- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2635/2635] fs/nfs/dir.c:1498:6: warning: no previous prototype for 'nfs_check_have_lookup_cache_flag'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e46fbbc0ad301c3517340bf966d39b8493a2ebb0 commit: 18e360871c3f648ecb0d8cc9b23fd4268a64c17f [2635/2635] add enfs feature config: x86_64-randconfig-2006-20250804 (https://download.01.org/0day-ci/archive/20250804/202508041629.6wf4G1eb-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041629.6wf4G1eb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041629.6wf4G1eb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/nfs/dir.c:1498:6: warning: no previous prototype for 'nfs_check_have_lookup_cache_flag' [-Wmissing-prototypes] 1498 | bool nfs_check_have_lookup_cache_flag(struct nfs_server *server, int flag) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/nfs_check_have_lookup_cache_flag +1498 fs/nfs/dir.c 1497 > 1498 bool nfs_check_have_lookup_cache_flag(struct nfs_server *server, int flag) 1499 { 1500 #if IS_ENABLED(CONFIG_ENFS) 1501 return enfs_check_have_lookup_cache_flag(server, flag); 1502 #else 1503 return (server->flags & NFS_MOUNT_LOOKUP_CACHE_NONE); 1504 #endif 1505 } 1506 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2635/2635] include/linux/virtcca_cvm_domain.h:69:51: warning: declaration of 'struct pci_dev' will not be visible outside of this function
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e46fbbc0ad301c3517340bf966d39b8493a2ebb0 commit: c5161d7e11a7e30755b2ec55aaebfd500193cbbc [2635/2635] virtCCA supports SR-IOV in CoDA scenarios. config: x86_64-randconfig-2004-20250804 (https://download.01.org/0day-ci/archive/20250804/202508041601.9q74wpPL-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041601.9q74wpPL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041601.9q74wpPL-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from net/sunrpc/sched.c:24: >> include/linux/virtcca_cvm_domain.h:69:51: warning: declaration of 'struct pci_dev' will not be visible outside of this function [-Wvisibility] 69 | static inline int virtcca_add_coda_pci_dev(struct pci_dev *pdev) | ^ 1 warning generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +69 include/linux/virtcca_cvm_domain.h 68 > 69 static inline int virtcca_add_coda_pci_dev(struct pci_dev *pdev) 70 { 71 return 0; 72 } 73 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION ba07135cf74b1424e2f7f0c60e59c5b206ab320c
by kernel test robot 04 Aug '25

04 Aug '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: ba07135cf74b1424e2f7f0c60e59c5b206ab320c !17040 net: ch9200: fix uninitialised access during mii_nway_restart Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202507150036.2TFl4VP9-lkp@intel.com crypto/aegis128.o: warning: objtool: missing symbol for section .init.text drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:184:13: error: variable 'fault_level' set but not used [-Werror=unused-but-set-variable] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:185:13: error: variable 'pcie_src' set but not used [-Werror=unused-but-set-variable] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:384:5: error: no previous prototype for 'sss_init_hwdev' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:487:6: error: no previous prototype for 'sss_deinit_hwdev' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:518:6: error: no previous prototype for 'sss_hwdev_stop' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:531:6: error: no previous prototype for 'sss_hwdev_detach' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_init.c:539:6: error: no previous prototype for 'sss_hwdev_shutdown' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_io_flush.c:91:5: error: no previous prototype for 'sss_hwdev_flush_io' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_mgmt_info.c:54:5: error: no previous prototype for 'sss_init_mgmt_info' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_mgmt_info.c:90:6: error: no previous prototype for 'sss_deinit_mgmt_info' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:682:5: error: no previous prototype for 'sss_sync_send_adm_msg' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:689:5: error: no previous prototype for 'sss_hwif_init_adm' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:738:6: error: no previous prototype for 'sss_hwif_deinit_adm' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:752:6: error: no previous prototype for 'sss_complete_adm_event' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:130:13: error: no previous prototype for 'sss_ceq_intr_handle' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:95:6: error: no previous prototype for 'sss_init_ceqe_desc' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:277:5: error: no previous prototype for 'sss_reinit_ctrlq_ctx' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:367:6: error: no previous prototype for 'sss_deinit_ctrlq' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:501:5: error: no previous prototype for 'sss_init_ctrlq_channel' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:538:6: error: no previous prototype for 'sss_deinit_ctrlq_channel' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:547:6: error: no previous prototype for 'sss_ctrlq_flush_sync_cmd' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:573:5: error: no previous prototype for 'sss_wait_ctrlq_stop' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:104:4: error: no previous prototype for 'sss_get_pcie_itf_id' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:113:20: error: no previous prototype for 'sss_get_func_type' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:131:5: error: no previous prototype for 'sss_get_glb_pf_vf_offset' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:140:4: error: no previous prototype for 'sss_get_ppf_id' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:15:5: error: no previous prototype for 'sss_alloc_db_addr' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:37:6: error: no previous prototype for 'sss_free_db_addr' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:52:6: error: no previous prototype for 'sss_chip_set_msix_auto_mask' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:70:6: error: no previous prototype for 'sss_chip_set_msix_state' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:86:5: error: no previous prototype for 'sss_get_global_func_id' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:95:4: error: no previous prototype for 'sss_get_pf_id_of_vf' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_irq.c:111:6: error: no previous prototype for 'sss_deinit_irq_info' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_irq.c:54:5: error: no previous prototype for 'sss_init_irq_info' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:252:5: error: no previous prototype for 'sss_init_func_mbx_msg' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:401:5: error: no previous prototype for 'sss_hwif_init_mbx' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:449:6: error: no previous prototype for 'sss_hwif_deinit_mbx' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:872:6: error: no previous prototype for 'sss_recv_mbx_aeq_handler' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mgmt_init.c:248:6: error: no previous prototype for 'sss_mgmt_msg_aeqe_handler' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mgmt_init.c:271:6: error: no previous prototype for 'sss_force_complete_all' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mgmt_init.c:290:6: error: no previous prototype for 'sss_flush_mgmt_workq' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_error.c:34:18: error: no previous prototype for 'sss_detect_pci_error' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:37:6: error: no previous prototype for 'sss_init_uld_lock' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:42:6: error: no previous prototype for 'sss_lock_uld' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:47:6: error: no previous prototype for 'sss_unlock_uld' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:52:14: error: no previous prototype for 'sss_get_uld_names' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:57:22: error: no previous prototype for 'sss_get_uld_info' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:62:6: error: no previous prototype for 'sss_attach_is_enable' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:5: error: no previous prototype for 'sss_attach_uld_driver' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:548:5: error: no previous prototype for 'sss_pci_probe' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:120:6: error: no previous prototype for 'sss_detach_all_uld_driver' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:138:6: error: no previous prototype for 'sss_dettach_uld_dev' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:179:6: error: no previous prototype for 'sss_deinit_function' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:200:6: error: no previous prototype for 'sss_unmap_pci_bar' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:211:5: error: no previous prototype for 'sss_deinit_adapter' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:237:6: error: no previous prototype for 'sss_deinit_pci_dev' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:249:6: error: no previous prototype for 'sss_pci_remove' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_remove.c:90:6: error: no previous prototype for 'sss_detach_uld_driver' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_shutdown.c:28:6: error: no previous prototype for 'sss_pci_shutdown' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool.c:467:6: error: no previous prototype for 'sss_nic_set_ethtool_ops' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_api.c:644:5: error: no previous prototype for 'sss_nic_finish_loop_test' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:120:5: error: no previous prototype for 'sss_nic_set_link_ksettings' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:44:5: error: no previous prototype for 'sss_nic_get_sset_count' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:62:6: error: no previous prototype for 'sss_nic_get_ethtool_stats' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:78:6: error: no previous prototype for 'sss_nic_get_strings' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:98:5: error: no previous prototype for 'sss_nic_get_link_ksettings' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_filter.c:468:6: error: no previous prototype for 'sss_nic_set_rx_mode_work' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_filter.c:67:6: error: no previous prototype for 'sss_nic_clean_mac_list_filter' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_irq.c:266:5: error: no previous prototype for 'sss_nic_request_qp_irq' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_irq.c:311:6: error: no previous prototype for 'sss_nic_release_qp_irq' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: error: no previous prototype for 'get_nic_uld_info' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: error: no previous prototype for 'sss_nic_port_module_cable_plug' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: error: no previous prototype for 'sss_nic_port_module_cable_unplug' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: error: no previous prototype for 'sss_nic_port_module_link_err' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:297:5: error: no previous prototype for 'sss_nic_ndo_vlan_rx_add_vid' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:318:5: error: no previous prototype for 'sss_nic_ndo_vlan_rx_kill_vid' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:506:5: error: no previous prototype for 'sss_nic_ndo_set_vf_link_state' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:787:6: error: no previous prototype for 'sss_nic_set_netdev_ops' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:795:6: error: no previous prototype for 'sss_nic_is_netdev_ops_match' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:350:6: error: no previous prototype for 'sss_nic_flush_tcam_list' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:366:6: error: no previous prototype for 'sss_nic_flush_tcam_node_list' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:382:6: error: no previous prototype for 'sss_nic_flush_rx_flow_rule' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:397:6: error: no previous prototype for 'sss_nic_flush_tcam' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:797:5: error: no previous prototype for 'sss_nic_ethtool_update_flow' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:842:5: error: no previous prototype for 'sss_nic_ethtool_delete_flow' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:864:5: error: no previous prototype for 'sss_nic_ethtool_get_flow' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:887:5: error: no previous prototype for 'sss_nic_ethtool_get_all_flows' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:905:6: error: no previous prototype for 'sss_nic_validate_channel_setting_in_ntuple' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:136:6: error: no previous prototype for 'sss_nic_free_rq_res_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:208:5: error: no previous prototype for 'sss_nic_init_rq_desc_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:235:6: error: no previous prototype for 'sss_nic_free_rq_desc_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:241:5: error: no previous prototype for 'sss_nic_alloc_rq_desc_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:267:5: error: no previous prototype for 'sss_nic_update_rx_rss' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:282:6: error: no previous prototype for 'sss_nic_reset_rx_rss' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_init.c:80:5: error: no previous prototype for 'sss_nic_alloc_rq_res_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:6: error: no previous prototype for 'sss_nic_rq_watchdog_handler' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:104:6: error: no previous prototype for 'sss_nic_init_all_sq' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:128:5: error: no previous prototype for 'sss_nic_alloc_sq_desc_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:153:6: error: no previous prototype for 'sss_nic_free_sq_desc_group' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:200:6: error: no previous prototype for 'sss_nic_flush_all_sq' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:42:5: error: no previous prototype for 'sss_nic_alloc_sq_resource' [-Werror=missing-prototypes] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx_init.c:87:6: error: no previous prototype for 'sss_nic_free_sq_resource' [-Werror=missing-prototypes] samples/vfio-mdev/mdpy-fb.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_io_flush.c:error:no-previous-prototype-for-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_mgmt_info.c:error:no-previous-prototype-for-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_mgmt_info.c:error:no-previous-prototype-for-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:error:no-previous-prototype-for-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:error:no-previous-prototype-for-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:error:no-previous-prototype-for-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:error:no-previous-prototype-for-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:error:no-previous-prototype-for-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:error:no-previous-prototype-for-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_irq.c:error:no-previous-prototype-for-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_irq.c:error:no-previous-prototype-for-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mgmt_init.c:error:no-previous-prototype-for-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mgmt_init.c:error:no-previous-prototype-for-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mgmt_init.c:error:no-previous-prototype-for-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_error.c:error:no-previous-prototype-for-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_probe.c:error:no-previous-prototype-for-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_probe.c:error:no-previous-prototype-for-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_shutdown.c:error:no-previous-prototype-for-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool.c:error:no-previous-prototype-for-sss_nic_set_ethtool_ops | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_api.c:error:no-previous-prototype-for-sss_nic_finish_loop_test | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.c:error:no-previous-prototype-for-sss_nic_get_ethtool_stats | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.c:error:no-previous-prototype-for-sss_nic_get_link_ksettings | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.c:error:no-previous-prototype-for-sss_nic_get_sset_count | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.c:error:no-previous-prototype-for-sss_nic_get_strings | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.c:error:no-previous-prototype-for-sss_nic_set_link_ksettings | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_filter.c:error:no-previous-prototype-for-sss_nic_clean_mac_list_filter | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_filter.c:error:no-previous-prototype-for-sss_nic_set_rx_mode_work | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_irq.c:error:no-previous-prototype-for-sss_nic_release_qp_irq | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_irq.c:error:no-previous-prototype-for-sss_nic_request_qp_irq | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:no-previous-prototype-for-get_nic_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:no-previous-prototype-for-sss_nic_port_module_cable_plug | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:no-previous-prototype-for-sss_nic_port_module_cable_unplug | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:no-previous-prototype-for-sss_nic_port_module_link_err | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:error:no-previous-prototype-for-sss_nic_is_netdev_ops_match | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:error:no-previous-prototype-for-sss_nic_ndo_set_vf_link_state | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:error:no-previous-prototype-for-sss_nic_ndo_vlan_rx_add_vid | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:error:no-previous-prototype-for-sss_nic_ndo_vlan_rx_kill_vid | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:error:no-previous-prototype-for-sss_nic_set_netdev_ops | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_delete_flow | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_get_all_flows | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_get_flow | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_update_flow | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_rx_flow_rule | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_tcam | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_tcam_list | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_tcam_node_list | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_validate_channel_setting_in_ntuple | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_alloc_rq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_alloc_rq_res_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_free_rq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_free_rq_res_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_init_rq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_reset_rx_rss | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_update_rx_rss | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_reset.c:error:no-previous-prototype-for-sss_nic_rq_watchdog_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_alloc_sq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_alloc_sq_resource | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_flush_all_sq | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_free_sq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_free_sq_resource | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_init_all_sq | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- arm64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250804 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250804 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250804 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-uaccess.h:warning:abs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:addr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ai-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:attr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:blk-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:cap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:cd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:dom-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:hypercall-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:i-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:irq_event-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kdata-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ke-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kvm_userspace_mem-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:log-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mmapcmd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ms_info-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:msf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:msi-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:op-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:policy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:q-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ra-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:routing-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:space_args-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:transid-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uffdio_api-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uffdio_copy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uffdio_register-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uffdio_unregister-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uffdio_wake-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uffdio_zeropage-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:user_auxv-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:volctrl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:zone-may-be-used-uninitialized | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa |-- x86_64-allnoconfig | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-001-20250804 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20250804 | |-- block-bfq-cgroup.o:warning:objtool:missing-symbol-for-section-.text | |-- block-ioctl.o:warning:objtool:missing-symbol-for-section-.text | |-- block-partitions-check.o:warning:objtool:missing-symbol-for-section-.text | |-- block-scsi_ioctl.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | |-- mm-rodata_test.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-rhel-9.4-rust |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool elapsed time: 724m configs tested: 17 configs skipped: 122 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 defconfig gcc-15.1.0 arm64 randconfig-001-20250804 gcc-6.5.0 arm64 randconfig-002-20250804 gcc-11.5.0 arm64 randconfig-003-20250804 gcc-11.5.0 arm64 randconfig-004-20250804 gcc-14.3.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250804 clang-20 x86_64 buildonly-randconfig-002-20250804 gcc-12 x86_64 buildonly-randconfig-003-20250804 gcc-12 x86_64 buildonly-randconfig-004-20250804 gcc-12 x86_64 buildonly-randconfig-005-20250804 clang-20 x86_64 buildonly-randconfig-006-20250804 gcc-12 x86_64 defconfig gcc-11 x86_64 rhel-9.4-rust clang-22 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1743/1743] kernel/trace/bpf_trace.c:1273:5: warning: no previous prototype for 'bpf_event_notify'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba07135cf74b1424e2f7f0c60e59c5b206ab320c commit: 00d0f1b149a5201c072e868915c76f909c11c38f [1743/1743] bpf: support raw tracepoints in modules config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250804/202508041528.hcdsgsEh-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041528.hcdsgsEh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041528.hcdsgsEh-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/bpf_trace.c:1273:5: warning: no previous prototype for 'bpf_event_notify' [-Wmissing-prototypes] 1273 | int bpf_event_notify(struct notifier_block *nb, unsigned long op, void *module) | ^~~~~~~~~~~~~~~~ >> kernel/trace/bpf_trace.c:1312:12: warning: no previous prototype for 'bpf_event_init' [-Wmissing-prototypes] 1312 | int __init bpf_event_init(void) | ^~~~~~~~~~~~~~ vim +/bpf_event_notify +1273 kernel/trace/bpf_trace.c 1271 1272 #ifdef CONFIG_MODULES > 1273 int bpf_event_notify(struct notifier_block *nb, unsigned long op, void *module) 1274 { 1275 struct bpf_trace_module *btm, *tmp; 1276 struct module *mod = module; 1277 1278 if (mod->num_bpf_raw_events == 0 || 1279 (op != MODULE_STATE_COMING && op != MODULE_STATE_GOING)) 1280 return 0; 1281 1282 mutex_lock(&bpf_module_mutex); 1283 1284 switch (op) { 1285 case MODULE_STATE_COMING: 1286 btm = kzalloc(sizeof(*btm), GFP_KERNEL); 1287 if (btm) { 1288 btm->module = module; 1289 list_add(&btm->list, &bpf_trace_modules); 1290 } 1291 break; 1292 case MODULE_STATE_GOING: 1293 list_for_each_entry_safe(btm, tmp, &bpf_trace_modules, list) { 1294 if (btm->module == module) { 1295 list_del(&btm->list); 1296 kfree(btm); 1297 break; 1298 } 1299 } 1300 break; 1301 } 1302 1303 mutex_unlock(&bpf_module_mutex); 1304 1305 return 0; 1306 } 1307 1308 static struct notifier_block bpf_module_nb = { 1309 .notifier_call = bpf_event_notify, 1310 }; 1311 > 1312 int __init bpf_event_init(void) 1313 { 1314 register_module_notifier(&bpf_module_nb); 1315 return 0; 1316 } 1317 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH -next RFC] irqchip/gic-v5: Improve the SPI alloc efficiency
by Jinjie Ruan 04 Aug '25

04 Aug '25

If the GICv5 system has a large number of PEs and IRS components, traversing the linked list to find the irs_data corresponding to a specific SPI interrupt will be very slow. Since the maximum number of IRS nodes, the minimum and maximum SPI interrupt numbers for each IRS is known during the initialization of the IRS nodes, sort the IRS nodes by interrupt number at the initial stage. This way, when allocating SPI interrupts, we can directly perform a binary search on the irs_data using the SPI interrupt number with O(log N) complexity. Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v5-irs.c | 85 +++++++++++++++++++++--------- include/linux/irqchip/arm-gic-v5.h | 2 + 2 files changed, 61 insertions(+), 26 deletions(-) diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c index f845415f9143..5f0324467142 100644 --- a/drivers/irqchip/irq-gic-v5-irs.c +++ b/drivers/irqchip/irq-gic-v5-irs.c @@ -8,6 +8,7 @@ #include <linux/log2.h> #include <linux/of.h> #include <linux/of_address.h> +#include <linux/sort.h> #include <linux/irqchip.h> #include <linux/irqchip/arm-gic-v5.h> @@ -22,7 +23,7 @@ #define IRS_FLAGS_NON_COHERENT BIT(0) static DEFINE_PER_CPU_READ_MOSTLY(struct gicv5_irs_chip_data *, per_cpu_irs_data); -static LIST_HEAD(irs_nodes); +static struct gicv5_irs_chip_data **irs_nodes; static u32 irs_readl_relaxed(struct gicv5_irs_chip_data *irs_data, const u32 reg_offset) @@ -382,17 +383,19 @@ int gicv5_irs_cpu_to_iaffid(int cpuid, u16 *iaffid) struct gicv5_irs_chip_data *gicv5_irs_lookup_by_spi_id(u32 spi_id) { - struct gicv5_irs_chip_data *irs_data; - u32 min, max; - - list_for_each_entry(irs_data, &irs_nodes, entry) { - if (!irs_data->spi_range) - continue; - - min = irs_data->spi_min; - max = irs_data->spi_min + irs_data->spi_range - 1; - if (spi_id >= min && spi_id <= max) - return irs_data; + int l = 0, r = gicv5_global_data.irs_count - 1; + + while (l <= r) { + int m = (l + r) >> 1; + + if (irs_nodes[m]->spi_min <= spi_id && + spi_id <= irs_nodes[m]->spi_max) { + return irs_nodes[m]; + } else if (spi_id < irs_nodes[m]->spi_min) { + r = m - 1; + } else { + l = m + 1; + } } return NULL; @@ -489,7 +492,7 @@ void gicv5_irs_syncr(void) struct gicv5_irs_chip_data *irs_data; u32 syncr; - irs_data = list_first_entry_or_null(&irs_nodes, struct gicv5_irs_chip_data, entry); + irs_data = irs_nodes[0]; if (WARN_ON_ONCE(!irs_data)) return; @@ -673,7 +676,7 @@ static void irs_setup_pri_bits(u32 idr1) } } -static int __init gicv5_irs_init(struct device_node *node) +static int __init gicv5_irs_init(struct device_node *node, unsigned int *num) { struct gicv5_irs_chip_data *irs_data; void __iomem *irs_base; @@ -725,11 +728,11 @@ static int __init gicv5_irs_init(struct device_node *node) irs_data->spi_range = FIELD_GET(GICV5_IRS_IDR6_SPI_IRS_RANGE, idr); if (irs_data->spi_range) { + irs_data->spi_max = irs_data->spi_min + irs_data->spi_range - 1; pr_info("%s detected SPI range [%u-%u]\n", of_node_full_name(node), irs_data->spi_min, - irs_data->spi_min + - irs_data->spi_range - 1); + irs_data->spi_max); } /* @@ -737,8 +740,7 @@ static int __init gicv5_irs_init(struct device_node *node) * Global properties (iaffid_bits, global spi count) are guaranteed to * be consistent across IRSes by the architecture. */ - if (list_empty(&irs_nodes)) { - + if (*num == 0) { idr = irs_readl_relaxed(irs_data, GICV5_IRS_IDR1); irs_setup_pri_bits(idr); @@ -752,7 +754,7 @@ static int __init gicv5_irs_init(struct device_node *node) pr_debug("Detected %u SPIs globally\n", spi_count); } - list_add_tail(&irs_data->entry, &irs_nodes); + irs_nodes[*num] = irs_data; return 0; @@ -765,12 +767,14 @@ static int __init gicv5_irs_init(struct device_node *node) void __init gicv5_irs_remove(void) { - struct gicv5_irs_chip_data *irs_data, *tmp_data; + struct gicv5_irs_chip_data *irs_data; + int i; gicv5_free_lpi_domain(); gicv5_deinit_lpis(); - list_for_each_entry_safe(irs_data, tmp_data, &irs_nodes, entry) { + for (i = 0; i < gicv5_global_data.irs_count; i++) { + irs_data = irs_nodes[i]; iounmap(irs_data->irs_base); list_del(&irs_data->entry); kfree(irs_data); @@ -782,8 +786,7 @@ int __init gicv5_irs_enable(void) struct gicv5_irs_chip_data *irs_data; int ret; - irs_data = list_first_entry_or_null(&irs_nodes, - struct gicv5_irs_chip_data, entry); + irs_data = irs_nodes[0]; if (!irs_data) return -ENODEV; @@ -799,24 +802,54 @@ int __init gicv5_irs_enable(void) void __init gicv5_irs_its_probe(void) { struct gicv5_irs_chip_data *irs_data; + int i; - list_for_each_entry(irs_data, &irs_nodes, entry) + for (i = 0; i < gicv5_global_data.irs_count; i++) { + irs_data = irs_nodes[i]; gicv5_its_of_probe(to_of_node(irs_data->fwnode)); + } +} + +static int spi_min_cmp(const void *a, const void *b) +{ + const struct gicv5_irs_chip_data *irs_data1 = a; + const struct gicv5_irs_chip_data *irs_data2 = b; + + return irs_data1->spi_min - irs_data2->spi_min; } int __init gicv5_irs_of_probe(struct device_node *parent) { + unsigned int irs_count = 0, num = 0; struct device_node *np; int ret; + for_each_available_child_of_node(parent, np) { + if (of_device_is_compatible(np, "arm,gic-v5-irs")) + irs_count++; + } + + if (irs_count == 0) + return -ENODEV; + + irs_nodes = kzalloc(irs_count * sizeof(struct gicv5_irs_chip_data *), + __GFP_ZERO); + if (!irs_nodes) + return -ENOMEM; + for_each_available_child_of_node(parent, np) { if (!of_device_is_compatible(np, "arm,gic-v5-irs")) continue; - ret = gicv5_irs_init(np); + ret = gicv5_irs_init(np, &num); if (ret) pr_err("Failed to init IRS %s\n", np->full_name); + else + num++; } - return list_empty(&irs_nodes) ? -ENODEV : 0; + sort(irs_nodes, num, sizeof(struct gicv5_irs_chip_data *), spi_min_cmp, NULL); + gicv5_global_data.irs_count = num; + + return num > 0 ? 0 : -ENODEV; } diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h index 68ddcdb1cec5..6661b583b8d8 100644 --- a/include/linux/irqchip/arm-gic-v5.h +++ b/include/linux/irqchip/arm-gic-v5.h @@ -278,6 +278,7 @@ struct gicv5_chip_data { u8 cpuif_pri_bits; u8 cpuif_id_bits; u8 irs_pri_bits; + unsigned int irs_count; struct { __le64 *l1ist_addr; u32 l2_size; @@ -294,6 +295,7 @@ struct gicv5_irs_chip_data { void __iomem *irs_base; u32 flags; u32 spi_min; + u32 spi_max; u32 spi_range; raw_spinlock_t spi_config_lock; }; -- 2.34.1

1 0

[PATCH OLK-6.6] ioinf: inflight based relative controller
by Baokun Li 04 Aug '25

04 Aug '25

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICN84T -------------------------------- The demo no-weight version. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/Kconfig | 7 + block/Makefile | 1 + block/blk-ioinf.c | 964 +++++++++++++++++++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + 6 files changed, 978 insertions(+) create mode 100644 block/blk-ioinf.c diff --git a/block/Kconfig b/block/Kconfig index 7018fdcaa459..0990ff8b94f3 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -204,6 +204,13 @@ config BLK_CGROUP_LEGACY_IOCOST If unsure, say N. +config BLK_CGROUP_IOINFLIGHT + bool "Enable support for inflight based cgroup IO controller" + depends on BLK_CGROUP + select BLK_RQ_ALLOC_TIME + help + xxxx + config BLK_CGROUP_IOPRIO bool "Cgroup I/O controller for assigning an I/O priority class" depends on BLK_CGROUP diff --git a/block/Makefile b/block/Makefile index bfba1d2afc0e..eeea4092a5c0 100644 --- a/block/Makefile +++ b/block/Makefile @@ -21,6 +21,7 @@ obj-$(CONFIG_BLK_DEV_THROTTLING) += blk-throttle.o obj-$(CONFIG_BLK_CGROUP_IOPRIO) += blk-ioprio.o obj-$(CONFIG_BLK_CGROUP_IOLATENCY) += blk-iolatency.o obj-$(CONFIG_BLK_CGROUP_IOCOST) += blk-iocost.o +obj-$(CONFIG_BLK_CGROUP_IOINFLIGHT) += blk-ioinf.o obj-$(CONFIG_MQ_IOSCHED_DEADLINE) += mq-deadline.o obj-$(CONFIG_MQ_IOSCHED_KYBER) += kyber-iosched.o bfq-y := bfq-iosched.o bfq-wf2q.o bfq-cgroup.o diff --git a/block/blk-ioinf.c b/block/blk-ioinf.c new file mode 100644 index 000000000000..eec85b753886 --- /dev/null +++ b/block/blk-ioinf.c @@ -0,0 +1,964 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * IO inflight relative controller + */ + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/timer.h> +#include <linux/time64.h> +#include <linux/parser.h> +#include <linux/blk-cgroup.h> + +#include "blk-cgroup.h" +#include "blk-rq-qos.h" +#include "blk-mq.h" + +/* default weight for each cgroup */ +#define IOINF_DFL_WEIGHT 10 +/* default wake-up time in jiffies for backgroup job, see ioinf_timer_fn() */ +#define IOINF_TIMER_PERID 500 +/* default time in jiffies that cgroup will idle without any IO */ +#define MIN_SAMPLES 100 +#define MAX_BUSY_LEVEL 90 +#define MIN_BUSY_LEVEL -90 + +/* io.inf.qos controls */ +enum { + INF_ENABLE, + INF_INFLIGHT, + + QOS_ENABLE, + QOS_RLAT, + QOS_WLAT, + QOS_RPCT, + QOS_WPCT, + + NR_QOS_CTRL_PARAMS, +}; + +/* qos control params */ +struct ioinf_params { + bool enabled; + bool qos_enabled; + u32 inflight; + u64 rlat; + u64 wlat; + u32 rpct; + u32 wpct; +}; + +struct ioinf_lat_stat { + u64 rmet; + u64 wmet; + u64 rmissed; + u64 wmissed; + u64 rlatency; + u64 wlatency; +}; + +struct ioinf_rq_wait { + struct rq_wait rqw; + u32 hinflight; +}; + +/* the global conrtol structure */ +struct ioinf { + struct rq_qos rqos; + + struct ioinf_params params; + /* real inflight with consideration of busy_level */ + u32 inflight; + + /* default time for ioinf_timer_fn */ + unsigned long inf_timer_perid; + struct timer_list inf_timer; + + /* global lock */ + spinlock_t lock; + + /* for offline cgroups */ + struct ioinf_rq_wait offline; + /* for online cgroups */ + struct ioinf_rq_wait online; + u32 max_inflight; + u32 last_max_inflight; + + struct ioinf_lat_stat last_stat; + struct ioinf_lat_stat __percpu *stat; + + int busy_level; + int last_busy_level; + int old_scale; +}; + +/* per disk-cgroup pair structure */ +struct ioinf_gq { + struct blkg_policy_data pd; + struct ioinf *inf; + + /* configured by user */ + u32 weight; +}; + +/* per cgroup structure, used to record default weight for all disks */ +struct ioinf_cgrp { + struct blkcg_policy_data cpd; + + /* if def_weight is 0, means it's offline */ + u32 dfl_weight; +}; + +/* scale inflight according to busy_level, from 1/10 to 10 */ +static const u8 scale_table[20] = { + [0] = 100, /* -90 */ + [1] = 90, /* -80 */ + [2] = 80, /* -70 */ + [3] = 70, /* -60 */ + [4] = 60, /* -50 */ + [5] = 50, /* -40 */ + [6] = 40, /* -30 */ + [7] = 30, /* -20 */ + [8] = 20, /* -10 */ + [9] = 10, /* 0 */ + [10] = 9, /* 10 */ + [11] = 8, /* 20 */ + [12] = 7, /* 30 */ + [13] = 6, /* 40 */ + [14] = 5, /* 50 */ + [15] = 4, /* 60 */ + [16] = 3, /* 70 */ + [17] = 2, /* 80 */ + [18] = 1, /* 90 */ +}; + +static struct blkcg_policy blkcg_policy_ioinf; + +static struct ioinf *rqos_to_inf(struct rq_qos *rqos) +{ + return container_of(rqos, struct ioinf, rqos); +} + +static struct ioinf *q_to_inf(struct request_queue *q) +{ + return rqos_to_inf(rq_qos_id(q, RQ_QOS_INFLIGHT)); +} + +static struct ioinf_gq *pd_to_infg(struct blkg_policy_data *pd) +{ + if (!pd) + return NULL; + + return container_of(pd, struct ioinf_gq, pd); +} + +static struct ioinf_gq *blkg_to_infg(struct blkcg_gq *blkg) +{ + return pd_to_infg(blkg_to_pd(blkg, &blkcg_policy_ioinf)); +} + +static struct blkcg_gq *infg_to_blkg(struct ioinf_gq *infg) +{ + return pd_to_blkg(&infg->pd); +} + +static struct ioinf_cgrp *blkcg_to_infcg(struct blkcg *blkcg) +{ + struct blkcg_policy_data *cpd = + blkcg_to_cpd(blkcg, &blkcg_policy_ioinf); + + return container_of(cpd, struct ioinf_cgrp, cpd); +} + +static struct blkcg_gq *ioinf_bio_blkg(struct bio *bio) +{ + struct blkcg_gq *blkg = bio->bi_blkg; + + if (!blkg || !blkg->online) + return NULL; + + if (blkg->blkcg->css.cgroup->level == 0) + return NULL; + + return blkg; +} + +static struct ioinf_gq *ioinf_bio_infg(struct bio *bio) +{ + struct ioinf_gq *infg; + struct blkcg_gq *blkg = ioinf_bio_blkg(bio); + + if (!blkg) + return NULL; + + infg = blkg_to_infg(blkg); + if (!infg) + return NULL; + + return infg; +} + +static unsigned int atomic_inc_below_return(atomic_t *v, unsigned int below) +{ + unsigned int cur = atomic_read(v); + + for (;;) { + unsigned int old; + + if (cur >= below) + return below + 1; + + old = atomic_cmpxchg(v, cur, cur + 1); + if (old == cur) + break; + cur = old; + } + + return cur + 1; +} + +void ioinf_global_done(struct ioinf_rq_wait *ioinf_rqw) +{ + int inflight = atomic_dec_return(&ioinf_rqw->rqw.inflight); + + if (inflight < ioinf_rqw->hinflight && + wq_has_sleeper(&ioinf_rqw->rqw.wait)) + wake_up_all(&ioinf_rqw->rqw.wait); +} + +static bool infg_offline(struct ioinf_gq *infg) +{ + struct ioinf_cgrp *infcg; + struct blkcg_gq *blkg; + + if (infg->weight != 0) + return false; + + /* if user doesn't set per disk weight, use the cgroup default weight */ + blkg = infg_to_blkg(infg); + infcg = blkcg_to_infcg(blkg->blkcg); + + return infcg->dfl_weight == 0; +} + +static struct ioinf_rq_wait *rqw_to_ioinf_rqw(struct rq_wait *rqw) +{ + return container_of(rqw, struct ioinf_rq_wait, rqw); +} + +static bool ioinf_global_inflight_cb(struct rq_wait *rqw, void *private_data) +{ + struct ioinf_rq_wait *ioinf_rqw = rqw_to_ioinf_rqw(rqw); + struct ioinf *inf = private_data; + u32 inflight; + u32 limit; + + if (ioinf_rqw == &inf->offline) + return rq_wait_inc_below(rqw, ioinf_rqw->hinflight); +retry: + limit = ioinf_rqw->hinflight; + inflight = atomic_inc_below_return(&rqw->inflight, limit); + if (inflight > inf->max_inflight) + inf->max_inflight = inflight; + if (inflight <= limit) + return true; + + if (ioinf_rqw->hinflight < inf->inflight - 1) { + /* Stop lend inflight budget to offline groups */ + inf->offline.hinflight = 1; + ioinf_rqw->hinflight = inf->inflight - 1; + goto retry; + } + + return false; +} + +static void ioinf_global_cleanup_cb(struct rq_wait *rqw, void *private_data) +{ + struct ioinf_rq_wait *ioinf_rqw = rqw_to_ioinf_rqw(rqw); + + ioinf_global_done(ioinf_rqw); +} + +static void +ioinf_throttle_global(struct ioinf *inf, struct ioinf_rq_wait *ioinf_rqw) +{ + rq_qos_wait(&ioinf_rqw->rqw, inf, ioinf_global_inflight_cb, + ioinf_global_cleanup_cb, NULL); + + /* + * In case no online cgroup is active, daemon will adjust all the + * budget to offline cgroup. + */ + timer_reduce(&inf->inf_timer, jiffies + inf->inf_timer_perid); +} + +static void ioinf_rqos_throttle(struct rq_qos *rqos, struct bio *bio) +{ + struct ioinf *inf = rqos_to_inf(rqos); + struct ioinf_gq *infg = ioinf_bio_infg(bio); + + if (!inf->params.enabled || !infg) + return; + + if (infg_offline(infg)) + ioinf_throttle_global(inf, &inf->offline); + else + ioinf_throttle_global(inf, &inf->online); +} + +static void ioinf_rqos_track(struct rq_qos *rqos, struct request *rq, + struct bio *bio) +{ + struct blkcg_gq *blkg = ioinf_bio_blkg(bio); + + if (!blkg) + return; + + rq->blkg = blkg; +} + +static void ioinf_record_lat(struct ioinf *inf, struct request *rq) +{ + u64 lat; + + lat = rq->io_end_time_ns ? rq->io_end_time_ns : blk_time_get_ns(); + lat -= rq->alloc_time_ns; + + if (!inf->params.qos_enabled) + return; + + switch(req_op(rq)) { + case REQ_OP_READ: + if (lat > inf->params.rlat) + this_cpu_inc(inf->stat->rmissed); + else + this_cpu_inc(inf->stat->rmet); + this_cpu_add(inf->stat->rlatency, lat); + break; + case REQ_OP_WRITE: + if (lat > inf->params.wlat) + this_cpu_inc(inf->stat->wmissed); + else + this_cpu_inc(inf->stat->wmet); + this_cpu_add(inf->stat->wlatency, lat); + break; + default: + break; + } +} + +static struct ioinf_lat_stat ioinf_get_lat(struct ioinf *inf) +{ + struct ioinf_lat_stat stat = {0}; + int cpu; + + for_each_possible_cpu(cpu) { + struct ioinf_lat_stat *pstat = per_cpu_ptr(inf->stat, cpu); + + stat.rmet += pstat->rmet; + stat.rmissed += pstat->rmissed; + stat.wmet += pstat->wmet; + stat.wmissed += pstat->wmissed; + stat.rlatency += pstat->rlatency; + stat.wlatency += pstat->wlatency; + } + + return stat; +} + +static void ioinf_rqos_done(struct rq_qos *rqos, struct request *rq) +{ + struct blkcg_gq *blkg = rq->blkg; + struct ioinf_gq *infg; + struct ioinf *inf; + + if (!blkg) + return; + + infg = blkg_to_infg(blkg); + inf = infg->inf; + if (infg_offline(infg)) { + ioinf_global_done(&inf->offline); + } else { + ioinf_global_done(&inf->online); + ioinf_record_lat(inf, rq); + } + + rq->blkg = NULL; +} + +static void ioinf_rqos_exit(struct rq_qos *rqos) +{ + struct ioinf *inf = rqos_to_inf(rqos); + + blkcg_deactivate_policy(rqos->disk, &blkcg_policy_ioinf); + + del_timer_sync(&inf->inf_timer); + free_percpu(inf->stat); + kfree(inf); +} + +static int ioinf_stat_show(void *data, struct seq_file *m) +{ + struct rq_qos *rqos = data; + struct ioinf *inf = rqos_to_inf(rqos); + + spin_lock_irq(&inf->lock); + + seq_printf(m, "busy_level %d inflight %u->%u\n", inf->busy_level, + inf->params.inflight, inf->inflight); + seq_printf(m, "online inflight %u/%d\n", + atomic_read(&inf->online.rqw.inflight), + inf->online.hinflight); + seq_printf(m, "offline inflight %u/%d\n", + atomic_read(&inf->offline.rqw.inflight), + inf->offline.hinflight); + + spin_unlock_irq(&inf->lock); + + return 0; +} + +static int ioinf_lat_show(void *data, struct seq_file *m) +{ + struct rq_qos *rqos = data; + struct ioinf *inf = rqos_to_inf(rqos); + struct ioinf_lat_stat stat; + struct ioinf_lat_stat *last; + u64 nr_read_io, nr_write_io; + u64 rlatency = 0, wlatency = 0; + + if (!inf->params.qos_enabled) + return 0; + + stat = ioinf_get_lat(inf); + last = &inf->last_stat; + seq_printf(m, "qos lat: %llu %llu %llu %llu\n", + stat.rmet, stat.rmissed, stat.wmet, stat.wmissed); + + nr_read_io = stat.rmet - last->rmet; + nr_read_io += stat.rmissed - last->rmissed; + if (nr_read_io > 0) + rlatency = (stat.rlatency - last->rlatency) / nr_read_io; + + nr_write_io = stat.wmet - last->wmet; + nr_write_io += stat.wmissed - last->wmissed; + if (nr_write_io > 0) + wlatency = (stat.wlatency - last->wlatency) / nr_write_io; + + seq_printf(m, "online average latency: (%llu-%llu) (%llu-%llu)\n", + nr_read_io, rlatency, nr_write_io, wlatency); + + return 0; +} + +static const struct blk_mq_debugfs_attr ioinf_debugfs_attrs[] = { + {"stat", 0400, ioinf_stat_show}, + {"lat", 0400, ioinf_lat_show}, + {}, +}; + +static struct rq_qos_ops ioinf_rqos_ops = { + .throttle = ioinf_rqos_throttle, + .done = ioinf_rqos_done, + .track = ioinf_rqos_track, + .exit = ioinf_rqos_exit, + +#ifdef CONFIG_BLK_DEBUG_FS + .debugfs_attrs = ioinf_debugfs_attrs, +#endif +}; + +static void +ioinf_set_global_inflight(struct ioinf_rq_wait *ioinf_rqw, u32 inflight) +{ + bool budget_increased = false; + + if (inflight > ioinf_rqw->hinflight) + budget_increased = true; + + ioinf_rqw->hinflight = inflight; + + if (budget_increased && wq_has_sleeper(&ioinf_rqw->rqw.wait)) + wake_up_all(&ioinf_rqw->rqw.wait); +} + +static bool ioinf_online_busy(struct ioinf *inf) +{ + struct ioinf_lat_stat stat; + u32 met, missed; + bool ret = false; + + if (!inf->params.qos_enabled) + return false; + + stat = ioinf_get_lat(inf); + met = stat.rmet - inf->last_stat.rmet; + missed = stat.rmissed - inf->last_stat.rmissed; + + if (met + missed >= MIN_SAMPLES && + met * 100 < (met + missed) * inf->params.rpct) { + ret = true; + goto out; + } + + met = stat.wmet - inf->last_stat.wmet; + missed = stat.wmissed - inf->last_stat.wmissed; + + if (met + missed >= MIN_SAMPLES && + met * 100 < (met + missed) * inf->params.wpct) + ret = true; + +out: + inf->last_stat = stat; + return ret; +} + +static void ioinf_adjust_busy_level(struct ioinf *inf, int old_busy_level) +{ + int scale; + + inf->busy_level = clamp(inf->busy_level, -90, 90); + + if (inf->busy_level == old_busy_level) + return; + + scale = (inf->busy_level + 90) / 10; + if (scale == inf->old_scale) + return; + + scale = scale_table[scale]; + inf->old_scale = scale; + + inf->inflight = inf->params.inflight * scale / 10; +} + +static void ioinf_timer_global_fn(struct timer_list *timer) +{ + struct ioinf *inf = container_of(timer, struct ioinf, inf_timer); + bool busy = ioinf_online_busy(inf); + struct ioinf_rq_wait *online = &inf->online; + struct ioinf_rq_wait *offline = &inf->offline; + int old_busy_level = inf->busy_level; + unsigned long flags; + u32 last_max_inflight; + u32 new_budget; + + spin_lock_irqsave(&inf->lock, flags); + + /* First take back the offline budget. */ + if (busy && offline->hinflight > 1) { + offline->hinflight = 1; + ioinf_set_global_inflight(online, inf->inflight - 1); + goto unlock; + } + + if (busy) { /* slow down */ + int min_level = inf->busy_level + 1; + int max_level = MAX_BUSY_LEVEL; + + if (inf->last_busy_level > min_level) + max_level = inf->last_busy_level; + inf->last_busy_level = inf->busy_level; + inf->busy_level = (min_level + max_level) / 2; + } else if (inf->params.qos_enabled) { + int min_level = MIN_BUSY_LEVEL; + int max_level = inf->busy_level - 1; + + if (inf->last_busy_level < max_level) + min_level = inf->last_busy_level; + inf->last_busy_level = inf->busy_level; + inf->busy_level = (min_level + max_level) / 2; + } + ioinf_adjust_busy_level(inf, old_busy_level); + + last_max_inflight = inf->last_max_inflight; + new_budget = max(last_max_inflight, inf->max_inflight); + inf->last_max_inflight = max(last_max_inflight >> 1, inf->max_inflight); + inf->max_inflight = inf->max_inflight >> 1; + + if (busy || inf->inflight <= new_budget) { + offline->hinflight = 1; + ioinf_set_global_inflight(online, inf->inflight - 1); + } else { + ioinf_set_global_inflight(online, new_budget); + ioinf_set_global_inflight(offline, + inf->inflight - new_budget); + } +unlock: + spin_unlock_irqrestore(&inf->lock, flags); + mod_timer(&inf->inf_timer, jiffies + inf->inf_timer_perid); +} + +static void ioinf_timer_fn(struct timer_list *timer) +{ + ioinf_timer_global_fn(timer); +} + +static u32 ioinf_default_inflight(struct gendisk *disk) +{ + return max(disk->queue->nr_requests / 10, 30); +} + +static int blk_ioinf_init(struct gendisk *disk) +{ + struct ioinf *inf; + int ret; + + inf = kzalloc(sizeof(*inf), GFP_KERNEL); + if (!inf) + return -ENOMEM; + + inf->stat = alloc_percpu(struct ioinf_lat_stat); + if (!inf->stat) { + kfree(inf); + return -ENOMEM; + } + + spin_lock_init(&inf->lock); + inf->params.inflight = ioinf_default_inflight(disk); + inf->inflight = inf->params.inflight; + inf->inf_timer_perid = IOINF_TIMER_PERID; + inf->offline.hinflight = 1; + inf->old_scale = 9; + rq_wait_init(&inf->offline.rqw); + inf->online.hinflight = IOINF_DFL_WEIGHT; + rq_wait_init(&inf->online.rqw); + timer_setup(&inf->inf_timer, ioinf_timer_fn, 0); + + ret = rq_qos_add(&inf->rqos, disk, RQ_QOS_INFLIGHT, &ioinf_rqos_ops); + if (ret) + goto err_free_inf; + + ret = blkcg_activate_policy(disk, &blkcg_policy_ioinf); + if (ret) + goto err_del_qos; + return 0; + +err_del_qos: + rq_qos_del(&inf->rqos); +err_free_inf: + free_percpu(inf->stat); + kfree(inf); + return ret; +} + +static struct blkcg_policy_data *ioinf_cpd_alloc(gfp_t gfp) +{ + struct ioinf_cgrp *infcg = kzalloc(sizeof(*infcg), gfp); + + if (!infcg) + return NULL; + + infcg->dfl_weight = IOINF_DFL_WEIGHT; + return &infcg->cpd; +} + +static void ioinf_cpd_free(struct blkcg_policy_data *cpd) +{ + kfree(container_of(cpd, struct ioinf_cgrp, cpd)); +} + +static struct blkg_policy_data *ioinf_pd_alloc(struct gendisk *disk, + struct blkcg *blkcg, gfp_t gfp) +{ + struct ioinf_gq *infg = kzalloc_node(sizeof(*infg), gfp, disk->node_id); + + if (!infg) + return NULL; + + return &infg->pd; +} + +static void ioinf_pd_init(struct blkg_policy_data *pd) +{ + struct ioinf_gq *infg = pd_to_infg(pd); + struct blkcg_gq *blkg = pd_to_blkg(pd); + + infg->inf = q_to_inf(blkg->q); +} + +static void ioinf_pd_free(struct blkg_policy_data *pd) +{ + struct ioinf_gq *infg = pd_to_infg(pd); + + kfree(infg); +} + +static u64 ioinf_weight_prfill(struct seq_file *sf, struct blkg_policy_data *pd, + int off) +{ + const char *dname = blkg_dev_name(pd->blkg); + struct ioinf_gq *infg = pd_to_infg(pd); + + if (dname && infg->weight) + seq_printf(sf, "%s %u\n", dname, infg->weight); + + return 0; +} + +static int ioinf_weight_show(struct seq_file *sf, void *v) +{ + struct blkcg *blkcg = css_to_blkcg(seq_css(sf)); + struct ioinf_cgrp *infcg = blkcg_to_infcg(blkcg); + + seq_printf(sf, "default %u\n", infcg->dfl_weight); + blkcg_print_blkgs(sf, blkcg, ioinf_weight_prfill, &blkcg_policy_ioinf, + seq_cft(sf)->private, false); + + return 0; +} + +static ssize_t ioinf_weight_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, loff_t off) +{ + struct blkcg *blkcg = css_to_blkcg(of_css(of)); + struct ioinf_cgrp *infcg = blkcg_to_infcg(blkcg); + struct blkg_conf_ctx ctx; + struct ioinf_gq *infg; + int ret; + u32 v; + + if (!strchr(buf, ':')) { + if (!sscanf(buf, "default %u", &v) && !sscanf(buf, "%u", &v)) + return -EINVAL; + if (v < 0) + return -EINVAL; + + infcg->dfl_weight = v; + + return nbytes; + } + + blkg_conf_init(&ctx, buf); + ret = blkg_conf_prep(blkcg, &blkcg_policy_ioinf, &ctx); + if (ret) + return ret; + + infg = blkg_to_infg(ctx.blkg); + if (!strncmp(ctx.body, "default", 7)) { + v = IOINF_DFL_WEIGHT; + } else if (!sscanf(ctx.body, "%u", &v) || + v < 0 || v > CGROUP_WEIGHT_MAX) { + blkg_conf_exit(&ctx); + return -EINVAL; + } + + infg->weight = v; + blkg_conf_exit(&ctx); + return nbytes; +} + +static u64 ioinf_qos_prfill(struct seq_file *sf, struct blkg_policy_data *pd, + int off) +{ + const char *dname = blkg_dev_name(pd->blkg); + struct ioinf *inf = q_to_inf(pd->blkg->q); + struct ioinf_params params; + + if (!dname) + return 0; + + params = inf->params; + seq_printf(sf, "%s enable=%d inflight=%u qos_enable=%d", dname, + params.enabled, params.inflight, params.qos_enabled); + + if (inf->params.qos_enabled) + seq_printf(sf, " rlat=%llu rpct=%u wlat=%llu wpct=%u", + params.rlat, params.rpct, params.wlat, params.wpct); + + seq_putc(sf, '\n'); + return 0; +} + +static int ioinf_qos_show(struct seq_file *sf, void *v) +{ + struct blkcg *blkcg = css_to_blkcg(seq_css(sf)); + + blkcg_print_blkgs(sf, blkcg, ioinf_qos_prfill, + &blkcg_policy_ioinf, seq_cft(sf)->private, false); + return 0; +} + +static const match_table_t qos_ctrl_tokens = { + { INF_ENABLE, "enable=%u" }, + { INF_INFLIGHT, "inflight=%u" }, + { QOS_ENABLE, "qos_enable=%u" }, + { QOS_RLAT, "rlat=%u" }, + { QOS_WLAT, "wlat=%u" }, + { QOS_RPCT, "rpct=%u" }, + { QOS_WPCT, "wpct=%u" }, + { NR_QOS_CTRL_PARAMS, NULL }, +}; + +static ssize_t ioinf_qos_write(struct kernfs_open_file *of, char *input, + size_t nbytes, loff_t off) +{ + struct blkg_conf_ctx ctx; + struct gendisk *disk; + struct ioinf *inf; + struct ioinf_params params; + char *body, *p; + int ret; + + blkg_conf_init(&ctx, input); + + ret = blkg_conf_open_bdev(&ctx); + if (ret) + goto err; + + body = ctx.body; + disk = ctx.bdev->bd_disk; + if (!queue_is_mq(disk->queue)) { + ret = -EOPNOTSUPP; + goto err; + } + + inf = q_to_inf(disk->queue); + if (!inf) { + ret = blk_ioinf_init(disk); + if (ret) + goto err; + + inf = q_to_inf(disk->queue); + } + + params = inf->params; + + while ((p = strsep(&body, " \t\n"))) { + substring_t args[MAX_OPT_ARGS]; + s64 v; + + if (!*p) + continue; + + switch (match_token(p, qos_ctrl_tokens, args)) { + case INF_ENABLE: + if (match_u64(&args[0], &v)) + goto einval; + params.enabled = !!v; + continue; + case QOS_ENABLE: + if (match_u64(&args[0], &v)) + goto einval; + params.qos_enabled = !!v; + continue; + case INF_INFLIGHT: + if (match_u64(&args[0], &v)) + goto einval; + params.inflight = v; + continue; + case QOS_RLAT: + if (match_u64(&args[0], &v) || v == 0) + goto einval; + params.rlat = v; + continue; + case QOS_WLAT: + if (match_u64(&args[0], &v) || v == 0) + goto einval; + params.wlat = v; + continue; + case QOS_RPCT: + if (match_u64(&args[0], &v) || v == 0 || v >= 100) + goto einval; + params.rpct = v; + continue; + case QOS_WPCT: + if (match_u64(&args[0], &v) || v == 0 || v >= 100) + goto einval; + params.wpct = v; + continue; + default: + goto einval; + } + } + + if (params.qos_enabled && + (params.rlat == 0 || params.wlat == 0 || + params.rpct == 0 || params.rpct >= 100 || + params.wpct == 0 || params.wpct >= 100)) + goto einval; + + if (params.inflight == 0) + params.inflight = ioinf_default_inflight(disk); + + if (params.qos_enabled && !inf->params.qos_enabled) { + blk_stat_enable_accounting(disk->queue); + blk_queue_flag_set(QUEUE_FLAG_RQ_ALLOC_TIME, disk->queue); + } else if (!params.qos_enabled && inf->params.qos_enabled) { + blk_stat_disable_accounting(disk->queue); + blk_queue_flag_clear(QUEUE_FLAG_RQ_ALLOC_TIME, disk->queue); + } + + inf->params = params; + inf->busy_level = 0; + inf->old_scale = 9; + inf->inflight = params.inflight; + + blkg_conf_exit(&ctx); + return nbytes; + +einval: + ret = -EINVAL; +err: + blkg_conf_exit(&ctx); + return ret; +} + +static struct cftype ioinf_files[] = { + { + .name = "inf.weight", + .flags = CFTYPE_NOT_ON_ROOT, + .seq_show = ioinf_weight_show, + .write = ioinf_weight_write, + }, + { + .name = "inf.qos", + .flags = CFTYPE_ONLY_ON_ROOT, + .seq_show = ioinf_qos_show, + .write = ioinf_qos_write, + }, + {} +}; + +static struct cftype ioinf_legacy_files[] = { + { + .name = "inf.weight", + .flags = CFTYPE_NOT_ON_ROOT, + .seq_show = ioinf_weight_show, + .write = ioinf_weight_write, + }, + { + .name = "inf.qos", + .flags = CFTYPE_ONLY_ON_ROOT, + .seq_show = ioinf_qos_show, + .write = ioinf_qos_write, + }, + {} +}; + +static struct blkcg_policy blkcg_policy_ioinf = { + .dfl_cftypes = ioinf_files, + .legacy_cftypes = ioinf_legacy_files, + + .cpd_alloc_fn = ioinf_cpd_alloc, + .cpd_free_fn = ioinf_cpd_free, + + .pd_alloc_fn = ioinf_pd_alloc, + .pd_init_fn = ioinf_pd_init, + .pd_free_fn = ioinf_pd_free, +}; + +static int __init ioinf_init(void) +{ + return blkcg_policy_register(&blkcg_policy_ioinf); +} + +static void __exit ioinf_exit(void) +{ + blkcg_policy_unregister(&blkcg_policy_ioinf); +} + +module_init(ioinf_init); +module_exit(ioinf_exit); diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c index efe99cfae51d..b5af47bf99d4 100644 --- a/block/blk-mq-debugfs.c +++ b/block/blk-mq-debugfs.c @@ -798,6 +798,8 @@ static const char *rq_qos_id_to_name(enum rq_qos_id id) return "latency"; case RQ_QOS_COST: return "cost"; + case RQ_QOS_INFLIGHT: + return "inflight"; } return "unknown"; } diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h index 93d1ba692973..d504a302ca0f 100644 --- a/block/blk-rq-qos.h +++ b/block/blk-rq-qos.h @@ -17,6 +17,7 @@ enum rq_qos_id { RQ_QOS_WBT, RQ_QOS_LATENCY, RQ_QOS_COST, + RQ_QOS_INFLIGHT, }; struct rq_wait { diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 4c4416fd2df7..81a733e1bef9 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -115,6 +115,9 @@ struct request { #ifdef CONFIG_BLK_WBT unsigned short wbt_flags; +#endif +#ifdef CONFIG_BLK_CGROUP_IOINFLIGHT + struct blkcg_gq *blkg; #endif /* * rq sectors used for blk stats. It has the same value -- 2.46.1

2 1

[openeuler:openEuler-1.0-LTS 1743/1743] block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba07135cf74b1424e2f7f0c60e59c5b206ab320c commit: 5f100bc6aabbe30e55cf20af8e163bb6dba3a3aa [1743/1743] block: fix the DISCARD request merge config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250804/202508041253.AJArCfly-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041253.AJArCfly-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041253.AJArCfly-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge' [-Wmissing-prototypes] 688 | enum elv_merge blk_try_req_merge(struct request *req, struct request *next) | ^~~~~~~~~~~~~~~~~ vim +/blk_try_req_merge +688 block/blk-merge.c 687 > 688 enum elv_merge blk_try_req_merge(struct request *req, struct request *next) 689 { 690 if (blk_discard_mergable(req)) 691 return ELEVATOR_DISCARD_MERGE; 692 else if (blk_rq_pos(req) + blk_rq_sectors(req) == blk_rq_pos(next)) 693 return ELEVATOR_BACK_MERGE; 694 695 return ELEVATOR_NO_MERGE; 696 } 697 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2634/2634] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:23: error: use of undeclared identifier 'NR_syscalls'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e46fbbc0ad301c3517340bf966d39b8493a2ebb0 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [2634/2634] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-buildonly-randconfig-2004-20250804 (https://download.01.org/0day-ci/archive/20250804/202508041257.VLmpFnXZ-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041257.VLmpFnXZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041257.VLmpFnXZ-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/crypto/ccp/hygon/tdm-kernel-guard.c:15: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for function 'tdm_service_run' [-Wmissing-prototypes] 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^ | static drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: warning: no previous prototype for function 'tdm_service_exit' [-Wmissing-prototypes] 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^ | static >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:23: error: use of undeclared identifier 'NR_syscalls' 308 | eh_objs[SCT].size = NR_syscalls * sizeof(char *); | ^ 7 warnings and 1 error generated. vim +/NR_syscalls +308 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 286 287 sct_addr = (unsigned long *)kallsyms_lookup_name("sys_call_table"); 288 #endif 289 if (!sct_addr) { 290 ret = -DYN_ERR_API; 291 pr_err("kallsyms_lookup_name for sys_call_table failed!"); 292 goto end; 293 } 294 295 asm("sidt %0":"=m"(idtr)); 296 297 if (!psp_check_tdm_support()) 298 return 0; 299 300 for (i = 0; i < MAX_OBJ; i++) { 301 memset(&eh_objs[i], 0, sizeof(eh_objs[i])); 302 eh_objs[i].context = CONTEXT_CHECK_MODNAME; 303 eh_objs[i].obj_name = obj_names[i]; 304 } 305 306 if ((eh_obj == -1) || (eh_obj & (1 << SCT))) { 307 eh_objs[SCT].vaddr = (uint64_t)sct_addr; > 308 eh_objs[SCT].size = NR_syscalls * sizeof(char *); 309 } 310 if ((eh_obj == -1) || (eh_obj & (1 << IDT))) { 311 eh_objs[IDT].vaddr = idtr.address; 312 eh_objs[IDT].size = idtr.size; 313 } 314 315 for (i = 0; i < MAX_OBJ; i++) { 316 if (eh_objs[i].vaddr) 317 tdm_service_run(&eh_objs[i]); 318 } 319 320 pr_info("Hygon TDM guard load successfully!\n"); 321 322 end: 323 return ret; 324 } 325 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2634/2634] kernel/sched/psi.c:894:13: warning: 'task_is_in_psi_v1' defined but not used
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2c3b9ec99c8859c2992ed4684c28a503913d5251 commit: 2dfc29e742a07863c2426aea03d5c2c97b558b9d [2634/2634] sched/psi: Export cgroup psi from cgroupv2 to cgroupv1 config: x86_64-buildonly-randconfig-2003-20250804 (https://download.01.org/0day-ci/archive/20250804/202508041114.JMCuqZko-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041114.JMCuqZko-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041114.JMCuqZko-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:97: >> kernel/sched/psi.c:894:13: warning: 'task_is_in_psi_v1' defined but not used [-Wunused-function] 894 | static bool task_is_in_psi_v1(void) | ^~~~~~~~~~~~~~~~~ vim +/task_is_in_psi_v1 +894 kernel/sched/psi.c 884 885 #if defined(CONFIG_CGROUP_CPUACCT) && defined(CONFIG_PSI_CGROUP_V1) 886 static bool task_is_in_psi_v1(void) 887 { 888 if (static_branch_likely(&psi_v1_disabled)) 889 return false; 890 891 return !cgroup_subsys_on_dfl(cpuacct_cgrp_subsys); 892 } 893 #else > 894 static bool task_is_in_psi_v1(void) 895 { 896 return false; 897 } 898 #endif 899 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ACPICA: Refuse to evaluate a method if arguments are missing
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> stable inclusion from stable-v5.10.240 commit 2219e49857ffd6aea1b1ca5214d3270f84623a16 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXEP CVE: CVE-2025-38386 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6fcab2791543924d438e7fa49276d0998b0a069f ] As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. Closes: https://github.com/acpica/acpica/issues/1027 [1] Reported-by: Peter Williams <peter(a)newton.cx> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> Tested-by: Hans de Goede <hansg(a)kernel.org> # Dell XPS 9640 with BIOS 1.12.0 Link: https://patch.msgid.link/5909446.DvuYhMxLoT@rjwysocki.net Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/acpi/acpica/dsmethod.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c index 97971c79c5f56..13c67f58e9052 100644 --- a/drivers/acpi/acpica/dsmethod.c +++ b/drivers/acpi/acpica/dsmethod.c @@ -483,6 +483,13 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, return_ACPI_STATUS(AE_NULL_OBJECT); } + if (this_walk_state->num_operands < obj_desc->method.param_count) { + ACPI_ERROR((AE_INFO, "Missing argument for method [%4.4s]", + acpi_ut_get_node_name(method_node))); + + return_ACPI_STATUS(AE_AML_UNINITIALIZED_ARG); + } + /* Init for new method, possibly wait on method mutex */ status = -- 2.20.1

2 1

[PATCH OLK-6.6] ACPICA: Refuse to evaluate a method if arguments are missing
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> stable inclusion from stable-v6.6.97 commit d547779e72cea9865b732cd45393c4cd02b3598e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXEP CVE: CVE-2025-38386 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6fcab2791543924d438e7fa49276d0998b0a069f ] As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. Closes: https://github.com/acpica/acpica/issues/1027 [1] Reported-by: Peter Williams <peter(a)newton.cx> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> Tested-by: Hans de Goede <hansg(a)kernel.org> # Dell XPS 9640 with BIOS 1.12.0 Link: https://patch.msgid.link/5909446.DvuYhMxLoT@rjwysocki.net Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/acpi/acpica/dsmethod.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c index e809c2aed78a..a232746d150a 100644 --- a/drivers/acpi/acpica/dsmethod.c +++ b/drivers/acpi/acpica/dsmethod.c @@ -483,6 +483,13 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, return_ACPI_STATUS(AE_NULL_OBJECT); } + if (this_walk_state->num_operands < obj_desc->method.param_count) { + ACPI_ERROR((AE_INFO, "Missing argument for method [%4.4s]", + acpi_ut_get_node_name(method_node))); + + return_ACPI_STATUS(AE_AML_UNINITIALIZED_ARG); + } + /* Init for new method, possibly wait on method mutex */ status = -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] ACPICA: Refuse to evaluate a method if arguments are missing
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.16-rc3 commit 6fcab2791543924d438e7fa49276d0998b0a069f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXEP CVE: CVE-2025-38386 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it. Closes: https://github.com/acpica/acpica/issues/1027 [1] Reported-by: Peter Williams <peter(a)newton.cx> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> Tested-by: Hans de Goede <hansg(a)kernel.org> # Dell XPS 9640 with BIOS 1.12.0 Link: https://patch.msgid.link/5909446.DvuYhMxLoT@rjwysocki.net Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/acpi/acpica/dsmethod.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c index a00516d9538c..6d44fedf9763 100644 --- a/drivers/acpi/acpica/dsmethod.c +++ b/drivers/acpi/acpica/dsmethod.c @@ -483,6 +483,13 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, return_ACPI_STATUS(AE_NULL_OBJECT); } + if (this_walk_state->num_operands < obj_desc->method.param_count) { + ACPI_ERROR((AE_INFO, "Missing argument for method [%4.4s]", + acpi_ut_get_node_name(method_node))); + + return_ACPI_STATUS(AE_AML_UNINITIALIZED_ARG); + } + /* Init for new method, possibly wait on method mutex */ status = -- 2.20.1

2 1

[openeuler:OLK-6.6 2634/2634] drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2c3b9ec99c8859c2992ed4684c28a503913d5251 commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [2634/2634] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-2004-20250804 (https://download.01.org/0day-ci/archive/20250804/202508041105.2ucnSiI7-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041105.2ucnSiI7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041105.2ucnSiI7-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/crypto/ccp/hygon/tdm-dev.c:21: In file included from include/linux/kfifo.h:42: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^ >> drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:606:20: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^ 7 warnings and 2 errors generated. vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v6.6.97 commit 387da3b6d1a90e3210bc9a7fb56703bdad2ac18a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 ] Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 8 ++++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 37 +++++++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 7f664a4b2a75..bcef978ba9c4 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -62,6 +62,12 @@ struct v3d_perfmon { u64 values[]; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -71,6 +77,8 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; + void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 2e94ce788c71..ef991a9b1c6c 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index b2d59a168697..641315dbee8b 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -215,7 +215,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -226,17 +226,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq_optional(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -244,8 +251,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -286,6 +297,12 @@ v3d_irq_disable(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (int i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[PATCH OLK-5.10] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v5.10.240 commit 2446e25e9246e0642a41d91cbf54c33b275da3c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 ] Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 7 +++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 38 ++++++++++++++++++++++++++--------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 8a390738d65b..a605b31a8224 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -37,6 +37,12 @@ struct v3d_queue_state { u64 emit_seqno; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -46,6 +52,7 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 64fe63c1938f..32cc461937cf 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index c88686489b88..6c233b9e8648 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -206,7 +206,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -217,17 +217,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -235,8 +242,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -271,12 +282,19 @@ void v3d_irq_disable(struct v3d_dev *v3d) { int core; + int i; /* Disable all interrupts. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/2] arm64: Fix two bugs for hardware xcall/xint
by Jinjie Ruan 04 Aug '25

04 Aug '25

Fix two bugs for hardware xcall/xint. Jinjie Ruan (2): arm64: Fix '__NR_syscalls' undeclared error arm64: Do not enable hardware xcall if actlr_el1 can not set arch/arm64/include/asm/xcall.h | 1 + arch/arm64/kernel/cpufeature.c | 45 ++++++++++++++-------------------- 2 files changed, 19 insertions(+), 27 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1743/1743] arch/x86/kernel/tsc.c:61:1: warning: 'inline' is not at beginning of declaration
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba07135cf74b1424e2f7f0c60e59c5b206ab320c commit: 4907c68abd3f60f650f98d5a69d4ec77c0bde44f [1743/1743] x86/tsc: Force inlining of cyc2ns bits config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250804/202508041025.pObzdAyL-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508041025.pObzdAyL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508041025.pObzdAyL-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kernel/tsc.c:61:1: warning: 'inline' is not at beginning of declaration [-Wold-style-declaration] 61 | void __always_inline cyc2ns_read_begin(struct cyc2ns_data *data) | ^~~~ arch/x86/kernel/tsc.c:78:1: warning: 'inline' is not at beginning of declaration [-Wold-style-declaration] 78 | void __always_inline cyc2ns_read_end(void) | ^~~~ arch/x86/kernel/tsc.c:1497:15: warning: no previous prototype for 'calibrate_delay_is_known' [-Wmissing-prototypes] 1497 | unsigned long calibrate_delay_is_known(void) | ^~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/tsc.c:1236: warning: Excess function parameter 'cycles' description in 'convert_art_ns_to_tsc' arch/x86/kernel/tsc.c:1236: warning: Excess function parameter 'cs' description in 'convert_art_ns_to_tsc' arch/x86/kernel/tsc.c:1270: warning: Function parameter or member 'work' not described in 'tsc_refine_calibration_work' vim +/inline +61 arch/x86/kernel/tsc.c 60 > 61 void __always_inline cyc2ns_read_begin(struct cyc2ns_data *data) 62 { 63 int seq, idx; 64 65 preempt_disable_notrace(); 66 67 do { 68 seq = this_cpu_read(cyc2ns.seq.sequence); 69 idx = seq & 1; 70 71 data->cyc2ns_offset = this_cpu_read(cyc2ns.data[idx].cyc2ns_offset); 72 data->cyc2ns_mul = this_cpu_read(cyc2ns.data[idx].cyc2ns_mul); 73 data->cyc2ns_shift = this_cpu_read(cyc2ns.data[idx].cyc2ns_shift); 74 75 } while (unlikely(seq != this_cpu_read(cyc2ns.seq.sequence))); 76 } 77 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: stmmac: make sure that ptp_rate is not 0 before configuring EST
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: Alexis Lothoré <alexis.lothore(a)bootlin.com> mainline inclusion from mainline-v6.16-rc1 commit cbefe2ffa7784525ec5d008ba87c7add19ec631a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT9O CVE: CVE-2025-38125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code. Suggested-by: Maxime Chevallier <maxime.chevallier(a)bootlin.com> Signed-off-by: Alexis Lothoré <alexis.lothore(a)bootlin.com> Fixes: 8572aec3d0dc ("net: stmmac: Add basic EST support for XGMAC") Link: https://patch.msgid.link/20250529-stmmac_tstamp_div-v4-2-d73340a794d5@bootl… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/stmicro/stmmac/dwmac5.c drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c drivers/net/ethernet/stmicro/stmmac/stmmac_est.c [wxf: fix conflicts because the following commit is not merged. It extract a common est_configure() from dwmac5 and dwxgmac2_core. commit c3f3b97238f6fd87b9d90b9a995ee5e69f751a74 net: stmmac: Refactor EST implementation] Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei> --- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 5 +++++ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c index d1b8b51bf6ad9..88334c4706f4f 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c @@ -576,6 +576,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, int i, ret = 0x0; u32 ctrl; + if (!ptp_rate) { + pr_warn("Invalid PTP rate"); + return -EINVAL; + } + ret |= dwmac5_est_write(ioaddr, BTR_LOW, cfg->btr[0], false); ret |= dwmac5_est_write(ioaddr, BTR_HIGH, cfg->btr[1], false); ret |= dwmac5_est_write(ioaddr, TER, cfg->ter, false); diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c index 86f70ea9a520c..ba4bcc8afc261 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c @@ -1491,6 +1491,11 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, int i, ret = 0x0; u32 ctrl; + if (!ptp_rate) { + pr_warn("Invalid PTP rate"); + return -EINVAL; + } + ret |= dwxgmac3_est_write(ioaddr, XGMAC_BTR_LOW, cfg->btr[0], false); ret |= dwxgmac3_est_write(ioaddr, XGMAC_BTR_HIGH, cfg->btr[1], false); ret |= dwxgmac3_est_write(ioaddr, XGMAC_TER, cfg->ter, false); -- 2.20.1

2 1

[PATCH OLK-5.10] bcache: fix NULL pointer in cache_set_flush()
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: Linggang Zeng <linggang.zeng(a)easystack.cn> mainline inclusion from mainline-v6.16-rc1 commit 1e46ed947ec658f89f1a910d880cd05e42d3763e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICL7YT CVE: CVE-2025-38263 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set(). 3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098. 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 } (1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the value to c->cache[], it means that c->cache[] is NULL. LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624) 1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 } (4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129] Oops: 0000 [#1] SMP PTI [ 846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G OE --------- - - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1 [ 846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018 [ 846.716451] Workqueue: events cache_set_flush [bcache] [ 846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache] [ 846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 <48> 8b b8 f8 09 00 00 48 85 ff 74 05 e8 b6 58 a2 e1 0f b7 95 3c f7 [ 846.718026] RSP: 0018:ffffb56dcf85fe70 EFLAGS: 00010202 [ 846.718372] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 846.718725] RDX: 0000000000000001 RSI: 0000000040000001 RDI: 0000000000000000 [ 846.719076] RBP: ffffa0ccc0f20df8 R08: ffffa0ce1fedb118 R09: 000073746e657665 [ 846.719428] R10: 8080808080808080 R11: 0000000000000000 R12: ffffa0ce1fee8700 [ 846.719779] R13: ffffa0ccc0f211a8 R14: ffffa0cd1b902840 R15: ffffa0ccc0f20e00 [ 846.720132] FS: 0000000000000000(0000) GS:ffffa0ce1fec0000(0000) knlGS:0000000000000000 [ 846.720726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 846.721073] CR2: 00000000000009f8 CR3: 00000008ba00a005 CR4: 00000000007606e0 [ 846.721426] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 846.721778] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 846.722131] PKRU: 55555554 [ 846.722467] Call Trace: [ 846.722814] process_one_work+0x1a7/0x3b0 [ 846.723157] worker_thread+0x30/0x390 [ 846.723501] ? create_worker+0x1a0/0x1a0 [ 846.723844] kthread+0x112/0x130 [ 846.724184] ? kthread_flush_work_fn+0x10/0x10 [ 846.724535] ret_from_fork+0x35/0x40 Now, check whether that ca is NULL in LINE#1655 to fix the issue. Signed-off-by: Linggang Zeng <linggang.zeng(a)easystack.cn> Signed-off-by: Mingzhe Zou <mingzhe.zou(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)kernel.org> Link: https://lore.kernel.org/r/20250527051601.74407-2-colyli@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/md/bcache/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index fd97730479d86..117a43b4b8c68 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1756,7 +1756,12 @@ static void cache_set_flush(struct closure *cl) mutex_unlock(&b->write_lock); } - if (ca->alloc_thread) + /* + * If the register_cache_set() call to bch_cache_set_alloc() failed, + * ca has not been assigned a value and return error. + * So we need check ca is not NULL during bch_cache_set_unregister(). + */ + if (ca && ca->alloc_thread) kthread_stop(ca->alloc_thread); if (c->journal.cur) { -- 2.20.1

2 1

[PATCH OLK-6.6] net: stmmac: make sure that ptp_rate is not 0 before configuring EST
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: Alexis Lothoré <alexis.lothore(a)bootlin.com> mainline inclusion from mainline-v6.16-rc1 commit cbefe2ffa7784525ec5d008ba87c7add19ec631a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT9O CVE: CVE-2025-38125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code. Suggested-by: Maxime Chevallier <maxime.chevallier(a)bootlin.com> Signed-off-by: Alexis Lothoré <alexis.lothore(a)bootlin.com> Fixes: 8572aec3d0dc ("net: stmmac: Add basic EST support for XGMAC") Link: https://patch.msgid.link/20250529-stmmac_tstamp_div-v4-2-d73340a794d5@bootl… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/stmicro/stmmac/dwmac5.c drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c drivers/net/ethernet/stmicro/stmmac/stmmac_est.c [wxf: fix conflicts because the following commit is not merged. It extract a common est_configure() from dwmac5 and dwxgmac2_core. commit c3f3b97238f6fd87b9d90b9a995ee5e69f751a74 net: stmmac: Refactor EST implementation] Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei> --- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 5 +++++ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c index 8fd167501fa0..fecb394332bf 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c @@ -597,6 +597,11 @@ int dwmac5_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, int i, ret = 0x0; u32 ctrl; + if (!ptp_rate) { + pr_warn("Invalid PTP rate"); + return -EINVAL; + } + ret |= dwmac5_est_write(ioaddr, BTR_LOW, cfg->btr[0], false); ret |= dwmac5_est_write(ioaddr, BTR_HIGH, cfg->btr[1], false); ret |= dwmac5_est_write(ioaddr, TER, cfg->ter, false); diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c index 052566f5b7f3..d223e1e9eb01 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c @@ -1529,6 +1529,11 @@ static int dwxgmac3_est_configure(void __iomem *ioaddr, struct stmmac_est *cfg, int i, ret = 0x0; u32 ctrl; + if (!ptp_rate) { + pr_warn("Invalid PTP rate"); + return -EINVAL; + } + ret |= dwxgmac3_est_write(ioaddr, XGMAC_BTR_LOW, cfg->btr[0], false); ret |= dwxgmac3_est_write(ioaddr, XGMAC_BTR_HIGH, cfg->btr[1], false); ret |= dwxgmac3_est_write(ioaddr, XGMAC_TER, cfg->ter, false); -- 2.20.1

2 1

[PATCH OLK-6.6] soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> stable inclusion from stable-v6.6.94 commit 8312b1f776f71979bf33bda7acc05b348e8792c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT7X CVE: CVE-2025-38145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f1706e0e1a74b095cbc60375b9b1e6205f5f4c98 ] devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev") Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Link: https://patch.msgid.link/20250401074647.21300-1-bsdhenrymartin@gmail.com [arj: Fix Fixes: tag to use subject from 3772e5da4454] Signed-off-by: Andrew Jeffery <andrew(a)codeconstruct.com.au> Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei> --- drivers/soc/aspeed/aspeed-lpc-snoop.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c index 773dbcbc03a6..f63d0e9188a4 100644 --- a/drivers/soc/aspeed/aspeed-lpc-snoop.c +++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c @@ -200,11 +200,15 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, lpc_snoop->chan[channel].miscdev.minor = MISC_DYNAMIC_MINOR; lpc_snoop->chan[channel].miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "%s%d", DEVICE_NAME, channel); + if (!lpc_snoop->chan[channel].miscdev.name) { + rc = -ENOMEM; + goto err_free_fifo; + } lpc_snoop->chan[channel].miscdev.fops = &snoop_fops; lpc_snoop->chan[channel].miscdev.parent = dev; rc = misc_register(&lpc_snoop->chan[channel].miscdev); if (rc) - return rc; + goto err_free_fifo; /* Enable LPC snoop channel at requested port */ switch (channel) { @@ -221,7 +225,8 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, hicrb_en = HICRB_ENSNP1D; break; default: - return -EINVAL; + rc = -EINVAL; + goto err_misc_deregister; } regmap_update_bits(lpc_snoop->regmap, HICR5, hicr5_en, hicr5_en); @@ -231,6 +236,12 @@ static int aspeed_lpc_enable_snoop(struct aspeed_lpc_snoop *lpc_snoop, regmap_update_bits(lpc_snoop->regmap, HICRB, hicrb_en, hicrb_en); + return 0; + +err_misc_deregister: + misc_deregister(&lpc_snoop->chan[channel].miscdev); +err_free_fifo: + kfifo_free(&lpc_snoop->chan[channel].fifo); return rc; } -- 2.20.1

2 1

[PATCH OLK-6.6] ACPICA: fix acpi operand cache leak in dswstate.c
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: Seunghun Han <kkamagui(a)gmail.com> stable inclusion from stable-v6.6.95 commit 755a8006b76792922ff7b1c9674d8897a476b5d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICLIXX CVE: CVE-2025-38345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 156fd20a41e776bbf334bd5e45c4f78dfc90ce1c ] ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When early termination occurs due to malicious ACPI table, Linux kernel terminates ACPI function and continues to boot process. While kernel terminates ACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak. Boot log of ACPI operand cache leak is as follows: >[ 0.585957] ACPI: Added _OSI(Module Device) >[ 0.587218] ACPI: Added _OSI(Processor Device) >[ 0.588530] ACPI: Added _OSI(3.0 _SCP Extensions) >[ 0.589790] ACPI: Added _OSI(Processor Aggregator Device) >[ 0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155) >[ 0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88) >[ 0.597858] ACPI: Unable to start the ACPI Interpreter >[ 0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) >[ 0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects >[ 0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26 >[ 0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 >[ 0.609177] Call Trace: >[ 0.610063] ? dump_stack+0x5c/0x81 >[ 0.611118] ? kmem_cache_destroy+0x1aa/0x1c0 >[ 0.612632] ? acpi_sleep_proc_init+0x27/0x27 >[ 0.613906] ? acpi_os_delete_cache+0xa/0x10 >[ 0.617986] ? acpi_ut_delete_caches+0x3f/0x7b >[ 0.619293] ? acpi_terminate+0xa/0x14 >[ 0.620394] ? acpi_init+0x2af/0x34f >[ 0.621616] ? __class_create+0x4c/0x80 >[ 0.623412] ? video_setup+0x7f/0x7f >[ 0.624585] ? acpi_sleep_proc_init+0x27/0x27 >[ 0.625861] ? do_one_initcall+0x4e/0x1a0 >[ 0.627513] ? kernel_init_freeable+0x19e/0x21f >[ 0.628972] ? rest_init+0x80/0x80 >[ 0.630043] ? kernel_init+0xa/0x100 >[ 0.631084] ? ret_from_fork+0x25/0x30 >[ 0.633343] vgaarb: loaded >[ 0.635036] EDAC MC: Ver: 3.0.0 >[ 0.638601] PCI: Probing PCI hardware >[ 0.639833] PCI host bridge to bus 0000:00 >[ 0.641031] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] > ... Continue to boot and log is omitted ... I analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_ delete() function miscalculated the top of the stack. acpi_ds_obj_stack_push() function uses walk_state->operand_index for start position of the top, but acpi_ds_obj_stack_pop_and_delete() function considers index 0 for it. Therefore, this causes acpi operand memory leak. This cache leak causes a security threat because an old kernel (<= 4.9) shows memory locations of kernel functions in stack dump. Some malicious users could use this information to neutralize kernel ASLR. I made a patch to fix ACPI operand cache leak. Link: https://github.com/acpica/acpica/commit/987a3b5c Signed-off-by: Seunghun Han <kkamagui(a)gmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/4999480.31r3eYUQgx@rjwysocki.net Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/acpi/acpica/dsutils.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c index fb9ed5e1da89..2bdae8a25e08 100644 --- a/drivers/acpi/acpica/dsutils.c +++ b/drivers/acpi/acpica/dsutils.c @@ -668,6 +668,8 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, union acpi_parse_object *arguments[ACPI_OBJ_NUM_OPERANDS]; u32 arg_count = 0; u32 index = walk_state->num_operands; + u32 prev_num_operands = walk_state->num_operands; + u32 new_num_operands; u32 i; ACPI_FUNCTION_TRACE_PTR(ds_create_operands, first_arg); @@ -696,6 +698,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, /* Create the interpreter arguments, in reverse order */ + new_num_operands = index; index--; for (i = 0; i < arg_count; i++) { arg = arguments[index]; @@ -720,7 +723,11 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state, * pop everything off of the operand stack and delete those * objects */ - acpi_ds_obj_stack_pop_and_delete(arg_count, walk_state); + walk_state->num_operands = i; + acpi_ds_obj_stack_pop_and_delete(new_num_operands, walk_state); + + /* Restore operand count */ + walk_state->num_operands = prev_num_operands; ACPI_EXCEPTION((AE_INFO, status, "While creating Arg %u", index)); return_ACPI_STATUS(status); -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] bcache: fix NULL pointer in cache_set_flush()
by Xiongfeng Wang 04 Aug '25

04 Aug '25

From: Linggang Zeng <linggang.zeng(a)easystack.cn> mainline inclusion from mainline-v6.16-rc1 commit 1e46ed947ec658f89f1a910d880cd05e42d3763e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICL7YT CVE: CVE-2025-38263 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set(). 3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098. 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 } (1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the value to c->cache[], it means that c->cache[] is NULL. LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624) 1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 } (4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129] Oops: 0000 [#1] SMP PTI [ 846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G OE --------- - - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1 [ 846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018 [ 846.716451] Workqueue: events cache_set_flush [bcache] [ 846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache] [ 846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 <48> 8b b8 f8 09 00 00 48 85 ff 74 05 e8 b6 58 a2 e1 0f b7 95 3c f7 [ 846.718026] RSP: 0018:ffffb56dcf85fe70 EFLAGS: 00010202 [ 846.718372] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 846.718725] RDX: 0000000000000001 RSI: 0000000040000001 RDI: 0000000000000000 [ 846.719076] RBP: ffffa0ccc0f20df8 R08: ffffa0ce1fedb118 R09: 000073746e657665 [ 846.719428] R10: 8080808080808080 R11: 0000000000000000 R12: ffffa0ce1fee8700 [ 846.719779] R13: ffffa0ccc0f211a8 R14: ffffa0cd1b902840 R15: ffffa0ccc0f20e00 [ 846.720132] FS: 0000000000000000(0000) GS:ffffa0ce1fec0000(0000) knlGS:0000000000000000 [ 846.720726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 846.721073] CR2: 00000000000009f8 CR3: 00000008ba00a005 CR4: 00000000007606e0 [ 846.721426] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 846.721778] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 846.722131] PKRU: 55555554 [ 846.722467] Call Trace: [ 846.722814] process_one_work+0x1a7/0x3b0 [ 846.723157] worker_thread+0x30/0x390 [ 846.723501] ? create_worker+0x1a0/0x1a0 [ 846.723844] kthread+0x112/0x130 [ 846.724184] ? kthread_flush_work_fn+0x10/0x10 [ 846.724535] ret_from_fork+0x35/0x40 Now, check whether that ca is NULL in LINE#1655 to fix the issue. Signed-off-by: Linggang Zeng <linggang.zeng(a)easystack.cn> Signed-off-by: Mingzhe Zou <mingzhe.zou(a)easystack.cn> Signed-off-by: Coly Li <colyli(a)kernel.org> Link: https://lore.kernel.org/r/20250527051601.74407-2-colyli@kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/md/bcache/super.c [wxf: fix conflicts because commit 08fdb2cddbdc 'bcache: remove for_each_cache()' is not merged. ] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/md/bcache/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 3f858de9e960..10a258f6ce13 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1612,8 +1612,13 @@ static void cache_set_flush(struct closure *cl) mutex_unlock(&b->write_lock); } + /* + * If the register_cache_set() call to bch_cache_set_alloc() failed, + * ca has not been assigned a value and return error. + * So we need check ca is not NULL during bch_cache_set_unregister(). + */ for_each_cache(ca, c, i) - if (ca->alloc_thread) + if (ca && ca->alloc_thread) kthread_stop(ca->alloc_thread); if (c->journal.cur) { -- 2.20.1

2 1

[openeuler:OLK-5.10 3094/3094] fs/cachefiles/ondemand.c:23:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6d337ce6e80ff095f25a2ccd842ebcf349fa4bfa commit: 2937cd5f8c58bd8e7895f6b2698057721442248e [3094/3094] cachefiles: notify the user daemon when looking up cookie config: x86_64-buildonly-randconfig-2003-20250804 (https://download.01.org/0day-ci/archive/20250804/202508040931.hrn1mWAF-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508040931.hrn1mWAF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508040931.hrn1mWAF-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/cachefiles/ondemand.c: In function 'cachefiles_ondemand_fd_release': >> fs/cachefiles/ondemand.c:23:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace' [-Wenum-conversion] 23 | cachefiles_obj_put_ondemand_fd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/cachefiles/ondemand.c: In function 'cachefiles_ondemand_get_fd': fs/cachefiles/ondemand.c:145:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace' [-Wenum-conversion] 145 | cachefiles_obj_get_ondemand_fd) ? 0 : -EAGAIN; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/cachefiles/ondemand.c:191:25: warning: implicit conversion from 'enum cachefiles_obj_ref_trace' to 'enum fscache_obj_ref_trace' [-Wenum-conversion] 191 | cachefiles_obj_put_ondemand_fd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +23 fs/cachefiles/ondemand.c 7 8 static int cachefiles_ondemand_fd_release(struct inode *inode, 9 struct file *file) 10 { 11 struct cachefiles_object *object = file->private_data; 12 int object_id = object->ondemand_id; 13 struct cachefiles_cache *cache; 14 15 cache = container_of(object->fscache.cache, 16 struct cachefiles_cache, cache); 17 18 object->ondemand_id = CACHEFILES_ONDEMAND_ID_CLOSED; 19 xa_lock(&cache->ondemand_ids.idr_rt); 20 idr_remove(&cache->ondemand_ids, object_id); 21 xa_unlock(&cache->ondemand_ids.idr_rt); 22 object->fscache.cache->ops->put_object(&object->fscache, > 23 cachefiles_obj_put_ondemand_fd); 24 return 0; 25 } 26 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
by Yuan Can 04 Aug '25

04 Aug '25

From: Imre Deak <imre.deak(a)intel.com> mainline inclusion from mainline-v6.13-rc2 commit e54b00086f7473dbda1a7d6fc47720ced157c6a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCBT CVE: CVE-2024-57798 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could be removed from another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. This could lead to a NULL deref/use-after-free of mst_primary in drm_dp_mst_handle_up_req(). Avoid the above by holding a reference for mst_primary in drm_dp_mst_handle_up_req() while it's used. v2: Fix kfreeing the request if getting an mst_primary reference fails. Cc: Lyude Paul <lyude(a)redhat.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> (v1) Signed-off-by: Imre Deak <imre.deak(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241204132007.3132494-1-imre… Conflicts: drivers/gpu/drm/drm_dp_mst_topology.c drivers/gpu/drm/display/drm_dp_mst_topology.c [commit adb9d5a2cc77 and da68386d9edb move drm_dp_mst_topology.c to new createdfolder display] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/gpu/drm/drm_dp_mst_topology.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index e53306ffeb63..e71d76daee74 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -4122,9 +4122,10 @@ static void drm_dp_mst_up_req_work(struct work_struct *work) static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) { struct drm_dp_pending_up_req *up_req; + struct drm_dp_mst_branch *mst_primary; if (!drm_dp_get_one_sb_msg(mgr, true, NULL)) - goto out; + goto out_clear_reply; if (!mgr->up_req_recv.have_eomt) return 0; @@ -4143,10 +4144,19 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) DRM_DEBUG_KMS("Received unknown up req type, ignoring: %x\n", up_req->msg.req_type); kfree(up_req); - goto out; + goto out_clear_reply; } - drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type, + mutex_lock(&mgr->lock); + mst_primary = mgr->mst_primary; + if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) { + mutex_unlock(&mgr->lock); + kfree(up_req); + goto out_clear_reply; + } + mutex_unlock(&mgr->lock); + + drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, false); if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { @@ -4175,7 +4185,8 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) mutex_unlock(&mgr->up_req_lock); queue_work(system_long_wq, &mgr->up_req_work); -out: + drm_dp_mst_topology_put_mstb(mst_primary); +out_clear_reply: memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); return 0; } -- 2.22.0

2 1

[PATCH OLK-5.10] [Backport] drm/dp_mst: Fix MST sideband message body length check
by Yuan Can 04 Aug '25

04 Aug '25

From: Imre Deak <imre.deak(a)intel.com> stable inclusion from stable-v5.10.233 commit 109f91d8b9335b0f3714ef9920eae5a8b21d56af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN5 CVE: CVE-2024-56616 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bd2fccac61b40eaf08d9546acc9fef958bfe4763 ] Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC (aka message data CRC) at the end of the message. This fixes a case where an MST branch device returns a header with a correct header CRC (indicating a correctly received body length), with the body length being incorrectly set to 0. This will later lead to a memory corruption in drm_dp_sideband_append_payload() and the following errors in dmesg: UBSAN: array-index-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:786:25 index -1 is out of range for type 'u8 [48]' Call Trace: drm_dp_sideband_append_payload+0x33d/0x350 [drm_display_helper] drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper] drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper] memcpy: detected field-spanning write (size 18446744073709551615) of single field "&msg->msg[msg->curlen]" at drivers/gpu/drm/display/drm_dp_mst_topology.c:791 (size 256) Call Trace: drm_dp_sideband_append_payload+0x324/0x350 [drm_display_helper] drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper] drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper] Cc: <stable(a)vger.kernel.org> Cc: Lyude Paul <lyude(a)redhat.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Imre Deak <imre.deak(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241125205314.1725887-1-imre… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/gpu/drm/drm_dp_mst_topology.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index bb9f2342e96b..e53306ffeb63 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -318,6 +318,9 @@ static bool drm_dp_decode_sideband_msg_hdr(struct drm_dp_sideband_msg_hdr *hdr, hdr->broadcast = (buf[idx] >> 7) & 0x1; hdr->path_msg = (buf[idx] >> 6) & 0x1; hdr->msg_len = buf[idx] & 0x3f; + if (hdr->msg_len < 1) /* min space for body CRC */ + return false; + idx++; hdr->somt = (buf[idx] >> 7) & 0x1; hdr->eomt = (buf[idx] >> 6) & 0x1; -- 2.22.0

2 1

[PATCH OLK-6.6 0/2] arm64: Fix two bugs for hardware xcall/xint
by Jinjie Ruan 04 Aug '25

04 Aug '25

Fix two bugs for hardware xcall/xint. Jinjie Ruan (2): arm64: Fix '__NR_syscalls' undeclared error arm64: Do not enable hardware xcall if actlr_el1 can not set arch/arm64/include/asm/xcall.h | 1 + arch/arm64/kernel/cpufeature.c | 45 ++++++++++++++-------------------- 2 files changed, 19 insertions(+), 27 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v5 00/39] High Performance Container Resource View Isolation -- Stage 2
by GONG Ruiqi 04 Aug '25

04 Aug '25

v5: - Gather bpf_arm64_cpu_have_feature() into arch/arm64/kernel/bpf-rvi.c v4: - Fix compile failure of bpf_mem_failure() when CONFIG_MEMORY_FAILURE=n - Move iterator target for diskstats & partitions into block/bpf-rvi.c, to avoid unexpected "kABI changes" (actually no) v3: - Optimize swaptotal's estimation and make it a stand-alone function v2: - Remove pidns's refcount from the loadavg global list. - Optimize calculation of swap{total,usage,free} for swap and meminfo - Fix a put_task_struct() missing for bpf_disk_seqf_start() - Remove ineffective build control in samples/bpf/Makefile - Clean up some commented code --- Common supports: bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc bpf-rvi: cpuacct: Add task_cpuacct() Cpuinfo_arm64: bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc bpf-rvi: arm64: Add cpuinfo_arm64 iterator target bpf-rvi: Add bpf_arch_flags kunc for arm64 samples/bpf: Add iterator program for cpuinfo_arm64 Diskstats: bpf-rvi: block: Add diskstats iterator target bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc samples/bpf: Add iterator program for diskstats Partitions: bpf-rvi: block: Add partitions iterator target bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions samples/bpf: Add iterator program for partitions Loadavg: bpf-rvi: pidns: Calculate loadavg for each pid namespace bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs samples/bpf: Add iterator program for loadavg Uptime: bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc samples/bpf: Add iterator program for uptime Swaps: bpf-rvi: Add bpf_si_memswinfo() kfunc bpf-rvi: Add bpf_page_counter_read() kfunc samples/bpf: Add iterator program for swaps Stat: bpf-rvi: Add bpf_seq_file_append() kfunc bpf-rvi: Add stat-related misc kfuncs bpf-rvi: Add cpu runqueue related kfuncs bpf-rvi: Add kstat_ & kcpustat_ kfuncs bpf-rvi: stat: Add stat iterator target samples/bpf: Add iterator program for stat Meminfo: bpf-rvi: x86: Add bpf_mem_direct_map kfunc bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc bpf-rvi: Add bpf_mem_{total,free}cma kfunc bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc bpf-rvi: Add bpf_mem_failure kfunc bpf-rvi: Add bpf_mem_percpu kfunc bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc samples/bpf: Add iterator program for meminfo --- GONG Ruiqi (31): bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc bpf-rvi: cpuacct: Add task_cpuacct() bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc bpf-rvi: arm64: Add cpuinfo_arm64 iterator target bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64 samples/bpf: Add iterator program for cpuinfo_arm64 bpf-rvi: block: Add diskstats iterator target bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc samples/bpf: Add iterator program for diskstats bpf-rvi: block: Add partitions iterator target bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions samples/bpf: Add iterator program for partitions bpf-rvi: pidns: Calculate loadavg for each pid namespace bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs samples/bpf: Add iterator program for loadavg bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc samples/bpf: Add iterator program for uptime bpf-rvi: Add bpf_si_memswinfo() kfunc bpf-rvi: Add bpf_page_counter_read() kfunc samples/bpf: Add iterator program for swaps bpf-rvi: Add bpf_seq_file_append() kfunc bpf-rvi: Add stat-related misc kfuncs bpf-rvi: Add cpu runqueue related kfuncs bpf-rvi: Add kstat_ & kcpustat_ kfuncs bpf-rvi: stat: Add stat iterator target samples/bpf: Add iterator program for stat samples/bpf: Add iterator program for meminfo Gu Bowen (8): bpf-rvi: x86: Add bpf_mem_direct_map kfunc bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc bpf-rvi: Add bpf_mem_{total,free}cma kfunc bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc bpf-rvi: Add bpf_mem_failure kfunc bpf-rvi: Add bpf_mem_percpu kfunc bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/bpf-rvi.c | 223 ++++++++++++ arch/arm64/kernel/cpuinfo.c | 128 +------ arch/arm64/kernel/hwcap_str.h | 131 +++++++ arch/x86/mm/pat/set_memory.c | 33 ++ block/Kconfig.iosched | 3 + block/Makefile | 1 + block/blk-cgroup.c | 158 +++++++++ block/bpf-rvi.c | 442 ++++++++++++++++++++++++ block/genhd.c | 3 +- fs/proc/stat.c | 204 +++++++++++ include/linux/cgroup.h | 12 + include/linux/pid.h | 5 + include/linux/pid_namespace.h | 28 ++ kernel/bpf-rvi/Kconfig | 2 + kernel/bpf-rvi/Makefile | 2 +- kernel/bpf-rvi/common_kfuncs.c | 310 +++++++++++++++++ kernel/bpf-rvi/generic_single_iter.c | 3 + kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 18 + kernel/pid.c | 9 + kernel/pid_namespace.c | 130 +++++++ kernel/sched/cpuacct.c | 43 +++ samples/bpf/bpf_rvi_cpuinfo_arm64.bpf.c | 112 ++++++ samples/bpf/bpf_rvi_diskstats.bpf.c | 299 ++++++++++++++++ samples/bpf/bpf_rvi_loadavg.bpf.c | 60 ++++ samples/bpf/bpf_rvi_meminfo.bpf.c | 278 +++++++++++++++ samples/bpf/bpf_rvi_partitions.bpf.c | 42 +++ samples/bpf/bpf_rvi_stat.bpf.c | 220 ++++++++++++ samples/bpf/bpf_rvi_swaps.bpf.c | 138 ++++++++ samples/bpf/bpf_rvi_uptime.bpf.c | 122 +++++++ 31 files changed, 3033 insertions(+), 131 deletions(-) create mode 100644 arch/arm64/kernel/bpf-rvi.c create mode 100644 arch/arm64/kernel/hwcap_str.h create mode 100644 block/bpf-rvi.c create mode 100644 kernel/bpf-rvi/common_kfuncs.c create mode 100644 samples/bpf/bpf_rvi_cpuinfo_arm64.bpf.c create mode 100644 samples/bpf/bpf_rvi_diskstats.bpf.c create mode 100644 samples/bpf/bpf_rvi_loadavg.bpf.c create mode 100644 samples/bpf/bpf_rvi_meminfo.bpf.c create mode 100644 samples/bpf/bpf_rvi_partitions.bpf.c create mode 100644 samples/bpf/bpf_rvi_stat.bpf.c create mode 100644 samples/bpf/bpf_rvi_swaps.bpf.c create mode 100644 samples/bpf/bpf_rvi_uptime.bpf.c -- 2.25.1

2 40

[PATCH OLK-6.6] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v6.6.97 commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/k… -------------------------------- [ Upstream commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 ] Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/v3d/v3d_drv.h drivers/gpu/drm/v3d/v3d_gem.c drivers/gpu/drm/v3d/v3d_irq.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 8 ++++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 37 +++++++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 7f664a4b2a75..bcef978ba9c4 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -62,6 +62,12 @@ struct v3d_perfmon { u64 values[]; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -71,6 +77,8 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; + void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 2e94ce788c71..ef991a9b1c6c 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index b2d59a168697..641315dbee8b 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -215,7 +215,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -226,17 +226,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq_optional(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -244,8 +251,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -286,6 +297,12 @@ v3d_irq_disable(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (int i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-37957
by Yuan Can 04 Aug '25

04 Aug '25

Mikhail Lobanov (1): KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Peter Gonda (1): KVM: SVM: Update SEV-ES shutdown intercepts with more metadata arch/x86/kvm/smm.c | 1 + arch/x86/kvm/svm/svm.c | 19 +++++++++++-------- 2 files changed, 12 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH v3 OLK-6.6] livepatch: support for super-long symbol repositioning
by Li Huafei 04 Aug '25

04 Aug '25

From: caixiaomeng 00662745 <caixiaomeng2(a)huawei.com> EulerOS inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICPM0M ---------------------------------------- symbols longer than KSYM_NAME_LEN will be truncated in strtab, we can not find them using original name, so we use a new format .klp.sym.objname-ref_name,ref_offset to find a unique symbol and add ref_offset to get the long name symbol address. Signed-off-by: Zhipeng Xie <xiezhipeng1(a)huawei.com> Signed-off-by: caixiaomeng <caixiaomeng2(a)huawei.com> Signed-off-by: hubin <hubin73(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + kernel/livepatch/Kconfig | 10 ++++++++++ kernel/livepatch/core.c | 12 ++++++++++++ 4 files changed, 24 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 3cfff0701479..627fc381a0e4 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -377,6 +377,7 @@ CONFIG_LIVEPATCH_STOP_MACHINE_CONSISTENCY=y # CONFIG_LIVEPATCH_STACK is not set CONFIG_LIVEPATCH_RESTRICT_KPROBE=y CONFIG_LIVEPATCH_ISOLATE_KPROBE=y +CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT=y # end of Enable Livepatch # diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 3cbae4c5f390..52e6ccad8aa8 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -538,6 +538,7 @@ CONFIG_LIVEPATCH_STOP_MACHINE_CONSISTENCY=y # CONFIG_LIVEPATCH_STACK is not set CONFIG_LIVEPATCH_RESTRICT_KPROBE=y CONFIG_LIVEPATCH_ISOLATE_KPROBE=y +CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT=y # end of Enable Livepatch # end of Processor type and features diff --git a/kernel/livepatch/Kconfig b/kernel/livepatch/Kconfig index 239480682c92..d663ad91c619 100644 --- a/kernel/livepatch/Kconfig +++ b/kernel/livepatch/Kconfig @@ -101,4 +101,14 @@ config LIVEPATCH_ISOLATE_KPROBE do not allow both modify the same instruction when a function is marked as 'notrace' and without the reserved instructions. +config LIVEPATCH_LONG_SYMBOL_SUPPORT + bool "support relocate symbol name whose length longer than 128 bytes" + depends on LIVEPATCH_WO_FTRACE + default y + help + symbols longer than KSYM_NAME_LEN will be truncated in strtab, + we can not find them using original name, so we use a new format + .klp.sym.objname-ref_name,ref_offset to find a unique symbol + and add ref_offset to get the long name symbol address. + endmenu diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index bb7ecc516b4a..bc390975fd2c 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -233,6 +233,7 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, #endif Elf_Sym *sym; unsigned long sympos, addr; + long ref_offset; bool sym_vmlinux; bool sec_vmlinux = !strcmp(sec_objname, "vmlinux"); @@ -266,10 +267,19 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, return -EINVAL; } + ref_offset = 0; /* Format: .klp.sym.sym_objname.sym_name,sympos */ cnt = sscanf(strtab + sym->st_name, ".klp.sym.%55[^.].%511[^,],%lu", sym_objname, sym_name, &sympos); + if (IS_ENABLED(CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT) && cnt != 3) { + /* Format: .klp.sym.objname-ref_name,ref_offset*/ + cnt = sscanf(strtab + sym->st_name, + ".klp.sym.%55[^-]-%127[^,],%ld", + sym_objname, sym_name, &ref_offset); + if (cnt == 3) + sympos = 1; + } if (cnt != 3) { pr_err("symbol %s has an incorrectly formatted name\n", strtab + sym->st_name); @@ -297,6 +307,8 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, return ret; sym->st_value = addr; + if (IS_ENABLED(CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT)) + sym->st_value += ref_offset; } return 0; -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] CVE-2025-37957
by Yuan Can 04 Aug '25

04 Aug '25

Mikhail Lobanov (1): KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Peter Gonda (1): KVM: SVM: Update SEV-ES shutdown intercepts with more metadata arch/x86/kvm/smm.c | 1 + arch/x86/kvm/svm/svm.c | 19 +++++++++++-------- 2 files changed, 12 insertions(+), 8 deletions(-) -- 2.22.0

2 5

[PATCH OLK-5.10] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v5.10.240 commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/k… -------------------------------- [ Upstream commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 ] Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/v3d/v3d_drv.h drivers/gpu/drm/v3d/v3d_gem.c drivers/gpu/drm/v3d/v3d_irq.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 7 +++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 38 ++++++++++++++++++++++++++--------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 8a390738d65b..a605b31a8224 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -37,6 +37,12 @@ struct v3d_queue_state { u64 emit_seqno; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -46,6 +52,7 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 64fe63c1938f..32cc461937cf 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index c88686489b88..6c233b9e8648 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -206,7 +206,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -217,17 +217,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -235,8 +242,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -271,12 +282,19 @@ void v3d_irq_disable(struct v3d_dev *v3d) { int core; + int i; /* Disable all interrupts. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: net: sierra: check for no status endpoint
by Ziming Du 04 Aug '25

04 Aug '25

From: Oliver Neukum <oneukum(a)suse.com> stable inclusion from stable-v6.1.147 commit 5849980faea1c792d1d5e54fdbf1e69ac0a9bfb9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD6S CVE: CVE-2025-38474 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c4ca3c46167518f8534ed70f6e3b4bf86c4d158 ] The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission. Reported-by: syzbot+3f89ec3d1d0842e95d50(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/686d5a9f.050a0220.1ffab7.0017.GAE@google.… Tested-by: syzbot+3f89ec3d1d0842e95d50(a)syzkaller.appspotmail.com Fixes: eb4fd8cd355c8 ("net/usb: add sierra_net.c driver") Signed-off-by: Oliver Neukum <oneukum(a)suse.com> Link: https://patch.msgid.link/20250714111326.258378-1-oneukum@suse.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/usb/sierra_net.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c index c43087e066963..f66c84b729a9b 100644 --- a/drivers/net/usb/sierra_net.c +++ b/drivers/net/usb/sierra_net.c @@ -705,6 +705,10 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) status); return -ENODEV; } + if (!dev->status) { + dev_err(&dev->udev->dev, "No status endpoint found"); + return -ENODEV; + } /* Initialize sierra private data */ priv = kzalloc(sizeof *priv, GFP_KERNEL); if (!priv) -- 2.43.0

2 1

[PACTH OLK-6.6 0/2] arm64: Fix two bugs for hardware xcall/xint
by Jinjie Ruan 04 Aug '25

04 Aug '25

Fix two bugs for hardware xcall/xint. Jinjie Ruan (2): arm64: Fix '__NR_syscalls' undeclared error arm64: Do not enable hardware xcall if actlr_el1 can not set arch/arm64/include/asm/xcall.h | 1 + arch/arm64/kernel/cpufeature.c | 45 ++++++++++++++-------------------- 2 files changed, 19 insertions(+), 27 deletions(-) -- 2.34.1

1 2

[PATCH OLK-5.10] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v5.10.240 commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/k… -------------------------------- [ Upstream commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 ] Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 7 +++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 38 ++++++++++++++++++++++++++--------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 8a390738d65b..a605b31a8224 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -37,6 +37,12 @@ struct v3d_queue_state { u64 emit_seqno; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -46,6 +52,7 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 64fe63c1938f..32cc461937cf 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index c88686489b88..6c233b9e8648 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -206,7 +206,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -217,17 +217,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -235,8 +242,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -271,12 +282,19 @@ void v3d_irq_disable(struct v3d_dev *v3d) { int core; + int i; /* Disable all interrupts. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1743/1743] arch/x86/mm/cpu_entry_area.c:155:5: warning: no previous prototype for 'arch_get_kallsym'
by kernel test robot 04 Aug '25

04 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba07135cf74b1424e2f7f0c60e59c5b206ab320c commit: d83212d5dd6761625fe87cc23016bbaa47303271 [1743/1743] kallsyms, x86: Export addresses of PTI entry trampolines config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250804/202508040829.QB64jfaH-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250804/202508040829.QB64jfaH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508040829.QB64jfaH-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/mm/cpu_entry_area.c:155:5: warning: no previous prototype for 'arch_get_kallsym' [-Wmissing-prototypes] 155 | int arch_get_kallsym(unsigned int symnum, unsigned long *value, char *type, | ^~~~~~~~~~~~~~~~ vim +/arch_get_kallsym +155 arch/x86/mm/cpu_entry_area.c 153 154 #ifdef CONFIG_X86_64 > 155 int arch_get_kallsym(unsigned int symnum, unsigned long *value, char *type, 156 char *name) 157 { 158 unsigned int cpu, ncpu = 0; 159 160 if (symnum >= num_possible_cpus()) 161 return -EINVAL; 162 163 for_each_possible_cpu(cpu) { 164 if (ncpu++ >= symnum) 165 break; 166 } 167 168 *value = (unsigned long)&get_cpu_entry_area(cpu)->entry_trampoline; 169 *type = 't'; 170 strlcpy(name, "__entry_SYSCALL_64_trampoline", KSYM_NAME_LEN); 171 172 return 0; 173 } 174 #endif 175 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] usb: net: sierra: check for no status endpoint
by Ziming Du 04 Aug '25

04 Aug '25

From: Oliver Neukum <oneukum(a)suse.com> stable inclusion from stable-v6.1.147 commit 5849980faea1c792d1d5e54fdbf1e69ac0a9bfb9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD6S CVE: CVE-2025-38474 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c4ca3c46167518f8534ed70f6e3b4bf86c4d158 ] The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission. Reported-by: syzbot+3f89ec3d1d0842e95d50(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/686d5a9f.050a0220.1ffab7.0017.GAE@google.… Tested-by: syzbot+3f89ec3d1d0842e95d50(a)syzkaller.appspotmail.com Fixes: eb4fd8cd355c8 ("net/usb: add sierra_net.c driver") Signed-off-by: Oliver Neukum <oneukum(a)suse.com> Link: https://patch.msgid.link/20250714111326.258378-1-oneukum@suse.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/usb/sierra_net.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c index 0abd257b634c6..a74ac9314d508 100644 --- a/drivers/net/usb/sierra_net.c +++ b/drivers/net/usb/sierra_net.c @@ -688,6 +688,10 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) status); return -ENODEV; } + if (!dev->status) { + dev_err(&dev->udev->dev, "No status endpoint found"); + return -ENODEV; + } /* Initialize sierra private data */ priv = kzalloc(sizeof *priv, GFP_KERNEL); if (!priv) -- 2.43.0

2 1

[PATCH OLK-6.6] usb: net: sierra: check for no status endpoint
by Ziming Du 04 Aug '25

04 Aug '25

From: Oliver Neukum <oneukum(a)suse.com> stable inclusion from stable-v6.6.100 commit 5dd6a441748dad2f02e27b256984ca0b2d4546b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD6S CVE: CVE-2025-38474 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c4ca3c46167518f8534ed70f6e3b4bf86c4d158 ] The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission. Reported-by: syzbot+3f89ec3d1d0842e95d50(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/686d5a9f.050a0220.1ffab7.0017.GAE@google.… Tested-by: syzbot+3f89ec3d1d0842e95d50(a)syzkaller.appspotmail.com Fixes: eb4fd8cd355c8 ("net/usb: add sierra_net.c driver") Signed-off-by: Oliver Neukum <oneukum(a)suse.com> Link: https://patch.msgid.link/20250714111326.258378-1-oneukum@suse.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/usb/sierra_net.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c index 673d3aa837926..42b66adb35f1b 100644 --- a/drivers/net/usb/sierra_net.c +++ b/drivers/net/usb/sierra_net.c @@ -689,6 +689,10 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) status); return -ENODEV; } + if (!dev->status) { + dev_err(&dev->udev->dev, "No status endpoint found"); + return -ENODEV; + } /* Initialize sierra private data */ priv = kzalloc(sizeof *priv, GFP_KERNEL); if (!priv) -- 2.43.0

2 1

[PATCH v2 OLK-6.6] livepatch: support for super-long symbol repositioning
by Li Huafei 04 Aug '25

04 Aug '25

From: caixiaomeng 00662745 <caixiaomeng2(a)huawei.com> EulerOS inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICPM0M ---------------------------------------- symbols longer than KSYM_NAME_LEN will be truncated in strtab, we can not find them using original name, so we use a new format .klp.sym.objname-ref_name,ref_offset to find a unique symbol and add ref_offset to get the long name symbol address. Signed-off-by: Zhipeng Xie <xiezhipeng1(a)huawei.com> Signed-off-by: caixiaomeng <caixiaomeng2(a)huawei.com> Signed-off-by: hubin <hubin73(a)huawei.com> --- kernel/livepatch/Kconfig | 10 ++++++++++ kernel/livepatch/core.c | 12 ++++++++++++ 2 files changed, 22 insertions(+) diff --git a/kernel/livepatch/Kconfig b/kernel/livepatch/Kconfig index 239480682c92..d663ad91c619 100644 --- a/kernel/livepatch/Kconfig +++ b/kernel/livepatch/Kconfig @@ -101,4 +101,14 @@ config LIVEPATCH_ISOLATE_KPROBE do not allow both modify the same instruction when a function is marked as 'notrace' and without the reserved instructions. +config LIVEPATCH_LONG_SYMBOL_SUPPORT + bool "support relocate symbol name whose length longer than 128 bytes" + depends on LIVEPATCH_WO_FTRACE + default y + help + symbols longer than KSYM_NAME_LEN will be truncated in strtab, + we can not find them using original name, so we use a new format + .klp.sym.objname-ref_name,ref_offset to find a unique symbol + and add ref_offset to get the long name symbol address. + endmenu diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index bb7ecc516b4a..bc390975fd2c 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -233,6 +233,7 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, #endif Elf_Sym *sym; unsigned long sympos, addr; + long ref_offset; bool sym_vmlinux; bool sec_vmlinux = !strcmp(sec_objname, "vmlinux"); @@ -266,10 +267,19 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, return -EINVAL; } + ref_offset = 0; /* Format: .klp.sym.sym_objname.sym_name,sympos */ cnt = sscanf(strtab + sym->st_name, ".klp.sym.%55[^.].%511[^,],%lu", sym_objname, sym_name, &sympos); + if (IS_ENABLED(CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT) && cnt != 3) { + /* Format: .klp.sym.objname-ref_name,ref_offset*/ + cnt = sscanf(strtab + sym->st_name, + ".klp.sym.%55[^-]-%127[^,],%ld", + sym_objname, sym_name, &ref_offset); + if (cnt == 3) + sympos = 1; + } if (cnt != 3) { pr_err("symbol %s has an incorrectly formatted name\n", strtab + sym->st_name); @@ -297,6 +307,8 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, return ret; sym->st_value = addr; + if (IS_ENABLED(CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT)) + sym->st_value += ref_offset; } return 0; -- 2.43.0

2 1

[PATCH OLK-5.10] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> mainline inclusion from mainline-v6.16-rc5 commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/k… -------------------------------- Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Conflicts: drivers/gpu/drm/v3d/v3d_drv.h drivers/gpu/drm/v3d/v3d_gem.c drivers/gpu/drm/v3d/v3d_irq.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 8 ++++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 37 +++++++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 8a390738d65b..60e03e785273 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -37,6 +37,12 @@ struct v3d_queue_state { u64 emit_seqno; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -46,6 +52,8 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; + void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 64fe63c1938f..32cc461937cf 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index c88686489b88..6dd5eb708be6 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -206,7 +206,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -217,17 +217,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -235,8 +242,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -277,6 +288,12 @@ v3d_irq_disable(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (int i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[PATCH OLK-6.6] fscrypt: Don't use problematic non-inline crypto engines
by Yongjian Sun 04 Aug '25

04 Aug '25

From: Eric Biggers <ebiggers(a)kernel.org> mainline inclusion from mainline-v6.16-rc7 commit b41c1d8d07906786c60893980d52688f31d114a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICQ8LW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Make fscrypt no longer use Crypto API drivers for non-inline crypto engines, even when the Crypto API prioritizes them over CPU-based code (which unfortunately it often does). These drivers tend to be really problematic, especially for fscrypt's workload. This commit has no effect on inline crypto engines, which are different and do work well. Specifically, exclude drivers that have CRYPTO_ALG_KERN_DRIVER_ONLY or CRYPTO_ALG_ALLOCATES_MEMORY set. (Later, CRYPTO_ALG_ASYNC should be excluded too. That's omitted for now to keep this commit backportable, since until recently some CPU-based code had CRYPTO_ALG_ASYNC set.) There are two major issues with these drivers: bugs and performance. First, these drivers tend to be buggy. They're fundamentally much more error-prone and harder to test than the CPU-based code. They often don't get tested before kernel releases, and even if they do, the crypto self-tests don't properly test these drivers. Released drivers have en/decrypted or hashed data incorrectly. These bugs cause issues for fscrypt users who often didn't even want to use these drivers, e.g.: - https://github.com/google/fscryptctl/issues/32 - https://github.com/google/fscryptctl/issues/9 - https://lore.kernel.org/r/PH0PR02MB731916ECDB6C613665863B6CFFAA2@PH0PR02MB7… These drivers have also similarly caused issues for dm-crypt users, including data corruption and deadlocks. Since Linux v5.10, dm-crypt has disabled most of them by excluding CRYPTO_ALG_ALLOCATES_MEMORY. Second, these drivers tend to be *much* slower than the CPU-based code. This may seem counterintuitive, but benchmarks clearly show it. There's a *lot* of overhead associated with going to a hardware driver, off the CPU, and back again. To prove this, I gathered as many systems with this type of crypto engine as I could, and I measured synchronous encryption of 4096-byte messages (which matches fscrypt's workload): Intel Emerald Rapids server: AES-256-XTS: xts-aes-vaes-avx512 16171 MB/s [CPU-based, Vector AES] qat_aes_xts 289 MB/s [Offload, Intel QuickAssist] Qualcomm SM8650 HDK: AES-256-XTS: xts-aes-ce 4301 MB/s [CPU-based, ARMv8 Crypto Extensions] xts-aes-qce 73 MB/s [Offload, Qualcomm Crypto Engine] i.MX 8M Nano LPDDR4 EVK: AES-256-XTS: xts-aes-ce 647 MB/s [CPU-based, ARMv8 Crypto Extensions] xts(ecb-aes-caam) 20 MB/s [Offload, CAAM] AES-128-CBC-ESSIV: essiv(cbc-aes-caam,sha256-lib) 23 MB/s [Offload, CAAM] STM32MP157F-DK2: AES-256-XTS: xts-aes-neonbs 13.2 MB/s [CPU-based, ARM NEON] xts(stm32-ecb-aes) 3.1 MB/s [Offload, STM32 crypto engine] AES-128-CBC-ESSIV: essiv(cbc-aes-neonbs,sha256-lib) 14.7 MB/s [CPU-based, ARM NEON] essiv(stm32-cbc-aes,sha256-lib) 3.2 MB/s [Offload, STM32 crypto engine] Adiantum: adiantum(xchacha12-arm,aes-arm,nhpoly1305-neon) 52.8 MB/s [CPU-based, ARM scalar + NEON] So, there was no case in which the crypto engine was even *close* to being faster. On the first three, which have AES instructions in the CPU, the CPU was 30 to 55 times faster (!). Even on STM32MP157F-DK2 which has a Cortex-A7 CPU that doesn't have AES instructions, AES was over 4 times faster on the CPU. And Adiantum encryption, which is what actually should be used on CPUs like that, was over 17 times faster. Other justifications that have been given for these non-inline crypto engines (almost always coming from the hardware vendors, not actual users) don't seem very plausible either: - The crypto engine throughput could be improved by processing multiple requests concurrently. Currently irrelevant to fscrypt, since it doesn't do that. This would also be complex, and unhelpful in many cases. 2 of the 4 engines I tested even had only one queue. - Some of the engines, e.g. STM32, support hardware keys. Also currently irrelevant to fscrypt, since it doesn't support these. Interestingly, the STM32 driver itself doesn't support this either. - Free up CPU for other tasks and/or reduce energy usage. Not very plausible considering the "short" message length, driver overhead, and scheduling overhead. There's just very little time for the CPU to do something else like run another task or enter low-power state, before the message finishes and it's time to process the next one. - Some of these engines resist power analysis and electromagnetic attacks, while the CPU-based crypto generally does not. In theory, this sounds great. In practice, if this benefit requires the use of an off-CPU offload that massively regresses performance and has a low-quality, buggy driver, the price for this hardening (which is not relevant to most fscrypt users, and tends to be incomplete) is just too high. Inline crypto engines are much more promising here, as are on-CPU solutions like RISC-V High Assurance Cryptography. Fixes: b30ab0e03407 ("ext4 crypto: add ext4 encryption facilities") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20250704070322.20692-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Conflicts: Documentation/filesystems/fscrypt.rst fs/crypto/fscrypt_private.h fs/crypto/hkdf.c [Context changed] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- Documentation/filesystems/fscrypt.rst | 37 +++++++++++---------------- fs/crypto/fscrypt_private.h | 17 ++++++++++++ fs/crypto/hkdf.c | 2 +- fs/crypto/keysetup.c | 3 ++- fs/crypto/keysetup_v1.c | 3 ++- 5 files changed, 37 insertions(+), 25 deletions(-) diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst index a624e92f2687..8e2f550b0169 100644 --- a/Documentation/filesystems/fscrypt.rst +++ b/Documentation/filesystems/fscrypt.rst @@ -141,9 +141,8 @@ However, these ioctls have some limitations: CONFIG_PAGE_POISONING=y in your kernel config and add page_poison=1 to your kernel command line. However, this has a performance cost. -- Secret keys might still exist in CPU registers, in crypto - accelerator hardware (if used by the crypto API to implement any of - the algorithms), or in other places not explicitly considered here. +- Secret keys might still exist in CPU registers or in other places + not explicitly considered here. Limitations of v1 policies ~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -375,9 +374,12 @@ the work is done by XChaCha12, which is much faster than AES when AES acceleration is unavailable. For more information about Adiantum, see `the Adiantum paper <https://eprint.iacr.org/2018/720.pdf>`_. -The (AES-128-CBC-ESSIV, AES-128-CTS-CBC) pair exists only to support -systems whose only form of AES acceleration is an off-CPU crypto -accelerator such as CAAM or CESA that does not support XTS. +The (AES-128-CBC-ESSIV, AES-128-CBC-CTS) pair was added to try to +provide a more efficient option for systems that lack AES instructions +in the CPU but do have a non-inline crypto engine such as CAAM or CESA +that supports AES-CBC (and not AES-XTS). This is deprecated. It has +been shown that just doing AES on the CPU is actually faster. +Moreover, Adiantum is faster still and is recommended on such systems. The remaining mode pairs are the "national pride ciphers": @@ -1231,22 +1233,13 @@ this by validating all top-level encryption policies prior to access. Inline encryption support ========================= -By default, fscrypt uses the kernel crypto API for all cryptographic -operations (other than HKDF, which fscrypt partially implements -itself). The kernel crypto API supports hardware crypto accelerators, -but only ones that work in the traditional way where all inputs and -outputs (e.g. plaintexts and ciphertexts) are in memory. fscrypt can -take advantage of such hardware, but the traditional acceleration -model isn't particularly efficient and fscrypt hasn't been optimized -for it. - -Instead, many newer systems (especially mobile SoCs) have *inline -encryption hardware* that can encrypt/decrypt data while it is on its -way to/from the storage device. Linux supports inline encryption -through a set of extensions to the block layer called *blk-crypto*. -blk-crypto allows filesystems to attach encryption contexts to bios -(I/O requests) to specify how the data will be encrypted or decrypted -in-line. For more information about blk-crypto, see +Many newer systems (especially mobile SoCs) have *inline encryption +hardware* that can encrypt/decrypt data while it is on its way to/from +the storage device. Linux supports inline encryption through a set of +extensions to the block layer called *blk-crypto*. blk-crypto allows +filesystems to attach encryption contexts to bios (I/O requests) to +specify how the data will be encrypted or decrypted in-line. For more +information about blk-crypto, see :ref:`Documentation/block/inline-encryption.rst <inline_encryption>`. On supported filesystems (currently ext4 and f2fs), fscrypt can use diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h index 2d63da48635a..b7438536bc8d 100644 --- a/fs/crypto/fscrypt_private.h +++ b/fs/crypto/fscrypt_private.h @@ -27,6 +27,23 @@ */ #define FSCRYPT_MIN_KEY_SIZE 16 +/* + * This mask is passed as the third argument to the crypto_alloc_*() functions + * to prevent fscrypt from using the Crypto API drivers for non-inline crypto + * engines. Those drivers have been problematic for fscrypt. fscrypt users + * have reported hangs and even incorrect en/decryption with these drivers. + * Since going to the driver, off CPU, and back again is really slow, such + * drivers can be over 50 times slower than the CPU-based code for fscrypt's + * workload. Even on platforms that lack AES instructions on the CPU, using the + * offloads has been shown to be slower, even staying with AES. (Of course, + * Adiantum is faster still, and is the recommended option on such platforms...) + * + * Note that fscrypt also supports inline crypto engines. Those don't use the + * Crypto API and work much better than the old-style (non-inline) engines. + */ +#define FSCRYPT_CRYPTOAPI_MASK \ + (CRYPTO_ALG_ALLOCATES_MEMORY | CRYPTO_ALG_KERN_DRIVER_ONLY) + #define FSCRYPT_CONTEXT_V1 1 #define FSCRYPT_CONTEXT_V2 2 diff --git a/fs/crypto/hkdf.c b/fs/crypto/hkdf.c index 5a384dad2c72..b7f5e7884e03 100644 --- a/fs/crypto/hkdf.c +++ b/fs/crypto/hkdf.c @@ -72,7 +72,7 @@ int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key, u8 prk[HKDF_HASHLEN]; int err; - hmac_tfm = crypto_alloc_shash(HKDF_HMAC_ALG, 0, 0); + hmac_tfm = crypto_alloc_shash(HKDF_HMAC_ALG, 0, FSCRYPT_CRYPTOAPI_MASK); if (IS_ERR(hmac_tfm)) { fscrypt_err(NULL, "Error allocating " HKDF_HMAC_ALG ": %ld", PTR_ERR(hmac_tfm)); diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c index 361f41ef46c7..2348fc2a47f8 100644 --- a/fs/crypto/keysetup.c +++ b/fs/crypto/keysetup.c @@ -103,7 +103,8 @@ fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key, struct crypto_skcipher *tfm; int err; - tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); + tfm = crypto_alloc_skcipher(mode->cipher_str, 0, + FSCRYPT_CRYPTOAPI_MASK); if (IS_ERR(tfm)) { if (PTR_ERR(tfm) == -ENOENT) { fscrypt_warn(inode, diff --git a/fs/crypto/keysetup_v1.c b/fs/crypto/keysetup_v1.c index 75dabd9b27f9..159dd0288349 100644 --- a/fs/crypto/keysetup_v1.c +++ b/fs/crypto/keysetup_v1.c @@ -52,7 +52,8 @@ static int derive_key_aes(const u8 *master_key, struct skcipher_request *req = NULL; DECLARE_CRYPTO_WAIT(wait); struct scatterlist src_sg, dst_sg; - struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0); + struct crypto_skcipher *tfm = + crypto_alloc_skcipher("ecb(aes)", 0, FSCRYPT_CRYPTOAPI_MASK); if (IS_ERR(tfm)) { res = PTR_ERR(tfm); -- 2.39.2

2 1

[PATCH OLK-5.10] fscrypt: Don't use problematic non-inline crypto engines
by Yongjian Sun 04 Aug '25

04 Aug '25

From: Eric Biggers <ebiggers(a)kernel.org> mainline inclusion from mainline-v6.16-rc7 commit b41c1d8d07906786c60893980d52688f31d114a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICQ8LW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Make fscrypt no longer use Crypto API drivers for non-inline crypto engines, even when the Crypto API prioritizes them over CPU-based code (which unfortunately it often does). These drivers tend to be really problematic, especially for fscrypt's workload. This commit has no effect on inline crypto engines, which are different and do work well. Specifically, exclude drivers that have CRYPTO_ALG_KERN_DRIVER_ONLY or CRYPTO_ALG_ALLOCATES_MEMORY set. (Later, CRYPTO_ALG_ASYNC should be excluded too. That's omitted for now to keep this commit backportable, since until recently some CPU-based code had CRYPTO_ALG_ASYNC set.) There are two major issues with these drivers: bugs and performance. First, these drivers tend to be buggy. They're fundamentally much more error-prone and harder to test than the CPU-based code. They often don't get tested before kernel releases, and even if they do, the crypto self-tests don't properly test these drivers. Released drivers have en/decrypted or hashed data incorrectly. These bugs cause issues for fscrypt users who often didn't even want to use these drivers, e.g.: - https://github.com/google/fscryptctl/issues/32 - https://github.com/google/fscryptctl/issues/9 - https://lore.kernel.org/r/PH0PR02MB731916ECDB6C613665863B6CFFAA2@PH0PR02MB7… These drivers have also similarly caused issues for dm-crypt users, including data corruption and deadlocks. Since Linux v5.10, dm-crypt has disabled most of them by excluding CRYPTO_ALG_ALLOCATES_MEMORY. Second, these drivers tend to be *much* slower than the CPU-based code. This may seem counterintuitive, but benchmarks clearly show it. There's a *lot* of overhead associated with going to a hardware driver, off the CPU, and back again. To prove this, I gathered as many systems with this type of crypto engine as I could, and I measured synchronous encryption of 4096-byte messages (which matches fscrypt's workload): Intel Emerald Rapids server: AES-256-XTS: xts-aes-vaes-avx512 16171 MB/s [CPU-based, Vector AES] qat_aes_xts 289 MB/s [Offload, Intel QuickAssist] Qualcomm SM8650 HDK: AES-256-XTS: xts-aes-ce 4301 MB/s [CPU-based, ARMv8 Crypto Extensions] xts-aes-qce 73 MB/s [Offload, Qualcomm Crypto Engine] i.MX 8M Nano LPDDR4 EVK: AES-256-XTS: xts-aes-ce 647 MB/s [CPU-based, ARMv8 Crypto Extensions] xts(ecb-aes-caam) 20 MB/s [Offload, CAAM] AES-128-CBC-ESSIV: essiv(cbc-aes-caam,sha256-lib) 23 MB/s [Offload, CAAM] STM32MP157F-DK2: AES-256-XTS: xts-aes-neonbs 13.2 MB/s [CPU-based, ARM NEON] xts(stm32-ecb-aes) 3.1 MB/s [Offload, STM32 crypto engine] AES-128-CBC-ESSIV: essiv(cbc-aes-neonbs,sha256-lib) 14.7 MB/s [CPU-based, ARM NEON] essiv(stm32-cbc-aes,sha256-lib) 3.2 MB/s [Offload, STM32 crypto engine] Adiantum: adiantum(xchacha12-arm,aes-arm,nhpoly1305-neon) 52.8 MB/s [CPU-based, ARM scalar + NEON] So, there was no case in which the crypto engine was even *close* to being faster. On the first three, which have AES instructions in the CPU, the CPU was 30 to 55 times faster (!). Even on STM32MP157F-DK2 which has a Cortex-A7 CPU that doesn't have AES instructions, AES was over 4 times faster on the CPU. And Adiantum encryption, which is what actually should be used on CPUs like that, was over 17 times faster. Other justifications that have been given for these non-inline crypto engines (almost always coming from the hardware vendors, not actual users) don't seem very plausible either: - The crypto engine throughput could be improved by processing multiple requests concurrently. Currently irrelevant to fscrypt, since it doesn't do that. This would also be complex, and unhelpful in many cases. 2 of the 4 engines I tested even had only one queue. - Some of the engines, e.g. STM32, support hardware keys. Also currently irrelevant to fscrypt, since it doesn't support these. Interestingly, the STM32 driver itself doesn't support this either. - Free up CPU for other tasks and/or reduce energy usage. Not very plausible considering the "short" message length, driver overhead, and scheduling overhead. There's just very little time for the CPU to do something else like run another task or enter low-power state, before the message finishes and it's time to process the next one. - Some of these engines resist power analysis and electromagnetic attacks, while the CPU-based crypto generally does not. In theory, this sounds great. In practice, if this benefit requires the use of an off-CPU offload that massively regresses performance and has a low-quality, buggy driver, the price for this hardening (which is not relevant to most fscrypt users, and tends to be incomplete) is just too high. Inline crypto engines are much more promising here, as are on-CPU solutions like RISC-V High Assurance Cryptography. Fixes: b30ab0e03407 ("ext4 crypto: add ext4 encryption facilities") Cc: stable(a)vger.kernel.org Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Link: https://lore.kernel.org/r/20250704070322.20692-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Conflicts: Documentation/filesystems/fscrypt.rst fs/crypto/fscrypt_private.h fs/crypto/hkdf.c [abb861fac0465 & 324718ddddc40 not applied for fscrypt.rst and context inconsistency for the remains] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- Documentation/filesystems/fscrypt.rst | 5 ++--- fs/crypto/fscrypt_private.h | 17 +++++++++++++++++ fs/crypto/hkdf.c | 2 +- fs/crypto/keysetup.c | 3 ++- fs/crypto/keysetup_v1.c | 3 ++- 5 files changed, 24 insertions(+), 6 deletions(-) diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst index 936fae06db77..01c929c97265 100644 --- a/Documentation/filesystems/fscrypt.rst +++ b/Documentation/filesystems/fscrypt.rst @@ -141,9 +141,8 @@ However, these ioctls have some limitations: CONFIG_PAGE_POISONING=y in your kernel config and add page_poison=1 to your kernel command line. However, this has a performance cost. -- Secret keys might still exist in CPU registers, in crypto - accelerator hardware (if used by the crypto API to implement any of - the algorithms), or in other places not explicitly considered here. +- Secret keys might still exist in CPU registers or in other places + not explicitly considered here. Limitations of v1 policies ~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h index b746d7df3758..bde1991db3a1 100644 --- a/fs/crypto/fscrypt_private.h +++ b/fs/crypto/fscrypt_private.h @@ -22,6 +22,23 @@ #define FSCRYPT_MIN_KEY_SIZE 16 +/* + * This mask is passed as the third argument to the crypto_alloc_*() functions + * to prevent fscrypt from using the Crypto API drivers for non-inline crypto + * engines. Those drivers have been problematic for fscrypt. fscrypt users + * have reported hangs and even incorrect en/decryption with these drivers. + * Since going to the driver, off CPU, and back again is really slow, such + * drivers can be over 50 times slower than the CPU-based code for fscrypt's + * workload. Even on platforms that lack AES instructions on the CPU, using the + * offloads has been shown to be slower, even staying with AES. (Of course, + * Adiantum is faster still, and is the recommended option on such platforms...) + * + * Note that fscrypt also supports inline crypto engines. Those don't use the + * Crypto API and work much better than the old-style (non-inline) engines. + */ +#define FSCRYPT_CRYPTOAPI_MASK \ + (CRYPTO_ALG_ALLOCATES_MEMORY | CRYPTO_ALG_KERN_DRIVER_ONLY) + #define FSCRYPT_CONTEXT_V1 1 #define FSCRYPT_CONTEXT_V2 2 diff --git a/fs/crypto/hkdf.c b/fs/crypto/hkdf.c index 7607d18b35fc..8cc611896c32 100644 --- a/fs/crypto/hkdf.c +++ b/fs/crypto/hkdf.c @@ -72,7 +72,7 @@ int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key, u8 prk[HKDF_HASHLEN]; int err; - hmac_tfm = crypto_alloc_shash(HKDF_HMAC_ALG, 0, 0); + hmac_tfm = crypto_alloc_shash(HKDF_HMAC_ALG, 0, FSCRYPT_CRYPTOAPI_MASK); if (IS_ERR(hmac_tfm)) { fscrypt_err(NULL, "Error allocating " HKDF_HMAC_ALG ": %ld", PTR_ERR(hmac_tfm)); diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c index 7b14054fab49..c7f5b4a6d7fe 100644 --- a/fs/crypto/keysetup.c +++ b/fs/crypto/keysetup.c @@ -81,7 +81,8 @@ fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key, struct crypto_skcipher *tfm; int err; - tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); + tfm = crypto_alloc_skcipher(mode->cipher_str, 0, + FSCRYPT_CRYPTOAPI_MASK); if (IS_ERR(tfm)) { if (PTR_ERR(tfm) == -ENOENT) { fscrypt_warn(inode, diff --git a/fs/crypto/keysetup_v1.c b/fs/crypto/keysetup_v1.c index 2762c5350432..a38a01a45279 100644 --- a/fs/crypto/keysetup_v1.c +++ b/fs/crypto/keysetup_v1.c @@ -52,7 +52,8 @@ static int derive_key_aes(const u8 *master_key, struct skcipher_request *req = NULL; DECLARE_CRYPTO_WAIT(wait); struct scatterlist src_sg, dst_sg; - struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0); + struct crypto_skcipher *tfm = + crypto_alloc_skcipher("ecb(aes)", 0, FSCRYPT_CRYPTOAPI_MASK); if (IS_ERR(tfm)) { res = PTR_ERR(tfm); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/v3d: Disable interrupts before resetting the GPU
by Xiaomeng Zhang 04 Aug '25

04 Aug '25

From: Maíra Canal <mcanal(a)igalia.com> mainline inclusion from mainline-v6.16-rc5 commit 226862f50a7a88e4e4de9abbf36c64d19acd6fd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDY CVE: CVE-2025-38371 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/k… -------------------------------- Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the GPU, it's necessary to disable all interrupts and deal with any interrupt handler still in-flight. Otherwise, the GPU might reset with jobs still running, or yet, an interrupt could be handled during the reset. Cc: stable(a)vger.kernel.org Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") Reviewed-by: Juan A. Suarez <jasuarez(a)igalia.com> Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Link: https://lore.kernel.org/r/20250628224243.47599-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Conflicts: drivers/gpu/drm/v3d/v3d_drv.h drivers/gpu/drm/v3d/v3d_gem.c drivers/gpu/drm/v3d/v3d_irq.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_drv.h | 8 ++++++++ drivers/gpu/drm/v3d/v3d_gem.c | 2 ++ drivers/gpu/drm/v3d/v3d_irq.c | 37 +++++++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h index 7f664a4b2a75..bcef978ba9c4 100644 --- a/drivers/gpu/drm/v3d/v3d_drv.h +++ b/drivers/gpu/drm/v3d/v3d_drv.h @@ -62,6 +62,12 @@ struct v3d_perfmon { u64 values[]; }; +enum v3d_irq { + V3D_CORE_IRQ, + V3D_HUB_IRQ, + V3D_MAX_IRQS, +}; + struct v3d_dev { struct drm_device drm; @@ -71,6 +77,8 @@ struct v3d_dev { int ver; bool single_irq_line; + int irq[V3D_MAX_IRQS]; + void __iomem *hub_regs; void __iomem *core_regs[3]; void __iomem *bridge_regs; diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c index 2e94ce788c71..ef991a9b1c6c 100644 --- a/drivers/gpu/drm/v3d/v3d_gem.c +++ b/drivers/gpu/drm/v3d/v3d_gem.c @@ -120,6 +120,8 @@ v3d_reset(struct v3d_dev *v3d) if (false) v3d_idle_axi(v3d, 0); + v3d_irq_disable(v3d); + v3d_idle_gca(v3d); v3d_reset_v3d(v3d); diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c index b2d59a168697..641315dbee8b 100644 --- a/drivers/gpu/drm/v3d/v3d_irq.c +++ b/drivers/gpu/drm/v3d/v3d_irq.c @@ -215,7 +215,7 @@ v3d_hub_irq(int irq, void *arg) int v3d_irq_init(struct v3d_dev *v3d) { - int irq1, ret, core; + int irq, ret, core; INIT_WORK(&v3d->overflow_mem_work, v3d_overflow_mem_work); @@ -226,17 +226,24 @@ v3d_irq_init(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS); - irq1 = platform_get_irq_optional(v3d_to_pdev(v3d), 1); - if (irq1 == -EPROBE_DEFER) - return irq1; - if (irq1 > 0) { - ret = devm_request_irq(v3d->drm.dev, irq1, + irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1); + if (irq == -EPROBE_DEFER) + return irq; + if (irq > 0) { + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d_core0", v3d); if (ret) goto fail; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_HUB_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_HUB_IRQ], v3d_hub_irq, IRQF_SHARED, "v3d_hub", v3d); if (ret) @@ -244,8 +251,12 @@ v3d_irq_init(struct v3d_dev *v3d) } else { v3d->single_irq_line = true; - ret = devm_request_irq(v3d->drm.dev, - platform_get_irq(v3d_to_pdev(v3d), 0), + irq = platform_get_irq(v3d_to_pdev(v3d), 0); + if (irq < 0) + return irq; + v3d->irq[V3D_CORE_IRQ] = irq; + + ret = devm_request_irq(v3d->drm.dev, v3d->irq[V3D_CORE_IRQ], v3d_irq, IRQF_SHARED, "v3d", v3d); if (ret) @@ -286,6 +297,12 @@ v3d_irq_disable(struct v3d_dev *v3d) V3D_CORE_WRITE(core, V3D_CTL_INT_MSK_SET, ~0); V3D_WRITE(V3D_HUB_INT_MSK_SET, ~0); + /* Finish any interrupt handler still in flight. */ + for (int i = 0; i < V3D_MAX_IRQS; i++) { + if (v3d->irq[i]) + synchronize_irq(v3d->irq[i]); + } + /* Clear any pending interrupts we might have left. */ for (core = 0; core < v3d->cores; core++) V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS); -- 2.34.1

2 1

[PATCH OLK-6.6] livepatch: support for super-long symbol repositioning
by Li Huafei 04 Aug '25

04 Aug '25

From: caixiaomeng 00662745 <caixiaomeng2(a)huawei.com> EulerOS inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICPM0M ---------------------------------------- symbols longer than KSYM_NAME_LEN will be truncated in strtab, we can not find them using original name, so we use a new format .klp.sym.objname-ref_name,ref_offset to find a unique symbol and add ref_offset to get the long name symbol address. Signed-off-by: Zhipeng Xie <xiezhipeng1(a)huawei.com> Signed-off-by: caixiaomeng <caixiaomeng2(a)huawei.com> Signed-off-by: hubin <hubin73(a)huawei.com> --- kernel/livepatch/Kconfig | 10 ++++++++++ kernel/livepatch/core.c | 12 ++++++++++++ 2 files changed, 22 insertions(+) diff --git a/kernel/livepatch/Kconfig b/kernel/livepatch/Kconfig index 239480682c92..d663ad91c619 100644 --- a/kernel/livepatch/Kconfig +++ b/kernel/livepatch/Kconfig @@ -101,4 +101,14 @@ config LIVEPATCH_ISOLATE_KPROBE do not allow both modify the same instruction when a function is marked as 'notrace' and without the reserved instructions. +config LIVEPATCH_LONG_SYMBOL_SUPPORT + bool "support relocate symbol name whose length longer than 128 bytes" + depends on LIVEPATCH_WO_FTRACE + default y + help + symbols longer than KSYM_NAME_LEN will be truncated in strtab, + we can not find them using original name, so we use a new format + .klp.sym.objname-ref_name,ref_offset to find a unique symbol + and add ref_offset to get the long name symbol address. + endmenu diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index bb7ecc516b4a..bc390975fd2c 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -233,6 +233,7 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, #endif Elf_Sym *sym; unsigned long sympos, addr; + long ref_offset; bool sym_vmlinux; bool sec_vmlinux = !strcmp(sec_objname, "vmlinux"); @@ -266,10 +267,19 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, return -EINVAL; } + ref_offset = 0; /* Format: .klp.sym.sym_objname.sym_name,sympos */ cnt = sscanf(strtab + sym->st_name, ".klp.sym.%55[^.].%511[^,],%lu", sym_objname, sym_name, &sympos); + if (IS_ENABLED(CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT) && cnt != 3) { + /* Format: .klp.sym.objname-ref_name,ref_offset*/ + cnt = sscanf(strtab + sym->st_name, + ".klp.sym.%55[^-]-%127[^,],%ld", + sym_objname, sym_name, &ref_offset); + if (cnt == 3) + sympos = 1; + } if (cnt != 3) { pr_err("symbol %s has an incorrectly formatted name\n", strtab + sym->st_name); @@ -297,6 +307,8 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, return ret; sym->st_value = addr; + if (IS_ENABLED(CONFIG_LIVEPATCH_LONG_SYMBOL_SUPPORT)) + sym->st_value += ref_offset; } return 0; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] Squashfs: check return result of sb_min_blocksize
by Long Li 04 Aug '25

04 Aug '25

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.4.294 commit db7096ea160e40d78c67fce52e7cc51bde049497 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXJK CVE: CVE-2025-38415 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 734aa85390ea693bb7eaf2240623d41b03705c84 ] Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize(). Link: https://lkml.kernel.org/r/20250409024747.876480-1-phillip@squashfs.org.uk Fixes: 0aa666190509 ("Squashfs: super block operations") Reported-by: syzbot+65761fc25a137b9c8c6e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67f0dd7a.050a0220.0a13.0230.GAE@google.com/ Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/squashfs/super.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/squashfs/super.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c index 40e657386fa5..542d792624d6 100644 --- a/fs/squashfs/super.c +++ b/fs/squashfs/super.c @@ -97,6 +97,11 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) msblk = sb->s_fs_info; msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); + if (!msblk->devblksize) { + ERROR("squashfs: unable to set blocksize\n"); + return -EINVAL; + } + msblk->devblksize_log2 = ffz(~msblk->devblksize); mutex_init(&msblk->meta_index_mutex); -- 2.39.2

2 1

[PATCH OLK-5.10] Squashfs: check return result of sb_min_blocksize
by Long Li 04 Aug '25

04 Aug '25

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.10.238 commit 549f9e3d7b60d53808c98b9fde49b4f46d0524a5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXJK CVE: CVE-2025-38415 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 734aa85390ea693bb7eaf2240623d41b03705c84 ] Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize(). Link: https://lkml.kernel.org/r/20250409024747.876480-1-phillip@squashfs.org.uk Fixes: 0aa666190509 ("Squashfs: super block operations") Reported-by: syzbot+65761fc25a137b9c8c6e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67f0dd7a.050a0220.0a13.0230.GAE@google.com/ Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/squashfs/super.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c index f7128ae7b949..bb2958ad8a6f 100644 --- a/fs/squashfs/super.c +++ b/fs/squashfs/super.c @@ -118,6 +118,11 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) msblk = sb->s_fs_info; msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); + if (!msblk->devblksize) { + errorf(fc, "squashfs: unable to set blocksize\n"); + return -EINVAL; + } + msblk->devblksize_log2 = ffz(~msblk->devblksize); mutex_init(&msblk->meta_index_mutex); -- 2.39.2

2 1

[PATCH OLK-6.6] Squashfs: check return result of sb_min_blocksize
by Long Li 04 Aug '25

04 Aug '25

From: Phillip Lougher <phillip(a)squashfs.org.uk> mainline inclusion from mainline-v6.15-rc6 commit 734aa85390ea693bb7eaf2240623d41b03705c84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXJK CVE: CVE-2025-38415 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize(). Link: https://lkml.kernel.org/r/20250409024747.876480-1-phillip@squashfs.org.uk Fixes: 0aa666190509 ("Squashfs: super block operations") Reported-by: syzbot+65761fc25a137b9c8c6e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67f0dd7a.050a0220.0a13.0230.GAE@google.com/ Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/squashfs/super.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c index 22e812808e5c..3a27d4268b3c 100644 --- a/fs/squashfs/super.c +++ b/fs/squashfs/super.c @@ -202,6 +202,11 @@ static int squashfs_fill_super(struct super_block *sb, struct fs_context *fc) msblk->panic_on_errors = (opts->errors == Opt_errors_panic); msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); + if (!msblk->devblksize) { + errorf(fc, "squashfs: unable to set blocksize\n"); + return -EINVAL; + } + msblk->devblksize_log2 = ffz(~msblk->devblksize); mutex_init(&msblk->meta_index_mutex); -- 2.39.2

2 1

[PATCH OLK-5.10] selftests/tracing: Fix false failure of subsystem event test
by Tengda Wu 04 Aug '25

04 Aug '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.17 commit 213879061a9c60200ba971330dbefec6df3b4a30 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICQQ5K Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The subsystem event test enables all "sched" events and makes sure there's at least 3 different events in the output. It used to cat the entire trace file to | wc -l, but on slow machines, that could last a very long time. To solve that, it was changed to just read the first 100 lines of the trace file. This can cause false failures as some events repeat so often, that the 100 lines that are examined could possibly be of only one event. Instead, create an awk script that looks for 3 different events and will exit out after it finds them. This will find the 3 events the test looks for (eventually if it works), and still exit out after the test is satisfied and not cause slower machines to run forever. Link: https://lore.kernel.org/r/20250721134212.53c3e140@batman.local.home Reported-by: Tengda Wu <wutengda(a)huaweicloud.com> Closes: https://lore.kernel.org/all/20250710130134.591066-1-wutengda@huaweicloud.co… Fixes: 1a4ea83a6e67 ("selftests/ftrace: Limit length in subsystem-enable tests") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../ftrace/test.d/event/subsystem-enable.tc | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc index b7c8f29c09a9..65916bb55dfb 100644 --- a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +++ b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc @@ -14,11 +14,35 @@ fail() { #msg exit_fail } +# As reading trace can last forever, simply look for 3 different +# events then exit out of reading the file. If there's not 3 different +# events, then the test has failed. +check_unique() { + cat trace | grep -v '^#' | awk ' + BEGIN { cnt = 0; } + { + for (i = 0; i < cnt; i++) { + if (event[i] == $5) { + break; + } + } + if (i == cnt) { + event[cnt++] = $5; + if (cnt > 2) { + exit; + } + } + } + END { + printf "%d", cnt; + }' +} + echo 'sched:*' > set_event yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi @@ -29,7 +53,7 @@ echo 1 > events/sched/enable yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi -- 2.34.1

2 1

[PATCH OLK-6.6] selftests/tracing: Fix false failure of subsystem event test
by Tengda Wu 04 Aug '25

04 Aug '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.17 commit 213879061a9c60200ba971330dbefec6df3b4a30 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICQQ5K Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The subsystem event test enables all "sched" events and makes sure there's at least 3 different events in the output. It used to cat the entire trace file to | wc -l, but on slow machines, that could last a very long time. To solve that, it was changed to just read the first 100 lines of the trace file. This can cause false failures as some events repeat so often, that the 100 lines that are examined could possibly be of only one event. Instead, create an awk script that looks for 3 different events and will exit out after it finds them. This will find the 3 events the test looks for (eventually if it works), and still exit out after the test is satisfied and not cause slower machines to run forever. Link: https://lore.kernel.org/r/20250721134212.53c3e140@batman.local.home Reported-by: Tengda Wu <wutengda(a)huaweicloud.com> Closes: https://lore.kernel.org/all/20250710130134.591066-1-wutengda@huaweicloud.co… Fixes: 1a4ea83a6e67 ("selftests/ftrace: Limit length in subsystem-enable tests") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- .../ftrace/test.d/event/subsystem-enable.tc | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc index b7c8f29c09a9..65916bb55dfb 100644 --- a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc +++ b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc @@ -14,11 +14,35 @@ fail() { #msg exit_fail } +# As reading trace can last forever, simply look for 3 different +# events then exit out of reading the file. If there's not 3 different +# events, then the test has failed. +check_unique() { + cat trace | grep -v '^#' | awk ' + BEGIN { cnt = 0; } + { + for (i = 0; i < cnt; i++) { + if (event[i] == $5) { + break; + } + } + if (i == cnt) { + event[cnt++] = $5; + if (cnt > 2) { + exit; + } + } + } + END { + printf "%d", cnt; + }' +} + echo 'sched:*' > set_event yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi @@ -29,7 +53,7 @@ echo 1 > events/sched/enable yield -count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l` +count=`check_unique` if [ $count -lt 3 ]; then fail "at least fork, exec and exit events should be recorded" fi -- 2.34.1

2 1