- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/5] Support SMT control on arm64
by Yushan Wang 11 Apr '25

11 Apr '25

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBZQQR ---------------------------------------------------------------------- The core CPU control framework supports runtime SMT control which is not yet supported on arm64. Besides the general vulnerabilities concerns we want this runtime control on our arm64 server for: - better single CPU performance in some cases - saving overall power consumption This patchset implements it in the following aspects: - Provides a default topology_is_primary_thread() - support retrieve SMT thread number on OF based system - support retrieve SMT thread number on ACPI based system - select HOTPLUG_SMT for arm64 Tests has been done on our ACPI based arm64 server and on ACPI/OF based QEMU VMs. Yicong Yang (5): Revert "arm64: Kconfig: Enable HOTPLUG_SMT" cpu/SMT: Provide a default topology_is_primary_thread() arch_topology: Support SMT control for OF based system arm64: topology: Support SMT control on ACPI based system arm64: Kconfig: Enable HOTPLUG_SMT arch/arm64/Kconfig | 2 +- arch/arm64/configs/openeuler_defconfig | 1 - arch/arm64/kernel/topology.c | 67 +++++++++++++++++++------- arch/powerpc/include/asm/topology.h | 1 + arch/x86/include/asm/topology.h | 3 +- drivers/base/arch_topology.c | 61 +++++++---------------- include/linux/arch_topology.h | 14 ------ include/linux/topology.h | 24 +++++++++ 8 files changed, 94 insertions(+), 79 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS] proc: fix UAF in proc_get_inode()
by Yongjian Sun 11 Apr '25

11 Apr '25

mainline inclusion from mainline-v6.12-rc3 commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFS CVE: CVE-2025-21999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [adobriyan(a)gmail.com: don't do 2 atomic ops on the common path] Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: David S. Miller <davem(a)davemloft.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/proc/inode.c fs/proc/generic.c fs/proc/internal.h include/linux/proc_fs.h [The pre-patch d919b33dafb3 ("proc: faster open/read/close with "permanent" files") is not imported.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/proc/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 31bf3bb8ddae..7d225a2b8b2a 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -462,6 +462,14 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) make_empty_dir_inode(inode); return inode; } + + if (!use_pde(de)) { + PROC_I(inode)->pde = NULL; + pde_put(de); + iput(inode); + return NULL; + } + if (de->mode) { inode->i_mode = de->mode; inode->i_uid = de->uid; @@ -486,6 +494,7 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) inode->i_fop = de->proc_fops; } } + unuse_pde(de); } else pde_put(de); return inode; -- 2.39.2

2 1

[PATCH OLK-6.6 00/14] yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 11 Apr '25

11 Apr '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (14): yt6801: Add support for a pci table in this module yt6801: Implement mdio register yt6801: Implement pci_driver shutdown yt6801: Implement the fxgmac_init function yt6801: Implement the .ndo_open function yt6801: Implement the fxgmac_start function net:phy:motorcomm: Add PHY_INTERFACE_MODE_INTERNAL to support YT6801 yt6801: Implement the fxgmac_hw_init function yt6801: Implement the poll functions yt6801: Implement .ndo_start_xmit function yt6801: Implement some net_device_ops function yt6801: Implement pci_driver suspend and resume yt6801: Add makefile and Kconfig yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/powerpc/configs/openeuler_defconfig | 4 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 8 + .../ethernet/motorcomm/yt6801/yt6801_desc.c | 565 +++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 35 + .../ethernet/motorcomm/yt6801/yt6801_main.c | 3020 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_type.h | 957 ++++++ drivers/net/phy/motorcomm.c | 6 + 15 files changed, 4646 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 15

[openeuler:OLK-6.6 2117/2117] kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static?
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 89bf80a4d6d5ba852b9042480e0be23c2c4a628c [2117/2117] sched: Introduce priority load balance for qos scheduler config: loongarch-randconfig-r121-20250411 (https://download.01.org/0day-ci/archive/20250411/202504110741.FCO7H6rm-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250411/202504110741.FCO7H6rm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504110741.FCO7H6rm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_sched_prio_load_balance_enabled' was not declared. Should it be static? kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got unsigned int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:7578:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:7578:9: sparse: expected void *ptr kernel/sched/fair.c:7578:9: sparse: got int [noderef] __percpu * kernel/sched/fair.c:1271:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1271:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1271:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:12846:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12846:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12846:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5925:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5925:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5925:22: sparse: struct task_struct * kernel/sched/fair.c:6667:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6667:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6667:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7396:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7396:32: sparse: expected void *ptr kernel/sched/fair.c:7396:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7499:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7499:16: sparse: expected void *ptr kernel/sched/fair.c:7499:16: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7974:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got struct cpumask *[noderef] __percpu * @@ kernel/sched/fair.c:7974:32: sparse: expected void *ptr kernel/sched/fair.c:7974:32: sparse: got struct cpumask *[noderef] __percpu * kernel/sched/fair.c:7998:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7998:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7998:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8310:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8310:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8310:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8421:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8421:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8421:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8641:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8641:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8641:22: sparse: struct task_struct * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8706:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8706:16: sparse: expected void *ptr kernel/sched/fair.c:8706:16: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/sched/fair.c:8763:13: sparse: expected void *ptr kernel/sched/fair.c:8763:13: sparse: got int [noderef] __percpu * kernel/sched/fair.c:8763:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ vim +/sysctl_sched_prio_load_balance_enabled +151 kernel/sched/fair.c 149 150 #ifdef CONFIG_QOS_SCHED_PRIO_LB > 151 unsigned int sysctl_sched_prio_load_balance_enabled; 152 #endif 153 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2117/2117] drivers/iommu/loongarch_iommu.c:1292:22: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 72fe4978ee346c10869113410da1b61710dd8d8f [2117/2117] LoongArch: add iommu support config: loongarch-randconfig-r132-20250411 (https://download.01.org/0day-ci/archive/20250411/202504110226.FM6zQ8DE-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250411/202504110226.FM6zQ8DE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504110226.FM6zQ8DE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/iommu/loongarch_iommu.c:108:9: sparse: sparse: symbol 'la_iommu_last_bdf' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:112:5: sparse: sparse: symbol 'loongarch_iommu_disable' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:130:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:130:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:130:15: sparse: got void * drivers/iommu/loongarch_iommu.c:132:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:132:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:132:9: sparse: got void * drivers/iommu/loongarch_iommu.c:135:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:135:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:135:15: sparse: got void * drivers/iommu/loongarch_iommu.c:137:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:137:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:137:9: sparse: got void * drivers/iommu/loongarch_iommu.c:150:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:150:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:150:15: sparse: got void * drivers/iommu/loongarch_iommu.c:152:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:152:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:152:9: sparse: got void * drivers/iommu/loongarch_iommu.c:155:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:155:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:155:15: sparse: got void * drivers/iommu/loongarch_iommu.c:157:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:157:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:157:9: sparse: got void * drivers/iommu/loongarch_iommu.c:160:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:160:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:160:15: sparse: got void * drivers/iommu/loongarch_iommu.c:162:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:162:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:162:9: sparse: got void * drivers/iommu/loongarch_iommu.c:190:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:190:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:190:15: sparse: got void * drivers/iommu/loongarch_iommu.c:193:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:193:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:193:9: sparse: got void * drivers/iommu/loongarch_iommu.c:196:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:196:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:196:15: sparse: got void * drivers/iommu/loongarch_iommu.c:199:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:199:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:199:9: sparse: got void * drivers/iommu/loongarch_iommu.c:206:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:206:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:206:15: sparse: got void * drivers/iommu/loongarch_iommu.c:306:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:306:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:306:17: sparse: got void * drivers/iommu/loongarch_iommu.c:310:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:310:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:310:17: sparse: got void * drivers/iommu/loongarch_iommu.c:312:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:312:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:312:23: sparse: got void * drivers/iommu/loongarch_iommu.c:314:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:314:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:314:17: sparse: got void * drivers/iommu/loongarch_iommu.c:322:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:322:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:322:23: sparse: got void * drivers/iommu/loongarch_iommu.c:325:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:325:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:325:17: sparse: got void * drivers/iommu/loongarch_iommu.c:327:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:327:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:327:23: sparse: got void * drivers/iommu/loongarch_iommu.c:329:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:329:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:329:17: sparse: got void * drivers/iommu/loongarch_iommu.c:349:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:349:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:349:15: sparse: got void * drivers/iommu/loongarch_iommu.c:352:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:352:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:352:9: sparse: got void * drivers/iommu/loongarch_iommu.c:610:6: sparse: sparse: symbol 'domain_deattach_iommu' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:651:28: sparse: sparse: symbol 'lookup_rlooptable' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:662:24: sparse: sparse: symbol 'find_iommu_by_dev' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:721:21: sparse: sparse: symbol 'la_iommu_probe_device' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:752:19: sparse: sparse: symbol 'get_iommu_info_from_dom' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:794:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:794:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:794:9: sparse: got void * drivers/iommu/loongarch_iommu.c:795:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:795:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:795:9: sparse: got void * drivers/iommu/loongarch_iommu.c:796:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:796:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:796:9: sparse: got void * drivers/iommu/loongarch_iommu.c:1178:24: sparse: sparse: symbol 'la_iommu_ops' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:1197:24: sparse: sparse: symbol 'loongarch_get_iommu_by_devid' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:1215:6: sparse: sparse: symbol 'check_device_compat' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:1259:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *confbase @@ got void [noderef] __iomem * @@ drivers/iommu/loongarch_iommu.c:1259:25: sparse: expected void *confbase drivers/iommu/loongarch_iommu.c:1259:25: sparse: got void [noderef] __iomem * >> drivers/iommu/loongarch_iommu.c:1292:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *confbase @@ drivers/iommu/loongarch_iommu.c:1292:22: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:1292:22: sparse: got void *confbase drivers/iommu/loongarch_iommu.c:1319:30: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *confbase @@ drivers/iommu/loongarch_iommu.c:1319:30: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:1319:30: sparse: got void *confbase drivers/iommu/loongarch_iommu.c:1344:28: sparse: sparse: symbol 'create_rlookup_entry' was not declared. Should it be static? vim +1292 drivers/iommu/loongarch_iommu.c 1223 1224 static int loongarch_iommu_probe(struct pci_dev *pdev, 1225 const struct pci_device_id *ent) 1226 { 1227 int ret = 1; 1228 int bitmap_sz = 0; 1229 int tmp; 1230 bool compat = false; 1231 struct loongarch_iommu *iommu = NULL; 1232 resource_size_t base, size; 1233 1234 iommu = loongarch_get_iommu_by_devid(pdev); 1235 if (iommu == NULL) { 1236 pci_info(pdev, "%s can't find iommu\n", __func__); 1237 return -ENODEV; 1238 } 1239 1240 compat = check_device_compat(pdev); 1241 if (!compat) { 1242 pci_info(pdev, 1243 "%s The iommu driver is not compatible with this device\n", 1244 __func__); 1245 return -ENODEV; 1246 } 1247 1248 iommu->pdev = pdev; 1249 base = pci_resource_start(pdev, 0); 1250 size = pci_resource_len(pdev, 0); 1251 if (!request_mem_region(base, size, "loongarch_iommu")) { 1252 pci_err(pdev, 1253 "%d can't reserve mmio registers base %llx size %llx\n", 1254 __LINE__, base, size); 1255 return -ENOMEM; 1256 } 1257 iommu->confbase_phy = base; 1258 iommu->conf_size = size; 1259 iommu->confbase = ioremap(base, size); 1260 if (iommu->confbase == NULL) { 1261 pci_info(pdev, "%s iommu pci dev bar0 is NULL\n", __func__); 1262 return ret; 1263 } 1264 1265 pr_info("iommu confbase %llx pgtsize %llx\n", 1266 (u64)iommu->confbase, size); 1267 tmp = MAX_DOMAIN_ID / 8; 1268 bitmap_sz = (MAX_DOMAIN_ID % 8) ? (tmp + 1) : tmp; 1269 iommu->domain_bitmap = bitmap_zalloc(bitmap_sz, GFP_KERNEL); 1270 if (iommu->domain_bitmap == NULL) { 1271 pr_err("LA-IOMMU: domain bitmap alloc err bitmap_sz:%d\n", 1272 bitmap_sz); 1273 goto out_err; 1274 } 1275 1276 tmp = MAX_ATTACHED_DEV_ID / 8; 1277 bitmap_sz = (MAX_ATTACHED_DEV_ID % 8) ? (tmp + 1) : tmp; 1278 iommu->devtable_bitmap = bitmap_zalloc(bitmap_sz, GFP_KERNEL); 1279 if (iommu->devtable_bitmap == NULL) { 1280 pr_err("LA-IOMMU: devtable bitmap alloc err bitmap_sz:%d\n", 1281 bitmap_sz); 1282 goto out_err_1; 1283 } 1284 1285 ret = iommu_device_sysfs_add(&iommu->iommu_dev, &pdev->dev, 1286 NULL, "ivhd-%#x", iommu->devid); 1287 iommu_device_register(&iommu->iommu_dev, &la_iommu_ops, NULL); 1288 return 0; 1289 1290 out_err_1: 1291 iommu->pdev = NULL; > 1292 iounmap(iommu->confbase); 1293 iommu->confbase = NULL; 1294 release_mem_region(iommu->confbase_phy, iommu->conf_size); 1295 iommu->confbase_phy = 0; 1296 iommu->conf_size = 0; 1297 kfree(iommu->domain_bitmap); 1298 iommu->domain_bitmap = NULL; 1299 out_err: 1300 return ret; 1301 } 1302 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1578/1578] drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: warning: objtool: missing symbol for section .text.unlikely.
by kernel test robot 11 Apr '25

11 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ac44c6a4925e0772513c3597d420e5705faf482b commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [1578/1578] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-005-20250410 (https://download.01.org/0day-ci/archive/20250411/202504110241.8SiMchEQ-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250411/202504110241.8SiMchEQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504110241.8SiMchEQ-lkp@intel.com/ All warnings (new ones prefixed by >>): | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2542:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2542 | u32 flash_read_dword(struct ngbe_hw *hw, u32 addr) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2551:4: warning: no previous prototype for function 'flash_write_dword' [-Wmissing-prototypes] 2551 | u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2551:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2551 | u8 flash_write_dword(struct ngbe_hw *hw, u32 addr, u32 dword) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:5: warning: no previous prototype for function 'ngbe_flash_write_cab' [-Wmissing-prototypes] 2567 | int ngbe_flash_write_cab(struct ngbe_hw *hw, u32 addr, u32 value, u16 lan_id) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2567 | int ngbe_flash_write_cab(struct ngbe_hw *hw, u32 addr, u32 value, u16 lan_id) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2593:5: warning: no previous prototype for function 'ngbe_flash_read_cab' [-Wmissing-prototypes] 2593 | int ngbe_flash_read_cab(struct ngbe_hw *hw, u32 addr, u16 lan_id) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2593:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2593 | int ngbe_flash_read_cab(struct ngbe_hw *hw, u32 addr, u16 lan_id) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2628:5: warning: no previous prototype for function 'ngbe_flash_write_unlock' [-Wmissing-prototypes] 2628 | int ngbe_flash_write_unlock(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2628:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2628 | int ngbe_flash_write_unlock(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2651:5: warning: no previous prototype for function 'ngbe_flash_write_lock' [-Wmissing-prototypes] 2651 | int ngbe_flash_write_lock(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2651:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2651 | int ngbe_flash_write_lock(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3498:5: warning: no previous prototype for function 'ngbe_get_copper_link_capabilities' [-Wmissing-prototypes] 3498 | s32 ngbe_get_copper_link_capabilities(struct ngbe_hw *hw, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3498:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3498 | s32 ngbe_get_copper_link_capabilities(struct ngbe_hw *hw, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3647:5: warning: no previous prototype for function 'ngbe_reset_misc' [-Wmissing-prototypes] 3647 | int ngbe_reset_misc(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3647:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3647 | int ngbe_reset_misc(struct ngbe_hw *hw) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4124:5: warning: no previous prototype for function 'ngbe_read_ee_hostif_data' [-Wmissing-prototypes] 4124 | s32 ngbe_read_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4124:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4124 | s32 ngbe_read_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4339:5: warning: no previous prototype for function 'ngbe_read_ee_hostif_data32' [-Wmissing-prototypes] 4339 | s32 ngbe_read_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4339:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4339 | s32 ngbe_read_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4405:5: warning: no previous prototype for function 'ngbe_write_ee_hostif_data' [-Wmissing-prototypes] 4405 | s32 ngbe_write_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4405:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4405 | s32 ngbe_write_ee_hostif_data(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4466:5: warning: no previous prototype for function 'ngbe_write_ee_hostif_data32' [-Wmissing-prototypes] 4466 | s32 ngbe_write_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4466:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4466 | s32 ngbe_write_ee_hostif_data32(struct ngbe_hw *hw, u16 offset, | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2883:17: warning: unused variable 'ngbe_emc_temp_data' [-Wunused-const-variable] 2883 | STATIC const u8 ngbe_emc_temp_data[4] = { | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2890:17: warning: unused variable 'ngbe_emc_therm_limit' [-Wunused-const-variable] 2890 | STATIC const u8 ngbe_emc_therm_limit[4] = { | ^~~~~~~~~~~~~~~~~~~~ 26 warnings generated. drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:657: warning: Function parameter or member 'pools' not described in 'ngbe_set_rar' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:657: warning: Excess function parameter 'vmdq' description in 'ngbe_set_rar' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:817: warning: Function parameter or member 'vmdq' not described in 'ngbe_add_uc_addr' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:961: warning: Function parameter or member 'mc_addr' not described in 'ngbe_set_mta' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:961: warning: Excess function parameter 'hash_value' description in 'ngbe_set_mta' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1616: warning: Function parameter or member 'pool' not described in 'ngbe_set_vmdq' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1616: warning: Excess function parameter 'vmdq' description in 'ngbe_set_vmdq' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2904: warning: bad line: (8.1542E-08)N^3 + (-1.6743E-11)N^4 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2911: warning: Excess function parameter 'data' description in 'ngbe_get_thermal_sensor_data' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3632: warning: Function parameter or member 'need_restart_AN' not described in 'ngbe_setup_copper_link' drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3632: warning: Excess function parameter 'autoneg_wait_to_complete' description in 'ngbe_setup_copper_link' >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: warning: objtool: missing symbol for section .text.unlikely. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the extra atc tlb flush
by Zhang Zekun 10 Apr '25

10 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBZUQU ------------------------------------------- The tlb invalidation code for smmu pagetable prefetch problem might cause a extra tlb invalidation for atc. Introduce a new interface to avoid this. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 18 ++++++++++-------- drivers/iommu/io-pgtable-arm.c | 3 ++- include/linux/io-pgtable.h | 7 +++++++ 3 files changed, 19 insertions(+), 9 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index cedc1eda7250..9358d42b07c7 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2281,6 +2281,16 @@ static void arm_smmu_tlb_inv_range_domain(unsigned long iova, size_t size, arm_smmu_atc_inv_domain(smmu_domain, 0, iova, size); } +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +void arm_smmu_tlb_flush_hisilicon_errata(void *cookie, unsigned long iova, size_t granule) +{ + struct arm_smmu_domain *smmu_domain = cookie; + + if (smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) + arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); +} +#endif + void arm_smmu_tlb_inv_range_asid(unsigned long iova, size_t size, int asid, size_t granule, bool leaf, struct arm_smmu_domain *smmu_domain) @@ -2310,14 +2320,6 @@ static void arm_smmu_tlb_inv_page_nosync(struct iommu_iotlb_gather *gather, static void arm_smmu_tlb_inv_walk(unsigned long iova, size_t size, size_t granule, void *cookie) { -#ifdef CONFIG_HISILICON_ERRATUM_162100602 - struct arm_smmu_domain *smmu_domain = cookie; - - if (!size && smmu_domain->smmu->options & ARM_SMMU_OPT_SYNC_BATCH) { - arm_smmu_tlb_inv_range_domain(iova, granule, granule, true, cookie); - return; - } -#endif arm_smmu_tlb_inv_range_domain(iova, size, granule, false, cookie); } diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index dc80f2661ff7..a2f11d9db262 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -366,7 +366,8 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, __arm_lpae_free_pages(cptep, tblsz, cfg); #ifdef CONFIG_HISILICON_ERRATUM_162100602 if (lvl <= 2) - io_pgtable_tlb_flush_walk(&data->iop, iova, 0, ARM_LPAE_GRANULE(data)); + arm_smmu_tlb_flush_hisilicon_errata(data->iop.cookie, + iova, ARM_LPAE_GRANULE(data)); #endif } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { __arm_lpae_sync_pte(ptep, cfg); diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 27b994e42ec4..03b574ef6d14 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -267,4 +267,11 @@ extern struct io_pgtable_init_fns io_pgtable_arm_64_lpae_s2_init_fns; extern struct io_pgtable_init_fns io_pgtable_arm_v7s_init_fns; extern struct io_pgtable_init_fns io_pgtable_arm_mali_lpae_init_fns; +#ifdef CONFIG_HISILICON_ERRATUM_162100602 +void arm_smmu_tlb_flush_hisilicon_errata(void *cookie, unsigned long iova, size_t granule); +#else +static inline void arm_smmu_tlb_flush_hisilicon_errata(void *cookie, + unsigned long iova, size_t granule) {} +#endif + #endif /* __IO_PGTABLE_H */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] ASoC: rt5645: Fix errorenous cleanup order
by Zhao Yipeng 10 Apr '25

10 Apr '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v4.19.247 commit 0941150100173d4eaf3fe08ff4b16740e7c3026f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6HY CVE: CVE-2022-49493 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- ASoC: rt5645: Fix errorenous cleanup order [ Upstream commit 2def44d3aec59e38d2701c568d65540783f90f2f ] There is a logic error when removing rt5645 device as the function rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and delete the &rt5645->btn_check_timer latter. However, since the timer handler rt5645_btn_check_callback() will re-queue the jack_detect_work, this cleanup order is buggy. That is, once the del_timer_sync in rt5645_i2c_remove is concurrently run with the rt5645_btn_check_callback, the canceled jack_detect_work will be rescheduled again, leading to possible use-after-free. This patch fix the issue by placing the del_timer_sync function before the cancel_delayed_work_sync. Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Link: https://lore.kernel.org/r/20220516092035.28283-1-linma@zju.edu.cn Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- sound/soc/codecs/rt5645.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index 7e3b47eeea04..3fcce5996c2c 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -4091,9 +4091,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) if (i2c->irq) free_irq(i2c->irq, rt5645); + /* + * Since the rt5645_btn_check_callback() can queue jack_detect_work, + * the timer need to be delted first + */ + del_timer_sync(&rt5645->btn_check_timer); + cancel_delayed_work_sync(&rt5645->jack_detect_work); cancel_delayed_work_sync(&rt5645->rcclock_work); - del_timer_sync(&rt5645->btn_check_timer); regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); -- 2.34.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 10 Apr '25

10 Apr '25

您好！ Kernel 邀请您参加 2025-04-18 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容：由于4.11日全天openEuler ODD 2025线下活动，原定4.11日下午开始的Kernel SIG双周例会推迟至4.18日下午。议题详见会议看板，并可继续申报。会议链接：https://meeting.huaweicloud.com:36443/#/j/987901819 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-04-18 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 由于4.11日全天openEuler ODD 2025线下活动，原定4.11日下午开始的Kernel SIG双周例会推迟至4.18日下午。议题详见会议看板，并可继续申报。 You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/987901819 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[openeuler:OLK-6.6 2116/2116] drivers/crypto/montage/tsse/tsse_ipc_hash.c:14:1: sparse: sparse: symbol 'service_info_table' was not declared. Should it be static?
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 914854f2adb6988ac3b6521088ec96833d6743e2 [2116/2116] driver: crypto - update support for Mont-TSSE Driver config: x86_64-randconfig-r113-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101645.mRh7GNFb-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) rustc: rustc 1.73.0 (cc66ad468 2023-10-03) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504101645.mRh7GNFb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101645.mRh7GNFb-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/montage/tsse/tsse_ipc_hash.c:14:1: sparse: sparse: symbol 'service_info_table' was not declared. Should it be static? >> drivers/crypto/montage/tsse/tsse_ipc_hash.c:15:1: sparse: sparse: symbol 'service_handle_table' was not declared. Should it be static? -- >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:22:41: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:33: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:46: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:46: sparse: expected void const volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc_drv.c:42:46: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_ipc_drv.c:108:16: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:120:21: sparse: sparse: cast from restricted __le32 >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:124:60: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void *msg @@ got void [noderef] __iomem *d2h_msg @@ drivers/crypto/montage/tsse/tsse_ipc_drv.c:124:60: sparse: expected void *msg drivers/crypto/montage/tsse/tsse_ipc_drv.c:124:60: sparse: got void [noderef] __iomem *d2h_msg >> drivers/crypto/montage/tsse/tsse_ipc_drv.c:136:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *addr @@ drivers/crypto/montage/tsse/tsse_ipc_drv.c:136:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc_drv.c:136:21: sparse: got unsigned char [usertype] *addr vim +/service_info_table +14 drivers/crypto/montage/tsse/tsse_ipc_hash.c 13 > 14 DEFINE_HASHTABLE(service_info_table, SERVICE_TABLE_BUCKET_BITS); > 15 DEFINE_HASHTABLE(service_handle_table, SERVICE_TABLE_BUCKET_BITS); 16 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[Cancel] openEuler Kernel SIG双周例会
by openEuler conference 10 Apr '25

10 Apr '25

Sorry! The WeLink meeting will be held at 2025-04-11 14:00 scheduled by Kernel SIG has been cancelled.

1 0

[PATCH OLK-5.10] mt76: fix use-after-free by removing a non-RCU wcid pointer
by Yi Yang 10 Apr '25

10 Apr '25

From: Felix Fietkau <nbd(a)nbd.name> mainline inclusion from mainline-v5.19-rc1 commit 51fb1278aa57ae0fc54adaa786e1965362bed4fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP450 CVE: CVE-2022-49328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes an issue caught by KASAN about use-after-free in mt76_txq_schedule by protecting mtxq->wcid with rcu_lock between mt76_txq_schedule and sta_info_[alloc, free]. [18853.876689] ================================================================== [18853.876751] BUG: KASAN: use-after-free in mt76_txq_schedule+0x204/0xaf8 [mt76] [18853.876773] Read of size 8 at addr ffffffaf989a2138 by task mt76-tx phy0/883 [18853.876786] [18853.876810] CPU: 5 PID: 883 Comm: mt76-tx phy0 Not tainted 5.10.100-fix-510-56778d365941-kasan #5 0b01fbbcf41a530f52043508fec2e31a4215 [18853.876840] Call trace: [18853.876861] dump_backtrace+0x0/0x3ec [18853.876878] show_stack+0x20/0x2c [18853.876899] dump_stack+0x11c/0x1ac [18853.876918] print_address_description+0x74/0x514 [18853.876934] kasan_report+0x134/0x174 [18853.876948] __asan_report_load8_noabort+0x44/0x50 [18853.876976] mt76_txq_schedule+0x204/0xaf8 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877002] mt76_txq_schedule_all+0x2c/0x48 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877030] mt7921_tx_worker+0xa0/0x1cc [mt7921_common f0875ebac9d7b4754e1010549e7db50fbd90a047] [18853.877054] __mt76_worker_fn+0x190/0x22c [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2] [18853.877071] kthread+0x2f8/0x3b8 [18853.877087] ret_from_fork+0x10/0x30 [18853.877098] [18853.877112] Allocated by task 941: [18853.877131] kasan_save_stack+0x38/0x68 [18853.877147] __kasan_kmalloc+0xd4/0xfc [18853.877163] kasan_kmalloc+0x10/0x1c [18853.877177] __kmalloc+0x264/0x3c4 [18853.877294] sta_info_alloc+0x460/0xf88 [mac80211] [18853.877410] ieee80211_prep_connection+0x204/0x1ee0 [mac80211] [18853.877523] ieee80211_mgd_auth+0x6c4/0xa4c [mac80211] [18853.877635] ieee80211_auth+0x20/0x2c [mac80211] [18853.877733] rdev_auth+0x7c/0x438 [cfg80211] [18853.877826] cfg80211_mlme_auth+0x26c/0x390 [cfg80211] [18853.877919] nl80211_authenticate+0x6d4/0x904 [cfg80211] [18853.877938] genl_rcv_msg+0x748/0x93c [18853.877954] netlink_rcv_skb+0x160/0x2a8 [18853.877969] genl_rcv+0x3c/0x54 [18853.877985] netlink_unicast_kernel+0x104/0x1ec [18853.877999] netlink_unicast+0x178/0x268 [18853.878015] netlink_sendmsg+0x3cc/0x5f0 [18853.878030] sock_sendmsg+0xb4/0xd8 [18853.878043] ____sys_sendmsg+0x2f8/0x53c [18853.878058] ___sys_sendmsg+0xe8/0x150 [18853.878071] __sys_sendmsg+0xc4/0x1f4 [18853.878087] __arm64_compat_sys_sendmsg+0x88/0x9c [18853.878101] el0_svc_common+0x1b4/0x390 [18853.878115] do_el0_svc_compat+0x8c/0xdc [18853.878131] el0_svc_compat+0x10/0x1c [18853.878146] el0_sync_compat_handler+0xa8/0xcc [18853.878161] el0_sync_compat+0x188/0x1c0 [18853.878171] [18853.878183] Freed by task 10927: [18853.878200] kasan_save_stack+0x38/0x68 [18853.878215] kasan_set_track+0x28/0x3c [18853.878228] kasan_set_free_info+0x24/0x48 [18853.878244] __kasan_slab_free+0x11c/0x154 [18853.878259] kasan_slab_free+0x14/0x24 [18853.878273] slab_free_freelist_hook+0xac/0x1b0 [18853.878287] kfree+0x104/0x390 [18853.878402] sta_info_free+0x198/0x210 [mac80211] [18853.878515] __sta_info_destroy_part2+0x230/0x2d4 [mac80211] [18853.878628] __sta_info_flush+0x300/0x37c [mac80211] [18853.878740] ieee80211_set_disassoc+0x2cc/0xa7c [mac80211] [18853.878851] ieee80211_mgd_deauth+0x4a4/0x10a0 [mac80211] [18853.878962] ieee80211_deauth+0x20/0x2c [mac80211] [18853.879057] rdev_deauth+0x7c/0x438 [cfg80211] [18853.879150] cfg80211_mlme_deauth+0x274/0x414 [cfg80211] [18853.879243] cfg80211_mlme_down+0xe4/0x118 [cfg80211] [18853.879335] cfg80211_disconnect+0x218/0x2d8 [cfg80211] [18853.879427] __cfg80211_leave+0x17c/0x240 [cfg80211] [18853.879519] cfg80211_leave+0x3c/0x58 [cfg80211] [18853.879611] wiphy_suspend+0xdc/0x200 [cfg80211] [18853.879628] dpm_run_callback+0x58/0x408 [18853.879642] __device_suspend+0x4cc/0x864 [18853.879658] async_suspend+0x34/0xf4 [18853.879673] async_run_entry_fn+0xe0/0x37c [18853.879689] process_one_work+0x508/0xb98 [18853.879702] worker_thread+0x7f4/0xcd4 [18853.879717] kthread+0x2f8/0x3b8 [18853.879731] ret_from_fork+0x10/0x30 [18853.879741] [18853.879757] The buggy address belongs to the object at ffffffaf989a2000 [18853.879757] which belongs to the cache kmalloc-8k of size 8192 [18853.879774] The buggy address is located 312 bytes inside of [18853.879774] 8192-byte region [ffffffaf989a2000, ffffffaf989a4000) [18853.879787] The buggy address belongs to the page: [18853.879807] page:000000004bda2a59 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d89a0 [18853.879823] head:000000004bda2a59 order:3 compound_mapcount:0 compound_pincount:0 [18853.879839] flags: 0x8000000000010200(slab|head) [18853.879857] raw: 8000000000010200 ffffffffbc89e208 ffffffffb7fb5208 ffffffaec000cc80 [18853.879873] raw: 0000000000000000 0000000000010001 00000001ffffffff 0000000000000000 [18853.879885] page dumped because: kasan: bad access detected [18853.879896] [18853.879907] Memory state around the buggy address: [18853.879922] ffffffaf989a2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879935] ffffffaf989a2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879948] >ffffffaf989a2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879961] ^ [18853.879973] ffffffaf989a2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879986] ffffffaf989a2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [18853.879998] ================================================================== Cc: stable(a)vger.kernel.org Reported-by: Sean Wang <sean.wang(a)mediatek.com> Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Conflicts: drivers/net/wireless/mediatek/mt76/mt7615/main.c [commit d0e274af2f2e ("mt76: mt76_connac: create mcu library") was not merged] drivers/net/wireless/mediatek/mt76/mt76x02_util.c [commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") was not merged] drivers/net/wireless/mediatek/mt76/mt7915/main.c [commit 8aa2c6f4714e ("mt76: mt7915: support 32 station interfaces") was not merged] drivers/net/wireless/mediatek/mt76/tx.c [commit 57b8b57516c5 ("mt76: check return value of mt76_txq_send_burst in mt76_txq_schedule_list") was not merged] drivers/net/wireless/mediatek/mt76/mt7921/main.c [commit e0f9fdda81bd ("mt76: mt7921: add ieee80211_ops") was not merged] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76.h | 2 +- drivers/net/wireless/mediatek/mt76/mt7603/main.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 2 +- drivers/net/wireless/mediatek/mt76/mt76x02_util.c | 4 +++- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 2 +- drivers/net/wireless/mediatek/mt76/tx.c | 9 ++++----- 7 files changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c index dc1191aa0443..dc1351f2a04c 100644 --- a/drivers/net/wireless/mediatek/mt76/mac80211.c +++ b/drivers/net/wireless/mediatek/mt76/mac80211.c @@ -987,7 +987,7 @@ mt76_sta_add(struct mt76_dev *dev, struct ieee80211_vif *vif, continue; mtxq = (struct mt76_txq *)sta->txq[i]->drv_priv; - mtxq->wcid = wcid; + mtxq->wcid = wcid->idx; } ewma_signal_init(&wcid->rssi); diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h index 16e65020a242..3cb1a2b8aa84 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76.h +++ b/drivers/net/wireless/mediatek/mt76/mt76.h @@ -226,7 +226,7 @@ struct mt76_wcid { }; struct mt76_txq { - struct mt76_wcid *wcid; + u16 wcid; u16 agg_ssn; bool send_bar; diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c index bdff89cc3105..a5b472af93d3 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c @@ -74,7 +74,7 @@ mt7603_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) mt7603_wtbl_init(dev, idx, mvif->idx, bc_addr); mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->sta.wcid; + mtxq->wcid = idx; rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid); out: diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c index defa207f53d6..4fe51a0c8ac9 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c @@ -204,7 +204,7 @@ static int mt7615_add_interface(struct ieee80211_hw *hw, rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid); if (vif->txq) { mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->sta.wcid; + mtxq->wcid = idx; } ret = mt7615_mcu_add_dev_info(dev, vif, true); diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c index 0f191bd28417..1996a69109fa 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x02_util.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_util.c @@ -293,7 +293,8 @@ mt76x02_vif_init(struct mt76x02_dev *dev, struct ieee80211_vif *vif, mvif->group_wcid.idx = MT_VIF_WCID(idx); mvif->group_wcid.hw_key_idx = -1; mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->group_wcid; + rcu_assign_pointer(dev->mt76.wcid[MT_VIF_WCID(idx)], &mvif->group_wcid); + mtxq->wcid = MT_VIF_WCID(idx); } int @@ -346,6 +347,7 @@ void mt76x02_remove_interface(struct ieee80211_hw *hw, struct mt76x02_vif *mvif = (struct mt76x02_vif *)vif->drv_priv; dev->mphy.vif_mask &= ~BIT(mvif->idx); + rcu_assign_pointer(dev->mt76.wcid[mvif->group_wcid.idx], NULL); } EXPORT_SYMBOL_GPL(mt76x02_remove_interface); diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c index e78d3efa3fdf..d3d0085f070a 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c @@ -168,7 +168,7 @@ static int mt7915_add_interface(struct ieee80211_hw *hw, rcu_assign_pointer(dev->mt76.wcid[idx], &mvif->sta.wcid); if (vif->txq) { mtxq = (struct mt76_txq *)vif->txq->drv_priv; - mtxq->wcid = &mvif->sta.wcid; + mtxq->wcid = idx; } out: diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c index 073c29eb2ed8..974105d7503d 100644 --- a/drivers/net/wireless/mediatek/mt76/tx.c +++ b/drivers/net/wireless/mediatek/mt76/tx.c @@ -382,12 +382,11 @@ EXPORT_SYMBOL_GPL(mt76_release_buffered_frames); static int mt76_txq_send_burst(struct mt76_phy *phy, struct mt76_queue *q, - struct mt76_txq *mtxq) + struct mt76_txq *mtxq, struct mt76_wcid *wcid) { struct mt76_dev *dev = phy->dev; struct ieee80211_txq *txq = mtxq_to_txq(mtxq); enum mt76_txq_id qid = mt76_txq_get_qid(txq); - struct mt76_wcid *wcid = mtxq->wcid; struct ieee80211_tx_info *info; struct sk_buff *skb; int n_frames = 1; @@ -471,8 +470,8 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid) break; mtxq = (struct mt76_txq *)txq->drv_priv; - wcid = mtxq->wcid; - if (wcid && test_bit(MT_WCID_FLAG_PS, &wcid->flags)) + wcid = rcu_dereference(dev->wcid[mtxq->wcid]); + if (!wcid || test_bit(MT_WCID_FLAG_PS, &wcid->flags)) continue; if (mtxq->send_bar && mtxq->aggr) { @@ -488,7 +487,7 @@ mt76_txq_schedule_list(struct mt76_phy *phy, enum mt76_txq_id qid) spin_lock_bh(&q->lock); } - ret += mt76_txq_send_burst(phy, q, mtxq); + ret += mt76_txq_send_burst(phy, q, mtxq, wcid); ieee80211_return_txq(phy->hw, txq, false); } spin_unlock_bh(&q->lock); -- 2.25.1

2 1

[PATCH OLK-6.6] perf stat: Enable iostat mode for HiSilicon PCIe PMU
by Yushan Wang 10 Apr '25

10 Apr '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC02AC ---------------------------------------------------------------------- Some HiSilicon platforms provide PCIe PMU devices for monitoring the bandwidth and latency of PCIe traffic. With the support of PCIe PMU we can enable the perf iostat mode. The HiSilicon PCIe PMU can support measuring the bandwidth of certain TLP types and of certian root port. Totally 6 metrics are provided in the unit of MB: - Inbound MWR: The memory write TLPs from the devices downstream the root port - Inbound MRD: The memory read TLPs from the devices downstream the root port - Inbound CPL: The completion TLPs from the devices downstream the root port - Outbound MWR: The memory write TLPs from the CPU to the downstream devices - Outbound MRD: The memory read TLPs from the CPU to the downstream devices - Outbound CPL: The completions TLPs from the CPU to the downstream devices Since the PMU measure the throughput with unit of DWords. So we need the calculate the actually bandwidth like: Count * 4B / 1024 / 1024 / Time_elapsed (MB) Some of the display of the `perf iostat` will be like: [root@localhost tmp]# ./perf iostat list hisi_pcie8_core2<0000:aa:00.0> hisi_pcie0_core2<0000:40:00.0> hisi_pcie10_core2<0000:d5:00.0> hisi_pcie8_core1<0000:95:04.0> hisi_pcie8_core1<0000:95:00.0> hisi_pcie2_core2<0000:5f:00.0> hisi_pcie0_core1<0000:16:00.0> hisi_pcie0_core1<0000:16:04.0> [root@localhost tmp]# ./perf iostat --timeout 10000 Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:aa:00.0 0 0 0 0 0 0 0000:40:00.0 0 0 0 0 0 0 0000:d5:00.0 0 0 0 0 0 0 0000:95:04.0 9 81 0 1 0 2497 0000:95:00.0 0 0 0 0 0 0 0000:5f:00.0 0 0 0 0 0 0 0000:16:00.0 0 0 0 0 0 0 0000:16:04.0 5658 2 0 2 0 17 10.006795510 seconds time elapsed [root@localhost tmp]# ./perf iostat 0000:95:04.0 -- iperf -c 192.100.100.1 -t 30 ------------------------------------------------------------ Client connecting to 192.100.100.1, TCP port 5001 TCP window size: 1.79 MByte (default) ------------------------------------------------------------ [ 3] local 192.100.100.2 port 57130 connected with 192.100.100.1 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-30.0 sec 32.9 GBytes 9.41 Gbits/sec Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:95:04.0 4 41 0 1 0 1259 30.060558310 seconds time elapsed 0.060853000 seconds user 3.758800000 seconds sys More information of the HiSilicon PCIe PMU can be found at Documentation/admin-guide/perf/hisi-pcie-pmu.rst. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- tools/perf/arch/arm64/util/Build | 1 + tools/perf/arch/arm64/util/hisi-iostat.c | 431 +++++++++++++++++++++++ 2 files changed, 432 insertions(+) create mode 100644 tools/perf/arch/arm64/util/hisi-iostat.c diff --git a/tools/perf/arch/arm64/util/Build b/tools/perf/arch/arm64/util/Build index 78ef7115be3d..4e8dabf98b29 100644 --- a/tools/perf/arch/arm64/util/Build +++ b/tools/perf/arch/arm64/util/Build @@ -3,6 +3,7 @@ perf-y += machine.o perf-y += perf_regs.o perf-y += tsc.o perf-y += pmu.o +perf-y += hisi-iostat.o perf-$(CONFIG_LIBTRACEEVENT) += kvm-stat.o perf-$(CONFIG_DWARF) += dwarf-regs.o perf-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o diff --git a/tools/perf/arch/arm64/util/hisi-iostat.c b/tools/perf/arch/arm64/util/hisi-iostat.c new file mode 100644 index 000000000000..96684cc00464 --- /dev/null +++ b/tools/perf/arch/arm64/util/hisi-iostat.c @@ -0,0 +1,431 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * perf iostat support for HiSilicon PCIe PMU. + * Partly derived from tools/perf/arch/x86/util/iostat.c. + * + * Copyright (c) 2024 HiSilicon Technologies Co., Ltd. + * Author: Yicong Yang <yangyicong(a)hisilicon.com> + */ + +#include <api/fs/fs.h> +#include <linux/err.h> +#include <linux/zalloc.h> +#include <linux/limits.h> +#include <dirent.h> +#include <stdio.h> +#include <errno.h> +#include <stdlib.h> + +#include "util/counts.h" +#include "util/cpumap.h" +#include "util/debug.h" +#include "util/iostat.h" +#include "util/pmu.h" + +#define PCI_DEFAULT_DOMAIN 0 +#define PCI_DEVICE_NAME_PATTERN "%04x:%02hhx:%02hhx.%hhu" +#define PCI_ROOT_BUS_DEVICES_PATH "bus/pci/devices" + +static const char *hisi_iostat_metrics[] = { + "Inbound MWR(MB)", + "Inbound MRD(MB)", + "Inbound CPL(MB)", + "Outbound MWR(MB)", + "Outbound MRD(MB)", + "Outbound CPL(MB)", +}; + +static const char *hisi_iostat_cmd_template[] = { + /* Inbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0104,port=0x%hx/", + /* Inbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0804,port=0x%hx/", + /* Inbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x2004,port=0x%hx/", + /* Outbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0105,port=0x%hx/", + /* Outbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0405,port=0x%hx/", + /* Outbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x1005,port=0x%hx/", +}; + +struct hisi_pcie_root_port { + struct list_head list; + /* Is this Root Port selected for monitoring */ + bool selected; + /* IDs to locate the PMU */ + u16 sicl_id; + u16 core_id; + /* Filter mask for this Root Port */ + u16 mask; + /* PCIe Root Port's <domain>:<bus>:<device>.<function> */ + u32 domain; + u8 bus; + u8 dev; + u8 fn; +}; + +LIST_HEAD(hisi_pcie_root_ports_list); +static int hisi_pcie_root_ports_num; + +static void hisi_pcie_init_root_port_mask(struct hisi_pcie_root_port *rp) +{ + rp->mask = BIT(rp->dev << 1); +} + +/* + * Select specific Root Port to monitor. Return 0 if successfully find the + * Root Port, Otherwise -EINVAL. + */ +static int hisi_pcie_root_ports_select_one(u32 domain, u8 bus, u8 dev, u8 fn) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + if (domain == rp->domain && bus == rp->bus && + dev == rp->dev && fn == rp->fn) { + rp->selected = true; + return 0; + } + + return -EINVAL; +} + +static void hisi_pcie_root_ports_select_all(void) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + rp->selected = true; +} + +static void hisi_pcie_root_ports_add(u16 sicl_id, u16 core_id, u8 target_bus) +{ + const char *sysfs = sysfs__mountpoint(); + struct hisi_pcie_root_port *rp; + struct dirent *dent; + char path[PATH_MAX]; + u8 bus, dev, fn; + u32 domain; + DIR *dir; + int ret; + + snprintf(path, PATH_MAX, "%s/%s", sysfs, PCI_ROOT_BUS_DEVICES_PATH); + dir = opendir(path); + if (!dir) + return; + + /* Scan the PCI root bus to find the match root port on @target_bus */ + while ((dent = readdir(dir))) { + ret = sscanf(dent->d_name, PCI_DEVICE_NAME_PATTERN, + &domain, &bus, &dev, &fn); + if (ret != 4 || bus != target_bus) + continue; + + rp = zalloc(sizeof(*rp)); + if (!rp) + continue; + + rp->selected = false; + rp->sicl_id = sicl_id; + rp->core_id = core_id; + rp->domain = domain; + rp->bus = bus; + rp->dev = dev; + rp->fn = fn; + + hisi_pcie_init_root_port_mask(rp); + + list_add(&rp->list, &hisi_pcie_root_ports_list); + hisi_pcie_root_ports_num++; + + pr_debug3("Found root port %s\n", dent->d_name); + } + + closedir(dir); +} + +/* Scan the PMUs and build the mapping of the Root Ports to the PMU */ +static int hisi_pcie_root_ports_init(void) +{ + char event_source[PATH_MAX], bus_path[PATH_MAX]; + unsigned long long bus; + u16 sicl_id, core_id; + struct dirent *dent; + DIR *dir; + + perf_pmu__event_source_devices_scnprintf(event_source, sizeof(event_source)); + dir = opendir(event_source); + if (!dir) + return -ENOENT; + + while ((dent = readdir(dir))) { + /* + * This HiSilicon PCIe PMU will be named as: + * hisi_pcie<sicl_id>_core<core_id> + */ + if ((sscanf(dent->d_name, "hisi_pcie%hu_core%hu", &sicl_id, &core_id)) != 2) + continue; + + /* + * Driver will export the root port it can monitor through + * the "bus" sysfs attribute. + */ + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bus", + event_source, sicl_id, core_id); + + /* + * Per PCIe spec the bus should be 8bit, use unsigned long long + * for the convience of the library function. + */ + if (filename__read_ull(bus_path, &bus)) + continue; + + pr_debug3("Found pmu %s bus 0x%llx\n", dent->d_name, bus); + + hisi_pcie_root_ports_add(sicl_id, core_id, (u8)bus); + } + + closedir(dir); + return hisi_pcie_root_ports_num > 0 ? 0 : -ENOENT; +} + +static void hisi_pcie_root_ports_free(void) +{ + struct hisi_pcie_root_port *rp, *tmp; + + if (hisi_pcie_root_ports_num == 0) + return; + + list_for_each_entry_safe(rp, tmp, &hisi_pcie_root_ports_list, list) { + list_del(&rp->list); + zfree(&rp); + hisi_pcie_root_ports_num--; + } +} + +static int hisi_iostat_add_events(struct evlist *evl) +{ + struct hisi_pcie_root_port *rp; + struct evsel *evsel; + unsigned int i, j; + char *iostat_cmd; + int pos = 0; + int ret; + + if (!hisi_pcie_root_ports_num) + return -ENOENT; + + iostat_cmd = zalloc(PATH_MAX); + if (!iostat_cmd) + return -ENOMEM; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) { + if (!rp->selected) + continue; + + iostat_cmd[pos++] = '{'; + for (j = 0; j < ARRAY_SIZE(hisi_iostat_cmd_template); j++) { + pos += snprintf(iostat_cmd + pos, ARG_MAX - pos - 1, + hisi_iostat_cmd_template[j], + rp->sicl_id, rp->core_id, rp->mask); + + if (j == ARRAY_SIZE(hisi_iostat_cmd_template) - 1) + iostat_cmd[pos++] = '}'; + else + iostat_cmd[pos++] = ','; + } + + ret = parse_event(evl, iostat_cmd); + if (ret) + break; + + i = 0; + evlist__for_each_entry_reverse(evl, evsel) { + if (i == ARRAY_SIZE(hisi_iostat_cmd_template)) + break; + + evsel->priv = rp; + i++; + } + + memset(iostat_cmd, 0, PATH_MAX); + pos = 0; + } + + zfree(&iostat_cmd); + return ret; +} + +int iostat_prepare(struct evlist *evlist, + struct perf_stat_config *config) +{ + if (evlist->core.nr_entries > 0) { + pr_warning("The -e and -M options are not supported." + "All chosen events/metrics will be dropped\n"); + evlist__delete(evlist); + evlist = evlist__new(); + if (!evlist) + return -ENOMEM; + } + + config->metric_only = true; + config->aggr_mode = AGGR_GLOBAL; + + return hisi_iostat_add_events(evlist); +} + +static int hisi_pcie_root_ports_list_filter(const char *str) +{ + char *tok, *tmp, *copy = NULL; + u8 bus, dev, fn; + u32 domain; + int ret; + + copy = strdup(str); + if (!copy) + return -ENOMEM; + + for (tok = strtok_r(copy, ",", &tmp); tok; tok = strtok_r(NULL, ",", &tmp)) { + ret = sscanf(tok, PCI_DEVICE_NAME_PATTERN, &domain, &bus, &dev, &fn); + if (ret != 4) { + ret = -EINVAL; + break; + } + + ret = hisi_pcie_root_ports_select_one(domain, bus, dev, fn); + if (ret) + break; + } + + zfree(&copy); + return ret; +} + +int iostat_parse(const struct option *opt, const char *str, int unset __maybe_unused) +{ + struct perf_stat_config *config = (struct perf_stat_config *)opt->data; + int ret; + + ret = hisi_pcie_root_ports_init(); + if (!ret) { + config->iostat_run = true; + + if (!str) { + iostat_mode = IOSTAT_RUN; + hisi_pcie_root_ports_select_all(); + } else if (!strcmp(str, "list")) { + iostat_mode = IOSTAT_LIST; + hisi_pcie_root_ports_select_all(); + } else { + iostat_mode = IOSTAT_RUN; + ret = hisi_pcie_root_ports_list_filter(str); + } + } + + return ret; +} + +static void hisi_pcie_root_port_show(FILE *output, + const struct hisi_pcie_root_port * const rp) +{ + if (output && rp) + fprintf(output, "hisi_pcie%hu_core%hu<" PCI_DEVICE_NAME_PATTERN ">\n", + rp->sicl_id, rp->core_id, rp->domain, rp->bus, rp->dev, rp->fn); +} + +void iostat_list(struct evlist *evlist __maybe_unused, struct perf_stat_config *config) +{ + struct hisi_pcie_root_port *rp = NULL; + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) { + if (rp != evsel->priv) { + hisi_pcie_root_port_show(config->output, evsel->priv); + rp = evsel->priv; + } + } +} + +void iostat_release(struct evlist *evlist) +{ + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) + evsel->priv = NULL; + + hisi_pcie_root_ports_free(); +} + +void iostat_print_header_prefix(struct perf_stat_config *config) +{ + if (config->csv_output) + fputs("port,", config->output); + else if (config->interval) + fprintf(config->output, "# time port "); + else + fprintf(config->output, " port "); +} + +void iostat_print_metric(struct perf_stat_config *config, struct evsel *evsel, + struct perf_stat_output_ctx *out) +{ + const char *iostat_metric = hisi_iostat_metrics[evsel->core.idx % ARRAY_SIZE(hisi_iostat_metrics)]; + struct perf_counts_values *count; + double iostat_value; + + /* We're using AGGR_GLOBAL so there's only one aggr counts aggr[0]. */ + count = &evsel->stats->aggr[0].counts; + + /* The counts has been scaled, we can use it directly. */ + iostat_value = (double)count->val; + + /* + * Display two digits after decimal point for better accuracy if the + * value is non-zero. + */ + out->print_metric(config, out->ctx, NULL, + iostat_value > 0 ? "%8.2f" : "%8.0f", + iostat_metric, iostat_value / (256 * 1024)); +} + +void iostat_prefix(struct evlist *evlist, struct perf_stat_config *config, + char *prefix, struct timespec *ts) +{ + struct hisi_pcie_root_port *rp = evlist->selected->priv; + + if (rp) { + if (ts) + sprintf(prefix, "%6lu.%09lu%s" PCI_DEVICE_NAME_PATTERN "%s", + ts->tv_sec, ts->tv_nsec, config->csv_sep, + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + else + sprintf(prefix, PCI_DEVICE_NAME_PATTERN "%s", + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + } +} + +void iostat_print_counters(struct evlist *evlist, struct perf_stat_config *config, + struct timespec *ts, char *prefix, + iostat_print_counter_t print_cnt_cb, void *arg) +{ + struct evsel *counter = evlist__first(evlist); + void *perf_device; + + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "%s", prefix); + evlist__for_each_entry(evlist, counter) { + perf_device = evlist->selected->priv; + if (perf_device && perf_device != counter->priv) { + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "\n%s", prefix); + } + print_cnt_cb(config, counter, arg); + } + fputc('\n', config->output); +} -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1575/1575] mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static?
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: db05731a881772a1e8f532c2541b334d822596f2 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1575/1575] dhugetlb: backport dynamic hugetlb feature config: arm64-randconfig-r122-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101655.g80FSsl7-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250410/202504101655.g80FSsl7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101655.g80FSsl7-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static? mm/hugetlb.c:2018:20: sparse: sparse: context imbalance in 'gather_surplus_pages' - unexpected unlock mm/hugetlb.c:5168:17: sparse: sparse: context imbalance in 'hugetlb_cow' - unexpected unlock mm/hugetlb.c:5881:25: sparse: sparse: context imbalance in 'follow_hugetlb_page' - different lock contexts for basic block mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] perf stat: Enable iostat mode for HiSilicon PCIe PMU
by Yushan Wang 10 Apr '25

10 Apr '25

From: Yicong Yang <yangyicong(a)hisilicon.com> Some HiSilicon platforms provide PCIe PMU devices for monitoring the bandwidth and latency of PCIe traffic. With the support of PCIe PMU we can enable the perf iostat mode. The HiSilicon PCIe PMU can support measuring the bandwidth of certain TLP types and of certian root port. Totally 6 metrics are provided in the unit of MB: - Inbound MWR: The memory write TLPs from the devices downstream the root port - Inbound MRD: The memory read TLPs from the devices downstream the root port - Inbound CPL: The completion TLPs from the devices downstream the root port - Outbound MWR: The memory write TLPs from the CPU to the downstream devices - Outbound MRD: The memory read TLPs from the CPU to the downstream devices - Outbound CPL: The completions TLPs from the CPU to the downstream devices Since the PMU measure the throughput with unit of DWords. So we need the calculate the actually bandwidth like: Count * 4B / 1024 / 1024 / Time_elapsed (MB) Some of the display of the `perf iostat` will be like: [root@localhost tmp]# ./perf iostat list hisi_pcie8_core2<0000:aa:00.0> hisi_pcie0_core2<0000:40:00.0> hisi_pcie10_core2<0000:d5:00.0> hisi_pcie8_core1<0000:95:04.0> hisi_pcie8_core1<0000:95:00.0> hisi_pcie2_core2<0000:5f:00.0> hisi_pcie0_core1<0000:16:00.0> hisi_pcie0_core1<0000:16:04.0> [root@localhost tmp]# ./perf iostat --timeout 10000 Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:aa:00.0 0 0 0 0 0 0 0000:40:00.0 0 0 0 0 0 0 0000:d5:00.0 0 0 0 0 0 0 0000:95:04.0 9 81 0 1 0 2497 0000:95:00.0 0 0 0 0 0 0 0000:5f:00.0 0 0 0 0 0 0 0000:16:00.0 0 0 0 0 0 0 0000:16:04.0 5658 2 0 2 0 17 10.006795510 seconds time elapsed [root@localhost tmp]# ./perf iostat 0000:95:04.0 -- iperf -c 192.100.100.1 -t 30 ------------------------------------------------------------ Client connecting to 192.100.100.1, TCP port 5001 TCP window size: 1.79 MByte (default) ------------------------------------------------------------ [ 3] local 192.100.100.2 port 57130 connected with 192.100.100.1 port 5001 [ ID] Interval Transfer Bandwidth [ 3] 0.0-30.0 sec 32.9 GBytes 9.41 Gbits/sec Performance counter stats for 'system wide': port Inbound MWR(MB) Inbound MRD(MB) Inbound CPL(MB) Outbound MWR(MB) Outbound MRD(MB) Outbound CPL(MB) 0000:95:04.0 4 41 0 1 0 1259 30.060558310 seconds time elapsed 0.060853000 seconds user 3.758800000 seconds sys More information of the HiSilicon PCIe PMU can be found at Documentation/admin-guide/perf/hisi-pcie-pmu.rst. Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> --- tools/perf/arch/arm64/util/Build | 1 + tools/perf/arch/arm64/util/hisi-iostat.c | 451 +++++++++++++++++++++++ 2 files changed, 452 insertions(+) create mode 100644 tools/perf/arch/arm64/util/hisi-iostat.c diff --git a/tools/perf/arch/arm64/util/Build b/tools/perf/arch/arm64/util/Build index 78ef7115be3d..4e8dabf98b29 100644 --- a/tools/perf/arch/arm64/util/Build +++ b/tools/perf/arch/arm64/util/Build @@ -3,6 +3,7 @@ perf-y += machine.o perf-y += perf_regs.o perf-y += tsc.o perf-y += pmu.o +perf-y += hisi-iostat.o perf-$(CONFIG_LIBTRACEEVENT) += kvm-stat.o perf-$(CONFIG_DWARF) += dwarf-regs.o perf-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o diff --git a/tools/perf/arch/arm64/util/hisi-iostat.c b/tools/perf/arch/arm64/util/hisi-iostat.c new file mode 100644 index 000000000000..fc794ee7d8d4 --- /dev/null +++ b/tools/perf/arch/arm64/util/hisi-iostat.c @@ -0,0 +1,451 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * perf iostat support for HiSilicon PCIe PMU. + * Partly derived from tools/perf/arch/x86/util/iostat.c. + * + * Copyright (c) 2024 HiSilicon Technologies Co., Ltd. + * Author: Yicong Yang <yangyicong(a)hisilicon.com> + */ + +#include <api/fs/fs.h> +#include <linux/err.h> +#include <linux/zalloc.h> +#include <linux/limits.h> +#include <dirent.h> +#include <stdio.h> +#include <errno.h> +#include <stdlib.h> + +#include "util/counts.h" +#include "util/cpumap.h" +#include "util/debug.h" +#include "util/iostat.h" +#include "util/pmu.h" + +/* From include/uapi/linux/pci.h */ +#define PCI_SLOT(devfn) (((devfn) >> 3) & 0x1f) +#define PCI_DEVFN(slot, func) ((((slot) & 0x1f) << 3) | ((func) & 0x07)) + +#define PCI_DEFAULT_DOMAIN 0 +#define PCI_DEVICE_NAME_PATTERN "%04x:%02hhx:%02hhx.%hhu" +#define PCI_ROOT_BUS_DEVICES_PATH "bus/pci/devices" + +static const char *hisi_iostat_metrics[] = { + "Inbound MWR(MB)", + "Inbound MRD(MB)", + "Inbound CPL(MB)", + "Outbound MWR(MB)", + "Outbound MRD(MB)", + "Outbound CPL(MB)", +}; + +static const char *hisi_iostat_cmd_template[] = { + /* Inbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0104,port=0x%hx/", + /* Inbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0804,port=0x%hx/", + /* Inbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x2004,port=0x%hx/", + /* Outbound Memory Write */ + "hisi_pcie%hu_core%hu/event=0x0105,port=0x%hx/", + /* Outbound Memory Read */ + "hisi_pcie%hu_core%hu/event=0x0405,port=0x%hx/", + /* Outbound Memory Completion */ + "hisi_pcie%hu_core%hu/event=0x1005,port=0x%hx/", +}; + +struct hisi_pcie_root_port { + struct list_head list; + /* Is this Root Port selected for monitoring */ + bool selected; + /* IDs to locate the PMU */ + u16 sicl_id; + u16 core_id; + /* Filter mask for this Root Port */ + u16 mask; + /* PCIe Root Port's <domain>:<bus>:<device>.<function> */ + u32 domain; + u8 bus; + u8 dev; + u8 fn; +}; + +LIST_HEAD(hisi_pcie_root_ports_list); +static int hisi_pcie_root_ports_num; + +static void hisi_pcie_init_root_port_mask(struct hisi_pcie_root_port *rp, u16 devbase) +{ + rp->mask = BIT((rp->dev - devbase) << 1); +} + +/* + * Select specific Root Port to monitor. Return 0 if successfully find the + * Root Port, Otherwise -EINVAL. + */ +static int hisi_pcie_root_ports_select_one(u32 domain, u8 bus, u8 dev, u8 fn) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + if (domain == rp->domain && bus == rp->bus && + dev == rp->dev && fn == rp->fn) { + rp->selected = true; + return 0; + } + + return -EINVAL; +} + +static void hisi_pcie_root_ports_select_all(void) +{ + struct hisi_pcie_root_port *rp; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) + rp->selected = true; +} + +static void hisi_pcie_root_ports_add(u16 sicl_id, u16 core_id, u8 target_bus, + u16 bdf_min, u16 bdf_max) +{ + const char *sysfs = sysfs__mountpoint(); + struct hisi_pcie_root_port *rp; + struct dirent *dent; + char path[PATH_MAX]; + u8 bus, dev, fn; + u32 domain; + DIR *dir; + u16 bdf; + int ret; + + snprintf(path, PATH_MAX, "%s/%s", sysfs, PCI_ROOT_BUS_DEVICES_PATH); + dir = opendir(path); + if (!dir) + return; + + /* Scan the PCI root bus to find the match root port on @target_bus */ + while ((dent = readdir(dir))) { + ret = sscanf(dent->d_name, PCI_DEVICE_NAME_PATTERN, + &domain, &bus, &dev, &fn); + if (ret != 4 || bus != target_bus) + continue; + + bdf = (bus << 8) | PCI_DEVFN(dev, fn); + if (bdf < bdf_min || bdf > bdf_max) + continue; + + rp = zalloc(sizeof(*rp)); + if (!rp) + continue; + + rp->selected = false; + rp->sicl_id = sicl_id; + rp->core_id = core_id; + rp->domain = domain; + rp->bus = bus; + rp->dev = dev; + rp->fn = fn; + + hisi_pcie_init_root_port_mask(rp, PCI_SLOT(bdf_min)); + + list_add(&rp->list, &hisi_pcie_root_ports_list); + hisi_pcie_root_ports_num++; + + pr_debug3("Found root port %s\n", dent->d_name); + } + + closedir(dir); +} + +/* Scan the PMUs and build the mapping of the Root Ports to the PMU */ +static int hisi_pcie_root_ports_init(void) +{ + char event_source[PATH_MAX], bus_path[PATH_MAX]; + unsigned long long bus, bdf_max, bdf_min; + u16 sicl_id, core_id; + struct dirent *dent; + DIR *dir; + + perf_pmu__event_source_devices_scnprintf(event_source, sizeof(event_source)); + dir = opendir(event_source); + if (!dir) + return -ENOENT; + + while ((dent = readdir(dir))) { + /* + * This HiSilicon PCIe PMU will be named as: + * hisi_pcie<sicl_id>_core<core_id> + */ + if ((sscanf(dent->d_name, "hisi_pcie%hu_core%hu", &sicl_id, &core_id)) != 2) + continue; + + /* + * Driver will export the root port it can monitor through + * the "bus" sysfs attribute. + */ + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bus", + event_source, sicl_id, core_id); + + /* + * Per PCIe spec the bus should be 8bit, use unsigned long long + * for the convience of the library function. + */ + if (filename__read_ull(bus_path, &bus)) + continue; + + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bdf_max", + event_source, sicl_id, core_id); + if (filename__read_xll(bus_path, &bdf_max)) + bdf_max = -1; + + scnprintf(bus_path, sizeof(bus_path), "%s/hisi_pcie%hu_core%hu/bdf_min", + event_source, sicl_id, core_id); + if (filename__read_xll(bus_path, &bdf_min)) + bdf_min = 0; + + pr_debug3("Found pmu %s bus 0x%llx\n", dent->d_name, bus); + + hisi_pcie_root_ports_add(sicl_id, core_id, (u8)bus, (u16)bdf_min, (u16)bdf_max); + } + + closedir(dir); + return hisi_pcie_root_ports_num > 0 ? 0 : -ENOENT; +} + +static void hisi_pcie_root_ports_free(void) +{ + struct hisi_pcie_root_port *rp, *tmp; + + if (hisi_pcie_root_ports_num == 0) + return; + + list_for_each_entry_safe(rp, tmp, &hisi_pcie_root_ports_list, list) { + list_del(&rp->list); + zfree(&rp); + hisi_pcie_root_ports_num--; + } +} + +static int hisi_iostat_add_events(struct evlist *evl) +{ + struct hisi_pcie_root_port *rp; + struct evsel *evsel; + unsigned int i, j; + char *iostat_cmd; + int pos = 0; + int ret; + + if (!hisi_pcie_root_ports_num) + return -ENOENT; + + iostat_cmd = zalloc(PATH_MAX); + if (!iostat_cmd) + return -ENOMEM; + + list_for_each_entry(rp, &hisi_pcie_root_ports_list, list) { + if (!rp->selected) + continue; + + iostat_cmd[pos++] = '{'; + for (j = 0; j < ARRAY_SIZE(hisi_iostat_cmd_template); j++) { + pos += snprintf(iostat_cmd + pos, ARG_MAX - pos - 1, + hisi_iostat_cmd_template[j], + rp->sicl_id, rp->core_id, rp->mask); + + if (j == ARRAY_SIZE(hisi_iostat_cmd_template) - 1) + iostat_cmd[pos++] = '}'; + else + iostat_cmd[pos++] = ','; + } + + ret = parse_event(evl, iostat_cmd); + if (ret) + break; + + i = 0; + evlist__for_each_entry_reverse(evl, evsel) { + if (i == ARRAY_SIZE(hisi_iostat_cmd_template)) + break; + + evsel->priv = rp; + i++; + } + + memset(iostat_cmd, 0, PATH_MAX); + pos = 0; + } + + zfree(&iostat_cmd); + return ret; +} + +int iostat_prepare(struct evlist *evlist, + struct perf_stat_config *config) +{ + if (evlist->core.nr_entries > 0) { + pr_warning("The -e and -M options are not supported." + "All chosen events/metrics will be dropped\n"); + evlist__delete(evlist); + evlist = evlist__new(); + if (!evlist) + return -ENOMEM; + } + + config->metric_only = true; + config->aggr_mode = AGGR_GLOBAL; + + return hisi_iostat_add_events(evlist); +} + +static int hisi_pcie_root_ports_list_filter(const char *str) +{ + char *tok, *tmp, *copy = NULL; + u8 bus, dev, fn; + u32 domain; + int ret; + + copy = strdup(str); + if (!copy) + return -ENOMEM; + + for (tok = strtok_r(copy, ",", &tmp); tok; tok = strtok_r(NULL, ",", &tmp)) { + ret = sscanf(tok, PCI_DEVICE_NAME_PATTERN, &domain, &bus, &dev, &fn); + if (ret != 4) { + ret = -EINVAL; + break; + } + + ret = hisi_pcie_root_ports_select_one(domain, bus, dev, fn); + if (ret) + break; + } + + zfree(&copy); + return ret; +} + +int iostat_parse(const struct option *opt, const char *str, int unset __maybe_unused) +{ + struct perf_stat_config *config = (struct perf_stat_config *)opt->data; + int ret; + + ret = hisi_pcie_root_ports_init(); + if (!ret) { + config->iostat_run = true; + + if (!str) { + iostat_mode = IOSTAT_RUN; + hisi_pcie_root_ports_select_all(); + } else if (!strcmp(str, "list")) { + iostat_mode = IOSTAT_LIST; + hisi_pcie_root_ports_select_all(); + } else { + iostat_mode = IOSTAT_RUN; + ret = hisi_pcie_root_ports_list_filter(str); + } + } + + return ret; +} + +static void hisi_pcie_root_port_show(FILE *output, + const struct hisi_pcie_root_port * const rp) +{ + if (output && rp) + fprintf(output, "hisi_pcie%hu_core%hu<" PCI_DEVICE_NAME_PATTERN ">\n", + rp->sicl_id, rp->core_id, rp->domain, rp->bus, rp->dev, rp->fn); +} + +void iostat_list(struct evlist *evlist __maybe_unused, struct perf_stat_config *config) +{ + struct hisi_pcie_root_port *rp = NULL; + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) { + if (rp != evsel->priv) { + hisi_pcie_root_port_show(config->output, evsel->priv); + rp = evsel->priv; + } + } +} + +void iostat_release(struct evlist *evlist) +{ + struct evsel *evsel; + + evlist__for_each_entry(evlist, evsel) + evsel->priv = NULL; + + hisi_pcie_root_ports_free(); +} + +void iostat_print_header_prefix(struct perf_stat_config *config) +{ + if (config->csv_output) + fputs("port,", config->output); + else if (config->interval) + fprintf(config->output, "# time port "); + else + fprintf(config->output, " port "); +} + +void iostat_print_metric(struct perf_stat_config *config, struct evsel *evsel, + struct perf_stat_output_ctx *out) +{ + const char *iostat_metric = hisi_iostat_metrics[evsel->core.idx % ARRAY_SIZE(hisi_iostat_metrics)]; + struct perf_counts_values *count; + double iostat_value; + + /* We're using AGGR_GLOBAL so there's only one aggr counts aggr[0]. */ + count = &evsel->stats->aggr[0].counts; + + /* The counts has been scaled, we can use it directly. */ + iostat_value = (double)count->val; + + /* + * Display two digits after decimal point for better accuracy if the + * value is non-zero. + */ + out->print_metric(config, out->ctx, NULL, + iostat_value > 0 ? "%8.2f" : "%8.0f", + iostat_metric, iostat_value / (256 * 1024)); +} + +void iostat_prefix(struct evlist *evlist, struct perf_stat_config *config, + char *prefix, struct timespec *ts) +{ + struct hisi_pcie_root_port *rp = evlist->selected->priv; + + if (rp) { + if (ts) + sprintf(prefix, "%6lu.%09lu%s" PCI_DEVICE_NAME_PATTERN "%s", + ts->tv_sec, ts->tv_nsec, config->csv_sep, + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + else + sprintf(prefix, PCI_DEVICE_NAME_PATTERN "%s", + rp->domain, rp->bus, rp->dev, rp->fn, + config->csv_sep); + } +} + +void iostat_print_counters(struct evlist *evlist, struct perf_stat_config *config, + struct timespec *ts, char *prefix, + iostat_print_counter_t print_cnt_cb, void *arg) +{ + struct evsel *counter = evlist__first(evlist); + void *perf_device; + + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "%s", prefix); + evlist__for_each_entry(evlist, counter) { + perf_device = evlist->selected->priv; + if (perf_device && perf_device != counter->priv) { + evlist__set_selected(evlist, counter); + iostat_prefix(evlist, config, prefix, ts); + fprintf(config->output, "\n%s", prefix); + } + print_cnt_cb(config, counter, arg); + } + fputc('\n', config->output); +} -- 2.33.0

1 0

[openeuler:OLK-6.6 2116/2116] drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 62b846e657553d00552c1c71b6ecc26017eb1a9a commit: 7795623241fe9eb57352a09b27d06b5d4ff07071 [2116/2116] add firmware update function for Mont-TSSE config: x86_64-randconfig-r113-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101403.RKyoTq9Z-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504101403.RKyoTq9Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101403.RKyoTq9Z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/crypto/montage/tsse/tsse_ipc.c:27:40: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:48:28: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] device_msg_data @@ drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: expected void const volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:49:47: sparse: got unsigned char [usertype] *[assigned] device_msg_data drivers/crypto/montage/tsse/tsse_ipc.c:122:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:124:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_ipc.c:124:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:124:21: sparse: got unsigned char [usertype] *[assigned] h2d drivers/crypto/montage/tsse/tsse_ipc.c:125:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc.c:125:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:125:25: sparse: got unsigned char [usertype] * -- >> drivers/crypto/montage/tsse/tsse_dev_drv.c:148:1: sparse: sparse: symbol 'dev_attr_tsse_image_load' was not declared. Should it be static? vim +49 drivers/crypto/montage/tsse/tsse_ipc.c 16 17 /** 18 * Create ipc_msg and read message from BAR. 19 * Return the pointer to ipc_msg, the caller is responsible for free it. 20 */ 21 static struct ipc_msg *get_msginf(void __iomem *d2h) 22 { 23 uint32_t u_len = 0; 24 struct ipc_msg *msg = NULL; 25 26 uint8_t *device_msg_data = NULL; > 27 struct ipc_header *ipc_info = (struct ipc_header *)d2h; 28 29 // The memory layout in d2h should at least contains: 30 // ipc_header, msg_info and fw_load (message body) 31 if (ipc_info->i_len < sizeof(struct ipc_header) + 32 sizeof(struct msg_info) + sizeof(struct fw_load)) { 33 pr_info("%s(): msg format error\n", __func__); 34 return NULL; 35 } 36 u_len = ipc_info->i_len - sizeof(struct ipc_header); 37 msg = (struct ipc_msg *)(kzalloc(sizeof(struct ipc_msg) + u_len, 38 GFP_ATOMIC)); 39 if (!msg) { 40 pr_info("%s(): ipc_msg kzalloc failed\n", __func__); 41 return NULL; 42 } 43 44 msg->header.inst_id = ipc_info->inst_id; 45 msg->header.tgid = ipc_info->tgid; 46 msg->header.i_len = ipc_info->i_len; 47 48 device_msg_data = (uint8_t *)(d2h + sizeof(struct ipc_header)); > 49 memcpy_fromio((uint8_t *)msg->i_data, device_msg_data, u_len); 50 51 return msg; 52 } 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2116/2116] drivers/crypto/montage/tsse/tsse_fw_service.c:40:16: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f38765261337382b0302ed7d139c110e0fbe3f71 commit: 811debd4ea52033d7393d4a7de2be11f71c70348 [2116/2116] add support for Mont-TSSE Driver config: x86_64-randconfig-r113-20250410 (https://download.01.org/0day-ci/archive/20250410/202504101225.8jbFE2Ak-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504101225.8jbFE2Ak-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504101225.8jbFE2Ak-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/montage/tsse/tsse_fw_service.c:40:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_fw_service.c:41:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_fw_service.c:41:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_fw_service.c:41:21: sparse: got unsigned char [usertype] *[assigned] h2d >> drivers/crypto/montage/tsse/tsse_fw_service.c:42:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_fw_service.c:42:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_fw_service.c:42:25: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_fw_service.c:26:5: sparse: sparse: symbol 'fw_send_msg' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_fw_service.c:51:6: sparse: sparse: symbol 'fw_free' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_fw_service.c:141:22: sparse: got unsigned char [usertype] * -- >> drivers/crypto/montage/tsse/tsse_ipc.c:22:40: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:17:17: sparse: sparse: symbol 'get_msginf' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:47:21: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:48:36: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const volatile [noderef] __iomem * @@ got unsigned int [usertype] *[assigned] msg_data @@ drivers/crypto/montage/tsse/tsse_ipc.c:48:36: sparse: expected void const volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:48:36: sparse: got unsigned int [usertype] *[assigned] msg_data drivers/crypto/montage/tsse/tsse_ipc.c:41:6: sparse: sparse: symbol 'ipc_recieve_msg' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:53:5: sparse: sparse: symbol 'msg_rout' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:107:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:108:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_ipc.c:108:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:108:21: sparse: got unsigned char [usertype] *[assigned] h2d drivers/crypto/montage/tsse/tsse_ipc.c:109:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc.c:109:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:109:25: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_ipc.c:103:6: sparse: sparse: symbol 'ipc_send_msg' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:115:6: sparse: sparse: symbol 'ipc_hw_init' was not declared. Should it be static? drivers/crypto/montage/tsse/tsse_ipc.c:153:16: sparse: sparse: cast removes address space '__iomem' of expression drivers/crypto/montage/tsse/tsse_ipc.c:155:21: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] *[assigned] h2d @@ drivers/crypto/montage/tsse/tsse_ipc.c:155:21: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:155:21: sparse: got unsigned char [usertype] *[assigned] h2d drivers/crypto/montage/tsse/tsse_ipc.c:156:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got unsigned char [usertype] * @@ drivers/crypto/montage/tsse/tsse_ipc.c:156:25: sparse: expected void volatile [noderef] __iomem * drivers/crypto/montage/tsse/tsse_ipc.c:156:25: sparse: got unsigned char [usertype] * drivers/crypto/montage/tsse/tsse_ipc.c:122:5: sparse: sparse: symbol 'ipc_init_msg' was not declared. Should it be static? -- >> drivers/crypto/montage/tsse/tsse_vuart.c:61:28: sparse: sparse: cast to restricted __le32 >> drivers/crypto/montage/tsse/tsse_vuart.c:73:15: sparse: sparse: incorrect type in assignment (different base types) @@ expected int value @@ got restricted __le32 [usertype] @@ drivers/crypto/montage/tsse/tsse_vuart.c:73:15: sparse: expected int value drivers/crypto/montage/tsse/tsse_vuart.c:73:15: sparse: got restricted __le32 [usertype] vim +/__iomem +40 drivers/crypto/montage/tsse/tsse_fw_service.c 25 26 int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) 27 { 28 u8 *h2d; 29 u32 int_reg; 30 u32 rc; 31 32 mutex_lock(&tsseipc->list_lock); 33 34 int_reg = readl(tsseipc->virt_addr + HOST2MAIN_INTR_SET_OFFSET); 35 if ((int_reg & IPC_REGISTER_INT_SET) != 0) { 36 rc = -1; 37 mutex_unlock(&tsseipc->list_lock); 38 return rc; 39 } > 40 h2d = (u8 *)(tsseipc->virt_addr + HOST2MAIN_IPC_OFFSET); 41 memcpy_toio(h2d, msg, sizeof(struct ipc_header)); > 42 memcpy_toio(h2d + sizeof(struct ipc_header), (u32 *)msg->i_data, 43 msg->header.i_len - sizeof(struct ipc_header)); 44 writel(0x1, tsseipc->virt_addr + HOST2MAIN_INTR_SET_OFFSET); 45 46 dev_info(tsseipc->dev, "notify device to get firmware\n"); 47 mutex_unlock(&tsseipc->list_lock); 48 return 0; 49 } 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
by Yi Yang 10 Apr '25

10 Apr '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.14-rc6 commit ad95bab0cd28ed77c2c0d0b6e76e03e031391064 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43W CVE: CVE-2025-21927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Confilcts dues to no backport of 363895767fbf("nvme-tcp: sanitize TLS key handling") and 84e009042d0f("nvme-tcp: add basic support for the C2HTermReq PDU")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/nvme/host/tcp.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index be04c5f3856d..6076c0d2d97a 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -189,6 +189,19 @@ static inline int nvme_tcp_queue_id(struct nvme_tcp_queue *queue) return queue - queue->ctrl->queues; } +static inline bool nvme_tcp_recv_pdu_supported(enum nvme_tcp_pdu_type type) +{ + switch (type) { + case nvme_tcp_c2h_term: + case nvme_tcp_c2h_data: + case nvme_tcp_r2t: + case nvme_tcp_rsp: + return true; + default: + return false; + } +} + static inline struct blk_mq_tags *nvme_tcp_tagset(struct nvme_tcp_queue *queue) { u32 queue_idx = nvme_tcp_queue_id(queue); @@ -728,6 +741,16 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, return 0; hdr = queue->pdu; + if (unlikely(hdr->hlen != sizeof(struct nvme_tcp_rsp_pdu))) { + if (!nvme_tcp_recv_pdu_supported(hdr->type)) + goto unsupported_pdu; + + dev_err(queue->ctrl->ctrl.device, + "pdu type %d has unexpected header length (%d)\n", + hdr->type, hdr->hlen); + return -EPROTO; + } + if (queue->hdr_digest) { ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen); if (unlikely(ret)) @@ -751,10 +774,13 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, nvme_tcp_init_recv_ctx(queue); return nvme_tcp_handle_r2t(queue, (void *)queue->pdu); default: - dev_err(queue->ctrl->ctrl.device, - "unsupported pdu type (%d)\n", hdr->type); - return -EINVAL; + goto unsupported_pdu; } + +unsupported_pdu: + dev_err(queue->ctrl->ctrl.device, + "unsupported pdu type (%d)\n", hdr->type); + return -EINVAL; } static inline void nvme_tcp_end_request(struct request *rq, u16 status) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2023-52973 for openEuler-1.0-LTS
by Yi Yang 10 Apr '25

10 Apr '25

CVE-2023-52973 and later patches. George Kennedy (2): vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF vc_screen: modify vcs_size() handling in vcs_read() Thomas Weißschuh (1): vc_screen: don't clobber return value in vcs_read drivers/tty/vt/vc_screen.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 00/14] yt6801: Add Motorcomm yt6801 PCIe driver
by Frank Sae 10 Apr '25

10 Apr '25

This series includes adding Motorcomm YT6801 Gigabit ethernet driver and adding yt6801 ethernet driver entry in MAINTAINERS file. YT6801 integrates a YT8531S phy. Frank Sae (14): yt6801: Add support for a pci table in this module yt6801: Implement mdio register yt6801: Implement pci_driver shutdown yt6801: Implement the fxgmac_init function yt6801: Implement the .ndo_open function yt6801: Implement the fxgmac_start function net:phy:motorcomm: Add PHY_INTERFACE_MODE_INTERNAL to support YT6801 yt6801: Implement the fxgmac_hw_init function yt6801: Implement the poll functions yt6801: Implement .ndo_start_xmit function yt6801: Implement some net_device_ops function yt6801: Implement pci_driver suspend and resume yt6801: Add makefile and Kconfig yt6801: Update the Makefile, Kconfig and maintainer for yt6801 MAINTAINERS | 8 + arch/arm64/configs/openeuler_defconfig | 4 +- arch/powerpc/configs/openeuler_defconfig | 4 +- arch/riscv/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 4 +- drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/motorcomm/Kconfig | 27 + drivers/net/ethernet/motorcomm/Makefile | 6 + .../net/ethernet/motorcomm/yt6801/Makefile | 8 + .../ethernet/motorcomm/yt6801/yt6801_desc.c | 565 ++++ .../ethernet/motorcomm/yt6801/yt6801_desc.h | 35 + .../ethernet/motorcomm/yt6801/yt6801_main.c | 3006 +++++++++++++++++ .../ethernet/motorcomm/yt6801/yt6801_type.h | 956 ++++++ drivers/net/phy/motorcomm.c | 6 + 15 files changed, 4631 insertions(+), 4 deletions(-) create mode 100644 drivers/net/ethernet/motorcomm/Kconfig create mode 100644 drivers/net/ethernet/motorcomm/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/Makefile create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_desc.h create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c create mode 100644 drivers/net/ethernet/motorcomm/yt6801/yt6801_type.h -- 2.34.1

2 15

[openeuler:openEuler-1.0-LTS 1571/1571] block/blk-lib.o: warning: objtool: __blkdev_issue_discard()+0x146: unreachable instruction
by kernel test robot 10 Apr '25

10 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 332043630ae1e3b726dde819c6cb60a99afb2ad6 commit: dadc407ba9ceb5887da2bd4e4eedcf332bf47151 [1571/1571] block: check queue's limits.discard_granularity in __blkdev_issue_discard() config: x86_64-buildonly-randconfig-006-20250408 (https://download.01.org/0day-ci/archive/20250410/202504100333.uIAnI5Io-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250410/202504100333.uIAnI5Io-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504100333.uIAnI5Io-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-lib.o: warning: objtool: __blkdev_issue_discard()+0x146: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1571/1571] mm/mincore.o: warning: objtool: mincore_pte_range()+0x154: unreachable instruction
by kernel test robot 09 Apr '25

09 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 332043630ae1e3b726dde819c6cb60a99afb2ad6 commit: 274fe639155078e031602764bfad9217e57d8160 [1571/1571] Revert "Change mincore() to count "mapped" pages rather than "cached" pages" config: x86_64-buildonly-randconfig-006-20250408 (https://download.01.org/0day-ci/archive/20250409/202504092107.ks7cBbF1-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250409/202504092107.ks7cBbF1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504092107.ks7cBbF1-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/mincore.o: warning: objtool: mincore_pte_range()+0x154: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] LoongArch: Set hugetlb mmap base address aligned with pmd size
by Zeng Heng 09 Apr '25

09 Apr '25

From: Bibo Mao <maobibo(a)loongson.cn> mainline inclusion from mainline-v6.14-rc6 commit 3109d5ff484b7bc7b955f166974c6776d91f247b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44L CVE: CVE-2025-21949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With ltp test case "testcases/bin/hugefork02", there is a dmesg error report message such as: kernel BUG at mm/hugetlb.c:5550! Oops - BUG[#1]: CPU: 0 UID: 0 PID: 1517 Comm: hugefork02 Not tainted 6.14.0-rc2+ #241 Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 pc 90000000004eaf1c ra 9000000000485538 tp 900000010edbc000 sp 900000010edbf940 a0 900000010edbfb00 a1 9000000108d20280 a2 00007fffe9474000 a3 00007ffff3474000 a4 0000000000000000 a5 0000000000000003 a6 00000000003cadd3 a7 0000000000000000 t0 0000000001ffffff t1 0000000001474000 t2 900000010ecd7900 t3 00007fffe9474000 t4 00007fffe9474000 t5 0000000000000040 t6 900000010edbfb00 t7 0000000000000001 t8 0000000000000005 u0 90000000004849d0 s9 900000010edbfa00 s0 9000000108d20280 s1 00007fffe9474000 s2 0000000002000000 s3 9000000108d20280 s4 9000000002b38b10 s5 900000010edbfb00 s6 00007ffff3474000 s7 0000000000000406 s8 900000010edbfa08 ra: 9000000000485538 unmap_vmas+0x130/0x218 ERA: 90000000004eaf1c __unmap_hugepage_range+0x6f4/0x7d0 PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000007 (+FPE +SXE +ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0) PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) Process hugefork02 (pid: 1517, threadinfo=00000000a670eaf4, task=000000007a95fc64) Call Trace: [<90000000004eaf1c>] __unmap_hugepage_range+0x6f4/0x7d0 [<9000000000485534>] unmap_vmas+0x12c/0x218 [<9000000000494068>] exit_mmap+0xe0/0x308 [<900000000025fdc4>] mmput+0x74/0x180 [<900000000026a284>] do_exit+0x294/0x898 [<900000000026aa30>] do_group_exit+0x30/0x98 [<900000000027bed4>] get_signal+0x83c/0x868 [<90000000002457b4>] arch_do_signal_or_restart+0x54/0xfa0 [<90000000015795e8>] irqentry_exit_to_user_mode+0xb8/0x138 [<90000000002572d0>] tlb_do_page_fault_1+0x114/0x1b4 The problem is that base address allocated from hugetlbfs is not aligned with pmd size. Here add a checking for hugetlbfs and align base address with pmd size. After this patch the test case "testcases/bin/hugefork02" passes to run. This is similar to the commit 7f24cbc9c4d42db8a3c8484d1 ("mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings"). Cc: stable(a)vger.kernel.org # 6.13+ Signed-off-by: Bibo Mao <maobibo(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Conflicts: arch/loongarch/mm/mmap.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/loongarch/mm/mmap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/mm/mmap.c b/arch/loongarch/mm/mmap.c index a9630a81b38a..01c20564f4b6 100644 --- a/arch/loongarch/mm/mmap.c +++ b/arch/loongarch/mm/mmap.c @@ -3,6 +3,7 @@ * Copyright (C) 2020-2022 Loongson Technology Corporation Limited */ #include <linux/export.h> +#include <linux/hugetlb.h> #include <linux/io.h> #include <linux/memblock.h> #include <linux/mm.h> @@ -62,8 +63,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, } info.length = len; - info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; info.align_offset = pgoff << PAGE_SHIFT; + if (filp && is_file_hugepages(filp)) + info.align_mask = huge_page_mask_align(filp); + else + info.align_mask = do_color_align ? (PAGE_MASK & SHM_ALIGN_MASK) : 0; if (dir == DOWN) { info.flags = VM_UNMAPPED_AREA_TOPDOWN; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] io_uring: prevent opcode speculation
by Long Li 09 Apr '25

09 Apr '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c fs/io_uring.c [Context conflict] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index 96255b816d71..470d50c0b4c3 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -6390,6 +6390,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) return -EINVAL; + req->opcode = array_index_nospec(req->opcode, IORING_OP_LAST); + if ((sqe_flags & IOSQE_BUFFER_SELECT) && !io_op_defs[req->opcode].buffer_select) return -EOPNOTSUPP; -- 2.39.2

2 1

openEuler Kernel SIG双周例会
by openEuler conference 09 Apr '25

09 Apr '25

您好！ Kernel 邀请您参加 2025-04-11 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，或者直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960387240 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-04-11 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，或者直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960387240 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 00/17] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 09 Apr '25

09 Apr '25

Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type fs/resctrl: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 29 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 39 +-- drivers/platform/mpam/mpam_devices.c | 101 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 347 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 +++++---- include/linux/arm_mpam.h | 7 + include/linux/resctrl.h | 17 +- include/linux/resctrl_types.h | 10 + 11 files changed, 661 insertions(+), 195 deletions(-) -- 2.25.1

2 18

[PATCH OLK-6.6 00/17] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 09 Apr '25

09 Apr '25

Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type fs/resctrl: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 29 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 39 +-- drivers/platform/mpam/mpam_devices.c | 101 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 347 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 +++++---- include/linux/arm_mpam.h | 7 + include/linux/resctrl.h | 17 +- include/linux/resctrl_types.h | 10 + 11 files changed, 661 insertions(+), 195 deletions(-) -- 2.25.1

2 18

[openeuler:openEuler-1.0-LTS 1571/1571] drivers/usb/typec/tps6598x.o: warning: objtool: tps6598x_probe()+0x1ed: can't find switch jump table
by kernel test robot 09 Apr '25

09 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf266d800949a86365ca698efe637ca1256d1706 commit: 10379cc2b54aefd096d8f00b7e3bd25b3dc6632d [1571/1571] drivers/usb/typec/tps6598x.c: fix portinfo width config: x86_64-buildonly-randconfig-002-20250408 (https://download.01.org/0day-ci/archive/20250409/202504090456.GrQ4Fosx-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250409/202504090456.GrQ4Fosx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504090456.GrQ4Fosx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/usb/typec/tps6598x.o: warning: objtool: tps6598x_probe()+0x1ed: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1546/1546] net/netfilter/nft_chain_filter.o: warning: objtool: missing symbol for section .text
by kernel test robot 09 Apr '25

09 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf266d800949a86365ca698efe637ca1256d1706 commit: d209df3e7f7002d9099fdb0f6df0f972b4386a63 [1546/1546] netfilter: nf_tables: fix register ordering config: x86_64-buildonly-randconfig-006-20250401 (https://download.01.org/0day-ci/archive/20250409/202504090250.JNCrFcpX-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250409/202504090250.JNCrFcpX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504090250.JNCrFcpX-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/nft_chain_filter.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dm raid: fix accesses beyond end of raid member array
by Yuan Can 08 Apr '25

08 Apr '25

From: Heinz Mauelshagen <heinzm(a)redhat.com> stable inclusion from stable-v4.19.251 commit df1a5ab0dd0775f2ea101c71f2addbc4c0ea0f85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP60S CVE: CVE-2022-49674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 332bd0778775d0cf105c4b9e03e460b590749916 upstream. On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled). Cc: stable(a)vger.kernel.org Signed-off-by: Heinz Mauelshagen <heinzm(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/md/dm-raid.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index cb34dbf8bf31..9a5d65d2223b 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -998,12 +998,13 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size) static int validate_raid_redundancy(struct raid_set *rs) { unsigned int i, rebuild_cnt = 0; - unsigned int rebuilds_per_group = 0, copies; + unsigned int rebuilds_per_group = 0, copies, raid_disks; unsigned int group_size, last_group_start; - for (i = 0; i < rs->md.raid_disks; i++) - if (!test_bit(In_sync, &rs->dev[i].rdev.flags) || - !rs->dev[i].rdev.sb_page) + for (i = 0; i < rs->raid_disks; i++) + if (!test_bit(FirstUse, &rs->dev[i].rdev.flags) && + ((!test_bit(In_sync, &rs->dev[i].rdev.flags) || + !rs->dev[i].rdev.sb_page))) rebuild_cnt++; switch (rs->md.level) { @@ -1043,8 +1044,9 @@ static int validate_raid_redundancy(struct raid_set *rs) * A A B B C * C D D E E */ + raid_disks = min(rs->raid_disks, rs->md.raid_disks); if (__is_raid10_near(rs->md.new_layout)) { - for (i = 0; i < rs->md.raid_disks; i++) { + for (i = 0; i < raid_disks; i++) { if (!(i % copies)) rebuilds_per_group = 0; if ((!rs->dev[i].rdev.sb_page || @@ -1067,10 +1069,10 @@ static int validate_raid_redundancy(struct raid_set *rs) * results in the need to treat the last (potentially larger) * set differently. */ - group_size = (rs->md.raid_disks / copies); - last_group_start = (rs->md.raid_disks / group_size) - 1; + group_size = (raid_disks / copies); + last_group_start = (raid_disks / group_size) - 1; last_group_start *= group_size; - for (i = 0; i < rs->md.raid_disks; i++) { + for (i = 0; i < raid_disks; i++) { if (!(i % copies) && !(i > last_group_start)) rebuilds_per_group = 0; if ((!rs->dev[i].rdev.sb_page || @@ -1585,7 +1587,7 @@ static sector_t __rdev_sectors(struct raid_set *rs) { int i; - for (i = 0; i < rs->md.raid_disks; i++) { + for (i = 0; i < rs->raid_disks; i++) { struct md_rdev *rdev = &rs->dev[i].rdev; if (!test_bit(Journal, &rdev->flags) && @@ -3748,13 +3750,13 @@ static int raid_iterate_devices(struct dm_target *ti, unsigned int i; int r = 0; - for (i = 0; !r && i < rs->md.raid_disks; i++) - if (rs->dev[i].data_dev) - r = fn(ti, - rs->dev[i].data_dev, - 0, /* No offset on data devs */ - rs->md.dev_sectors, - data); + for (i = 0; !r && i < rs->raid_disks; i++) { + if (rs->dev[i].data_dev) { + r = fn(ti, rs->dev[i].data_dev, + 0, /* No offset on data devs */ + rs->md.dev_sectors, data); + } + } return r; } -- 2.22.0

2 1

[PATCH OLK-6.6] ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
by Ye Bin 08 Apr '25

08 Apr '25

From: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> stable inclusion from stable-v6.6.80 commit 2b3878baf90918a361a3dfd3513025100b1b40b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0Q CVE: CVE-2025-21847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d8d99c3b5c485f339864aeaa29f76269cc0ea975 upstream. The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference. Fixes: 090349a9feba ("ASoC: SOF: Add support for compress API for stream data/offset") Cc: stable(a)vger.kernel.org Reported-by: Curtis Malainey <cujomalainey(a)chromium.org> Closes: https://github.com/thesofproject/linux/pull/5214 Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Daniel Baluta <daniel.baluta(a)nxp.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Reviewed-by: Curtis Malainey <cujomalainey(a)chromium.org> Link: https://patch.msgid.link/20250205135232.19762-2-peter.ujfalusi@linux.intel.… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- sound/soc/sof/stream-ipc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/sof/stream-ipc.c b/sound/soc/sof/stream-ipc.c index 216b454f6b94..3edcb0ea3848 100644 --- a/sound/soc/sof/stream-ipc.c +++ b/sound/soc/sof/stream-ipc.c @@ -43,7 +43,7 @@ int sof_ipc_msg_data(struct snd_sof_dev *sdev, return -ESTRPIPE; posn_offset = stream->posn_offset; - } else { + } else if (sps->cstream) { struct sof_compr_stream *sstream = sps->cstream->runtime->private_data; @@ -51,6 +51,10 @@ int sof_ipc_msg_data(struct snd_sof_dev *sdev, return -ESTRPIPE; posn_offset = sstream->posn_offset; + + } else { + dev_err(sdev->dev, "%s: No stream opened\n", __func__); + return -EINVAL; } snd_sof_dsp_mailbox_read(sdev, posn_offset, p, sz); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
by Ye Bin 08 Apr '25

08 Apr '25

From: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> mainline inclusion from mainline-v6.2-rc1 commit 4920ab131b2dbae7464b72bdcac465d070254209 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYB CVE: CVE-2022-49740 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count value of channel specifications provided by the device is greater than the length of 'list->element[]', decided by the size of the 'list' allocated with kzalloc(). The patch adds checks that make the functions free the buffer and return -EINVAL if that is the case. Note that the negative return is handled by the caller, brcmf_setup_wiphybands() or brcmf_cfg80211_attach(). Found by a modified version of syzkaller. Crash Report from brcmf_construct_chaninfo(): ================================================================== BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430 Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896 CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_setup_wiphybands+0x1238/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_setup_wiphybands+0x290/0x1430 brcmf_cfg80211_attach+0x2118/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888115f24000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1536 bytes inside of 2048-byte region [ffff888115f24000, ffff888115f24800) Memory state around the buggy address: ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Crash Report from brcmf_enable_bw40_2g(): ================================================================== BUG: KASAN: slab-out-of-bounds in brcmf_cfg80211_attach+0x3d11/0x3fd0 Read of size 4 at addr ffff888103787600 by task kworker/0:2/1896 CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G W O 5.14.0+ #132 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x57/0x7d print_address_description.constprop.0.cold+0x93/0x334 kasan_report.cold+0x83/0xdf brcmf_cfg80211_attach+0x3d11/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 Allocated by task 1896: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 kmem_cache_alloc_trace+0x19e/0x330 brcmf_cfg80211_attach+0x3302/0x3fd0 brcmf_attach+0x389/0xd40 brcmf_usb_probe+0x12de/0x1690 usb_probe_interface+0x25f/0x710 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_set_configuration+0x984/0x1770 usb_generic_driver_probe+0x69/0x90 usb_probe_device+0x9c/0x220 really_probe+0x1be/0xa90 __driver_probe_device+0x2ab/0x460 driver_probe_device+0x49/0x120 __device_attach_driver+0x18a/0x250 bus_for_each_drv+0x123/0x1a0 __device_attach+0x207/0x330 bus_probe_device+0x1a2/0x260 device_add+0xa61/0x1ce0 usb_new_device.cold+0x463/0xf66 hub_event+0x10d5/0x3330 process_one_work+0x873/0x13e0 worker_thread+0x8b/0xd10 kthread+0x379/0x450 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888103787000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1536 bytes inside of 2048-byte region [ffff888103787000, ffff888103787800) Memory state around the buggy address: ffff888103787500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888103787580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888103787600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888103787680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888103787700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Reported-by: Dokyung Song <dokyungs(a)yonsei.ac.kr> Reported-by: Jisoo Jang <jisoo.jang(a)yonsei.ac.kr> Reported-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20221116142952.518241-1-linuxlovemin@yonsei.ac.kr Conflicts: drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c [Fix context diff and change brcmf_err() to print error info] Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 8f2cc54836cc..e6ff4c64738e 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -96,6 +96,9 @@ #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \ (sizeof(struct brcmf_assoc_params_le) - sizeof(u16)) +#define BRCMF_MAX_CHANSPEC_LIST \ + (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1) + static bool check_vif_up(struct brcmf_cfg80211_vif *vif) { if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) { @@ -5961,6 +5964,13 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg, band->channels[i].flags = IEEE80211_CHAN_DISABLED; total = le32_to_cpu(list->count); + if (total > BRCMF_MAX_CHANSPEC_LIST) { + brcmf_err("Invalid count of channel Spec. (%u)\n", + total); + err = -EINVAL; + goto fail_pbuf; + } + for (i = 0; i < total; i++) { ch.chspec = (u16)le32_to_cpu(list->element[i]); cfg->d11inf.decchspec(&ch); @@ -6094,6 +6104,13 @@ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg) band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ]; list = (struct brcmf_chanspec_list *)pbuf; num_chan = le32_to_cpu(list->count); + if (num_chan > BRCMF_MAX_CHANSPEC_LIST) { + brcmf_err("Invalid count of channel Spec. (%u)\n", + num_chan); + kfree(pbuf); + return -EINVAL; + } + for (i = 0; i < num_chan; i++) { ch.chspec = (u16)le32_to_cpu(list->element[i]); cfg->d11inf.decchspec(&ch); -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2025-21883
by Ye Bin 08 Apr '25

08 Apr '25

Marcin Szycik (1): ice: Fix deinitializing VF in error path Paul Greenwalt (2): ice: Add E830 device IDs, MAC type and registers ice: add E830 HW VF mailbox message limit support drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_common.c | 71 ++++++++++++------- drivers/net/ethernet/intel/ice/ice_devids.h | 10 ++- .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 24 ++++--- .../net/ethernet/intel/ice/ice_hw_autogen.h | 55 ++++++++++---- drivers/net/ethernet/intel/ice/ice_lib.c | 3 + drivers/net/ethernet/intel/ice/ice_main.c | 37 ++++++---- drivers/net/ethernet/intel/ice/ice_sriov.c | 4 +- drivers/net/ethernet/intel/ice/ice_type.h | 3 +- drivers/net/ethernet/intel/ice/ice_vf_lib.c | 34 ++++++++- .../ethernet/intel/ice/ice_vf_lib_private.h | 1 + drivers/net/ethernet/intel/ice/ice_vf_mbx.c | 32 +++++++++ drivers/net/ethernet/intel/ice/ice_vf_mbx.h | 9 +++ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 8 ++- .../ethernet/intel/ice/ice_virtchnl_fdir.c | 29 +++++--- 15 files changed, 245 insertions(+), 76 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 08 Apr '25

08 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.83 commit e6411c3b9512dba09af7d014d474516828c89706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43D CVE: CVE-2025-21935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-5.10] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 08 Apr '25

08 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.235 commit 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43D CVE: CVE-2025-21935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2022-49647
by Chen Ridong 08 Apr '25

08 Apr '25

CVE-2022-49647 Chen Ridong (2): cgroup: fix kabi for css_set cgroup: disable cgroup.type Tejun Heo (1): cgroup: Use separate src/dst nodes when preloading css_sets for migration include/linux/cgroup-defs.h | 13 +++++++++++ kernel/cgroup/cgroup.c | 43 +++++++++++++++++++++++++------------ 2 files changed, 42 insertions(+), 14 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] drm/drm_vma_manager: Add drm_vma_node_allow_once()
by Yang Yingliang 08 Apr '25

08 Apr '25

From: Nirmoy Das <nirmoy.das(a)intel.com> mainline inclusion from mainline-v6.2-rc6 commit 899d3a3c19ac0e5da013ce34833dccb97d19b5e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVX3 CVE: CVE-2023-53001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently there is no easy way for a drm driver to safely check and allow drm_vma_offset_node for a drm file just once. Allow drm drivers to call non-refcounted version of drm_vma_node_allow() so that a driver doesn't need to keep track of each drm_vma_node_allow() to call subsequent drm_vma_node_revoke() to prevent memory leak. Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)gmail.com> Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: Tvrtko Ursulin <tvrtko.ursulin(a)linux.intel.com> Cc: Andi Shyti <andi.shyti(a)linux.intel.com> Suggested-by: Chris Wilson <chris.p.wilson(a)intel.com> Signed-off-by: Nirmoy Das <nirmoy.das(a)intel.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://lore.kernel.org/r/20230117175236.22317-1-nirmoy.das@intel.com Signed-off-by: Maxime Ripard <maxime(a)cerno.tech> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/drm_vma_manager.c | 76 ++++++++++++++++++++++--------- include/drm/drm_vma_manager.h | 1 + 2 files changed, 55 insertions(+), 22 deletions(-) diff --git a/drivers/gpu/drm/drm_vma_manager.c b/drivers/gpu/drm/drm_vma_manager.c index 4565319fa6b3..7f0dc56321ae 100644 --- a/drivers/gpu/drm/drm_vma_manager.c +++ b/drivers/gpu/drm/drm_vma_manager.c @@ -240,27 +240,8 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr, } EXPORT_SYMBOL(drm_vma_offset_remove); -/** - * drm_vma_node_allow - Add open-file to list of allowed users - * @node: Node to modify - * @tag: Tag of file to remove - * - * Add @tag to the list of allowed open-files for this node. If @tag is - * already on this list, the ref-count is incremented. - * - * The list of allowed-users is preserved across drm_vma_offset_add() and - * drm_vma_offset_remove() calls. You may even call it if the node is currently - * not added to any offset-manager. - * - * You must remove all open-files the same number of times as you added them - * before destroying the node. Otherwise, you will leak memory. - * - * This is locked against concurrent access internally. - * - * RETURNS: - * 0 on success, negative error code on internal failure (out-of-mem) - */ -int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) +static int vma_node_allow(struct drm_vma_offset_node *node, + struct drm_file *tag, bool ref_counted) { struct rb_node **iter; struct rb_node *parent = NULL; @@ -282,7 +263,8 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) entry = rb_entry(*iter, struct drm_vma_offset_file, vm_rb); if (tag == entry->vm_tag) { - entry->vm_count++; + if (ref_counted) + entry->vm_count++; goto unlock; } else if (tag > entry->vm_tag) { iter = &(*iter)->rb_right; @@ -307,8 +289,58 @@ int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) kfree(new); return ret; } + +/** + * drm_vma_node_allow - Add open-file to list of allowed users + * @node: Node to modify + * @tag: Tag of file to remove + * + * Add @tag to the list of allowed open-files for this node. If @tag is + * already on this list, the ref-count is incremented. + * + * The list of allowed-users is preserved across drm_vma_offset_add() and + * drm_vma_offset_remove() calls. You may even call it if the node is currently + * not added to any offset-manager. + * + * You must remove all open-files the same number of times as you added them + * before destroying the node. Otherwise, you will leak memory. + * + * This is locked against concurrent access internally. + * + * RETURNS: + * 0 on success, negative error code on internal failure (out-of-mem) + */ +int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag) +{ + return vma_node_allow(node, tag, true); +} EXPORT_SYMBOL(drm_vma_node_allow); +/** + * drm_vma_node_allow_once - Add open-file to list of allowed users + * @node: Node to modify + * @tag: Tag of file to remove + * + * Add @tag to the list of allowed open-files for this node. + * + * The list of allowed-users is preserved across drm_vma_offset_add() and + * drm_vma_offset_remove() calls. You may even call it if the node is currently + * not added to any offset-manager. + * + * This is not ref-counted unlike drm_vma_node_allow() hence drm_vma_node_revoke() + * should only be called once after this. + * + * This is locked against concurrent access internally. + * + * RETURNS: + * 0 on success, negative error code on internal failure (out-of-mem) + */ +int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag) +{ + return vma_node_allow(node, tag, false); +} +EXPORT_SYMBOL(drm_vma_node_allow_once); + /** * drm_vma_node_revoke - Remove open-file from list of allowed users * @node: Node to modify diff --git a/include/drm/drm_vma_manager.h b/include/drm/drm_vma_manager.h index 76ac5e97a559..ed54bce9a005 100644 --- a/include/drm/drm_vma_manager.h +++ b/include/drm/drm_vma_manager.h @@ -74,6 +74,7 @@ void drm_vma_offset_remove(struct drm_vma_offset_manager *mgr, struct drm_vma_offset_node *node); int drm_vma_node_allow(struct drm_vma_offset_node *node, struct drm_file *tag); +int drm_vma_node_allow_once(struct drm_vma_offset_node *node, struct drm_file *tag); void drm_vma_node_revoke(struct drm_vma_offset_node *node, struct drm_file *tag); bool drm_vma_node_is_allowed(struct drm_vma_offset_node *node, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2022-49647
by Chen Ridong 08 Apr '25

08 Apr '25

CVE-2022-49647 Chen Ridong (2): cgroup: fix kabi for css_set cgroup: disable cgroup.type Tejun Heo (1): cgroup: Use separate src/dst nodes when preloading css_sets for migration include/linux/cgroup-defs.h | 13 +++++++++++ kernel/cgroup/cgroup.c | 43 +++++++++++++++++++++++++------------ 2 files changed, 42 insertions(+), 14 deletions(-) -- 2.34.1

2 4

[openeuler:openEuler-1.0-LTS 1568/1568] drivers/spi/spi-phytium-plat.c:122:8: error: implicit declaration of function 'gpiod_count'
by kernel test robot 08 Apr '25

08 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [1568/1568] spi: add phytium spi support config: x86_64-randconfig-104-20250408 (https://download.01.org/0day-ci/archive/20250408/202504081227.W3mx0ZSS-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081227.W3mx0ZSS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081227.W3mx0ZSS-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/spi/spi-phytium-plat.c:122:8: error: implicit declaration of function 'gpiod_count' [-Werror,-Wimplicit-function-declaration] 122 | n = gpiod_count(&pdev->dev, "cs"); | ^ drivers/spi/spi-phytium-plat.c:122:8: note: did you mean 'cpuid_count'? arch/x86/include/asm/processor.h:620:20: note: 'cpuid_count' declared here 620 | static inline void cpuid_count(unsigned int op, int count, | ^ >> drivers/spi/spi-phytium-plat.c:128:12: error: implicit declaration of function 'devm_gpiod_get_index_optional' [-Werror,-Wimplicit-function-declaration] 128 | gpiod = devm_gpiod_get_index_optional(&pdev->dev, | ^ >> drivers/spi/spi-phytium-plat.c:129:17: error: use of undeclared identifier 'GPIOD_OUT_LOW' 129 | "cs", i, GPIOD_OUT_LOW); | ^ >> drivers/spi/spi-phytium-plat.c:136:14: error: implicit declaration of function 'desc_to_gpio' [-Werror,-Wimplicit-function-declaration] 136 | cs_gpio = desc_to_gpio(gpiod); | ^ drivers/spi/spi-phytium-plat.c:136:14: note: did you mean 'irq_to_gpio'? include/linux/gpio.h:236:19: note: 'irq_to_gpio' declared here 236 | static inline int irq_to_gpio(unsigned irq) | ^ 4 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for SPI_PHYTIUM Depends on [n]: SPI [=y] && SPI_MASTER [=y] && (ARCH_PHYTIUM || COMPILE_TEST [=n]) Selected by [m]: - SPI_PHYTIUM_PLAT [=m] && SPI [=y] && SPI_MASTER [=y] vim +/gpiod_count +122 drivers/spi/spi-phytium-plat.c 37 38 static int phytium_spi_probe(struct platform_device *pdev) 39 { 40 struct phytium_spi_clk *ftsc; 41 struct phytium_spi *fts; 42 struct resource *mem; 43 int ret; 44 int num_cs; 45 int cs_gpio; 46 int global_cs; 47 int i; 48 49 ftsc = devm_kzalloc(&pdev->dev, sizeof(struct phytium_spi_clk), 50 GFP_KERNEL); 51 if (!ftsc) 52 return -ENOMEM; 53 54 fts = &ftsc->fts; 55 56 mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); 57 if (!mem) { 58 dev_err(&pdev->dev, "no mem resource?\n"); 59 return -EINVAL; 60 } 61 62 fts->regs = devm_ioremap_resource(&pdev->dev, mem); 63 if (IS_ERR(fts->regs)) { 64 dev_err(&pdev->dev, "SPI region map failed\n"); 65 return PTR_ERR(fts->regs); 66 } 67 68 fts->irq = platform_get_irq(pdev, 0); 69 if (fts->irq < 0) { 70 dev_err(&pdev->dev, "no irq resource?\n"); 71 return fts->irq; /* -ENXIO */ 72 } 73 74 if (pdev->dev.of_node) { 75 ftsc->clk = devm_clk_get(&pdev->dev, NULL); 76 77 if (IS_ERR(ftsc->clk)) 78 return PTR_ERR(ftsc->clk); 79 ret = clk_prepare_enable(ftsc->clk); 80 if (ret) 81 return ret; 82 83 fts->max_freq = clk_get_rate(ftsc->clk); 84 } else if (has_acpi_companion(&pdev->dev)) { 85 fts->max_freq = 48000000; 86 } 87 88 fts->bus_num = pdev->id; 89 device_property_read_u32(&pdev->dev, 90 "reg-io-width", &fts->reg_io_width); 91 92 num_cs = 4; 93 94 device_property_read_u32(&pdev->dev, "num-cs", &num_cs); 95 96 fts->num_cs = num_cs; 97 98 if (pdev->dev.of_node) { 99 int i; 100 101 for (i = 0; i < fts->num_cs; i++) { 102 cs_gpio = of_get_named_gpio(pdev->dev.of_node, 103 "cs-gpios", i); 104 105 if (cs_gpio == -EPROBE_DEFER) { 106 ret = cs_gpio; 107 goto out; 108 } 109 110 if (gpio_is_valid(cs_gpio)) { 111 ret = devm_gpio_request(&pdev->dev, cs_gpio, 112 dev_name(&pdev->dev)); 113 if (ret) 114 goto out; 115 } 116 } 117 } else if (has_acpi_companion(&pdev->dev)) { 118 int n; 119 int *cs; 120 struct gpio_desc *gpiod; 121 > 122 n = gpiod_count(&pdev->dev, "cs"); 123 124 cs = devm_kcalloc(&pdev->dev, n, sizeof(int), GFP_KERNEL); 125 fts->cs = cs; 126 127 for (i = 0; i < n; i++) { > 128 gpiod = devm_gpiod_get_index_optional(&pdev->dev, > 129 "cs", i, GPIOD_OUT_LOW); 130 131 if (IS_ERR(gpiod)) { 132 ret = PTR_ERR(gpiod); 133 goto out; 134 } 135 > 136 cs_gpio = desc_to_gpio(gpiod); 137 cs[i] = cs_gpio; 138 } 139 } 140 141 device_property_read_u32(&pdev->dev, "global-cs", &global_cs); 142 fts->global_cs = global_cs; 143 144 ret = phytium_spi_add_host(&pdev->dev, fts); 145 if (ret) 146 goto out; 147 148 platform_set_drvdata(pdev, ftsc); 149 return 0; 150 151 out: 152 clk_disable_unprepare(ftsc->clk); 153 return ret; 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] RDMA/mlx5: Fix a WARN during dereg_mr for DM type
by Yi Yang 08 Apr '25

08 Apr '25

From: Yishai Hadas <yishaih(a)nvidia.com> mainline inclusion from mainline-v6.14-rc5 commit abc7b3f1f056d69a8f11d6dceecc0c9549ace770 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSX CVE: CVE-2025-21888 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Memory regions (MR) of type DM (device memory) do not have an associated umem. In the __mlx5_ib_dereg_mr() -> mlx5_free_priv_descs() flow, the code incorrectly takes the wrong branch, attempting to call dma_unmap_single() on a DMA address that is not mapped. This results in a WARN [1], as shown below. The issue is resolved by properly accounting for the DM type and ensuring the correct branch is selected in mlx5_free_priv_descs(). [1] WARNING: CPU: 12 PID: 1346 at drivers/iommu/dma-iommu.c:1230 iommu_dma_unmap_page+0x79/0x90 Modules linked in: ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry ovelay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core CPU: 12 UID: 0 PID: 1346 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1631 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 49 3b 29 72 26 49 3b 69 08 73 20 4d 89 f0 44 89 e9 4c 89 e2 48 89 ee 48 89 df 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 b8 88 ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 66 0f 1f 44 00 RSP: 0018:ffffc90001913a10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810194b0a8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffff88810194b0a8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f537abdd740(0000) GS:ffff88885fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f537aeb8000 CR3: 000000010c248001 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x84/0x190 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0xf8/0x1c0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 dma_unmap_page_attrs+0xe6/0x290 mlx5_free_priv_descs+0xb0/0xe0 [mlx5_ib] __mlx5_ib_dereg_mr+0x37e/0x520 [mlx5_ib] ? _raw_spin_unlock_irq+0x24/0x40 ? wait_for_completion+0xfe/0x130 ? rdma_restrack_put+0x63/0xe0 [ib_core] ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] __x64_sys_ioctl+0x1b0/0xa70 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f537adaf17b Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffff218f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff218f1d8 RCX: 00007f537adaf17b RDX: 00007ffff218f1c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffff218f1a0 R08: 00007f537aa8d010 R09: 0000561ee2e4f270 R10: 00007f537aace3a8 R11: 0000000000000246 R12: 00007ffff218f190 R13: 000000000000001c R14: 0000561ee2e4d7c0 R15: 00007ffff218f450 </TASK> Fixes: f18ec4223117 ("RDMA/mlx5: Use a union inside mlx5_ib_mr") Signed-off-by: Yishai Hadas <yishaih(a)nvidia.com> Link: https://patch.msgid.link/2039c22cfc3df02378747ba4d623a558b53fc263.173858707… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/mlx5/mr.c [Conflicts due to commits de8f847a5114 ("RDMA/mlx5: Add support for DMABUF MR registrations with Data-direct") not merged.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c index 90d468b00256..5881d8e69aa4 100644 --- a/drivers/infiniband/hw/mlx5/mr.c +++ b/drivers/infiniband/hw/mlx5/mr.c @@ -1818,7 +1818,7 @@ mlx5_alloc_priv_descs(struct ib_device *device, static void mlx5_free_priv_descs(struct mlx5_ib_mr *mr) { - if (!mr->umem && mr->descs) { + if (!mr->umem && mr->ibmr.type != IB_MR_TYPE_DM && mr->descs) { struct ib_device *device = mr->ibmr.device; int size = mr->max_descs * mr->desc_size; struct mlx5_ib_dev *dev = to_mdev(device); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
by Tirui Yin 08 Apr '25

08 Apr '25

From: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> mainline inclusion from mainline-v5.19-rc3 commit 928ea98252ad75118950941683893cf904541da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74W CVE: CVE-2022-49711 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15. Fixes: f93627146f0e ("staging: fsl-mc: fix asymmetry in destroy of mc_io") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Link: https://lore.kernel.org/r/20220601105159.87752-1-shinichiro.kawasaki@wdc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 5d8266c6571f..3512341c3038 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -878,14 +878,14 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) static int fsl_mc_bus_remove(struct platform_device *pdev) { struct fsl_mc *mc = platform_get_drvdata(pdev); + struct fsl_mc_io *mc_io; if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev)) return -EINVAL; + mc_io = mc->root_mc_bus_dev->mc_io; fsl_mc_device_remove(mc->root_mc_bus_dev); - - fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io); - mc->root_mc_bus_dev->mc_io = NULL; + fsl_destroy_mc_io(mc_io); return 0; } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
by Tirui Yin 08 Apr '25

08 Apr '25

From: Hui Wang <hui.wang(a)canonical.com> stable inclusion from stable-v4.19.272 commit 80ee99e52936b2c04cc37b17a14b2ae2f9d282ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWT CVE: CVE-2022-49746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1417f59ac0b02130ee56c0c50794b9b257be3d17 ] If the function sdma_load_context() fails, the sdma_desc will be freed, but the allocated desc->bd is forgot to be freed. We already met the sdma_load_context() failure case and the log as below: [ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready ... In this case, the desc->bd will not be freed without this change. Signed-off-by: Hui Wang <hui.wang(a)canonical.com> Reviewed-by: Sascha Hauer <s.hauer(a)pengutronix.de> Link: https://lore.kernel.org/r/20221130090800.102035-1-hui.wang@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/dma/imx-sdma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c index 3f5a01cb4ab4..b9e6d276df4c 100644 --- a/drivers/dma/imx-sdma.c +++ b/drivers/dma/imx-sdma.c @@ -1353,10 +1353,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac, sdma_config_ownership(sdmac, false, true, false); if (sdma_load_context(sdmac)) - goto err_desc_out; + goto err_bd_out; return desc; +err_bd_out: + sdma_free_bd(desc); err_desc_out: kfree(desc); err_out: -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1568/1568] kernel/uid16.o: warning: objtool: __x64_sys_getuid16.cold()+0x0: unreachable instruction
by kernel test robot 08 Apr '25

08 Apr '25

Hi Josh, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 56bc1719652e7a937bc9856f76f0c0fbf8ce1b23 [1568/1568] objtool: Support GCC 9 cold subfunction naming scheme config: x86_64-randconfig-103-20250408 (https://download.01.org/0day-ci/archive/20250408/202504081156.eLZp36Hb-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081156.eLZp36Hb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081156.eLZp36Hb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/uid16.o: warning: objtool: __x64_sys_getuid16.cold()+0x0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 08 Apr '25

08 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250408/202504081127.rMMmKSGb-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081127.rMMmKSGb-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 08 Apr '25

08 Apr '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250408/202504081025.oeT4D3sO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081025.oeT4D3sO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081025.oeT4D3sO-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 08 Apr '25

08 Apr '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-003-20250207 (https://download.01.org/0day-ci/archive/20250408/202504081022.SWpK2BGS-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081022.SWpK2BGS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081022.SWpK2BGS-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 2 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 08 Apr '25

08 Apr '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250408/202504080927.7eGn2cDH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504080927.7eGn2cDH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504080927.7eGn2cDH-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 07 Apr '25

07 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.235 commit 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] vhost/vdpa: Provide new ioctls to user
by frenkjason 07 Apr '25

07 Apr '25

From: frankyj915 <yangjieyj.yang(a)huawei.com> Enable users to bind, unbind, attach, detach vDPA devices with iommufd. So multiple vDPA devices can share the same iommu/smmu table. frankyj915 (2): vhost/vdpa: Add support to bind, unbind, attach and detach iommufd vhost/vdpa: Add error handling when binding or attaching fails drivers/vhost/vdpa.c | 130 +++++++++++++++++++++++++++++++ include/uapi/linux/vhost.h | 28 +++++++ include/uapi/linux/vhost_types.h | 5 ++ tools/include/uapi/linux/vhost.h | 28 +++++++ 4 files changed, 191 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 07 Apr '25

07 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.234 commit 14984139f1f2768883332965db566ef26db609e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/cpu.c [commit 1426c91277cc ("cpu/hotplug: Fix kabi breakage in enum cpuhp_state") removed CPUHP_AP_HRTIMERS_DYING to fix kabi changes] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/cpu.c | 9 ++++++++- kernel/time/hrtimer.c | 11 ++++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 9c4f4f15a056..04bdeba7b072 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -545,6 +545,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_cpu_dying(unsigned int cpu); #else diff --git a/kernel/cpu.c b/kernel/cpu.c index 137baebdeced..83e1bc2fafb1 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1713,9 +1713,16 @@ static struct cpuhp_step cpuhp_hp_states[] = { * Please ensure that there are no other steps with teardown handler * between smpcfd:dying and cpu:teardown. */ + /* + * In the past, the implementation of CPUHP_AP_HRTIMERS_DYING is deleted because + * the Kabi is fixed. The teardown operation and teardown of CPUHP_AP_SMPCFD_DYING + * are combined into smpcfd_and_hrtimer_dying_cpu. The startup operation of + * CPUHP_AP_SMPCFD_DYING is empty. Therefore, the startup operation of + * hrtimers_cpu_starting is set to the startup operation of CPUHP_AP_SMPCFD_DYING. + */ [CPUHP_AP_SMPCFD_DYING] = { .name = "smpcfd:dying", - .startup.single = NULL, + .startup.single = hrtimers_cpu_starting, .teardown.single = smpcfd_and_hrtimer_dying_cpu, }, diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 31d481da509e..0831821d04c4 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -2136,6 +2136,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + hrtimer_cpu_base_init_expiry_lock(cpu_base); + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -2144,7 +2153,6 @@ int hrtimers_prepare_cpu(unsigned int cpu) cpu_base->expires_next = KTIME_MAX; cpu_base->softirq_expires_next = KTIME_MAX; cpu_base->online = 1; - hrtimer_cpu_base_init_expiry_lock(cpu_base); return 0; } @@ -2222,6 +2230,7 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1