forked from torvalds/linux
-
Notifications
You must be signed in to change notification settings - Fork 31
net: npcm7xx: EMAC driver should not directly use seq_read. #8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
kunyi731
wants to merge
37
commits into
Nuvoton-Israel:Poleg-4.13.16-OpenBMC-Upstream
Choose a base branch
from
kunyi731:Poleg-4.13.16-OpenBMC-Upstream
base: Poleg-4.13.16-OpenBMC-Upstream
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
net: npcm7xx: EMAC driver should not directly use seq_read. #8
kunyi731
wants to merge
37
commits into
Nuvoton-Israel:Poleg-4.13.16-OpenBMC-Upstream
from
kunyi731:Poleg-4.13.16-OpenBMC-Upstream
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
add configuration definition for evaluation board based NPCM7xx (Poleg) BMC Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add full device tree for all Nuvoton NPCM750 BMCs and a board specific device tree for the NPCM750 (Poleg) evaluation board. Based on [v8,2/3] arm: dts: add Nuvoton NPCM750 device tree patch: Brendan Higgins : - https://patchwork.kernel.org/patch/10063497/ Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add maintainers and reviewers for Nuvoton NPCM architecture Based on [v8,3/3] MAINTAINERS: Add entry for Nuvoton NPCM architecture patch: Brendan Higgins : - https://patchwork.kernel.org/patch/10063413/ Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx timer. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx timer driver. the clocksource Enable 24-bit TIMER0 and TIMER1 counters, while TIMER0 serves as clockevent and TIMER1 serves as clocksource. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx watchdog.
Add Nuvoton BMC NPCM7xx watchdog driver. Nuvoton NPCM7xx have three watchdog timer modules, each watchdog timer is a free-running timer with programmable timeout intervals. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM UART. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM UART driver. The NPCM7xx BMC contains four UART blocks and accessory logic. NPCM UART based on 8250 driver. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com> Remove NPCM UART based on 8250 driver. and add to 8250 driver support to NPCM7xx serial Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx ADC. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx Analog-to-digital converter (ADC) driver The NPCM7xx ADC is a 10-bit converter for eight channel inputs, the ADC module includes an eight-to-one multiplexer. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx Serial Peripheral Interface (SPI) NOR Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx serial Peripheral interface (SPI) Flash interface unit (FIU) driver Nuvoton NPCM7xx have two SPI nor modules, first module support 2 chip select second module support 4 chip select Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx Pulse Width Modulation (PWM) and Fan Tachometer devices. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx Pulse Width Modulation (PWM) Fan tachometer (Fan) drivers Nuvoton NPCM7xx support upto 16 Fan tachometer inputs and upto 8 PWM outputs. Each PWM output module have watchdog. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx pin controller Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx pin controller driver. The NPCM7XX Pin Controller multi-function routed through the multiplexing block, Each pin supports GPIO functionality (GPIOx) and multiple functions that directly connect the pin to different hardware blocks. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx random number generator. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx random number generator driver. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx Ethernet MAC Controller (EMC). Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx Ethernet MAC controller (EMC) driver. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx I2C bus. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx I2C bus driver. Signed-off-by: Avi Fishman <AviFishman70@gmail.com> Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
add NPCM7XX clock include file to building DTS Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Added device tree binding documentation for Nuvoton NPCM7xx clock. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
add NPCM7XX clock include file for DTS use. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Add Nuvoton BMC NPCM7xx clock bus driver. Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Bypass for lpi eee hang issue in the STMicroelectronics 10/100/1000 Ethernet driver Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
The KCS (Keyboard Controller Style) interface is used to perform in-band IPMI communication between a server host and its BMC (BaseBoard Management Controllers). This driver exposes the KCS interface on ASpeed SOCs (AST2400 and AST2500) as a character device. Such SOCs are commonly used as BMCs and this driver implements the BMC side of the KCS interface. Signed-off-by: Haiyue Wang <haiyue.wang@linux.intel.com>
Original kcs_bmc_npcm7xx.c was missing enabling to send interrupt to the host on writes to output buffer. This patch fixes it by setting the bits that enables the generation of IRQn events by hardware control based on the status of the OBF flag. Signed-off-by: Avi Fishman <AviFishman70@gmail.com>
enable NPCM7XX_TIMER by defualt when the NPCM7XX architecture is selected Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Adding multiplexer support for handling control SPSWC register Signed-off-by: Tomer Maimon <tmaimon77@gmail.com>
Procfs read should be npcm7xx_proc_read function so that the read operation correctly allocates dump memory. Change-Id: I2bd72fbc5c1668c062c6eb5b95057c7f050b6009 Signed-off-by: Kun Yi <kunyi@google.com>
Hi Kun,
Did you try to do "cat /proc/driver/npcm7xx_emc.0" after th echange and is
it working well?
Avi
…On Mon, Jun 18, 2018 at 8:32 AM Kun Yi ***@***.***> wrote:
Procfs read should be npcm7xx_proc_read function so that the read
operation correctly allocates dump memory.
Change-Id: I2bd72fbc5c1668c062c6eb5b95057c7f050b6009
Signed-off-by: Kun Yi ***@***.***
------------------------------
You can view, comment on, or merge this pull request online at:
#8
Commit Summary
- net: npcm7xx: EMAC driver should not directly use seq_read.
File Changes
- *M* drivers/net/ethernet/nuvoton/npcm7xx_emc.c
<https://github.com/Nuvoton-Israel/linux/pull/8/files#diff-0> (4)
Patch Links:
- https://github.com/Nuvoton-Israel/linux/pull/8.patch
- https://github.com/Nuvoton-Israel/linux/pull/8.diff
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#8>, or mute the thread
<https://github.com/notifications/unsubscribe-auth/AbbZSra6QF3eaQoQq5UUF_YC10d8DTu7ks5t9ztQgaJpZM4UrLMn>
.
|
Yes I did. Example output:
root@arcadia:~# cat /proc/driver/npcm7xx_emc.0
NPCM7XX EMC eth0 driver version: 3.90
REG_CAMCMR = 00000016
REG_CAMEN = 00000001
REG_CAMM_BASE = A6DCABA6
REG_CAML_BASE = 44480000
REG_TXDLSA = 3B47B000
REG_RXDLSA = 36B99000
REG_MCMDR = 0008032B
REG_MIID = 00000000
REG_MIIDA = 00900000
REG_FFTCR = 00200203
REG_TSDR = FFFFFFFF
REG_RSDR = FFFFFFFF
REG_DMARFC = 000005F2
REG_MIEN = 017F0DF7
REG_MISTA = 00800000
REG_MGSTA = 00000000
REG_MPCNT = 00007FFF
REG_MRPC = 00000000
REG_MRPCC = 00000000
REG_MREPC = 00000000
REG_DMARFS = 00000000
REG_CTXDSA = 3B47B2C0
REG_CTXBSA = 3AEA6800
REG_CRXDSA = 36B99000
REG_CRXBSA = 3B6A7940
REG_RXFSM = 04012102
REG_TXFSM = 80012101
REG_FSM0 = 00010101
REG_FSM1 = 01000000
REG_DCR = 0000003F
REG_DMMIR = 00000000
REG_BISTR = 00000000
netif_queue Running
napi is not scheduled
TXD offset 44
cur_tx 44
finish_tx 43
pending_tx 1
tx_tdu 0
tx_tdu_i 0
tx_cp_i 0
tx_int_count 0
count_xmit tx 77
count_finish 75
RXD offset 0
cur_rx 0
rx_err 0
rx_berr 0
rx_stuck 0
rdu 0
rxov rx 0
rx_int_count 0
rx_err_count 0
rx_count_pool 0
max_waiting_rx 0
need_reset 0
finish 42 txbd mode 00000003 buffer 3AE49C02 sl 00290227 next 3B47B2B0
tx_skb (null)
finish 43 txbd mode 00000003 buffer 3AEA6802 sl 00290200 next 3B47B2C0
tx_skb eb40f780
finish 44 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2D0
tx_skb (null)
txd_of 43 txbd mode 00000003 buffer 3AEA6802 sl 00290200 next 3B47B2C0
txd_of 44 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2D0
txd_of 45 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2E0
cur_tx 46 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2F0
cur_tx 47 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B300
cur_tx 48 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B310
cur_tx 49 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B320
cur_tx 50 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B330
cur_tx 51 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B340
cur_tx 52 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B350
cur_tx 53 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B360
cur_tx 54 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B370
cur_tx 55 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B380
cur_tx 56 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B390
cur_tx 57 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3A0
cur_tx 58 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3B0
cur_tx 59 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3C0
cur_tx 60 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3D0
cur_tx 61 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3E0
cur_tx 62 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3F0
cur_tx 63 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B000
cur_tx 0 txbd mode 00000003 buffer 3AEA9002 sl 0029005A next 3B47B010
cur_tx 1 txbd mode 00000003 buffer 3AEC0802 sl 0029005A next 3B47B020
cur_tx 2 txbd mode 00000003 buffer 3AE24402 sl 0029002A next 3B47B030
cur_tx 3 txbd mode 00000003 buffer 3B421802 sl 00290056 next 3B47B040
cur_tx 4 txbd mode 00000003 buffer 3AEA9002 sl 0029005A next 3B47B050
cur_tx 5 txbd mode 00000003 buffer 3AEC0802 sl 0029005A next 3B47B060
cur_tx 6 txbd mode 00000003 buffer 3AE59C0A sl 00290208 next 3B47B070
cur_tx 7 txbd mode 00000003 buffer 3AE4A00A sl 00290162 next 3B47B080
cur_tx 8 txbd mode 00000003 buffer 3AE59C0A sl 00290208 next 3B47B090
cur_tx 9 txbd mode 00000003 buffer 3B55A802 sl 0029006E next 3B47B0A0
cur_tx 10 txbd mode 00000003 buffer 3AE4A00A sl 00290208 next 3B47B0B0
cur_tx 11 txbd mode 00000003 buffer 3B55A802 sl 0029005A next 3B47B0C0
cur_tx 12 txbd mode 00000003 buffer 3AE4A00A sl 002901DE next 3B47B0D0
cur_tx 13 txbd mode 00000003 buffer 3AE24302 sl 0029002A next 3B47B0E0
cur_tx 14 txbd mode 00000003 buffer 3AE4A00A sl 0029022B next 3B47B0F0
cur_tx 15 txbd mode 00000003 buffer 3C10140A sl 002901DE next 3B47B100
cur_tx 16 txbd mode 00000003 buffer 3AE24302 sl 0029002A next 3B47B110
cur_tx 17 txbd mode 00000003 buffer 3C10140A sl 0029022B next 3B47B120
cur_tx 18 txbd mode 00000003 buffer 3AE4A00A sl 002901DE next 3B47B130
cur_tx 19 txbd mode 00000003 buffer 3AE24D02 sl 0029002A next 3B47B140
cur_tx 20 txbd mode 00000003 buffer 3B4EA802 sl 00290230 next 3B47B150
cur_tx 21 txbd mode 00000003 buffer 3B477002 sl 0029014E next 3B47B160
cur_tx 22 txbd mode 00000003 buffer 3B4EA802 sl 00290230 next 3B47B170
cur_tx 23 txbd mode 00000003 buffer 3B477002 sl 00290230 next 3B47B180
cur_tx 24 txbd mode 00000003 buffer 3B4EA802 sl 00290200 next 3B47B190
cur_tx 25 txbd mode 00000003 buffer 3B477002 sl 00290227 next 3B47B1A0
cur_tx 26 txbd mode 00000003 buffer 3B4EA802 sl 00290200 next 3B47B1B0
cur_tx 27 txbd mode 00000003 buffer 3AE24D02 sl 0029002A next 3B47B1C0
cur_tx 28 txbd mode 00000003 buffer 3B4EA802 sl 00290227 next 3B47B1D0
cur_tx 29 txbd mode 00000003 buffer 3B477002 sl 00290200 next 3B47B1E0
cur_tx 30 txbd mode 00000003 buffer 3AF81E02 sl 0029002A next 3B47B1F0
cur_tx 31 txbd mode 00000003 buffer 3ADD1702 sl 0029002A next 3B47B200
cur_tx 32 txbd mode 00000003 buffer 3AF81E02 sl 0029002A next 3B47B210
cur_tx 33 txbd mode 00000003 buffer 3ADD1702 sl 0029002A next 3B47B220
cur_tx 34 txbd mode 00000003 buffer 3AEF2802 sl 00290230 next 3B47B230
cur_tx 35 txbd mode 00000003 buffer 3AEA6802 sl 0029014E next 3B47B240
cur_tx 36 txbd mode 00000003 buffer 3AEF2802 sl 00290230 next 3B47B250
cur_tx 37 txbd mode 00000003 buffer 3AEA6802 sl 00290230 next 3B47B260
cur_tx 38 txbd mode 00000003 buffer 3AEF2802 sl 00290200 next 3B47B270
cur_tx 39 txbd mode 00000003 buffer 3AEA6802 sl 0029014E next 3B47B280
cur_tx 40 txbd mode 00000003 buffer 3AEF2802 sl 00290200 next 3B47B290
cur_tx 41 txbd mode 00000003 buffer 3B4BB002 sl 0029002A next 3B47B2A0
cur_tx 42 txbd mode 00000003 buffer 3AE49C02 sl 00290227 next 3B47B2B0
cur_tx 43 txbd mode 00000003 buffer 3AEA6802 sl 00290200 next 3B47B2C0
cur_tx 44 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2D0
cur_tx 45 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2E0
cur_rx 66 rxbd sl 80000000 buffer 3B672540 sl 00000000 next 36B99430
cur_rx 67 rxbd sl 80000000 buffer 3B671E40 sl 00000000 next 36B99440
cur_rx 68 rxbd sl 80000000 buffer 3B671740 sl 00000000 next 36B99450
cur_rx 69 rxbd sl 80000000 buffer 3B671040 sl 00000000 next 36B99460
cur_rx 70 rxbd sl 80000000 buffer 3B670940 sl 00000000 next 36B99470
cur_rx 71 rxbd sl 80000000 buffer 3B670240 sl 00000000 next 36B99480
cur_rx 72 rxbd sl 80000000 buffer 3B67F940 sl 00000000 next 36B99490
cur_rx 73 rxbd sl 80000000 buffer 3B67F240 sl 00000000 next 36B994A0
cur_rx 74 rxbd sl 80000000 buffer 3B67EB40 sl 00000000 next 36B994B0
cur_rx 75 rxbd sl 80000000 buffer 3B67E440 sl 00000000 next 36B994C0
cur_rx 76 rxbd sl 80000000 buffer 3B67DD40 sl 00000000 next 36B994D0
cur_rx 77 rxbd sl 80000000 buffer 3B67D640 sl 00000000 next 36B994E0
cur_rx 78 rxbd sl 80000000 buffer 3B67CF40 sl 00000000 next 36B994F0
cur_rx 79 rxbd sl 80000000 buffer 3B67C840 sl 00000000 next 36B99500
cur_rx 80 rxbd sl 80000000 buffer 3B67C140 sl 00000000 next 36B99510
cur_rx 81 rxbd sl 80000000 buffer 3B67BA40 sl 00000000 next 36B99520
cur_rx 82 rxbd sl 80000000 buffer 3B67B340 sl 00000000 next 36B99530
cur_rx 83 rxbd sl 80000000 buffer 3B67AC40 sl 00000000 next 36B99540
cur_rx 84 rxbd sl 80000000 buffer 3B67A540 sl 00000000 next 36B99550
cur_rx 85 rxbd sl 80000000 buffer 3B679E40 sl 00000000 next 36B99560
cur_rx 86 rxbd sl 80000000 buffer 3B679740 sl 00000000 next 36B99570
cur_rx 87 rxbd sl 80000000 buffer 3B679040 sl 00000000 next 36B99580
cur_rx 88 rxbd sl 80000000 buffer 3B678940 sl 00000000 next 36B99590
cur_rx 89 rxbd sl 80000000 buffer 3B678240 sl 00000000 next 36B995A0
cur_rx 90 rxbd sl 80000000 buffer 3B757940 sl 00000000 next 36B995B0
cur_rx 91 rxbd sl 80000000 buffer 3B757240 sl 00000000 next 36B995C0
cur_rx 92 rxbd sl 80000000 buffer 3B756B40 sl 00000000 next 36B995D0
cur_rx 93 rxbd sl 80000000 buffer 3B756440 sl 00000000 next 36B995E0
cur_rx 94 rxbd sl 80000000 buffer 3B755D40 sl 00000000 next 36B995F0
cur_rx 95 rxbd sl 80000000 buffer 3B755640 sl 00000000 next 36B99600
cur_rx 96 rxbd sl 80000000 buffer 3B754F40 sl 00000000 next 36B99610
cur_rx 97 rxbd sl 80000000 buffer 3B754840 sl 00000000 next 36B99620
cur_rx 98 rxbd sl 80000000 buffer 3B754140 sl 00000000 next 36B99630
cur_rx 99 rxbd sl 80000000 buffer 3B753A40 sl 00000000 next 36B99640
cur_rx 100 rxbd sl 80000000 buffer 3B753340 sl 00000000 next 36B99650
cur_rx 101 rxbd sl 80000000 buffer 3B752C40 sl 00000000 next 36B99660
cur_rx 102 rxbd sl 80000000 buffer 3B752540 sl 00000000 next 36B99670
cur_rx 103 rxbd sl 80000000 buffer 3B751E40 sl 00000000 next 36B99680
cur_rx 104 rxbd sl 80000000 buffer 3B751740 sl 00000000 next 36B99690
cur_rx 105 rxbd sl 80000000 buffer 3B751040 sl 00000000 next 36B996A0
cur_rx 106 rxbd sl 80000000 buffer 3B750940 sl 00000000 next 36B996B0
cur_rx 107 rxbd sl 80000000 buffer 3B750240 sl 00000000 next 36B996C0
cur_rx 108 rxbd sl 80000000 buffer 3B75F940 sl 00000000 next 36B996D0
cur_rx 109 rxbd sl 80000000 buffer 3B75F240 sl 00000000 next 36B996E0
cur_rx 110 rxbd sl 80000000 buffer 3B75EB40 sl 00000000 next 36B996F0
cur_rx 111 rxbd sl 80000000 buffer 3B75E440 sl 00000000 next 36B99700
cur_rx 112 rxbd sl 80000000 buffer 3B75DD40 sl 00000000 next 36B99710
cur_rx 113 rxbd sl 80000000 buffer 3B75D640 sl 00000000 next 36B99720
cur_rx 114 rxbd sl 80000000 buffer 3B75CF40 sl 00000000 next 36B99730
cur_rx 115 rxbd sl 80000000 buffer 3B75C840 sl 00000000 next 36B99740
cur_rx 116 rxbd sl 80000000 buffer 3B75C140 sl 00000000 next 36B99750
cur_rx 117 rxbd sl 80000000 buffer 3B75BA40 sl 00000000 next 36B99760
cur_rx 118 rxbd sl 80000000 buffer 3B75B340 sl 00000000 next 36B99770
cur_rx 119 rxbd sl 80000000 buffer 3B75AC40 sl 00000000 next 36B99780
cur_rx 120 rxbd sl 80000000 buffer 3B75A540 sl 00000000 next 36B99790
cur_rx 121 rxbd sl 80000000 buffer 3B759E40 sl 00000000 next 36B997A0
cur_rx 122 rxbd sl 80000000 buffer 3B759740 sl 00000000 next 36B997B0
cur_rx 123 rxbd sl 80000000 buffer 3B759040 sl 00000000 next 36B997C0
cur_rx 124 rxbd sl 80000000 buffer 3B758940 sl 00000000 next 36B997D0
cur_rx 125 rxbd sl 80000000 buffer 3B758240 sl 00000000 next 36B997E0
cur_rx 126 rxbd sl 80000000 buffer 3B687940 sl 00000000 next 36B997F0
cur_rx 127 rxbd sl 80000000 buffer 3B687240 sl 00000000 next 36B99000
cur_rx 0 rxbd sl 80000000 buffer 3B6A7940 sl 00000000 next 36B99010
cur_rx 1 rxbd sl 80000000 buffer 3B6A7240 sl 00000000 next 36B99020
rxd_of 127 rxbd sl 80000000 buffer 3B687240 sl 00000000 next 36B99000
rxd_of 0 rxbd sl 80000000 buffer 3B6A7940 sl 00000000 next 36B99010
rxd_of 1 rxbd sl 80000000 buffer 3B6A7240 sl 00000000 next 36B99020
root@arcadia:~#
Still working on verifying NC-SI with the EMAC driver on our board, but
what I found is that using seq_read will crash the kernel. So this is a
patch just to get unblocked.
Thanks,
Kun
On Mon, Jun 18, 2018 at 4:10 AM Avi Fishman <notifications@github.com>
wrote:
… Hi Kun,
Did you try to do "cat /proc/driver/npcm7xx_emc.0" after th echange and is
it working well?
Avi
On Mon, Jun 18, 2018 at 8:32 AM Kun Yi ***@***.***> wrote:
> Procfs read should be npcm7xx_proc_read function so that the read
> operation correctly allocates dump memory.
>
> Change-Id: I2bd72fbc5c1668c062c6eb5b95057c7f050b6009
> Signed-off-by: Kun Yi ***@***.***
> ------------------------------
> You can view, comment on, or merge this pull request online at:
>
> #8
> Commit Summary
>
> - net: npcm7xx: EMAC driver should not directly use seq_read.
>
> File Changes
>
> - *M* drivers/net/ethernet/nuvoton/npcm7xx_emc.c
> <https://github.com/Nuvoton-Israel/linux/pull/8/files#diff-0> (4)
>
> Patch Links:
>
> - https://github.com/Nuvoton-Israel/linux/pull/8.patch
> - https://github.com/Nuvoton-Israel/linux/pull/8.diff
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub
> <#8>, or mute the thread
> <
https://github.com/notifications/unsubscribe-auth/AbbZSra6QF3eaQoQq5UUF_YC10d8DTu7ks5t9ztQgaJpZM4UrLMn
>
> .
>
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#8 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AB9Sx6dIJPSubZuHBusLnXy7fZrPlZc5ks5t94qKgaJpZM4UrLMn>
.
--
Regards,
Kun
|
I tried your change and it crashes since in npcm7xx_proc_read():
struct net_device *dev = (struct net_device *)sf->private;
'dev' gets NULL.
Have you done other changes?
…On Mon, Jun 18, 2018 at 5:32 PM Kun Yi ***@***.***> wrote:
Yes I did. Example output:
***@***.***:~# cat /proc/driver/npcm7xx_emc.0
NPCM7XX EMC eth0 driver version: 3.90
REG_CAMCMR = 00000016
REG_CAMEN = 00000001
REG_CAMM_BASE = A6DCABA6
REG_CAML_BASE = 44480000
REG_TXDLSA = 3B47B000
REG_RXDLSA = 36B99000
REG_MCMDR = 0008032B
REG_MIID = 00000000
REG_MIIDA = 00900000
REG_FFTCR = 00200203
REG_TSDR = FFFFFFFF
REG_RSDR = FFFFFFFF
REG_DMARFC = 000005F2
REG_MIEN = 017F0DF7
REG_MISTA = 00800000
REG_MGSTA = 00000000
REG_MPCNT = 00007FFF
REG_MRPC = 00000000
REG_MRPCC = 00000000
REG_MREPC = 00000000
REG_DMARFS = 00000000
REG_CTXDSA = 3B47B2C0
REG_CTXBSA = 3AEA6800
REG_CRXDSA = 36B99000
REG_CRXBSA = 3B6A7940
REG_RXFSM = 04012102
REG_TXFSM = 80012101
REG_FSM0 = 00010101
REG_FSM1 = 01000000
REG_DCR = 0000003F
REG_DMMIR = 00000000
REG_BISTR = 00000000
netif_queue Running
napi is not scheduled
TXD offset 44
cur_tx 44
finish_tx 43
pending_tx 1
tx_tdu 0
tx_tdu_i 0
tx_cp_i 0
tx_int_count 0
count_xmit tx 77
count_finish 75
RXD offset 0
cur_rx 0
rx_err 0
rx_berr 0
rx_stuck 0
rdu 0
rxov rx 0
rx_int_count 0
rx_err_count 0
rx_count_pool 0
max_waiting_rx 0
need_reset 0
finish 42 txbd mode 00000003 buffer 3AE49C02 sl 00290227 next 3B47B2B0
tx_skb (null)
finish 43 txbd mode 00000003 buffer 3AEA6802 sl 00290200 next 3B47B2C0
tx_skb eb40f780
finish 44 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2D0
tx_skb (null)
txd_of 43 txbd mode 00000003 buffer 3AEA6802 sl 00290200 next 3B47B2C0
txd_of 44 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2D0
txd_of 45 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2E0
cur_tx 46 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2F0
cur_tx 47 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B300
cur_tx 48 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B310
cur_tx 49 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B320
cur_tx 50 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B330
cur_tx 51 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B340
cur_tx 52 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B350
cur_tx 53 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B360
cur_tx 54 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B370
cur_tx 55 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B380
cur_tx 56 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B390
cur_tx 57 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3A0
cur_tx 58 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3B0
cur_tx 59 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3C0
cur_tx 60 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3D0
cur_tx 61 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3E0
cur_tx 62 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B3F0
cur_tx 63 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B000
cur_tx 0 txbd mode 00000003 buffer 3AEA9002 sl 0029005A next 3B47B010
cur_tx 1 txbd mode 00000003 buffer 3AEC0802 sl 0029005A next 3B47B020
cur_tx 2 txbd mode 00000003 buffer 3AE24402 sl 0029002A next 3B47B030
cur_tx 3 txbd mode 00000003 buffer 3B421802 sl 00290056 next 3B47B040
cur_tx 4 txbd mode 00000003 buffer 3AEA9002 sl 0029005A next 3B47B050
cur_tx 5 txbd mode 00000003 buffer 3AEC0802 sl 0029005A next 3B47B060
cur_tx 6 txbd mode 00000003 buffer 3AE59C0A sl 00290208 next 3B47B070
cur_tx 7 txbd mode 00000003 buffer 3AE4A00A sl 00290162 next 3B47B080
cur_tx 8 txbd mode 00000003 buffer 3AE59C0A sl 00290208 next 3B47B090
cur_tx 9 txbd mode 00000003 buffer 3B55A802 sl 0029006E next 3B47B0A0
cur_tx 10 txbd mode 00000003 buffer 3AE4A00A sl 00290208 next 3B47B0B0
cur_tx 11 txbd mode 00000003 buffer 3B55A802 sl 0029005A next 3B47B0C0
cur_tx 12 txbd mode 00000003 buffer 3AE4A00A sl 002901DE next 3B47B0D0
cur_tx 13 txbd mode 00000003 buffer 3AE24302 sl 0029002A next 3B47B0E0
cur_tx 14 txbd mode 00000003 buffer 3AE4A00A sl 0029022B next 3B47B0F0
cur_tx 15 txbd mode 00000003 buffer 3C10140A sl 002901DE next 3B47B100
cur_tx 16 txbd mode 00000003 buffer 3AE24302 sl 0029002A next 3B47B110
cur_tx 17 txbd mode 00000003 buffer 3C10140A sl 0029022B next 3B47B120
cur_tx 18 txbd mode 00000003 buffer 3AE4A00A sl 002901DE next 3B47B130
cur_tx 19 txbd mode 00000003 buffer 3AE24D02 sl 0029002A next 3B47B140
cur_tx 20 txbd mode 00000003 buffer 3B4EA802 sl 00290230 next 3B47B150
cur_tx 21 txbd mode 00000003 buffer 3B477002 sl 0029014E next 3B47B160
cur_tx 22 txbd mode 00000003 buffer 3B4EA802 sl 00290230 next 3B47B170
cur_tx 23 txbd mode 00000003 buffer 3B477002 sl 00290230 next 3B47B180
cur_tx 24 txbd mode 00000003 buffer 3B4EA802 sl 00290200 next 3B47B190
cur_tx 25 txbd mode 00000003 buffer 3B477002 sl 00290227 next 3B47B1A0
cur_tx 26 txbd mode 00000003 buffer 3B4EA802 sl 00290200 next 3B47B1B0
cur_tx 27 txbd mode 00000003 buffer 3AE24D02 sl 0029002A next 3B47B1C0
cur_tx 28 txbd mode 00000003 buffer 3B4EA802 sl 00290227 next 3B47B1D0
cur_tx 29 txbd mode 00000003 buffer 3B477002 sl 00290200 next 3B47B1E0
cur_tx 30 txbd mode 00000003 buffer 3AF81E02 sl 0029002A next 3B47B1F0
cur_tx 31 txbd mode 00000003 buffer 3ADD1702 sl 0029002A next 3B47B200
cur_tx 32 txbd mode 00000003 buffer 3AF81E02 sl 0029002A next 3B47B210
cur_tx 33 txbd mode 00000003 buffer 3ADD1702 sl 0029002A next 3B47B220
cur_tx 34 txbd mode 00000003 buffer 3AEF2802 sl 00290230 next 3B47B230
cur_tx 35 txbd mode 00000003 buffer 3AEA6802 sl 0029014E next 3B47B240
cur_tx 36 txbd mode 00000003 buffer 3AEF2802 sl 00290230 next 3B47B250
cur_tx 37 txbd mode 00000003 buffer 3AEA6802 sl 00290230 next 3B47B260
cur_tx 38 txbd mode 00000003 buffer 3AEF2802 sl 00290200 next 3B47B270
cur_tx 39 txbd mode 00000003 buffer 3AEA6802 sl 0029014E next 3B47B280
cur_tx 40 txbd mode 00000003 buffer 3AEF2802 sl 00290200 next 3B47B290
cur_tx 41 txbd mode 00000003 buffer 3B4BB002 sl 0029002A next 3B47B2A0
cur_tx 42 txbd mode 00000003 buffer 3AE49C02 sl 00290227 next 3B47B2B0
cur_tx 43 txbd mode 00000003 buffer 3AEA6802 sl 00290200 next 3B47B2C0
cur_tx 44 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2D0
cur_tx 45 txbd mode 00000000 buffer 00000000 sl 00000000 next 3B47B2E0
cur_rx 66 rxbd sl 80000000 buffer 3B672540 sl 00000000 next 36B99430
cur_rx 67 rxbd sl 80000000 buffer 3B671E40 sl 00000000 next 36B99440
cur_rx 68 rxbd sl 80000000 buffer 3B671740 sl 00000000 next 36B99450
cur_rx 69 rxbd sl 80000000 buffer 3B671040 sl 00000000 next 36B99460
cur_rx 70 rxbd sl 80000000 buffer 3B670940 sl 00000000 next 36B99470
cur_rx 71 rxbd sl 80000000 buffer 3B670240 sl 00000000 next 36B99480
cur_rx 72 rxbd sl 80000000 buffer 3B67F940 sl 00000000 next 36B99490
cur_rx 73 rxbd sl 80000000 buffer 3B67F240 sl 00000000 next 36B994A0
cur_rx 74 rxbd sl 80000000 buffer 3B67EB40 sl 00000000 next 36B994B0
cur_rx 75 rxbd sl 80000000 buffer 3B67E440 sl 00000000 next 36B994C0
cur_rx 76 rxbd sl 80000000 buffer 3B67DD40 sl 00000000 next 36B994D0
cur_rx 77 rxbd sl 80000000 buffer 3B67D640 sl 00000000 next 36B994E0
cur_rx 78 rxbd sl 80000000 buffer 3B67CF40 sl 00000000 next 36B994F0
cur_rx 79 rxbd sl 80000000 buffer 3B67C840 sl 00000000 next 36B99500
cur_rx 80 rxbd sl 80000000 buffer 3B67C140 sl 00000000 next 36B99510
cur_rx 81 rxbd sl 80000000 buffer 3B67BA40 sl 00000000 next 36B99520
cur_rx 82 rxbd sl 80000000 buffer 3B67B340 sl 00000000 next 36B99530
cur_rx 83 rxbd sl 80000000 buffer 3B67AC40 sl 00000000 next 36B99540
cur_rx 84 rxbd sl 80000000 buffer 3B67A540 sl 00000000 next 36B99550
cur_rx 85 rxbd sl 80000000 buffer 3B679E40 sl 00000000 next 36B99560
cur_rx 86 rxbd sl 80000000 buffer 3B679740 sl 00000000 next 36B99570
cur_rx 87 rxbd sl 80000000 buffer 3B679040 sl 00000000 next 36B99580
cur_rx 88 rxbd sl 80000000 buffer 3B678940 sl 00000000 next 36B99590
cur_rx 89 rxbd sl 80000000 buffer 3B678240 sl 00000000 next 36B995A0
cur_rx 90 rxbd sl 80000000 buffer 3B757940 sl 00000000 next 36B995B0
cur_rx 91 rxbd sl 80000000 buffer 3B757240 sl 00000000 next 36B995C0
cur_rx 92 rxbd sl 80000000 buffer 3B756B40 sl 00000000 next 36B995D0
cur_rx 93 rxbd sl 80000000 buffer 3B756440 sl 00000000 next 36B995E0
cur_rx 94 rxbd sl 80000000 buffer 3B755D40 sl 00000000 next 36B995F0
cur_rx 95 rxbd sl 80000000 buffer 3B755640 sl 00000000 next 36B99600
cur_rx 96 rxbd sl 80000000 buffer 3B754F40 sl 00000000 next 36B99610
cur_rx 97 rxbd sl 80000000 buffer 3B754840 sl 00000000 next 36B99620
cur_rx 98 rxbd sl 80000000 buffer 3B754140 sl 00000000 next 36B99630
cur_rx 99 rxbd sl 80000000 buffer 3B753A40 sl 00000000 next 36B99640
cur_rx 100 rxbd sl 80000000 buffer 3B753340 sl 00000000 next 36B99650
cur_rx 101 rxbd sl 80000000 buffer 3B752C40 sl 00000000 next 36B99660
cur_rx 102 rxbd sl 80000000 buffer 3B752540 sl 00000000 next 36B99670
cur_rx 103 rxbd sl 80000000 buffer 3B751E40 sl 00000000 next 36B99680
cur_rx 104 rxbd sl 80000000 buffer 3B751740 sl 00000000 next 36B99690
cur_rx 105 rxbd sl 80000000 buffer 3B751040 sl 00000000 next 36B996A0
cur_rx 106 rxbd sl 80000000 buffer 3B750940 sl 00000000 next 36B996B0
cur_rx 107 rxbd sl 80000000 buffer 3B750240 sl 00000000 next 36B996C0
cur_rx 108 rxbd sl 80000000 buffer 3B75F940 sl 00000000 next 36B996D0
cur_rx 109 rxbd sl 80000000 buffer 3B75F240 sl 00000000 next 36B996E0
cur_rx 110 rxbd sl 80000000 buffer 3B75EB40 sl 00000000 next 36B996F0
cur_rx 111 rxbd sl 80000000 buffer 3B75E440 sl 00000000 next 36B99700
cur_rx 112 rxbd sl 80000000 buffer 3B75DD40 sl 00000000 next 36B99710
cur_rx 113 rxbd sl 80000000 buffer 3B75D640 sl 00000000 next 36B99720
cur_rx 114 rxbd sl 80000000 buffer 3B75CF40 sl 00000000 next 36B99730
cur_rx 115 rxbd sl 80000000 buffer 3B75C840 sl 00000000 next 36B99740
cur_rx 116 rxbd sl 80000000 buffer 3B75C140 sl 00000000 next 36B99750
cur_rx 117 rxbd sl 80000000 buffer 3B75BA40 sl 00000000 next 36B99760
cur_rx 118 rxbd sl 80000000 buffer 3B75B340 sl 00000000 next 36B99770
cur_rx 119 rxbd sl 80000000 buffer 3B75AC40 sl 00000000 next 36B99780
cur_rx 120 rxbd sl 80000000 buffer 3B75A540 sl 00000000 next 36B99790
cur_rx 121 rxbd sl 80000000 buffer 3B759E40 sl 00000000 next 36B997A0
cur_rx 122 rxbd sl 80000000 buffer 3B759740 sl 00000000 next 36B997B0
cur_rx 123 rxbd sl 80000000 buffer 3B759040 sl 00000000 next 36B997C0
cur_rx 124 rxbd sl 80000000 buffer 3B758940 sl 00000000 next 36B997D0
cur_rx 125 rxbd sl 80000000 buffer 3B758240 sl 00000000 next 36B997E0
cur_rx 126 rxbd sl 80000000 buffer 3B687940 sl 00000000 next 36B997F0
cur_rx 127 rxbd sl 80000000 buffer 3B687240 sl 00000000 next 36B99000
cur_rx 0 rxbd sl 80000000 buffer 3B6A7940 sl 00000000 next 36B99010
cur_rx 1 rxbd sl 80000000 buffer 3B6A7240 sl 00000000 next 36B99020
rxd_of 127 rxbd sl 80000000 buffer 3B687240 sl 00000000 next 36B99000
rxd_of 0 rxbd sl 80000000 buffer 3B6A7940 sl 00000000 next 36B99010
rxd_of 1 rxbd sl 80000000 buffer 3B6A7240 sl 00000000 next 36B99020
***@***.***:~#
Still working on verifying NC-SI with the EMAC driver on our board, but
what I found is that using seq_read will crash the kernel. So this is a
patch just to get unblocked.
Thanks,
Kun
On Mon, Jun 18, 2018 at 4:10 AM Avi Fishman ***@***.***>
wrote:
> Hi Kun,
>
> Did you try to do "cat /proc/driver/npcm7xx_emc.0" after th echange and
is
> it working well?
>
> Avi
>
> On Mon, Jun 18, 2018 at 8:32 AM Kun Yi ***@***.***> wrote:
>
> > Procfs read should be npcm7xx_proc_read function so that the read
> > operation correctly allocates dump memory.
> >
> > Change-Id: I2bd72fbc5c1668c062c6eb5b95057c7f050b6009
> > Signed-off-by: Kun Yi ***@***.***
> > ------------------------------
> > You can view, comment on, or merge this pull request online at:
> >
> > #8
> > Commit Summary
> >
> > - net: npcm7xx: EMAC driver should not directly use seq_read.
> >
> > File Changes
> >
> > - *M* drivers/net/ethernet/nuvoton/npcm7xx_emc.c
> > <https://github.com/Nuvoton-Israel/linux/pull/8/files#diff-0> (4)
> >
> > Patch Links:
> >
> > - https://github.com/Nuvoton-Israel/linux/pull/8.patch
> > - https://github.com/Nuvoton-Israel/linux/pull/8.diff
> >
> > —
> > You are receiving this because you are subscribed to this thread.
> > Reply to this email directly, view it on GitHub
> > <#8>, or mute the thread
> > <
>
https://github.com/notifications/unsubscribe-auth/AbbZSra6QF3eaQoQq5UUF_YC10d8DTu7ks5t9ztQgaJpZM4UrLMn
> >
> > .
> >
>
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub
> <#8 (comment)>,
> or mute the thread
> <
https://github.com/notifications/unsubscribe-auth/AB9Sx6dIJPSubZuHBusLnXy7fZrPlZc5ks5t94qKgaJpZM4UrLMn
>
> .
>
--
Regards,
Kun
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#8 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AbbZSk1M1kpYJgO5pqmaad-_kAsfnXV_ks5t97nlgaJpZM4UrLMn>
.
|
33be98a
to
96c2824
Compare
5ed6593
to
836c6f7
Compare
BenjaminFair
pushed a commit
to BenjaminFair/linux
that referenced
this pull request
Jul 9, 2018
commit 1105a2f upstream. In our armv8a server(QDF2400), I noticed lots of WARN_ON caused by PAGE_SIZE unaligned for rmap_item->address under memory pressure tests(start 20 guests and run memhog in the host). WARNING: CPU: 4 PID: 4641 at virt/kvm/arm/mmu.c:1826 kvm_age_hva_handler+0xc0/0xc8 CPU: 4 PID: 4641 Comm: memhog Tainted: G W 4.17.0-rc3+ Nuvoton-Israel#8 Call trace: kvm_age_hva_handler+0xc0/0xc8 handle_hva_to_gpa+0xa8/0xe0 kvm_age_hva+0x4c/0xe8 kvm_mmu_notifier_clear_flush_young+0x54/0x98 __mmu_notifier_clear_flush_young+0x6c/0xa0 page_referenced_one+0x154/0x1d8 rmap_walk_ksm+0x12c/0x1d0 rmap_walk+0x94/0xa0 page_referenced+0x194/0x1b0 shrink_page_list+0x674/0xc28 shrink_inactive_list+0x26c/0x5b8 shrink_node_memcg+0x35c/0x620 shrink_node+0x100/0x430 do_try_to_free_pages+0xe0/0x3a8 try_to_free_pages+0xe4/0x230 __alloc_pages_nodemask+0x564/0xdc0 alloc_pages_vma+0x90/0x228 do_anonymous_page+0xc8/0x4d0 __handle_mm_fault+0x4a0/0x508 handle_mm_fault+0xf8/0x1b0 do_page_fault+0x218/0x4b8 do_translation_fault+0x90/0xa0 do_mem_abort+0x68/0xf0 el0_da+0x24/0x28 In rmap_walk_ksm, the rmap_item->address might still have the STABLE_FLAG, then the start and end in handle_hva_to_gpa might not be PAGE_SIZE aligned. Thus it will cause exceptions in handle_hva_to_gpa on arm64. This patch fixes it by ignoring (not removing) the low bits of address when doing rmap_walk_ksm. IMO, it should be backported to stable tree. the storm of WARN_ONs is very easy for me to reproduce. More than that, I watched a panic (not reproducible) as follows: page:ffff7fe003742d80 count:-4871 mapcount:-2126053375 mapping: (null) index:0x0 flags: 0x1fffc00000000000() raw: 1fffc00000000000 0000000000000000 0000000000000000 ffffecf981470000 raw: dead000000000100 dead000000000200 ffff8017c001c000 0000000000000000 page dumped because: nonzero _refcount CPU: 29 PID: 18323 Comm: qemu-kvm Tainted: G W 4.14.15-5.hxt.aarch64 Nuvoton-Israel#1 Hardware name: <snip for confidential issues> Call trace: dump_backtrace+0x0/0x22c show_stack+0x24/0x2c dump_stack+0x8c/0xb0 bad_page+0xf4/0x154 free_pages_check_bad+0x90/0x9c free_pcppages_bulk+0x464/0x518 free_hot_cold_page+0x22c/0x300 __put_page+0x54/0x60 unmap_stage2_range+0x170/0x2b4 kvm_unmap_hva_handler+0x30/0x40 handle_hva_to_gpa+0xb0/0xec kvm_unmap_hva_range+0x5c/0xd0 I even injected a fault on purpose in kvm_unmap_hva_range by seting size=size-0x200, the call trace is similar as above. So I thought the panic is similarly caused by the root cause of WARN_ON. Andrea said: : It looks a straightforward safe fix, on x86 hva_to_gfn_memslot would : zap those bits and hide the misalignment caused by the low metadata : bits being erroneously left set in the address, but the arm code : notices when that's the last page in the memslot and the hva_end is : getting aligned and the size is below one page. : : I think the problem triggers in the addr += PAGE_SIZE of : unmap_stage2_ptes that never matches end because end is aligned but : addr is not. : : } while (pte++, addr += PAGE_SIZE, addr != end); : : x86 again only works on hva_start/hva_end after converting it to : gfn_start/end and that being in pfn units the bits are zapped before : they risk to cause trouble. Jia He said: : I've tested by myself in arm64 server (QDF2400,46 cpus,96G mem) Without : this patch, the WARN_ON is very easy for reproducing. After this patch, I : have run the same benchmarch for a whole day without any WARN_ONs Link: http://lkml.kernel.org/r/1525403506-6750-1-git-send-email-hejianet@gmail.com Signed-off-by: Jia He <jia.he@hxt-semitech.com> Reviewed-by: Andrea Arcangeli <aarcange@redhat.com> Tested-by: Jia He <hejianet@gmail.com> Cc: Suzuki K Poulose <Suzuki.Poulose@arm.com> Cc: Minchan Kim <minchan@kernel.org> Cc: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com> Cc: Arvind Yadav <arvind.yadav.cs@gmail.com> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
BenjaminFair
pushed a commit
to BenjaminFair/linux
that referenced
this pull request
Jul 20, 2018
commit b2ca374 upstream. syzbot hit the following crash on upstream commit 87ef120 (Wed Apr 18 19:48:17 2018 +0000) Merge tag 'ceph-for-4.17-rc2' of git://github.com/ceph/ceph-client syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=83699adeb2d13579c31e C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5805208181407744 syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=6005073343676416 Raw console output: https://syzkaller.appspot.com/x/log.txt?id=6555047731134464 Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118 compiler: gcc (GCC) 8.0.1 20180413 (experimental) IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+83699adeb2d13579c31e@syzkaller.appspotmail.com It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer. F2FS-fs (loop0): Magic Mismatch, valid(0xf2f52010) - read(0x0) F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (loop0): invalid crc value BUG: unable to handle kernel paging request at ffffed006b2a50c0 PGD 21ffee067 P4D 21ffee067 PUD 21fbeb067 PMD 0 Oops: 0000 [Nuvoton-Israel#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 4514 Comm: syzkaller989480 Not tainted 4.17.0-rc1+ Nuvoton-Israel#8 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:build_sit_entries fs/f2fs/segment.c:3653 [inline] RIP: 0010:build_segment_manager+0x7ef7/0xbf70 fs/f2fs/segment.c:3852 RSP: 0018:ffff8801b102e5b0 EFLAGS: 00010a06 RAX: 1ffff1006b2a50c0 RBX: 0000000000000004 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801ac74243e RBP: ffff8801b102f410 R08: ffff8801acbd46c0 R09: fffffbfff14d9af8 R10: fffffbfff14d9af8 R11: ffff8801acbd46c0 R12: ffff8801ac742a80 R13: ffff8801d9519100 R14: dffffc0000000000 R15: ffff880359528600 FS: 0000000001e04880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffed006b2a50c0 CR3: 00000001ac6ac000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: f2fs_fill_super+0x4095/0x7bf0 fs/f2fs/super.c:2803 mount_bdev+0x30c/0x3e0 fs/super.c:1165 f2fs_mount+0x34/0x40 fs/f2fs/super.c:3020 mount_fs+0xae/0x328 fs/super.c:1268 vfs_kern_mount.part.34+0xd4/0x4d0 fs/namespace.c:1037 vfs_kern_mount fs/namespace.c:1027 [inline] do_new_mount fs/namespace.c:2517 [inline] do_mount+0x564/0x3070 fs/namespace.c:2847 ksys_mount+0x12d/0x140 fs/namespace.c:3063 __do_sys_mount fs/namespace.c:3077 [inline] __se_sys_mount fs/namespace.c:3074 [inline] __x64_sys_mount+0xbe/0x150 fs/namespace.c:3074 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x443d6a RSP: 002b:00007ffd312813c8 EFLAGS: 00000297 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000020000c00 RCX: 0000000000443d6a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd312813d0 RBP: 0000000000000003 R08: 0000000020016a00 R09: 000000000000000a R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000004 R13: 0000000000402c60 R14: 0000000000000000 R15: 0000000000000000 RIP: build_sit_entries fs/f2fs/segment.c:3653 [inline] RSP: ffff8801b102e5b0 RIP: build_segment_manager+0x7ef7/0xbf70 fs/f2fs/segment.c:3852 RSP: ffff8801b102e5b0 CR2: ffffed006b2a50c0 ---[ end trace a2034989e196ff17 ]--- Reported-and-tested-by: syzbot+83699adeb2d13579c31e@syzkaller.appspotmail.com Reviewed-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
56e5af0
to
5771681
Compare
BenjaminFair
pushed a commit
to BenjaminFair/linux
that referenced
this pull request
Sep 6, 2018
commit 36eb8ff upstream. Crash dump shows following instructions crash> bt PID: 0 TASK: ffffffffbe412480 CPU: 0 COMMAND: "swapper/0" #0 [ffff891ee0003868] machine_kexec at ffffffffbd063ef1 Nuvoton-Israel#1 [ffff891ee00038c8] __crash_kexec at ffffffffbd12b6f2 Nuvoton-Israel#2 [ffff891ee0003998] crash_kexec at ffffffffbd12c84c Nuvoton-Israel#3 [ffff891ee00039b8] oops_end at ffffffffbd030f0a Nuvoton-Israel#4 [ffff891ee00039e0] no_context at ffffffffbd074643 Nuvoton-Israel#5 [ffff891ee0003a40] __bad_area_nosemaphore at ffffffffbd07496e Nuvoton-Israel#6 [ffff891ee0003a90] bad_area_nosemaphore at ffffffffbd074a64 Nuvoton-Israel#7 [ffff891ee0003aa0] __do_page_fault at ffffffffbd074b0a Nuvoton-Israel#8 [ffff891ee0003b18] do_page_fault at ffffffffbd074fc8 Nuvoton-Israel#9 [ffff891ee0003b50] page_fault at ffffffffbda01925 [exception RIP: qlt_schedule_sess_for_deletion+15] RIP: ffffffffc02e526f RSP: ffff891ee0003c08 RFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffc0307847 RDX: 00000000000020e6 RSI: ffff891edbc377c8 RDI: 0000000000000000 RBP: ffff891ee0003c18 R8: ffffffffc02f0b20 R9: 0000000000000250 R10: 0000000000000258 R11: 000000000000b780 R12: ffff891ed9b43000 R13: 00000000000000f0 R14: 0000000000000006 R15: ffff891edbc377c8 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Nuvoton-Israel#10 [ffff891ee0003c20] qla2x00_fcport_event_handler at ffffffffc02853d3 [qla2xxx] Nuvoton-Israel#11 [ffff891ee0003cf0] __dta_qla24xx_async_gnl_sp_done_333 at ffffffffc0285a1d [qla2xxx] Nuvoton-Israel#12 [ffff891ee0003de8] qla24xx_process_response_queue at ffffffffc02a2eb5 [qla2xxx] Nuvoton-Israel#13 [ffff891ee0003e88] qla24xx_msix_rsp_q at ffffffffc02a5403 [qla2xxx] Nuvoton-Israel#14 [ffff891ee0003ec0] __handle_irq_event_percpu at ffffffffbd0f4c59 Nuvoton-Israel#15 [ffff891ee0003f10] handle_irq_event_percpu at ffffffffbd0f4e02 Nuvoton-Israel#16 [ffff891ee0003f40] handle_irq_event at ffffffffbd0f4e90 Nuvoton-Israel#17 [ffff891ee0003f68] handle_edge_irq at ffffffffbd0f8984 Nuvoton-Israel#18 [ffff891ee0003f88] handle_irq at ffffffffbd0305d5 Nuvoton-Israel#19 [ffff891ee0003fb8] do_IRQ at ffffffffbda02a18 --- <IRQ stack> --- Nuvoton-Israel#20 [ffffffffbe403d30] ret_from_intr at ffffffffbda0094e [exception RIP: unknown or invalid address] RIP: 000000000000001f RSP: 0000000000000000 RFLAGS: fff3b8c2091ebb3f RAX: ffffbba5a0000200 RBX: 0000be8cdfa8f9fa RCX: 0000000000000018 RDX: 0000000000000101 RSI: 000000000000015d RDI: 0000000000000193 RBP: 0000000000000083 R8: ffffffffbe403e38 R9: 0000000000000002 R10: 0000000000000000 R11: ffffffffbe56b820 R12: ffff891ee001cf00 R13: ffffffffbd11c0a4 R14: ffffffffbe403d60 R15: 0000000000000001 ORIG_RAX: ffff891ee0022ac0 CS: 0000 SS: ffffffffffffffb9 bt: WARNING: possibly bogus exception frame Nuvoton-Israel#21 [ffffffffbe403dd8] cpuidle_enter_state at ffffffffbd67c6fd Nuvoton-Israel#22 [ffffffffbe403e40] cpuidle_enter at ffffffffbd67c907 Nuvoton-Israel#23 [ffffffffbe403e50] call_cpuidle at ffffffffbd0d98f3 Nuvoton-Israel#24 [ffffffffbe403e60] do_idle at ffffffffbd0d9b42 Nuvoton-Israel#25 [ffffffffbe403e98] cpu_startup_entry at ffffffffbd0d9da3 Nuvoton-Israel#26 [ffffffffbe403ec0] rest_init at ffffffffbd81d4aa Nuvoton-Israel#27 [ffffffffbe403ed0] start_kernel at ffffffffbe67d2ca Nuvoton-Israel#28 [ffffffffbe403f28] x86_64_start_reservations at ffffffffbe67c675 Nuvoton-Israel#29 [ffffffffbe403f38] x86_64_start_kernel at ffffffffbe67c6eb Nuvoton-Israel#30 [ffffffffbe403f50] secondary_startup_64 at ffffffffbd0000d5 Fixes: 040036b ("scsi: qla2xxx: Delay loop id allocation at login") Cc: <stable@vger.kernel.org> # v4.17+ Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com> Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
BenjaminFair
pushed a commit
to BenjaminFair/linux
that referenced
this pull request
Sep 6, 2018
[ Upstream commit 4f4616c ] Similar to what we do when we remove a PCI function, set the QEDF_UNLOADING flag to prevent any requests from being queued while a vport is being deleted. This prevents any requests from getting stuck in limbo when the vport is unloaded or deleted. Fixes the crash: PID: 106676 TASK: ffff9a436aa90000 CPU: 12 COMMAND: "multipathd" #0 [ffff9a43567d3550] machine_kexec+522 at ffffffffaca60b2a Nuvoton-Israel#1 [ffff9a43567d35b0] __crash_kexec+114 at ffffffffacb13512 Nuvoton-Israel#2 [ffff9a43567d3680] crash_kexec+48 at ffffffffacb13600 Nuvoton-Israel#3 [ffff9a43567d3698] oops_end+168 at ffffffffad117768 Nuvoton-Israel#4 [ffff9a43567d36c0] no_context+645 at ffffffffad106f52 Nuvoton-Israel#5 [ffff9a43567d3710] __bad_area_nosemaphore+116 at ffffffffad106fe9 Nuvoton-Israel#6 [ffff9a43567d3760] bad_area+70 at ffffffffad107379 Nuvoton-Israel#7 [ffff9a43567d3788] __do_page_fault+1247 at ffffffffad11a8cf Nuvoton-Israel#8 [ffff9a43567d37f0] do_page_fault+53 at ffffffffad11a915 Nuvoton-Israel#9 [ffff9a43567d3820] page_fault+40 at ffffffffad116768 [exception RIP: qedf_init_task+61] RIP: ffffffffc0e13c2d RSP: ffff9a43567d38d0 RFLAGS: 00010046 RAX: 0000000000000000 RBX: ffffbe920472c738 RCX: ffff9a434fa0e3e8 RDX: ffff9a434f695280 RSI: ffffbe920472c738 RDI: ffff9a43aa359c80 RBP: ffff9a43567d3950 R8: 0000000000000c15 R9: ffff9a3fb09b9880 R10: ffff9a434fa0e3e8 R11: ffff9a43567d35ce R12: 0000000000000000 R13: ffff9a434f695280 R14: ffff9a43aa359c80 R15: ffff9a3fb9e005c0 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Signed-off-by: Chad Dupuis <chad.dupuis@cavium.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
BenjaminFair
pushed a commit
to BenjaminFair/linux
that referenced
this pull request
Sep 6, 2018
commit 89da619 upstream. Kernel panic when with high memory pressure, calltrace looks like, PID: 21439 TASK: ffff881be3afedd0 CPU: 16 COMMAND: "java" #0 [ffff881ec7ed7630] machine_kexec at ffffffff81059beb Nuvoton-Israel#1 [ffff881ec7ed7690] __crash_kexec at ffffffff81105942 Nuvoton-Israel#2 [ffff881ec7ed7760] crash_kexec at ffffffff81105a30 Nuvoton-Israel#3 [ffff881ec7ed7778] oops_end at ffffffff816902c8 Nuvoton-Israel#4 [ffff881ec7ed77a0] no_context at ffffffff8167ff46 Nuvoton-Israel#5 [ffff881ec7ed77f0] __bad_area_nosemaphore at ffffffff8167ffdc Nuvoton-Israel#6 [ffff881ec7ed7838] __node_set at ffffffff81680300 Nuvoton-Israel#7 [ffff881ec7ed7860] __do_page_fault at ffffffff8169320f Nuvoton-Israel#8 [ffff881ec7ed78c0] do_page_fault at ffffffff816932b5 Nuvoton-Israel#9 [ffff881ec7ed78f0] page_fault at ffffffff8168f4c8 [exception RIP: _raw_spin_lock_irqsave+47] RIP: ffffffff8168edef RSP: ffff881ec7ed79a8 RFLAGS: 00010046 RAX: 0000000000000246 RBX: ffffea0019740d00 RCX: ffff881ec7ed7fd8 RDX: 0000000000020000 RSI: 0000000000000016 RDI: 0000000000000008 RBP: ffff881ec7ed79a8 R8: 0000000000000246 R9: 000000000001a098 R10: ffff88107ffda000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000008 R14: ffff881ec7ed7a80 R15: ffff881be3afedd0 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 It happens in the pagefault and results in double pagefault during compacting pages when memory allocation fails. Analysed the vmcore, the page leads to second pagefault is corrupted with _mapcount=-256, but private=0. It's caused by the race between migration and ballooning, and lock missing in virtballoon_migratepage() of virtio_balloon driver. This patch fix the bug. Fixes: e225042 ("virtio_balloon: introduce migration primitives to balloon pages") Cc: stable@vger.kernel.org Signed-off-by: Jiang Biao <jiang.biao2@zte.com.cn> Signed-off-by: Huang Chong <huang.chong@zte.com.cn> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
warp5tw
pushed a commit
to warp5tw/linux
that referenced
this pull request
Jan 10, 2022
The "__ip6_tnl_parm" struct was left uninitialized causing an invalid load of random data when the "__ip6_tnl_parm" struct was used elsewhere. As an example, in the function "ip6_tnl_xmit_ctl()", it tries to access the "collect_md" member. With "__ip6_tnl_parm" being uninitialized and containing random data, the UBSAN detected that "collect_md" held a non-boolean value. The UBSAN issue is as follows: =============================================================== UBSAN: invalid-load in net/ipv6/ip6_tunnel.c:1025:14 load of value 30 is not a valid value for type '_Bool' CPU: 1 PID: 228 Comm: kworker/1:3 Not tainted 5.16.0-rc4+ Nuvoton-Israel#8 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> dump_stack_lvl+0x44/0x57 ubsan_epilogue+0x5/0x40 __ubsan_handle_load_invalid_value+0x66/0x70 ? __cpuhp_setup_state+0x1d3/0x210 ip6_tnl_xmit_ctl.cold.52+0x2c/0x6f [ip6_tunnel] vti6_tnl_xmit+0x79c/0x1e96 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? vti6_rcv+0x100/0x100 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? rcu_read_lock_bh_held+0xc0/0xc0 ? lock_acquired+0x262/0xb10 dev_hard_start_xmit+0x1e6/0x820 __dev_queue_xmit+0x2079/0x3340 ? mark_lock.part.52+0xf7/0x1050 ? netdev_core_pick_tx+0x290/0x290 ? kvm_clock_read+0x14/0x30 ? kvm_sched_clock_read+0x5/0x10 ? sched_clock_cpu+0x15/0x200 ? find_held_lock+0x3a/0x1c0 ? lock_release+0x42f/0xc90 ? lock_downgrade+0x6b0/0x6b0 ? mark_held_locks+0xb7/0x120 ? neigh_connected_output+0x31f/0x470 ? lockdep_hardirqs_on+0x79/0x100 ? neigh_connected_output+0x31f/0x470 ? ip6_finish_output2+0x9b0/0x1d90 ? rcu_read_lock_bh_held+0x62/0xc0 ? ip6_finish_output2+0x9b0/0x1d90 ip6_finish_output2+0x9b0/0x1d90 ? ip6_append_data+0x330/0x330 ? ip6_mtu+0x166/0x370 ? __ip6_finish_output+0x1ad/0xfb0 ? nf_hook_slow+0xa6/0x170 ip6_output+0x1fb/0x710 ? nf_hook.constprop.32+0x317/0x430 ? ip6_finish_output+0x180/0x180 ? __ip6_finish_output+0xfb0/0xfb0 ? lock_is_held_type+0xd9/0x130 ndisc_send_skb+0xb33/0x1590 ? __sk_mem_raise_allocated+0x11cf/0x1560 ? dst_output+0x4a0/0x4a0 ? ndisc_send_rs+0x432/0x610 addrconf_dad_completed+0x30c/0xbb0 ? addrconf_rs_timer+0x650/0x650 ? addrconf_dad_work+0x73c/0x10e0 addrconf_dad_work+0x73c/0x10e0 ? addrconf_dad_completed+0xbb0/0xbb0 ? rcu_read_lock_sched_held+0xaf/0xe0 ? rcu_read_lock_bh_held+0xc0/0xc0 process_one_work+0x97b/0x1740 ? pwq_dec_nr_in_flight+0x270/0x270 worker_thread+0x87/0xbf0 ? process_one_work+0x1740/0x1740 kthread+0x3ac/0x490 ? set_kthread_struct+0x100/0x100 ret_from_fork+0x22/0x30 </TASK> =============================================================== The solution is to initialize "__ip6_tnl_parm" struct to zeros in the "vti6_siocdevprivate()" function. Signed-off-by: William Zhao <wizhao@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
warp5tw
pushed a commit
to warp5tw/linux
that referenced
this pull request
Mar 8, 2022
We hit a bug with a recovering relocation on mount for one of our file systems in production. I reproduced this locally by injecting errors into snapshot delete with balance running at the same time. This presented as an error while looking up an extent item WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680 CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ Nuvoton-Israel#8 RIP: 0010:lookup_inline_extent_backref+0x647/0x680 RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000 RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001 R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000 R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000 FS: 0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0 Call Trace: <TASK> insert_inline_extent_backref+0x46/0xd0 __btrfs_inc_extent_ref.isra.0+0x5f/0x200 ? btrfs_merge_delayed_refs+0x164/0x190 __btrfs_run_delayed_refs+0x561/0xfa0 ? btrfs_search_slot+0x7b4/0xb30 ? btrfs_update_root+0x1a9/0x2c0 btrfs_run_delayed_refs+0x73/0x1f0 ? btrfs_update_root+0x1a9/0x2c0 btrfs_commit_transaction+0x50/0xa50 ? btrfs_update_reloc_root+0x122/0x220 prepare_to_merge+0x29f/0x320 relocate_block_group+0x2b8/0x550 btrfs_relocate_block_group+0x1a6/0x350 btrfs_relocate_chunk+0x27/0xe0 btrfs_balance+0x777/0xe60 balance_kthread+0x35/0x50 ? btrfs_balance+0xe60/0xe60 kthread+0x16b/0x190 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x22/0x30 </TASK> Normally snapshot deletion and relocation are excluded from running at the same time by the fs_info->cleaner_mutex. However if we had a pending balance waiting to get the ->cleaner_mutex, and a snapshot deletion was running, and then the box crashed, we would come up in a state where we have a half deleted snapshot. Again, in the normal case the snapshot deletion needs to complete before relocation can start, but in this case relocation could very well start before the snapshot deletion completes, as we simply add the root to the dead roots list and wait for the next time the cleaner runs to clean up the snapshot. Fix this by setting a bit on the fs_info if we have any DEAD_ROOT's that had a pending drop_progress key. If they do then we know we were in the middle of the drop operation and set a flag on the fs_info. Then balance can wait until this flag is cleared to start up again. If there are DEAD_ROOT's that don't have a drop_progress set then we're safe to start balance right away as we'll be properly protected by the cleaner_mutex. CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Filipe Manana <fdmanana@suse.com> Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
warp5tw
pushed a commit
to warp5tw/linux
that referenced
this pull request
May 24, 2022
Do not allow to write timestamps on RX rings if PF is being configured. When PF is being configured RX rings can be freed or rebuilt. If at the same time timestamps are updated, the kernel will crash by dereferencing null RX ring pointer. PID: 1449 TASK: ff187d28ed658040 CPU: 34 COMMAND: "ice-ptp-0000:51" #0 [ff1966a94a713bb0] machine_kexec at ffffffff9d05a0be Nuvoton-Israel#1 [ff1966a94a713c08] __crash_kexec at ffffffff9d192e9d Nuvoton-Israel#2 [ff1966a94a713cd0] crash_kexec at ffffffff9d1941bd Nuvoton-Israel#3 [ff1966a94a713ce8] oops_end at ffffffff9d01bd54 Nuvoton-Israel#4 [ff1966a94a713d08] no_context at ffffffff9d06bda4 Nuvoton-Israel#5 [ff1966a94a713d60] __bad_area_nosemaphore at ffffffff9d06c10c Nuvoton-Israel#6 [ff1966a94a713da8] do_page_fault at ffffffff9d06cae4 Nuvoton-Israel#7 [ff1966a94a713de0] page_fault at ffffffff9da0107e [exception RIP: ice_ptp_update_cached_phctime+91] RIP: ffffffffc076db8b RSP: ff1966a94a713e98 RFLAGS: 00010246 RAX: 16e3db9c6b7ccae4 RBX: ff187d269dd3c180 RCX: ff187d269cd4d018 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff187d269cfcc644 R8: ff187d339b9641b0 R9: 0000000000000000 R10: 0000000000000002 R11: 0000000000000000 R12: ff187d269cfcc648 R13: ffffffff9f128784 R14: ffffffff9d101b70 R15: ff187d269cfcc640 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Nuvoton-Israel#8 [ff1966a94a713ea0] ice_ptp_periodic_work at ffffffffc076dbef [ice] Nuvoton-Israel#9 [ff1966a94a713ee0] kthread_worker_fn at ffffffff9d101c1b Nuvoton-Israel#10 [ff1966a94a713f10] kthread at ffffffff9d101b4d Nuvoton-Israel#11 [ff1966a94a713f50] ret_from_fork at ffffffff9da0023f Fixes: 77a7811 ("ice: enable receive hardware timestamping") Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Reviewed-by: Michal Schmidt <mschmidt@redhat.com> Tested-by: Dave Cain <dcain@redhat.com> Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
tmaimon
pushed a commit
that referenced
this pull request
Aug 7, 2024
commit be346c1 upstream. The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents. Extent tree manipulations do often extend the current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents. Once that happens a WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to this error. This was actually triggered by one of our customers on a heavily fragmented OCFS2 filesystem. To fix the issue make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written(). Heming Zhao said: ------ PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error" PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA" #0 machine_kexec at ffffffff8c069932 #1 __crash_kexec at ffffffff8c1338fa #2 panic at ffffffff8c1d69b9 #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2] #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2] #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2] #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2] #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2] #10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] #11 dio_complete at ffffffff8c2b9fa7 #12 do_blockdev_direct_IO at ffffffff8c2bc09f #13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] #14 generic_file_direct_write at ffffffff8c1dcf14 #15 __generic_file_write_iter at ffffffff8c1dd07b #16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] #17 aio_write at ffffffff8c2cc72e #18 kmem_cache_alloc at ffffffff8c248dde #19 do_io_submit at ffffffff8c2ccada #20 do_syscall_64 at ffffffff8c004984 #21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba Link: https://lkml.kernel.org/r/20240617095543.6971-1-jack@suse.cz Link: https://lkml.kernel.org/r/20240614145243.8837-1-jack@suse.cz Fixes: c15471f ("ocfs2: fix sparse file & data ordering issue in direct io") Signed-off-by: Jan Kara <jack@suse.cz> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Reviewed-by: Heming Zhao <heming.zhao@suse.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Gang He <ghe@suse.com> Cc: Jun Piao <piaojun@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
maxdog988
pushed a commit
that referenced
this pull request
Nov 4, 2024
[ Upstream commit 73f3508 ] When creating a trace_probe we would set nr_args prior to truncating the arguments to MAX_TRACE_ARGS. However, we would only initialize arguments up to the limit. This caused invalid memory access when attempting to set up probes with more than 128 fetchargs. BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 1769 Comm: cat Not tainted 6.11.0-rc7+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:__set_print_fmt+0x134/0x330 Resolve the issue by applying the MAX_TRACE_ARGS limit earlier. Return an error when there are too many arguments instead of silently truncating. Link: https://lore.kernel.org/all/20240930202656.292869-1-mikel@mikelr.com/ Fixes: 035ba76 ("tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init") Signed-off-by: Mikel Rychliski <mikel@mikelr.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
maxdog988
pushed a commit
that referenced
this pull request
Nov 5, 2024
commit ac01c8c upstream. AddressSanitizer found a use-after-free bug in the symbol code which manifested as 'perf top' segfaulting. ==1238389==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00c48844b at pc 0x5650d8035961 bp 0x7f751aaecc90 sp 0x7f751aaecc80 READ of size 1 at 0x60b00c48844b thread T193 #0 0x5650d8035960 in _sort__sym_cmp util/sort.c:310 #1 0x5650d8043744 in hist_entry__cmp util/hist.c:1286 #2 0x5650d8043951 in hists__findnew_entry util/hist.c:614 #3 0x5650d804568f in __hists__add_entry util/hist.c:754 #4 0x5650d8045bf9 in hists__add_entry util/hist.c:772 #5 0x5650d8045df1 in iter_add_single_normal_entry util/hist.c:997 #6 0x5650d8043326 in hist_entry_iter__add util/hist.c:1242 #7 0x5650d7ceeefe in perf_event__process_sample /home/matt/src/linux/tools/perf/builtin-top.c:845 #8 0x5650d7ceeefe in deliver_event /home/matt/src/linux/tools/perf/builtin-top.c:1208 #9 0x5650d7fdb51b in do_flush util/ordered-events.c:245 #10 0x5650d7fdb51b in __ordered_events__flush util/ordered-events.c:324 #11 0x5650d7ced743 in process_thread /home/matt/src/linux/tools/perf/builtin-top.c:1120 #12 0x7f757ef1f133 in start_thread nptl/pthread_create.c:442 #13 0x7f757ef9f7db in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 When updating hist maps it's also necessary to update the hist symbol reference because the old one gets freed in map__put(). While this bug was probably introduced with 5c24b67 ("perf tools: Replace map->referenced & maps->removed_maps with map->refcnt"), the symbol objects were leaked until c087e94 ("perf machine: Fix refcount usage when processing PERF_RECORD_KSYMBOL") was merged so the bug was masked. Fixes: c087e94 ("perf machine: Fix refcount usage when processing PERF_RECORD_KSYMBOL") Reported-by: Yunzhao Li <yunzhao@cloudflare.com> Signed-off-by: Matt Fleming (Cloudflare) <matt@readmodwrite.com> Cc: Ian Rogers <irogers@google.com> Cc: kernel-team@cloudflare.com Cc: Namhyung Kim <namhyung@kernel.org> Cc: Riccardo Mancini <rickyman7@gmail.com> Cc: stable@vger.kernel.org # v5.13+ Link: https://lore.kernel.org/r/20240815142212.3834625-1-matt@readmodwrite.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
maxdog988
pushed a commit
that referenced
this pull request
Nov 5, 2024
commit 9af2efe upstream. The fields in the hist_entry are filled on-demand which means they only have meaningful values when relevant sort keys are used. So if neither of 'dso' nor 'sym' sort keys are used, the map/symbols in the hist entry can be garbage. So it shouldn't access it unconditionally. I got a segfault, when I wanted to see cgroup profiles. $ sudo perf record -a --all-cgroups --synth=cgroup true $ sudo perf report -s cgroup Program received signal SIGSEGV, Segmentation fault. 0x00005555557a8d90 in map__dso (map=0x0) at util/map.h:48 48 return RC_CHK_ACCESS(map)->dso; (gdb) bt #0 0x00005555557a8d90 in map__dso (map=0x0) at util/map.h:48 #1 0x00005555557aa39b in map__load (map=0x0) at util/map.c:344 #2 0x00005555557aa592 in map__find_symbol (map=0x0, addr=140736115941088) at util/map.c:385 #3 0x00005555557ef000 in hists__findnew_entry (hists=0x555556039d60, entry=0x7fffffffa4c0, al=0x7fffffffa8c0, sample_self=true) at util/hist.c:644 #4 0x00005555557ef61c in __hists__add_entry (hists=0x555556039d60, al=0x7fffffffa8c0, sym_parent=0x0, bi=0x0, mi=0x0, ki=0x0, block_info=0x0, sample=0x7fffffffaa90, sample_self=true, ops=0x0) at util/hist.c:761 #5 0x00005555557ef71f in hists__add_entry (hists=0x555556039d60, al=0x7fffffffa8c0, sym_parent=0x0, bi=0x0, mi=0x0, ki=0x0, sample=0x7fffffffaa90, sample_self=true) at util/hist.c:779 #6 0x00005555557f00fb in iter_add_single_normal_entry (iter=0x7fffffffa900, al=0x7fffffffa8c0) at util/hist.c:1015 #7 0x00005555557f09a7 in hist_entry_iter__add (iter=0x7fffffffa900, al=0x7fffffffa8c0, max_stack_depth=127, arg=0x7fffffffbce0) at util/hist.c:1260 #8 0x00005555555ba7ce in process_sample_event (tool=0x7fffffffbce0, event=0x7ffff7c14128, sample=0x7fffffffaa90, evsel=0x555556039ad0, machine=0x5555560388e8) at builtin-report.c:334 #9 0x00005555557b30c8 in evlist__deliver_sample (evlist=0x555556039010, tool=0x7fffffffbce0, event=0x7ffff7c14128, sample=0x7fffffffaa90, evsel=0x555556039ad0, machine=0x5555560388e8) at util/session.c:1232 #10 0x00005555557b32bc in machines__deliver_event (machines=0x5555560388e8, evlist=0x555556039010, event=0x7ffff7c14128, sample=0x7fffffffaa90, tool=0x7fffffffbce0, file_offset=110888, file_path=0x555556038ff0 "perf.data") at util/session.c:1271 #11 0x00005555557b3848 in perf_session__deliver_event (session=0x5555560386d0, event=0x7ffff7c14128, tool=0x7fffffffbce0, file_offset=110888, file_path=0x555556038ff0 "perf.data") at util/session.c:1354 #12 0x00005555557affaf in ordered_events__deliver_event (oe=0x555556038e60, event=0x555556135aa0) at util/session.c:132 #13 0x00005555557bb605 in do_flush (oe=0x555556038e60, show_progress=false) at util/ordered-events.c:245 #14 0x00005555557bb95c in __ordered_events__flush (oe=0x555556038e60, how=OE_FLUSH__ROUND, timestamp=0) at util/ordered-events.c:324 #15 0x00005555557bba46 in ordered_events__flush (oe=0x555556038e60, how=OE_FLUSH__ROUND) at util/ordered-events.c:342 #16 0x00005555557b1b3b in perf_event__process_finished_round (tool=0x7fffffffbce0, event=0x7ffff7c15bb8, oe=0x555556038e60) at util/session.c:780 #17 0x00005555557b3b27 in perf_session__process_user_event (session=0x5555560386d0, event=0x7ffff7c15bb8, file_offset=117688, file_path=0x555556038ff0 "perf.data") at util/session.c:1406 As you can see the entry->ms.map was NULL even if he->ms.map has a value. This is because 'sym' sort key is not given, so it cannot assume whether he->ms.sym and entry->ms.sym is the same. I only checked the 'sym' sort key here as it implies 'dso' behavior (so maps are the same). Fixes: ac01c8c ("perf hist: Update hist symbol when updating maps") Signed-off-by: Namhyung Kim <namhyung@kernel.org> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Ian Rogers <irogers@google.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Kan Liang <kan.liang@linux.intel.com> Cc: Matt Fleming <matt@readmodwrite.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Link: https://lore.kernel.org/r/20240826221045.1202305-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
maxdog988
pushed a commit
that referenced
this pull request
Nov 5, 2024
…tion to perf_sched__replay() [ Upstream commit c690786 ] The start_work_mutex and work_done_wait_mutex are used only for the 'perf sched replay'. Put their initialization in perf_sched__replay () to reduce unnecessary actions in other commands. Simple functional testing: # perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 0.197 [sec] [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 14.952 MB perf.data (134165 samples) ] # perf sched replay run measurement overhead: 108 nsecs sleep measurement overhead: 65658 nsecs the run test took 999991 nsecs the sleep test took 1079324 nsecs nr_run_events: 42378 nr_sleep_events: 43102 nr_wakeup_events: 31852 target-less wakeups: 17 multi-target wakeups: 712 task 0 ( swapper: 0), nr_events: 10451 task 1 ( swapper: 1), nr_events: 3 task 2 ( swapper: 2), nr_events: 1 <SNIP> task 717 ( sched-messaging: 74483), nr_events: 152 task 718 ( sched-messaging: 74484), nr_events: 1944 task 719 ( sched-messaging: 74485), nr_events: 73 task 720 ( sched-messaging: 74486), nr_events: 163 task 721 ( sched-messaging: 74487), nr_events: 942 task 722 ( sched-messaging: 74488), nr_events: 78 task 723 ( sched-messaging: 74489), nr_events: 1090 ------------------------------------------------------------ #1 : 1366.507, ravg: 1366.51, cpu: 7682.70 / 7682.70 #2 : 1410.072, ravg: 1370.86, cpu: 7723.88 / 7686.82 #3 : 1396.296, ravg: 1373.41, cpu: 7568.20 / 7674.96 #4 : 1381.019, ravg: 1374.17, cpu: 7531.81 / 7660.64 #5 : 1393.826, ravg: 1376.13, cpu: 7725.25 / 7667.11 #6 : 1401.581, ravg: 1378.68, cpu: 7594.82 / 7659.88 #7 : 1381.337, ravg: 1378.94, cpu: 7371.22 / 7631.01 #8 : 1373.842, ravg: 1378.43, cpu: 7894.92 / 7657.40 #9 : 1364.697, ravg: 1377.06, cpu: 7324.91 / 7624.15 #10 : 1363.613, ravg: 1375.72, cpu: 7209.55 / 7582.69 # echo $? 0 Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Link: https://lore.kernel.org/r/20240206083228.172607-2-yangjihong1@huawei.com Stable-dep-of: 1a5efc9 ("libsubcmd: Don't free the usage string") Signed-off-by: Sasha Levin <sashal@kernel.org>
maxdog988
pushed a commit
that referenced
this pull request
Nov 5, 2024
…f_sched__{lat|map|replay}() [ Upstream commit bd2cdf2 ] The curr_pid and cpu_last_switched are used only for the 'perf sched replay/latency/map'. Put their initialization in perf_sched__{lat|map|replay () to reduce unnecessary actions in other commands. Simple functional testing: # perf sched record perf bench sched messaging # Running 'sched/messaging' benchmark: # 20 sender and receiver processes per group # 10 groups == 400 processes run Total time: 0.209 [sec] [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 16.456 MB perf.data (147907 samples) ] # perf sched lat ------------------------------------------------------------------------------------------------------------------------------------------- Task | Runtime ms | Switches | Avg delay ms | Max delay ms | Max delay start | Max delay end | ------------------------------------------------------------------------------------------------------------------------------------------- sched-messaging:(401) | 2990.699 ms | 38705 | avg: 0.661 ms | max: 67.046 ms | max start: 456532.624830 s | max end: 456532.691876 s qemu-system-x86:(7) | 179.764 ms | 2191 | avg: 0.152 ms | max: 21.857 ms | max start: 456532.576434 s | max end: 456532.598291 s sshd:48125 | 0.522 ms | 2 | avg: 0.037 ms | max: 0.046 ms | max start: 456532.514610 s | max end: 456532.514656 s <SNIP> ksoftirqd/11:82 | 0.063 ms | 1 | avg: 0.005 ms | max: 0.005 ms | max start: 456532.769366 s | max end: 456532.769371 s kworker/9:0-mm_:34624 | 0.233 ms | 20 | avg: 0.004 ms | max: 0.007 ms | max start: 456532.690804 s | max end: 456532.690812 s migration/13:93 | 0.000 ms | 1 | avg: 0.004 ms | max: 0.004 ms | max start: 456532.512669 s | max end: 456532.512674 s ----------------------------------------------------------------------------------------------------------------- TOTAL: | 3180.750 ms | 41368 | --------------------------------------------------- # echo $? 0 # perf sched map *A0 456532.510141 secs A0 => migration/0:15 *. 456532.510171 secs . => swapper:0 . *B0 456532.510261 secs B0 => migration/1:21 . *. 456532.510279 secs <SNIP> L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . . 456532.785979 secs L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . 456532.786054 secs L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . 456532.786127 secs L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . 456532.786197 secs L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 456532.786270 secs # echo $? 0 # perf sched replay run measurement overhead: 108 nsecs sleep measurement overhead: 66473 nsecs the run test took 1000002 nsecs the sleep test took 1082686 nsecs nr_run_events: 49334 nr_sleep_events: 50054 nr_wakeup_events: 34701 target-less wakeups: 165 multi-target wakeups: 766 task 0 ( swapper: 0), nr_events: 15419 task 1 ( swapper: 1), nr_events: 1 task 2 ( swapper: 2), nr_events: 1 <SNIP> task 715 ( sched-messaging: 110248), nr_events: 1438 task 716 ( sched-messaging: 110249), nr_events: 512 task 717 ( sched-messaging: 110250), nr_events: 500 task 718 ( sched-messaging: 110251), nr_events: 537 task 719 ( sched-messaging: 110252), nr_events: 823 ------------------------------------------------------------ #1 : 1325.288, ravg: 1325.29, cpu: 7823.35 / 7823.35 #2 : 1363.606, ravg: 1329.12, cpu: 7655.53 / 7806.56 #3 : 1349.494, ravg: 1331.16, cpu: 7544.80 / 7780.39 #4 : 1311.488, ravg: 1329.19, cpu: 7495.13 / 7751.86 #5 : 1309.902, ravg: 1327.26, cpu: 7266.65 / 7703.34 #6 : 1309.535, ravg: 1325.49, cpu: 7843.86 / 7717.39 #7 : 1316.482, ravg: 1324.59, cpu: 7854.41 / 7731.09 #8 : 1366.604, ravg: 1328.79, cpu: 7955.81 / 7753.57 #9 : 1326.286, ravg: 1328.54, cpu: 7466.86 / 7724.90 #10 : 1356.653, ravg: 1331.35, cpu: 7566.60 / 7709.07 # echo $? 0 Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Link: https://lore.kernel.org/r/20240206083228.172607-5-yangjihong1@huawei.com Stable-dep-of: 1a5efc9 ("libsubcmd: Don't free the usage string") Signed-off-by: Sasha Levin <sashal@kernel.org>
maxdog988
pushed a commit
that referenced
this pull request
Nov 5, 2024
[ Upstream commit a848c29 ] On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash with the following syslog: [232064.838881] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232064.839360] NFSv4: state recovery failed for open file nfs/pvc-12b5200d-cd0f-46a3-b9f0-af8f4fe0ef64.qcow2, error = -116 [232066.588183] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 [232066.588586] Mem abort info: [232066.588701] ESR = 0x0000000096000007 [232066.588862] EC = 0x25: DABT (current EL), IL = 32 bits [232066.589084] SET = 0, FnV = 0 [232066.589216] EA = 0, S1PTW = 0 [232066.589340] FSC = 0x07: level 3 translation fault [232066.589559] Data abort info: [232066.589683] ISV = 0, ISS = 0x00000007 [232066.589842] CM = 0, WnR = 0 [232066.589967] user pgtable: 64k pages, 48-bit VAs, pgdp=00002000956ff400 [232066.590231] [0000000000000058] pgd=08001100ae100003, p4d=08001100ae100003, pud=08001100ae100003, pmd=08001100b3c00003, pte=0000000000000000 [232066.590757] Internal error: Oops: 96000007 [#1] SMP [232066.590958] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm vhost_net vhost vhost_iotlb tap tun ipt_rpfilter xt_multiport ip_set_hash_ip ip_set_hash_net xfrm_interface xfrm6_tunnel tunnel4 tunnel6 esp4 ah4 wireguard libcurve25519_generic veth xt_addrtype xt_set nf_conntrack_netlink ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_bitmap_port ip_set_hash_ipport dummy ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs iptable_filter sch_ingress nfnetlink_cttimeout vport_gre ip_gre ip_tunnel gre vport_geneve geneve vport_vxlan vxlan ip6_udp_tunnel udp_tunnel openvswitch nf_conncount dm_round_robin dm_service_time dm_multipath xt_nat xt_MASQUERADE nft_chain_nat nf_nat xt_mark xt_conntrack xt_comment nft_compat nft_counter nf_tables nfnetlink ocfs2 ocfs2_nodemanager ocfs2_stackglue iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ipmi_ssif nbd overlay 8021q garp mrp bonding tls rfkill sunrpc ext4 mbcache jbd2 [232066.591052] vfat fat cas_cache cas_disk ses enclosure scsi_transport_sas sg acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler ip_tables vfio_pci vfio_pci_core vfio_virqfd vfio_iommu_type1 vfio dm_mirror dm_region_hash dm_log dm_mod nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc fuse xfs libcrc32c ast drm_vram_helper qla2xxx drm_kms_helper syscopyarea crct10dif_ce sysfillrect ghash_ce sysimgblt sha2_ce fb_sys_fops cec sha256_arm64 sha1_ce drm_ttm_helper ttm nvme_fc igb sbsa_gwdt nvme_fabrics drm nvme_core i2c_algo_bit i40e scsi_transport_fc megaraid_sas aes_neon_bs [232066.596953] CPU: 6 PID: 4124696 Comm: 10.253.166.125- Kdump: loaded Not tainted 5.15.131-9.cl9_ocfs2.aarch64 #1 [232066.597356] Hardware name: Great Wall .\x93\x8e...RF6260 V5/GWMSSE2GL1T, BIOS T656FBE_V3.0.18 2024-01-06 [232066.597721] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [232066.598034] pc : nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.598327] lr : nfs4_reclaim_open_state+0x12c/0x800 [nfsv4] [232066.598595] sp : ffff8000f568fc70 [232066.598731] x29: ffff8000f568fc70 x28: 0000000000001000 x27: ffff21003db33000 [232066.599030] x26: ffff800005521ae0 x25: ffff0100f98fa3f0 x24: 0000000000000001 [232066.599319] x23: ffff800009920008 x22: ffff21003db33040 x21: ffff21003db33050 [232066.599628] x20: ffff410172fe9e40 x19: ffff410172fe9e00 x18: 0000000000000000 [232066.599914] x17: 0000000000000000 x16: 0000000000000004 x15: 0000000000000000 [232066.600195] x14: 0000000000000000 x13: ffff800008e685a8 x12: 00000000eac0c6e6 [232066.600498] x11: 0000000000000000 x10: 0000000000000008 x9 : ffff8000054e5828 [232066.600784] x8 : 00000000ffffffbf x7 : 0000000000000001 x6 : 000000000a9eb14a [232066.601062] x5 : 0000000000000000 x4 : ffff70ff8a14a800 x3 : 0000000000000058 [232066.601348] x2 : 0000000000000001 x1 : 54dce46366daa6c6 x0 : 0000000000000000 [232066.601636] Call trace: [232066.601749] nfs4_reclaim_open_state+0x220/0x800 [nfsv4] [232066.601998] nfs4_do_reclaim+0x1b8/0x28c [nfsv4] [232066.602218] nfs4_state_manager+0x928/0x10f0 [nfsv4] [232066.602455] nfs4_run_state_manager+0x78/0x1b0 [nfsv4] [232066.602690] kthread+0x110/0x114 [232066.602830] ret_from_fork+0x10/0x20 [232066.602985] Code: 1400000d f9403f20 f9402e61 91016003 (f9402c00) [232066.603284] SMP: stopping secondary CPUs [232066.606936] Starting crashdump kernel... [232066.607146] Bye! Analysing the vmcore, we know that nfs4_copy_state listed by destination nfs_server->ss_copies was added by the field copies in handle_async_copy(), and we found a waiting copy process with the stack as: PID: 3511963 TASK: ffff710028b47e00 CPU: 0 COMMAND: "cp" #0 [ffff8001116ef740] __switch_to at ffff8000081b92f4 #1 [ffff8001116ef760] __schedule at ffff800008dd0650 #2 [ffff8001116ef7c0] schedule at ffff800008dd0a00 #3 [ffff8001116ef7e0] schedule_timeout at ffff800008dd6aa0 #4 [ffff8001116ef860] __wait_for_common at ffff800008dd166c #5 [ffff8001116ef8e0] wait_for_completion_interruptible at ffff800008dd1898 #6 [ffff8001116ef8f0] handle_async_copy at ffff8000055142f4 [nfsv4] #7 [ffff8001116ef970] _nfs42_proc_copy at ffff8000055147c8 [nfsv4] #8 [ffff8001116efa80] nfs42_proc_copy at ffff800005514cf0 [nfsv4] #9 [ffff8001116efc50] __nfs4_copy_file_range.constprop.0 at ffff8000054ed694 [nfsv4] The NULL-pointer dereference was due to nfs42_complete_copies() listed the nfs_server->ss_copies by the field ss_copies of nfs4_copy_state. So the nfs4_copy_state address ffff0100f98fa3f0 was offset by 0x10 and the data accessed through this pointer was also incorrect. Generally, the ordered list nfs4_state_owner->so_states indicate open(O_RDWR) or open(O_WRITE) states are reclaimed firstly by nfs4_reclaim_open_state(). When destination state reclaim is failed with NFS_STATE_RECOVERY_FAILED and copies are not deleted in nfs_server->ss_copies, the source state may be passed to the nfs42_complete_copies() process earlier, resulting in this crash scene finally. To solve this issue, we add a list_head nfs_server->ss_src_copies for a server-to-server copy specially. Fixes: 0e65a32 ("NFS: handle source server reboot") Signed-off-by: Yanjun Zhang <zhangyanjun@cestc.cn> Reviewed-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Procfs read should be npcm7xx_proc_read function so that the read
operation correctly allocates dump memory.
Change-Id: I2bd72fbc5c1668c062c6eb5b95057c7f050b6009
Signed-off-by: Kun Yi kunyi@google.com