bpf: Fix clobbering of r2 in bpf_gen_ld_abs #19

kernel-patches-bot · 2020-09-08T03:41:21Z

Pull request for series with
subject: bpf: Fix clobbering of r2 in bpf_gen_ld_abs
version: 1
url: https://patchwork.ozlabs.org/project/netdev/list/?series=200082

0: r6 = r1 1: r1 = 12 2: r0 = *(u16 *)skb[r1] The xlated sequence was incorrectly clobbering r2 with pointer value of r6 ... 0: (bf) r6 = r1 1: (b7) r1 = 12 2: (bf) r1 = r6 3: (bf) r2 = r1 4: (85) call bpf_skb_load_helper_16_no_cache#7692160 ... and hence call to the load helper never succeeded given the offset was too high. Fix it by reordering the load of r6 to r1. Other than that the insn has similar calling convention than BPF helpers, that is, r0 - r5 are scratch regs, so nothing else affected after the insn. Fixes: e0cea7c ("bpf: implement ld_abs/ld_ind in native bpf") Reported-by: Bryce Kahle <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> --- net/core/filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

kernel-patches-bot · 2020-09-08T03:41:22Z

Master branch: e6135df
series: https://patchwork.ozlabs.org/project/netdev/list/?series=200082
version: 1

patch https://patchwork.ozlabs.org/project/netdev/patch/cace836e4d07bb63b1a53e49c5dfb238a040c298.1599512096.git.daniel@iogearbox.net/ applied successfully

kernel-patches-bot · 2020-09-08T22:05:24Z

At least one diff in series https://patchwork.ozlabs.org/project/netdev/list/?series=200082 irrelevant now. Closing PR.

The test_generic_metric() missed to release entries in the pctx. Asan reported following leak (and more): Direct leak of 128 byte(s) in 1 object(s) allocated from: #0 0x7f4c9396980e in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10780e) #1 0x55f7e748cc14 in hashmap_grow (/home/namhyung/project/linux/tools/perf/perf+0x90cc14) #2 0x55f7e748d497 in hashmap__insert (/home/namhyung/project/linux/tools/perf/perf+0x90d497) #3 0x55f7e7341667 in hashmap__set /home/namhyung/project/linux/tools/perf/util/hashmap.h:111 #4 0x55f7e7341667 in expr__add_ref util/expr.c:120 #5 0x55f7e7292436 in prepare_metric util/stat-shadow.c:783 #6 0x55f7e729556d in test_generic_metric util/stat-shadow.c:858 #7 0x55f7e712390b in compute_single tests/parse-metric.c:128 #8 0x55f7e712390b in __compute_metric tests/parse-metric.c:180 #9 0x55f7e712446d in compute_metric tests/parse-metric.c:196 #10 0x55f7e712446d in test_dcache_l2 tests/parse-metric.c:295 #11 0x55f7e712446d in test__parse_metric tests/parse-metric.c:355 #12 0x55f7e70be09b in run_test tests/builtin-test.c:410 #13 0x55f7e70be09b in test_and_print tests/builtin-test.c:440 #14 0x55f7e70c101a in __cmd_test tests/builtin-test.c:661 #15 0x55f7e70c101a in cmd_test tests/builtin-test.c:807 #16 0x55f7e7126214 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312 #17 0x55f7e6fc41a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364 #18 0x55f7e6fc41a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408 #19 0x55f7e6fc41a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538 #20 0x7f4c93492cc9 in __libc_start_main ../csu/libc-start.c:308 Fixes: 6d432c4 ("perf tools: Add test_generic_metric function") Signed-off-by: Namhyung Kim <[email protected]> Acked-by: Jiri Olsa <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Andi Kleen <[email protected]> Cc: Ian Rogers <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Stephane Eranian <[email protected]> Link: http://lore.kernel.org/lkml/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

The metricgroup__add_metric() can find multiple match for a metric group and it's possible to fail. Also it can fail in the middle like in resolve_metric() even for single metric. In those cases, the intermediate list and ids will be leaked like: Direct leak of 3 byte(s) in 1 object(s) allocated from: #0 0x7f4c938f40b5 in strdup (/lib/x86_64-linux-gnu/libasan.so.5+0x920b5) #1 0x55f7e71c1bef in __add_metric util/metricgroup.c:683 #2 0x55f7e71c31d0 in add_metric util/metricgroup.c:906 #3 0x55f7e71c3844 in metricgroup__add_metric util/metricgroup.c:940 #4 0x55f7e71c488d in metricgroup__add_metric_list util/metricgroup.c:993 #5 0x55f7e71c488d in parse_groups util/metricgroup.c:1045 #6 0x55f7e71c60a4 in metricgroup__parse_groups_test util/metricgroup.c:1087 #7 0x55f7e71235ae in __compute_metric tests/parse-metric.c:164 #8 0x55f7e7124650 in compute_metric tests/parse-metric.c:196 #9 0x55f7e7124650 in test_recursion_fail tests/parse-metric.c:318 #10 0x55f7e7124650 in test__parse_metric tests/parse-metric.c:356 #11 0x55f7e70be09b in run_test tests/builtin-test.c:410 #12 0x55f7e70be09b in test_and_print tests/builtin-test.c:440 #13 0x55f7e70c101a in __cmd_test tests/builtin-test.c:661 #14 0x55f7e70c101a in cmd_test tests/builtin-test.c:807 #15 0x55f7e7126214 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312 #16 0x55f7e6fc41a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364 #17 0x55f7e6fc41a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408 #18 0x55f7e6fc41a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538 #19 0x7f4c93492cc9 in __libc_start_main ../csu/libc-start.c:308 Fixes: 83de0b7 ("perf metric: Collect referenced metrics in struct metric_ref_node") Signed-off-by: Namhyung Kim <[email protected]> Acked-by: Jiri Olsa <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Andi Kleen <[email protected]> Cc: Ian Rogers <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Stephane Eranian <[email protected]> Link: http://lore.kernel.org/lkml/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

Commit 4d00409 ("lockdep: Fix lockdep recursion") uncovered the following issue in lib/crc32test reported on s390: BUG: using __this_cpu_read() in preemptible [00000000] code: swapper/0/1 caller is lockdep_hardirqs_on_prepare+0x48/0x270 CPU: 6 PID: 1 Comm: swapper/0 Not tainted 5.9.0-next-20201015-15164-g03d992bd2de6 #19 Hardware name: IBM 3906 M04 704 (LPAR) Call Trace: lockdep_hardirqs_on_prepare+0x48/0x270 trace_hardirqs_on+0x9c/0x1b8 crc32_test.isra.0+0x170/0x1c0 crc32test_init+0x1c/0x40 do_one_initcall+0x40/0x130 do_initcalls+0x126/0x150 kernel_init_freeable+0x1f6/0x230 kernel_init+0x22/0x150 ret_from_fork+0x24/0x2c no locks held by swapper/0/1. Remove extra local_irq_disable/local_irq_enable helpers calls. Fixes: 5fb7f87 ("lib: add module support to crc32 tests") Signed-off-by: Vasily Gorbik <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Link: https://lkml.kernel.org/r/patch.git-4369da00c06e.your-ad-here.call-01602859837-ext-1679@work.hours Signed-off-by: Linus Torvalds <[email protected]>

This fix is for a failure that occurred in the DWARF unwind perf test. Stack unwinders may probe memory when looking for frames. Memory sanitizer will poison and track uninitialized memory on the stack, and on the heap if the value is copied to the heap. This can lead to false memory sanitizer failures for the use of an uninitialized value. Avoid this problem by removing the poison on the copied stack. The full msan failure with track origins looks like: ==2168==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x559ceb10755b in handle_cfi elfutils/libdwfl/frame_unwind.c:648:8 #1 0x559ceb105448 in __libdwfl_frame_unwind elfutils/libdwfl/frame_unwind.c:741:4 #2 0x559ceb0ece90 in dwfl_thread_getframes elfutils/libdwfl/dwfl_frame.c:435:7 #3 0x559ceb0ec6b7 in get_one_thread_frames_cb elfutils/libdwfl/dwfl_frame.c:379:10 #4 0x559ceb0ec6b7 in get_one_thread_cb elfutils/libdwfl/dwfl_frame.c:308:17 #5 0x559ceb0ec6b7 in dwfl_getthreads elfutils/libdwfl/dwfl_frame.c:283:17 #6 0x559ceb0ec6b7 in getthread elfutils/libdwfl/dwfl_frame.c:354:14 #7 0x559ceb0ec6b7 in dwfl_getthread_frames elfutils/libdwfl/dwfl_frame.c:388:10 #8 0x559ceaff6ae6 in unwind__get_entries tools/perf/util/unwind-libdw.c:236:8 #9 0x559ceabc9dbc in test_dwarf_unwind__thread tools/perf/tests/dwarf-unwind.c:111:8 #10 0x559ceabca5cf in test_dwarf_unwind__compare tools/perf/tests/dwarf-unwind.c:138:26 #11 0x7f812a6865b0 in bsearch (libc.so.6+0x4e5b0) #12 0x559ceabca871 in test_dwarf_unwind__krava_3 tools/perf/tests/dwarf-unwind.c:162:2 #13 0x559ceabca926 in test_dwarf_unwind__krava_2 tools/perf/tests/dwarf-unwind.c:169:9 #14 0x559ceabca946 in test_dwarf_unwind__krava_1 tools/perf/tests/dwarf-unwind.c:174:9 #15 0x559ceabcae12 in test__dwarf_unwind tools/perf/tests/dwarf-unwind.c:211:8 #16 0x559ceabbc4ab in run_test tools/perf/tests/builtin-test.c:418:9 #17 0x559ceabbc4ab in test_and_print tools/perf/tests/builtin-test.c:448:9 #18 0x559ceabbac70 in __cmd_test tools/perf/tests/builtin-test.c:669:4 #19 0x559ceabbac70 in cmd_test tools/perf/tests/builtin-test.c:815:9 #20 0x559cea960e30 in run_builtin tools/perf/perf.c:313:11 #21 0x559cea95fbce in handle_internal_command tools/perf/perf.c:365:8 #22 0x559cea95fbce in run_argv tools/perf/perf.c:409:2 #23 0x559cea95fbce in main tools/perf/perf.c:539:3 Uninitialized value was stored to memory at #0 0x559ceb106acf in __libdwfl_frame_reg_set elfutils/libdwfl/frame_unwind.c:77:22 #1 0x559ceb106acf in handle_cfi elfutils/libdwfl/frame_unwind.c:627:13 #2 0x559ceb105448 in __libdwfl_frame_unwind elfutils/libdwfl/frame_unwind.c:741:4 #3 0x559ceb0ece90 in dwfl_thread_getframes elfutils/libdwfl/dwfl_frame.c:435:7 #4 0x559ceb0ec6b7 in get_one_thread_frames_cb elfutils/libdwfl/dwfl_frame.c:379:10 #5 0x559ceb0ec6b7 in get_one_thread_cb elfutils/libdwfl/dwfl_frame.c:308:17 #6 0x559ceb0ec6b7 in dwfl_getthreads elfutils/libdwfl/dwfl_frame.c:283:17 #7 0x559ceb0ec6b7 in getthread elfutils/libdwfl/dwfl_frame.c:354:14 #8 0x559ceb0ec6b7 in dwfl_getthread_frames elfutils/libdwfl/dwfl_frame.c:388:10 #9 0x559ceaff6ae6 in unwind__get_entries tools/perf/util/unwind-libdw.c:236:8 #10 0x559ceabc9dbc in test_dwarf_unwind__thread tools/perf/tests/dwarf-unwind.c:111:8 #11 0x559ceabca5cf in test_dwarf_unwind__compare tools/perf/tests/dwarf-unwind.c:138:26 #12 0x7f812a6865b0 in bsearch (libc.so.6+0x4e5b0) #13 0x559ceabca871 in test_dwarf_unwind__krava_3 tools/perf/tests/dwarf-unwind.c:162:2 #14 0x559ceabca926 in test_dwarf_unwind__krava_2 tools/perf/tests/dwarf-unwind.c:169:9 #15 0x559ceabca946 in test_dwarf_unwind__krava_1 tools/perf/tests/dwarf-unwind.c:174:9 #16 0x559ceabcae12 in test__dwarf_unwind tools/perf/tests/dwarf-unwind.c:211:8 #17 0x559ceabbc4ab in run_test tools/perf/tests/builtin-test.c:418:9 #18 0x559ceabbc4ab in test_and_print tools/perf/tests/builtin-test.c:448:9 #19 0x559ceabbac70 in __cmd_test tools/perf/tests/builtin-test.c:669:4 #20 0x559ceabbac70 in cmd_test tools/perf/tests/builtin-test.c:815:9 #21 0x559cea960e30 in run_builtin tools/perf/perf.c:313:11 #22 0x559cea95fbce in handle_internal_command tools/perf/perf.c:365:8 #23 0x559cea95fbce in run_argv tools/perf/perf.c:409:2 #24 0x559cea95fbce in main tools/perf/perf.c:539:3 Uninitialized value was stored to memory at #0 0x559ceb106a54 in handle_cfi elfutils/libdwfl/frame_unwind.c:613:9 #1 0x559ceb105448 in __libdwfl_frame_unwind elfutils/libdwfl/frame_unwind.c:741:4 #2 0x559ceb0ece90 in dwfl_thread_getframes elfutils/libdwfl/dwfl_frame.c:435:7 #3 0x559ceb0ec6b7 in get_one_thread_frames_cb elfutils/libdwfl/dwfl_frame.c:379:10 #4 0x559ceb0ec6b7 in get_one_thread_cb elfutils/libdwfl/dwfl_frame.c:308:17 #5 0x559ceb0ec6b7 in dwfl_getthreads elfutils/libdwfl/dwfl_frame.c:283:17 #6 0x559ceb0ec6b7 in getthread elfutils/libdwfl/dwfl_frame.c:354:14 #7 0x559ceb0ec6b7 in dwfl_getthread_frames elfutils/libdwfl/dwfl_frame.c:388:10 #8 0x559ceaff6ae6 in unwind__get_entries tools/perf/util/unwind-libdw.c:236:8 #9 0x559ceabc9dbc in test_dwarf_unwind__thread tools/perf/tests/dwarf-unwind.c:111:8 #10 0x559ceabca5cf in test_dwarf_unwind__compare tools/perf/tests/dwarf-unwind.c:138:26 #11 0x7f812a6865b0 in bsearch (libc.so.6+0x4e5b0) #12 0x559ceabca871 in test_dwarf_unwind__krava_3 tools/perf/tests/dwarf-unwind.c:162:2 #13 0x559ceabca926 in test_dwarf_unwind__krava_2 tools/perf/tests/dwarf-unwind.c:169:9 #14 0x559ceabca946 in test_dwarf_unwind__krava_1 tools/perf/tests/dwarf-unwind.c:174:9 #15 0x559ceabcae12 in test__dwarf_unwind tools/perf/tests/dwarf-unwind.c:211:8 #16 0x559ceabbc4ab in run_test tools/perf/tests/builtin-test.c:418:9 #17 0x559ceabbc4ab in test_and_print tools/perf/tests/builtin-test.c:448:9 #18 0x559ceabbac70 in __cmd_test tools/perf/tests/builtin-test.c:669:4 #19 0x559ceabbac70 in cmd_test tools/perf/tests/builtin-test.c:815:9 #20 0x559cea960e30 in run_builtin tools/perf/perf.c:313:11 #21 0x559cea95fbce in handle_internal_command tools/perf/perf.c:365:8 #22 0x559cea95fbce in run_argv tools/perf/perf.c:409:2 #23 0x559cea95fbce in main tools/perf/perf.c:539:3 Uninitialized value was stored to memory at #0 0x559ceaff8800 in memory_read tools/perf/util/unwind-libdw.c:156:10 #1 0x559ceb10f053 in expr_eval elfutils/libdwfl/frame_unwind.c:501:13 #2 0x559ceb1060cc in handle_cfi elfutils/libdwfl/frame_unwind.c:603:18 #3 0x559ceb105448 in __libdwfl_frame_unwind elfutils/libdwfl/frame_unwind.c:741:4 #4 0x559ceb0ece90 in dwfl_thread_getframes elfutils/libdwfl/dwfl_frame.c:435:7 #5 0x559ceb0ec6b7 in get_one_thread_frames_cb elfutils/libdwfl/dwfl_frame.c:379:10 #6 0x559ceb0ec6b7 in get_one_thread_cb elfutils/libdwfl/dwfl_frame.c:308:17 #7 0x559ceb0ec6b7 in dwfl_getthreads elfutils/libdwfl/dwfl_frame.c:283:17 #8 0x559ceb0ec6b7 in getthread elfutils/libdwfl/dwfl_frame.c:354:14 #9 0x559ceb0ec6b7 in dwfl_getthread_frames elfutils/libdwfl/dwfl_frame.c:388:10 #10 0x559ceaff6ae6 in unwind__get_entries tools/perf/util/unwind-libdw.c:236:8 #11 0x559ceabc9dbc in test_dwarf_unwind__thread tools/perf/tests/dwarf-unwind.c:111:8 #12 0x559ceabca5cf in test_dwarf_unwind__compare tools/perf/tests/dwarf-unwind.c:138:26 #13 0x7f812a6865b0 in bsearch (libc.so.6+0x4e5b0) #14 0x559ceabca871 in test_dwarf_unwind__krava_3 tools/perf/tests/dwarf-unwind.c:162:2 #15 0x559ceabca926 in test_dwarf_unwind__krava_2 tools/perf/tests/dwarf-unwind.c:169:9 #16 0x559ceabca946 in test_dwarf_unwind__krava_1 tools/perf/tests/dwarf-unwind.c:174:9 #17 0x559ceabcae12 in test__dwarf_unwind tools/perf/tests/dwarf-unwind.c:211:8 #18 0x559ceabbc4ab in run_test tools/perf/tests/builtin-test.c:418:9 #19 0x559ceabbc4ab in test_and_print tools/perf/tests/builtin-test.c:448:9 #20 0x559ceabbac70 in __cmd_test tools/perf/tests/builtin-test.c:669:4 #21 0x559ceabbac70 in cmd_test tools/perf/tests/builtin-test.c:815:9 #22 0x559cea960e30 in run_builtin tools/perf/perf.c:313:11 #23 0x559cea95fbce in handle_internal_command tools/perf/perf.c:365:8 #24 0x559cea95fbce in run_argv tools/perf/perf.c:409:2 #25 0x559cea95fbce in main tools/perf/perf.c:539:3 Uninitialized value was stored to memory at #0 0x559cea9027d9 in __msan_memcpy llvm/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:1558:3 #1 0x559cea9d2185 in sample_ustack tools/perf/arch/x86/tests/dwarf-unwind.c:41:2 #2 0x559cea9d202c in test__arch_unwind_sample tools/perf/arch/x86/tests/dwarf-unwind.c:72:9 #3 0x559ceabc9cbd in test_dwarf_unwind__thread tools/perf/tests/dwarf-unwind.c:106:6 #4 0x559ceabca5cf in test_dwarf_unwind__compare tools/perf/tests/dwarf-unwind.c:138:26 #5 0x7f812a6865b0 in bsearch (libc.so.6+0x4e5b0) #6 0x559ceabca871 in test_dwarf_unwind__krava_3 tools/perf/tests/dwarf-unwind.c:162:2 #7 0x559ceabca926 in test_dwarf_unwind__krava_2 tools/perf/tests/dwarf-unwind.c:169:9 #8 0x559ceabca946 in test_dwarf_unwind__krava_1 tools/perf/tests/dwarf-unwind.c:174:9 #9 0x559ceabcae12 in test__dwarf_unwind tools/perf/tests/dwarf-unwind.c:211:8 #10 0x559ceabbc4ab in run_test tools/perf/tests/builtin-test.c:418:9 #11 0x559ceabbc4ab in test_and_print tools/perf/tests/builtin-test.c:448:9 #12 0x559ceabbac70 in __cmd_test tools/perf/tests/builtin-test.c:669:4 #13 0x559ceabbac70 in cmd_test tools/perf/tests/builtin-test.c:815:9 #14 0x559cea960e30 in run_builtin tools/perf/perf.c:313:11 #15 0x559cea95fbce in handle_internal_command tools/perf/perf.c:365:8 #16 0x559cea95fbce in run_argv tools/perf/perf.c:409:2 #17 0x559cea95fbce in main tools/perf/perf.c:539:3 Uninitialized value was created by an allocation of 'bf' in the stack frame of function 'perf_event__synthesize_mmap_events' #0 0x559ceafc5f60 in perf_event__synthesize_mmap_events tools/perf/util/synthetic-events.c:445 SUMMARY: MemorySanitizer: use-of-uninitialized-value elfutils/libdwfl/frame_unwind.c:648:8 in handle_cfi Signed-off-by: Ian Rogers <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: [email protected] Cc: Jiri Olsa <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Namhyung Kim <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Sandeep Dasgupta <[email protected]> Cc: Stephane Eranian <[email protected]> Link: http://lore.kernel.org/lkml/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

The memory for struct clk_bulk_data should not be static which will be written during the clk_bulk_get. It fixed below oops when loading cdns3-imx as module. [ 17.272605] Unable to handle kernel write to read-only memory at virtual address ffff8000092a5398 [ 17.299730] Mem abort info: [ 17.313542] unregister ISI channel: mxc_isi.4 [ 17.324076] ESR = 0x9600004f [ 17.344658] EC = 0x25: DABT (current EL), IL = 32 bits [ 17.402055] SET = 0, FnV = 0 [ 17.404321] mxs_phy 5b100000.usbphy: supply phy-3p0 not found, using dummy regulator [ 17.405121] EA = 0, S1PTW = 0 [ 17.405133] Data abort info: [ 17.496231] ISV = 0, ISS = 0x0000004f [ 17.510871] CM = 0, WnR = 1 [ 17.533542] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081ea5000 [ 17.545709] [ffff8000092a5398] pgd=00000008bffff003, p4d=00000008bffff003, pud=00000008bfffe003, pmd=0000000885041003, pte=006000088513b783 [ 17.573521] Internal error: Oops: 9600004f [#1] PREEMPT SMP [ 17.579113] Modules linked in: usbmisc_imx phy_mxs_usb phy_cadence_salvo cdns3_imx(+) tcpci imx8_media_dev(C) caam error [ 17.590044] CPU: 2 PID: 253 Comm: systemd-udevd Tainted: G C 5.10.0-rc4-04445-g11f3c3a29d0-dirty #19 [ 17.600488] Hardware name: Freescale i.MX8QXP MEK (DT) [ 17.605633] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--) [ 17.611662] pc : __clk_bulk_get+0x48/0x130 [ 17.615786] lr : clk_bulk_get+0x18/0x20 [ 17.619634] sp : ffff80001369b880 [ 17.622953] x29: ffff80001369b880 x28: 0000000000000013 [ 17.628277] x27: 0000000000000100 x26: ffff00080553b100 [ 17.633602] x25: ffff80001229b4d8 x24: 0000000000000000 [ 17.638928] x23: ffff000800665410 x22: 0000000000000005 [ 17.644275] x21: ffff8000092a5390 x20: ffff000800665400 [ 17.649605] x19: ffff000804e6f980 x18: 000000005b110000 [ 17.654946] x17: 0000000000000000 x16: 0000000000000000 [ 17.660274] x15: ffff800011989100 x14: 0000000000000000 [ 17.665599] x13: ffff800013ce1000 x12: ffff800013ca1000 [ 17.670924] x11: 000000005b110000 x10: 0000000000000000 [ 17.676249] x9 : ffff8000106c5a30 x8 : ffff000804e6fa00 [ 17.681575] x7 : 0000000000000000 x6 : 000000000000003f [ 17.686901] x5 : 0000000000000040 x4 : ffff80001369b8b0 [ 17.692228] x3 : ffff8000092a5398 x2 : ffff8000092a5390 [ 17.697574] x1 : ffff8000092a53e8 x0 : 0000000000000004 [ 17.702905] Call trace: [ 17.705366] __clk_bulk_get+0x48/0x130 [ 17.709125] clk_bulk_get+0x18/0x20 [ 17.712620] devm_clk_bulk_get+0x58/0xb8 [ 17.716563] cdns_imx_probe+0x84/0x1f0 [cdns3_imx] [ 17.721363] platform_drv_probe+0x58/0xa8 [ 17.725381] really_probe+0xec/0x4c8 [ 17.728967] driver_probe_device+0xf4/0x160 [ 17.733160] device_driver_attach+0x74/0x80 [ 17.737355] __driver_attach+0xa4/0x170 [ 17.741202] bus_for_each_dev+0x74/0xc8 [ 17.745043] driver_attach+0x28/0x30 [ 17.748620] bus_add_driver+0x144/0x228 [ 17.752462] driver_register+0x68/0x118 [ 17.756308] __platform_driver_register+0x4c/0x58 [ 17.761022] cdns_imx_driver_init+0x24/0x1000 [cdns3_imx] [ 17.766434] do_one_initcall+0x48/0x2c0 [ 17.770280] do_init_module+0x5c/0x220 [ 17.774029] load_module+0x210c/0x2858 [ 17.777784] __do_sys_finit_module+0xb8/0x120 [ 17.782148] __arm64_sys_finit_module+0x24/0x30 [ 17.786691] el0_svc_common.constprop.0+0x70/0x168 [ 17.791497] do_el0_svc+0x28/0x88 [ 17.794822] el0_sync_handler+0x158/0x160 [ 17.798833] el0_sync+0x140/0x180 [ 17.802158] Code: aa0203f5 91002043 8b205021 a90153f3 (f801047f) Cc: <[email protected]> Fixes: 1e056ef ("usb: cdns3: add NXP imx8qm glue layer") Signed-off-by: Peter Chen <[email protected]>

BPF programs explicitly initialise global variables to 0 to make sure clang (v10 or older) do not put the variables in the common section. Skip "initialise globals to 0" check for BPF programs to elimiate error messages like: ERROR: do not initialise globals to 0 #19: FILE: samples/bpf/tracex1_kern.c:21: Cc: Andy Whitcroft <[email protected]> Cc: Joe Perches <[email protected]> Signed-off-by: Song Liu <[email protected]>

BPF programs explicitly initialise global variables to 0 to make sure clang (v10 or older) do not put the variables in the common section. Skip "initialise globals to 0" check for BPF programs to elimiate error messages like: ERROR: do not initialise globals to 0 #19: FILE: samples/bpf/tracex1_kern.c:21: Link: https://lkml.kernel.org/r/[email protected] Signed-off-by: Song Liu <[email protected]> Acked-by: Joe Perches <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>

Calling btrfs_qgroup_reserve_meta_prealloc from btrfs_delayed_inode_reserve_metadata can result in flushing delalloc while holding a transaction and delayed node locks. This is deadlock prone. In the past multiple commits: * ae5e070 ("btrfs: qgroup: don't try to wait flushing if we're already holding a transaction") * 6f23277 ("btrfs: qgroup: don't commit transaction when we already hold the handle") Tried to solve various aspects of this but this was always a whack-a-mole game. Unfortunately those 2 fixes don't solve a deadlock scenario involving btrfs_delayed_node::mutex. Namely, one thread can call btrfs_dirty_inode as a result of reading a file and modifying its atime: PID: 6963 TASK: ffff8c7f3f94c000 CPU: 2 COMMAND: "test" #0 __schedule at ffffffffa529e07d #1 schedule at ffffffffa529e4ff #2 schedule_timeout at ffffffffa52a1bdd #3 wait_for_completion at ffffffffa529eeea <-- sleeps with delayed node mutex held #4 start_delalloc_inodes at ffffffffc0380db5 #5 btrfs_start_delalloc_snapshot at ffffffffc0393836 #6 try_flush_qgroup at ffffffffc03f04b2 #7 __btrfs_qgroup_reserve_meta at ffffffffc03f5bb6 <-- tries to reserve space and starts delalloc inodes. #8 btrfs_delayed_update_inode at ffffffffc03e31aa <-- acquires delayed node mutex #9 btrfs_update_inode at ffffffffc0385ba8 #10 btrfs_dirty_inode at ffffffffc038627b <-- TRANSACTIION OPENED #11 touch_atime at ffffffffa4cf0000 #12 generic_file_read_iter at ffffffffa4c1f123 #13 new_sync_read at ffffffffa4ccdc8a #14 vfs_read at ffffffffa4cd0849 #15 ksys_read at ffffffffa4cd0bd1 #16 do_syscall_64 at ffffffffa4a052eb #17 entry_SYSCALL_64_after_hwframe at ffffffffa540008c This will cause an asynchronous work to flush the delalloc inodes to happen which can try to acquire the same delayed_node mutex: PID: 455 TASK: ffff8c8085fa4000 CPU: 5 COMMAND: "kworker/u16:30" #0 __schedule at ffffffffa529e07d #1 schedule at ffffffffa529e4ff #2 schedule_preempt_disabled at ffffffffa529e80a #3 __mutex_lock at ffffffffa529fdcb <-- goes to sleep, never wakes up. #4 btrfs_delayed_update_inode at ffffffffc03e3143 <-- tries to acquire the mutex #5 btrfs_update_inode at ffffffffc0385ba8 <-- this is the same inode that pid 6963 is holding #6 cow_file_range_inline.constprop.78 at ffffffffc0386be7 #7 cow_file_range at ffffffffc03879c1 #8 btrfs_run_delalloc_range at ffffffffc038894c #9 writepage_delalloc at ffffffffc03a3c8f #10 __extent_writepage at ffffffffc03a4c01 #11 extent_write_cache_pages at ffffffffc03a500b #12 extent_writepages at ffffffffc03a6de2 #13 do_writepages at ffffffffa4c277eb #14 __filemap_fdatawrite_range at ffffffffa4c1e5bb #15 btrfs_run_delalloc_work at ffffffffc0380987 <-- starts running delayed nodes #16 normal_work_helper at ffffffffc03b706c #17 process_one_work at ffffffffa4aba4e4 #18 worker_thread at ffffffffa4aba6fd #19 kthread at ffffffffa4ac0a3d #20 ret_from_fork at ffffffffa54001ff To fully address those cases the complete fix is to never issue any flushing while holding the transaction or the delayed node lock. This patch achieves it by calling qgroup_reserve_meta directly which will either succeed without flushing or will fail and return -EDQUOT. In the latter case that return value is going to be propagated to btrfs_dirty_inode which will fallback to start a new transaction. That's fine as the majority of time we expect the inode will have BTRFS_DELAYED_NODE_INODE_DIRTY flag set which will result in directly copying the in-memory state. Fixes: c53e965 ("btrfs: qgroup: try to flush qgroup space when we get -EDQUOT") CC: [email protected] # 5.10+ Reviewed-by: Qu Wenruo <[email protected]> Signed-off-by: Nikolay Borisov <[email protected]> Signed-off-by: David Sterba <[email protected]>

The evlist and the cpu/thread maps should be released together. Otherwise following error was reported by Asan. Note that this test still has memory leaks in DSOs so it still fails even after this change. I'll take a look at that too. # perf test -v 26 26: Object code reading : --- start --- test child forked, pid 154184 Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. symsrc__init: cannot get elf header. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols Parsing event 'cycles' mmap size 528384B ... ================================================================= ==154184==ERROR: LeakSanitizer: detected memory leaks Direct leak of 439 byte(s) in 1 object(s) allocated from: #0 0x7fcb66e77037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 #1 0x55ad9b7e821e in dso__new_id util/dso.c:1256 #2 0x55ad9b8cfd4a in __machine__addnew_vdso util/vdso.c:132 #3 0x55ad9b8cfd4a in machine__findnew_vdso util/vdso.c:347 #4 0x55ad9b845b7e in map__new util/map.c:176 #5 0x55ad9b8415a2 in machine__process_mmap2_event util/machine.c:1787 #6 0x55ad9b8fab16 in perf_tool__process_synth_event util/synthetic-events.c:64 #7 0x55ad9b8fab16 in perf_event__synthesize_mmap_events util/synthetic-events.c:499 #8 0x55ad9b8fbfdf in __event__synthesize_thread util/synthetic-events.c:741 #9 0x55ad9b8ff3e3 in perf_event__synthesize_thread_map util/synthetic-events.c:833 #10 0x55ad9b738585 in do_test_code_reading tests/code-reading.c:608 #11 0x55ad9b73b25d in test__code_reading tests/code-reading.c:722 #12 0x55ad9b6f28fb in run_test tests/builtin-test.c:428 #13 0x55ad9b6f28fb in test_and_print tests/builtin-test.c:458 #14 0x55ad9b6f4a53 in __cmd_test tests/builtin-test.c:679 #15 0x55ad9b6f4a53 in cmd_test tests/builtin-test.c:825 #16 0x55ad9b760cc4 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:313 #17 0x55ad9b5eaa88 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:365 #18 0x55ad9b5eaa88 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:409 #19 0x55ad9b5eaa88 in main /home/namhyung/project/linux/tools/perf/perf.c:539 #20 0x7fcb669acd09 in __libc_start_main ../csu/libc-start.c:308 ... SUMMARY: AddressSanitizer: 471 byte(s) leaked in 2 allocation(s). test child finished with 1 ---- end ---- Object code reading: FAILED! Signed-off-by: Namhyung Kim <[email protected]> Acked-by: Jiri Olsa <[email protected]> Cc: Adrian Hunter <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Andi Kleen <[email protected]> Cc: Ian Rogers <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Leo Yan <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Stephane Eranian <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

Pablo Neira Ayuso says: ==================== netfilter: flowtable enhancements [ This is v2 that includes documentation enhancements, including existing limitations. This is a rebase on top on net-next. ] The following patchset augments the Netfilter flowtable fastpath to support for network topologies that combine IP forwarding, bridge, classic VLAN devices, bridge VLAN filtering, DSA and PPPoE. This includes support for the flowtable software and hardware datapaths. The following pictures provides an example scenario: fast path! .------------------------. / \ | IP forwarding | | / \ \/ | br0 wan ..... eth0 . / \ host C -> veth1 veth2 . switch/router . . eth0 host A The bridge master device 'br0' has an IP address and a DHCP server is also assumed to be running to provide connectivity to host A which reaches the Internet through 'br0' as default gateway. Then, packet enters the IP forwarding path and Netfilter is used to NAT the packets before they leave through the wan device. The general idea is to accelerate forwarding by building a fast path that takes packets from the ingress path of the bridge port and place them in the egress path of the wan device (and vice versa). Hence, skipping the classic bridge and IP stack paths. ** Patch from #1 to #6 add the infrastructure which describes the list of netdevice hops to reach a given destination MAC address in the local network topology. Patch #1 adds dev_fill_forward_path() and .ndo_fill_forward_path() to netdev_ops. Patch #2 adds .ndo_fill_forward_path for vlan devices, which provides the next device hop via vlan->real_dev, the vlan ID and the protocol. Patch #3 adds .ndo_fill_forward_path for bridge devices, which allows to make lookups to the FDB to locate the next device hop (bridge port) in the forwarding path. Patch #4 extends bridge .ndo_fill_forward_path to support for bridge VLAN filtering. Patch #5 adds .ndo_fill_forward_path for PPPoE devices. Patch #6 adds .ndo_fill_forward_path for DSA. Patches from #7 to #14 update the flowtable software datapath: Patch #7 adds the transmit path type field to the flow tuple. Two transmit paths are supported so far: the neighbour and the xfrm transmit paths. Patch #8 and #9 update the flowtable datapath to use dev_fill_forward_path() to obtain the real ingress/egress device for the flowtable datapath. This adds the new ethernet xmit direct path to the flowtable. Patch #10 adds native flowtable VLAN support (up to 2 VLAN tags) through dev_fill_forward_path(). The flowtable stores the VLAN id and protocol in the flow tuple. Patch #11 adds native flowtable bridge VLAN filter support through dev_fill_forward_path(). Patch #12 adds native flowtable bridge PPPoE through dev_fill_forward_path(). Patch #13 adds DSA support through dev_fill_forward_path(). Patch #14 extends flowtable selftests to cover for flowtable software datapath enhancements. ** Patches from #15 to #20 update the flowtable hardware offload datapath: Patch #15 extends the flowtable hardware offload to support for the direct ethernet xmit path. This also includes VLAN support. Patch #16 stores the egress real device in the flow tuple. The software flowtable datapath uses dev_hard_header() to transmit packets, hence it might refer to VLAN/DSA/PPPoE software device, not the real ethernet device. Patch #17 deals with switchdev PVID hardware offload to skip it on egress. Patch #18 adds FLOW_ACTION_PPPOE_PUSH to the flow_offload action API. Patch #19 extends the flowtable hardware offload to support for PPPoE Patch #20 adds TC_SETUP_FT support for DSA. ** Patches from #20 to #23: Felix Fietkau adds a new driver which support hardware offload for the mtk PPE engine through the existing flow offload API which supports for the flowtable enhancements coming in this batch. Patch #24 extends the documentation and describe existing limitations. Please, apply, thanks. ==================== Signed-off-by: David S. Miller <[email protected]>

I got several memory leak reports from Asan with a simple command. It was because VDSO is not released due to the refcount. Like in __dsos_addnew_id(), it should put the refcount after adding to the list. $ perf record true [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.030 MB perf.data (10 samples) ] ================================================================= ==692599==ERROR: LeakSanitizer: detected memory leaks Direct leak of 439 byte(s) in 1 object(s) allocated from: #0 0x7fea52341037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 #1 0x559bce4aa8ee in dso__new_id util/dso.c:1256 #2 0x559bce59245a in __machine__addnew_vdso util/vdso.c:132 #3 0x559bce59245a in machine__findnew_vdso util/vdso.c:347 #4 0x559bce50826c in map__new util/map.c:175 #5 0x559bce503c92 in machine__process_mmap2_event util/machine.c:1787 #6 0x559bce512f6b in machines__deliver_event util/session.c:1481 #7 0x559bce515107 in perf_session__deliver_event util/session.c:1551 #8 0x559bce51d4d2 in do_flush util/ordered-events.c:244 #9 0x559bce51d4d2 in __ordered_events__flush util/ordered-events.c:323 #10 0x559bce519bea in __perf_session__process_events util/session.c:2268 #11 0x559bce519bea in perf_session__process_events util/session.c:2297 #12 0x559bce2e7a52 in process_buildids /home/namhyung/project/linux/tools/perf/builtin-record.c:1017 #13 0x559bce2e7a52 in record__finish_output /home/namhyung/project/linux/tools/perf/builtin-record.c:1234 #14 0x559bce2ed4f6 in __cmd_record /home/namhyung/project/linux/tools/perf/builtin-record.c:2026 #15 0x559bce2ed4f6 in cmd_record /home/namhyung/project/linux/tools/perf/builtin-record.c:2858 #16 0x559bce422db4 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:313 #17 0x559bce2acac8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:365 #18 0x559bce2acac8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:409 #19 0x559bce2acac8 in main /home/namhyung/project/linux/tools/perf/perf.c:539 #20 0x7fea51e76d09 in __libc_start_main ../csu/libc-start.c:308 Indirect leak of 32 byte(s) in 1 object(s) allocated from: #0 0x7fea52341037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 #1 0x559bce520907 in nsinfo__copy util/namespaces.c:169 #2 0x559bce50821b in map__new util/map.c:168 #3 0x559bce503c92 in machine__process_mmap2_event util/machine.c:1787 #4 0x559bce512f6b in machines__deliver_event util/session.c:1481 #5 0x559bce515107 in perf_session__deliver_event util/session.c:1551 #6 0x559bce51d4d2 in do_flush util/ordered-events.c:244 #7 0x559bce51d4d2 in __ordered_events__flush util/ordered-events.c:323 #8 0x559bce519bea in __perf_session__process_events util/session.c:2268 #9 0x559bce519bea in perf_session__process_events util/session.c:2297 #10 0x559bce2e7a52 in process_buildids /home/namhyung/project/linux/tools/perf/builtin-record.c:1017 #11 0x559bce2e7a52 in record__finish_output /home/namhyung/project/linux/tools/perf/builtin-record.c:1234 #12 0x559bce2ed4f6 in __cmd_record /home/namhyung/project/linux/tools/perf/builtin-record.c:2026 #13 0x559bce2ed4f6 in cmd_record /home/namhyung/project/linux/tools/perf/builtin-record.c:2858 #14 0x559bce422db4 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:313 #15 0x559bce2acac8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:365 #16 0x559bce2acac8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:409 #17 0x559bce2acac8 in main /home/namhyung/project/linux/tools/perf/perf.c:539 #18 0x7fea51e76d09 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: 471 byte(s) leaked in 2 allocation(s). Signed-off-by: Namhyung Kim <[email protected]> Acked-by: Jiri Olsa <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Andi Kleen <[email protected]> Cc: Ian Rogers <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Peter Zijlstra <[email protected]> Link: http://lore.kernel.org/lkml/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

Debian's clang carries a patch that makes the default FPU mode 'vfp3-d16' instead of 'neon' for 'armv7-a' to avoid generating NEON instructions on hardware that does not support them: https://salsa.debian.org/pkg-llvm-team/llvm-toolchain/-/raw/5a61ca6f21b4ad8c6ac4970e5ea5a7b5b4486d22/debian/patches/clang-arm-default-vfp3-on-armv7a.patch https://bugs.debian.org/841474 https://bugs.debian.org/842142 https://bugs.debian.org/914268 This results in the following build error when clang's integrated assembler is used because the '.arch' directive overrides the '.fpu' directive: arch/arm/crypto/curve25519-core.S:25:2: error: instruction requires: NEON vmov.i32 q0, #1 ^ arch/arm/crypto/curve25519-core.S:26:2: error: instruction requires: NEON vshr.u64 q1, q0, #7 ^ arch/arm/crypto/curve25519-core.S:27:2: error: instruction requires: NEON vshr.u64 q0, q0, #8 ^ arch/arm/crypto/curve25519-core.S:28:2: error: instruction requires: NEON vmov.i32 d4, #19 ^ Shuffle the order of the '.arch' and '.fpu' directives so that the code builds regardless of the default FPU mode. This has been tested against both clang with and without Debian's patch and GCC. Cc: [email protected] Fixes: d8f1308 ("crypto: arm/curve25519 - wire up NEON implementation") Link: https://github.com/ClangBuiltLinux/continuous-integration2/issues/118 Reported-by: Arnd Bergmann <[email protected]> Suggested-by: Arnd Bergmann <[email protected]> Suggested-by: Jessica Clarke <[email protected]> Signed-off-by: Nathan Chancellor <[email protected]> Acked-by: Jason A. Donenfeld <[email protected]> Reviewed-by: Nick Desaulniers <[email protected]> Tested-by: Nick Desaulniers <[email protected]> Signed-off-by: Herbert Xu <[email protected]>

…com/bnx2x/bnx2x_stats.c Hi folks, I'm seeing an UBSAN warning when loading the bnx2x module on my Power8 machine: ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ../drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 1 PID: 3870 Comm: NetworkManager Not tainted 6.9.0-dirty kernel-patches#17 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.B3 (SV860_245) hv:phyp pSeries Call Trace: dump_stack_lvl+0x80/0xe8 (unreliable) __ubsan_handle_out_of_bounds+0xc4/0x110 bnx2x_stats_init+0x6f0/0x724 [bnx2x] bnx2x_post_irq_nic_init+0x2bc/0x51c [bnx2x] bnx2x_nic_load+0xd74/0x2de0 [bnx2x] bnx2x_open+0x194/0x310 [bnx2x] __dev_open+0x16c/0x22c __dev_change_flags+0x258/0x2f4 dev_change_flags+0x3c/0x9c do_setlink+0x35c/0x13b4 __rtnl_newlink+0x9b8/0xd88 rtnl_newlink+0x70/0xac rtnetlink_rcv_msg+0x380/0x578 netlink_rcv_skb+0x80/0x190 rtnetlink_rcv+0x28/0x3c netlink_unicast+0x2bc/0x3d4 netlink_sendmsg+0x21c/0x54c ____sys_sendmsg+0x28c/0x3c0 ___sys_sendmsg+0xcc/0x128 __sys_sendmsg+0x94/0xf4 system_call_exception+0x174/0x320 system_call_common+0x160/0x2c4 It seems there's some confusion about how many queues there should be, earlier the driver prints: [ 480.692141] bnx2x 0010:01:00.0: set number of queues to 21 But the stats array only has space for 19? Loading the driver with num_queues=18 avoids the warning. This naive patch does fix it, but is probably just papering over the issue: Full dmesg leading up to the UBSAN report below. cheers $ modprobe bnx2x [ 480.575366] bnx2x 0010:01:00.0: msix capability found [ 480.594616] bnx2x 0010:01:00.0: me reg PF num: 0 [ 480.594747] bnx2x 0010:01:00.0: This is a physical function [ 480.594754] bnx2x 0010:01:00.0: Cnic support is on [ 480.594760] bnx2x 0010:01:00.0: Max num of status blocks 31 [ 480.594766] bnx2x 0010:01:00.0: Allocated netdev with 91 tx and 31 rx queues [ 480.594781] bnx2x 0010:01:00.0: chip is in 2_PORT_MODE [ 480.594787] bnx2x 0010:01:00.0: pf_id: 0 [ 480.594792] bnx2x 0010:01:00.0: chip ID is 0x168e1000 [ 480.594802] bnx2x 0010:01:00.0: flash_size 0x200000 (2097152) [ 480.594815] bnx2x 0010:01:00.0: shmem offset 0x3c6c80 shmem2 offset 0x3c575c [ 480.594824] bnx2x 0010:01:00.0: hw_config 0x000f0001 [ 480.594831] bnx2x 0010:01:00.0: bc_ver 70A04 [ 480.594939] bnx2x 0010:01:00.0: not WoL capable [ 480.594948] bnx2x 0010:01:00.0: part number 0-0-0-0 [ 480.594963] bnx2x 0010:01:00.0: IGU Normal Mode [ 480.595077] bnx2x 0010:01:00.0: igu_dsb_id 0 igu_base_sb 1 igu_sb_cnt 31 base_fw_ndsb 1 [ 480.595086] bnx2x 0010:01:00.0: shmem2base 0x3c575c, size 412, mfcfg offset 16 [ 480.595096] bnx2x 0010:01:00.0: single function mode [ 480.595107] bnx2x 0010:01:00.0: lane_config 0x00000000 speed_cap_mask0 0x005c0000 link_config0 0x00000000 [ 480.595118] bnx2x: [bnx2x_phy_probe:12595(eth%d)]Begin phy probe [ 480.595124] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 0, actual_phy_idx 0 [ 480.595137] bnx2x: [bnx2x_populate_int_phy:12217(eth%d)]:chip_id = 0x168e1000 [ 480.595147] bnx2x: [bnx2x_populate_int_phy:12335(eth%d)]Internal phy port=0, addr=0x1, mdio_ctl=0x8000 [ 480.595162] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 0 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.595171] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 1, actual_phy_idx 1 [ 480.595184] bnx2x: [bnx2x_populate_ext_phy:12463(eth%d)]phy_type 0xd00 port 0 found in index 1 [ 480.595192] bnx2x: [bnx2x_populate_ext_phy:12465(eth%d)] addr=0x10, mdio_ctl=0x8000 [ 480.595202] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 1 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.595210] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 2, actual_phy_idx 2 [ 480.595218] bnx2x: [bnx2x_phy_probe:12658(eth%d)]End phy probe. #phys found 2 [ 480.595226] bnx2x 0010:01:00.0: phy_addr 0x1 [ 480.595231] bnx2x 0010:01:00.0: supported 0x70ec 0x0 [ 480.595237] bnx2x 0010:01:00.0: req_line_speed 0 req_duplex 1 req_flow_ctrl 0x0 advertising 0x70ec [ 480.595255] bnx2x 0010:01:00.0: max_iscsi_conn 0x0 [ 480.595265] bnx2x 0010:01:00.0: max_fcoe_conn 0x0 [ 480.595273] bnx2x 0010:01:00.0: msix_table_size 32 [ 480.595278] bnx2x 0010:01:00.0: fp_array_size 31 [ 480.595307] bnx2x 0010:01:00.0: txq_array_size 91 [ 480.632980] bnx2x 0010:01:00.0: fw_seq 0x00000007 [ 480.632994] bnx2x 0010:01:00.0: Entering Previous Unload Flow [ 480.633001] bnx2x 0010:01:00.0: No need to release hw/nvram locks [ 480.661401] bnx2x 0010:01:00.0: Common unload Flow [ 480.691399] bnx2x 0010:01:00.0: Finished Previous Unload Flow [0] [ 480.691420] bnx2x 0010:01:00.0: set bp->max_cos to 3 [ 480.691426] bnx2x 0010:01:00.0: bp->min_msix_vec_cnt 3 [ 480.692131] bnx2x 0010:01:00.0: qm_cid_count 3072 [ 480.692141] bnx2x 0010:01:00.0: set number of queues to 21 [ 480.692148] bnx2x 0010:01:00.0: msix_table[0].entry = 0 (slowpath) [ 480.692154] bnx2x 0010:01:00.0: msix_table[1].entry = 1 (CNIC) [ 480.692160] bnx2x 0010:01:00.0: msix_table[2].entry = 2 (fastpath #0) [ 480.692167] bnx2x 0010:01:00.0: msix_table[3].entry = 3 (fastpath kernel-patches#1) [ 480.692173] bnx2x 0010:01:00.0: msix_table[4].entry = 4 (fastpath kernel-patches#2) [ 480.692179] bnx2x 0010:01:00.0: msix_table[5].entry = 5 (fastpath kernel-patches#3) [ 480.692185] bnx2x 0010:01:00.0: msix_table[6].entry = 6 (fastpath kernel-patches#4) [ 480.692191] bnx2x 0010:01:00.0: msix_table[7].entry = 7 (fastpath kernel-patches#5) [ 480.692198] bnx2x 0010:01:00.0: msix_table[8].entry = 8 (fastpath kernel-patches#6) [ 480.692204] bnx2x 0010:01:00.0: msix_table[9].entry = 9 (fastpath kernel-patches#7) [ 480.692210] bnx2x 0010:01:00.0: msix_table[10].entry = 10 (fastpath kernel-patches#8) [ 480.692216] bnx2x 0010:01:00.0: msix_table[11].entry = 11 (fastpath kernel-patches#9) [ 480.692222] bnx2x 0010:01:00.0: msix_table[12].entry = 12 (fastpath kernel-patches#10) [ 480.692229] bnx2x 0010:01:00.0: msix_table[13].entry = 13 (fastpath kernel-patches#11) [ 480.692235] bnx2x 0010:01:00.0: msix_table[14].entry = 14 (fastpath kernel-patches#12) [ 480.692241] bnx2x 0010:01:00.0: msix_table[15].entry = 15 (fastpath kernel-patches#13) [ 480.692247] bnx2x 0010:01:00.0: msix_table[16].entry = 16 (fastpath kernel-patches#14) [ 480.692253] bnx2x 0010:01:00.0: msix_table[17].entry = 17 (fastpath kernel-patches#15) [ 480.692259] bnx2x 0010:01:00.0: msix_table[18].entry = 18 (fastpath kernel-patches#16) [ 480.692266] bnx2x 0010:01:00.0: msix_table[19].entry = 19 (fastpath kernel-patches#17) [ 480.692272] bnx2x 0010:01:00.0: msix_table[20].entry = 20 (fastpath kernel-patches#18) [ 480.692278] bnx2x 0010:01:00.0: msix_table[21].entry = 21 (fastpath kernel-patches#19) [ 480.700861] bnx2x 0010:01:00.0: set interrupts successfully [ 480.704240] bnx2x 0010:01:00.0: device name after netdev register eth0 [ 480.704253] bnx2x 0010:01:00.0: QLogic BCM57810 10 Gigabit Ethernet (B0) PCI-E found at mem 3fc001800000, IRQ 18, node addr 00:0a:f7:73:c1:00 [ 480.704768] bnx2x 0010:01:00.0: 32.000 Gb/s available PCIe bandwidth (5.0 GT/s PCIe x8 link) [ 480.704861] bnx2x 0010:01:00.1: msix capability found [ 480.708107] bnx2x 0010:01:00.0 enP16p1s0f0: renamed from eth0 [ 480.724224] bnx2x 0010:01:00.1: me reg PF num: 1 [ 480.724379] bnx2x 0010:01:00.1: This is a physical function [ 480.724389] bnx2x 0010:01:00.1: Cnic support is on [ 480.724396] bnx2x 0010:01:00.1: Max num of status blocks 31 [ 480.724404] bnx2x 0010:01:00.1: Allocated netdev with 91 tx and 31 rx queues [ 480.724419] bnx2x 0010:01:00.1: chip is in 2_PORT_MODE [ 480.724426] bnx2x 0010:01:00.1: pf_id: 0 [ 480.724433] bnx2x 0010:01:00.1: chip ID is 0x168e1000 [ 480.724445] bnx2x 0010:01:00.1: flash_size 0x200000 (2097152) [ 480.724461] bnx2x 0010:01:00.1: shmem offset 0x3c7640 shmem2 offset 0x3c5918 [ 480.724472] bnx2x 0010:01:00.1: hw_config 0x000f0001 [ 480.724481] bnx2x 0010:01:00.1: bc_ver 70A04 [ 480.724592] bnx2x: [bnx2x_get_load_status:4581(enP16p1s0f0)]GLOB_REG=0x00000000 [ 480.724603] bnx2x: [bnx2x_get_load_status:4585(enP16p1s0f0)]load mask for engine 1 = 0x0 [ 480.724614] bnx2x: [bnx2x_get_load_status:4581(enP16p1s0f0)]GLOB_REG=0x00000000 [ 480.724622] bnx2x: [bnx2x_get_load_status:4585(enP16p1s0f0)]load mask for engine 0 = 0x0 [ 480.724637] bnx2x: [bnx2x_nic_load:2631(enP16p1s0f0)]Starting NIC load [ 480.724645] bnx2x: [bnx2x_nic_load:2632(enP16p1s0f0)]CNIC is disabled [ 480.724652] bnx2x: [bnx2x_ilt_set_info:8658(enP16p1s0f0)]ilt client[CDU]: start 0, end 74, psz 0x8000, flags 0x2, hw psz 3 [ 480.724664] bnx2x: [bnx2x_ilt_set_info:8679(enP16p1s0f0)]ilt client[QM]: start 75, end 122, psz 0x1000, flags 0x0, hw psz 0 [ 480.724675] bnx2x: [bnx2x_ilt_set_info:8698(enP16p1s0f0)]ilt client[SRC]: start 123, end 138, psz 0x1000, flags 0x0, hw psz 0 [ 480.724688] bnx2x: [bnx2x_ilt_set_info:8715(enP16p1s0f0)]ilt client[TM]: start 139, end 143, psz 0x1000, flags 0x0, hw psz 0 [ 480.724700] bnx2x: [bnx2x_nic_load:2658(enP16p1s0f0)]num queues: 21 [ 480.724706] bnx2x 0010:01:00.1: not WoL capable [ 480.724726] bnx2x 0010:01:00.1: part number 0-0-0-0 [ 480.724768] bnx2x 0010:01:00.1: IGU Normal Mode [ 480.724939] bnx2x 0010:01:00.1: igu_dsb_id 0 igu_base_sb 1 igu_sb_cnt 31 base_fw_ndsb 1 [ 480.724972] bnx2x 0010:01:00.1: shmem2base 0x3c5918, size 412, mfcfg offset 16 [ 480.725003] bnx2x 0010:01:00.1: single function mode [ 480.725032] bnx2x 0010:01:00.1: lane_config 0x00000000 speed_cap_mask0 0x005c0000 link_config0 0x00000000 [ 480.725062] bnx2x: [bnx2x_phy_probe:12595(eth%d)]Begin phy probe [ 480.725089] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 0, actual_phy_idx 0 [ 480.725125] bnx2x: [bnx2x_populate_int_phy:12217(eth%d)]:chip_id = 0x168e1000 [ 480.725152] bnx2x: [bnx2x_populate_int_phy:12335(eth%d)]Internal phy port=0, addr=0x1, mdio_ctl=0x8000 [ 480.725193] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 0 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.725214] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 1, actual_phy_idx 1 [ 480.725226] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 0 cos 0 [ 480.725246] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 0 cos 1 [ 480.725249] bnx2x: [bnx2x_populate_ext_phy:12463(eth%d)]phy_type 0xd00 port 0 found in index 1 [ 480.725269] bnx2x: [bnx2x_populate_ext_phy:12465(eth%d)] addr=0x11, mdio_ctl=0x8000 [ 480.725270] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 0 cos 2 [ 480.725305] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 1 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.725342] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 2, actual_phy_idx 2 [ 480.725357] bnx2x: [bnx2x_phy_probe:12658(eth%d)]End phy probe. #phys found 2 [ 480.725374] bnx2x 0010:01:00.1: phy_addr 0x1 [ 480.725385] bnx2x 0010:01:00.1: supported 0x70ec 0x0 [ 480.725393] bnx2x 0010:01:00.1: req_line_speed 0 req_duplex 1 req_flow_ctrl 0x0 advertising 0x70ec [ 480.725414] bnx2x 0010:01:00.1: max_iscsi_conn 0x0 [ 480.725426] bnx2x 0010:01:00.1: max_fcoe_conn 0x0 [ 480.725434] bnx2x 0010:01:00.1: msix_table_size 32 [ 480.725441] bnx2x 0010:01:00.1: fp_array_size 31 [ 480.725472] bnx2x 0010:01:00.1: txq_array_size 91 [ 480.725489] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 1 cos 0 [ 480.725509] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 1 cos 1 [ 480.725528] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 1 cos 2 [ 480.725721] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 2 cos 0 [ 480.725746] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 2 cos 1 [ 480.725770] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 2 cos 2 [ 480.725967] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 3 cos 0 [ 480.725991] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 3 cos 1 [ 480.726010] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 3 cos 2 [ 480.726193] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 4 cos 0 [ 480.726215] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 4 cos 1 [ 480.726238] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 4 cos 2 [ 480.726412] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 5 cos 0 [ 480.726433] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 5 cos 1 [ 480.726455] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 5 cos 2 [ 480.726663] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 6 cos 0 [ 480.726688] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 6 cos 1 [ 480.726709] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 6 cos 2 [ 480.726898] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 7 cos 0 [ 480.726921] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 7 cos 1 [ 480.726941] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 7 cos 2 [ 480.727091] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 8 cos 0 [ 480.727110] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 8 cos 1 [ 480.727127] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 8 cos 2 [ 480.727299] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 9 cos 0 [ 480.727320] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 9 cos 1 [ 480.727344] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 9 cos 2 [ 480.727504] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 10 cos 0 [ 480.727523] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 10 cos 1 [ 480.727539] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 10 cos 2 [ 480.727676] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 11 cos 0 [ 480.727694] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 11 cos 1 [ 480.727710] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 11 cos 2 [ 480.727858] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 12 cos 0 [ 480.727878] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 12 cos 1 [ 480.727898] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 12 cos 2 [ 480.728071] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 13 cos 0 [ 480.728094] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 13 cos 1 [ 480.728113] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 13 cos 2 [ 480.728287] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 14 cos 0 [ 480.728309] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 14 cos 1 [ 480.728328] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 14 cos 2 [ 480.728496] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 15 cos 0 [ 480.728517] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 15 cos 1 [ 480.728536] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 15 cos 2 [ 480.728714] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 16 cos 0 [ 480.728738] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 16 cos 1 [ 480.728759] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 16 cos 2 [ 480.728940] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 17 cos 0 [ 480.728963] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 17 cos 1 [ 480.728987] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 17 cos 2 [ 480.729174] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 18 cos 0 [ 480.729199] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 18 cos 1 [ 480.729221] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 18 cos 2 [ 480.729400] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 19 cos 0 [ 480.729427] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 19 cos 1 [ 480.729450] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 19 cos 2 [ 480.731207] bnx2x: [bnx2x_set_real_num_queues:2017(enP16p1s0f0)]Setting real num queues to (tx, rx) (60, 20) [ 480.731222] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 0 to tc 0 [ 480.731231] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 1 to tc 0 [ 480.731240] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 2 to tc 0 [ 480.731248] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 3 to tc 0 [ 480.731256] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 4 to tc 0 [ 480.731264] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 5 to tc 0 [ 480.731275] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 6 to tc 0 [ 480.731283] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 7 to tc 0 [ 480.731291] bnx2x: [bnx2x_setup_tc:4309(enP16p1s0f0)]mapping tc 0 to offset 0 count 20 [ 480.731300] bnx2x: [bnx2x_setup_tc:4309(enP16p1s0f0)]mapping tc 1 to offset 20 count 20 [ 480.731310] bnx2x: [bnx2x_setup_tc:4309(enP16p1s0f0)]mapping tc 2 to offset 40 count 20 [ 480.731341] bnx2x: [bnx2x_nic_load:2717(enP16p1s0f0)]napi added [ 480.731354] bnx2x: [bnx2x_set_pf_load:4512(enP16p1s0f0)]Old GEN_REG_VAL=0x00000000 [ 480.731367] bnx2x 0010:01:00.0: fw_seq 0x00000009 [ 480.731375] bnx2x 0010:01:00.0: drv_pulse 0x17d [ 480.766791] bnx2x 0010:01:00.1: fw_seq 0x00000007 [ 480.766801] bnx2x 0010:01:00.1: Entering Previous Unload Flow [ 480.766808] bnx2x 0010:01:00.1: No need to release hw/nvram locks [ 480.791410] bnx2x 0010:01:00.1: Common unload Flow [ 480.821407] bnx2x 0010:01:00.1: Finished Previous Unload Flow [0] [ 480.821430] bnx2x 0010:01:00.1: set bp->max_cos to 3 [ 480.821437] bnx2x 0010:01:00.1: bp->min_msix_vec_cnt 3 [ 480.822071] bnx2x 0010:01:00.1: qm_cid_count 3072 [ 480.822081] bnx2x 0010:01:00.1: set number of queues to 21 [ 480.822087] bnx2x 0010:01:00.1: msix_table[0].entry = 0 (slowpath) [ 480.822093] bnx2x 0010:01:00.1: msix_table[1].entry = 1 (CNIC) [ 480.822100] bnx2x 0010:01:00.1: msix_table[2].entry = 2 (fastpath #0) [ 480.822106] bnx2x 0010:01:00.1: msix_table[3].entry = 3 (fastpath kernel-patches#1) [ 480.822113] bnx2x 0010:01:00.1: msix_table[4].entry = 4 (fastpath kernel-patches#2) [ 480.822119] bnx2x 0010:01:00.1: msix_table[5].entry = 5 (fastpath kernel-patches#3) [ 480.822125] bnx2x 0010:01:00.1: msix_table[6].entry = 6 (fastpath kernel-patches#4) [ 480.822131] bnx2x 0010:01:00.1: msix_table[7].entry = 7 (fastpath kernel-patches#5) [ 480.822137] bnx2x 0010:01:00.1: msix_table[8].entry = 8 (fastpath kernel-patches#6) [ 480.822143] bnx2x 0010:01:00.1: msix_table[9].entry = 9 (fastpath kernel-patches#7) [ 480.822149] bnx2x 0010:01:00.1: msix_table[10].entry = 10 (fastpath kernel-patches#8) [ 480.822156] bnx2x 0010:01:00.1: msix_table[11].entry = 11 (fastpath kernel-patches#9) [ 480.822162] bnx2x 0010:01:00.1: msix_table[12].entry = 12 (fastpath kernel-patches#10) [ 480.822168] bnx2x 0010:01:00.1: msix_table[13].entry = 13 (fastpath kernel-patches#11) [ 480.822174] bnx2x 0010:01:00.1: msix_table[14].entry = 14 (fastpath kernel-patches#12) [ 480.822180] bnx2x 0010:01:00.1: msix_table[15].entry = 15 (fastpath kernel-patches#13) [ 480.822187] bnx2x 0010:01:00.1: msix_table[16].entry = 16 (fastpath kernel-patches#14) [ 480.822193] bnx2x 0010:01:00.1: msix_table[17].entry = 17 (fastpath kernel-patches#15) [ 480.822199] bnx2x 0010:01:00.1: msix_table[18].entry = 18 (fastpath kernel-patches#16) [ 480.822205] bnx2x 0010:01:00.1: msix_table[19].entry = 19 (fastpath kernel-patches#17) [ 480.822211] bnx2x 0010:01:00.1: msix_table[20].entry = 20 (fastpath kernel-patches#18) [ 480.822217] bnx2x 0010:01:00.1: msix_table[21].entry = 21 (fastpath kernel-patches#19) [ 480.831471] bnx2x 0010:01:00.1: set interrupts successfully [ 480.871402] bnx2x: [bnx2x_nic_load_pmf:2445(enP16p1s0f0)]pmf 1 [ 480.871446] bnx2x 0010:01:00.0: Loading bnx2x/bnx2x-e2-7.13.21.0.fw [ 481.412444] bnx2x: [bnx2x_init_hw_func:8010(enP16p1s0f0)]NIC MODE configured [ 481.458818] bnx2x: [bnx2x_phy_probe:12595(enP16p1s0f0)]Begin phy probe [ 481.458832] bnx2x: [bnx2x_phy_probe:12608(enP16p1s0f0)]phy_config_swapped 0, phy_index 0, actual_phy_idx 0 [ 481.458844] bnx2x: [bnx2x_populate_int_phy:12217(enP16p1s0f0)]:chip_id = 0x168e1000 [ 481.458854] bnx2x: [bnx2x_populate_int_phy:12335(enP16p1s0f0)]Internal phy port=0, addr=0x1, mdio_ctl=0x8000 [ 481.458869] bnx2x: [bnx2x_phy_def_cfg:12505(enP16p1s0f0)]Default config phy idx 0 cfg 0x0 speed_cap_mask 0x5c0000 [ 481.458877] bnx2x: [bnx2x_phy_probe:12608(enP16p1s0f0)]phy_config_swapped 0, phy_index 1, actual_phy_idx 1 [ 481.458891] bnx2x: [bnx2x_populate_ext_phy:12463(enP16p1s0f0)]phy_type 0xd00 port 0 found in index 1 [ 481.458899] bnx2x: [bnx2x_populate_ext_phy:12465(enP16p1s0f0)] addr=0x10, mdio_ctl=0x8000 [ 481.458909] bnx2x: [bnx2x_phy_def_cfg:12505(enP16p1s0f0)]Default config phy idx 1 cfg 0x0 speed_cap_mask 0x5c0000 [ 481.458917] bnx2x: [bnx2x_phy_probe:12608(enP16p1s0f0)]phy_config_swapped 0, phy_index 2, actual_phy_idx 2 [ 481.458926] bnx2x: [bnx2x_phy_probe:12658(enP16p1s0f0)]End phy probe. #phys found 2 [ 481.458943] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 0, txq 0 [ 481.458950] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 20, txq 20 [ 481.458957] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 40, txq 40 [ 481.458973] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 2 [ 481.458983] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[0]: bnx2x_init_sb(00000000ee7290d5,000000003df6b04d) cl_id 2 fw_sb 2 igu_sb 2 [ 481.458995] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 1, txq 1 [ 481.459002] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 21, txq 21 [ 481.459009] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 41, txq 41 [ 481.459022] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 3 [ 481.459030] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[1]: bnx2x_init_sb(00000000ee7290d5,00000000dabca996) cl_id 3 fw_sb 3 igu_sb 3 [ 481.459040] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 2, txq 2 [ 481.459047] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 22, txq 22 [ 481.459054] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 42, txq 42 [ 481.459067] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 4 [ 481.459075] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[2]: bnx2x_init_sb(00000000ee7290d5,0000000019ec8b36) cl_id 4 fw_sb 4 igu_sb 4 [ 481.459085] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 3, txq 3 [ 481.459092] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 23, txq 23 [ 481.459098] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 43, txq 43 [ 481.459111] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 5 [ 481.459120] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[3]: bnx2x_init_sb(00000000ee7290d5,000000007b88f1d8) cl_id 5 fw_sb 5 igu_sb 5 [ 481.459130] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 4, txq 4 [ 481.459136] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 24, txq 24 [ 481.459143] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 44, txq 44 [ 481.459156] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 6 [ 481.459164] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[4]: bnx2x_init_sb(00000000ee7290d5,00000000b0b1373f) cl_id 6 fw_sb 6 igu_sb 6 [ 481.459174] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 5, txq 5 [ 481.459180] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 25, txq 25 [ 481.459187] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 45, txq 45 [ 481.459200] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 7 [ 481.459208] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[5]: bnx2x_init_sb(00000000ee7290d5,00000000e4e707c3) cl_id 7 fw_sb 7 igu_sb 7 [ 481.459218] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 6, txq 6 [ 481.459225] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 26, txq 26 [ 481.459231] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 46, txq 46 [ 481.459244] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 8 [ 481.459252] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[6]: bnx2x_init_sb(00000000ee7290d5,000000009a9c8fce) cl_id 8 fw_sb 8 igu_sb 8 [ 481.459262] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 7, txq 7 [ 481.459269] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 27, txq 27 [ 481.459276] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 47, txq 47 [ 481.459288] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 9 [ 481.459297] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[7]: bnx2x_init_sb(00000000ee7290d5,0000000014c7da0e) cl_id 9 fw_sb 9 igu_sb 9 [ 481.459307] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 8, txq 8 [ 481.459313] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 28, txq 28 [ 481.459320] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 48, txq 48 [ 481.459333] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 10 [ 481.459341] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[8]: bnx2x_init_sb(00000000ee7290d5,00000000d73bba50) cl_id 10 fw_sb 10 igu_sb 10 [ 481.459351] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 9, txq 9 [ 481.459358] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 29, txq 29 [ 481.459364] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 49, txq 49 [ 481.459377] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 11 [ 481.459386] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[9]: bnx2x_init_sb(00000000ee7290d5,00000000b847ea06) cl_id 11 fw_sb 11 igu_sb 11 [ 481.459396] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 10, txq 10 [ 481.459403] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 30, txq 30 [ 481.459409] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 50, txq 50 [ 481.459422] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 12 [ 481.459430] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[10]: bnx2x_init_sb(00000000ee7290d5,00000000196303a5) cl_id 12 fw_sb 12 igu_sb 12 [ 481.459440] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 11, txq 11 [ 481.459447] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 31, txq 31 [ 481.459453] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 51, txq 51 [ 481.459466] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 13 [ 481.459474] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[11]: bnx2x_init_sb(00000000ee7290d5,0000000066bd5df6) cl_id 13 fw_sb 13 igu_sb 13 [ 481.459484] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 12, txq 12 [ 481.459491] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 32, txq 32 [ 481.459497] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 52, txq 52 [ 481.459510] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 14 [ 481.459518] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[12]: bnx2x_init_sb(00000000ee7290d5,00000000cf0dcd91) cl_id 14 fw_sb 14 igu_sb 14 [ 481.459528] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 13, txq 13 [ 481.459535] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 33, txq 33 [ 481.459541] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 53, txq 53 [ 481.459554] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 15 [ 481.459562] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[13]: bnx2x_init_sb(00000000ee7290d5,0000000036d63708) cl_id 15 fw_sb 15 igu_sb 15 [ 481.459572] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 14, txq 14 [ 481.459579] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 34, txq 34 [ 481.459585] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 54, txq 54 [ 481.459598] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 16 [ 481.459606] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[14]: bnx2x_init_sb(00000000ee7290d5,0000000078b37957) cl_id 16 fw_sb 16 igu_sb 16 [ 481.459616] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 15, txq 15 [ 481.459623] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 35, txq 35 [ 481.459629] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 55, txq 55 [ 481.459642] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 17 [ 481.459650] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[15]: bnx2x_init_sb(00000000ee7290d5,00000000f04248ff) cl_id 17 fw_sb 17 igu_sb 17 [ 481.459660] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 16, txq 16 [ 481.459667] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 36, txq 36 [ 481.459674] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 56, txq 56 [ 481.459686] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 18 [ 481.459695] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[16]: bnx2x_init_sb(00000000ee7290d5,00000000a20333ee) cl_id 18 fw_sb 18 igu_sb 18 [ 481.459705] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 17, txq 17 [ 481.459711] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 37, txq 37 [ 481.459718] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 57, txq 57 [ 481.459730] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 19 [ 481.459739] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[17]: bnx2x_init_sb(00000000ee7290d5,00000000d5c15823) cl_id 19 fw_sb 19 igu_sb 19 [ 481.459749] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 18, txq 18 [ 481.459755] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 38, txq 38 [ 481.459762] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 58, txq 58 [ 481.459775] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 20 [ 481.459783] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[18]: bnx2x_init_sb(00000000ee7290d5,000000001b9fe542) cl_id 20 fw_sb 20 igu_sb 20 [ 481.459793] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 19, txq 19 [ 481.459800] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 39, txq 39 [ 481.459806] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 59, txq 59 [ 481.459819] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 21 [ 481.459827] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[19]: bnx2x_init_sb(00000000ee7290d5,000000007f29c48b) cl_id 21 fw_sb 21 igu_sb 21 [ 481.459837] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.459929] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460025] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460124] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460218] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460311] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460411] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460505] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460598] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460697] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460792] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460885] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460984] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461078] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461171] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461270] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461363] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461532] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461650] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461744] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461859] bnx2x: [bnx2x_get_mod_abs_int_cfg:4351(enP16p1s0f0)]No cfg pin 0 for module detect indication [ 481.464004] bnx2x 0010:01:00.0 enP16p1s0f0: using MSI-X IRQs: sp 69 fp[0] 73 ... fp[19] 111 [ 481.464352] bnx2x: [bnx2x_cmng_fns_init:2601(enP16p1s0f0)]rate shaping and fairness are disabled [ 481.464373] ------------[ cut here ]------------ [ 481.464378] UBSAN: array-index-out-of-bounds in ../drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 [ 481.464387] index 20 is out of range for type 'stats_query_entry [19]' [ 481.464395] CPU: 1 PID: 3870 Comm: NetworkManager Not tainted 6.9.0-dirty kernel-patches#17 [ 481.464403] Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.B3 (SV860_245) hv:phyp pSeries [ 481.464412] Call Trace: [ 481.464416] [c000001fc4462d30] [c000000001441188] dump_stack_lvl+0x80/0xe8 (unreliable) [ 481.464432] [c000001fc4462d60] [c000000000c1a678] __ubsan_handle_out_of_bounds+0xc4/0x110 [ 481.464447] [c000001fc4462e10] [c008000025dafcb4] bnx2x_stats_init+0x6f0/0x724 [bnx2x] [ 481.464547] [c000001fc4462eb0] [c008000025d4e72c] bnx2x_post_irq_nic_init+0x2bc/0x51c [bnx2x] [ 481.464641] [c000001fc4462f50] [c008000025d9a7b8] bnx2x_nic_load+0xd74/0x2de0 [bnx2x] [ 481.464736] [c000001fc44630e0] [c008000025d4cb20] bnx2x_open+0x194/0x310 [bnx2x] [ 481.464828] [c000001fc4463170] [c00000000116e2b8] __dev_open+0x16c/0x22c [ 481.464840] [c000001fc4463210] [c00000000116e9ac] __dev_change_flags+0x258/0x2f4 [ 481.464852] [c000001fc44632c0] [c00000000116ea84] dev_change_flags+0x3c/0x9c [ 481.464863] [c000001fc4463300] [c000000001187cc4] do_setlink+0x35c/0x13b4 [ 481.464873] [c000001fc44634a0] [c00000000118fb88] __rtnl_newlink+0x9b8/0xd88 [ 481.464885] [c000001fc4463630] [c00000000118ffc8] rtnl_newlink+0x70/0xac [ 481.464895] [c000001fc4463670] [c000000001185e60] rtnetlink_rcv_msg+0x380/0x578 [ 481.464906] [c000001fc4463720] [c000000001217be4] netlink_rcv_skb+0x80/0x190 [ 481.464918] [c000001fc44637f0] [c00000000118321c] rtnetlink_rcv+0x28/0x3c [ 481.464928] [c000001fc4463810] [c000000001216ef8] netlink_unicast+0x2bc/0x3d4 [ 481.464940] [c000001fc4463880] [c00000000121722c] netlink_sendmsg+0x21c/0x54c [ 481.464951] [c000001fc4463970] [c00000000112461c] ____sys_sendmsg+0x28c/0x3c0 [ 481.464963] [c000001fc4463a00] [c00000000112763c] ___sys_sendmsg+0xcc/0x128 [ 481.464972] [c000001fc4463b70] [c000000001127d98] __sys_sendmsg+0x94/0xf4 [ 481.464980] [c000001fc4463c30] [c000000000030304] system_call_exception+0x174/0x320 [ 481.464992] [c000001fc4463e50] [c00000000000d520] system_call_common+0x160/0x2c4 [ 481.465003] --- interrupt: c00 at 0x7ffcfe5b6504 [ 481.465011] NIP: 00007ffcfe5b6504 LR: 00007ffcfe5b64dc CTR: 0000000000000000 [ 481.465017] REGS: c000001fc4463e80 TRAP: 0c00 Not tainted (6.9.0-dirty) [ 481.465025] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22084440 XER: 00000000 [ 481.465049] IRQMASK: 0 GPR00: 0000000000000155 00007ffff91154a0 00007ffcfe6b6f00 000000000000000d GPR04: 00007ffff9115510 0000000000000000 0000000000000020 00007ffcfcbfe800 GPR08: 00007ffcfcbf7148 0000000000000000 0000000000000000 0000000000000000 GPR12: 0000000000000000 00007ffcfcbfe800 00007ffcfe8f06b4 0000000000000000 GPR16: 00007ffff9115e90 00000001717e2748 000001002bce10e0 000001002bd96850 GPR20: 000001002bcc647c 00000001717416f8 0000000000000000 00007ffff911576c GPR24: 00007ffff9115778 0000000000000000 0000000000000000 0000000000000000 GPR28: 0000000000000000 00007ffff9115510 0000000000000000 000000000000000d [ 481.465135] NIP [00007ffcfe5b6504] 0x7ffcfe5b6504 [ 481.465141] LR [00007ffcfe5b64dc] 0x7ffcfe5b64dc [ 481.465147] --- interrupt: c00 [ 481.465151] ---[ end trace ]--- [ 481.467183] bnx2x: [bnx2x_igu_int_enable:1666(enP16p1s0f0)]write 0xb to IGU mode MSI-X [ 481.467254] bnx2x: [bnx2x_eq_int:5592(enP16p1s0f0)]got FUNC_START ramrod Signed-off-by: NipaLocal <nipa@local>

ui_browser__show() is capturing the input title that is stack allocated memory in hist_browser__run(). Avoid a use after return by strdup-ing the string. Committer notes: Further explanation from Ian Rogers: My command line using tui is: $ sudo bash -c 'rm /tmp/asan.log*; export ASAN_OPTIONS="log_path=/tmp/asan.log"; /tmp/perf/perf mem record -a sleep 1; /tmp/perf/perf mem report' I then go to the perf annotate view and quit. This triggers the asan error (from the log file): ``` ==1254591==ERROR: AddressSanitizer: stack-use-after-return on address 0x7f2813331920 at pc 0x7f28180 65991 bp 0x7fff0a21c750 sp 0x7fff0a21bf10 READ of size 80 at 0x7f2813331920 thread T0 #0 0x7f2818065990 in __interceptor_strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:461 #1 0x7f2817698251 in SLsmg_write_wrapped_string (/lib/x86_64-linux-gnu/libslang.so.2+0x98251) #2 0x7f28176984b9 in SLsmg_write_nstring (/lib/x86_64-linux-gnu/libslang.so.2+0x984b9) #3 0x55c94045b365 in ui_browser__write_nstring ui/browser.c:60 #4 0x55c94045c558 in __ui_browser__show_title ui/browser.c:266 #5 0x55c94045c776 in ui_browser__show ui/browser.c:288 #6 0x55c94045c06d in ui_browser__handle_resize ui/browser.c:206 #7 0x55c94047979b in do_annotate ui/browsers/hists.c:2458 #8 0x55c94047fb17 in evsel__hists_browse ui/browsers/hists.c:3412 #9 0x55c940480a0c in perf_evsel_menu__run ui/browsers/hists.c:3527 #10 0x55c940481108 in __evlist__tui_browse_hists ui/browsers/hists.c:3613 #11 0x55c9404813f7 in evlist__tui_browse_hists ui/browsers/hists.c:3661 #12 0x55c93ffa253f in report__browse_hists tools/perf/builtin-report.c:671 #13 0x55c93ffa58ca in __cmd_report tools/perf/builtin-report.c:1141 #14 0x55c93ffaf159 in cmd_report tools/perf/builtin-report.c:1805 #15 0x55c94000c05c in report_events tools/perf/builtin-mem.c:374 #16 0x55c94000d96d in cmd_mem tools/perf/builtin-mem.c:516 #17 0x55c9400e44ee in run_builtin tools/perf/perf.c:350 #18 0x55c9400e4a5a in handle_internal_command tools/perf/perf.c:403 #19 0x55c9400e4e22 in run_argv tools/perf/perf.c:447 #20 0x55c9400e53ad in main tools/perf/perf.c:561 #21 0x7f28170456c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #22 0x7f2817045784 in __libc_start_main_impl ../csu/libc-start.c:360 #23 0x55c93ff544c0 in _start (/tmp/perf/perf+0x19a4c0) (BuildId: 84899b0e8c7d3a3eaa67b2eb35e3d8b2f8cd4c93) Address 0x7f2813331920 is located in stack of thread T0 at offset 32 in frame #0 0x55c94046e85e in hist_browser__run ui/browsers/hists.c:746 This frame has 1 object(s): [32, 192) 'title' (line 747) <== Memory access at offset 32 is inside this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork ``` hist_browser__run isn't on the stack so the asan error looks legit. There's no clean init/exit on struct ui_browser so I may be trading a use-after-return for a memory leak, but that seems look a good trade anyway. Fixes: 05e8b08 ("perf ui browser: Stop using 'self'") Signed-off-by: Ian Rogers <[email protected]> Cc: Adrian Hunter <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Andi Kleen <[email protected]> Cc: Athira Rajeev <[email protected]> Cc: Ben Gainey <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: James Clark <[email protected]> Cc: Jiri Olsa <[email protected]> Cc: Kajol Jain <[email protected]> Cc: Kan Liang <[email protected]> Cc: K Prateek Nayak <[email protected]> Cc: Li Dong <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Namhyung Kim <[email protected]> Cc: Oliver Upton <[email protected]> Cc: Paran Lee <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Ravi Bangoria <[email protected]> Cc: Sun Haiyong <[email protected]> Cc: Tim Chen <[email protected]> Cc: Yanteng Si <[email protected]> Cc: Yicong Yang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

…com/bnx2x/bnx2x_stats.c Hi folks, I'm seeing an UBSAN warning when loading the bnx2x module on my Power8 machine: ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in ../drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 1 PID: 3870 Comm: NetworkManager Not tainted 6.9.0-dirty kernel-patches#17 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.B3 (SV860_245) hv:phyp pSeries Call Trace: dump_stack_lvl+0x80/0xe8 (unreliable) __ubsan_handle_out_of_bounds+0xc4/0x110 bnx2x_stats_init+0x6f0/0x724 [bnx2x] bnx2x_post_irq_nic_init+0x2bc/0x51c [bnx2x] bnx2x_nic_load+0xd74/0x2de0 [bnx2x] bnx2x_open+0x194/0x310 [bnx2x] __dev_open+0x16c/0x22c __dev_change_flags+0x258/0x2f4 dev_change_flags+0x3c/0x9c do_setlink+0x35c/0x13b4 __rtnl_newlink+0x9b8/0xd88 rtnl_newlink+0x70/0xac rtnetlink_rcv_msg+0x380/0x578 netlink_rcv_skb+0x80/0x190 rtnetlink_rcv+0x28/0x3c netlink_unicast+0x2bc/0x3d4 netlink_sendmsg+0x21c/0x54c ____sys_sendmsg+0x28c/0x3c0 ___sys_sendmsg+0xcc/0x128 __sys_sendmsg+0x94/0xf4 system_call_exception+0x174/0x320 system_call_common+0x160/0x2c4 It seems there's some confusion about how many queues there should be, earlier the driver prints: [ 480.692141] bnx2x 0010:01:00.0: set number of queues to 21 But the stats array only has space for 19? Loading the driver with num_queues=18 avoids the warning. This naive patch does fix it, but is probably just papering over the issue: Full dmesg leading up to the UBSAN report below. cheers $ modprobe bnx2x [ 480.575366] bnx2x 0010:01:00.0: msix capability found [ 480.594616] bnx2x 0010:01:00.0: me reg PF num: 0 [ 480.594747] bnx2x 0010:01:00.0: This is a physical function [ 480.594754] bnx2x 0010:01:00.0: Cnic support is on [ 480.594760] bnx2x 0010:01:00.0: Max num of status blocks 31 [ 480.594766] bnx2x 0010:01:00.0: Allocated netdev with 91 tx and 31 rx queues [ 480.594781] bnx2x 0010:01:00.0: chip is in 2_PORT_MODE [ 480.594787] bnx2x 0010:01:00.0: pf_id: 0 [ 480.594792] bnx2x 0010:01:00.0: chip ID is 0x168e1000 [ 480.594802] bnx2x 0010:01:00.0: flash_size 0x200000 (2097152) [ 480.594815] bnx2x 0010:01:00.0: shmem offset 0x3c6c80 shmem2 offset 0x3c575c [ 480.594824] bnx2x 0010:01:00.0: hw_config 0x000f0001 [ 480.594831] bnx2x 0010:01:00.0: bc_ver 70A04 [ 480.594939] bnx2x 0010:01:00.0: not WoL capable [ 480.594948] bnx2x 0010:01:00.0: part number 0-0-0-0 [ 480.594963] bnx2x 0010:01:00.0: IGU Normal Mode [ 480.595077] bnx2x 0010:01:00.0: igu_dsb_id 0 igu_base_sb 1 igu_sb_cnt 31 base_fw_ndsb 1 [ 480.595086] bnx2x 0010:01:00.0: shmem2base 0x3c575c, size 412, mfcfg offset 16 [ 480.595096] bnx2x 0010:01:00.0: single function mode [ 480.595107] bnx2x 0010:01:00.0: lane_config 0x00000000 speed_cap_mask0 0x005c0000 link_config0 0x00000000 [ 480.595118] bnx2x: [bnx2x_phy_probe:12595(eth%d)]Begin phy probe [ 480.595124] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 0, actual_phy_idx 0 [ 480.595137] bnx2x: [bnx2x_populate_int_phy:12217(eth%d)]:chip_id = 0x168e1000 [ 480.595147] bnx2x: [bnx2x_populate_int_phy:12335(eth%d)]Internal phy port=0, addr=0x1, mdio_ctl=0x8000 [ 480.595162] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 0 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.595171] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 1, actual_phy_idx 1 [ 480.595184] bnx2x: [bnx2x_populate_ext_phy:12463(eth%d)]phy_type 0xd00 port 0 found in index 1 [ 480.595192] bnx2x: [bnx2x_populate_ext_phy:12465(eth%d)] addr=0x10, mdio_ctl=0x8000 [ 480.595202] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 1 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.595210] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 2, actual_phy_idx 2 [ 480.595218] bnx2x: [bnx2x_phy_probe:12658(eth%d)]End phy probe. #phys found 2 [ 480.595226] bnx2x 0010:01:00.0: phy_addr 0x1 [ 480.595231] bnx2x 0010:01:00.0: supported 0x70ec 0x0 [ 480.595237] bnx2x 0010:01:00.0: req_line_speed 0 req_duplex 1 req_flow_ctrl 0x0 advertising 0x70ec [ 480.595255] bnx2x 0010:01:00.0: max_iscsi_conn 0x0 [ 480.595265] bnx2x 0010:01:00.0: max_fcoe_conn 0x0 [ 480.595273] bnx2x 0010:01:00.0: msix_table_size 32 [ 480.595278] bnx2x 0010:01:00.0: fp_array_size 31 [ 480.595307] bnx2x 0010:01:00.0: txq_array_size 91 [ 480.632980] bnx2x 0010:01:00.0: fw_seq 0x00000007 [ 480.632994] bnx2x 0010:01:00.0: Entering Previous Unload Flow [ 480.633001] bnx2x 0010:01:00.0: No need to release hw/nvram locks [ 480.661401] bnx2x 0010:01:00.0: Common unload Flow [ 480.691399] bnx2x 0010:01:00.0: Finished Previous Unload Flow [0] [ 480.691420] bnx2x 0010:01:00.0: set bp->max_cos to 3 [ 480.691426] bnx2x 0010:01:00.0: bp->min_msix_vec_cnt 3 [ 480.692131] bnx2x 0010:01:00.0: qm_cid_count 3072 [ 480.692141] bnx2x 0010:01:00.0: set number of queues to 21 [ 480.692148] bnx2x 0010:01:00.0: msix_table[0].entry = 0 (slowpath) [ 480.692154] bnx2x 0010:01:00.0: msix_table[1].entry = 1 (CNIC) [ 480.692160] bnx2x 0010:01:00.0: msix_table[2].entry = 2 (fastpath #0) [ 480.692167] bnx2x 0010:01:00.0: msix_table[3].entry = 3 (fastpath kernel-patches#1) [ 480.692173] bnx2x 0010:01:00.0: msix_table[4].entry = 4 (fastpath kernel-patches#2) [ 480.692179] bnx2x 0010:01:00.0: msix_table[5].entry = 5 (fastpath kernel-patches#3) [ 480.692185] bnx2x 0010:01:00.0: msix_table[6].entry = 6 (fastpath kernel-patches#4) [ 480.692191] bnx2x 0010:01:00.0: msix_table[7].entry = 7 (fastpath kernel-patches#5) [ 480.692198] bnx2x 0010:01:00.0: msix_table[8].entry = 8 (fastpath kernel-patches#6) [ 480.692204] bnx2x 0010:01:00.0: msix_table[9].entry = 9 (fastpath kernel-patches#7) [ 480.692210] bnx2x 0010:01:00.0: msix_table[10].entry = 10 (fastpath kernel-patches#8) [ 480.692216] bnx2x 0010:01:00.0: msix_table[11].entry = 11 (fastpath kernel-patches#9) [ 480.692222] bnx2x 0010:01:00.0: msix_table[12].entry = 12 (fastpath kernel-patches#10) [ 480.692229] bnx2x 0010:01:00.0: msix_table[13].entry = 13 (fastpath kernel-patches#11) [ 480.692235] bnx2x 0010:01:00.0: msix_table[14].entry = 14 (fastpath kernel-patches#12) [ 480.692241] bnx2x 0010:01:00.0: msix_table[15].entry = 15 (fastpath kernel-patches#13) [ 480.692247] bnx2x 0010:01:00.0: msix_table[16].entry = 16 (fastpath kernel-patches#14) [ 480.692253] bnx2x 0010:01:00.0: msix_table[17].entry = 17 (fastpath kernel-patches#15) [ 480.692259] bnx2x 0010:01:00.0: msix_table[18].entry = 18 (fastpath kernel-patches#16) [ 480.692266] bnx2x 0010:01:00.0: msix_table[19].entry = 19 (fastpath kernel-patches#17) [ 480.692272] bnx2x 0010:01:00.0: msix_table[20].entry = 20 (fastpath kernel-patches#18) [ 480.692278] bnx2x 0010:01:00.0: msix_table[21].entry = 21 (fastpath kernel-patches#19) [ 480.700861] bnx2x 0010:01:00.0: set interrupts successfully [ 480.704240] bnx2x 0010:01:00.0: device name after netdev register eth0 [ 480.704253] bnx2x 0010:01:00.0: QLogic BCM57810 10 Gigabit Ethernet (B0) PCI-E found at mem 3fc001800000, IRQ 18, node addr 00:0a:f7:73:c1:00 [ 480.704768] bnx2x 0010:01:00.0: 32.000 Gb/s available PCIe bandwidth (5.0 GT/s PCIe x8 link) [ 480.704861] bnx2x 0010:01:00.1: msix capability found [ 480.708107] bnx2x 0010:01:00.0 enP16p1s0f0: renamed from eth0 [ 480.724224] bnx2x 0010:01:00.1: me reg PF num: 1 [ 480.724379] bnx2x 0010:01:00.1: This is a physical function [ 480.724389] bnx2x 0010:01:00.1: Cnic support is on [ 480.724396] bnx2x 0010:01:00.1: Max num of status blocks 31 [ 480.724404] bnx2x 0010:01:00.1: Allocated netdev with 91 tx and 31 rx queues [ 480.724419] bnx2x 0010:01:00.1: chip is in 2_PORT_MODE [ 480.724426] bnx2x 0010:01:00.1: pf_id: 0 [ 480.724433] bnx2x 0010:01:00.1: chip ID is 0x168e1000 [ 480.724445] bnx2x 0010:01:00.1: flash_size 0x200000 (2097152) [ 480.724461] bnx2x 0010:01:00.1: shmem offset 0x3c7640 shmem2 offset 0x3c5918 [ 480.724472] bnx2x 0010:01:00.1: hw_config 0x000f0001 [ 480.724481] bnx2x 0010:01:00.1: bc_ver 70A04 [ 480.724592] bnx2x: [bnx2x_get_load_status:4581(enP16p1s0f0)]GLOB_REG=0x00000000 [ 480.724603] bnx2x: [bnx2x_get_load_status:4585(enP16p1s0f0)]load mask for engine 1 = 0x0 [ 480.724614] bnx2x: [bnx2x_get_load_status:4581(enP16p1s0f0)]GLOB_REG=0x00000000 [ 480.724622] bnx2x: [bnx2x_get_load_status:4585(enP16p1s0f0)]load mask for engine 0 = 0x0 [ 480.724637] bnx2x: [bnx2x_nic_load:2631(enP16p1s0f0)]Starting NIC load [ 480.724645] bnx2x: [bnx2x_nic_load:2632(enP16p1s0f0)]CNIC is disabled [ 480.724652] bnx2x: [bnx2x_ilt_set_info:8658(enP16p1s0f0)]ilt client[CDU]: start 0, end 74, psz 0x8000, flags 0x2, hw psz 3 [ 480.724664] bnx2x: [bnx2x_ilt_set_info:8679(enP16p1s0f0)]ilt client[QM]: start 75, end 122, psz 0x1000, flags 0x0, hw psz 0 [ 480.724675] bnx2x: [bnx2x_ilt_set_info:8698(enP16p1s0f0)]ilt client[SRC]: start 123, end 138, psz 0x1000, flags 0x0, hw psz 0 [ 480.724688] bnx2x: [bnx2x_ilt_set_info:8715(enP16p1s0f0)]ilt client[TM]: start 139, end 143, psz 0x1000, flags 0x0, hw psz 0 [ 480.724700] bnx2x: [bnx2x_nic_load:2658(enP16p1s0f0)]num queues: 21 [ 480.724706] bnx2x 0010:01:00.1: not WoL capable [ 480.724726] bnx2x 0010:01:00.1: part number 0-0-0-0 [ 480.724768] bnx2x 0010:01:00.1: IGU Normal Mode [ 480.724939] bnx2x 0010:01:00.1: igu_dsb_id 0 igu_base_sb 1 igu_sb_cnt 31 base_fw_ndsb 1 [ 480.724972] bnx2x 0010:01:00.1: shmem2base 0x3c5918, size 412, mfcfg offset 16 [ 480.725003] bnx2x 0010:01:00.1: single function mode [ 480.725032] bnx2x 0010:01:00.1: lane_config 0x00000000 speed_cap_mask0 0x005c0000 link_config0 0x00000000 [ 480.725062] bnx2x: [bnx2x_phy_probe:12595(eth%d)]Begin phy probe [ 480.725089] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 0, actual_phy_idx 0 [ 480.725125] bnx2x: [bnx2x_populate_int_phy:12217(eth%d)]:chip_id = 0x168e1000 [ 480.725152] bnx2x: [bnx2x_populate_int_phy:12335(eth%d)]Internal phy port=0, addr=0x1, mdio_ctl=0x8000 [ 480.725193] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 0 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.725214] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 1, actual_phy_idx 1 [ 480.725226] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 0 cos 0 [ 480.725246] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 0 cos 1 [ 480.725249] bnx2x: [bnx2x_populate_ext_phy:12463(eth%d)]phy_type 0xd00 port 0 found in index 1 [ 480.725269] bnx2x: [bnx2x_populate_ext_phy:12465(eth%d)] addr=0x11, mdio_ctl=0x8000 [ 480.725270] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 0 cos 2 [ 480.725305] bnx2x: [bnx2x_phy_def_cfg:12505(eth%d)]Default config phy idx 1 cfg 0x0 speed_cap_mask 0x5c0000 [ 480.725342] bnx2x: [bnx2x_phy_probe:12608(eth%d)]phy_config_swapped 0, phy_index 2, actual_phy_idx 2 [ 480.725357] bnx2x: [bnx2x_phy_probe:12658(eth%d)]End phy probe. #phys found 2 [ 480.725374] bnx2x 0010:01:00.1: phy_addr 0x1 [ 480.725385] bnx2x 0010:01:00.1: supported 0x70ec 0x0 [ 480.725393] bnx2x 0010:01:00.1: req_line_speed 0 req_duplex 1 req_flow_ctrl 0x0 advertising 0x70ec [ 480.725414] bnx2x 0010:01:00.1: max_iscsi_conn 0x0 [ 480.725426] bnx2x 0010:01:00.1: max_fcoe_conn 0x0 [ 480.725434] bnx2x 0010:01:00.1: msix_table_size 32 [ 480.725441] bnx2x 0010:01:00.1: fp_array_size 31 [ 480.725472] bnx2x 0010:01:00.1: txq_array_size 91 [ 480.725489] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 1 cos 0 [ 480.725509] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 1 cos 1 [ 480.725528] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 1 cos 2 [ 480.725721] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 2 cos 0 [ 480.725746] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 2 cos 1 [ 480.725770] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 2 cos 2 [ 480.725967] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 3 cos 0 [ 480.725991] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 3 cos 1 [ 480.726010] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 3 cos 2 [ 480.726193] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 4 cos 0 [ 480.726215] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 4 cos 1 [ 480.726238] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 4 cos 2 [ 480.726412] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 5 cos 0 [ 480.726433] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 5 cos 1 [ 480.726455] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 5 cos 2 [ 480.726663] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 6 cos 0 [ 480.726688] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 6 cos 1 [ 480.726709] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 6 cos 2 [ 480.726898] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 7 cos 0 [ 480.726921] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 7 cos 1 [ 480.726941] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 7 cos 2 [ 480.727091] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 8 cos 0 [ 480.727110] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 8 cos 1 [ 480.727127] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 8 cos 2 [ 480.727299] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 9 cos 0 [ 480.727320] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 9 cos 1 [ 480.727344] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 9 cos 2 [ 480.727504] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 10 cos 0 [ 480.727523] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 10 cos 1 [ 480.727539] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 10 cos 2 [ 480.727676] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 11 cos 0 [ 480.727694] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 11 cos 1 [ 480.727710] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 11 cos 2 [ 480.727858] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 12 cos 0 [ 480.727878] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 12 cos 1 [ 480.727898] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 12 cos 2 [ 480.728071] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 13 cos 0 [ 480.728094] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 13 cos 1 [ 480.728113] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 13 cos 2 [ 480.728287] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 14 cos 0 [ 480.728309] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 14 cos 1 [ 480.728328] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 14 cos 2 [ 480.728496] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 15 cos 0 [ 480.728517] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 15 cos 1 [ 480.728536] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 15 cos 2 [ 480.728714] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 16 cos 0 [ 480.728738] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 16 cos 1 [ 480.728759] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 16 cos 2 [ 480.728940] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 17 cos 0 [ 480.728963] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 17 cos 1 [ 480.728987] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 17 cos 2 [ 480.729174] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 18 cos 0 [ 480.729199] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 18 cos 1 [ 480.729221] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 18 cos 2 [ 480.729400] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 19 cos 0 [ 480.729427] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 19 cos 1 [ 480.729450] bnx2x: [bnx2x_alloc_fp_mem_at:4581(enP16p1s0f0)]allocating tx memory of fp 19 cos 2 [ 480.731207] bnx2x: [bnx2x_set_real_num_queues:2017(enP16p1s0f0)]Setting real num queues to (tx, rx) (60, 20) [ 480.731222] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 0 to tc 0 [ 480.731231] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 1 to tc 0 [ 480.731240] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 2 to tc 0 [ 480.731248] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 3 to tc 0 [ 480.731256] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 4 to tc 0 [ 480.731264] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 5 to tc 0 [ 480.731275] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 6 to tc 0 [ 480.731283] bnx2x: [bnx2x_setup_tc:4289(enP16p1s0f0)]mapping priority 7 to tc 0 [ 480.731291] bnx2x: [bnx2x_setup_tc:4309(enP16p1s0f0)]mapping tc 0 to offset 0 count 20 [ 480.731300] bnx2x: [bnx2x_setup_tc:4309(enP16p1s0f0)]mapping tc 1 to offset 20 count 20 [ 480.731310] bnx2x: [bnx2x_setup_tc:4309(enP16p1s0f0)]mapping tc 2 to offset 40 count 20 [ 480.731341] bnx2x: [bnx2x_nic_load:2717(enP16p1s0f0)]napi added [ 480.731354] bnx2x: [bnx2x_set_pf_load:4512(enP16p1s0f0)]Old GEN_REG_VAL=0x00000000 [ 480.731367] bnx2x 0010:01:00.0: fw_seq 0x00000009 [ 480.731375] bnx2x 0010:01:00.0: drv_pulse 0x17d [ 480.766791] bnx2x 0010:01:00.1: fw_seq 0x00000007 [ 480.766801] bnx2x 0010:01:00.1: Entering Previous Unload Flow [ 480.766808] bnx2x 0010:01:00.1: No need to release hw/nvram locks [ 480.791410] bnx2x 0010:01:00.1: Common unload Flow [ 480.821407] bnx2x 0010:01:00.1: Finished Previous Unload Flow [0] [ 480.821430] bnx2x 0010:01:00.1: set bp->max_cos to 3 [ 480.821437] bnx2x 0010:01:00.1: bp->min_msix_vec_cnt 3 [ 480.822071] bnx2x 0010:01:00.1: qm_cid_count 3072 [ 480.822081] bnx2x 0010:01:00.1: set number of queues to 21 [ 480.822087] bnx2x 0010:01:00.1: msix_table[0].entry = 0 (slowpath) [ 480.822093] bnx2x 0010:01:00.1: msix_table[1].entry = 1 (CNIC) [ 480.822100] bnx2x 0010:01:00.1: msix_table[2].entry = 2 (fastpath #0) [ 480.822106] bnx2x 0010:01:00.1: msix_table[3].entry = 3 (fastpath kernel-patches#1) [ 480.822113] bnx2x 0010:01:00.1: msix_table[4].entry = 4 (fastpath kernel-patches#2) [ 480.822119] bnx2x 0010:01:00.1: msix_table[5].entry = 5 (fastpath kernel-patches#3) [ 480.822125] bnx2x 0010:01:00.1: msix_table[6].entry = 6 (fastpath kernel-patches#4) [ 480.822131] bnx2x 0010:01:00.1: msix_table[7].entry = 7 (fastpath kernel-patches#5) [ 480.822137] bnx2x 0010:01:00.1: msix_table[8].entry = 8 (fastpath kernel-patches#6) [ 480.822143] bnx2x 0010:01:00.1: msix_table[9].entry = 9 (fastpath kernel-patches#7) [ 480.822149] bnx2x 0010:01:00.1: msix_table[10].entry = 10 (fastpath kernel-patches#8) [ 480.822156] bnx2x 0010:01:00.1: msix_table[11].entry = 11 (fastpath kernel-patches#9) [ 480.822162] bnx2x 0010:01:00.1: msix_table[12].entry = 12 (fastpath kernel-patches#10) [ 480.822168] bnx2x 0010:01:00.1: msix_table[13].entry = 13 (fastpath kernel-patches#11) [ 480.822174] bnx2x 0010:01:00.1: msix_table[14].entry = 14 (fastpath kernel-patches#12) [ 480.822180] bnx2x 0010:01:00.1: msix_table[15].entry = 15 (fastpath kernel-patches#13) [ 480.822187] bnx2x 0010:01:00.1: msix_table[16].entry = 16 (fastpath kernel-patches#14) [ 480.822193] bnx2x 0010:01:00.1: msix_table[17].entry = 17 (fastpath kernel-patches#15) [ 480.822199] bnx2x 0010:01:00.1: msix_table[18].entry = 18 (fastpath kernel-patches#16) [ 480.822205] bnx2x 0010:01:00.1: msix_table[19].entry = 19 (fastpath kernel-patches#17) [ 480.822211] bnx2x 0010:01:00.1: msix_table[20].entry = 20 (fastpath kernel-patches#18) [ 480.822217] bnx2x 0010:01:00.1: msix_table[21].entry = 21 (fastpath kernel-patches#19) [ 480.831471] bnx2x 0010:01:00.1: set interrupts successfully [ 480.871402] bnx2x: [bnx2x_nic_load_pmf:2445(enP16p1s0f0)]pmf 1 [ 480.871446] bnx2x 0010:01:00.0: Loading bnx2x/bnx2x-e2-7.13.21.0.fw [ 481.412444] bnx2x: [bnx2x_init_hw_func:8010(enP16p1s0f0)]NIC MODE configured [ 481.458818] bnx2x: [bnx2x_phy_probe:12595(enP16p1s0f0)]Begin phy probe [ 481.458832] bnx2x: [bnx2x_phy_probe:12608(enP16p1s0f0)]phy_config_swapped 0, phy_index 0, actual_phy_idx 0 [ 481.458844] bnx2x: [bnx2x_populate_int_phy:12217(enP16p1s0f0)]:chip_id = 0x168e1000 [ 481.458854] bnx2x: [bnx2x_populate_int_phy:12335(enP16p1s0f0)]Internal phy port=0, addr=0x1, mdio_ctl=0x8000 [ 481.458869] bnx2x: [bnx2x_phy_def_cfg:12505(enP16p1s0f0)]Default config phy idx 0 cfg 0x0 speed_cap_mask 0x5c0000 [ 481.458877] bnx2x: [bnx2x_phy_probe:12608(enP16p1s0f0)]phy_config_swapped 0, phy_index 1, actual_phy_idx 1 [ 481.458891] bnx2x: [bnx2x_populate_ext_phy:12463(enP16p1s0f0)]phy_type 0xd00 port 0 found in index 1 [ 481.458899] bnx2x: [bnx2x_populate_ext_phy:12465(enP16p1s0f0)] addr=0x10, mdio_ctl=0x8000 [ 481.458909] bnx2x: [bnx2x_phy_def_cfg:12505(enP16p1s0f0)]Default config phy idx 1 cfg 0x0 speed_cap_mask 0x5c0000 [ 481.458917] bnx2x: [bnx2x_phy_probe:12608(enP16p1s0f0)]phy_config_swapped 0, phy_index 2, actual_phy_idx 2 [ 481.458926] bnx2x: [bnx2x_phy_probe:12658(enP16p1s0f0)]End phy probe. #phys found 2 [ 481.458943] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 0, txq 0 [ 481.458950] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 20, txq 20 [ 481.458957] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 40, txq 40 [ 481.458973] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 2 [ 481.458983] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[0]: bnx2x_init_sb(00000000ee7290d5,000000003df6b04d) cl_id 2 fw_sb 2 igu_sb 2 [ 481.458995] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 1, txq 1 [ 481.459002] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 21, txq 21 [ 481.459009] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 41, txq 41 [ 481.459022] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 3 [ 481.459030] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[1]: bnx2x_init_sb(00000000ee7290d5,00000000dabca996) cl_id 3 fw_sb 3 igu_sb 3 [ 481.459040] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 2, txq 2 [ 481.459047] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 22, txq 22 [ 481.459054] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 42, txq 42 [ 481.459067] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 4 [ 481.459075] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[2]: bnx2x_init_sb(00000000ee7290d5,0000000019ec8b36) cl_id 4 fw_sb 4 igu_sb 4 [ 481.459085] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 3, txq 3 [ 481.459092] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 23, txq 23 [ 481.459098] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 43, txq 43 [ 481.459111] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 5 [ 481.459120] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[3]: bnx2x_init_sb(00000000ee7290d5,000000007b88f1d8) cl_id 5 fw_sb 5 igu_sb 5 [ 481.459130] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 4, txq 4 [ 481.459136] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 24, txq 24 [ 481.459143] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 44, txq 44 [ 481.459156] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 6 [ 481.459164] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[4]: bnx2x_init_sb(00000000ee7290d5,00000000b0b1373f) cl_id 6 fw_sb 6 igu_sb 6 [ 481.459174] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 5, txq 5 [ 481.459180] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 25, txq 25 [ 481.459187] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 45, txq 45 [ 481.459200] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 7 [ 481.459208] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[5]: bnx2x_init_sb(00000000ee7290d5,00000000e4e707c3) cl_id 7 fw_sb 7 igu_sb 7 [ 481.459218] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 6, txq 6 [ 481.459225] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 26, txq 26 [ 481.459231] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 46, txq 46 [ 481.459244] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 8 [ 481.459252] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[6]: bnx2x_init_sb(00000000ee7290d5,000000009a9c8fce) cl_id 8 fw_sb 8 igu_sb 8 [ 481.459262] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 7, txq 7 [ 481.459269] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 27, txq 27 [ 481.459276] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 47, txq 47 [ 481.459288] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 9 [ 481.459297] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[7]: bnx2x_init_sb(00000000ee7290d5,0000000014c7da0e) cl_id 9 fw_sb 9 igu_sb 9 [ 481.459307] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 8, txq 8 [ 481.459313] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 28, txq 28 [ 481.459320] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 48, txq 48 [ 481.459333] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 10 [ 481.459341] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[8]: bnx2x_init_sb(00000000ee7290d5,00000000d73bba50) cl_id 10 fw_sb 10 igu_sb 10 [ 481.459351] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 9, txq 9 [ 481.459358] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 29, txq 29 [ 481.459364] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 49, txq 49 [ 481.459377] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 11 [ 481.459386] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[9]: bnx2x_init_sb(00000000ee7290d5,00000000b847ea06) cl_id 11 fw_sb 11 igu_sb 11 [ 481.459396] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 10, txq 10 [ 481.459403] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 30, txq 30 [ 481.459409] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 50, txq 50 [ 481.459422] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 12 [ 481.459430] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[10]: bnx2x_init_sb(00000000ee7290d5,00000000196303a5) cl_id 12 fw_sb 12 igu_sb 12 [ 481.459440] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 11, txq 11 [ 481.459447] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 31, txq 31 [ 481.459453] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 51, txq 51 [ 481.459466] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 13 [ 481.459474] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[11]: bnx2x_init_sb(00000000ee7290d5,0000000066bd5df6) cl_id 13 fw_sb 13 igu_sb 13 [ 481.459484] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 12, txq 12 [ 481.459491] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 32, txq 32 [ 481.459497] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 52, txq 52 [ 481.459510] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 14 [ 481.459518] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[12]: bnx2x_init_sb(00000000ee7290d5,00000000cf0dcd91) cl_id 14 fw_sb 14 igu_sb 14 [ 481.459528] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 13, txq 13 [ 481.459535] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 33, txq 33 [ 481.459541] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 53, txq 53 [ 481.459554] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 15 [ 481.459562] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[13]: bnx2x_init_sb(00000000ee7290d5,0000000036d63708) cl_id 15 fw_sb 15 igu_sb 15 [ 481.459572] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 14, txq 14 [ 481.459579] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 34, txq 34 [ 481.459585] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 54, txq 54 [ 481.459598] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 16 [ 481.459606] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[14]: bnx2x_init_sb(00000000ee7290d5,0000000078b37957) cl_id 16 fw_sb 16 igu_sb 16 [ 481.459616] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 15, txq 15 [ 481.459623] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 35, txq 35 [ 481.459629] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 55, txq 55 [ 481.459642] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 17 [ 481.459650] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[15]: bnx2x_init_sb(00000000ee7290d5,00000000f04248ff) cl_id 17 fw_sb 17 igu_sb 17 [ 481.459660] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 16, txq 16 [ 481.459667] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 36, txq 36 [ 481.459674] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 56, txq 56 [ 481.459686] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 18 [ 481.459695] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[16]: bnx2x_init_sb(00000000ee7290d5,00000000a20333ee) cl_id 18 fw_sb 18 igu_sb 18 [ 481.459705] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 17, txq 17 [ 481.459711] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 37, txq 37 [ 481.459718] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 57, txq 57 [ 481.459730] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 19 [ 481.459739] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[17]: bnx2x_init_sb(00000000ee7290d5,00000000d5c15823) cl_id 19 fw_sb 19 igu_sb 19 [ 481.459749] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 18, txq 18 [ 481.459755] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 38, txq 38 [ 481.459762] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 58, txq 58 [ 481.459775] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 20 [ 481.459783] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[18]: bnx2x_init_sb(00000000ee7290d5,000000001b9fe542) cl_id 20 fw_sb 20 igu_sb 20 [ 481.459793] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 19, txq 19 [ 481.459800] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 39, txq 39 [ 481.459806] bnx2x: [bnx2x_init_txdata:1172(enP16p1s0f0)]created tx data cid 59, txq 59 [ 481.459819] bnx2x: [bnx2x_init_sb:6013(enP16p1s0f0)]Init FW SB 21 [ 481.459827] bnx2x: [bnx2x_init_eth_fp:6411(enP16p1s0f0)]queue[19]: bnx2x_init_sb(00000000ee7290d5,000000007f29c48b) cl_id 21 fw_sb 21 igu_sb 21 [ 481.459837] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.459929] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460025] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460124] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460218] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460311] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460411] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460505] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460598] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460697] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460792] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460885] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.460984] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461078] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461171] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461270] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461363] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461532] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461650] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461744] bnx2x: [bnx2x_init_rx_rings:1421(enP16p1s0f0)]mtu 1500 rx_buf_size 2048 [ 481.461859] bnx2x: [bnx2x_get_mod_abs_int_cfg:4351(enP16p1s0f0)]No cfg pin 0 for module detect indication [ 481.464004] bnx2x 0010:01:00.0 enP16p1s0f0: using MSI-X IRQs: sp 69 fp[0] 73 ... fp[19] 111 [ 481.464352] bnx2x: [bnx2x_cmng_fns_init:2601(enP16p1s0f0)]rate shaping and fairness are disabled [ 481.464373] ------------[ cut here ]------------ [ 481.464378] UBSAN: array-index-out-of-bounds in ../drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 [ 481.464387] index 20 is out of range for type 'stats_query_entry [19]' [ 481.464395] CPU: 1 PID: 3870 Comm: NetworkManager Not tainted 6.9.0-dirty kernel-patches#17 [ 481.464403] Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.B3 (SV860_245) hv:phyp pSeries [ 481.464412] Call Trace: [ 481.464416] [c000001fc4462d30] [c000000001441188] dump_stack_lvl+0x80/0xe8 (unreliable) [ 481.464432] [c000001fc4462d60] [c000000000c1a678] __ubsan_handle_out_of_bounds+0xc4/0x110 [ 481.464447] [c000001fc4462e10] [c008000025dafcb4] bnx2x_stats_init+0x6f0/0x724 [bnx2x] [ 481.464547] [c000001fc4462eb0] [c008000025d4e72c] bnx2x_post_irq_nic_init+0x2bc/0x51c [bnx2x] [ 481.464641] [c000001fc4462f50] [c008000025d9a7b8] bnx2x_nic_load+0xd74/0x2de0 [bnx2x] [ 481.464736] [c000001fc44630e0] [c008000025d4cb20] bnx2x_open+0x194/0x310 [bnx2x] [ 481.464828] [c000001fc4463170] [c00000000116e2b8] __dev_open+0x16c/0x22c [ 481.464840] [c000001fc4463210] [c00000000116e9ac] __dev_change_flags+0x258/0x2f4 [ 481.464852] [c000001fc44632c0] [c00000000116ea84] dev_change_flags+0x3c/0x9c [ 481.464863] [c000001fc4463300] [c000000001187cc4] do_setlink+0x35c/0x13b4 [ 481.464873] [c000001fc44634a0] [c00000000118fb88] __rtnl_newlink+0x9b8/0xd88 [ 481.464885] [c000001fc4463630] [c00000000118ffc8] rtnl_newlink+0x70/0xac [ 481.464895] [c000001fc4463670] [c000000001185e60] rtnetlink_rcv_msg+0x380/0x578 [ 481.464906] [c000001fc4463720] [c000000001217be4] netlink_rcv_skb+0x80/0x190 [ 481.464918] [c000001fc44637f0] [c00000000118321c] rtnetlink_rcv+0x28/0x3c [ 481.464928] [c000001fc4463810] [c000000001216ef8] netlink_unicast+0x2bc/0x3d4 [ 481.464940] [c000001fc4463880] [c00000000121722c] netlink_sendmsg+0x21c/0x54c [ 481.464951] [c000001fc4463970] [c00000000112461c] ____sys_sendmsg+0x28c/0x3c0 [ 481.464963] [c000001fc4463a00] [c00000000112763c] ___sys_sendmsg+0xcc/0x128 [ 481.464972] [c000001fc4463b70] [c000000001127d98] __sys_sendmsg+0x94/0xf4 [ 481.464980] [c000001fc4463c30] [c000000000030304] system_call_exception+0x174/0x320 [ 481.464992] [c000001fc4463e50] [c00000000000d520] system_call_common+0x160/0x2c4 [ 481.465003] --- interrupt: c00 at 0x7ffcfe5b6504 [ 481.465011] NIP: 00007ffcfe5b6504 LR: 00007ffcfe5b64dc CTR: 0000000000000000 [ 481.465017] REGS: c000001fc4463e80 TRAP: 0c00 Not tainted (6.9.0-dirty) [ 481.465025] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22084440 XER: 00000000 [ 481.465049] IRQMASK: 0 GPR00: 0000000000000155 00007ffff91154a0 00007ffcfe6b6f00 000000000000000d GPR04: 00007ffff9115510 0000000000000000 0000000000000020 00007ffcfcbfe800 GPR08: 00007ffcfcbf7148 0000000000000000 0000000000000000 0000000000000000 GPR12: 0000000000000000 00007ffcfcbfe800 00007ffcfe8f06b4 0000000000000000 GPR16: 00007ffff9115e90 00000001717e2748 000001002bce10e0 000001002bd96850 GPR20: 000001002bcc647c 00000001717416f8 0000000000000000 00007ffff911576c GPR24: 00007ffff9115778 0000000000000000 0000000000000000 0000000000000000 GPR28: 0000000000000000 00007ffff9115510 0000000000000000 000000000000000d [ 481.465135] NIP [00007ffcfe5b6504] 0x7ffcfe5b6504 [ 481.465141] LR [00007ffcfe5b64dc] 0x7ffcfe5b64dc [ 481.465147] --- interrupt: c00 [ 481.465151] ---[ end trace ]--- [ 481.467183] bnx2x: [bnx2x_igu_int_enable:1666(enP16p1s0f0)]write 0xb to IGU mode MSI-X [ 481.467254] bnx2x: [bnx2x_eq_int:5592(enP16p1s0f0)]got FUNC_START ramrod Signed-off-by: NipaLocal <nipa@local>

The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents. Extent tree manipulations do often extend the current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents. Once that happens a WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to this error. This was actually triggered by one of our customers on a heavily fragmented OCFS2 filesystem. To fix the issue make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written(). Heming Zhao said: ------ PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error" PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA" #0 machine_kexec at ffffffff8c069932 kernel-patches#1 __crash_kexec at ffffffff8c1338fa kernel-patches#2 panic at ffffffff8c1d69b9 kernel-patches#3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2] kernel-patches#4 __ocfs2_abort at ffffffffc0c88387 [ocfs2] kernel-patches#5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2] kernel-patches#6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] kernel-patches#7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] kernel-patches#8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2] kernel-patches#9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2] kernel-patches#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] kernel-patches#11 dio_complete at ffffffff8c2b9fa7 kernel-patches#12 do_blockdev_direct_IO at ffffffff8c2bc09f kernel-patches#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] kernel-patches#14 generic_file_direct_write at ffffffff8c1dcf14 kernel-patches#15 __generic_file_write_iter at ffffffff8c1dd07b kernel-patches#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] kernel-patches#17 aio_write at ffffffff8c2cc72e kernel-patches#18 kmem_cache_alloc at ffffffff8c248dde kernel-patches#19 do_io_submit at ffffffff8c2ccada kernel-patches#20 do_syscall_64 at ffffffff8c004984 kernel-patches#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba Link: https://lkml.kernel.org/r/[email protected] Link: https://lkml.kernel.org/r/[email protected] Fixes: c15471f ("ocfs2: fix sparse file & data ordering issue in direct io") Signed-off-by: Jan Kara <[email protected]> Reviewed-by: Joseph Qi <[email protected]> Reviewed-by: Heming Zhao <[email protected]> Cc: Mark Fasheh <[email protected]> Cc: Joel Becker <[email protected]> Cc: Junxiao Bi <[email protected]> Cc: Changwei Ge <[email protected]> Cc: Gang He <[email protected]> Cc: Jun Piao <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]>

iter_finish_branch_entry() doesn't put the branch_info from/to map elements creating memory leaks. This can be seen with: ``` $ perf record -e cycles -b perf test -w noploop $ perf report -D ... Direct leak of 984344 byte(s) in 123043 object(s) allocated from: #0 0x7fb2654f3bd7 in malloc libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x564d3400d10b in map__get util/map.h:186 #2 0x564d3400d10b in ip__resolve_ams util/machine.c:1981 #3 0x564d34014d81 in sample__resolve_bstack util/machine.c:2151 #4 0x564d34094790 in iter_prepare_branch_entry util/hist.c:898 #5 0x564d34098fa4 in hist_entry_iter__add util/hist.c:1238 #6 0x564d33d1f0c7 in process_sample_event tools/perf/builtin-report.c:334 #7 0x564d34031eb7 in perf_session__deliver_event util/session.c:1655 #8 0x564d3403ba52 in do_flush util/ordered-events.c:245 #9 0x564d3403ba52 in __ordered_events__flush util/ordered-events.c:324 #10 0x564d3402d32e in perf_session__process_user_event util/session.c:1708 #11 0x564d34032480 in perf_session__process_event util/session.c:1877 #12 0x564d340336ad in reader__read_event util/session.c:2399 #13 0x564d34033fdc in reader__process_events util/session.c:2448 #14 0x564d34033fdc in __perf_session__process_events util/session.c:2495 #15 0x564d34033fdc in perf_session__process_events util/session.c:2661 #16 0x564d33d27113 in __cmd_report tools/perf/builtin-report.c:1065 #17 0x564d33d27113 in cmd_report tools/perf/builtin-report.c:1805 #18 0x564d33e0ccb7 in run_builtin tools/perf/perf.c:350 #19 0x564d33e0d45e in handle_internal_command tools/perf/perf.c:403 #20 0x564d33cdd827 in run_argv tools/perf/perf.c:447 #21 0x564d33cdd827 in main tools/perf/perf.c:561 ... ``` Clearing up the map_symbols properly creates maps reference count issues so resolve those. Resolving this issue doesn't improve peak heap consumption for the test above. Committer testing: $ sudo dnf install libasan $ make -k CORESIGHT=1 EXTRA_CFLAGS="-fsanitize=address" CC=clang O=/tmp/build/$(basename $PWD)/ -C tools/perf install-bin Reviewed-by: Kan Liang <[email protected]> Signed-off-by: Ian Rogers <[email protected]> Tested-by: Arnaldo Carvalho de Melo <[email protected]> Cc: Adrian Hunter <[email protected]> Cc: Alexander Shishkin <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Jiri Olsa <[email protected]> Cc: Mark Rutland <[email protected]> Cc: Namhyung Kim <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Sun Haiyong <[email protected]> Cc: Yanteng Si <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

@offset

The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. NFS CLIENT thread1 thread2 open("file") ... nfs4_do_open _nfs4_do_open _nfs4_open_and_get_state _nfs4_proc_open nfs4_run_open_task /* rpc_task1 */ rpc_run_task rpc_wait_for_completion_task umount -f nfs_umount_begin rpc_killall_tasks rpc_signal_task rpc_task1 been wakeup and return -512 _nfs4_do_open // while loop ... nfs4_run_open_task /* rpc_task2 */ rpc_run_task rpc_wait_for_completion_task While processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered. NFS SERVER nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // alloc oo1, stateid1 nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // find oo1, without NFS4_OO_CONFIRMED release_openowner unhash_openowner_locked list_del_init(&oo->oo_perclient) // cannot find this oo // from client, LEAK!!! alloc_stateowner // alloc oo2 nfsd4_process_open2 init_open_stateid // associate oo1 // with stateid1, stateid1 LEAK!!! nfs4_get_vfs_file // alloc nfsd_file1 and nfsd_file_mark1 // all LEAK!!! nfsd4_process_open2 ... write_threads ... nfsd_destroy_serv nfsd_shutdown_net nfs4_state_shutdown_net nfs4_state_destroy_net destroy_client __destroy_client // won't find oo1!!! nfsd_shutdown_generic nfsd_file_cache_shutdown kmem_cache_destroy for nfsd_file_slab and nfsd_file_mark_slab // bark since nfsd_file1 // and nfsd_file_mark1 // still alive ======================================================================= BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() ----------------------------------------------------------------------- Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28 flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ kernel-patches#19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1ae/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Disabling lock debugging due to kernel taint Object 0xff11000110e2ac38 @offset=3128 Allocated in nfsd_file_do_acquire+0x20f/0xa30 [nfsd] age=1635 cpu=3 pid=800 nfsd_file_do_acquire+0x20f/0xa30 [nfsd] nfsd_file_acquire_opened+0x5f/0x90 [nfsd] nfs4_get_vfs_file+0x4c9/0x570 [nfsd] nfsd4_process_open2+0x713/0x1070 [nfsd] nfsd4_open+0x74b/0x8b0 [nfsd] nfsd4_proc_compound+0x70b/0xc20 [nfsd] nfsd_dispatch+0x1b4/0x3a0 [nfsd] svc_process_common+0x5b8/0xc50 [sunrpc] svc_process+0x2ab/0x3b0 [sunrpc] svc_handle_xprt+0x681/0xa20 [sunrpc] nfsd+0x183/0x220 [nfsd] kthread+0x199/0x1e0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Add nfs4_openowner_unhashed to help found unhashed nfs4_openowner, and break nfsd4_open process to fix this problem. Cc: [email protected] # v5.4+ Reviewed-by: Jeff Layton <[email protected]> Signed-off-by: Yang Erkun <[email protected]> Signed-off-by: Chuck Lever <[email protected]>

@offset

commit 98100e8 upstream. The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. NFS CLIENT thread1 thread2 open("file") ... nfs4_do_open _nfs4_do_open _nfs4_open_and_get_state _nfs4_proc_open nfs4_run_open_task /* rpc_task1 */ rpc_run_task rpc_wait_for_completion_task umount -f nfs_umount_begin rpc_killall_tasks rpc_signal_task rpc_task1 been wakeup and return -512 _nfs4_do_open // while loop ... nfs4_run_open_task /* rpc_task2 */ rpc_run_task rpc_wait_for_completion_task While processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered. NFS SERVER nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // alloc oo1, stateid1 nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // find oo1, without NFS4_OO_CONFIRMED release_openowner unhash_openowner_locked list_del_init(&oo->oo_perclient) // cannot find this oo // from client, LEAK!!! alloc_stateowner // alloc oo2 nfsd4_process_open2 init_open_stateid // associate oo1 // with stateid1, stateid1 LEAK!!! nfs4_get_vfs_file // alloc nfsd_file1 and nfsd_file_mark1 // all LEAK!!! nfsd4_process_open2 ... write_threads ... nfsd_destroy_serv nfsd_shutdown_net nfs4_state_shutdown_net nfs4_state_destroy_net destroy_client __destroy_client // won't find oo1!!! nfsd_shutdown_generic nfsd_file_cache_shutdown kmem_cache_destroy for nfsd_file_slab and nfsd_file_mark_slab // bark since nfsd_file1 // and nfsd_file_mark1 // still alive ======================================================================= BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() ----------------------------------------------------------------------- Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28 flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ kernel-patches#19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1ae/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Disabling lock debugging due to kernel taint Object 0xff11000110e2ac38 @offset=3128 Allocated in nfsd_file_do_acquire+0x20f/0xa30 [nfsd] age=1635 cpu=3 pid=800 nfsd_file_do_acquire+0x20f/0xa30 [nfsd] nfsd_file_acquire_opened+0x5f/0x90 [nfsd] nfs4_get_vfs_file+0x4c9/0x570 [nfsd] nfsd4_process_open2+0x713/0x1070 [nfsd] nfsd4_open+0x74b/0x8b0 [nfsd] nfsd4_proc_compound+0x70b/0xc20 [nfsd] nfsd_dispatch+0x1b4/0x3a0 [nfsd] svc_process_common+0x5b8/0xc50 [sunrpc] svc_process+0x2ab/0x3b0 [sunrpc] svc_handle_xprt+0x681/0xa20 [sunrpc] nfsd+0x183/0x220 [nfsd] kthread+0x199/0x1e0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Add nfs4_openowner_unhashed to help found unhashed nfs4_openowner, and break nfsd4_open process to fix this problem. Cc: [email protected] # v5.4+ Reviewed-by: Jeff Layton <[email protected]> Signed-off-by: Yang Erkun <[email protected]> Signed-off-by: Chuck Lever <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>

Hou Tao says: ==================== The use of migrate_{disable|enable} pair in BPF is mainly due to the introduction of bpf memory allocator and the use of per-CPU data struct in its internal implementation. The caller needs to disable migration before invoking the alloc or free APIs of bpf memory allocator, and enable migration after the invocation. The main users of bpf memory allocator are various kind of bpf maps in which the map values or the special fields in the map values are allocated by using bpf memory allocator. At present, the running context for bpf program has already disabled migration explictly or implictly, therefore, when these maps are manipulated in bpf program, it is OK to not invoke migrate_disable() and migrate_enable() pair. Howevers, it is not always the case when these maps are manipulated through bpf syscall, therefore many migrate_{disable|enable} pairs are added when the map can either be manipulated by BPF program or BPF syscall. The initial idea of reducing the use of migrate_{disable|enable} comes from Alexei [1]. I turned it into a patch set that archives the goals through the following three methods: 1. remove unnecessary migrate_{disable|enable} pair when the BPF syscall path also disables migration, it is OK to remove the pair. Patch #1~#3 fall into this category, while patch #4~#5 are partially included. 2. move the migrate_{disable|enable} pair from inner callee to outer caller Instead of invoking migrate_disable() in the inner callee, invoking migrate_disable() in the outer caller to simplify reasoning about when migrate_disable() is needed. Patch #4~#5 and patch #6~#19 belongs to this category. 3. add cant_migrate() check in the inner callee Add cant_migrate() check in the inner callee to ensure the guarantee that migration is disabled is not broken. Patch #1~#5, #13, #16~#19 also belong to this category. Please check the individual patches for more details. Comments are always welcome. Change Log: v2: * sqaush the ->map_free related patches (#10~#12, #15) into one patch * remove unnecessary cant_migrate() checks. v1: https://lore.kernel.org/bpf/[email protected] ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>

This commit addresses a circular locking dependency issue within the GFX isolation mechanism. The problem was identified by a warning indicating a potential deadlock due to inconsistent lock acquisition order. - The `amdgpu_gfx_enforce_isolation_ring_begin_use` and `amdgpu_gfx_enforce_isolation_ring_end_use` functions previously acquired `enforce_isolation_mutex` and called `amdgpu_gfx_kfd_sch_ctrl`, leading to potential deadlocks. ie., If `amdgpu_gfx_kfd_sch_ctrl` is called while `enforce_isolation_mutex` is held, and `amdgpu_gfx_enforce_isolation_handler` is called while `kfd_sch_mutex` is held, it can create a circular dependency. By ensuring consistent lock usage, this fix resolves the issue: [ 606.297333] ====================================================== [ 606.297343] WARNING: possible circular locking dependency detected [ 606.297353] 6.10.0-amd-mlkd-610-311224-lof #19 Tainted: G OE [ 606.297365] ------------------------------------------------------ [ 606.297375] kworker/u96:3/3825 is trying to acquire lock: [ 606.297385] ffff9aa64e431cb8 ((work_completion)(&(&adev->gfx.enforce_isolation[i].work)->work)){+.+.}-{0:0}, at: __flush_work+0x232/0x610 [ 606.297413] but task is already holding lock: [ 606.297423] ffff9aa64e432338 (&adev->gfx.kfd_sch_mutex){+.+.}-{3:3}, at: amdgpu_gfx_kfd_sch_ctrl+0x51/0x4d0 [amdgpu] [ 606.297725] which lock already depends on the new lock. [ 606.297738] the existing dependency chain (in reverse order) is: [ 606.297749] -> #2 (&adev->gfx.kfd_sch_mutex){+.+.}-{3:3}: [ 606.297765] __mutex_lock+0x85/0x930 [ 606.297776] mutex_lock_nested+0x1b/0x30 [ 606.297786] amdgpu_gfx_kfd_sch_ctrl+0x51/0x4d0 [amdgpu] [ 606.298007] amdgpu_gfx_enforce_isolation_ring_begin_use+0x2a4/0x5d0 [amdgpu] [ 606.298225] amdgpu_ring_alloc+0x48/0x70 [amdgpu] [ 606.298412] amdgpu_ib_schedule+0x176/0x8a0 [amdgpu] [ 606.298603] amdgpu_job_run+0xac/0x1e0 [amdgpu] [ 606.298866] drm_sched_run_job_work+0x24f/0x430 [gpu_sched] [ 606.298880] process_one_work+0x21e/0x680 [ 606.298890] worker_thread+0x190/0x350 [ 606.298899] kthread+0xe7/0x120 [ 606.298908] ret_from_fork+0x3c/0x60 [ 606.298919] ret_from_fork_asm+0x1a/0x30 [ 606.298929] -> #1 (&adev->enforce_isolation_mutex){+.+.}-{3:3}: [ 606.298947] __mutex_lock+0x85/0x930 [ 606.298956] mutex_lock_nested+0x1b/0x30 [ 606.298966] amdgpu_gfx_enforce_isolation_handler+0x87/0x370 [amdgpu] [ 606.299190] process_one_work+0x21e/0x680 [ 606.299199] worker_thread+0x190/0x350 [ 606.299208] kthread+0xe7/0x120 [ 606.299217] ret_from_fork+0x3c/0x60 [ 606.299227] ret_from_fork_asm+0x1a/0x30 [ 606.299236] -> #0 ((work_completion)(&(&adev->gfx.enforce_isolation[i].work)->work)){+.+.}-{0:0}: [ 606.299257] __lock_acquire+0x16f9/0x2810 [ 606.299267] lock_acquire+0xd1/0x300 [ 606.299276] __flush_work+0x250/0x610 [ 606.299286] cancel_delayed_work_sync+0x71/0x80 [ 606.299296] amdgpu_gfx_kfd_sch_ctrl+0x287/0x4d0 [amdgpu] [ 606.299509] amdgpu_gfx_enforce_isolation_ring_begin_use+0x2a4/0x5d0 [amdgpu] [ 606.299723] amdgpu_ring_alloc+0x48/0x70 [amdgpu] [ 606.299909] amdgpu_ib_schedule+0x176/0x8a0 [amdgpu] [ 606.300101] amdgpu_job_run+0xac/0x1e0 [amdgpu] [ 606.300355] drm_sched_run_job_work+0x24f/0x430 [gpu_sched] [ 606.300369] process_one_work+0x21e/0x680 [ 606.300378] worker_thread+0x190/0x350 [ 606.300387] kthread+0xe7/0x120 [ 606.300396] ret_from_fork+0x3c/0x60 [ 606.300406] ret_from_fork_asm+0x1a/0x30 [ 606.300416] other info that might help us debug this: [ 606.300428] Chain exists of: (work_completion)(&(&adev->gfx.enforce_isolation[i].work)->work) --> &adev->enforce_isolation_mutex --> &adev->gfx.kfd_sch_mutex [ 606.300458] Possible unsafe locking scenario: [ 606.300468] CPU0 CPU1 [ 606.300476] ---- ---- [ 606.300484] lock(&adev->gfx.kfd_sch_mutex); [ 606.300494] lock(&adev->enforce_isolation_mutex); [ 606.300508] lock(&adev->gfx.kfd_sch_mutex); [ 606.300521] lock((work_completion)(&(&adev->gfx.enforce_isolation[i].work)->work)); [ 606.300536] *** DEADLOCK *** [ 606.300546] 5 locks held by kworker/u96:3/3825: [ 606.300555] #0: ffff9aa5aa1f5d58 ((wq_completion)comp_1.1.0){+.+.}-{0:0}, at: process_one_work+0x3f5/0x680 [ 606.300577] #1: ffffaa53c3c97e40 ((work_completion)(&sched->work_run_job)){+.+.}-{0:0}, at: process_one_work+0x1d6/0x680 [ 606.300600] #2: ffff9aa64e463c98 (&adev->enforce_isolation_mutex){+.+.}-{3:3}, at: amdgpu_gfx_enforce_isolation_ring_begin_use+0x1c3/0x5d0 [amdgpu] [ 606.300837] #3: ffff9aa64e432338 (&adev->gfx.kfd_sch_mutex){+.+.}-{3:3}, at: amdgpu_gfx_kfd_sch_ctrl+0x51/0x4d0 [amdgpu] [ 606.301062] #4: ffffffff8c1a5660 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x70/0x610 [ 606.301083] stack backtrace: [ 606.301092] CPU: 14 PID: 3825 Comm: kworker/u96:3 Tainted: G OE 6.10.0-amd-mlkd-610-311224-lof #19 [ 606.301109] Hardware name: Gigabyte Technology Co., Ltd. X570S GAMING X/X570S GAMING X, BIOS F7 03/22/2024 [ 606.301124] Workqueue: comp_1.1.0 drm_sched_run_job_work [gpu_sched] [ 606.301140] Call Trace: [ 606.301146] <TASK> [ 606.301154] dump_stack_lvl+0x9b/0xf0 [ 606.301166] dump_stack+0x10/0x20 [ 606.301175] print_circular_bug+0x26c/0x340 [ 606.301187] check_noncircular+0x157/0x170 [ 606.301197] ? register_lock_class+0x48/0x490 [ 606.301213] __lock_acquire+0x16f9/0x2810 [ 606.301230] lock_acquire+0xd1/0x300 [ 606.301239] ? __flush_work+0x232/0x610 [ 606.301250] ? srso_alias_return_thunk+0x5/0xfbef5 [ 606.301261] ? mark_held_locks+0x54/0x90 [ 606.301274] ? __flush_work+0x232/0x610 [ 606.301284] __flush_work+0x250/0x610 [ 606.301293] ? __flush_work+0x232/0x610 [ 606.301305] ? __pfx_wq_barrier_func+0x10/0x10 [ 606.301318] ? mark_held_locks+0x54/0x90 [ 606.301331] ? srso_alias_return_thunk+0x5/0xfbef5 [ 606.301345] cancel_delayed_work_sync+0x71/0x80 [ 606.301356] amdgpu_gfx_kfd_sch_ctrl+0x287/0x4d0 [amdgpu] [ 606.301661] amdgpu_gfx_enforce_isolation_ring_begin_use+0x2a4/0x5d0 [amdgpu] [ 606.302050] ? srso_alias_return_thunk+0x5/0xfbef5 [ 606.302069] amdgpu_ring_alloc+0x48/0x70 [amdgpu] [ 606.302452] amdgpu_ib_schedule+0x176/0x8a0 [amdgpu] [ 606.302862] ? drm_sched_entity_error+0x82/0x190 [gpu_sched] [ 606.302890] amdgpu_job_run+0xac/0x1e0 [amdgpu] [ 606.303366] drm_sched_run_job_work+0x24f/0x430 [gpu_sched] [ 606.303388] process_one_work+0x21e/0x680 [ 606.303409] worker_thread+0x190/0x350 [ 606.303424] ? __pfx_worker_thread+0x10/0x10 [ 606.303437] kthread+0xe7/0x120 [ 606.303449] ? __pfx_kthread+0x10/0x10 [ 606.303463] ret_from_fork+0x3c/0x60 [ 606.303476] ? __pfx_kthread+0x10/0x10 [ 606.303489] ret_from_fork_asm+0x1a/0x30 [ 606.303512] </TASK> v2: Refactor lock handling to resolve circular dependency (Alex) - Introduced a `sched_work` flag to defer the call to `amdgpu_gfx_kfd_sch_ctrl` until after releasing `enforce_isolation_mutex`. - This change ensures that `amdgpu_gfx_kfd_sch_ctrl` is called outside the critical section, preventing the circular dependency and deadlock. - The `sched_work` flag is set within the mutex-protected section if conditions are met, and the actual function call is made afterward. - This approach ensures consistent lock acquisition order. Fixes: afefd6f ("drm/amdgpu: Implement Enforce Isolation Handler for KGD/KFD serialization") Cc: Christian König <[email protected]> Cc: Alex Deucher <[email protected]> Signed-off-by: Srinivasan Shanmugam <[email protected]> Suggested-by: Alex Deucher <[email protected]> Reviewed-by: Alex Deucher <[email protected]> Signed-off-by: Alex Deucher <[email protected]> (cherry picked from commit 0b6b2dd) Cc: [email protected]

tsipa and others added 2 commits September 7, 2020 20:41

adding ci files

e4ba4c7

kernel-patches-bot added bpf new V1 labels Sep 8, 2020

kernel-patches-bot added accepted and removed new labels Sep 8, 2020

kernel-patches-bot closed this Sep 8, 2020

kernel-patches-bot deleted the series/200082 branch September 15, 2020 17:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bpf: Fix clobbering of r2 in bpf_gen_ld_abs #19

bpf: Fix clobbering of r2 in bpf_gen_ld_abs #19

kernel-patches-bot commented Sep 8, 2020

kernel-patches-bot commented Sep 8, 2020

kernel-patches-bot commented Sep 8, 2020

bpf: Fix clobbering of r2 in bpf_gen_ld_abs #19

bpf: Fix clobbering of r2 in bpf_gen_ld_abs #19

Conversation

kernel-patches-bot commented Sep 8, 2020

kernel-patches-bot commented Sep 8, 2020

kernel-patches-bot commented Sep 8, 2020