2021-04-11 23:08:14

by Linus Torvalds

[permalink] [raw]
Subject: Linux 5.12-rc7

Oh well. rc5 was big. rc6 was small. And now rc7 is big again. In
fact, it's the biggest rc7 (at least in number of commits) we've had
in the 5.x series.

It's mostly due to networking fixes (of which rc6 had none), and none
of them should be all that scary, but it's never great when we have
such a big rc. It's particularly annoying at the end of the release
window like this.

End result: I'm still waffling about the final 5.12 release. The fact
that we have a big rc7 does make me think that I'll probably do an rc8
this time around. But it ends up depending a bit on how the upcoming
week goes, and if things are deathly quiet, I may end up deciding that
an rc8 doesn't really make sense.

So we'll see.

Anyway, networking (both core and drivers) is over half of the rc7
patch, with the rest being a fairly random collection of fixes all
over. We've got other driver updates (sound, rdma, scsi, usb..) some
fs fixes (io_uring, umount, btrfs, cifs, ocfs), minor arch fixes (arc,
arm, parisc, powerpc, s390, x86), and other misc fixes.

The shortlog is appended, although it's obviously not as nice and
small and readable as I'd have liked at this point in the release..

Please do test,

Linus

---

A. Cody Schuffelen (1):
virt_wifi: Return micros for BSS TSF values

Aditya Pakki (1):
net/rds: Avoid potential use after free in rds_send_remove_from_sock

Adrian Hunter (1):
perf inject: Fix repipe usage

Ahmed S. Darwish (2):
net: xfrm: Localize sequence counter per network namespace
net: xfrm: Use sequence counter with associated spinlock

Aili Yao (1):
mm/gup: check page posion status for coredump.

Al Viro (3):
hostfs: fix memory handling in follow_link()
Make sure nd->path.mnt and nd->path.dentry are always valid pointers
LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late

Alex Deucher (1):
drm/amdgpu/smu7: fix CAC setting on TOPAZ

Alex Shi (1):
net/ieee802154: remove unused macros to tame gcc

Alexander Aring (19):
net: ieee802154: fix nl802154 del llsec key
net: ieee802154: fix nl802154 del llsec dev
net: ieee802154: fix nl802154 add llsec key
net: ieee802154: fix nl802154 del llsec devkey
net: ieee802154: nl-mac: fix check on panid
net: ieee802154: forbid monitor for set llsec params
net: ieee802154: stop dump llsec keys for monitors
net: ieee802154: forbid monitor for add llsec key
net: ieee802154: forbid monitor for del llsec key
net: ieee802154: stop dump llsec devs for monitors
net: ieee802154: forbid monitor for add llsec dev
net: ieee802154: forbid monitor for del llsec dev
net: ieee802154: stop dump llsec devkeys for monitors
net: ieee802154: forbid monitor for add llsec devkey
net: ieee802154: forbid monitor for del llsec devkey
net: ieee802154: stop dump llsec seclevels for monitors
net: ieee802154: forbid monitor for add llsec seclevel
net: ieee802154: forbid monitor for del llsec seclevel
net: ieee802154: stop dump llsec params for monitors

Alexander Gordeev (1):
s390/cpcmd: fix inline assembly register clobbering

Alexander Shiyan (1):
ASoC: fsl_esai: Fix TDM slot setup for I2S mode

Andrew Morton (1):
lib/test_kasan_module.c: suppress unused var warning

Andrey Konovalov (1):
kasan: fix conflict with page poisoning

Andy Shevchenko (1):
i2c: designware: Adjust bus_freq_hz when refuse high speed mode set

Anirudh Rayabharam (1):
net: hso: fix null-ptr-deref during tty device unregistration

Anirudh Venkataramanan (2):
ice: Continue probe on link/PHY errors
ice: Use port number instead of PF ID for WoL

Antoine Tenart (2):
vxlan: do not modify the shared tunnel info when PMTU triggers
an ICMP reply
geneve: do not modify the shared tunnel info when PMTU triggers
an ICMP reply

Ariel Levkovich (1):
net/mlx5e: Fix mapping of ct_label zero

Arkadiusz Kubalewski (6):
i40e: Fix oops at i40e_rebuild()
i40e: Fix inconsistent indenting
i40e: Fix sparse errors in i40e_txrx.c
i40e: Fix sparse error: uninitialized symbol 'ring'
i40e: Fix sparse error: 'vsi->netdev' could be null
i40e: Fix sparse warning: missing error code 'err'

Arnd Bergmann (7):
remoteproc: qcom: pil_info: avoid 64-bit division
lockdep: Address clang -Wformat warning printing for %hd
ARM: keystone: fix integer overflow warning
soc/fsl: qbman: fix conflicting alignment attributes
ARM: omap1: fix building with clang IAS
ARM: pxa: mainstone: avoid -Woverride-init warning
ARM: mvebu: avoid clang -Wtautological-constant warning

Aya Levin (3):
net/mlx5e: Fix ethtool indication of connector type
net/mlx5: Fix PPLM register mapping
net/mlx5: Fix PBMC register mapping

Bastian Germann (1):
ASoC: sunxi: sun4i-codec: fill ASoC card owner

Ben Greear (1):
mac80211: fix time-is-after bug in mlme

Bhaskar Chowdhury (2):
i2c: stm32f4: Mundane typo fix
parisc: math-emu: Few spelling fixes in the file fpu.h

Bruce Allan (1):
ice: fix memory allocation call

Can Guo (2):
scsi: ufs: core: Fix task management request completion timeout
scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs

Carlos Leija (1):
ARM: OMAP4: PM: update ROM return address for OSWR and OFF

Chinh T Cao (1):
ice: Recognize 860 as iSCSI port in CEE mode

Christian Brauner (1):
file: fix close_range() for unshare+cloexec

Christophe Leroy (3):
powerpc/ptrace: Don't return error when getting/setting FP regs
without CONFIG_PPC_FPU_REGS
powerpc/signal32: Fix Oops on sigreturn with unmapped VDSO
powerpc/vdso: Make sure vdso_wrapper.o is rebuilt everytime
vdso.so is rebuilt

Ciara Loftus (3):
libbpf: Ensure umem pointer is non-NULL before dereferencing
libbpf: Restore umem state after socket create failure
libbpf: Only create rx and tx XDP rings when necessary

Claudiu Beznea (1):
net: macb: restore cmp registers on resume path

Claudiu Manoil (1):
gianfar: Handle error code at MAC address change

Dan Carpenter (2):
thunderbolt: Fix a leak in tb_retimer_add()
thunderbolt: Fix off by one in tb_port_find_retimer()

Daniel Jurgens (1):
net/mlx5: Don't request more than supported EQs

Daniel Mack (1):
net: axienet: allow setups without MDIO

Danielle Ratson (2):
ethtool: Remove link_mode param and derive link params from driver
ethtool: Add lanes parameter for ETHTOOL_LINK_MODE_10000baseR_FEC_BIT

Dave Ertman (1):
ice: remove DCBNL_DEVRESET bit from PF state

Dave Marchevsky (1):
bpf: Refcount task stack in bpf_get_task_stack

Dima Chumak (1):
net/mlx5e: Consider geneve_opts for encap contexts

Dimitar Dimitrov (1):
remoteproc: pru: Fix loading of GNU Binutils ELF

Dinh Nguyen (1):
dt-bindings: net: micrel-ksz90x1.txt: correct documentation

Dmitry Baryshkov (2):
drm/msm: a6xx: fix version check for the A650 SQE microcode
clk: fixed: fix double free in resource managed fixed-factor clock

Dmitry Safonov (1):
xfrm/compat: Cleanup WARN()s that can be user-triggered

Dom Cobley (1):
drm/vc4: crtc: Reduce PV fifo threshold on hvs4

Du Cheng (1):
cfg80211: remove WARN_ON() in cfg80211_sme_connect

Eli Cohen (5):
net/mlx5: Fix HW spec violation configuring uplink
vdpa/mlx5: Use the correct dma device when registering memory
vdpa/mlx5: Retrieve BAR address suitable any function
vdpa/mlx5: Fix wrong use of bit numbers
vdpa/mlx5: Fix suspend/resume index restoration

Eric Dumazet (4):
sch_red: fix off-by-one checks in red_check_params()
net: ensure mac header is set in virtio_net_hdr_to_skb()
Revert "net: correct sk_acceptq_is_full()"
virtio_net: Do not pull payload in skb->head

Eryk Rybak (2):
i40e: Fix kernel oops when i40e driver removes VF's
i40e: Fix display statistics for veb_tc

Evan Nimmo (1):
xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume

Eyal Birger (3):
xfrm: interface: fix ipv4 pmtu check to honor ip header df
vti: fix ipv4 pmtu check to honor ip header df
vti6: fix ipv4 pmtu check to honor ip header df

Fabio Pricoco (1):
ice: Increase control queue timeout

Florian Fainelli (2):
Revert "ARM: dts: bcm2711: Add the BSC interrupt controller"
net: phy: broadcom: Only advertise EEE for supported modes

Frank Rowand (2):
of: properly check for error returned by fdt_get_name()
of: unittest: overlay: ensure proper alignment of copied FDT

Gao Xiang (1):
parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers

Geert Uytterhoeven (3):
regulator: bd9571mwv: Fix AVS and DVFS voltage range
regulator: bd9571mwv: Fix regulator name printed on registration failure
regulator: bd9571mwv: Convert device attribute to sysfs_emit()

Gregory CLEMENT (1):
Revert "arm64: dts: marvell: armada-cp110: Switch to per-port
SATA interrupts"

Gregory Greenman (1):
iwlwifi: mvm: rfi: don't lock mvm->mutex when sending config command

Grzegorz Siwik (1):
i40e: Fix parameters in aq_get_phy_register()

Guangbin Huang (1):
net: hns3: clear VF down state bit before request link status

Guennadi Liakhovetski (1):
ASoC: SOF: Intel: HDA: fix core status verification

Guenter Roeck (1):
pcnet32: Use pci_resource_len to validate PCI resource

Hans de Goede (5):
brcmfmac: p2p: Fix recently introduced deadlock issue
ASoC: intel: atom: Stop advertising non working S24LE support
ASoC: intel: atom: Remove 44100 sample-rate from the media and
deep-buffer DAI descriptions
platform/x86: intel-hid: Fix spurious wakeups caused by
tablet-mode events during suspend
Bluetooth: btusb: Revert Fix the autosuspend enable and disable

Hao Fang (1):
i2c: hix5hd2: use the correct HiSilicon copyright

Heiko Carstens (2):
s390/irq: fix reading of ext_params2 field from lowcore
s390/setup: use memblock_free_late() to free old stack

Helge Deller (1):
parisc: parisc-agp requires SBA IOMMU driver

Ian Rogers (1):
perf arm-spe: Avoid potential buffer overrun

Ido Schimmel (2):
mlxsw: spectrum: Fix ECN marking in tunnel decapsulation
selftests: forwarding: vxlan_bridge_1d: Add more ECN decap test cases

Ilya Lipnitskiy (1):
of: property: fw_devlink: do not link ".*,nr-gpios"

Ilya Maximets (1):
openvswitch: fix send of uninitialized stack memory in ct limit reply

Jacek Bułatek (1):
ice: Fix for dereference of NULL pointer

Jack Qiu (1):
fs: direct-io: fix missing sdio->boundary

Jakub Kicinski (4):
docs: ethtool: fix some copy-paste errors
ethtool: un-kdocify extended link state
ethtool: document reserved fields in the uAPI
ethtool: fix kdoc in headers

Jin Yao (1):
perf report: Fix wrong LBR block sorting

Jiri Kosina (1):
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()

Jiri Olsa (1):
bpf: Take module reference for trampoline in module

Johannes Berg (8):
iwlwifi: pcie: properly set LTR workarounds on 22000 devices
iwlwifi: fw: fix notification wait locking
iwlwifi: mvm: fix beacon protection checks
rfkill: revert back to old userspace API by default
mac80211: fix TXQ AC confusion
cfg80211: check S1G beacon compat element length
nl80211: fix potential leak of ACL params
nl80211: fix beacon head validation

John Fastabend (2):
bpf, sockmap: Fix sk->prot unhash op reset
bpf, sockmap: Fix incorrect fwd_alloc accounting

John Stultz (1):
drm/msm: Fix removal of valid error case when checking speed_bin

Jonas Holmberg (1):
ALSA: aloop: Fix initialization of controls

Jordan Crouse (1):
mailmap: update email address for Jordan Crouse

Julian Braha (1):
lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS

Kalyan Thota (1):
drm/msm/disp/dpu1: program 3d_merge only if block is attached

Kamal Heib (1):
RDMA/qedr: Fix kernel panic when trying to access recv_cq

Krzysztof Goreczny (1):
ice: prevent ice_open and ice_stop during reset

Krzysztof Kozlowski (2):
clk: socfpga: fix iomem pointer cast on 64-bit
i2c: exynos5: correct top kerneldoc

Kumar Kartikeya Dwivedi (1):
net: sched: bump refcount for new action in ACT replace mode

Kurt Kanzenbach (1):
net: hsr: Reset MAC header for Tx path

Leon Romanovsky (1):
RDMA/addr: Be strict with gid size

Libin Yang (5):
ASoC: SOF: Intel: TGL: fix EHL ops
ASoC: SOF: Intel: TGL: set shutdown callback to hda_dsp_shutdown
ASoC: SOF: Intel: ICL: set shutdown callback to hda_dsp_shutdown
ASoC: SOF: Intel: CNL: set shutdown callback to hda_dsp_shutdown
ASoC: SOF: Intel: APL: set shutdown callback to hda_dsp_shutdown

Linus Torvalds (1):
Linux 5.12-rc7

Loic Poulain (1):
net: qrtr: Fix memory leak on qrtr_tx_wait failure

Lorenz Bauer (2):
bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET
bpf: program: Refuse non-O_RDWR flags in BPF_OBJ_GET

Lorenzo Bianconi (1):
mt76: mt7921: fix airtime reporting

Luca Coelho (2):
iwlwifi: fix 11ax disabled bit in the regulatory capability flags
iwlwifi: pcie: add support for So-F devices

Luca Fancellu (1):
xen/evtchn: Change irq_info lock to raw_spinlock_t

Lukasz Bartosik (2):
clk: fix invalid usage of list cursor in register
clk: fix invalid usage of list cursor in unregister

Lv Yunlong (7):
gpu/xen: Fix a use after free in xen_drm_drv_init
drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso
net:tipc: Fix a double free in tipc_sk_mcast_rcv
ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx
net/rds: Fix a use after free in rds_message_map_pages
net: broadcom: bcm4908enet: Fix a double free in bcm4908_enet_dma_alloc

Maciej Żenczykowski (1):
net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()

Maciek Borzecki (1):
cifs: escape spaces in share names

Magnus Karlsson (1):
i40e: fix receiving of single packets in xsk zero-copy mode

Manivannan Sadhasivam (1):
MAINTAINERS: Add entry for Qualcomm IPC Router (QRTR) driver

Maor Dickman (2):
net/mlx5: Delete auxiliary bus driver eth-rep first
net/mlx5: E-switch, Create vport miss group only if src rewrite
is supported

Marc Kleine-Budde (2):
can: uapi: can.h: mark union inside struct can_frame packed
can: mcp251x: fix support for half duplex SPI host controllers

Marco Elver (1):
kfence, x86: fix preemptible warning on KPTI-enabled systems

Marek Behún (3):
ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin
MAINTAINERS: update CZ.NIC's Turris information
treewide: change my e-mail address, fix my name

Martin Blumenstingl (3):
net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock
net: dsa: lantiq_gswip: Don't use PHY auto polling
net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits

Martin Wilck (1):
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state

Mateusz Palczewski (1):
i40e: Added Asym_Pause to supported link modes

Mathieu Poirier (1):
MAINTAINERS: Add co-maintainer for remoteproc/RPMSG subsystems

Matt Chen (1):
iwlwifi: add support for Qu with AX201 device

Matthew Wilcox (1):
.mailmap: fix old email addresses

Mauro Carvalho Chehab (3):
dt-bindings: don't use ../dir for doc references
dt-bindings: fix references for iio-bindings.txt
dt-bindings:iio:adc: update motorola,cpcap-adc.yaml reference

Maxim Kochetkov (1):
net: dsa: Fix type was not set for devlink port

Maxime Ripard (1):
drm/vc4: plane: Remove redundant assignment

Md Haris Iqbal (1):
RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt
session files

Mike Marciniszyn (1):
IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS

Mike Rapoport (1):
nds32: flush_dcache_page: use page_mapping_file to avoid races
with swapoff

Milton Miller (1):
net/ncsi: Avoid channel_monitor hrtimer deadlock

Muhammad Usama Anjum (1):
net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh

Naohiro Aota (1):
btrfs: zoned: move superblock logging zone location

Nick Desaulniers (1):
gcov: re-fix clang-11+ support

Norbert Ciosek (1):
virtchnl: Fix layout of RSS structures

Norman Maurer (1):
net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);

Oliver Hartkopp (2):
can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE

Oliver Stäbler (1):
arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0

Ondrej Mosnacek (3):
selinux: make nslot handling in avtab more robust
selinux: fix cond_list corruption when changing booleans
selinux: fix race between old and new sidtab

Ong Boon Leong (1):
xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model

Paolo Abeni (4):
net: let skb_orphan_partial wake-up waiters.
mptcp: forbit mcast-related sockopt on MPTCP sockets
mptcp: revert "mptcp: provide subflow aware release function"
net: fix hangup on napi_disable for threaded napi

Paolo Bonzini (1):
KVM: x86/mmu: preserve pending TLB flush across calls to
kvm_tdp_mmu_zap_sp

Pavel Begunkov (3):
io_uring: clear F_REISSUE right after getting it
io_uring: fix rw req completion
io-wq: cancel unbounded works on io-wq destroy

Pavel Skripkin (3):
drivers: net: fix memory leak in atusb_probe
drivers: net: fix memory leak in peak_usb_create_dev
net: mac802154: Fix general protection fault

Pavel Tikhomirov (1):
net: sched: sch_teql: fix null-pointer dereference

Pawel Laszczak (1):
usb: cdnsp: Fixes issue with dequeuing requests after disabling endpoint

Pedro Tammela (1):
libbpf: Fix bail out from 'ringbuf_process_ring()' on error

Phillip Potter (1):
net: tun: set tun->dev->addr_len during TUNSETLINK processing

Pierre-Louis Bossart (2):
ASoC: SOF: core: harden shutdown helper
ASoC: SOF: Intel: move ELH chip info

Piotr Krysiuk (2):
bpf, x86: Validate computation of branch displacements for x86-64
bpf, x86: Validate computation of branch displacements for x86-32

Potnuri Bharat Teja (1):
RDMA/cxgb4: check for ipv6 address properly while destroying listener

Qingqing Zhuo (1):
drm/amd/display: Add missing mask for DCN3

Raed Salem (1):
net/mlx5: Fix placement of log_max_flow_counter

Rafał Miłecki (2):
dt-bindings: net: ethernet-controller: fix typo in NVMEM
dt-bindings: net: bcm4908-enet: fix Ethernet generic properties

Rahul Lakkireddy (1):
cxgb4: avoid collecting SGE_QBASE regs during traffic

Rob Clark (1):
drm/msm: Fix a5xx/a6xx timestamps

Robert Malz (1):
ice: Cleanup fltr list in case of allocation issues

Roman Bolshakov (1):
scsi: target: iscsi: Fix zero tag inside a trace event

Roman Gushchin (1):
percpu: make pcpu_nr_empty_pop_pages per chunk type

Rui Salvaterra (1):
ARM: dts: turris-omnia: fix hardware buffer management

Ryan Lee (2):
ASoC: max98373: Changed amp shutdown register as volatile
ASoC: max98373: Added 30ms turn on/off time delay

Salil Mehta (3):
net: hns3: Remove the left over redundant check & assignment
net: hns3: Remove un-necessary 'else-if' in the hclge_reset_event()
net: hns3: Trivial spell fix in hns3 driver

Saravana Kannan (1):
driver core: Fix locking bug in deferred_probe_timeout_work_func()

Sebastian Reichel (1):
drm/panel: panel-dsi-cm: disable TE for now

Seevalamuthu Mariappan (1):
mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN

Sergei Trofimovich (4):
scsi: hpsa: Use __packed on individual structs, not header-wide
scsi: hpsa: Fix boot on ia64 (atomic_t alignment)
scsi: hpsa: Add an assert to prevent __packed reintroduction
ia64: fix user_stack_pointer() for ptrace()

Shengjiu Wang (1):
ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips

Shuah Khan (4):
usbip: add sysfs_lock to synchronize sysfs code paths
usbip: stub-dev synchronize sysfs code paths
usbip: vudc synchronize sysfs code paths
usbip: synchronize event handler with sysfs code paths

Shyam Prasad N (1):
cifs: On cifs_reconnect, resolve the hostname again.
A. Cody Schuffelen (1):
virt_wifi: Return micros for BSS TSF values

Aditya Pakki (1):
net/rds: Avoid potential use after free in rds_send_remove_from_sock

Adrian Hunter (1):
perf inject: Fix repipe usage

Ahmed S. Darwish (2):
net: xfrm: Localize sequence counter per network namespace
net: xfrm: Use sequence counter with associated spinlock

Aili Yao (1):
mm/gup: check page posion status for coredump.

Al Viro (3):
hostfs: fix memory handling in follow_link()
Make sure nd->path.mnt and nd->path.dentry are always valid pointers
LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late

Alex Deucher (1):
drm/amdgpu/smu7: fix CAC setting on TOPAZ

Alex Shi (1):
net/ieee802154: remove unused macros to tame gcc

Alexander Aring (19):
net: ieee802154: fix nl802154 del llsec key
net: ieee802154: fix nl802154 del llsec dev
net: ieee802154: fix nl802154 add llsec key
net: ieee802154: fix nl802154 del llsec devkey
net: ieee802154: nl-mac: fix check on panid
net: ieee802154: forbid monitor for set llsec params
net: ieee802154: stop dump llsec keys for monitors
net: ieee802154: forbid monitor for add llsec key
net: ieee802154: forbid monitor for del llsec key
net: ieee802154: stop dump llsec devs for monitors
net: ieee802154: forbid monitor for add llsec dev
net: ieee802154: forbid monitor for del llsec dev
net: ieee802154: stop dump llsec devkeys for monitors
net: ieee802154: forbid monitor for add llsec devkey
net: ieee802154: forbid monitor for del llsec devkey
net: ieee802154: stop dump llsec seclevels for monitors
net: ieee802154: forbid monitor for add llsec seclevel
net: ieee802154: forbid monitor for del llsec seclevel
net: ieee802154: stop dump llsec params for monitors

Alexander Gordeev (1):
s390/cpcmd: fix inline assembly register clobbering

Alexander Shiyan (1):
ASoC: fsl_esai: Fix TDM slot setup for I2S mode

Andrew Morton (1):
lib/test_kasan_module.c: suppress unused var warning

Andrey Konovalov (1):
kasan: fix conflict with page poisoning

Andy Shevchenko (1):
i2c: designware: Adjust bus_freq_hz when refuse high speed mode set

Anirudh Rayabharam (1):
net: hso: fix null-ptr-deref during tty device unregistration

Anirudh Venkataramanan (2):
ice: Continue probe on link/PHY errors
ice: Use port number instead of PF ID for WoL

Antoine Tenart (2):
vxlan: do not modify the shared tunnel info when PMTU triggers
an ICMP reply
geneve: do not modify the shared tunnel info when PMTU triggers
an ICMP reply

Ariel Levkovich (1):
net/mlx5e: Fix mapping of ct_label zero

Arkadiusz Kubalewski (6):
i40e: Fix oops at i40e_rebuild()
i40e: Fix inconsistent indenting
i40e: Fix sparse errors in i40e_txrx.c
i40e: Fix sparse error: uninitialized symbol 'ring'
i40e: Fix sparse error: 'vsi->netdev' could be null
i40e: Fix sparse warning: missing error code 'err'

Arnd Bergmann (7):
remoteproc: qcom: pil_info: avoid 64-bit division
lockdep: Address clang -Wformat warning printing for %hd
ARM: keystone: fix integer overflow warning
soc/fsl: qbman: fix conflicting alignment attributes
ARM: omap1: fix building with clang IAS
ARM: pxa: mainstone: avoid -Woverride-init warning
ARM: mvebu: avoid clang -Wtautological-constant warning

Aya Levin (3):
net/mlx5e: Fix ethtool indication of connector type
net/mlx5: Fix PPLM register mapping
net/mlx5: Fix PBMC register mapping

Bastian Germann (1):
ASoC: sunxi: sun4i-codec: fill ASoC card owner

Ben Greear (1):
mac80211: fix time-is-after bug in mlme

Bhaskar Chowdhury (2):
i2c: stm32f4: Mundane typo fix
parisc: math-emu: Few spelling fixes in the file fpu.h

Bruce Allan (1):
ice: fix memory allocation call

Can Guo (2):
scsi: ufs: core: Fix task management request completion timeout
scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs

Carlos Leija (1):
ARM: OMAP4: PM: update ROM return address for OSWR and OFF

Chinh T Cao (1):
ice: Recognize 860 as iSCSI port in CEE mode

Christian Brauner (1):
file: fix close_range() for unshare+cloexec

Christophe Leroy (3):
powerpc/ptrace: Don't return error when getting/setting FP regs
without CONFIG_PPC_FPU_REGS
powerpc/signal32: Fix Oops on sigreturn with unmapped VDSO
powerpc/vdso: Make sure vdso_wrapper.o is rebuilt everytime
vdso.so is rebuilt

Ciara Loftus (3):
libbpf: Ensure umem pointer is non-NULL before dereferencing
libbpf: Restore umem state after socket create failure
libbpf: Only create rx and tx XDP rings when necessary

Claudiu Beznea (1):
net: macb: restore cmp registers on resume path

Claudiu Manoil (1):
gianfar: Handle error code at MAC address change

Dan Carpenter (2):
thunderbolt: Fix a leak in tb_retimer_add()
thunderbolt: Fix off by one in tb_port_find_retimer()

Daniel Jurgens (1):
net/mlx5: Don't request more than supported EQs

Daniel Mack (1):
net: axienet: allow setups without MDIO

Danielle Ratson (2):
ethtool: Remove link_mode param and derive link params from driver
ethtool: Add lanes parameter for ETHTOOL_LINK_MODE_10000baseR_FEC_BIT

Dave Ertman (1):
ice: remove DCBNL_DEVRESET bit from PF state

Dave Marchevsky (1):
bpf: Refcount task stack in bpf_get_task_stack

Dima Chumak (1):
net/mlx5e: Consider geneve_opts for encap contexts

Dimitar Dimitrov (1):
remoteproc: pru: Fix loading of GNU Binutils ELF

Dinh Nguyen (1):
dt-bindings: net: micrel-ksz90x1.txt: correct documentation

Dmitry Baryshkov (2):
drm/msm: a6xx: fix version check for the A650 SQE microcode
clk: fixed: fix double free in resource managed fixed-factor clock

Dmitry Safonov (1):
xfrm/compat: Cleanup WARN()s that can be user-triggered

Dom Cobley (1):
drm/vc4: crtc: Reduce PV fifo threshold on hvs4

Du Cheng (1):
cfg80211: remove WARN_ON() in cfg80211_sme_connect

Eli Cohen (5):
net/mlx5: Fix HW spec violation configuring uplink
vdpa/mlx5: Use the correct dma device when registering memory
vdpa/mlx5: Retrieve BAR address suitable any function
vdpa/mlx5: Fix wrong use of bit numbers
vdpa/mlx5: Fix suspend/resume index restoration

Eric Dumazet (4):
sch_red: fix off-by-one checks in red_check_params()
net: ensure mac header is set in virtio_net_hdr_to_skb()
Revert "net: correct sk_acceptq_is_full()"
virtio_net: Do not pull payload in skb->head

Eryk Rybak (2):
i40e: Fix kernel oops when i40e driver removes VF's
i40e: Fix display statistics for veb_tc

Evan Nimmo (1):
xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume

Eyal Birger (3):
xfrm: interface: fix ipv4 pmtu check to honor ip header df
vti: fix ipv4 pmtu check to honor ip header df
vti6: fix ipv4 pmtu check to honor ip header df

Fabio Pricoco (1):
ice: Increase control queue timeout

Florian Fainelli (2):
Revert "ARM: dts: bcm2711: Add the BSC interrupt controller"
net: phy: broadcom: Only advertise EEE for supported modes

Frank Rowand (2):
of: properly check for error returned by fdt_get_name()
of: unittest: overlay: ensure proper alignment of copied FDT

Gao Xiang (1):
parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers

Geert Uytterhoeven (3):
regulator: bd9571mwv: Fix AVS and DVFS voltage range
regulator: bd9571mwv: Fix regulator name printed on registration failure
regulator: bd9571mwv: Convert device attribute to sysfs_emit()

Gregory CLEMENT (1):
Revert "arm64: dts: marvell: armada-cp110: Switch to per-port
SATA interrupts"

Gregory Greenman (1):
iwlwifi: mvm: rfi: don't lock mvm->mutex when sending config command

Grzegorz Siwik (1):
i40e: Fix parameters in aq_get_phy_register()

Guangbin Huang (1):
net: hns3: clear VF down state bit before request link status

Guennadi Liakhovetski (1):
ASoC: SOF: Intel: HDA: fix core status verification

Guenter Roeck (1):
pcnet32: Use pci_resource_len to validate PCI resource

Hans de Goede (5):
brcmfmac: p2p: Fix recently introduced deadlock issue
ASoC: intel: atom: Stop advertising non working S24LE support
ASoC: intel: atom: Remove 44100 sample-rate from the media and
deep-buffer DAI descriptions
platform/x86: intel-hid: Fix spurious wakeups caused by
tablet-mode events during suspend
Bluetooth: btusb: Revert Fix the autosuspend enable and disable

Hao Fang (1):
i2c: hix5hd2: use the correct HiSilicon copyright

Heiko Carstens (2):
s390/irq: fix reading of ext_params2 field from lowcore
s390/setup: use memblock_free_late() to free old stack

Helge Deller (1):
parisc: parisc-agp requires SBA IOMMU driver

Ian Rogers (1):
perf arm-spe: Avoid potential buffer overrun

Ido Schimmel (2):
mlxsw: spectrum: Fix ECN marking in tunnel decapsulation
selftests: forwarding: vxlan_bridge_1d: Add more ECN decap test cases

Ilya Lipnitskiy (1):
of: property: fw_devlink: do not link ".*,nr-gpios"

Ilya Maximets (1):
openvswitch: fix send of uninitialized stack memory in ct limit reply

Jacek Bułatek (1):
ice: Fix for dereference of NULL pointer

Jack Qiu (1):
fs: direct-io: fix missing sdio->boundary

Jakub Kicinski (4):
docs: ethtool: fix some copy-paste errors
ethtool: un-kdocify extended link state
ethtool: document reserved fields in the uAPI
ethtool: fix kdoc in headers

Jin Yao (1):
perf report: Fix wrong LBR block sorting

Jiri Kosina (1):
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()

Jiri Olsa (1):
bpf: Take module reference for trampoline in module

Johannes Berg (8):
iwlwifi: pcie: properly set LTR workarounds on 22000 devices
iwlwifi: fw: fix notification wait locking
iwlwifi: mvm: fix beacon protection checks
rfkill: revert back to old userspace API by default
mac80211: fix TXQ AC confusion
cfg80211: check S1G beacon compat element length
nl80211: fix potential leak of ACL params
nl80211: fix beacon head validation

John Fastabend (2):
bpf, sockmap: Fix sk->prot unhash op reset
bpf, sockmap: Fix incorrect fwd_alloc accounting

John Stultz (1):
drm/msm: Fix removal of valid error case when checking speed_bin

Jonas Holmberg (1):
ALSA: aloop: Fix initialization of controls

Jordan Crouse (1):
mailmap: update email address for Jordan Crouse

Julian Braha (1):
lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS

Kalyan Thota (1):
drm/msm/disp/dpu1: program 3d_merge only if block is attached

Kamal Heib (1):
RDMA/qedr: Fix kernel panic when trying to access recv_cq

Krzysztof Goreczny (1):
ice: prevent ice_open and ice_stop during reset

Krzysztof Kozlowski (2):
clk: socfpga: fix iomem pointer cast on 64-bit
i2c: exynos5: correct top kerneldoc

Kumar Kartikeya Dwivedi (1):
net: sched: bump refcount for new action in ACT replace mode

Kurt Kanzenbach (1):
net: hsr: Reset MAC header for Tx path

Leon Romanovsky (1):
RDMA/addr: Be strict with gid size

Libin Yang (5):
ASoC: SOF: Intel: TGL: fix EHL ops
ASoC: SOF: Intel: TGL: set shutdown callback to hda_dsp_shutdown
ASoC: SOF: Intel: ICL: set shutdown callback to hda_dsp_shutdown
ASoC: SOF: Intel: CNL: set shutdown callback to hda_dsp_shutdown
ASoC: SOF: Intel: APL: set shutdown callback to hda_dsp_shutdown

Linus Torvalds (1):
Linux 5.12-rc7

Loic Poulain (1):
net: qrtr: Fix memory leak on qrtr_tx_wait failure

Lorenz Bauer (2):
bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET
bpf: program: Refuse non-O_RDWR flags in BPF_OBJ_GET

Lorenzo Bianconi (1):
mt76: mt7921: fix airtime reporting

Luca Coelho (2):
iwlwifi: fix 11ax disabled bit in the regulatory capability flags
iwlwifi: pcie: add support for So-F devices

Luca Fancellu (1):
xen/evtchn: Change irq_info lock to raw_spinlock_t

Lukasz Bartosik (2):
clk: fix invalid usage of list cursor in register
clk: fix invalid usage of list cursor in unregister

Lv Yunlong (7):
gpu/xen: Fix a use after free in xen_drm_drv_init
drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso
net:tipc: Fix a double free in tipc_sk_mcast_rcv
ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx
net/rds: Fix a use after free in rds_message_map_pages
net: broadcom: bcm4908enet: Fix a double free in bcm4908_enet_dma_alloc

Maciej Żenczykowski (1):
net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()

Maciek Borzecki (1):
cifs: escape spaces in share names

Magnus Karlsson (1):
i40e: fix receiving of single packets in xsk zero-copy mode

Manivannan Sadhasivam (1):
MAINTAINERS: Add entry for Qualcomm IPC Router (QRTR) driver

Maor Dickman (2):
net/mlx5: Delete auxiliary bus driver eth-rep first
net/mlx5: E-switch, Create vport miss group only if src rewrite
is supported

Marc Kleine-Budde (2):
can: uapi: can.h: mark union inside struct can_frame packed
can: mcp251x: fix support for half duplex SPI host controllers

Marco Elver (1):
kfence, x86: fix preemptible warning on KPTI-enabled systems

Marek Behún (3):
ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin
MAINTAINERS: update CZ.NIC's Turris information
treewide: change my e-mail address, fix my name

Martin Blumenstingl (3):
net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock
net: dsa: lantiq_gswip: Don't use PHY auto polling
net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits

Martin Wilck (1):
scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state

Mateusz Palczewski (1):
i40e: Added Asym_Pause to supported link modes

Mathieu Poirier (1):
MAINTAINERS: Add co-maintainer for remoteproc/RPMSG subsystems

Matt Chen (1):
iwlwifi: add support for Qu with AX201 device

Matthew Wilcox (1):
.mailmap: fix old email addresses

Mauro Carvalho Chehab (3):
dt-bindings: don't use ../dir for doc references
dt-bindings: fix references for iio-bindings.txt
dt-bindings:iio:adc: update motorola,cpcap-adc.yaml reference

Maxim Kochetkov (1):
net: dsa: Fix type was not set for devlink port

Maxime Ripard (1):
drm/vc4: plane: Remove redundant assignment

Md Haris Iqbal (1):
RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt
session files

Mike Marciniszyn (1):
IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS

Mike Rapoport (1):
nds32: flush_dcache_page: use page_mapping_file to avoid races
with swapoff

Milton Miller (1):
net/ncsi: Avoid channel_monitor hrtimer deadlock

Muhammad Usama Anjum (1):
net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh

Naohiro Aota (1):
btrfs: zoned: move superblock logging zone location

Nick Desaulniers (1):
gcov: re-fix clang-11+ support

Norbert Ciosek (1):
virtchnl: Fix layout of RSS structures

Norman Maurer (1):
net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);

Oliver Hartkopp (2):
can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE

Oliver Stäbler (1):
arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0

Ondrej Mosnacek (3):
selinux: make nslot handling in avtab more robust
selinux: fix cond_list corruption when changing booleans
selinux: fix race between old and new sidtab

Ong Boon Leong (1):
xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model

Paolo Abeni (4):
net: let skb_orphan_partial wake-up waiters.
mptcp: forbit mcast-related sockopt on MPTCP sockets
mptcp: revert "mptcp: provide subflow aware release function"
net: fix hangup on napi_disable for threaded napi

Paolo Bonzini (1):
KVM: x86/mmu: preserve pending TLB flush across calls to
kvm_tdp_mmu_zap_sp

Pavel Begunkov (3):
io_uring: clear F_REISSUE right after getting it
io_uring: fix rw req completion
io-wq: cancel unbounded works on io-wq destroy

Pavel Skripkin (3):
drivers: net: fix memory leak in atusb_probe
drivers: net: fix memory leak in peak_usb_create_dev
net: mac802154: Fix general protection fault

Pavel Tikhomirov (1):
net: sched: sch_teql: fix null-pointer dereference

Pawel Laszczak (1):
usb: cdnsp: Fixes issue with dequeuing requests after disabling endpoint

Pedro Tammela (1):
libbpf: Fix bail out from 'ringbuf_process_ring()' on error

Phillip Potter (1):
net: tun: set tun->dev->addr_len during TUNSETLINK processing

Pierre-Louis Bossart (2):
ASoC: SOF: core: harden shutdown helper
ASoC: SOF: Intel: move ELH chip info

Piotr Krysiuk (2):
bpf, x86: Validate computation of branch displacements for x86-64
bpf, x86: Validate computation of branch displacements for x86-32

Potnuri Bharat Teja (1):
RDMA/cxgb4: check for ipv6 address properly while destroying listener

Qingqing Zhuo (1):
drm/amd/display: Add missing mask for DCN3

Raed Salem (1):
net/mlx5: Fix placement of log_max_flow_counter

Rafał Miłecki (2):
dt-bindings: net: ethernet-controller: fix typo in NVMEM
dt-bindings: net: bcm4908-enet: fix Ethernet generic properties

Rahul Lakkireddy (1):
cxgb4: avoid collecting SGE_QBASE regs during traffic

Rob Clark (1):
drm/msm: Fix a5xx/a6xx timestamps

Robert Malz (1):
ice: Cleanup fltr list in case of allocation issues

Roman Bolshakov (1):
scsi: target: iscsi: Fix zero tag inside a trace event

Roman Gushchin (1):
percpu: make pcpu_nr_empty_pop_pages per chunk type

Rui Salvaterra (1):
ARM: dts: turris-omnia: fix hardware buffer management

Ryan Lee (2):
ASoC: max98373: Changed amp shutdown register as volatile
ASoC: max98373: Added 30ms turn on/off time delay

Salil Mehta (3):
net: hns3: Remove the left over redundant check & assignment
net: hns3: Remove un-necessary 'else-if' in the hclge_reset_event()
net: hns3: Trivial spell fix in hns3 driver

Saravana Kannan (1):
driver core: Fix locking bug in deferred_probe_timeout_work_func()

Sebastian Reichel (1):
drm/panel: panel-dsi-cm: disable TE for now

Seevalamuthu Mariappan (1):
mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN

Sergei Trofimovich (4):
scsi: hpsa: Use __packed on individual structs, not header-wide
scsi: hpsa: Fix boot on ia64 (atomic_t alignment)
scsi: hpsa: Add an assert to prevent __packed reintroduction
ia64: fix user_stack_pointer() for ptrace()

Shengjiu Wang (1):
ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips

Shuah Khan (4):
usbip: add sysfs_lock to synchronize sysfs code paths
usbip: stub-dev synchronize sysfs code paths
usbip: vudc synchronize sysfs code paths
usbip: synchronize event handler with sysfs code paths

Shyam Prasad N (1):
cifs: On cifs_reconnect, resolve the hostname again.

Shyam Sundar S K (1):
amd-xgbe: Update DMA coherency values

Si-Wei Liu (1):
vdpa/mlx5: should exclude header length and fcs from mtu

Srinivas Kandagatla (2):
ASoC: codecs: lpass-tx-macro: set npl clock rate correctly
ASoC: codecs: lpass-rx-macro: set npl clock rate correctly

Stefan Riedmueller (1):
ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces

Steffen Klassert (2):
xfrm: Fix NULL pointer dereference on policy lookup
xfrm: Provide private skb extensions for segmented and hw
offloaded ESP packets

Stephen Boyd (1):
drm/msm: Set drvdata to NULL when msm_drm_init() fails

Stephen Hemminger (1):
ipv6: report errors for iftoken via netlink extack

Suman Anna (1):
remoteproc: pru: Fix firmware loading crashes on K3 SoCs

Sven Van Asbroeck (1):
lan743x: fix ethernet frame cutoff issue

Takashi Iwai (3):
ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model
drm/i915: Fix invalid access to ACPI _DSM objects
ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1

Taniya Das (1):
clk: qcom: camcc: Update the clock ops for the SC7180

Tariq Toukan (3):
net/mlx5e: kTLS, Fix TX counters atomicity
net/mlx5e: kTLS, Fix RX counters atomicity
net/mlx5e: Guarantee room for XSK wakeup NOP on async ICOSQ

Tetsuo Handa (2):
lockdep: Add a missing initialization hint to the "INFO: Trying
to register non-static key" message
batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field

Thomas Tai (1):
x86/traps: Correct exc_general_protection() and math_error() return paths

Toke Høiland-Jørgensen (2):
bpf: Enforce that struct_ops programs be GPL-only
bpf/selftests: Test that kernel rejects a TCP CC with an invalid license

Tong Zhu (1):
neighbour: Disregard DEAD dst in neigh_update

Tony Lindgren (3):
ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
ARM: OMAP4: Fix PMIC voltage domains for bionic

Vasily Gorbik (1):
s390/unwind: add machine check handler stack

Vineet Gupta (1):
ARC: haps: bump memory to 1 GB

Viswas G (1):
scsi: pm80xx: Fix chip initialization failure

Vitaly Kuznetsov (1):
ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m

Vlad Buslov (3):
Revert "net: sched: bump refcount for new action in ACT replace mode"
net: sched: fix action overwrite reference counting
net: sched: fix err handler in tcf_action_init()

Vladimir Oltean (1):
net: dsa: only unset VLAN filtering when last port leaves last
VLAN-aware bridge

Wan Jiabing (3):
drivers: gpu: drm: xen_drm_front_drm_info is declared twice
parisc: Remove duplicate struct task_struct declaration
fs: cifs: Remove unnecessary struct declaration

Wang Qing (2):
arc: kernel: Return -EFAULT if copy_to_user() fails
workqueue/watchdog: Make unbound workqueues aware of
touch_softlockup_watchdog() 84;0;0c84;0;0c There are two
workqueue-specific watchdog timestamps:

Wengang Wang (1):
ocfs2: fix deadlock between setattr and dio_end_io_write

William Roche (1):
RAS/CEC: Correct ce_add_elem()'s returned values

Wolfram Sang (4):
i2c: turn recovery error on init to debug
i2c: imx: drop me as maintainer of binding docs
i2c: gpio: update email address in binding docs
i2c: imx: mention Oleksij as maintainer of the binding docs

Wong Vee Khee (1):
ethtool: fix incorrect datatype in set_eee ops

Xiaoming Ni (5):
nfc: fix refcount leak in llcp_sock_bind()
nfc: fix refcount leak in llcp_sock_connect()
nfc: fix memory leak in llcp_sock_connect()
nfc: Avoid endless loops caused by repeated llcp_sock_connect()
net/mlx5: fix kfree mismatch in indir_table.c

Xin Long (3):
esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
xfrm: BEET mode doesn't support fragments for inner packets
tipc: increment the tmp aead refcnt before attaching it

Xu Kuohai (1):
bpf: Fix a spelling typo in bpf_atomic_alu_string disasm

Yinjun Zhang (1):
nfp: flower: ignore duplicate merge hints from FW

Yongxin Liu (1):
ice: fix memory leak of aRFS after resuming from suspend

Yunjian Wang (2):
sch_htb: fix null pointer dereference on a null new_q
net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb

Zheng Yongjun (1):
net: tipc: Fix spelling errors in net/tipc module

Zqiang (1):
workqueue: Move the position of debug_work_activate() in __queue_work()

dean.yang_cp (1):
ARC: treewide: avoid the pointer addition with NULL pointer

kernel test robot (1):
ASoC: cygnus: fix for_each_child.cocci warnings

xinhui pan (2):
drm/amdgpu: Fix size overflow
drm/radeon: Fix size overflow

周琰杰 (Zhou Yanjie) (1):
I2C: JZ4780: Fix bug for Ingenic X1000.

Shyam Sundar S K (1):
amd-xgbe: Update DMA coherency values

Si-Wei Liu (1):
vdpa/mlx5: should exclude header length and fcs from mtu

Srinivas Kandagatla (2):
ASoC: codecs: lpass-tx-macro: set npl clock rate correctly
ASoC: codecs: lpass-rx-macro: set npl clock rate correctly

Stefan Riedmueller (1):
ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces

Steffen Klassert (2):
xfrm: Fix NULL pointer dereference on policy lookup
xfrm: Provide private skb extensions for segmented and hw
offloaded ESP packets

Stephen Boyd (1):
drm/msm: Set drvdata to NULL when msm_drm_init() fails

Stephen Hemminger (1):
ipv6: report errors for iftoken via netlink extack

Suman Anna (1):
remoteproc: pru: Fix firmware loading crashes on K3 SoCs

Sven Van Asbroeck (1):
lan743x: fix ethernet frame cutoff issue

Takashi Iwai (3):
ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model
drm/i915: Fix invalid access to ACPI _DSM objects
ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1

Taniya Das (1):
clk: qcom: camcc: Update the clock ops for the SC7180

Tariq Toukan (3):
net/mlx5e: kTLS, Fix TX counters atomicity
net/mlx5e: kTLS, Fix RX counters atomicity
net/mlx5e: Guarantee room for XSK wakeup NOP on async ICOSQ

Tetsuo Handa (2):
lockdep: Add a missing initialization hint to the "INFO: Trying
to register non-static key" message
batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field

Thomas Tai (1):
x86/traps: Correct exc_general_protection() and math_error() return paths

Toke Høiland-Jørgensen (2):
bpf: Enforce that struct_ops programs be GPL-only
bpf/selftests: Test that kernel rejects a TCP CC with an invalid license

Tong Zhu (1):
neighbour: Disregard DEAD dst in neigh_update

Tony Lindgren (3):
ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
ARM: OMAP4: Fix PMIC voltage domains for bionic

Vasily Gorbik (1):
s390/unwind: add machine check handler stack

Vineet Gupta (1):
ARC: haps: bump memory to 1 GB

Viswas G (1):
scsi: pm80xx: Fix chip initialization failure

Vitaly Kuznetsov (1):
ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m

Vlad Buslov (3):
Revert "net: sched: bump refcount for new action in ACT replace mode"
net: sched: fix action overwrite reference counting
net: sched: fix err handler in tcf_action_init()

Vladimir Oltean (1):
net: dsa: only unset VLAN filtering when last port leaves last
VLAN-aware bridge

Wan Jiabing (3):
drivers: gpu: drm: xen_drm_front_drm_info is declared twice
parisc: Remove duplicate struct task_struct declaration
fs: cifs: Remove unnecessary struct declaration

Wang Qing (2):
arc: kernel: Return -EFAULT if copy_to_user() fails
workqueue/watchdog: Make unbound workqueues aware of
touch_softlockup_watchdog() 84;0;0c84;0;0c There are two
workqueue-specific watchdog timestamps:

Wengang Wang (1):
ocfs2: fix deadlock between setattr and dio_end_io_write

William Roche (1):
RAS/CEC: Correct ce_add_elem()'s returned values

Wolfram Sang (4):
i2c: turn recovery error on init to debug
i2c: imx: drop me as maintainer of binding docs
i2c: gpio: update email address in binding docs
i2c: imx: mention Oleksij as maintainer of the binding docs

Wong Vee Khee (1):
ethtool: fix incorrect datatype in set_eee ops

Xiaoming Ni (5):
nfc: fix refcount leak in llcp_sock_bind()
nfc: fix refcount leak in llcp_sock_connect()
nfc: fix memory leak in llcp_sock_connect()
nfc: Avoid endless loops caused by repeated llcp_sock_connect()
net/mlx5: fix kfree mismatch in indir_table.c

Xin Long (3):
esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
xfrm: BEET mode doesn't support fragments for inner packets
tipc: increment the tmp aead refcnt before attaching it

Xu Kuohai (1):
bpf: Fix a spelling typo in bpf_atomic_alu_string disasm

Yinjun Zhang (1):
nfp: flower: ignore duplicate merge hints from FW

Yongxin Liu (1):
ice: fix memory leak of aRFS after resuming from suspend

Yunjian Wang (2):
sch_htb: fix null pointer dereference on a null new_q
net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb

Zheng Yongjun (1):
net: tipc: Fix spelling errors in net/tipc module

Zqiang (1):
workqueue: Move the position of debug_work_activate() in __queue_work()

dean.yang_cp (1):
ARC: treewide: avoid the pointer addition with NULL pointer

kernel test robot (1):
ASoC: cygnus: fix for_each_child.cocci warnings

xinhui pan (2):
drm/amdgpu: Fix size overflow
drm/radeon: Fix size overflow

周琰杰 (Zhou Yanjie) (1):
I2C: JZ4780: Fix bug for Ingenic X1000.


2021-04-12 02:18:05

by Ronald Warsow

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

Hallo

thanks all for the new kernel.

however, I see the following since linux-5.12-rc6 (when I started
testing 5.12)

I'm, as a non-developer, quiet not sure what the warning mean or better
how important they need to be taken, cause the box run's fine, so far.

I'm not sure if the warnings, etc. are only caused by the new compiler,
what is: gcc version 11.0.1 20210405 (Red Hat 11.0.1-0) (GCC) on an
Fedora 34 (beta) box or if it's something else.


during compilation:
===================

...
In function ‘poly1305_simd_init’,
inlined from ‘crypto_poly1305_setdctxkey’ at
arch/x86/crypto/poly1305_glue.c:150:4,
inlined from ‘crypto_poly1305_setdctxkey’ at
arch/x86/crypto/poly1305_glue.c:144:21,
inlined from ‘poly1305_update_arch’ at
arch/x86/crypto/poly1305_glue.c:181:8:
arch/x86/crypto/poly1305_glue.c:86:9: warning: ‘poly1305_init_x86_64’
reading 32 bytes from a region of size 16 [-Wstringop-overread]
86 | poly1305_init_x86_64(ctx, key);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/x86/crypto/poly1305_glue.c: In function ‘poly1305_update_arch’:
arch/x86/crypto/poly1305_glue.c:86:9: note: referencing argument 2 of
type ‘const u8 *’ {aka ‘const unsigned char *’}
arch/x86/crypto/poly1305_glue.c:18:17: note: in a call to function
‘poly1305_init_x86_64’
18 | asmlinkage void poly1305_init_x86_64(void *ctx,
| ^~~~~~~~~~~~~~~~~~~~
...

CC security/selinux/ss/sidtab.o
In file included from ./include/linux/string.h:269,
from ./include/linux/bitmap.h:9,
from ./include/linux/cpumask.h:12,
from ./arch/x86/include/asm/cpumask.h:5,
from ./arch/x86/include/asm/msr.h:11,
from ./arch/x86/include/asm/processor.h:22,
from ./arch/x86/include/asm/cpufeature.h:5,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:59,
from ./arch/x86/include/asm/preempt.h:7,
from ./include/linux/preempt.h:78,
from ./include/linux/rcupdate.h:27,
from ./include/linux/rbtree.h:22,
from ./include/linux/iova.h:14,
from ./include/linux/intel-iommu.h:14,
from arch/x86/kernel/tboot.c:9:
In function ‘memcmp’,
inlined from ‘tboot_probe’ at arch/x86/kernel/tboot.c:70:6:
./include/linux/fortify-string.h:19:33: warning: ‘__builtin_memcmp_eq’
specified bound 16 exceeds source size 0 [-Wstringop-overread]
19 | #define __underlying_memcmp __builtin_memcmp
| ^
./include/linux/fortify-string.h:235:16: note: in expansion of macro
‘__underlying_memcmp’
235 | return __underlying_memcmp(p, q, size);
| ^~~~~~~~~~~~~~~~~~~
...

CC net/core/fib_rules.o
In function ‘snb_wm_latency_quirk’,
inlined from ‘ilk_setup_wm_latency’ at
drivers/gpu/drm/i915/intel_pm.c:3108:3,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3057:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3057 | intel_print_wm_latency(dev_priv, "Primary",
dev_priv->wm.pri_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3057:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘snb_wm_latency_quirk’,
inlined from ‘ilk_setup_wm_latency’ at
drivers/gpu/drm/i915/intel_pm.c:3108:3,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3058:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3058 | intel_print_wm_latency(dev_priv, "Sprite",
dev_priv->wm.spr_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3058:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘snb_wm_latency_quirk’,
inlined from ‘ilk_setup_wm_latency’ at
drivers/gpu/drm/i915/intel_pm.c:3108:3,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3059:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3059 | intel_print_wm_latency(dev_priv, "Cursor",
dev_priv->wm.cur_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3059:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘snb_wm_lp3_irq_quirk’,
inlined from ‘ilk_setup_wm_latency’ at
drivers/gpu/drm/i915/intel_pm.c:3109:3,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3086:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3086 | intel_print_wm_latency(dev_priv, "Primary",
dev_priv->wm.pri_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3086:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘snb_wm_lp3_irq_quirk’,
inlined from ‘ilk_setup_wm_latency’ at
drivers/gpu/drm/i915/intel_pm.c:3109:3,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3087:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3087 | intel_print_wm_latency(dev_priv, "Sprite",
dev_priv->wm.spr_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3087:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘snb_wm_lp3_irq_quirk’,
inlined from ‘ilk_setup_wm_latency’ at
drivers/gpu/drm/i915/intel_pm.c:3109:3,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3088:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3088 | intel_print_wm_latency(dev_priv, "Cursor",
dev_priv->wm.cur_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3088:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘ilk_setup_wm_latency’,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3103:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3103 | intel_print_wm_latency(dev_priv, "Primary",
dev_priv->wm.pri_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3103:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘ilk_setup_wm_latency’,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3104:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3104 | intel_print_wm_latency(dev_priv, "Sprite",
dev_priv->wm.spr_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3104:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
In function ‘ilk_setup_wm_latency’,
inlined from ‘intel_init_pm’ at drivers/gpu/drm/i915/intel_pm.c:7628:3:
drivers/gpu/drm/i915/intel_pm.c:3105:9: warning:
‘intel_print_wm_latency’ reading 16 bytes from a region of size 10
[-Wstringop-overread]
3105 | intel_print_wm_latency(dev_priv, "Cursor",
dev_priv->wm.cur_latency);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/intel_pm.c: In function ‘intel_init_pm’:
drivers/gpu/drm/i915/intel_pm.c:3105:9: note: referencing argument 3 of
type ‘const u16 *’ {aka ‘const short unsigned int *’}
drivers/gpu/drm/i915/intel_pm.c:2994:13: note: in a call to function
‘intel_print_wm_latency’
2994 | static void intel_print_wm_latency(struct drm_i915_private
*dev_priv,
| ^~~~~~~~~~~~~~~~~~~~~~
CC [M] drivers/gpu/drm/i915/intel_runtime_pm.o
...

AR drivers/media/platform/built-in.a
AR drivers/media/pci/ttpci/built-in.a
arch/x86/lib/msr-smp.c:255:51: warning: argument 2 of type ‘u32 *’ {aka
‘unsigned int *’} declared as a pointer [-Warray-parameter=]
255 | int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
| ~~~~~^~~~
In file included from ./arch/x86/include/asm/processor.h:22,
from ./arch/x86/include/asm/cpufeature.h:5,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:59,
from ./arch/x86/include/asm/preempt.h:7,
from ./include/linux/preempt.h:78,
from arch/x86/lib/msr-smp.c:3:
./arch/x86/include/asm/msr.h:347:50: note: previously declared as an
array ‘u32[8]’ {aka ‘unsigned int[8]’}
347 | int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]);
| ~~~~^~~~~~~
arch/x86/lib/msr-smp.c:268:51: warning: argument 2 of type ‘u32 *’ {aka
‘unsigned int *’} declared as a pointer [-Warray-parameter=]
268 | int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
| ~~~~~^~~~
In file included from ./arch/x86/include/asm/processor.h:22,
from ./arch/x86/include/asm/cpufeature.h:5,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:59,
from ./arch/x86/include/asm/preempt.h:7,
from ./include/linux/preempt.h:78,
from arch/x86/lib/msr-smp.c:3:
./arch/x86/include/asm/msr.h:348:50: note: previously declared as an
array ‘u32[8]’ {aka ‘unsigned int[8]’}
348 | int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]);
| ~~~~^~~~~~~
AR drivers/media/pci/b2c2/built-in.a
...

CC [M] drivers/gpu/drm/i915/i915_scheduler.o
lib/crypto/poly1305-donna64.c:15:67: warning: argument 2 of type ‘const
u8[16]’ {aka ‘const unsigned char[16]’} with mismatched bound
[-Warray-parameter=]
15 | void poly1305_core_setkey(struct poly1305_core_key *key, const
u8 raw_key[16])
|
~~~~~~~~~^~~~~~~~~~~
In file included from lib/crypto/poly1305-donna64.c:11:
./include/crypto/internal/poly1305.h:21:68: note: previously declared as
‘const u8 *’ {aka ‘const unsigned char *’}
21 | void poly1305_core_setkey(struct poly1305_core_key *key, const
u8 *raw_key);
|
~~~~~~~~~~^~~~~~~
AS arch/x86/lib/iomap_copy_64.o
...

CC lib/assoc_array.o
In function ‘intel_dp_check_mst_status’,
inlined from ‘intel_dp_hpd_pulse’ at
drivers/gpu/drm/i915/display/intel_dp.c:5901:8:
drivers/gpu/drm/i915/display/intel_dp.c:4554:22: warning:
‘drm_dp_channel_eq_ok’ reading 6 bytes from a region of size 4
[-Wstringop-overread]
4554 | !drm_dp_channel_eq_ok(&esi[10],
intel_dp->lane_count)) {
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/i915/display/intel_dp.c: In function ‘intel_dp_hpd_pulse’:
drivers/gpu/drm/i915/display/intel_dp.c:4554:22: note: referencing
argument 1 of type ‘const u8 *’ {aka ‘const unsigned char *’}
In file included from drivers/gpu/drm/i915/display/intel_dp.c:38:
./include/drm/drm_dp_helper.h:1459:6: note: in a call to function
‘drm_dp_channel_eq_ok’
1459 | bool drm_dp_channel_eq_ok(const u8
link_status[DP_LINK_STATUS_SIZE],
| ^~~~~~~~~~~~~~~~~~~~
CC [M] drivers/gpu/drm/i915/display/intel_dp_aux.o
...


in with dmesg
=============

I see this ACPI Error's since 5.12-rc6 (a regression compared to 5.11.x)


[ 0.960137] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960141] ACPI Error: Aborting method \_PR.CPU1._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
[ 0.960168] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960170] ACPI Error: Aborting method \_PR.CPU2._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
[ 0.960195] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960197] ACPI Error: Aborting method \_PR.CPU3._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
[ 0.960222] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960224] ACPI Error: Aborting method \_PR.CPU4._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
[ 0.960248] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960250] ACPI Error: Aborting method \_PR.CPU5._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
[ 0.960274] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960276] ACPI Error: Aborting method \_PR.CPU6._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
[ 0.960300] ACPI BIOS Error (bug): Could not resolve symbol
[\_PR.CPU0._CPC], AE_NOT_FOUND (20210105/psargs-330)
[ 0.960302] ACPI Error: Aborting method \_PR.CPU7._CPC due to
previous error (AE_NOT_FOUND) (20210105/psparse-529)
...


and this one since 5.11 or earlier:

[ 2.598268] i915 0000:00:02.0: [drm] failed to retrieve link info,
disabling eDP

box is connected via HDMI only.


regards

Ronald

2021-04-12 05:17:40

by Guenter Roeck

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Sun, Apr 11, 2021 at 03:41:18PM -0700, Linus Torvalds wrote:
> Oh well. rc5 was big. rc6 was small. And now rc7 is big again. In
> fact, it's the biggest rc7 (at least in number of commits) we've had
> in the 5.x series.
>
> It's mostly due to networking fixes (of which rc6 had none), and none
> of them should be all that scary, but it's never great when we have
> such a big rc. It's particularly annoying at the end of the release
> window like this.
>
> End result: I'm still waffling about the final 5.12 release. The fact
> that we have a big rc7 does make me think that I'll probably do an rc8
> this time around. But it ends up depending a bit on how the upcoming
> week goes, and if things are deathly quiet, I may end up deciding that
> an rc8 doesn't really make sense.
>
> So we'll see.
>
> Anyway, networking (both core and drivers) is over half of the rc7
> patch, with the rest being a fairly random collection of fixes all
> over. We've got other driver updates (sound, rdma, scsi, usb..) some
> fs fixes (io_uring, umount, btrfs, cifs, ocfs), minor arch fixes (arc,
> arm, parisc, powerpc, s390, x86), and other misc fixes.
>
> The shortlog is appended, although it's obviously not as nice and
> small and readable as I'd have liked at this point in the release..
>
> Please do test,
>

Build results:
total: 151 pass: 151 fail: 0
Qemu test results:
total: 460 pass: 459 fail: 1
Failed tests:
sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs

The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
skb->head"). It is a spurious problem - the test passes roughly every other
time. When the failure is seen, udhcpc fails to get an IP address and aborts
with SIGTERM. So far I have only seen this with the "sh" architecture.

Guenter

2021-04-12 16:41:51

by Michael S. Tsirkin

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Mon, Apr 12, 2021 at 09:28:28AM -0700, Linus Torvalds wrote:
> On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> >
> > Qemu test results:
> > total: 460 pass: 459 fail: 1
> > Failed tests:
> > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> >
> > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > skb->head"). It is a spurious problem - the test passes roughly every other
> > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > with SIGTERM. So far I have only seen this with the "sh" architecture.
>
> Hmm. Let's add in some more of the people involved in that commit, and
> also netdev.
>
> Nothing in there looks like it should have any interaction with
> architecture, so that "it happens on sh" sounds odd, but maybe it's
> some particular interaction with the qemu environment.
>
> Linus

Yea Eric's been trying to debug this already. Let's give him a bit more time...

--
MST

2021-04-12 16:53:01

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
<[email protected]> wrote:
>
> On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> >
> > Qemu test results:
> > total: 460 pass: 459 fail: 1
> > Failed tests:
> > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> >
> > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > skb->head"). It is a spurious problem - the test passes roughly every other
> > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > with SIGTERM. So far I have only seen this with the "sh" architecture.
>
> Hmm. Let's add in some more of the people involved in that commit, and
> also netdev.
>
> Nothing in there looks like it should have any interaction with
> architecture, so that "it happens on sh" sounds odd, but maybe it's
> some particular interaction with the qemu environment.

Yes, maybe.

I spent few hours on this, and suspect a buggy memcpy() implementation
on SH, but this was not conclusive.

By pulling one extra byte, the problem goes away.

Strange thing is that the udhcpc process does not go past sendto().

2021-04-12 17:36:09

by Guenter Roeck

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On 4/12/21 9:31 AM, Eric Dumazet wrote:
> On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> <[email protected]> wrote:
>>
>> On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
>>>
>>> Qemu test results:
>>> total: 460 pass: 459 fail: 1
>>> Failed tests:
>>> sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
>>>
>>> The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
>>> skb->head"). It is a spurious problem - the test passes roughly every other
>>> time. When the failure is seen, udhcpc fails to get an IP address and aborts
>>> with SIGTERM. So far I have only seen this with the "sh" architecture.
>>
>> Hmm. Let's add in some more of the people involved in that commit, and
>> also netdev.
>>
>> Nothing in there looks like it should have any interaction with
>> architecture, so that "it happens on sh" sounds odd, but maybe it's
>> some particular interaction with the qemu environment.
>
> Yes, maybe.
>
> I spent few hours on this, and suspect a buggy memcpy() implementation
> on SH, but this was not conclusive.
>

I replaced all memcpy() calls in skbuff.h with calls to

static inline void __my_memcpy(unsigned char *to, const unsigned char *from,
unsigned int len)
{
while (len--)
*to++ = *from++;
}

That made no difference, so unless you have some other memcpy() in mind that
seems to be unlikely.

> By pulling one extra byte, the problem goes away.
>
> Strange thing is that the udhcpc process does not go past sendto().
>

I have been trying to debug that one. Unfortunately gdb doesn't work with sh,
so I can't use it to debug the problem. I'll spend some more time on this today.

Thanks,
Guenter

2021-04-13 05:48:39

by Linus Torvalds

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
>
> Qemu test results:
> total: 460 pass: 459 fail: 1
> Failed tests:
> sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
>
> The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> skb->head"). It is a spurious problem - the test passes roughly every other
> time. When the failure is seen, udhcpc fails to get an IP address and aborts
> with SIGTERM. So far I have only seen this with the "sh" architecture.

Hmm. Let's add in some more of the people involved in that commit, and
also netdev.

Nothing in there looks like it should have any interaction with
architecture, so that "it happens on sh" sounds odd, but maybe it's
some particular interaction with the qemu environment.

Linus

2021-04-13 05:57:53

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
>
> On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> <[email protected]> wrote:
> >
> > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > >
> > > Qemu test results:
> > > total: 460 pass: 459 fail: 1
> > > Failed tests:
> > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > >
> > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> >
> > Hmm. Let's add in some more of the people involved in that commit, and
> > also netdev.
> >
> > Nothing in there looks like it should have any interaction with
> > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > some particular interaction with the qemu environment.
>
> Yes, maybe.
>
> I spent few hours on this, and suspect a buggy memcpy() implementation
> on SH, but this was not conclusive.
>
> By pulling one extra byte, the problem goes away.
>
> Strange thing is that the udhcpc process does not go past sendto().

This is the patch working around the issue. Unfortunately I was not
able to root-cause it (I really suspect something on SH)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
virtnet_info *vi,

/* Copy all frame if it fits skb->head, otherwise
* we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
+ *
+ * Apparently, pulling only the Ethernet Header triggers a bug
on qemu-system-sh4.
+ * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
+ * more to work around this bug : These 20 bytes can not belong
+ * to UDP/TCP payload.
+ * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
*/
if (len <= skb_tailroom(skb))
copy = len;
else
- copy = ETH_HLEN + metasize;
+ copy = ETH_HLEN + sizeof(struct iphdr) + metasize;
skb_put_data(skb, p, copy);

if (metasize) {

2021-04-13 07:02:08

by Guenter Roeck

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On 4/12/21 10:38 AM, Eric Dumazet wrote:
[ ... ]

> Yes, I think this is the real issue here. This smells like some memory
> corruption.
>
> In my traces, packet is correctly received in AF_PACKET queue.
>
> I have checked the skb is well formed.
>
> But the user space seems to never call poll() and recvmsg() on this
> af_packet socket.
>

After sprinkling the kernel with debug messages:

424 00:01:33.674181 sendto(6, "E\0\1H\0\0\0\0@\21y\246\0\0\0\0\377\377\377\377\0D\0C\00148\346\1\1\6\0\246\336\333\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0RT\0\
424 00:01:33.693873 close(6) = 0
424 00:01:33.694652 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
424 00:01:33.695213 clock_gettime64(CLOCK_MONOTONIC, 0x7be18a18) = -1 EFAULT (Bad address)
424 00:01:33.695889 write(2, "udhcpc: clock_gettime(MONOTONIC) failed\n", 40) = -1 EFAULT (Bad address)
424 00:01:33.697311 exit_group(1) = ?
424 00:01:33.698346 +++ exited with 1 +++

I only see that after adding debug messages in the kernel, so I guess there must be
a heisenbug somehere.

Anyway, indeed, I see (another kernel debug message):

__do_sys_clock_gettime: Returning -EFAULT on address 0x7bacc9a8

So udhcpc doesn't even try to read the reply because it crashes after sendto()
when trying to read the current time. Unless I am missing something, that means
that the problem happens somewhere on the send side.

To make things even more interesting, it looks like the failing system call
isn't always clock_gettime().

Guenter

2021-04-13 10:39:22

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Mon, Apr 12, 2021 at 7:31 PM Guenter Roeck <[email protected]> wrote:
>
> On 4/12/21 9:31 AM, Eric Dumazet wrote:
> > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > <[email protected]> wrote:
> >>
> >> On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> >>>
> >>> Qemu test results:
> >>> total: 460 pass: 459 fail: 1
> >>> Failed tests:
> >>> sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> >>>
> >>> The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> >>> skb->head"). It is a spurious problem - the test passes roughly every other
> >>> time. When the failure is seen, udhcpc fails to get an IP address and aborts
> >>> with SIGTERM. So far I have only seen this with the "sh" architecture.
> >>
> >> Hmm. Let's add in some more of the people involved in that commit, and
> >> also netdev.
> >>
> >> Nothing in there looks like it should have any interaction with
> >> architecture, so that "it happens on sh" sounds odd, but maybe it's
> >> some particular interaction with the qemu environment.
> >
> > Yes, maybe.
> >
> > I spent few hours on this, and suspect a buggy memcpy() implementation
> > on SH, but this was not conclusive.
> >
>
> I replaced all memcpy() calls in skbuff.h with calls to
>
> static inline void __my_memcpy(unsigned char *to, const unsigned char *from,
> unsigned int len)
> {
> while (len--)
> *to++ = *from++;
> }
>
> That made no difference, so unless you have some other memcpy() in mind that
> seems to be unlikely.


Sure, note I also had :

diff --git a/net/core/dev.c b/net/core/dev.c
index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..4e05a32542dd606aaaaee8038017fea949939c0e
100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5938,7 +5938,7 @@ static void gro_pull_from_frag0(struct sk_buff
*skb, int grow)

BUG_ON(skb->end - skb->tail < grow);

- memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
+ memmove(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);

skb->data_len -= grow;
skb->tail += grow;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c421c8f809256f7b13a8b5a1331108449353ee2d..41796dedfa9034f2333cf249a0d81b7250e14d1f
100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2278,7 +2278,7 @@ int skb_copy_bits(const struct sk_buff *skb, int
offset, void *to, int len)
skb_frag_off(f) + offset - start,
copy, p, p_off, p_len, copied) {
vaddr = kmap_atomic(p);
- memcpy(to + copied, vaddr + p_off, p_len);
+ memmove(to + copied, vaddr + p_off, p_len);
kunmap_atomic(vaddr);
}


>
> > By pulling one extra byte, the problem goes away.
> >
> > Strange thing is that the udhcpc process does not go past sendto().
> >
>
> I have been trying to debug that one. Unfortunately gdb doesn't work with sh,
> so I can't use it to debug the problem. I'll spend some more time on this today.

Yes, I think this is the real issue here. This smells like some memory
corruption.

In my traces, packet is correctly received in AF_PACKET queue.

I have checked the skb is well formed.

But the user space seems to never call poll() and recvmsg() on this
af_packet socket.

2021-04-13 14:14:48

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Mon, Apr 12, 2021 at 10:05 PM Guenter Roeck <[email protected]> wrote:
>
> On 4/12/21 10:38 AM, Eric Dumazet wrote:
> [ ... ]
>
> > Yes, I think this is the real issue here. This smells like some memory
> > corruption.
> >
> > In my traces, packet is correctly received in AF_PACKET queue.
> >
> > I have checked the skb is well formed.
> >
> > But the user space seems to never call poll() and recvmsg() on this
> > af_packet socket.
> >
>
> After sprinkling the kernel with debug messages:
>
> 424 00:01:33.674181 sendto(6, "E\0\1H\0\0\0\0@\21y\246\0\0\0\0\377\377\377\377\0D\0C\00148\346\1\1\6\0\246\336\333\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0RT\0\
> 424 00:01:33.693873 close(6) = 0
> 424 00:01:33.694652 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
> 424 00:01:33.695213 clock_gettime64(CLOCK_MONOTONIC, 0x7be18a18) = -1 EFAULT (Bad address)
> 424 00:01:33.695889 write(2, "udhcpc: clock_gettime(MONOTONIC) failed\n", 40) = -1 EFAULT (Bad address)
> 424 00:01:33.697311 exit_group(1) = ?
> 424 00:01:33.698346 +++ exited with 1 +++
>
> I only see that after adding debug messages in the kernel, so I guess there must be
> a heisenbug somehere.
>
> Anyway, indeed, I see (another kernel debug message):
>
> __do_sys_clock_gettime: Returning -EFAULT on address 0x7bacc9a8
>
> So udhcpc doesn't even try to read the reply because it crashes after sendto()
> when trying to read the current time. Unless I am missing something, that means
> that the problem happens somewhere on the send side.
>
> To make things even more interesting, it looks like the failing system call
> isn't always clock_gettime().
>
> Guenter


I think GRO fast path has never worked on SUPERH. Probably SUPERH has
never used a fast NIC (10Gbit+)

The following hack fixes the issue.


diff --git a/net/core/dev.c b/net/core/dev.c
index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..91ba89a645ff91d4cd4f3d8dc8a009bcb67da344
100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5916,13 +5916,16 @@ static struct list_head
*gro_list_prepare(struct napi_struct *napi,

static void skb_gro_reset_offset(struct sk_buff *skb)
{
+#if !defined(CONFIG_SUPERH)
const struct skb_shared_info *pinfo = skb_shinfo(skb);
const skb_frag_t *frag0 = &pinfo->frags[0];
+#endif

NAPI_GRO_CB(skb)->data_offset = 0;
NAPI_GRO_CB(skb)->frag0 = NULL;
NAPI_GRO_CB(skb)->frag0_len = 0;

+#if !defined(CONFIG_SUPERH)
if (!skb_headlen(skb) && pinfo->nr_frags &&
!PageHighMem(skb_frag_page(frag0))) {
NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
@@ -5930,6 +5933,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
skb_frag_size(frag0),
skb->end - skb->tail);
}
+#endif
}

static void gro_pull_from_frag0(struct sk_buff *skb, int grow)

2021-04-13 14:31:09

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 11:24 AM Eric Dumazet <[email protected]> wrote:
>
> On Mon, Apr 12, 2021 at 10:05 PM Guenter Roeck <[email protected]> wrote:
> >
> > On 4/12/21 10:38 AM, Eric Dumazet wrote:
> > [ ... ]
> >
> > > Yes, I think this is the real issue here. This smells like some memory
> > > corruption.
> > >
> > > In my traces, packet is correctly received in AF_PACKET queue.
> > >
> > > I have checked the skb is well formed.
> > >
> > > But the user space seems to never call poll() and recvmsg() on this
> > > af_packet socket.
> > >
> >
> > After sprinkling the kernel with debug messages:
> >
> > 424 00:01:33.674181 sendto(6, "E\0\1H\0\0\0\0@\21y\246\0\0\0\0\377\377\377\377\0D\0C\00148\346\1\1\6\0\246\336\333\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0RT\0\
> > 424 00:01:33.693873 close(6) = 0
> > 424 00:01:33.694652 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
> > 424 00:01:33.695213 clock_gettime64(CLOCK_MONOTONIC, 0x7be18a18) = -1 EFAULT (Bad address)
> > 424 00:01:33.695889 write(2, "udhcpc: clock_gettime(MONOTONIC) failed\n", 40) = -1 EFAULT (Bad address)
> > 424 00:01:33.697311 exit_group(1) = ?
> > 424 00:01:33.698346 +++ exited with 1 +++
> >
> > I only see that after adding debug messages in the kernel, so I guess there must be
> > a heisenbug somehere.
> >
> > Anyway, indeed, I see (another kernel debug message):
> >
> > __do_sys_clock_gettime: Returning -EFAULT on address 0x7bacc9a8
> >
> > So udhcpc doesn't even try to read the reply because it crashes after sendto()
> > when trying to read the current time. Unless I am missing something, that means
> > that the problem happens somewhere on the send side.
> >
> > To make things even more interesting, it looks like the failing system call
> > isn't always clock_gettime().
> >
> > Guenter
>
>
> I think GRO fast path has never worked on SUPERH. Probably SUPERH has
> never used a fast NIC (10Gbit+)
>
> The following hack fixes the issue.
>
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..91ba89a645ff91d4cd4f3d8dc8a009bcb67da344
> 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5916,13 +5916,16 @@ static struct list_head
> *gro_list_prepare(struct napi_struct *napi,
>
> static void skb_gro_reset_offset(struct sk_buff *skb)
> {
> +#if !defined(CONFIG_SUPERH)
> const struct skb_shared_info *pinfo = skb_shinfo(skb);
> const skb_frag_t *frag0 = &pinfo->frags[0];
> +#endif
>
> NAPI_GRO_CB(skb)->data_offset = 0;
> NAPI_GRO_CB(skb)->frag0 = NULL;
> NAPI_GRO_CB(skb)->frag0_len = 0;
>
> +#if !defined(CONFIG_SUPERH)
> if (!skb_headlen(skb) && pinfo->nr_frags &&
> !PageHighMem(skb_frag_page(frag0))) {
> NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
> @@ -5930,6 +5933,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
> skb_frag_size(frag0),
> skb->end - skb->tail);
> }
> +#endif
> }
>
> static void gro_pull_from_frag0(struct sk_buff *skb, int grow)

OK ... more sh debugging :

diff --git a/arch/sh/mm/alignment.c b/arch/sh/mm/alignment.c
index fb517b82a87b1065cf38c06cb3c178ce86587b00..5d18f9f792991105a8aa05cc6231b7d4532d72c9
100644
--- a/arch/sh/mm/alignment.c
+++ b/arch/sh/mm/alignment.c
@@ -27,7 +27,7 @@ static unsigned long se_multi;
valid! */
static int se_usermode = UM_WARN | UM_FIXUP;
/* 0: no warning 1: print a warning message, disabled by default */
-static int se_kernmode_warn;
+static int se_kernmode_warn = 1;

core_param(alignment, se_usermode, int, 0600);

@@ -103,7 +103,7 @@ void unaligned_fixups_notify(struct task_struct
*tsk, insn_size_t insn,
(void *)instruction_pointer(regs), insn);
else if (se_kernmode_warn)
pr_notice_ratelimited("Fixing up unaligned kernel access "
- "in \"%s\" pid=%d pc=0x%p ins=0x%04hx\n",
+ "in \"%s\" pid=%d pc=%px ins=0x%04hx\n",
tsk->comm, task_pid_nr(tsk),
(void *)instruction_pointer(regs), insn);
}

I now see something of interest :
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc2e ins=0x6236
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc2e ins=0x6236
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc30 ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc30 ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636

So basically the frag0 idea only works if drivers respect NET_IP_ALIGN
(So that IP header is 4-byte aligned)

It seems either virtio_net or qemu does not respect the contract.

A possible generic fix would then be :


diff --git a/net/core/dev.c b/net/core/dev.c
index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..1f79b9aa9a3f2392fddd1401f95ad098b5e03204
100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5924,7 +5924,8 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
NAPI_GRO_CB(skb)->frag0_len = 0;

if (!skb_headlen(skb) && pinfo->nr_frags &&
- !PageHighMem(skb_frag_page(frag0))) {
+ !PageHighMem(skb_frag_page(frag0)) &&
+ (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) {
NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
skb_frag_size(frag0),

2021-04-13 15:20:11

by Michael S. Tsirkin

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 02:45:46PM +0200, Eric Dumazet wrote:
> On Tue, Apr 13, 2021 at 12:43 PM Eric Dumazet <[email protected]> wrote:
> >
> > On Tue, Apr 13, 2021 at 11:24 AM Eric Dumazet <[email protected]> wrote:
> > >
> > > On Mon, Apr 12, 2021 at 10:05 PM Guenter Roeck <[email protected]> wrote:
> > > >
> > > > On 4/12/21 10:38 AM, Eric Dumazet wrote:
> > > > [ ... ]
> > > >
> > > > > Yes, I think this is the real issue here. This smells like some memory
> > > > > corruption.
> > > > >
> > > > > In my traces, packet is correctly received in AF_PACKET queue.
> > > > >
> > > > > I have checked the skb is well formed.
> > > > >
> > > > > But the user space seems to never call poll() and recvmsg() on this
> > > > > af_packet socket.
> > > > >
> > > >
> > > > After sprinkling the kernel with debug messages:
> > > >
> > > > 424 00:01:33.674181 sendto(6, "E\0\1H\0\0\0\0@\21y\246\0\0\0\0\377\377\377\377\0D\0C\00148\346\1\1\6\0\246\336\333\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0RT\0\
> > > > 424 00:01:33.693873 close(6) = 0
> > > > 424 00:01:33.694652 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
> > > > 424 00:01:33.695213 clock_gettime64(CLOCK_MONOTONIC, 0x7be18a18) = -1 EFAULT (Bad address)
> > > > 424 00:01:33.695889 write(2, "udhcpc: clock_gettime(MONOTONIC) failed\n", 40) = -1 EFAULT (Bad address)
> > > > 424 00:01:33.697311 exit_group(1) = ?
> > > > 424 00:01:33.698346 +++ exited with 1 +++
> > > >
> > > > I only see that after adding debug messages in the kernel, so I guess there must be
> > > > a heisenbug somehere.
> > > >
> > > > Anyway, indeed, I see (another kernel debug message):
> > > >
> > > > __do_sys_clock_gettime: Returning -EFAULT on address 0x7bacc9a8
> > > >
> > > > So udhcpc doesn't even try to read the reply because it crashes after sendto()
> > > > when trying to read the current time. Unless I am missing something, that means
> > > > that the problem happens somewhere on the send side.
> > > >
> > > > To make things even more interesting, it looks like the failing system call
> > > > isn't always clock_gettime().
> > > >
> > > > Guenter
> > >
> > >
> > > I think GRO fast path has never worked on SUPERH. Probably SUPERH has
> > > never used a fast NIC (10Gbit+)
> > >
> > > The following hack fixes the issue.
> > >
> > >
> > > diff --git a/net/core/dev.c b/net/core/dev.c
> > > index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..91ba89a645ff91d4cd4f3d8dc8a009bcb67da344
> > > 100644
> > > --- a/net/core/dev.c
> > > +++ b/net/core/dev.c
> > > @@ -5916,13 +5916,16 @@ static struct list_head
> > > *gro_list_prepare(struct napi_struct *napi,
> > >
> > > static void skb_gro_reset_offset(struct sk_buff *skb)
> > > {
> > > +#if !defined(CONFIG_SUPERH)
> > > const struct skb_shared_info *pinfo = skb_shinfo(skb);
> > > const skb_frag_t *frag0 = &pinfo->frags[0];
> > > +#endif
> > >
> > > NAPI_GRO_CB(skb)->data_offset = 0;
> > > NAPI_GRO_CB(skb)->frag0 = NULL;
> > > NAPI_GRO_CB(skb)->frag0_len = 0;
> > >
> > > +#if !defined(CONFIG_SUPERH)
> > > if (!skb_headlen(skb) && pinfo->nr_frags &&
> > > !PageHighMem(skb_frag_page(frag0))) {
> > > NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
> > > @@ -5930,6 +5933,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
> > > skb_frag_size(frag0),
> > > skb->end - skb->tail);
> > > }
> > > +#endif
> > > }
> > >
> > > static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
> >
> > OK ... more sh debugging :
> >
> > diff --git a/arch/sh/mm/alignment.c b/arch/sh/mm/alignment.c
> > index fb517b82a87b1065cf38c06cb3c178ce86587b00..5d18f9f792991105a8aa05cc6231b7d4532d72c9
> > 100644
> > --- a/arch/sh/mm/alignment.c
> > +++ b/arch/sh/mm/alignment.c
> > @@ -27,7 +27,7 @@ static unsigned long se_multi;
> > valid! */
> > static int se_usermode = UM_WARN | UM_FIXUP;
> > /* 0: no warning 1: print a warning message, disabled by default */
> > -static int se_kernmode_warn;
> > +static int se_kernmode_warn = 1;
> >
> > core_param(alignment, se_usermode, int, 0600);
> >
> > @@ -103,7 +103,7 @@ void unaligned_fixups_notify(struct task_struct
> > *tsk, insn_size_t insn,
> > (void *)instruction_pointer(regs), insn);
> > else if (se_kernmode_warn)
> > pr_notice_ratelimited("Fixing up unaligned kernel access "
> > - "in \"%s\" pid=%d pc=0x%p ins=0x%04hx\n",
> > + "in \"%s\" pid=%d pc=%px ins=0x%04hx\n",
> > tsk->comm, task_pid_nr(tsk),
> > (void *)instruction_pointer(regs), insn);
> > }
> >
> > I now see something of interest :
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc2e ins=0x6236
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc2e ins=0x6236
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc30 ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc30 ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> > Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> >
> > So basically the frag0 idea only works if drivers respect NET_IP_ALIGN
> > (So that IP header is 4-byte aligned)
> >
> > It seems either virtio_net or qemu does not respect the contract.
> >
> > A possible generic fix would then be :
> >
> >
> > diff --git a/net/core/dev.c b/net/core/dev.c
> > index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..1f79b9aa9a3f2392fddd1401f95ad098b5e03204
> > 100644
> > --- a/net/core/dev.c
> > +++ b/net/core/dev.c
> > @@ -5924,7 +5924,8 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
> > NAPI_GRO_CB(skb)->frag0_len = 0;
> >
> > if (!skb_headlen(skb) && pinfo->nr_frags &&
> > - !PageHighMem(skb_frag_page(frag0))) {
> > + !PageHighMem(skb_frag_page(frag0)) &&
> > + (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) {
> > NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
> > NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
> > skb_frag_size(frag0),
>
>
> Official submission :
>
> https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/

Thanks a lot Eric!

--
MST

2021-04-13 15:26:01

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 2:57 PM Michael S. Tsirkin <[email protected]> wrote:
>
> On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> > On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> > >
> > > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > > <[email protected]> wrote:
> > > >
> > > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > > >
> > > > > Qemu test results:
> > > > > total: 460 pass: 459 fail: 1
> > > > > Failed tests:
> > > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > > >
> > > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > > >
> > > > Hmm. Let's add in some more of the people involved in that commit, and
> > > > also netdev.
> > > >
> > > > Nothing in there looks like it should have any interaction with
> > > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > > some particular interaction with the qemu environment.
> > >
> > > Yes, maybe.
> > >
> > > I spent few hours on this, and suspect a buggy memcpy() implementation
> > > on SH, but this was not conclusive.
> > >
> > > By pulling one extra byte, the problem goes away.
> > >
> > > Strange thing is that the udhcpc process does not go past sendto().
> >
> > This is the patch working around the issue. Unfortunately I was not
> > able to root-cause it (I really suspect something on SH)
> >
> > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> > 100644
> > --- a/drivers/net/virtio_net.c
> > +++ b/drivers/net/virtio_net.c
> > @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> > virtnet_info *vi,
> >
> > /* Copy all frame if it fits skb->head, otherwise
> > * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> > + *
> > + * Apparently, pulling only the Ethernet Header triggers a bug
> > on qemu-system-sh4.
> > + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> > + * more to work around this bug : These 20 bytes can not belong
> > + * to UDP/TCP payload.
> > + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> > */
>
> Question: do we still want to do this for performance reasons?
> We also have the hdr_len coming from the device which is
> just skb_headlen on the host.

Well, putting 20 bytes in skb->head will disable frag0 optimization.

The change would only benefit to sh architecture :)

About hdr_len, I suppose we could try it, with appropriate safety checks.

>
> > if (len <= skb_tailroom(skb))
> > copy = len;
> > else
> > - copy = ETH_HLEN + metasize;
> > + copy = ETH_HLEN + sizeof(struct iphdr) + metasize;
> > skb_put_data(skb, p, copy);
> >
> > if (metasize) {
>

2021-04-13 15:28:43

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 3:27 PM Eric Dumazet <[email protected]> wrote:
>
> On Tue, Apr 13, 2021 at 2:57 PM Michael S. Tsirkin <[email protected]> wrote:
> >
> > On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> > > On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> > > >
> > > > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > > > <[email protected]> wrote:
> > > > >
> > > > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > > > >
> > > > > > Qemu test results:
> > > > > > total: 460 pass: 459 fail: 1
> > > > > > Failed tests:
> > > > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > > > >
> > > > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > > > >
> > > > > Hmm. Let's add in some more of the people involved in that commit, and
> > > > > also netdev.
> > > > >
> > > > > Nothing in there looks like it should have any interaction with
> > > > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > > > some particular interaction with the qemu environment.
> > > >
> > > > Yes, maybe.
> > > >
> > > > I spent few hours on this, and suspect a buggy memcpy() implementation
> > > > on SH, but this was not conclusive.
> > > >
> > > > By pulling one extra byte, the problem goes away.
> > > >
> > > > Strange thing is that the udhcpc process does not go past sendto().
> > >
> > > This is the patch working around the issue. Unfortunately I was not
> > > able to root-cause it (I really suspect something on SH)
> > >
> > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> > > 100644
> > > --- a/drivers/net/virtio_net.c
> > > +++ b/drivers/net/virtio_net.c
> > > @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> > > virtnet_info *vi,
> > >
> > > /* Copy all frame if it fits skb->head, otherwise
> > > * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> > > + *
> > > + * Apparently, pulling only the Ethernet Header triggers a bug
> > > on qemu-system-sh4.
> > > + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> > > + * more to work around this bug : These 20 bytes can not belong
> > > + * to UDP/TCP payload.
> > > + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> > > */
> >
> > Question: do we still want to do this for performance reasons?
> > We also have the hdr_len coming from the device which is
> > just skb_headlen on the host.
>
> Well, putting 20 bytes in skb->head will disable frag0 optimization.
>
> The change would only benefit to sh architecture :)
>
> About hdr_len, I suppose we could try it, with appropriate safety checks.

I have added traces, hdr_len seems to be 0 with the qemu-system-sh4 I am using.

Have I understood you correctly ?

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 0824e6999e49957f7aaf7c990f6259792d42f32b..f024860f7dc260d4efbc35a3b8ffd358bd0da894
100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -399,9 +399,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
hdr_padded_len = sizeof(struct padded_vnet_hdr);

/* hdr_valid means no XDP, so we can copy the vnet header */
- if (hdr_valid)
+ if (hdr_valid) {
memcpy(hdr, p, hdr_len);
-
+ pr_err("hdr->hdr_len=%u\n", hdr->hdr.hdr_len);
+ }
len -= hdr_len;
offset += hdr_padded_len;
p += hdr_padded_len;

2021-04-13 17:08:38

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 12:43 PM Eric Dumazet <[email protected]> wrote:
>
> On Tue, Apr 13, 2021 at 11:24 AM Eric Dumazet <[email protected]> wrote:
> >
> > On Mon, Apr 12, 2021 at 10:05 PM Guenter Roeck <[email protected]> wrote:
> > >
> > > On 4/12/21 10:38 AM, Eric Dumazet wrote:
> > > [ ... ]
> > >
> > > > Yes, I think this is the real issue here. This smells like some memory
> > > > corruption.
> > > >
> > > > In my traces, packet is correctly received in AF_PACKET queue.
> > > >
> > > > I have checked the skb is well formed.
> > > >
> > > > But the user space seems to never call poll() and recvmsg() on this
> > > > af_packet socket.
> > > >
> > >
> > > After sprinkling the kernel with debug messages:
> > >
> > > 424 00:01:33.674181 sendto(6, "E\0\1H\0\0\0\0@\21y\246\0\0\0\0\377\377\377\377\0D\0C\00148\346\1\1\6\0\246\336\333\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0RT\0\
> > > 424 00:01:33.693873 close(6) = 0
> > > 424 00:01:33.694652 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
> > > 424 00:01:33.695213 clock_gettime64(CLOCK_MONOTONIC, 0x7be18a18) = -1 EFAULT (Bad address)
> > > 424 00:01:33.695889 write(2, "udhcpc: clock_gettime(MONOTONIC) failed\n", 40) = -1 EFAULT (Bad address)
> > > 424 00:01:33.697311 exit_group(1) = ?
> > > 424 00:01:33.698346 +++ exited with 1 +++
> > >
> > > I only see that after adding debug messages in the kernel, so I guess there must be
> > > a heisenbug somehere.
> > >
> > > Anyway, indeed, I see (another kernel debug message):
> > >
> > > __do_sys_clock_gettime: Returning -EFAULT on address 0x7bacc9a8
> > >
> > > So udhcpc doesn't even try to read the reply because it crashes after sendto()
> > > when trying to read the current time. Unless I am missing something, that means
> > > that the problem happens somewhere on the send side.
> > >
> > > To make things even more interesting, it looks like the failing system call
> > > isn't always clock_gettime().
> > >
> > > Guenter
> >
> >
> > I think GRO fast path has never worked on SUPERH. Probably SUPERH has
> > never used a fast NIC (10Gbit+)
> >
> > The following hack fixes the issue.
> >
> >
> > diff --git a/net/core/dev.c b/net/core/dev.c
> > index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..91ba89a645ff91d4cd4f3d8dc8a009bcb67da344
> > 100644
> > --- a/net/core/dev.c
> > +++ b/net/core/dev.c
> > @@ -5916,13 +5916,16 @@ static struct list_head
> > *gro_list_prepare(struct napi_struct *napi,
> >
> > static void skb_gro_reset_offset(struct sk_buff *skb)
> > {
> > +#if !defined(CONFIG_SUPERH)
> > const struct skb_shared_info *pinfo = skb_shinfo(skb);
> > const skb_frag_t *frag0 = &pinfo->frags[0];
> > +#endif
> >
> > NAPI_GRO_CB(skb)->data_offset = 0;
> > NAPI_GRO_CB(skb)->frag0 = NULL;
> > NAPI_GRO_CB(skb)->frag0_len = 0;
> >
> > +#if !defined(CONFIG_SUPERH)
> > if (!skb_headlen(skb) && pinfo->nr_frags &&
> > !PageHighMem(skb_frag_page(frag0))) {
> > NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
> > @@ -5930,6 +5933,7 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
> > skb_frag_size(frag0),
> > skb->end - skb->tail);
> > }
> > +#endif
> > }
> >
> > static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
>
> OK ... more sh debugging :
>
> diff --git a/arch/sh/mm/alignment.c b/arch/sh/mm/alignment.c
> index fb517b82a87b1065cf38c06cb3c178ce86587b00..5d18f9f792991105a8aa05cc6231b7d4532d72c9
> 100644
> --- a/arch/sh/mm/alignment.c
> +++ b/arch/sh/mm/alignment.c
> @@ -27,7 +27,7 @@ static unsigned long se_multi;
> valid! */
> static int se_usermode = UM_WARN | UM_FIXUP;
> /* 0: no warning 1: print a warning message, disabled by default */
> -static int se_kernmode_warn;
> +static int se_kernmode_warn = 1;
>
> core_param(alignment, se_usermode, int, 0600);
>
> @@ -103,7 +103,7 @@ void unaligned_fixups_notify(struct task_struct
> *tsk, insn_size_t insn,
> (void *)instruction_pointer(regs), insn);
> else if (se_kernmode_warn)
> pr_notice_ratelimited("Fixing up unaligned kernel access "
> - "in \"%s\" pid=%d pc=0x%p ins=0x%04hx\n",
> + "in \"%s\" pid=%d pc=%px ins=0x%04hx\n",
> tsk->comm, task_pid_nr(tsk),
> (void *)instruction_pointer(regs), insn);
> }
>
> I now see something of interest :
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc2e ins=0x6236
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc2e ins=0x6236
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc30 ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc30 ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
> Fixing up unaligned kernel access in "udhcpc" pid=91 pc=8c43fc3a ins=0x6636
>
> So basically the frag0 idea only works if drivers respect NET_IP_ALIGN
> (So that IP header is 4-byte aligned)
>
> It seems either virtio_net or qemu does not respect the contract.
>
> A possible generic fix would then be :
>
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index af8c1ea040b9364b076e2d72f04dc3de2d7e2f11..1f79b9aa9a3f2392fddd1401f95ad098b5e03204
> 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5924,7 +5924,8 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
> NAPI_GRO_CB(skb)->frag0_len = 0;
>
> if (!skb_headlen(skb) && pinfo->nr_frags &&
> - !PageHighMem(skb_frag_page(frag0))) {
> + !PageHighMem(skb_frag_page(frag0)) &&
> + (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) {
> NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
> NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
> skb_frag_size(frag0),


Official submission :

https://patchwork.kernel.org/project/netdevbpf/patch/[email protected]/

2021-04-13 17:54:45

by Michael S. Tsirkin

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> >
> > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > <[email protected]> wrote:
> > >
> > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > >
> > > > Qemu test results:
> > > > total: 460 pass: 459 fail: 1
> > > > Failed tests:
> > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > >
> > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > >
> > > Hmm. Let's add in some more of the people involved in that commit, and
> > > also netdev.
> > >
> > > Nothing in there looks like it should have any interaction with
> > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > some particular interaction with the qemu environment.
> >
> > Yes, maybe.
> >
> > I spent few hours on this, and suspect a buggy memcpy() implementation
> > on SH, but this was not conclusive.
> >
> > By pulling one extra byte, the problem goes away.
> >
> > Strange thing is that the udhcpc process does not go past sendto().
>
> This is the patch working around the issue. Unfortunately I was not
> able to root-cause it (I really suspect something on SH)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> virtnet_info *vi,
>
> /* Copy all frame if it fits skb->head, otherwise
> * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> + *
> + * Apparently, pulling only the Ethernet Header triggers a bug
> on qemu-system-sh4.
> + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> + * more to work around this bug : These 20 bytes can not belong
> + * to UDP/TCP payload.
> + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> */

Question: do we still want to do this for performance reasons?
We also have the hdr_len coming from the device which is
just skb_headlen on the host.

> if (len <= skb_tailroom(skb))
> copy = len;
> else
> - copy = ETH_HLEN + metasize;
> + copy = ETH_HLEN + sizeof(struct iphdr) + metasize;
> skb_put_data(skb, p, copy);
>
> if (metasize) {

2021-04-13 18:20:21

by Michael S. Tsirkin

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 03:33:40PM +0200, Eric Dumazet wrote:
> On Tue, Apr 13, 2021 at 3:27 PM Eric Dumazet <[email protected]> wrote:
> >
> > On Tue, Apr 13, 2021 at 2:57 PM Michael S. Tsirkin <[email protected]> wrote:
> > >
> > > On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> > > > On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> > > > >
> > > > > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > > > > <[email protected]> wrote:
> > > > > >
> > > > > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > > > > >
> > > > > > > Qemu test results:
> > > > > > > total: 460 pass: 459 fail: 1
> > > > > > > Failed tests:
> > > > > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > > > > >
> > > > > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > > > > >
> > > > > > Hmm. Let's add in some more of the people involved in that commit, and
> > > > > > also netdev.
> > > > > >
> > > > > > Nothing in there looks like it should have any interaction with
> > > > > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > > > > some particular interaction with the qemu environment.
> > > > >
> > > > > Yes, maybe.
> > > > >
> > > > > I spent few hours on this, and suspect a buggy memcpy() implementation
> > > > > on SH, but this was not conclusive.
> > > > >
> > > > > By pulling one extra byte, the problem goes away.
> > > > >
> > > > > Strange thing is that the udhcpc process does not go past sendto().
> > > >
> > > > This is the patch working around the issue. Unfortunately I was not
> > > > able to root-cause it (I really suspect something on SH)
> > > >
> > > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> > > > 100644
> > > > --- a/drivers/net/virtio_net.c
> > > > +++ b/drivers/net/virtio_net.c
> > > > @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> > > > virtnet_info *vi,
> > > >
> > > > /* Copy all frame if it fits skb->head, otherwise
> > > > * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> > > > + *
> > > > + * Apparently, pulling only the Ethernet Header triggers a bug
> > > > on qemu-system-sh4.
> > > > + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> > > > + * more to work around this bug : These 20 bytes can not belong
> > > > + * to UDP/TCP payload.
> > > > + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> > > > */
> > >
> > > Question: do we still want to do this for performance reasons?
> > > We also have the hdr_len coming from the device which is
> > > just skb_headlen on the host.
> >
> > Well, putting 20 bytes in skb->head will disable frag0 optimization.
> >
> > The change would only benefit to sh architecture :)
> >
> > About hdr_len, I suppose we could try it, with appropriate safety checks.
>
> I have added traces, hdr_len seems to be 0 with the qemu-system-sh4 I am using.
>
> Have I understood you correctly ?
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 0824e6999e49957f7aaf7c990f6259792d42f32b..f024860f7dc260d4efbc35a3b8ffd358bd0da894
> 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -399,9 +399,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
> hdr_padded_len = sizeof(struct padded_vnet_hdr);
>
> /* hdr_valid means no XDP, so we can copy the vnet header */
> - if (hdr_valid)
> + if (hdr_valid) {
> memcpy(hdr, p, hdr_len);
> -
> + pr_err("hdr->hdr_len=%u\n", hdr->hdr.hdr_len);
> + }
> len -= hdr_len;
> offset += hdr_padded_len;
> p += hdr_padded_len;


Depends on how you connect qemu on the host. It's filled by host tap,
see virtio_net_hdr_from_skb. If you are using slirp that just zero-fills
it.


--
MST

2021-04-13 18:21:30

by Eric Dumazet

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 3:38 PM Michael S. Tsirkin <[email protected]> wrote:
>
> On Tue, Apr 13, 2021 at 03:33:40PM +0200, Eric Dumazet wrote:
> > On Tue, Apr 13, 2021 at 3:27 PM Eric Dumazet <[email protected]> wrote:
> > >
> > > On Tue, Apr 13, 2021 at 2:57 PM Michael S. Tsirkin <[email protected]> wrote:
> > > >
> > > > On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> > > > > On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> > > > > >
> > > > > > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > > > > > <[email protected]> wrote:
> > > > > > >
> > > > > > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > > > > > >
> > > > > > > > Qemu test results:
> > > > > > > > total: 460 pass: 459 fail: 1
> > > > > > > > Failed tests:
> > > > > > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > > > > > >
> > > > > > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > > > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > > > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > > > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > > > > > >
> > > > > > > Hmm. Let's add in some more of the people involved in that commit, and
> > > > > > > also netdev.
> > > > > > >
> > > > > > > Nothing in there looks like it should have any interaction with
> > > > > > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > > > > > some particular interaction with the qemu environment.
> > > > > >
> > > > > > Yes, maybe.
> > > > > >
> > > > > > I spent few hours on this, and suspect a buggy memcpy() implementation
> > > > > > on SH, but this was not conclusive.
> > > > > >
> > > > > > By pulling one extra byte, the problem goes away.
> > > > > >
> > > > > > Strange thing is that the udhcpc process does not go past sendto().
> > > > >
> > > > > This is the patch working around the issue. Unfortunately I was not
> > > > > able to root-cause it (I really suspect something on SH)
> > > > >
> > > > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> > > > > 100644
> > > > > --- a/drivers/net/virtio_net.c
> > > > > +++ b/drivers/net/virtio_net.c
> > > > > @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> > > > > virtnet_info *vi,
> > > > >
> > > > > /* Copy all frame if it fits skb->head, otherwise
> > > > > * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> > > > > + *
> > > > > + * Apparently, pulling only the Ethernet Header triggers a bug
> > > > > on qemu-system-sh4.
> > > > > + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> > > > > + * more to work around this bug : These 20 bytes can not belong
> > > > > + * to UDP/TCP payload.
> > > > > + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> > > > > */
> > > >
> > > > Question: do we still want to do this for performance reasons?
> > > > We also have the hdr_len coming from the device which is
> > > > just skb_headlen on the host.
> > >
> > > Well, putting 20 bytes in skb->head will disable frag0 optimization.
> > >
> > > The change would only benefit to sh architecture :)
> > >
> > > About hdr_len, I suppose we could try it, with appropriate safety checks.
> >
> > I have added traces, hdr_len seems to be 0 with the qemu-system-sh4 I am using.
> >
> > Have I understood you correctly ?
> >
> > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > index 0824e6999e49957f7aaf7c990f6259792d42f32b..f024860f7dc260d4efbc35a3b8ffd358bd0da894
> > 100644
> > --- a/drivers/net/virtio_net.c
> > +++ b/drivers/net/virtio_net.c
> > @@ -399,9 +399,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
> > hdr_padded_len = sizeof(struct padded_vnet_hdr);
> >
> > /* hdr_valid means no XDP, so we can copy the vnet header */
> > - if (hdr_valid)
> > + if (hdr_valid) {
> > memcpy(hdr, p, hdr_len);
> > -
> > + pr_err("hdr->hdr_len=%u\n", hdr->hdr.hdr_len);
> > + }
> > len -= hdr_len;
> > offset += hdr_padded_len;
> > p += hdr_padded_len;
>
>
> Depends on how you connect qemu on the host. It's filled by host tap,
> see virtio_net_hdr_from_skb. If you are using slirp that just zero-fills
> it.

Guenter provided :

qemu-system-sh4 -M r2d -kernel ./arch/sh/boot/zImage -no-reboot \
-snapshot \
-drive file=rootfs.ext2,format=raw,if=ide \
-device virtio-net,netdev=net0 -netdev user,id=net0 \
-append "root=/dev/sda console=ttySC1,115200
earlycon=scif,mmio16,0xffe80000 noiotrap" \
-serial null -serial stdio -nographic -monitor null

2021-04-13 18:26:47

by Michael S. Tsirkin

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 03:42:24PM +0200, Eric Dumazet wrote:
> On Tue, Apr 13, 2021 at 3:38 PM Michael S. Tsirkin <[email protected]> wrote:
> >
> > On Tue, Apr 13, 2021 at 03:33:40PM +0200, Eric Dumazet wrote:
> > > On Tue, Apr 13, 2021 at 3:27 PM Eric Dumazet <[email protected]> wrote:
> > > >
> > > > On Tue, Apr 13, 2021 at 2:57 PM Michael S. Tsirkin <[email protected]> wrote:
> > > > >
> > > > > On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> > > > > > On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> > > > > > >
> > > > > > > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > > > > > > <[email protected]> wrote:
> > > > > > > >
> > > > > > > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > > > > > > >
> > > > > > > > > Qemu test results:
> > > > > > > > > total: 460 pass: 459 fail: 1
> > > > > > > > > Failed tests:
> > > > > > > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > > > > > > >
> > > > > > > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > > > > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > > > > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > > > > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > > > > > > >
> > > > > > > > Hmm. Let's add in some more of the people involved in that commit, and
> > > > > > > > also netdev.
> > > > > > > >
> > > > > > > > Nothing in there looks like it should have any interaction with
> > > > > > > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > > > > > > some particular interaction with the qemu environment.
> > > > > > >
> > > > > > > Yes, maybe.
> > > > > > >
> > > > > > > I spent few hours on this, and suspect a buggy memcpy() implementation
> > > > > > > on SH, but this was not conclusive.
> > > > > > >
> > > > > > > By pulling one extra byte, the problem goes away.
> > > > > > >
> > > > > > > Strange thing is that the udhcpc process does not go past sendto().
> > > > > >
> > > > > > This is the patch working around the issue. Unfortunately I was not
> > > > > > able to root-cause it (I really suspect something on SH)
> > > > > >
> > > > > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > > > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> > > > > > 100644
> > > > > > --- a/drivers/net/virtio_net.c
> > > > > > +++ b/drivers/net/virtio_net.c
> > > > > > @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> > > > > > virtnet_info *vi,
> > > > > >
> > > > > > /* Copy all frame if it fits skb->head, otherwise
> > > > > > * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> > > > > > + *
> > > > > > + * Apparently, pulling only the Ethernet Header triggers a bug
> > > > > > on qemu-system-sh4.
> > > > > > + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> > > > > > + * more to work around this bug : These 20 bytes can not belong
> > > > > > + * to UDP/TCP payload.
> > > > > > + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> > > > > > */
> > > > >
> > > > > Question: do we still want to do this for performance reasons?
> > > > > We also have the hdr_len coming from the device which is
> > > > > just skb_headlen on the host.
> > > >
> > > > Well, putting 20 bytes in skb->head will disable frag0 optimization.
> > > >
> > > > The change would only benefit to sh architecture :)
> > > >
> > > > About hdr_len, I suppose we could try it, with appropriate safety checks.
> > >
> > > I have added traces, hdr_len seems to be 0 with the qemu-system-sh4 I am using.
> > >
> > > Have I understood you correctly ?
> > >
> > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..f024860f7dc260d4efbc35a3b8ffd358bd0da894
> > > 100644
> > > --- a/drivers/net/virtio_net.c
> > > +++ b/drivers/net/virtio_net.c
> > > @@ -399,9 +399,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
> > > hdr_padded_len = sizeof(struct padded_vnet_hdr);
> > >
> > > /* hdr_valid means no XDP, so we can copy the vnet header */
> > > - if (hdr_valid)
> > > + if (hdr_valid) {
> > > memcpy(hdr, p, hdr_len);
> > > -
> > > + pr_err("hdr->hdr_len=%u\n", hdr->hdr.hdr_len);
> > > + }
> > > len -= hdr_len;
> > > offset += hdr_padded_len;
> > > p += hdr_padded_len;
> >
> >
> > Depends on how you connect qemu on the host. It's filled by host tap,
> > see virtio_net_hdr_from_skb. If you are using slirp that just zero-fills
> > it.
>
> Guenter provided :
>
> qemu-system-sh4 -M r2d -kernel ./arch/sh/boot/zImage -no-reboot \
> -snapshot \
> -drive file=rootfs.ext2,format=raw,if=ide \
> -device virtio-net,netdev=net0 -netdev user,id=net0 \
> -append "root=/dev/sda console=ttySC1,115200
> earlycon=scif,mmio16,0xffe80000 noiotrap" \
> -serial null -serial stdio -nographic -monitor null


I do something like this (macvtap):

sudo ip link del macvtap0
sudo ip link add link enp0s25 name macvtap0 type macvtap mode bridge
#sudo ip link add link wlp3s0 name macvtap0 type macvtap mode bridge
sudo ip link set macvtap0 address 52:54:00:12:34:56 up
index=`cat /sys/class/net/macvtap0/ifindex`
sudo chgrp mst /dev/tap$index
sudo chmod g+rw /dev/tap$index

and then

-netdev tap,fds=6,id=net0,vhost=on -device virtio-net,netdev=net0 \
6<>/dev/tap$index


2021-04-13 19:31:19

by Michael S. Tsirkin

[permalink] [raw]
Subject: Re: Linux 5.12-rc7

On Tue, Apr 13, 2021 at 03:42:24PM +0200, Eric Dumazet wrote:
> On Tue, Apr 13, 2021 at 3:38 PM Michael S. Tsirkin <[email protected]> wrote:
> >
> > On Tue, Apr 13, 2021 at 03:33:40PM +0200, Eric Dumazet wrote:
> > > On Tue, Apr 13, 2021 at 3:27 PM Eric Dumazet <[email protected]> wrote:
> > > >
> > > > On Tue, Apr 13, 2021 at 2:57 PM Michael S. Tsirkin <[email protected]> wrote:
> > > > >
> > > > > On Mon, Apr 12, 2021 at 06:47:07PM +0200, Eric Dumazet wrote:
> > > > > > On Mon, Apr 12, 2021 at 6:31 PM Eric Dumazet <[email protected]> wrote:
> > > > > > >
> > > > > > > On Mon, Apr 12, 2021 at 6:28 PM Linus Torvalds
> > > > > > > <[email protected]> wrote:
> > > > > > > >
> > > > > > > > On Sun, Apr 11, 2021 at 10:14 PM Guenter Roeck <[email protected]> wrote:
> > > > > > > > >
> > > > > > > > > Qemu test results:
> > > > > > > > > total: 460 pass: 459 fail: 1
> > > > > > > > > Failed tests:
> > > > > > > > > sh:rts7751r2dplus_defconfig:ata:net,virtio-net:rootfs
> > > > > > > > >
> > > > > > > > > The failure bisects to commit 0f6925b3e8da ("virtio_net: Do not pull payload in
> > > > > > > > > skb->head"). It is a spurious problem - the test passes roughly every other
> > > > > > > > > time. When the failure is seen, udhcpc fails to get an IP address and aborts
> > > > > > > > > with SIGTERM. So far I have only seen this with the "sh" architecture.
> > > > > > > >
> > > > > > > > Hmm. Let's add in some more of the people involved in that commit, and
> > > > > > > > also netdev.
> > > > > > > >
> > > > > > > > Nothing in there looks like it should have any interaction with
> > > > > > > > architecture, so that "it happens on sh" sounds odd, but maybe it's
> > > > > > > > some particular interaction with the qemu environment.
> > > > > > >
> > > > > > > Yes, maybe.
> > > > > > >
> > > > > > > I spent few hours on this, and suspect a buggy memcpy() implementation
> > > > > > > on SH, but this was not conclusive.
> > > > > > >
> > > > > > > By pulling one extra byte, the problem goes away.
> > > > > > >
> > > > > > > Strange thing is that the udhcpc process does not go past sendto().
> > > > > >
> > > > > > This is the patch working around the issue. Unfortunately I was not
> > > > > > able to root-cause it (I really suspect something on SH)
> > > > > >
> > > > > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > > > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..fd890a951beea03bdf24406809042666eb972655
> > > > > > 100644
> > > > > > --- a/drivers/net/virtio_net.c
> > > > > > +++ b/drivers/net/virtio_net.c
> > > > > > @@ -408,11 +408,17 @@ static struct sk_buff *page_to_skb(struct
> > > > > > virtnet_info *vi,
> > > > > >
> > > > > > /* Copy all frame if it fits skb->head, otherwise
> > > > > > * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
> > > > > > + *
> > > > > > + * Apparently, pulling only the Ethernet Header triggers a bug
> > > > > > on qemu-system-sh4.
> > > > > > + * Since GRO aggregation really cares of IPv4/IPv6, pull 20 bytes
> > > > > > + * more to work around this bug : These 20 bytes can not belong
> > > > > > + * to UDP/TCP payload.
> > > > > > + * As a bonus, this makes GRO slightly faster for IPv4 (one less copy).
> > > > > > */
> > > > >
> > > > > Question: do we still want to do this for performance reasons?
> > > > > We also have the hdr_len coming from the device which is
> > > > > just skb_headlen on the host.
> > > >
> > > > Well, putting 20 bytes in skb->head will disable frag0 optimization.
> > > >
> > > > The change would only benefit to sh architecture :)
> > > >
> > > > About hdr_len, I suppose we could try it, with appropriate safety checks.
> > >
> > > I have added traces, hdr_len seems to be 0 with the qemu-system-sh4 I am using.
> > >
> > > Have I understood you correctly ?
> > >
> > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > > index 0824e6999e49957f7aaf7c990f6259792d42f32b..f024860f7dc260d4efbc35a3b8ffd358bd0da894
> > > 100644
> > > --- a/drivers/net/virtio_net.c
> > > +++ b/drivers/net/virtio_net.c
> > > @@ -399,9 +399,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
> > > hdr_padded_len = sizeof(struct padded_vnet_hdr);
> > >
> > > /* hdr_valid means no XDP, so we can copy the vnet header */
> > > - if (hdr_valid)
> > > + if (hdr_valid) {
> > > memcpy(hdr, p, hdr_len);
> > > -
> > > + pr_err("hdr->hdr_len=%u\n", hdr->hdr.hdr_len);
> > > + }
> > > len -= hdr_len;
> > > offset += hdr_padded_len;
> > > p += hdr_padded_len;
> >
> >
> > Depends on how you connect qemu on the host. It's filled by host tap,
> > see virtio_net_hdr_from_skb. If you are using slirp that just zero-fills
> > it.
>
> Guenter provided :
>
> qemu-system-sh4 -M r2d -kernel ./arch/sh/boot/zImage -no-reboot \
> -snapshot \
> -drive file=rootfs.ext2,format=raw,if=ide \
> -device virtio-net,netdev=net0 -netdev user,id=net0 \
> -append "root=/dev/sda console=ttySC1,115200
> earlycon=scif,mmio16,0xffe80000 noiotrap" \
> -serial null -serial stdio -nographic -monitor null

That's slirp, sure enough. It generates packets in userspace thus no
skbs thus no skb_headlen.

--
MST