Netdev List
 help / color / mirror / Atom feed
* Re: [PATCH net-next] net: dsa: Expose tagging protocol to user-space
From: Andrew Lunn @ 2018-09-10  3:04 UTC (permalink / raw)
  To: Jiri Pirko
  Cc: Florian Fainelli, netdev, Vivien Didelot, David S. Miller,
	open list
In-Reply-To: <20180908094331.GB3246@nanopsycho.orion>

On Sat, Sep 08, 2018 at 11:43:31AM +0200, Jiri Pirko wrote:
> Fri, Sep 07, 2018 at 08:09:02PM CEST, f.fainelli@gmail.com wrote:
> >There is no way for user-space to know what a given DSA network device's
> >tagging protocol is. Expose this information through a dsa/tagging
> >attribute which reflects the tagging protocol currently in use.
> >
> >This is helpful for configuration (e.g: none behaves dramatically
> >different wrt. bridges) as well as for packet capture tools when there
> >is not a proper Ethernet type available.
> 
> 
> Hmm, I wonder. It this something that varies between ports of an
> individual ASIC? Or is it rather something defined per-ASIC. If so, this
> looks more like a devlink-api material.

Hi Jiri

This is between the CPU ethernet device and the switch port that
interface is connect to.

For the Marvell devices, any switch port can be connected to the CPU
Ethernet interface, and the same protocol is used. However, some
switches have a special port which should be used to connect to the
CPU ethernet and supports this tagging protocol. If the designer gets
it wrong and uses a different port to connect the CPU, no tagging
protocol can be used, which as Florian indicated, has a big impact on
bridging, etc.

And just to make it more complex, Marvel has two tagging
schemes. Older devices use DSA, newer devices uses EDSA. However, for
the very new devices in the 6390 family, Marvell made a subtle change
to how EDSA works, which broke it, so we had to go back to DSA.

Of the different tagging protocols used by the 50 or so switches Linux
supports, only the EDSA tagging protocol makes use of an
Ethertype. tcpdump knows how to decode these packets. For all the
other tagging protocols, it has no idea, the Ethertype is all messed
up, and it just prints hex. What i think Florian wants to do is stuff
the tagging protocol into the pcap-ng header so that tcpdump knows
what protocol is in use, and can put the correct protocol dissector in
the chain.

And just for completeness, there potentially is a second tagging
scheme when you have multiple switches connected together in a
cluster, but that is internal to the cluster. The CPU is unaware of
it. But if you are snooping on the traffic, you need to know what the
protocol is, so you can decode the frames. In theory, that could be
EDSA or DSA, and can be selected per intra-switch link. In practice,
they are all DSA, and i've not heard of anybody actually snooping this
traffic.

	Andrew

^ permalink raw reply

* [PATCH] ath9k: debug: remove set but not used variable 'fops_dump_nfcal'
From: YueHaibing @ 2018-09-10  3:11 UTC (permalink / raw)
  To: ath9k-devel, kvalo
  Cc: linux-kernel, netdev, davem, linux-wireless, YueHaibing

'fops_dump_nfcal' is not used since commit 4447d815fd0f ("ath: ath9k: use debugfs_create_devm_seqfile() helper for seq_file entries")

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
 drivers/net/wireless/ath/ath9k/debug.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 0a6eb8a..c871b7e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -990,19 +990,6 @@ static int read_file_dump_nfcal(struct seq_file *file, void *data)
 	return 0;
 }
 
-static int open_file_dump_nfcal(struct inode *inode, struct file *f)
-{
-	return single_open(f, read_file_dump_nfcal, inode->i_private);
-}
-
-static const struct file_operations fops_dump_nfcal = {
-	.read = seq_read,
-	.open = open_file_dump_nfcal,
-	.owner = THIS_MODULE,
-	.llseek = seq_lseek,
-	.release = single_release,
-};
-
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
 static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
 				size_t count, loff_t *ppos)
-- 
2.7.0

^ permalink raw reply related

* Re: [virtio-dev] Re: [PATCH net-next v2 0/5] virtio: support packed ring
From: Jason Wang @ 2018-09-10  3:33 UTC (permalink / raw)
  To: Tiwei Bie, Michael S. Tsirkin
  Cc: virtualization, linux-kernel, netdev, virtio-dev, wexu, jfreimann
In-Reply-To: <20180910030053.GA15645@debian>



On 2018年09月10日 11:00, Tiwei Bie wrote:
> On Fri, Sep 07, 2018 at 09:00:49AM -0400, Michael S. Tsirkin wrote:
>> On Fri, Sep 07, 2018 at 09:22:25AM +0800, Tiwei Bie wrote:
>>> On Mon, Aug 27, 2018 at 05:00:40PM +0300, Michael S. Tsirkin wrote:
>>>> Are there still plans to test the performance with vost pmd?
>>>> vhost doesn't seem to show a performance gain ...
>>>>
>>> I tried some performance tests with vhost PMD. In guest, the
>>> XDP program will return XDP_DROP directly. And in host, testpmd
>>> will do txonly fwd.
>>>
>>> When burst size is 1 and packet size is 64 in testpmd and
>>> testpmd needs to iterate 5 Tx queues (but only the first two
>>> queues are enabled) to prepare and inject packets, I got ~12%
>>> performance boost (5.7Mpps -> 6.4Mpps). And if the vhost PMD
>>> is faster (e.g. just need to iterate the first two queues to
>>> prepare and inject packets), then I got similar performance
>>> for both rings (~9.9Mpps) (packed ring's performance can be
>>> lower, because it's more complicated in driver.)
>>>
>>> I think packed ring makes vhost PMD faster, but it doesn't make
>>> the driver faster. In packed ring, the ring is simplified, and
>>> the handling of the ring in vhost (device) is also simplified,
>>> but things are not simplified in driver, e.g. although there is
>>> no desc table in the virtqueue anymore, driver still needs to
>>> maintain a private desc state table (which is still managed as
>>> a list in this patch set) to support the out-of-order desc
>>> processing in vhost (device).
>>>
>>> I think this patch set is mainly to make the driver have a full
>>> functional support for the packed ring, which makes it possible
>>> to leverage the packed ring feature in vhost (device). But I'm
>>> not sure whether there is any other better idea, I'd like to
>>> hear your thoughts. Thanks!
>> Just this: Jens seems to report a nice gain with virtio and
>> vhost pmd across the board. Try to compare virtio and
>> virtio pmd to see what does pmd do better?
> The virtio PMD (drivers/net/virtio) in DPDK doesn't need to share
> the virtio ring operation code with other drivers and is highly
> optimized for network. E.g. in Rx, the Rx burst function won't
> chain descs. So the ID management for the Rx ring can be quite
> simple and straightforward, we just need to initialize these IDs
> when initializing the ring and don't need to change these IDs
> in data path anymore (the mergable Rx code in that patch set
> assumes the descs will be written back in order, which should be
> fixed. I.e., the ID in the desc should be used to index vq->descx[]).
> The Tx code in that patch set also assumes the descs will be
> written back by device in order, which should be fixed.

Yes it is. I think I've pointed it out in some early version of pmd 
patch. So I suspect part (or all) of the boost may come from in order 
feature.

>
> But in kernel virtio driver, the virtio_ring.c is very generic.
> The enqueue (virtqueue_add()) and dequeue (virtqueue_get_buf_ctx())
> functions need to support all the virtio devices and should be
> able to handle all the possible cases that may happen. So although
> the packed ring can be very efficient in some cases, currently
> the room to optimize the performance in kernel's virtio_ring.c
> isn't that much. If we want to take the fully advantage of the
> packed ring's efficiency, we need some further e.g. API changes
> in virtio_ring.c, which shouldn't be part of this patch set.

Could you please share more thoughts on this e.g how to improve the API? 
Notice since the API is shared by both split ring and packed ring, it 
may improve the performance of split ring as well. One can easily 
imagine a batching API, but it does not have many real users now, the 
only case is the XDP transmission which can accept an array of XDP frames.

> So
> I still think this patch set is mainly to make the kernel virtio
> driver to have a full functional support of the packed ring, and
> we can't expect impressive performance boost with it.

We can only gain when virtio ring layout is the bottleneck. If there're 
bottlenecks elsewhere, we probably won't see any increasing in the 
numbers. Vhost-net is an example, and lots of optimizations have proved 
that virtio ring is not the main bottleneck for the current codes. I 
suspect it also the case of virtio driver. Did perf tell us any 
interesting things in virtio driver?

Thanks

>
>>
>>>> On Wed, Jul 11, 2018 at 10:27:06AM +0800, Tiwei Bie wrote:
>>>>> Hello everyone,
>>>>>
>>>>> This patch set implements packed ring support in virtio driver.
>>>>>
>>>>> Some functional tests have been done with Jason's
>>>>> packed ring implementation in vhost:
>>>>>
>>>>> https://lkml.org/lkml/2018/7/3/33
>>>>>
>>>>> Both of ping and netperf worked as expected.
>>>>>
>>>>> v1 -> v2:
>>>>> - Use READ_ONCE() to read event off_wrap and flags together (Jason);
>>>>> - Add comments related to ccw (Jason);
>>>>>
>>>>> RFC (v6) -> v1:
>>>>> - Avoid extra virtio_wmb() in virtqueue_enable_cb_delayed_packed()
>>>>>    when event idx is off (Jason);
>>>>> - Fix bufs calculation in virtqueue_enable_cb_delayed_packed() (Jason);
>>>>> - Test the state of the desc at used_idx instead of last_used_idx
>>>>>    in virtqueue_enable_cb_delayed_packed() (Jason);
>>>>> - Save wrap counter (as part of queue state) in the return value
>>>>>    of virtqueue_enable_cb_prepare_packed();
>>>>> - Refine the packed ring definitions in uapi;
>>>>> - Rebase on the net-next tree;
>>>>>
>>>>> RFC v5 -> RFC v6:
>>>>> - Avoid tracking addr/len/flags when DMA API isn't used (MST/Jason);
>>>>> - Define wrap counter as bool (Jason);
>>>>> - Use ALIGN() in vring_init_packed() (Jason);
>>>>> - Avoid using pointer to track `next` in detach_buf_packed() (Jason);
>>>>> - Add comments for barriers (Jason);
>>>>> - Don't enable RING_PACKED on ccw for now (noticed by Jason);
>>>>> - Refine the memory barrier in virtqueue_poll();
>>>>> - Add a missing memory barrier in virtqueue_enable_cb_delayed_packed();
>>>>> - Remove the hacks in virtqueue_enable_cb_prepare_packed();
>>>>>
>>>>> RFC v4 -> RFC v5:
>>>>> - Save DMA addr, etc in desc state (Jason);
>>>>> - Track used wrap counter;
>>>>>
>>>>> RFC v3 -> RFC v4:
>>>>> - Make ID allocation support out-of-order (Jason);
>>>>> - Various fixes for EVENT_IDX support;
>>>>>
>>>>> RFC v2 -> RFC v3:
>>>>> - Split into small patches (Jason);
>>>>> - Add helper virtqueue_use_indirect() (Jason);
>>>>> - Just set id for the last descriptor of a list (Jason);
>>>>> - Calculate the prev in virtqueue_add_packed() (Jason);
>>>>> - Fix/improve desc suppression code (Jason/MST);
>>>>> - Refine the code layout for XXX_split/packed and wrappers (MST);
>>>>> - Fix the comments and API in uapi (MST);
>>>>> - Remove the BUG_ON() for indirect (Jason);
>>>>> - Some other refinements and bug fixes;
>>>>>
>>>>> RFC v1 -> RFC v2:
>>>>> - Add indirect descriptor support - compile test only;
>>>>> - Add event suppression supprt - compile test only;
>>>>> - Move vring_packed_init() out of uapi (Jason, MST);
>>>>> - Merge two loops into one in virtqueue_add_packed() (Jason);
>>>>> - Split vring_unmap_one() for packed ring and split ring (Jason);
>>>>> - Avoid using '%' operator (Jason);
>>>>> - Rename free_head -> next_avail_idx (Jason);
>>>>> - Add comments for virtio_wmb() in virtqueue_add_packed() (Jason);
>>>>> - Some other refinements and bug fixes;
>>>>>
>>>>> Thanks!
>>>>>
>>>>> Tiwei Bie (5):
>>>>>    virtio: add packed ring definitions
>>>>>    virtio_ring: support creating packed ring
>>>>>    virtio_ring: add packed ring support
>>>>>    virtio_ring: add event idx support in packed ring
>>>>>    virtio_ring: enable packed ring
>>>>>
>>>>>   drivers/s390/virtio/virtio_ccw.c   |   14 +
>>>>>   drivers/virtio/virtio_ring.c       | 1365 ++++++++++++++++++++++------
>>>>>   include/linux/virtio_ring.h        |    8 +-
>>>>>   include/uapi/linux/virtio_config.h |    3 +
>>>>>   include/uapi/linux/virtio_ring.h   |   43 +
>>>>>   5 files changed, 1157 insertions(+), 276 deletions(-)
>>>>>
>>>>> -- 
>>>>> 2.18.0
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: virtio-dev-unsubscribe@lists.oasis-open.org
>>>> For additional commands, e-mail: virtio-dev-help@lists.oasis-open.org
>>>>

^ permalink raw reply

* Re: [PATCH net-next 06/11] tuntap: split out XDP logic
From: Jason Wang @ 2018-09-10  3:43 UTC (permalink / raw)
  To: Michael S. Tsirkin; +Cc: netdev, linux-kernel, kvm, virtualization
In-Reply-To: <20180907101606-mutt-send-email-mst@kernel.org>



On 2018年09月07日 22:16, Michael S. Tsirkin wrote:
> On Fri, Sep 07, 2018 at 11:29:34AM +0800, Jason Wang wrote:
>>>> +		if (act != XDP_PASS)
>>>> +			goto out;
>>> likely?
>> It depends on the XDP program, so I tend not to use it.
> Point is XDP_PASS is already slow.
>

Ok.

Thanks
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization

^ permalink raw reply

* Re: [PATCH net-next 04/11] tuntap: simplify error handling in tun_build_skb()
From: Jason Wang @ 2018-09-10  3:44 UTC (permalink / raw)
  To: Michael S. Tsirkin; +Cc: netdev, linux-kernel, kvm, virtualization
In-Reply-To: <20180907101645-mutt-send-email-mst@kernel.org>



On 2018年09月07日 22:17, Michael S. Tsirkin wrote:
> On Fri, Sep 07, 2018 at 11:22:00AM +0800, Jason Wang wrote:
>>>> @@ -1668,6 +1668,9 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
>>>>    	if (copied != len)
>>>>    		return ERR_PTR(-EFAULT);
>>>> +	get_page(alloc_frag->page);
>>>> +	alloc_frag->offset += buflen;
>>>> +
>>> This adds an atomic op on XDP_DROP which is a data path
>>> operation for some workloads.
>> Yes, I have patch on top to amortize this, the idea is to have a very big
>> refcount once after the frag was allocated and maintain a bias and decrease
>> them all when allocating new frags.'
> Why bother with refcounting for a drop though? It should be simple.
>

Right, let me fix this.

Thanks

^ permalink raw reply

* Re: [PATCH net-next 11/11] vhost_net: batch submitting XDP buffers to underlayer sockets
From: Jason Wang @ 2018-09-10  3:47 UTC (permalink / raw)
  To: Michael S. Tsirkin; +Cc: netdev, linux-kernel, kvm, virtualization
In-Reply-To: <20180907121148-mutt-send-email-mst@kernel.org>



On 2018年09月08日 00:13, Michael S. Tsirkin wrote:
> On Fri, Sep 07, 2018 at 03:41:52PM +0800, Jason Wang wrote:
>>>> @@ -556,10 +667,14 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
>>>>    	size_t len, total_len = 0;
>>>>    	int err;
>>>>    	int sent_pkts = 0;
>>>> +	bool bulking = (sock->sk->sk_sndbuf == INT_MAX);
>>> What does bulking mean?
>> The name is misleading, it means whether we can do batching. For simplicity,
>> I disable batching is sndbuf is not INT_MAX.
> But what does batching have to do with sndbuf?

If we want to do batching with sndbuf, sockets needs to return the 
number of packets that was successfully sent. And vhost need to examine 
the value.

Consider performance won't be good if sndbuf is limited, I don't 
implement this for simplicity.

>
>>>>    	for (;;) {
>>>>    		bool busyloop_intr = false;
>>>> +		if (nvq->done_idx == VHOST_NET_BATCH)
>>>> +			vhost_tx_batch(net, nvq, sock, &msg);
>>>> +
>>>>    		head = get_tx_bufs(net, nvq, &msg, &out, &in, &len,
>>>>    				   &busyloop_intr);
>>>>    		/* On error, stop handling until the next kick. */
>>>> @@ -577,14 +692,34 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
>>>>    			break;
>>>>    		}
>>>> -		vq->heads[nvq->done_idx].id = cpu_to_vhost32(vq, head);
>>>> -		vq->heads[nvq->done_idx].len = 0;
>>>> -
>>>>    		total_len += len;
>>>> -		if (tx_can_batch(vq, total_len))
>>>> -			msg.msg_flags |= MSG_MORE;
>>>> -		else
>>>> -			msg.msg_flags &= ~MSG_MORE;
>>>> +
>>>> +		/* For simplicity, TX batching is only enabled if
>>>> +		 * sndbuf is unlimited.
>>> What if sndbuf changes while this processing is going on?
>> We will get the correct sndbuf in the next run of handle_tx(). I think this
>> is safe.
> If it's safe why bother with special-casing INT_MAX?
>

The difference is handle_tx() won't loop forever and will recognize the 
new value next time, we have a quota to limit this.

Thanks

^ permalink raw reply

* Re: [PATCH 1/5] powerpc: rename setbits32/clrbits32 to setbits32_be/clrbits32_be
From: Christophe LEROY @ 2018-09-10  5:16 UTC (permalink / raw)
  To: Corentin Labbe, Gilles.Muller, Julia.Lawall, agust,
	alexandre.torgue, alistair, benh, carlo, davem, galak, joabreu,
	khilman, maxime.ripard, michal.lkml, mpe, mporter, nicolas.palix,
	oss, paulus, peppe.cavallaro, tj, vitb, wens
  Cc: netdev, linux-kernel, linux-ide, linux-sunxi, linux-amlogic,
	linuxppc-dev, cocci, linux-arm-kernel
In-Reply-To: <1536349307-20714-2-git-send-email-clabbe@baylibre.com>



Le 07/09/2018 à 21:41, Corentin Labbe a écrit :
> Since setbits32/clrbits32 work on be32, it's better to remove ambiguity on
> the used data type.

Wouldn't it be better to call them setbits_be32() / clrbits_be32() to 
have something looking similar to in_be32() / ou_be32() ?

Christophe

> 
> Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
> ---
>   arch/powerpc/include/asm/fsl_lbc.h               |  2 +-
>   arch/powerpc/include/asm/io.h                    |  5 +-
>   arch/powerpc/platforms/44x/canyonlands.c         |  4 +-
>   arch/powerpc/platforms/4xx/gpio.c                | 28 ++++-----
>   arch/powerpc/platforms/512x/pdm360ng.c           |  6 +-
>   arch/powerpc/platforms/52xx/mpc52xx_common.c     |  6 +-
>   arch/powerpc/platforms/52xx/mpc52xx_gpt.c        | 10 ++--
>   arch/powerpc/platforms/82xx/ep8248e.c            |  2 +-
>   arch/powerpc/platforms/82xx/km82xx.c             |  6 +-
>   arch/powerpc/platforms/82xx/mpc8272_ads.c        | 10 ++--
>   arch/powerpc/platforms/82xx/pq2.c                |  2 +-
>   arch/powerpc/platforms/82xx/pq2ads-pci-pic.c     |  4 +-
>   arch/powerpc/platforms/82xx/pq2fads.c            | 10 ++--
>   arch/powerpc/platforms/83xx/km83xx.c             |  6 +-
>   arch/powerpc/platforms/83xx/mpc836x_mds.c        |  2 +-
>   arch/powerpc/platforms/85xx/mpc85xx_mds.c        |  2 +-
>   arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c     |  4 +-
>   arch/powerpc/platforms/85xx/mpc85xx_rdb.c        |  2 +-
>   arch/powerpc/platforms/85xx/p1022_ds.c           |  4 +-
>   arch/powerpc/platforms/85xx/p1022_rdk.c          |  4 +-
>   arch/powerpc/platforms/85xx/t1042rdb_diu.c       |  4 +-
>   arch/powerpc/platforms/85xx/twr_p102x.c          |  2 +-
>   arch/powerpc/platforms/86xx/mpc8610_hpcd.c       |  4 +-
>   arch/powerpc/platforms/8xx/adder875.c            |  2 +-
>   arch/powerpc/platforms/8xx/m8xx_setup.c          |  4 +-
>   arch/powerpc/platforms/8xx/mpc86xads_setup.c     |  4 +-
>   arch/powerpc/platforms/8xx/mpc885ads_setup.c     | 28 ++++-----
>   arch/powerpc/platforms/embedded6xx/flipper-pic.c |  6 +-
>   arch/powerpc/platforms/embedded6xx/hlwd-pic.c    |  8 +--
>   arch/powerpc/platforms/embedded6xx/wii.c         | 10 ++--
>   arch/powerpc/sysdev/cpm1.c                       | 26 ++++-----
>   arch/powerpc/sysdev/cpm2.c                       | 16 ++---
>   arch/powerpc/sysdev/cpm_common.c                 |  4 +-
>   arch/powerpc/sysdev/fsl_85xx_l2ctlr.c            |  8 +--
>   arch/powerpc/sysdev/fsl_lbc.c                    |  2 +-
>   arch/powerpc/sysdev/fsl_pci.c                    |  8 +--
>   arch/powerpc/sysdev/fsl_pmc.c                    |  2 +-
>   arch/powerpc/sysdev/fsl_rcpm.c                   | 74 ++++++++++++------------
>   arch/powerpc/sysdev/fsl_rio.c                    |  4 +-
>   arch/powerpc/sysdev/fsl_rmu.c                    |  8 +--
>   arch/powerpc/sysdev/mpic_timer.c                 | 12 ++--
>   41 files changed, 178 insertions(+), 177 deletions(-)
> 
> diff --git a/arch/powerpc/include/asm/fsl_lbc.h b/arch/powerpc/include/asm/fsl_lbc.h
> index c7240a024b96..55d7aa0c27cf 100644
> --- a/arch/powerpc/include/asm/fsl_lbc.h
> +++ b/arch/powerpc/include/asm/fsl_lbc.h
> @@ -276,7 +276,7 @@ static inline void fsl_upm_start_pattern(struct fsl_upm *upm, u8 pat_offset)
>    */
>   static inline void fsl_upm_end_pattern(struct fsl_upm *upm)
>   {
> -	clrbits32(upm->mxmr, MxMR_OP_RP);
> +	clrbits32_be(upm->mxmr, MxMR_OP_RP);
>   
>   	while (in_be32(upm->mxmr) & MxMR_OP_RP)
>   		cpu_relax();
> diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
> index e0331e754568..29ecefd41ecb 100644
> --- a/arch/powerpc/include/asm/io.h
> +++ b/arch/powerpc/include/asm/io.h
> @@ -873,8 +873,8 @@ static inline void * bus_to_virt(unsigned long address)
>   #endif /* CONFIG_PPC32 */
>   
>   /* access ports */
> -#define setbits32(_addr, _v) out_be32((_addr), in_be32(_addr) |  (_v))
> -#define clrbits32(_addr, _v) out_be32((_addr), in_be32(_addr) & ~(_v))
> +#define setbits32_be(_addr, _v) out_be32((_addr), in_be32(_addr) |  (_v))
> +#define clrbits32_be(_addr, _v) out_be32((_addr), in_be32(_addr) & ~(_v))
>   
>   #define setbits16(_addr, _v) out_be16((_addr), in_be16(_addr) |  (_v))
>   #define clrbits16(_addr, _v) out_be16((_addr), in_be16(_addr) & ~(_v))
> @@ -904,6 +904,7 @@ static inline void * bus_to_virt(unsigned long address)
>   #define clrsetbits_le16(addr, clear, set) clrsetbits(le16, addr, clear, set)
>   
>   #define clrsetbits_8(addr, clear, set) clrsetbits(8, addr, clear, set)
> +#define clrsetbits32_be(addr, clear, set) clrsetbits(be32, addr, clear, set)
>   
>   #endif /* __KERNEL__ */
>   
> diff --git a/arch/powerpc/platforms/44x/canyonlands.c b/arch/powerpc/platforms/44x/canyonlands.c
> index 157f4ce46386..7145a730769d 100644
> --- a/arch/powerpc/platforms/44x/canyonlands.c
> +++ b/arch/powerpc/platforms/44x/canyonlands.c
> @@ -113,8 +113,8 @@ static int __init ppc460ex_canyonlands_fixup(void)
>   	 * USB2HStop and gpio19 will be USB2DStop. For more details refer to
>   	 * table 34-7 of PPC460EX user manual.
>   	 */
> -	setbits32((vaddr + GPIO0_OSRH), 0x42000000);
> -	setbits32((vaddr + GPIO0_TSRH), 0x42000000);
> +	setbits32_be((vaddr + GPIO0_OSRH), 0x42000000);
> +	setbits32_be((vaddr + GPIO0_TSRH), 0x42000000);
>   err_gpio:
>   	iounmap(vaddr);
>   err_bcsr:
> diff --git a/arch/powerpc/platforms/4xx/gpio.c b/arch/powerpc/platforms/4xx/gpio.c
> index 2238e369cde4..e84f2d20674e 100644
> --- a/arch/powerpc/platforms/4xx/gpio.c
> +++ b/arch/powerpc/platforms/4xx/gpio.c
> @@ -82,9 +82,9 @@ __ppc4xx_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val)
>   	struct ppc4xx_gpio __iomem *regs = mm_gc->regs;
>   
>   	if (val)
> -		setbits32(&regs->or, GPIO_MASK(gpio));
> +		setbits32_be(&regs->or, GPIO_MASK(gpio));
>   	else
> -		clrbits32(&regs->or, GPIO_MASK(gpio));
> +		clrbits32_be(&regs->or, GPIO_MASK(gpio));
>   }
>   
>   static void
> @@ -112,18 +112,18 @@ static int ppc4xx_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio)
>   	spin_lock_irqsave(&chip->lock, flags);
>   
>   	/* Disable open-drain function */
> -	clrbits32(&regs->odr, GPIO_MASK(gpio));
> +	clrbits32_be(&regs->odr, GPIO_MASK(gpio));
>   
>   	/* Float the pin */
> -	clrbits32(&regs->tcr, GPIO_MASK(gpio));
> +	clrbits32_be(&regs->tcr, GPIO_MASK(gpio));
>   
>   	/* Bits 0-15 use TSRL/OSRL, bits 16-31 use TSRH/OSRH */
>   	if (gpio < 16) {
> -		clrbits32(&regs->osrl, GPIO_MASK2(gpio));
> -		clrbits32(&regs->tsrl, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->osrl, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->tsrl, GPIO_MASK2(gpio));
>   	} else {
> -		clrbits32(&regs->osrh, GPIO_MASK2(gpio));
> -		clrbits32(&regs->tsrh, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->osrh, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->tsrh, GPIO_MASK2(gpio));
>   	}
>   
>   	spin_unlock_irqrestore(&chip->lock, flags);
> @@ -145,18 +145,18 @@ ppc4xx_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
>   	__ppc4xx_gpio_set(gc, gpio, val);
>   
>   	/* Disable open-drain function */
> -	clrbits32(&regs->odr, GPIO_MASK(gpio));
> +	clrbits32_be(&regs->odr, GPIO_MASK(gpio));
>   
>   	/* Drive the pin */
> -	setbits32(&regs->tcr, GPIO_MASK(gpio));
> +	setbits32_be(&regs->tcr, GPIO_MASK(gpio));
>   
>   	/* Bits 0-15 use TSRL, bits 16-31 use TSRH */
>   	if (gpio < 16) {
> -		clrbits32(&regs->osrl, GPIO_MASK2(gpio));
> -		clrbits32(&regs->tsrl, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->osrl, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->tsrl, GPIO_MASK2(gpio));
>   	} else {
> -		clrbits32(&regs->osrh, GPIO_MASK2(gpio));
> -		clrbits32(&regs->tsrh, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->osrh, GPIO_MASK2(gpio));
> +		clrbits32_be(&regs->tsrh, GPIO_MASK2(gpio));
>   	}
>   
>   	spin_unlock_irqrestore(&chip->lock, flags);
> diff --git a/arch/powerpc/platforms/512x/pdm360ng.c b/arch/powerpc/platforms/512x/pdm360ng.c
> index dc81f05e0bce..283925e49096 100644
> --- a/arch/powerpc/platforms/512x/pdm360ng.c
> +++ b/arch/powerpc/platforms/512x/pdm360ng.c
> @@ -38,7 +38,7 @@ static int pdm360ng_get_pendown_state(void)
>   
>   	reg = in_be32(pdm360ng_gpio_base + 0xc);
>   	if (reg & 0x40)
> -		setbits32(pdm360ng_gpio_base + 0xc, 0x40);
> +		setbits32_be(pdm360ng_gpio_base + 0xc, 0x40);
>   
>   	reg = in_be32(pdm360ng_gpio_base + 0x8);
>   
> @@ -69,8 +69,8 @@ static int __init pdm360ng_penirq_init(void)
>   		return -ENODEV;
>   	}
>   	out_be32(pdm360ng_gpio_base + 0xc, 0xffffffff);
> -	setbits32(pdm360ng_gpio_base + 0x18, 0x2000);
> -	setbits32(pdm360ng_gpio_base + 0x10, 0x40);
> +	setbits32_be(pdm360ng_gpio_base + 0x18, 0x2000);
> +	setbits32_be(pdm360ng_gpio_base + 0x10, 0x40);
>   
>   	return 0;
>   }
> diff --git a/arch/powerpc/platforms/52xx/mpc52xx_common.c b/arch/powerpc/platforms/52xx/mpc52xx_common.c
> index 565e3a83dc9e..8a8b3d79798d 100644
> --- a/arch/powerpc/platforms/52xx/mpc52xx_common.c
> +++ b/arch/powerpc/platforms/52xx/mpc52xx_common.c
> @@ -314,13 +314,13 @@ int mpc5200_psc_ac97_gpio_reset(int psc_number)
>   
>   	/* enable gpio pins for output */
>   	setbits8(&wkup_gpio->wkup_gpioe, reset);
> -	setbits32(&simple_gpio->simple_gpioe, sync | out);
> +	setbits32_be(&simple_gpio->simple_gpioe, sync | out);
>   
>   	setbits8(&wkup_gpio->wkup_ddr, reset);
> -	setbits32(&simple_gpio->simple_ddr, sync | out);
> +	setbits32_be(&simple_gpio->simple_ddr, sync | out);
>   
>   	/* Assert cold reset */
> -	clrbits32(&simple_gpio->simple_dvo, sync | out);
> +	clrbits32_be(&simple_gpio->simple_dvo, sync | out);
>   	clrbits8(&wkup_gpio->wkup_dvo, reset);
>   
>   	/* wait for 1 us */
> diff --git a/arch/powerpc/platforms/52xx/mpc52xx_gpt.c b/arch/powerpc/platforms/52xx/mpc52xx_gpt.c
> index 17cf249b18ee..88eef86f802c 100644
> --- a/arch/powerpc/platforms/52xx/mpc52xx_gpt.c
> +++ b/arch/powerpc/platforms/52xx/mpc52xx_gpt.c
> @@ -142,7 +142,7 @@ static void mpc52xx_gpt_irq_unmask(struct irq_data *d)
>   	unsigned long flags;
>   
>   	raw_spin_lock_irqsave(&gpt->lock, flags);
> -	setbits32(&gpt->regs->mode, MPC52xx_GPT_MODE_IRQ_EN);
> +	setbits32_be(&gpt->regs->mode, MPC52xx_GPT_MODE_IRQ_EN);
>   	raw_spin_unlock_irqrestore(&gpt->lock, flags);
>   }
>   
> @@ -152,7 +152,7 @@ static void mpc52xx_gpt_irq_mask(struct irq_data *d)
>   	unsigned long flags;
>   
>   	raw_spin_lock_irqsave(&gpt->lock, flags);
> -	clrbits32(&gpt->regs->mode, MPC52xx_GPT_MODE_IRQ_EN);
> +	clrbits32_be(&gpt->regs->mode, MPC52xx_GPT_MODE_IRQ_EN);
>   	raw_spin_unlock_irqrestore(&gpt->lock, flags);
>   }
>   
> @@ -308,7 +308,7 @@ static int mpc52xx_gpt_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio)
>   	dev_dbg(gpt->dev, "%s: gpio:%d\n", __func__, gpio);
>   
>   	raw_spin_lock_irqsave(&gpt->lock, flags);
> -	clrbits32(&gpt->regs->mode, MPC52xx_GPT_MODE_GPIO_MASK);
> +	clrbits32_be(&gpt->regs->mode, MPC52xx_GPT_MODE_GPIO_MASK);
>   	raw_spin_unlock_irqrestore(&gpt->lock, flags);
>   
>   	return 0;
> @@ -482,7 +482,7 @@ int mpc52xx_gpt_stop_timer(struct mpc52xx_gpt_priv *gpt)
>   		return -EBUSY;
>   	}
>   
> -	clrbits32(&gpt->regs->mode, MPC52xx_GPT_MODE_COUNTER_ENABLE);
> +	clrbits32_be(&gpt->regs->mode, MPC52xx_GPT_MODE_COUNTER_ENABLE);
>   	raw_spin_unlock_irqrestore(&gpt->lock, flags);
>   	return 0;
>   }
> @@ -639,7 +639,7 @@ static int mpc52xx_wdt_release(struct inode *inode, struct file *file)
>   	unsigned long flags;
>   
>   	raw_spin_lock_irqsave(&gpt_wdt->lock, flags);
> -	clrbits32(&gpt_wdt->regs->mode,
> +	clrbits32_be(&gpt_wdt->regs->mode,
>   		  MPC52xx_GPT_MODE_COUNTER_ENABLE | MPC52xx_GPT_MODE_WDT_EN);
>   	gpt_wdt->wdt_mode &= ~MPC52xx_GPT_IS_WDT;
>   	raw_spin_unlock_irqrestore(&gpt_wdt->lock, flags);
> diff --git a/arch/powerpc/platforms/82xx/ep8248e.c b/arch/powerpc/platforms/82xx/ep8248e.c
> index 8fec050f2d5b..da4fee98085f 100644
> --- a/arch/powerpc/platforms/82xx/ep8248e.c
> +++ b/arch/powerpc/platforms/82xx/ep8248e.c
> @@ -262,7 +262,7 @@ static void __init ep8248e_setup_arch(void)
>   	/* When this is set, snooping CPM DMA from RAM causes
>   	 * machine checks.  See erratum SIU18.
>   	 */
> -	clrbits32(&cpm2_immr->im_siu_conf.siu_82xx.sc_bcr, MPC82XX_BCR_PLDP);
> +	clrbits32_be(&cpm2_immr->im_siu_conf.siu_82xx.sc_bcr, MPC82XX_BCR_PLDP);
>   
>   	ep8248e_bcsr_node =
>   		of_find_compatible_node(NULL, NULL, "fsl,ep8248e-bcsr");
> diff --git a/arch/powerpc/platforms/82xx/km82xx.c b/arch/powerpc/platforms/82xx/km82xx.c
> index 28860e40b5db..b5b34f8b1a9b 100644
> --- a/arch/powerpc/platforms/82xx/km82xx.c
> +++ b/arch/powerpc/platforms/82xx/km82xx.c
> @@ -157,9 +157,9 @@ static void __init init_ioports(void)
>   	cpm2_clk_setup(CPM_CLK_FCC2, CPM_CLK14, CPM_CLK_TX);
>   
>   	/* Force USB FULL SPEED bit to '1' */
> -	setbits32(&cpm2_immr->im_ioport.iop_pdata, 1 << (31 - 10));
> +	setbits32_be(&cpm2_immr->im_ioport.iop_pdata, 1 << (31 - 10));
>   	/* clear USB_SLAVE */
> -	clrbits32(&cpm2_immr->im_ioport.iop_pdata, 1 << (31 - 11));
> +	clrbits32_be(&cpm2_immr->im_ioport.iop_pdata, 1 << (31 - 11));
>   }
>   
>   static void __init km82xx_setup_arch(void)
> @@ -172,7 +172,7 @@ static void __init km82xx_setup_arch(void)
>   	/* When this is set, snooping CPM DMA from RAM causes
>   	 * machine checks.  See erratum SIU18.
>   	 */
> -	clrbits32(&cpm2_immr->im_siu_conf.siu_82xx.sc_bcr, MPC82XX_BCR_PLDP);
> +	clrbits32_be(&cpm2_immr->im_siu_conf.siu_82xx.sc_bcr, MPC82XX_BCR_PLDP);
>   
>   	init_ioports();
>   
> diff --git a/arch/powerpc/platforms/82xx/mpc8272_ads.c b/arch/powerpc/platforms/82xx/mpc8272_ads.c
> index d23c10a96bde..a9c8cd13a4b5 100644
> --- a/arch/powerpc/platforms/82xx/mpc8272_ads.c
> +++ b/arch/powerpc/platforms/82xx/mpc8272_ads.c
> @@ -164,13 +164,13 @@ static void __init mpc8272_ads_setup_arch(void)
>   #define BCSR3_FETHIEN2		0x10000000
>   #define BCSR3_FETH2_RST		0x08000000
>   
> -	clrbits32(&bcsr[1], BCSR1_RS232_EN1 | BCSR1_RS232_EN2 | BCSR1_FETHIEN);
> -	setbits32(&bcsr[1], BCSR1_FETH_RST);
> +	clrbits32_be(&bcsr[1], BCSR1_RS232_EN1 | BCSR1_RS232_EN2 | BCSR1_FETHIEN);
> +	setbits32_be(&bcsr[1], BCSR1_FETH_RST);
>   
> -	clrbits32(&bcsr[3], BCSR3_FETHIEN2);
> -	setbits32(&bcsr[3], BCSR3_FETH2_RST);
> +	clrbits32_be(&bcsr[3], BCSR3_FETHIEN2);
> +	setbits32_be(&bcsr[3], BCSR3_FETH2_RST);
>   
> -	clrbits32(&bcsr[3], BCSR3_USB_nEN);
> +	clrbits32_be(&bcsr[3], BCSR3_USB_nEN);
>   
>   	iounmap(bcsr);
>   
> diff --git a/arch/powerpc/platforms/82xx/pq2.c b/arch/powerpc/platforms/82xx/pq2.c
> index c4f7029fc9ae..43a9a948f064 100644
> --- a/arch/powerpc/platforms/82xx/pq2.c
> +++ b/arch/powerpc/platforms/82xx/pq2.c
> @@ -25,7 +25,7 @@
>   void __noreturn pq2_restart(char *cmd)
>   {
>   	local_irq_disable();
> -	setbits32(&cpm2_immr->im_clkrst.car_rmr, RMR_CSRE);
> +	setbits32_be(&cpm2_immr->im_clkrst.car_rmr, RMR_CSRE);
>   
>   	/* Clear the ME,EE,IR & DR bits in MSR to cause checkstop */
>   	mtmsr(mfmsr() & ~(MSR_ME | MSR_EE | MSR_IR | MSR_DR));
> diff --git a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
> index 8b065bdf7412..b691de4c580a 100644
> --- a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
> +++ b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
> @@ -47,7 +47,7 @@ static void pq2ads_pci_mask_irq(struct irq_data *d)
>   		unsigned long flags;
>   		raw_spin_lock_irqsave(&pci_pic_lock, flags);
>   
> -		setbits32(&priv->regs->mask, 1 << irq);
> +		setbits32_be(&priv->regs->mask, 1 << irq);
>   		mb();
>   
>   		raw_spin_unlock_irqrestore(&pci_pic_lock, flags);
> @@ -63,7 +63,7 @@ static void pq2ads_pci_unmask_irq(struct irq_data *d)
>   		unsigned long flags;
>   
>   		raw_spin_lock_irqsave(&pci_pic_lock, flags);
> -		clrbits32(&priv->regs->mask, 1 << irq);
> +		clrbits32_be(&priv->regs->mask, 1 << irq);
>   		raw_spin_unlock_irqrestore(&pci_pic_lock, flags);
>   	}
>   }
> diff --git a/arch/powerpc/platforms/82xx/pq2fads.c b/arch/powerpc/platforms/82xx/pq2fads.c
> index 6c654dc74a4b..05e9c743712f 100644
> --- a/arch/powerpc/platforms/82xx/pq2fads.c
> +++ b/arch/powerpc/platforms/82xx/pq2fads.c
> @@ -140,18 +140,18 @@ static void __init pq2fads_setup_arch(void)
>   
>   	/* Enable the serial and ethernet ports */
>   
> -	clrbits32(&bcsr[1], BCSR1_RS232_EN1 | BCSR1_RS232_EN2 | BCSR1_FETHIEN);
> -	setbits32(&bcsr[1], BCSR1_FETH_RST);
> +	clrbits32_be(&bcsr[1], BCSR1_RS232_EN1 | BCSR1_RS232_EN2 | BCSR1_FETHIEN);
> +	setbits32_be(&bcsr[1], BCSR1_FETH_RST);
>   
> -	clrbits32(&bcsr[3], BCSR3_FETHIEN2);
> -	setbits32(&bcsr[3], BCSR3_FETH2_RST);
> +	clrbits32_be(&bcsr[3], BCSR3_FETHIEN2);
> +	setbits32_be(&bcsr[3], BCSR3_FETH2_RST);
>   
>   	iounmap(bcsr);
>   
>   	init_ioports();
>   
>   	/* Enable external IRQs */
> -	clrbits32(&cpm2_immr->im_siu_conf.siu_82xx.sc_siumcr, 0x0c000000);
> +	clrbits32_be(&cpm2_immr->im_siu_conf.siu_82xx.sc_siumcr, 0x0c000000);
>   
>   	pq2_init_pci();
>   
> diff --git a/arch/powerpc/platforms/83xx/km83xx.c b/arch/powerpc/platforms/83xx/km83xx.c
> index d8642a4afc74..d13f11aac111 100644
> --- a/arch/powerpc/platforms/83xx/km83xx.c
> +++ b/arch/powerpc/platforms/83xx/km83xx.c
> @@ -101,19 +101,19 @@ static void quirk_mpc8360e_qe_enet10(void)
>   		 * UCC1: write 0b11 to bits 18:19
>   		 * at address IMMRBAR+0x14A8
>   		 */
> -		setbits32((base + 0xa8), 0x00003000);
> +		setbits32_be((base + 0xa8), 0x00003000);
>   
>   		/*
>   		 * UCC2 option 1: write 0b11 to bits 4:5
>   		 * at address IMMRBAR+0x14A8
>   		 */
> -		setbits32((base + 0xa8), 0x0c000000);
> +		setbits32_be((base + 0xa8), 0x0c000000);
>   
>   		/*
>   		 * UCC2 option 2: write 0b11 to bits 16:17
>   		 * at address IMMRBAR+0x14AC
>   		 */
> -		setbits32((base + 0xac), 0x0000c000);
> +		setbits32_be((base + 0xac), 0x0000c000);
>   	}
>   	iounmap(base);
>   	of_node_put(np_par);
> diff --git a/arch/powerpc/platforms/83xx/mpc836x_mds.c b/arch/powerpc/platforms/83xx/mpc836x_mds.c
> index fd44dd03e1f3..56e638fdbbc5 100644
> --- a/arch/powerpc/platforms/83xx/mpc836x_mds.c
> +++ b/arch/powerpc/platforms/83xx/mpc836x_mds.c
> @@ -118,7 +118,7 @@ static void __init mpc836x_mds_setup_arch(void)
>   			 * IMMR + 0x14A8[4:5] = 11 (clk delay for UCC 2)
>   			 * IMMR + 0x14A8[18:19] = 11 (clk delay for UCC 1)
>   			 */
> -			setbits32(immap, 0x0c003000);
> +			setbits32_be(immap, 0x0c003000);
>   
>   			/*
>   			 * IMMR + 0x14AC[20:27] = 10101010
> diff --git a/arch/powerpc/platforms/85xx/mpc85xx_mds.c b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
> index d7e440e6dba3..06c18149dc5a 100644
> --- a/arch/powerpc/platforms/85xx/mpc85xx_mds.c
> +++ b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
> @@ -262,7 +262,7 @@ static void __init mpc85xx_mds_qe_init(void)
>   			 * and QE12 for QE MII management signals in PMUXCR
>   			 * register.
>   			 */
> -				setbits32(&guts->pmuxcr, MPC85xx_PMUXCR_QE(0) |
> +				setbits32_be(&guts->pmuxcr, MPC85xx_PMUXCR_QE(0) |
>   						  MPC85xx_PMUXCR_QE(3) |
>   						  MPC85xx_PMUXCR_QE(9) |
>   						  MPC85xx_PMUXCR_QE(12));
> diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
> index f05325f0cc03..b1bb81a49a7f 100644
> --- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
> +++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
> @@ -60,9 +60,9 @@ static void mpc85xx_freeze_time_base(bool freeze)
>   
>   	mask = CCSR_GUTS_DEVDISR_TB0 | CCSR_GUTS_DEVDISR_TB1;
>   	if (freeze)
> -		setbits32(&guts->devdisr, mask);
> +		setbits32_be(&guts->devdisr, mask);
>   	else
> -		clrbits32(&guts->devdisr, mask);
> +		clrbits32_be(&guts->devdisr, mask);
>   
>   	in_be32(&guts->devdisr);
>   }
> diff --git a/arch/powerpc/platforms/85xx/mpc85xx_rdb.c b/arch/powerpc/platforms/85xx/mpc85xx_rdb.c
> index 10069503e39f..13ae0b12dd5a 100644
> --- a/arch/powerpc/platforms/85xx/mpc85xx_rdb.c
> +++ b/arch/powerpc/platforms/85xx/mpc85xx_rdb.c
> @@ -115,7 +115,7 @@ static void __init mpc85xx_rdb_setup_arch(void)
>   			* and QE12 for QE MII management singals in PMUXCR
>   			* register.
>   			*/
> -				setbits32(&guts->pmuxcr, MPC85xx_PMUXCR_QE(0) |
> +				setbits32_be(&guts->pmuxcr, MPC85xx_PMUXCR_QE(0) |
>   						MPC85xx_PMUXCR_QE(3) |
>   						MPC85xx_PMUXCR_QE(9) |
>   						MPC85xx_PMUXCR_QE(12));
> diff --git a/arch/powerpc/platforms/85xx/p1022_ds.c b/arch/powerpc/platforms/85xx/p1022_ds.c
> index 9fb57f78cdbe..adb7abdd291f 100644
> --- a/arch/powerpc/platforms/85xx/p1022_ds.c
> +++ b/arch/powerpc/platforms/85xx/p1022_ds.c
> @@ -405,11 +405,11 @@ void p1022ds_set_pixel_clock(unsigned int pixclock)
>   	pxclk = clamp_t(u32, pxclk, 2, 255);
>   
>   	/* Disable the pixel clock, and set it to non-inverted and no delay */
> -	clrbits32(&guts->clkdvdr,
> +	clrbits32_be(&guts->clkdvdr,
>   		  CLKDVDR_PXCKEN | CLKDVDR_PXCKDLY | CLKDVDR_PXCLK_MASK);
>   
>   	/* Enable the clock and set the pxclk */
> -	setbits32(&guts->clkdvdr, CLKDVDR_PXCKEN | (pxclk << 16));
> +	setbits32_be(&guts->clkdvdr, CLKDVDR_PXCKEN | (pxclk << 16));
>   
>   	iounmap(guts);
>   }
> diff --git a/arch/powerpc/platforms/85xx/p1022_rdk.c b/arch/powerpc/platforms/85xx/p1022_rdk.c
> index 276e00ab3dde..97698230f031 100644
> --- a/arch/powerpc/platforms/85xx/p1022_rdk.c
> +++ b/arch/powerpc/platforms/85xx/p1022_rdk.c
> @@ -75,11 +75,11 @@ void p1022rdk_set_pixel_clock(unsigned int pixclock)
>   	pxclk = clamp_t(u32, pxclk, 2, 255);
>   
>   	/* Disable the pixel clock, and set it to non-inverted and no delay */
> -	clrbits32(&guts->clkdvdr,
> +	clrbits32_be(&guts->clkdvdr,
>   		  CLKDVDR_PXCKEN | CLKDVDR_PXCKDLY | CLKDVDR_PXCLK_MASK);
>   
>   	/* Enable the clock and set the pxclk */
> -	setbits32(&guts->clkdvdr, CLKDVDR_PXCKEN | (pxclk << 16));
> +	setbits32_be(&guts->clkdvdr, CLKDVDR_PXCKEN | (pxclk << 16));
>   
>   	iounmap(guts);
>   }
> diff --git a/arch/powerpc/platforms/85xx/t1042rdb_diu.c b/arch/powerpc/platforms/85xx/t1042rdb_diu.c
> index dac36ba82fea..c11f95711a8a 100644
> --- a/arch/powerpc/platforms/85xx/t1042rdb_diu.c
> +++ b/arch/powerpc/platforms/85xx/t1042rdb_diu.c
> @@ -114,11 +114,11 @@ static void t1042rdb_set_pixel_clock(unsigned int pixclock)
>   	pxclk = clamp_t(u32, pxclk, 2, 255);
>   
>   	/* Disable the pixel clock, and set it to non-inverted and no delay */
> -	clrbits32(scfg + CCSR_SCFG_PIXCLKCR,
> +	clrbits32_be(scfg + CCSR_SCFG_PIXCLKCR,
>   		  PIXCLKCR_PXCKEN | PIXCLKCR_PXCKDLY | PIXCLKCR_PXCLK_MASK);
>   
>   	/* Enable the clock and set the pxclk */
> -	setbits32(scfg + CCSR_SCFG_PIXCLKCR, PIXCLKCR_PXCKEN | (pxclk << 16));
> +	setbits32_be(scfg + CCSR_SCFG_PIXCLKCR, PIXCLKCR_PXCKEN | (pxclk << 16));
>   
>   	iounmap(scfg);
>   }
> diff --git a/arch/powerpc/platforms/85xx/twr_p102x.c b/arch/powerpc/platforms/85xx/twr_p102x.c
> index 360f6253e9ff..b678ee2665d0 100644
> --- a/arch/powerpc/platforms/85xx/twr_p102x.c
> +++ b/arch/powerpc/platforms/85xx/twr_p102x.c
> @@ -95,7 +95,7 @@ static void __init twr_p1025_setup_arch(void)
>   			 * and QE12 for QE MII management signals in PMUXCR
>   			 * register.
>   			 * Set QE mux bits in PMUXCR */
> -			setbits32(&guts->pmuxcr, MPC85xx_PMUXCR_QE(0) |
> +			setbits32_be(&guts->pmuxcr, MPC85xx_PMUXCR_QE(0) |
>   					MPC85xx_PMUXCR_QE(3) |
>   					MPC85xx_PMUXCR_QE(9) |
>   					MPC85xx_PMUXCR_QE(12));
> diff --git a/arch/powerpc/platforms/86xx/mpc8610_hpcd.c b/arch/powerpc/platforms/86xx/mpc8610_hpcd.c
> index a5d73fabe4d1..78472179b05a 100644
> --- a/arch/powerpc/platforms/86xx/mpc8610_hpcd.c
> +++ b/arch/powerpc/platforms/86xx/mpc8610_hpcd.c
> @@ -261,11 +261,11 @@ void mpc8610hpcd_set_pixel_clock(unsigned int pixclock)
>   	pxclk = clamp_t(u32, pxclk, 2, 31);
>   
>   	/* Disable the pixel clock, and set it to non-inverted and no delay */
> -	clrbits32(&guts->clkdvdr,
> +	clrbits32_be(&guts->clkdvdr,
>   		  CLKDVDR_PXCKEN | CLKDVDR_PXCKDLY | CLKDVDR_PXCLK_MASK);
>   
>   	/* Enable the clock and set the pxclk */
> -	setbits32(&guts->clkdvdr, CLKDVDR_PXCKEN | (pxclk << 16));
> +	setbits32_be(&guts->clkdvdr, CLKDVDR_PXCKEN | (pxclk << 16));
>   
>   	iounmap(guts);
>   }
> diff --git a/arch/powerpc/platforms/8xx/adder875.c b/arch/powerpc/platforms/8xx/adder875.c
> index bcef9f66191e..d21d0b8fd2a7 100644
> --- a/arch/powerpc/platforms/8xx/adder875.c
> +++ b/arch/powerpc/platforms/8xx/adder875.c
> @@ -77,7 +77,7 @@ static void __init init_ioports(void)
>   	cpm1_clk_setup(CPM_CLK_SMC1, CPM_BRG1, CPM_CLK_RTX);
>   
>   	/* Set FEC1 and FEC2 to MII mode */
> -	clrbits32(&mpc8xx_immr->im_cpm.cp_cptr, 0x00000180);
> +	clrbits32_be(&mpc8xx_immr->im_cpm.cp_cptr, 0x00000180);
>   }
>   
>   static void __init adder875_setup(void)
> diff --git a/arch/powerpc/platforms/8xx/m8xx_setup.c b/arch/powerpc/platforms/8xx/m8xx_setup.c
> index 027c42d8966c..2ed24abd0b40 100644
> --- a/arch/powerpc/platforms/8xx/m8xx_setup.c
> +++ b/arch/powerpc/platforms/8xx/m8xx_setup.c
> @@ -103,7 +103,7 @@ void __init mpc8xx_calibrate_decr(void)
>   
>   	/* Force all 8xx processors to use divide by 16 processor clock. */
>   	clk_r2 = immr_map(im_clkrst);
> -	setbits32(&clk_r2->car_sccr, 0x02000000);
> +	setbits32_be(&clk_r2->car_sccr, 0x02000000);
>   	immr_unmap(clk_r2);
>   
>   	/* Processor frequency is MHz.
> @@ -203,7 +203,7 @@ void __noreturn mpc8xx_restart(char *cmd)
>   
>   	local_irq_disable();
>   
> -	setbits32(&clk_r->car_plprcr, 0x00000080);
> +	setbits32_be(&clk_r->car_plprcr, 0x00000080);
>   	/* Clear the ME bit in MSR to cause checkstop on machine check
>   	*/
>   	mtmsr(mfmsr() & ~0x1000);
> diff --git a/arch/powerpc/platforms/8xx/mpc86xads_setup.c b/arch/powerpc/platforms/8xx/mpc86xads_setup.c
> index 8d02f5ff4481..a25e5ab15d65 100644
> --- a/arch/powerpc/platforms/8xx/mpc86xads_setup.c
> +++ b/arch/powerpc/platforms/8xx/mpc86xads_setup.c
> @@ -87,7 +87,7 @@ static void __init init_ioports(void)
>   	cpm1_clk_setup(CPM_CLK_SCC1, CPM_CLK2, CPM_CLK_RX);
>   
>   	/* Set FEC1 and FEC2 to MII mode */
> -	clrbits32(&mpc8xx_immr->im_cpm.cp_cptr, 0x00000180);
> +	clrbits32_be(&mpc8xx_immr->im_cpm.cp_cptr, 0x00000180);
>   }
>   
>   static void __init mpc86xads_setup_arch(void)
> @@ -112,7 +112,7 @@ static void __init mpc86xads_setup_arch(void)
>   		return;
>   	}
>   
> -	clrbits32(bcsr_io, BCSR1_RS232EN_1 | BCSR1_RS232EN_2 | BCSR1_ETHEN);
> +	clrbits32_be(bcsr_io, BCSR1_RS232EN_1 | BCSR1_RS232EN_2 | BCSR1_ETHEN);
>   	iounmap(bcsr_io);
>   }
>   
> diff --git a/arch/powerpc/platforms/8xx/mpc885ads_setup.c b/arch/powerpc/platforms/8xx/mpc885ads_setup.c
> index a0c83c1905c6..8aad0fb9090b 100644
> --- a/arch/powerpc/platforms/8xx/mpc885ads_setup.c
> +++ b/arch/powerpc/platforms/8xx/mpc885ads_setup.c
> @@ -123,7 +123,7 @@ static void __init init_ioports(void)
>   	cpm1_clk_setup(CPM_CLK_SCC3, CPM_CLK6, CPM_CLK_RX);
>   
>   	/* Set FEC1 and FEC2 to MII mode */
> -	clrbits32(&mpc8xx_immr->im_cpm.cp_cptr, 0x00000180);
> +	clrbits32_be(&mpc8xx_immr->im_cpm.cp_cptr, 0x00000180);
>   }
>   
>   static void __init mpc885ads_setup_arch(void)
> @@ -148,33 +148,33 @@ static void __init mpc885ads_setup_arch(void)
>   		return;
>   	}
>   
> -	clrbits32(&bcsr[1], BCSR1_RS232EN_1);
> +	clrbits32_be(&bcsr[1], BCSR1_RS232EN_1);
>   #ifdef CONFIG_MPC8xx_SECOND_ETH_FEC2
> -	setbits32(&bcsr[1], BCSR1_RS232EN_2);
> +	setbits32_be(&bcsr[1], BCSR1_RS232EN_2);
>   #else
> -	clrbits32(&bcsr[1], BCSR1_RS232EN_2);
> +	clrbits32_be(&bcsr[1], BCSR1_RS232EN_2);
>   #endif
>   
> -	clrbits32(bcsr5, BCSR5_MII1_EN);
> -	setbits32(bcsr5, BCSR5_MII1_RST);
> +	clrbits32_be(bcsr5, BCSR5_MII1_EN);
> +	setbits32_be(bcsr5, BCSR5_MII1_RST);
>   	udelay(1000);
> -	clrbits32(bcsr5, BCSR5_MII1_RST);
> +	clrbits32_be(bcsr5, BCSR5_MII1_RST);
>   
>   #ifdef CONFIG_MPC8xx_SECOND_ETH_FEC2
> -	clrbits32(bcsr5, BCSR5_MII2_EN);
> -	setbits32(bcsr5, BCSR5_MII2_RST);
> +	clrbits32_be(bcsr5, BCSR5_MII2_EN);
> +	setbits32_be(bcsr5, BCSR5_MII2_RST);
>   	udelay(1000);
> -	clrbits32(bcsr5, BCSR5_MII2_RST);
> +	clrbits32_be(bcsr5, BCSR5_MII2_RST);
>   #else
> -	setbits32(bcsr5, BCSR5_MII2_EN);
> +	setbits32_be(bcsr5, BCSR5_MII2_EN);
>   #endif
>   
>   #ifdef CONFIG_MPC8xx_SECOND_ETH_SCC3
> -	clrbits32(&bcsr[4], BCSR4_ETH10_RST);
> +	clrbits32_be(&bcsr[4], BCSR4_ETH10_RST);
>   	udelay(1000);
> -	setbits32(&bcsr[4], BCSR4_ETH10_RST);
> +	setbits32_be(&bcsr[4], BCSR4_ETH10_RST);
>   
> -	setbits32(&bcsr[1], BCSR1_ETHEN);
> +	setbits32_be(&bcsr[1], BCSR1_ETHEN);
>   
>   	np = of_find_node_by_path("/soc@ff000000/cpm@9c0/serial@a80");
>   #else
> diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
> index db0be007fd06..6df4533aa851 100644
> --- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c
> +++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
> @@ -53,7 +53,7 @@ static void flipper_pic_mask_and_ack(struct irq_data *d)
>   	void __iomem *io_base = irq_data_get_irq_chip_data(d);
>   	u32 mask = 1 << irq;
>   
> -	clrbits32(io_base + FLIPPER_IMR, mask);
> +	clrbits32_be(io_base + FLIPPER_IMR, mask);
>   	/* this is at least needed for RSW */
>   	out_be32(io_base + FLIPPER_ICR, mask);
>   }
> @@ -72,7 +72,7 @@ static void flipper_pic_mask(struct irq_data *d)
>   	int irq = irqd_to_hwirq(d);
>   	void __iomem *io_base = irq_data_get_irq_chip_data(d);
>   
> -	clrbits32(io_base + FLIPPER_IMR, 1 << irq);
> +	clrbits32_be(io_base + FLIPPER_IMR, 1 << irq);
>   }
>   
>   static void flipper_pic_unmask(struct irq_data *d)
> @@ -80,7 +80,7 @@ static void flipper_pic_unmask(struct irq_data *d)
>   	int irq = irqd_to_hwirq(d);
>   	void __iomem *io_base = irq_data_get_irq_chip_data(d);
>   
> -	setbits32(io_base + FLIPPER_IMR, 1 << irq);
> +	setbits32_be(io_base + FLIPPER_IMR, 1 << irq);
>   }
>   
>   
> diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
> index 8112b39879d6..5487710bed1c 100644
> --- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
> +++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
> @@ -50,7 +50,7 @@ static void hlwd_pic_mask_and_ack(struct irq_data *d)
>   	void __iomem *io_base = irq_data_get_irq_chip_data(d);
>   	u32 mask = 1 << irq;
>   
> -	clrbits32(io_base + HW_BROADWAY_IMR, mask);
> +	clrbits32_be(io_base + HW_BROADWAY_IMR, mask);
>   	out_be32(io_base + HW_BROADWAY_ICR, mask);
>   }
>   
> @@ -67,7 +67,7 @@ static void hlwd_pic_mask(struct irq_data *d)
>   	int irq = irqd_to_hwirq(d);
>   	void __iomem *io_base = irq_data_get_irq_chip_data(d);
>   
> -	clrbits32(io_base + HW_BROADWAY_IMR, 1 << irq);
> +	clrbits32_be(io_base + HW_BROADWAY_IMR, 1 << irq);
>   }
>   
>   static void hlwd_pic_unmask(struct irq_data *d)
> @@ -75,10 +75,10 @@ static void hlwd_pic_unmask(struct irq_data *d)
>   	int irq = irqd_to_hwirq(d);
>   	void __iomem *io_base = irq_data_get_irq_chip_data(d);
>   
> -	setbits32(io_base + HW_BROADWAY_IMR, 1 << irq);
> +	setbits32_be(io_base + HW_BROADWAY_IMR, 1 << irq);
>   
>   	/* Make sure the ARM (aka. Starlet) doesn't handle this interrupt. */
> -	clrbits32(io_base + HW_STARLET_IMR, 1 << irq);
> +	clrbits32_be(io_base + HW_STARLET_IMR, 1 << irq);
>   }
>   
>   
> diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
> index 403523c061ba..dd511e19147a 100644
> --- a/arch/powerpc/platforms/embedded6xx/wii.c
> +++ b/arch/powerpc/platforms/embedded6xx/wii.c
> @@ -134,7 +134,7 @@ static void __init wii_setup_arch(void)
>   	hw_gpio = wii_ioremap_hw_regs("hw_gpio", HW_GPIO_COMPATIBLE);
>   	if (hw_gpio) {
>   		/* turn off the front blue led and IR light */
> -		clrbits32(hw_gpio + HW_GPIO_OUT(0),
> +		clrbits32_be(hw_gpio + HW_GPIO_OUT(0),
>   			  HW_GPIO_SLOT_LED | HW_GPIO_SENSOR_BAR);
>   	}
>   }
> @@ -145,7 +145,7 @@ static void __noreturn wii_restart(char *cmd)
>   
>   	if (hw_ctrl) {
>   		/* clear the system reset pin to cause a reset */
> -		clrbits32(hw_ctrl + HW_CTRL_RESETS, HW_CTRL_RESETS_SYS);
> +		clrbits32_be(hw_ctrl + HW_CTRL_RESETS, HW_CTRL_RESETS_SYS);
>   	}
>   	wii_spin();
>   }
> @@ -159,13 +159,13 @@ static void wii_power_off(void)
>   		 * set the owner of the shutdown pin to ARM, because it is
>   		 * accessed through the registers for the ARM, below
>   		 */
> -		clrbits32(hw_gpio + HW_GPIO_OWNER, HW_GPIO_SHUTDOWN);
> +		clrbits32_be(hw_gpio + HW_GPIO_OWNER, HW_GPIO_SHUTDOWN);
>   
>   		/* make sure that the poweroff GPIO is configured as output */
> -		setbits32(hw_gpio + HW_GPIO_DIR(1), HW_GPIO_SHUTDOWN);
> +		setbits32_be(hw_gpio + HW_GPIO_DIR(1), HW_GPIO_SHUTDOWN);
>   
>   		/* drive the poweroff GPIO high */
> -		setbits32(hw_gpio + HW_GPIO_OUT(1), HW_GPIO_SHUTDOWN);
> +		setbits32_be(hw_gpio + HW_GPIO_OUT(1), HW_GPIO_SHUTDOWN);
>   	}
>   	wii_spin();
>   }
> diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
> index 4f8dcf124828..9de5f13c51cb 100644
> --- a/arch/powerpc/sysdev/cpm1.c
> +++ b/arch/powerpc/sysdev/cpm1.c
> @@ -60,14 +60,14 @@ static void cpm_mask_irq(struct irq_data *d)
>   {
>   	unsigned int cpm_vec = (unsigned int)irqd_to_hwirq(d);
>   
> -	clrbits32(&cpic_reg->cpic_cimr, (1 << cpm_vec));
> +	clrbits32_be(&cpic_reg->cpic_cimr, (1 << cpm_vec));
>   }
>   
>   static void cpm_unmask_irq(struct irq_data *d)
>   {
>   	unsigned int cpm_vec = (unsigned int)irqd_to_hwirq(d);
>   
> -	setbits32(&cpic_reg->cpic_cimr, (1 << cpm_vec));
> +	setbits32_be(&cpic_reg->cpic_cimr, (1 << cpm_vec));
>   }
>   
>   static void cpm_end_irq(struct irq_data *d)
> @@ -188,7 +188,7 @@ unsigned int cpm_pic_init(void)
>   	if (setup_irq(eirq, &cpm_error_irqaction))
>   		printk(KERN_ERR "Could not allocate CPM error IRQ!");
>   
> -	setbits32(&cpic_reg->cpic_cicr, CICR_IEN);
> +	setbits32_be(&cpic_reg->cpic_cicr, CICR_IEN);
>   
>   end:
>   	of_node_put(np);
> @@ -317,14 +317,14 @@ static void cpm1_set_pin32(int port, int pin, int flags)
>   		      &mpc8xx_immr->im_cpm.cp_pedir;
>   
>   	if (flags & CPM_PIN_OUTPUT)
> -		setbits32(&iop->dir, pin);
> +		setbits32_be(&iop->dir, pin);
>   	else
> -		clrbits32(&iop->dir, pin);
> +		clrbits32_be(&iop->dir, pin);
>   
>   	if (!(flags & CPM_PIN_GPIO))
> -		setbits32(&iop->par, pin);
> +		setbits32_be(&iop->par, pin);
>   	else
> -		clrbits32(&iop->par, pin);
> +		clrbits32_be(&iop->par, pin);
>   
>   	if (port == CPM_PORTB) {
>   		if (flags & CPM_PIN_OPENDRAIN)
> @@ -335,14 +335,14 @@ static void cpm1_set_pin32(int port, int pin, int flags)
>   
>   	if (port == CPM_PORTE) {
>   		if (flags & CPM_PIN_SECONDARY)
> -			setbits32(&iop->sor, pin);
> +			setbits32_be(&iop->sor, pin);
>   		else
> -			clrbits32(&iop->sor, pin);
> +			clrbits32_be(&iop->sor, pin);
>   
>   		if (flags & CPM_PIN_OPENDRAIN)
> -			setbits32(&mpc8xx_immr->im_cpm.cp_peodr, pin);
> +			setbits32_be(&mpc8xx_immr->im_cpm.cp_peodr, pin);
>   		else
> -			clrbits32(&mpc8xx_immr->im_cpm.cp_peodr, pin);
> +			clrbits32_be(&mpc8xx_immr->im_cpm.cp_peodr, pin);
>   	}
>   }
>   
> @@ -732,7 +732,7 @@ static int cpm1_gpio32_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
>   
>   	spin_lock_irqsave(&cpm1_gc->lock, flags);
>   
> -	setbits32(&iop->dir, pin_mask);
> +	setbits32_be(&iop->dir, pin_mask);
>   	__cpm1_gpio32_set(mm_gc, pin_mask, val);
>   
>   	spin_unlock_irqrestore(&cpm1_gc->lock, flags);
> @@ -750,7 +750,7 @@ static int cpm1_gpio32_dir_in(struct gpio_chip *gc, unsigned int gpio)
>   
>   	spin_lock_irqsave(&cpm1_gc->lock, flags);
>   
> -	clrbits32(&iop->dir, pin_mask);
> +	clrbits32_be(&iop->dir, pin_mask);
>   
>   	spin_unlock_irqrestore(&cpm1_gc->lock, flags);
>   
> diff --git a/arch/powerpc/sysdev/cpm2.c b/arch/powerpc/sysdev/cpm2.c
> index 07718b9a2c99..445d6e45a6de 100644
> --- a/arch/powerpc/sysdev/cpm2.c
> +++ b/arch/powerpc/sysdev/cpm2.c
> @@ -335,22 +335,22 @@ void cpm2_set_pin(int port, int pin, int flags)
>   	pin = 1 << (31 - pin);
>   
>   	if (flags & CPM_PIN_OUTPUT)
> -		setbits32(&iop[port].dir, pin);
> +		setbits32_be(&iop[port].dir, pin);
>   	else
> -		clrbits32(&iop[port].dir, pin);
> +		clrbits32_be(&iop[port].dir, pin);
>   
>   	if (!(flags & CPM_PIN_GPIO))
> -		setbits32(&iop[port].par, pin);
> +		setbits32_be(&iop[port].par, pin);
>   	else
> -		clrbits32(&iop[port].par, pin);
> +		clrbits32_be(&iop[port].par, pin);
>   
>   	if (flags & CPM_PIN_SECONDARY)
> -		setbits32(&iop[port].sor, pin);
> +		setbits32_be(&iop[port].sor, pin);
>   	else
> -		clrbits32(&iop[port].sor, pin);
> +		clrbits32_be(&iop[port].sor, pin);
>   
>   	if (flags & CPM_PIN_OPENDRAIN)
> -		setbits32(&iop[port].odr, pin);
> +		setbits32_be(&iop[port].odr, pin);
>   	else
> -		clrbits32(&iop[port].odr, pin);
> +		clrbits32_be(&iop[port].odr, pin);
>   }
> diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c
> index b74508175b67..d36a95708aaf 100644
> --- a/arch/powerpc/sysdev/cpm_common.c
> +++ b/arch/powerpc/sysdev/cpm_common.c
> @@ -165,7 +165,7 @@ static int cpm2_gpio32_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
>   
>   	spin_lock_irqsave(&cpm2_gc->lock, flags);
>   
> -	setbits32(&iop->dir, pin_mask);
> +	setbits32_be(&iop->dir, pin_mask);
>   	__cpm2_gpio32_set(mm_gc, pin_mask, val);
>   
>   	spin_unlock_irqrestore(&cpm2_gc->lock, flags);
> @@ -183,7 +183,7 @@ static int cpm2_gpio32_dir_in(struct gpio_chip *gc, unsigned int gpio)
>   
>   	spin_lock_irqsave(&cpm2_gc->lock, flags);
>   
> -	clrbits32(&iop->dir, pin_mask);
> +	clrbits32_be(&iop->dir, pin_mask);
>   
>   	spin_unlock_irqrestore(&cpm2_gc->lock, flags);
>   
> diff --git a/arch/powerpc/sysdev/fsl_85xx_l2ctlr.c b/arch/powerpc/sysdev/fsl_85xx_l2ctlr.c
> index c27058e5df26..2b7e2b4a2543 100644
> --- a/arch/powerpc/sysdev/fsl_85xx_l2ctlr.c
> +++ b/arch/powerpc/sysdev/fsl_85xx_l2ctlr.c
> @@ -124,23 +124,23 @@ static int mpc85xx_l2ctlr_of_probe(struct platform_device *dev)
>   
>   	switch (ways) {
>   	case LOCK_WAYS_EIGHTH:
> -		setbits32(&l2ctlr->ctl,
> +		setbits32_be(&l2ctlr->ctl,
>   			L2CR_L2E | L2CR_L2FI | L2CR_SRAM_EIGHTH);
>   		break;
>   
>   	case LOCK_WAYS_TWO_EIGHTH:
> -		setbits32(&l2ctlr->ctl,
> +		setbits32_be(&l2ctlr->ctl,
>   			L2CR_L2E | L2CR_L2FI | L2CR_SRAM_QUART);
>   		break;
>   
>   	case LOCK_WAYS_HALF:
> -		setbits32(&l2ctlr->ctl,
> +		setbits32_be(&l2ctlr->ctl,
>   			L2CR_L2E | L2CR_L2FI | L2CR_SRAM_HALF);
>   		break;
>   
>   	case LOCK_WAYS_FULL:
>   	default:
> -		setbits32(&l2ctlr->ctl,
> +		setbits32_be(&l2ctlr->ctl,
>   			L2CR_L2E | L2CR_L2FI | L2CR_SRAM_FULL);
>   		break;
>   	}
> diff --git a/arch/powerpc/sysdev/fsl_lbc.c b/arch/powerpc/sysdev/fsl_lbc.c
> index 5340a483cf55..994233e41b91 100644
> --- a/arch/powerpc/sysdev/fsl_lbc.c
> +++ b/arch/powerpc/sysdev/fsl_lbc.c
> @@ -192,7 +192,7 @@ static int fsl_lbc_ctrl_init(struct fsl_lbc_ctrl *ctrl,
>   	struct fsl_lbc_regs __iomem *lbc = ctrl->regs;
>   
>   	/* clear event registers */
> -	setbits32(&lbc->ltesr, LTESR_CLEAR);
> +	setbits32_be(&lbc->ltesr, LTESR_CLEAR);
>   	out_be32(&lbc->lteatr, 0);
>   	out_be32(&lbc->ltear, 0);
>   	out_be32(&lbc->lteccr, LTECCR_CLEAR);
> diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
> index 918be816b097..17aa5ee63d34 100644
> --- a/arch/powerpc/sysdev/fsl_pci.c
> +++ b/arch/powerpc/sysdev/fsl_pci.c
> @@ -1196,11 +1196,11 @@ static int fsl_pci_pme_probe(struct pci_controller *hose)
>   	pci = hose->private_data;
>   
>   	/* Enable PTOD, ENL23D & EXL23D */
> -	clrbits32(&pci->pex_pme_mes_disr,
> +	clrbits32_be(&pci->pex_pme_mes_disr,
>   		  PME_DISR_EN_PTOD | PME_DISR_EN_ENL23D | PME_DISR_EN_EXL23D);
>   
>   	out_be32(&pci->pex_pme_mes_ier, 0);
> -	setbits32(&pci->pex_pme_mes_ier,
> +	setbits32_be(&pci->pex_pme_mes_ier,
>   		  PME_DISR_EN_PTOD | PME_DISR_EN_ENL23D | PME_DISR_EN_EXL23D);
>   
>   	/* PME Enable */
> @@ -1218,7 +1218,7 @@ static void send_pme_turnoff_message(struct pci_controller *hose)
>   	int i;
>   
>   	/* Send PME_Turn_Off Message Request */
> -	setbits32(&pci->pex_pmcr, PEX_PMCR_PTOMR);
> +	setbits32_be(&pci->pex_pmcr, PEX_PMCR_PTOMR);
>   
>   	/* Wait trun off done */
>   	for (i = 0; i < 150; i++) {
> @@ -1254,7 +1254,7 @@ static void fsl_pci_syscore_do_resume(struct pci_controller *hose)
>   	int i;
>   
>   	/* Send Exit L2 State Message */
> -	setbits32(&pci->pex_pmcr, PEX_PMCR_EXL2S);
> +	setbits32_be(&pci->pex_pmcr, PEX_PMCR_EXL2S);
>   
>   	/* Wait exit done */
>   	for (i = 0; i < 150; i++) {
> diff --git a/arch/powerpc/sysdev/fsl_pmc.c b/arch/powerpc/sysdev/fsl_pmc.c
> index 232225e7f863..bbcf4cb89bb6 100644
> --- a/arch/powerpc/sysdev/fsl_pmc.c
> +++ b/arch/powerpc/sysdev/fsl_pmc.c
> @@ -37,7 +37,7 @@ static int pmc_suspend_enter(suspend_state_t state)
>   {
>   	int ret;
>   
> -	setbits32(&pmc_regs->pmcsr, PMCSR_SLP);
> +	setbits32_be(&pmc_regs->pmcsr, PMCSR_SLP);
>   	/* At this point, the CPU is asleep. */
>   
>   	/* Upon resume, wait for SLP bit to be clear. */
> diff --git a/arch/powerpc/sysdev/fsl_rcpm.c b/arch/powerpc/sysdev/fsl_rcpm.c
> index 9259a94f70e1..bd2a7606bfce 100644
> --- a/arch/powerpc/sysdev/fsl_rcpm.c
> +++ b/arch/powerpc/sysdev/fsl_rcpm.c
> @@ -33,10 +33,10 @@ static void rcpm_v1_irq_mask(int cpu)
>   	int hw_cpu = get_hard_smp_processor_id(cpu);
>   	unsigned int mask = 1 << hw_cpu;
>   
> -	setbits32(&rcpm_v1_regs->cpmimr, mask);
> -	setbits32(&rcpm_v1_regs->cpmcimr, mask);
> -	setbits32(&rcpm_v1_regs->cpmmcmr, mask);
> -	setbits32(&rcpm_v1_regs->cpmnmimr, mask);
> +	setbits32_be(&rcpm_v1_regs->cpmimr, mask);
> +	setbits32_be(&rcpm_v1_regs->cpmcimr, mask);
> +	setbits32_be(&rcpm_v1_regs->cpmmcmr, mask);
> +	setbits32_be(&rcpm_v1_regs->cpmnmimr, mask);
>   }
>   
>   static void rcpm_v2_irq_mask(int cpu)
> @@ -44,10 +44,10 @@ static void rcpm_v2_irq_mask(int cpu)
>   	int hw_cpu = get_hard_smp_processor_id(cpu);
>   	unsigned int mask = 1 << hw_cpu;
>   
> -	setbits32(&rcpm_v2_regs->tpmimr0, mask);
> -	setbits32(&rcpm_v2_regs->tpmcimr0, mask);
> -	setbits32(&rcpm_v2_regs->tpmmcmr0, mask);
> -	setbits32(&rcpm_v2_regs->tpmnmimr0, mask);
> +	setbits32_be(&rcpm_v2_regs->tpmimr0, mask);
> +	setbits32_be(&rcpm_v2_regs->tpmcimr0, mask);
> +	setbits32_be(&rcpm_v2_regs->tpmmcmr0, mask);
> +	setbits32_be(&rcpm_v2_regs->tpmnmimr0, mask);
>   }
>   
>   static void rcpm_v1_irq_unmask(int cpu)
> @@ -55,10 +55,10 @@ static void rcpm_v1_irq_unmask(int cpu)
>   	int hw_cpu = get_hard_smp_processor_id(cpu);
>   	unsigned int mask = 1 << hw_cpu;
>   
> -	clrbits32(&rcpm_v1_regs->cpmimr, mask);
> -	clrbits32(&rcpm_v1_regs->cpmcimr, mask);
> -	clrbits32(&rcpm_v1_regs->cpmmcmr, mask);
> -	clrbits32(&rcpm_v1_regs->cpmnmimr, mask);
> +	clrbits32_be(&rcpm_v1_regs->cpmimr, mask);
> +	clrbits32_be(&rcpm_v1_regs->cpmcimr, mask);
> +	clrbits32_be(&rcpm_v1_regs->cpmmcmr, mask);
> +	clrbits32_be(&rcpm_v1_regs->cpmnmimr, mask);
>   }
>   
>   static void rcpm_v2_irq_unmask(int cpu)
> @@ -66,26 +66,26 @@ static void rcpm_v2_irq_unmask(int cpu)
>   	int hw_cpu = get_hard_smp_processor_id(cpu);
>   	unsigned int mask = 1 << hw_cpu;
>   
> -	clrbits32(&rcpm_v2_regs->tpmimr0, mask);
> -	clrbits32(&rcpm_v2_regs->tpmcimr0, mask);
> -	clrbits32(&rcpm_v2_regs->tpmmcmr0, mask);
> -	clrbits32(&rcpm_v2_regs->tpmnmimr0, mask);
> +	clrbits32_be(&rcpm_v2_regs->tpmimr0, mask);
> +	clrbits32_be(&rcpm_v2_regs->tpmcimr0, mask);
> +	clrbits32_be(&rcpm_v2_regs->tpmmcmr0, mask);
> +	clrbits32_be(&rcpm_v2_regs->tpmnmimr0, mask);
>   }
>   
>   static void rcpm_v1_set_ip_power(bool enable, u32 mask)
>   {
>   	if (enable)
> -		setbits32(&rcpm_v1_regs->ippdexpcr, mask);
> +		setbits32_be(&rcpm_v1_regs->ippdexpcr, mask);
>   	else
> -		clrbits32(&rcpm_v1_regs->ippdexpcr, mask);
> +		clrbits32_be(&rcpm_v1_regs->ippdexpcr, mask);
>   }
>   
>   static void rcpm_v2_set_ip_power(bool enable, u32 mask)
>   {
>   	if (enable)
> -		setbits32(&rcpm_v2_regs->ippdexpcr[0], mask);
> +		setbits32_be(&rcpm_v2_regs->ippdexpcr[0], mask);
>   	else
> -		clrbits32(&rcpm_v2_regs->ippdexpcr[0], mask);
> +		clrbits32_be(&rcpm_v2_regs->ippdexpcr[0], mask);
>   }
>   
>   static void rcpm_v1_cpu_enter_state(int cpu, int state)
> @@ -95,10 +95,10 @@ static void rcpm_v1_cpu_enter_state(int cpu, int state)
>   
>   	switch (state) {
>   	case E500_PM_PH10:
> -		setbits32(&rcpm_v1_regs->cdozcr, mask);
> +		setbits32_be(&rcpm_v1_regs->cdozcr, mask);
>   		break;
>   	case E500_PM_PH15:
> -		setbits32(&rcpm_v1_regs->cnapcr, mask);
> +		setbits32_be(&rcpm_v1_regs->cnapcr, mask);
>   		break;
>   	default:
>   		pr_warn("Unknown cpu PM state (%d)\n", state);
> @@ -114,16 +114,16 @@ static void rcpm_v2_cpu_enter_state(int cpu, int state)
>   	switch (state) {
>   	case E500_PM_PH10:
>   		/* one bit corresponds to one thread for PH10 of 6500 */
> -		setbits32(&rcpm_v2_regs->tph10setr0, 1 << hw_cpu);
> +		setbits32_be(&rcpm_v2_regs->tph10setr0, 1 << hw_cpu);
>   		break;
>   	case E500_PM_PH15:
> -		setbits32(&rcpm_v2_regs->pcph15setr, mask);
> +		setbits32_be(&rcpm_v2_regs->pcph15setr, mask);
>   		break;
>   	case E500_PM_PH20:
> -		setbits32(&rcpm_v2_regs->pcph20setr, mask);
> +		setbits32_be(&rcpm_v2_regs->pcph20setr, mask);
>   		break;
>   	case E500_PM_PH30:
> -		setbits32(&rcpm_v2_regs->pcph30setr, mask);
> +		setbits32_be(&rcpm_v2_regs->pcph30setr, mask);
>   		break;
>   	default:
>   		pr_warn("Unknown cpu PM state (%d)\n", state);
> @@ -172,10 +172,10 @@ static void rcpm_v1_cpu_exit_state(int cpu, int state)
>   
>   	switch (state) {
>   	case E500_PM_PH10:
> -		clrbits32(&rcpm_v1_regs->cdozcr, mask);
> +		clrbits32_be(&rcpm_v1_regs->cdozcr, mask);
>   		break;
>   	case E500_PM_PH15:
> -		clrbits32(&rcpm_v1_regs->cnapcr, mask);
> +		clrbits32_be(&rcpm_v1_regs->cnapcr, mask);
>   		break;
>   	default:
>   		pr_warn("Unknown cpu PM state (%d)\n", state);
> @@ -196,16 +196,16 @@ static void rcpm_v2_cpu_exit_state(int cpu, int state)
>   
>   	switch (state) {
>   	case E500_PM_PH10:
> -		setbits32(&rcpm_v2_regs->tph10clrr0, 1 << hw_cpu);
> +		setbits32_be(&rcpm_v2_regs->tph10clrr0, 1 << hw_cpu);
>   		break;
>   	case E500_PM_PH15:
> -		setbits32(&rcpm_v2_regs->pcph15clrr, mask);
> +		setbits32_be(&rcpm_v2_regs->pcph15clrr, mask);
>   		break;
>   	case E500_PM_PH20:
> -		setbits32(&rcpm_v2_regs->pcph20clrr, mask);
> +		setbits32_be(&rcpm_v2_regs->pcph20clrr, mask);
>   		break;
>   	case E500_PM_PH30:
> -		setbits32(&rcpm_v2_regs->pcph30clrr, mask);
> +		setbits32_be(&rcpm_v2_regs->pcph30clrr, mask);
>   		break;
>   	default:
>   		pr_warn("Unknown cpu PM state (%d)\n", state);
> @@ -226,7 +226,7 @@ static int rcpm_v1_plat_enter_state(int state)
>   
>   	switch (state) {
>   	case PLAT_PM_SLEEP:
> -		setbits32(pmcsr_reg, RCPM_POWMGTCSR_SLP);
> +		setbits32_be(pmcsr_reg, RCPM_POWMGTCSR_SLP);
>   
>   		/* Upon resume, wait for RCPM_POWMGTCSR_SLP bit to be clear. */
>   		result = spin_event_timeout(
> @@ -253,9 +253,9 @@ static int rcpm_v2_plat_enter_state(int state)
>   	switch (state) {
>   	case PLAT_PM_LPM20:
>   		/* clear previous LPM20 status */
> -		setbits32(pmcsr_reg, RCPM_POWMGTCSR_P_LPM20_ST);
> +		setbits32_be(pmcsr_reg, RCPM_POWMGTCSR_P_LPM20_ST);
>   		/* enter LPM20 status */
> -		setbits32(pmcsr_reg, RCPM_POWMGTCSR_LPM20_RQ);
> +		setbits32_be(pmcsr_reg, RCPM_POWMGTCSR_LPM20_RQ);
>   
>   		/* At this point, the device is in LPM20 status. */
>   
> @@ -291,9 +291,9 @@ static void rcpm_common_freeze_time_base(u32 *tben_reg, int freeze)
>   
>   	if (freeze) {
>   		mask = in_be32(tben_reg);
> -		clrbits32(tben_reg, mask);
> +		clrbits32_be(tben_reg, mask);
>   	} else {
> -		setbits32(tben_reg, mask);
> +		setbits32_be(tben_reg, mask);
>   	}
>   
>   	/* read back to push the previous write */
> diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
> index 5011ffea4e4b..278e63cc8afe 100644
> --- a/arch/powerpc/sysdev/fsl_rio.c
> +++ b/arch/powerpc/sysdev/fsl_rio.c
> @@ -668,10 +668,10 @@ int fsl_rio_setup(struct platform_device *dev)
>   			out_be32(priv->regs_win
>   				+ RIO_CCSR + i*0x20, 0);
>   			/* Set 1x lane */
> -			setbits32(priv->regs_win
> +			setbits32_be(priv->regs_win
>   				+ RIO_CCSR + i*0x20, 0x02000000);
>   			/* Enable ports */
> -			setbits32(priv->regs_win
> +			setbits32_be(priv->regs_win
>   				+ RIO_CCSR + i*0x20, 0x00600000);
>   			msleep(100);
>   			if (in_be32((priv->regs_win
> diff --git a/arch/powerpc/sysdev/fsl_rmu.c b/arch/powerpc/sysdev/fsl_rmu.c
> index 88b35a3dcdc5..134ba53f0fcb 100644
> --- a/arch/powerpc/sysdev/fsl_rmu.c
> +++ b/arch/powerpc/sysdev/fsl_rmu.c
> @@ -355,7 +355,7 @@ fsl_rio_dbell_handler(int irq, void *dev_instance)
>   				dmsg->sid, dmsg->tid,
>   				dmsg->info);
>   		}
> -		setbits32(&fsl_dbell->dbell_regs->dmr, DOORBELL_DMR_DI);
> +		setbits32_be(&fsl_dbell->dbell_regs->dmr, DOORBELL_DMR_DI);
>   		out_be32(&fsl_dbell->dbell_regs->dsr, DOORBELL_DSR_DIQI);
>   	}
>   
> @@ -909,10 +909,10 @@ fsl_open_inb_mbox(struct rio_mport *mport, void *dev_id, int mbox, int entries)
>   	out_be32(&rmu->msg_regs->imr, 0x001b0060);
>   
>   	/* Set number of queue entries */
> -	setbits32(&rmu->msg_regs->imr, (get_bitmask_order(entries) - 2) << 12);
> +	setbits32_be(&rmu->msg_regs->imr, (get_bitmask_order(entries) - 2) << 12);
>   
>   	/* Now enable the unit */
> -	setbits32(&rmu->msg_regs->imr, 0x1);
> +	setbits32_be(&rmu->msg_regs->imr, 0x1);
>   
>   out:
>   	return rc;
> @@ -1015,7 +1015,7 @@ void *fsl_get_inb_message(struct rio_mport *mport, int mbox)
>   	rmu->msg_rx_ring.virt_buffer[buf_idx] = NULL;
>   
>   out1:
> -	setbits32(&rmu->msg_regs->imr, RIO_MSG_IMR_MI);
> +	setbits32_be(&rmu->msg_regs->imr, RIO_MSG_IMR_MI);
>   
>   out2:
>   	return buf;
> diff --git a/arch/powerpc/sysdev/mpic_timer.c b/arch/powerpc/sysdev/mpic_timer.c
> index 87e7c42777a8..70b02ba90220 100644
> --- a/arch/powerpc/sysdev/mpic_timer.c
> +++ b/arch/powerpc/sysdev/mpic_timer.c
> @@ -154,7 +154,7 @@ static int set_cascade_timer(struct timer_group_priv *priv, u64 ticks,
>   
>   	tcr = casc_priv->tcr_value |
>   		(casc_priv->tcr_value << MPIC_TIMER_TCR_ROVR_OFFSET);
> -	setbits32(priv->group_tcr, tcr);
> +	setbits32_be(priv->group_tcr, tcr);
>   
>   	tmp_ticks = div_u64_rem(ticks, MAX_TICKS_CASCADE, &rem_ticks);
>   
> @@ -253,7 +253,7 @@ void mpic_start_timer(struct mpic_timer *handle)
>   	struct timer_group_priv *priv = container_of(handle,
>   			struct timer_group_priv, timer[handle->num]);
>   
> -	clrbits32(&priv->regs[handle->num].gtbcr, TIMER_STOP);
> +	clrbits32_be(&priv->regs[handle->num].gtbcr, TIMER_STOP);
>   }
>   EXPORT_SYMBOL(mpic_start_timer);
>   
> @@ -269,7 +269,7 @@ void mpic_stop_timer(struct mpic_timer *handle)
>   			struct timer_group_priv, timer[handle->num]);
>   	struct cascade_priv *casc_priv;
>   
> -	setbits32(&priv->regs[handle->num].gtbcr, TIMER_STOP);
> +	setbits32_be(&priv->regs[handle->num].gtbcr, TIMER_STOP);
>   
>   	casc_priv = priv->timer[handle->num].cascade_handle;
>   	if (casc_priv) {
> @@ -340,7 +340,7 @@ void mpic_free_timer(struct mpic_timer *handle)
>   		u32 tcr;
>   		tcr = casc_priv->tcr_value | (casc_priv->tcr_value <<
>   					MPIC_TIMER_TCR_ROVR_OFFSET);
> -		clrbits32(priv->group_tcr, tcr);
> +		clrbits32_be(priv->group_tcr, tcr);
>   		priv->idle |= casc_priv->cascade_map;
>   		priv->timer[handle->num].cascade_handle = NULL;
>   	} else {
> @@ -508,7 +508,7 @@ static void timer_group_init(struct device_node *np)
>   
>   	/* Init FSL timer hardware */
>   	if (priv->flags & FSL_GLOBAL_TIMER)
> -		setbits32(priv->group_tcr, MPIC_TIMER_TCR_CLKDIV);
> +		setbits32_be(priv->group_tcr, MPIC_TIMER_TCR_CLKDIV);
>   
>   	list_add_tail(&priv->node, &timer_group_list);
>   
> @@ -531,7 +531,7 @@ static void mpic_timer_resume(void)
>   	list_for_each_entry(priv, &timer_group_list, node) {
>   		/* Init FSL timer hardware */
>   		if (priv->flags & FSL_GLOBAL_TIMER)
> -			setbits32(priv->group_tcr, MPIC_TIMER_TCR_CLKDIV);
> +			setbits32_be(priv->group_tcr, MPIC_TIMER_TCR_CLKDIV);
>   	}
>   }
>   
> 

^ permalink raw reply

* Re: [PATCH 2/5] include: add setbits32/clrbits32/clrsetbits32/setbits64/clrbits64/clrsetbits64 in linux/setbits.h
From: Christophe LEROY @ 2018-09-10  5:22 UTC (permalink / raw)
  To: Corentin Labbe, Gilles.Muller, Julia.Lawall, agust,
	alexandre.torgue, alistair, benh, carlo, davem, galak, joabreu,
	khilman, maxime.ripard, michal.lkml, mpe, mporter, nicolas.palix,
	oss, paulus, peppe.cavallaro, tj, vitb, wens
  Cc: netdev, linux-kernel, linux-ide, linux-sunxi, linux-amlogic,
	linuxppc-dev, cocci, linux-arm-kernel
In-Reply-To: <1536349307-20714-3-git-send-email-clabbe@baylibre.com>



Le 07/09/2018 à 21:41, Corentin Labbe a écrit :
> This patch adds setbits32/clrbits32/clrsetbits32 and
> setbits64/clrbits64/clrsetbits64 in linux/setbits.h header.

So you changed the name of setbits32() ... to setbits32_be() and now you 
are adding new functions called setbits32() ... which do something 
different ?

What will happen if any file has been forgotten during the conversion, 
or if anybody has outoftree drivers and missed this change ?
They will silently successfully compile without any error or warning, 
and the result will be crap buggy.

And why would it be more legitim to have setbits32() be implicitely LE 
instead of implicitely BE ?

I really think those new functions should be called something like 
setbits_le32() ...

Christophe

> 
> Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
> ---
>   include/linux/setbits.h | 55 +++++++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 55 insertions(+)
>   create mode 100644 include/linux/setbits.h
> 
> diff --git a/include/linux/setbits.h b/include/linux/setbits.h
> new file mode 100644
> index 000000000000..3e1e273551bb
> --- /dev/null
> +++ b/include/linux/setbits.h
> @@ -0,0 +1,55 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#ifndef __LINUX_SETBITS_H
> +#define __LINUX_SETBITS_H
> +
> +#include <linux/io.h>
> +
> +#define __setbits(readfunction, writefunction, addr, set) \
> +	writefunction((readfunction(addr) | (set)), addr)
> +#define __clrbits(readfunction, writefunction, addr, mask) \
> +	writefunction((readfunction(addr) & ~(mask)), addr)
> +#define __clrsetbits(readfunction, writefunction, addr, mask, set) \
> +	writefunction(((readfunction(addr) & ~(mask)) | (set)), addr)
> +#define __setclrbits(readfunction, writefunction, addr, mask, set) \
> +	writefunction(((readfunction(addr) | (seti)) & ~(mask)), addr)
> +
> +#define setbits32(addr, set) __setbits(readl, writel, addr, set)
> +#define setbits32_relaxed(addr, set) __setbits(readl_relaxed, writel_relaxed, \
> +					       addr, set)
> +
> +#define clrbits32(addr, mask) __clrbits(readl, writel, addr, mask)
> +#define clrbits32_relaxed(addr, mask) __clrbits(readl_relaxed, writel_relaxed, \
> +						addr, mask)
> +
> +#define clrsetbits32(addr, mask, set) __clrsetbits(readl, writel, addr, mask, set)
> +#define clrsetbits32_relaxed(addr, mask, set) __clrsetbits(readl_relaxed, \
> +							   writel_relaxed, \
> +							   addr, mask, set)
> +
> +#define setclrbits32(addr, mask, set) __setclrbits(readl, writel, addr, mask, set)
> +#define setclrbits32_relaxed(addr, mask, set) __setclrbits(readl_relaxed, \
> +							   writel_relaxed, \
> +							   addr, mask, set)
> +
> +/* We cannot use CONFIG_64BIT as some x86 drivers use writeq */
> +#if defined(writeq) && defined(readq)
> +#define setbits64(addr, set) __setbits(readq, writeq, addr, set)
> +#define setbits64_relaxed(addr, set) __setbits(readq_relaxed, writeq_relaxed, \
> +					       addr, set)
> +
> +#define clrbits64(addr, mask) __clrbits(readq, writeq, addr, mask)
> +#define clrbits64_relaxed(addr, mask) __clrbits(readq_relaxed, writeq_relaxed, \
> +						addr, mask)
> +
> +#define clrsetbits64(addr, mask, set) __clrsetbits(readq, writeq, addr, mask, set)
> +#define clrsetbits64_relaxed(addr, mask, set) __clrsetbits(readq_relaxed, \
> +							   writeq_relaxed, \
> +							   addr, mask, set)
> +
> +#define setclrbits64(addr, mask, set) __setclrbits(readq, writeq, addr, mask, set)
> +#define setclrbits64_relaxed(addr, mask, set) __setclrbits(readq_relaxed, \
> +							   writeq_relaxed, \
> +							   addr, mask, set)
> +#endif /* writeq/readq */
> +
> +#endif /* __LINUX_SETBITS_H */
> 

^ permalink raw reply

* Re: [PATCH 0/5] introduce setbits32/clrbits32/clrsetbits32/setbits64/clrbits64/clrsetbits64 functions
From: Christophe LEROY @ 2018-09-10  5:24 UTC (permalink / raw)
  To: Corentin Labbe, Gilles.Muller, Julia.Lawall, agust,
	alexandre.torgue, alistair, benh, carlo, davem, galak, joabreu,
	khilman, maxime.ripard, michal.lkml, mpe, mporter, nicolas.palix,
	oss, paulus, peppe.cavallaro, tj, vitb, wens
  Cc: netdev, linux-kernel, linux-ide, linux-sunxi, linux-amlogic,
	linuxppc-dev, cocci, linux-arm-kernel
In-Reply-To: <1536349307-20714-1-git-send-email-clabbe@baylibre.com>



Le 07/09/2018 à 21:41, Corentin Labbe a écrit :
> Hello
> 
> This patchset adds a new set of functions which are open-coded in lot of
> place.
> Basicly the pattern is always the same, "read, modify a bit, write"
> some driver already have thoses pattern them as functions. (like ahci_sunxi.c or dwmac-meson8b)
> 
> The first patch rename some powerpc funtions which already use the same name (xxxbits32)
> but with only bigendian values.

The same name as what ?

> 
> The second patch adds the header.

But the second patch adds functions with the same name as the powerpc 
ones but doing something different. Why consider that setbits32() should 
be LE and not BE ?

Christophe


> The third patch is an ugly try to implement a coccinelle semantic patch to
> find all place where xxxbits function could be used.
> Probably this spatch could be better written and I didnt found an easy way to add the "linux/setbits" header.
> 
> The two last patch are example of convertion of two drivers.
> Thoses patchs give an example of the reduction of code won by using xxxbits32.
> 
> This patchset is tested with the ahci_sunxi and dwmac-sun8i drivers.
> 
> Regards
> 
> Corentin Labbe (5):
>    powerpc: rename setbits32/clrbits32 to setbits32_be/clrbits32_be
>    include: add
>      setbits32/clrbits32/clrsetbits32/setbits64/clrbits64/clrsetbits64 in
>      linux/setbits.h
>    coccinelle: add xxxsetbitsXX converting spatch
>    net: ethernet: stmmac: use xxxsetbits32
>    ata: ahci_sunxi: use xxxsetbits32 functions
> 
>   arch/powerpc/include/asm/fsl_lbc.h                 |   2 +-
>   arch/powerpc/include/asm/io.h                      |   5 +-
>   arch/powerpc/platforms/44x/canyonlands.c           |   4 +-
>   arch/powerpc/platforms/4xx/gpio.c                  |  28 +-
>   arch/powerpc/platforms/512x/pdm360ng.c             |   6 +-
>   arch/powerpc/platforms/52xx/mpc52xx_common.c       |   6 +-
>   arch/powerpc/platforms/52xx/mpc52xx_gpt.c          |  10 +-
>   arch/powerpc/platforms/82xx/ep8248e.c              |   2 +-
>   arch/powerpc/platforms/82xx/km82xx.c               |   6 +-
>   arch/powerpc/platforms/82xx/mpc8272_ads.c          |  10 +-
>   arch/powerpc/platforms/82xx/pq2.c                  |   2 +-
>   arch/powerpc/platforms/82xx/pq2ads-pci-pic.c       |   4 +-
>   arch/powerpc/platforms/82xx/pq2fads.c              |  10 +-
>   arch/powerpc/platforms/83xx/km83xx.c               |   6 +-
>   arch/powerpc/platforms/83xx/mpc836x_mds.c          |   2 +-
>   arch/powerpc/platforms/85xx/mpc85xx_mds.c          |   2 +-
>   arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c       |   4 +-
>   arch/powerpc/platforms/85xx/mpc85xx_rdb.c          |   2 +-
>   arch/powerpc/platforms/85xx/p1022_ds.c             |   4 +-
>   arch/powerpc/platforms/85xx/p1022_rdk.c            |   4 +-
>   arch/powerpc/platforms/85xx/t1042rdb_diu.c         |   4 +-
>   arch/powerpc/platforms/85xx/twr_p102x.c            |   2 +-
>   arch/powerpc/platforms/86xx/mpc8610_hpcd.c         |   4 +-
>   arch/powerpc/platforms/8xx/adder875.c              |   2 +-
>   arch/powerpc/platforms/8xx/m8xx_setup.c            |   4 +-
>   arch/powerpc/platforms/8xx/mpc86xads_setup.c       |   4 +-
>   arch/powerpc/platforms/8xx/mpc885ads_setup.c       |  28 +-
>   arch/powerpc/platforms/embedded6xx/flipper-pic.c   |   6 +-
>   arch/powerpc/platforms/embedded6xx/hlwd-pic.c      |   8 +-
>   arch/powerpc/platforms/embedded6xx/wii.c           |  10 +-
>   arch/powerpc/sysdev/cpm1.c                         |  26 +-
>   arch/powerpc/sysdev/cpm2.c                         |  16 +-
>   arch/powerpc/sysdev/cpm_common.c                   |   4 +-
>   arch/powerpc/sysdev/fsl_85xx_l2ctlr.c              |   8 +-
>   arch/powerpc/sysdev/fsl_lbc.c                      |   2 +-
>   arch/powerpc/sysdev/fsl_pci.c                      |   8 +-
>   arch/powerpc/sysdev/fsl_pmc.c                      |   2 +-
>   arch/powerpc/sysdev/fsl_rcpm.c                     |  74 ++--
>   arch/powerpc/sysdev/fsl_rio.c                      |   4 +-
>   arch/powerpc/sysdev/fsl_rmu.c                      |   8 +-
>   arch/powerpc/sysdev/mpic_timer.c                   |  12 +-
>   drivers/ata/ahci_sunxi.c                           |  51 +--
>   .../net/ethernet/stmicro/stmmac/dwmac-meson8b.c    |  54 +--
>   drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c  |  55 +--
>   .../net/ethernet/stmicro/stmmac/dwmac1000_core.c   |  21 +-
>   drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |  51 +--
>   drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c   |  13 +-
>   drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c   |  42 +-
>   drivers/net/ethernet/stmicro/stmmac/dwmac5.c       |  11 +-
>   drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c    |  17 +-
>   .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |  30 +-
>   drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c |  69 +---
>   .../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c  |  11 +-
>   drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c  |   7 +-
>   include/linux/setbits.h                            |  55 +++
>   scripts/coccinelle/misc/setbits.cocci              | 423 +++++++++++++++++++++
>   56 files changed, 776 insertions(+), 489 deletions(-)
>   create mode 100644 include/linux/setbits.h
>   create mode 100644 scripts/coccinelle/misc/setbits.cocci
> 

^ permalink raw reply

* [PATCH] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
From: Kai-Heng Feng @ 2018-09-10  6:34 UTC (permalink / raw)
  To: nic_swsd; +Cc: davem, netdev, linux-kernel, Kai-Heng Feng, Heiner Kallweit

After system suspend, sometimes the r8169 doesn't work when ethernet
cable gets pluggued.

This issue happens because rtl_reset_work() doesn't get called from
rtl8169_runtime_resume(), after system suspend.

In rtl_task(), RTL_FLAG_TASK_* only gets cleared if this condition is
met:
if (!netif_running(dev) ||
    !test_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags))
    ...

If RTL_FLAG_TASK_ENABLED was cleared during system suspend while
RTL_FLAG_TASK_RESET_PENDING was set, the next rtl_schedule_task() won't
schedule task as the flag is still there.

So in addition to clearing RTL_FLAG_TASK_ENABLED, also clears other
flags.

Cc: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
---
 drivers/net/ethernet/realtek/r8169.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index b08d51bf7a20..20593245ef53 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6648,6 +6648,7 @@ static int rtl8169_close(struct net_device *dev)
 {
 	struct rtl8169_private *tp = netdev_priv(dev);
 	struct pci_dev *pdev = tp->pci_dev;
+	int i;
 
 	pm_runtime_get_sync(&pdev->dev);
 
@@ -6655,7 +6656,9 @@ static int rtl8169_close(struct net_device *dev)
 	rtl8169_update_counters(tp);
 
 	rtl_lock_work(tp);
-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+	/* Clear all task flags */
+	for (i = 0; i < RTL_FLAG_MAX; i++)
+		clear_bit(i, tp->wk.flags);
 
 	rtl8169_down(dev);
 	rtl_unlock_work(tp);
@@ -6828,6 +6831,7 @@ rtl8169_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 static void rtl8169_net_suspend(struct net_device *dev)
 {
 	struct rtl8169_private *tp = netdev_priv(dev);
+	int i;
 
 	if (!netif_running(dev))
 		return;
@@ -6838,7 +6842,10 @@ static void rtl8169_net_suspend(struct net_device *dev)
 
 	rtl_lock_work(tp);
 	napi_disable(&tp->napi);
-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+	/* Clear all task flags */
+	for (i = 0; i < RTL_FLAG_MAX; i++)
+		clear_bit(i, tp->wk.flags);
+
 	rtl_unlock_work(tp);
 
 	rtl_pll_power_down(tp);
-- 
2.17.1

^ permalink raw reply related

* Re: [PATCH] wireless: remove unnecessary condition check before kfree
From: Johannes Berg @ 2018-09-10  7:10 UTC (permalink / raw)
  To: zhong jiang, davem; +Cc: linux-wireless, netdev, linux-kernel
In-Reply-To: <1536415955-33776-1-git-send-email-zhongjiang@huawei.com>

On Sat, 2018-09-08 at 22:12 +0800, zhong jiang wrote:
> kfree has taken the null pointer into account. Just remove the
> redundant condition check before kfree.

I'm all for doing that if it actually removes conditionals, but

> -	if (!IS_ERR_OR_NULL(regdb))
> +	if (!IS_ERR(regdb))
>  		kfree(regdb);

this seems rather pointless since there's still a condition. In that
case, I feel it's easier to understand the original code.

johannes

^ permalink raw reply

* [PATCH net-next] tcp: rate limit synflood warnings further
From: Willem de Bruijn @ 2018-09-09 23:12 UTC (permalink / raw)
  To: netdev; +Cc: davem, eric.dumazet, Willem de Bruijn

From: Willem de Bruijn <willemb@google.com>

Convert pr_info to net_info_ratelimited to limit the total number of
synflood warnings.

Commit 946cedccbd73 ("tcp: Change possible SYN flooding messages")
rate limits synflood warnings to one per listener.

Workloads that open many listener sockets can still see a high rate of
log messages. Syzkaller is one frequent example.

Signed-off-by: Willem de Bruijn <willemb@google.com>
---
 net/ipv4/tcp_input.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 62508a2f9b21..d9034073138c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6380,8 +6380,8 @@ static bool tcp_syn_flood_action(const struct sock *sk,
 	if (!queue->synflood_warned &&
 	    net->ipv4.sysctl_tcp_syncookies != 2 &&
 	    xchg(&queue->synflood_warned, 1) == 0)
-		pr_info("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
-			proto, ntohs(tcp_hdr(skb)->dest), msg);
+		net_info_ratelimited("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
+				     proto, ntohs(tcp_hdr(skb)->dest), msg);
 
 	return want_cookie;
 }
-- 
2.19.0.rc2.392.g5ba43deb5a-goog

^ permalink raw reply related

* Re: [PATCH] netlink: fix hash::nelems check
From: Li RongQing @ 2018-09-10  1:36 UTC (permalink / raw)
  To: Li RongQing; +Cc: netdev
In-Reply-To: <1536417194-20828-1-git-send-email-lirongqing@baidu.com>

after reconsider, I think we can remove this check directly, since
rht_grow_above_max() will be called to check the overflow again in
rhashtable_insert_one.

and atomic_read(&table->hash.nelems) always compares with unsigned
value, will force to switch unsigned, so the hash.nelems overflows can
be accepted.

-Rong

^ permalink raw reply

* Re: [PATCH] ath9k: add reset for airtime station debugfs
From: Dave Taht @ 2018-09-09 23:44 UTC (permalink / raw)
  To: Toke Høiland-Jørgensen
  Cc: git, Kalle Valo, QCA ath9k Development, David S. Miller,
	linux-wireless, Linux Kernel Network Developers
In-Reply-To: <87sh2mykmt.fsf@toke.dk>

On Thu, Sep 6, 2018 at 4:13 AM Toke Høiland-Jørgensen <toke@toke.dk> wrote:
>
> Louie Lu <git@louie.lu> writes:
>
> > Toke Høiland-Jørgensen <toke@toke.dk> 於 2018年9月6日 週四 下午5:27寫道:
> >
> >> Louie Lu <git@louie.lu> writes:
> >>
> >> > Let user can reset station airtime status by debugfs, it will
> >> > reset all airtime deficit to ATH_AIRTIME_QUANTUM and reset rx/tx
> >> > airtime accumulate to 0.
> >>
> >> No objections to the patch, but I'm curious which issues you were
> >> debugging that led you to needing it? :)
> >>
> > I'm testing to get the packet queue time + airtime in
> > ath_tx_process_buffer,
>
> Right; I've been thinking that it would be useful to make the CoDel
> enqueue time available to drivers. And minstrel, for that matter
> (lowering the number of retries for packets that has queued for a long
> time, for instance). Good to hear that others are looking into something
> similar :)

Yea! Seeing retransmits scale down would be a goodness. Last I looked
ath9k was at, like 10?, when it should be, like, 2, at mcs0 and 10 at
mcs15.

I can't seem to publish a link to this directly, but it's open access
if you search via https://scholar.google.com/:

"Resolving Bufferbloat in TCP Communication over IEEE 802.11 n WLAN by
Reducing MAC Retransmission Limit at Low Data Rate"

even their simple bifurcated model worked well.




>
> > it would be useful if I can reset the station airtime accumulated
> > value, so I can observe in each test round (e.g. 5 ping) airtime
> > accumulated
> >
> > Also to reset the deficit to make sure it run like fresh one.
>
> Yup, makes sense.
>
> -Toke



-- 

Dave Täht
CEO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-669-226-2619

^ permalink raw reply

* Re: [PATCH net-next] virtio_net: force_napi_tx module param.
From: Willem de Bruijn @ 2018-09-09 23:07 UTC (permalink / raw)
  To: Jason Wang
  Cc: Jon Olson (Google Drive), Michael S. Tsirkin, caleb.raitto,
	David Miller, Network Development, Caleb Raitto
In-Reply-To: <CAF=yD-L+psndKfTFS0S33ZvO7NP4wFO=-Gr5aYw22_oqkx+smA@mail.gmail.com>

On Wed, Aug 29, 2018 at 9:01 AM Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
>
> On Wed, Aug 29, 2018 at 3:56 AM Jason Wang <jasowang@redhat.com> wrote:
> >
> >
> >
> > On 2018年08月29日 03:57, Willem de Bruijn wrote:
> > > On Mon, Jul 30, 2018 at 2:06 AM Jason Wang <jasowang@redhat.com> wrote:
> > >>
> > >>
> > >> On 2018年07月25日 08:17, Jon Olson wrote:
> > >>> On Tue, Jul 24, 2018 at 3:46 PM Michael S. Tsirkin <mst@redhat.com> wrote:
> > >>>> On Tue, Jul 24, 2018 at 06:31:54PM -0400, Willem de Bruijn wrote:
> > >>>>> On Tue, Jul 24, 2018 at 6:23 PM Michael S. Tsirkin <mst@redhat.com> wrote:
> > >>>>>> On Tue, Jul 24, 2018 at 04:52:53PM -0400, Willem de Bruijn wrote:
> > >>>>>>> >From the above linked patch, I understand that there are yet
> > >>>>>>> other special cases in production, such as a hard cap on #tx queues to
> > >>>>>>> 32 regardless of number of vcpus.
> > >>>>>> I don't think upstream kernels have this limit - we can
> > >>>>>> now use vmalloc for higher number of queues.
> > >>>>> Yes. that patch* mentioned it as a google compute engine imposed
> > >>>>> limit. It is exactly such cloud provider imposed rules that I'm
> > >>>>> concerned about working around in upstream drivers.
> > >>>>>
> > >>>>> * for reference, I mean https://patchwork.ozlabs.org/patch/725249/
> > >>>> Yea. Why does GCE do it btw?
> > >>> There are a few reasons for the limit, some historical, some current.
> > >>>
> > >>> Historically we did this because of a kernel limit on the number of
> > >>> TAP queues (in Montreal I thought this limit was 32). To my chagrin,
> > >>> the limit upstream at the time we did it was actually eight. We had
> > >>> increased the limit from eight to 32 internally, and it appears in
> > >>> upstream it has subsequently increased upstream to 256. We no longer
> > >>> use TAP for networking, so that constraint no longer applies for us,
> > >>> but when looking at removing/raising the limit we discovered no
> > >>> workloads that clearly benefited from lifting it, and it also placed
> > >>> more pressure on our virtual networking stack particularly on the Tx
> > >>> side. We left it as-is.
> > >>>
> > >>> In terms of current reasons there are really two. One is memory usage.
> > >>> As you know, virtio-net uses rx/tx pairs, so there's an expectation
> > >>> that the guest will have an Rx queue for every Tx queue. We run our
> > >>> individual virtqueues fairly deep (4096 entries) to give guests a wide
> > >>> time window for re-posting Rx buffers and avoiding starvation on
> > >>> packet delivery. Filling an Rx vring with max-sized mergeable buffers
> > >>> (4096 bytes) is 16MB of GFP_ATOMIC allocations. At 32 queues this can
> > >>> be up to 512MB of memory posted for network buffers. Scaling this to
> > >>> the largest VM GCE offers today (160 VCPUs -- n1-ultramem-160) keeping
> > >>> all of the Rx rings full would (in the large average Rx packet size
> > >>> case) consume up to 2.5 GB(!) of guest RAM. Now, those VMs have 3.8T
> > >>> of RAM available, but I don't believe we've observed a situation where
> > >>> they would have benefited from having 2.5 gigs of buffers posted for
> > >>> incoming network traffic :)
> > >> We can work to have async txq and rxq instead of paris if there's a
> > >> strong requirement.
> > >>
> > >>> The second reason is interrupt related -- as I mentioned above, we
> > >>> have found no workloads that clearly benefit from so many queues, but
> > >>> we have found workloads that degrade. In particular workloads that do
> > >>> a lot of small packet processing but which aren't extremely latency
> > >>> sensitive can achieve higher PPS by taking fewer interrupt across
> > >>> fewer VCPUs due to better batching (this also incurs higher latency,
> > >>> but at the limit the "busy" cores end up suppressing most interrupts
> > >>> and spending most of their cycles farming out work). Memcache is a
> > >>> good example here, particularly if the latency targets for request
> > >>> completion are in the ~milliseconds range (rather than the
> > >>> microseconds we typically strive for with TCP_RR-style workloads).
> > >>>
> > >>> All of that said, we haven't been forthcoming with data (and
> > >>> unfortunately I don't have it handy in a useful form, otherwise I'd
> > >>> simply post it here), so I understand the hesitation to simply run
> > >>> with napi_tx across the board. As Willem said, this patch seemed like
> > >>> the least disruptive way to allow us to continue down the road of
> > >>> "universal" NAPI Tx and to hopefully get data across enough workloads
> > >>> (with VMs small, large, and absurdly large :) to present a compelling
> > >>> argument in one direction or another. As far as I know there aren't
> > >>> currently any NAPI related ethtool commands (based on a quick perusal
> > >>> of ethtool.h)
> > >> As I suggest before, maybe we can (ab)use tx-frames-irq.
> > > I forgot to respond to this originally, but I agree.
> > >
> > > How about something like the snippet below. It would be simpler to
> > > reason about if only allow switching while the device is down, but
> > > napi does not strictly require that.
> > >
> > > +static int virtnet_set_coalesce(struct net_device *dev,
> > > +                               struct ethtool_coalesce *ec)
> > > +{
> > > +       const u32 tx_coalesce_napi_mask = (1 << 16);
> > > +       const struct ethtool_coalesce ec_default = {
> > > +               .cmd = ETHTOOL_SCOALESCE,
> > > +               .rx_max_coalesced_frames = 1,
> > > +               .tx_max_coalesced_frames = 1,
> > > +       };
> > > +       struct virtnet_info *vi = netdev_priv(dev);
> > > +       int napi_weight = 0;
> > > +       bool running;
> > > +       int i;
> > > +
> > > +       if (ec->tx_max_coalesced_frames & tx_coalesce_napi_mask) {
> > > +               ec->tx_max_coalesced_frames &= ~tx_coalesce_napi_mask;
> > > +               napi_weight = NAPI_POLL_WEIGHT;
> > > +       }
> > > +
> > > +       /* disallow changes to fields not explicitly tested above */
> > > +       if (memcmp(ec, &ec_default, sizeof(ec_default)))
> > > +               return -EINVAL;
> > > +
> > > +       if (napi_weight ^ vi->sq[0].napi.weight) {
> > > +               running = netif_running(vi->dev);
> > > +
> > > +               for (i = 0; i < vi->max_queue_pairs; i++) {
> > > +                       vi->sq[i].napi.weight = napi_weight;
> > > +
> > > +                       if (!running)
> > > +                               continue;
> > > +
> > > +                       if (napi_weight)
> > > +                               virtnet_napi_tx_enable(vi, vi->sq[i].vq,
> > > +                                                      &vi->sq[i].napi);
> > > +                       else
> > > +                               napi_disable(&vi->sq[i].napi);
> > > +               }
> > > +       }
> > > +
> > > +       return 0;
> > > +}
> > > +
> > > +static int virtnet_get_coalesce(struct net_device *dev,
> > > +                               struct ethtool_coalesce *ec)
> > > +{
> > > +       const u32 tx_coalesce_napi_mask = (1 << 16);
> > > +       const struct ethtool_coalesce ec_default = {
> > > +               .cmd = ETHTOOL_GCOALESCE,
> > > +               .rx_max_coalesced_frames = 1,
> > > +               .tx_max_coalesced_frames = 1,
> > > +       };
> > > +       struct virtnet_info *vi = netdev_priv(dev);
> > > +
> > > +       memcpy(ec, &ec_default, sizeof(ec_default));
> > > +
> > > +       if (vi->sq[0].napi.weight)
> > > +               ec->tx_max_coalesced_frames |= tx_coalesce_napi_mask;
> > > +
> > > +       return 0;
> > > +}
> >
> > Looks good. Just one nit, maybe it's better simply check against zero?
>
> I wanted to avoid making napi and interrupt moderation mutually
> exclusive. If the virtio-net driver ever gets true moderation support,
> it should be able to work alongside napi.
>
> But I can make no-napi be 0 and napi be 1. That is future proof, in
> the sense that napi is enabled if there is any interrupt moderation.

It's not appearing on patchwork yet, but I just sent a patch.

I implemented the above, but .tx_frames of 0 is technically incorrect
and it would unnecessarily constrain interrupt moderation to one of two
modes. I went back to using a high bit. That said, if you feel strongly
I'll change it.

I also tried various ways of switching between napi and non napi
mode without bringing the device down. This is quite fragile. At the
very least napi.weight has to be updated without any interrupt or
napi callback happening in between. So most of the datapath needs
to be quiesced.

I did code up a variant that manually stops all the queues, masks the
interrupt and waits for napi to complete if scheduled. But in a stress
test it still managed to trigger a BUG in napi_enable on this state.

Napi is not switched at runtime in other devices, nor really needed. So
instead I made this change conditional on the device being down.

^ permalink raw reply

* Re: [PATCH net-next 13/15] net: Add and use skb_list_del_init().
From: David Miller @ 2018-09-10  0:35 UTC (permalink / raw)
  To: sergei.shtylyov; +Cc: netdev
In-Reply-To: <5384880e-2f2c-5067-52db-a31727dd1b10@cogentembedded.com>

From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Date: Sun, 9 Sep 2018 12:45:50 +0300

> Hello!
> 
> On 9/8/2018 11:11 PM, David Miller wrote:
> 
>> It documents what is happening, and eliminates the spurious list
>> pointer poisoning.
>> In the long term, in order to get proper list head debugging, we
>> might want to use the list poinson value as the indicator that
> 
>    Poison?

I knew you would find something Sergei :-)

I'll fix that up, thanks.

^ permalink raw reply

* [PATCH net-next] virtio_net: ethtool tx napi configuration
From: Willem de Bruijn @ 2018-09-09 22:44 UTC (permalink / raw)
  To: netdev; +Cc: davem, caleb.raitto, jasowang, mst, jonolson, Willem de Bruijn

From: Willem de Bruijn <willemb@google.com>

Implement ethtool .set_coalesce (-C) and .get_coalesce (-c) handlers.
Interrupt moderation is currently not supported, so these accept and
display the default settings of 0 usec and 1 frame.

Toggle tx napi through a bit in tx-frames. So as to not interfere
with possible future interrupt moderation, use bit 10, well outside
the reasonable range of real interrupt moderation values.

Changes are not atomic. The tx IRQ, napi BH and transmit path must
be quiesced when switching modes. Only allow changing this setting
when the device is down.

Link: https://patchwork.ozlabs.org/patch/948149/
Suggested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
---
 drivers/net/virtio_net.c | 52 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 765920905226..b320b6b14749 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -66,6 +66,8 @@ DECLARE_EWMA(pkt_len, 0, 64)
 
 #define VIRTNET_DRIVER_VERSION "1.0.0"
 
+static const u32 ethtool_coalesce_napi_mask = (1UL << 10);
+
 static const unsigned long guest_offloads[] = {
 	VIRTIO_NET_F_GUEST_TSO4,
 	VIRTIO_NET_F_GUEST_TSO6,
@@ -2181,6 +2183,54 @@ static int virtnet_get_link_ksettings(struct net_device *dev,
 	return 0;
 }
 
+static int virtnet_set_coalesce(struct net_device *dev,
+				struct ethtool_coalesce *ec)
+{
+	const struct ethtool_coalesce ec_default = {
+		.cmd = ETHTOOL_SCOALESCE,
+		.rx_max_coalesced_frames = 1,
+		.tx_max_coalesced_frames = 1,
+	};
+	struct virtnet_info *vi = netdev_priv(dev);
+	int i, napi_weight = 0;
+
+	if (ec->tx_max_coalesced_frames & ethtool_coalesce_napi_mask) {
+		ec->tx_max_coalesced_frames &= ~ethtool_coalesce_napi_mask;
+		napi_weight = NAPI_POLL_WEIGHT;
+	}
+
+	/* disallow changes to fields not explicitly tested above */
+	if (memcmp(ec, &ec_default, sizeof(ec_default)))
+		return -EINVAL;
+
+	if (napi_weight ^ vi->sq[0].napi.weight) {
+		if (dev->flags & IFF_UP)
+			return -EBUSY;
+		for (i = 0; i < vi->max_queue_pairs; i++)
+			vi->sq[i].napi.weight = napi_weight;
+	}
+
+	return 0;
+}
+
+static int virtnet_get_coalesce(struct net_device *dev,
+				struct ethtool_coalesce *ec)
+{
+	const struct ethtool_coalesce ec_default = {
+		.cmd = ETHTOOL_GCOALESCE,
+		.rx_max_coalesced_frames = 1,
+		.tx_max_coalesced_frames = 1,
+	};
+	struct virtnet_info *vi = netdev_priv(dev);
+
+	memcpy(ec, &ec_default, sizeof(ec_default));
+
+	if (vi->sq[0].napi.weight)
+		ec->tx_max_coalesced_frames |= ethtool_coalesce_napi_mask;
+
+	return 0;
+}
+
 static void virtnet_init_settings(struct net_device *dev)
 {
 	struct virtnet_info *vi = netdev_priv(dev);
@@ -2219,6 +2269,8 @@ static const struct ethtool_ops virtnet_ethtool_ops = {
 	.get_ts_info = ethtool_op_get_ts_info,
 	.get_link_ksettings = virtnet_get_link_ksettings,
 	.set_link_ksettings = virtnet_set_link_ksettings,
+	.set_coalesce = virtnet_set_coalesce,
+	.get_coalesce = virtnet_get_coalesce,
 };
 
 static void virtnet_freeze_down(struct virtio_device *vdev)
-- 
2.19.0.rc2.392.g5ba43deb5a-goog

^ permalink raw reply related

* [PATCH] ip6_gre: simplify gre header parsing in ip6gre_err
From: Haishuang Yan @ 2018-09-10  8:25 UTC (permalink / raw)
  To: David S. Miller, Alexey Kuznetsov; +Cc: netdev, linux-kernel, Haishuang Yan

Same as ip_gre, use gre_parse_header to parse gre header in gre error
handler code.

Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
---
 net/ipv6/ip6_gre.c | 29 +++++++----------------------
 1 file changed, 7 insertions(+), 22 deletions(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 18a3794..505d891 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -427,35 +427,20 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		       u8 type, u8 code, int offset, __be32 info)
 {
 	struct net *net = dev_net(skb->dev);
-	const struct gre_base_hdr *greh;
 	const struct ipv6hdr *ipv6h;
-	int grehlen = sizeof(*greh);
+	struct tnl_ptk_info tpi;
+	bool csum_err = false;
 	struct ip6_tnl *t;
-	int key_off = 0;
-	__be16 flags;
-	__be32 key;
 
-	if (!pskb_may_pull(skb, offset + grehlen))
-		return;
-	greh = (const struct gre_base_hdr *)(skb->data + offset);
-	flags = greh->flags;
-	if (flags & (GRE_VERSION | GRE_ROUTING))
-		return;
-	if (flags & GRE_CSUM)
-		grehlen += 4;
-	if (flags & GRE_KEY) {
-		key_off = grehlen + offset;
-		grehlen += 4;
+	if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IPV6),
+			     offset) < 0) {
+		if (!csum_err)		/* ignore csum errors. */
+			return;
 	}
 
-	if (!pskb_may_pull(skb, offset + grehlen))
-		return;
 	ipv6h = (const struct ipv6hdr *)skb->data;
-	greh = (const struct gre_base_hdr *)(skb->data + offset);
-	key = key_off ? *(__be32 *)(skb->data + key_off) : 0;
-
 	t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
-				 key, greh->protocol);
+				 tpi.key, tpi.proto);
 	if (!t)
 		return;
 
-- 
1.8.3.1

^ permalink raw reply related

* [PATCH 0/1] add IPV6_MULTICAST_ALL sockopt
From: Andre Naujoks @ 2018-09-10  8:27 UTC (permalink / raw)
  To: netdev, linux-kernel, davem, kuznet, yoshfuji; +Cc: Andre Naujoks

The patch applies to the current net-next tree.

I tried to keep the impact of this to a minimum and to replicate the
behaviour of IP_MULTICAST_ALL.

Andre Naujoks (1):
  ipv6: Add sockopt IPV6_MULTICAST_ALL analogue to IP_MULTICAST_ALL

 include/linux/ipv6.h     |  3 ++-
 include/uapi/linux/in6.h |  1 +
 net/ipv6/af_inet6.c      |  1 +
 net/ipv6/ipv6_sockglue.c | 11 +++++++++++
 net/ipv6/mcast.c         |  2 +-
 5 files changed, 16 insertions(+), 2 deletions(-)

-- 
2.19.0.rc2

^ permalink raw reply

* [PATCH 1/1] ipv6: Add sockopt IPV6_MULTICAST_ALL analogue to IP_MULTICAST_ALL
From: Andre Naujoks @ 2018-09-10  8:27 UTC (permalink / raw)
  To: netdev, linux-kernel, davem, kuznet, yoshfuji, Greg Kroah-Hartman,
	Erik Kline, Thomas Gleixner, Maciej Żenczykowski, Shaohua Li,
	Andre Naujoks, Kate Stewart, Philippe Ombredanne
In-Reply-To: <20180910082715.11506-1-nautsch2@gmail.com>

The socket option will be enabled by default to ensure current behaviour
is not changed. This is the same for the IPv4 version.

A socket bound to in6addr_any and a specific port will receive all traffic
on that port. Analogue to IP_MULTICAST_ALL, disable this behaviour, if
one or more multicast groups were joined (using said socket) and only
pass on multicast traffic from groups, which were explicitly joined via
this socket.

Without this option disabled a socket (system even) joined to multiple
multicast groups is very hard to get right. Filtering by destination
address has to take place in user space to avoid receiving multicast
traffic from other multicast groups, which might have traffic on the same
port.

The extension of the IP_MULTICAST_ALL socketoption to just apply to ipv6,
too, is not done to avoid changing the behaviour of current applications.

Signed-off-by: Andre Naujoks <nautsch2@gmail.com>
Acked-By: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
---
 include/linux/ipv6.h     |  3 ++-
 include/uapi/linux/in6.h |  1 +
 net/ipv6/af_inet6.c      |  1 +
 net/ipv6/ipv6_sockglue.c | 11 +++++++++++
 net/ipv6/mcast.c         |  2 +-
 5 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 8415bf1a9776..495e834c1367 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -274,7 +274,8 @@ struct ipv6_pinfo {
 						 */
 				dontfrag:1,
 				autoflowlabel:1,
-				autoflowlabel_set:1;
+				autoflowlabel_set:1,
+				mc_all:1;
 	__u8			min_hopcount;
 	__u8			tclass;
 	__be32			rcv_flowinfo;
diff --git a/include/uapi/linux/in6.h b/include/uapi/linux/in6.h
index ed291e55f024..71d82fe15b03 100644
--- a/include/uapi/linux/in6.h
+++ b/include/uapi/linux/in6.h
@@ -177,6 +177,7 @@ struct in6_flowlabel_req {
 #define IPV6_V6ONLY		26
 #define IPV6_JOIN_ANYCAST	27
 #define IPV6_LEAVE_ANYCAST	28
+#define IPV6_MULTICAST_ALL	29
 
 /* IPV6_MTU_DISCOVER values */
 #define IPV6_PMTUDISC_DONT		0
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 9a4261e50272..77ef8478234f 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -209,6 +209,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
 	np->hop_limit	= -1;
 	np->mcast_hops	= IPV6_DEFAULT_MCASTHOPS;
 	np->mc_loop	= 1;
+	np->mc_all	= 1;
 	np->pmtudisc	= IPV6_PMTUDISC_WANT;
 	np->repflow	= net->ipv6.sysctl.flowlabel_reflect;
 	sk->sk_ipv6only	= net->ipv6.sysctl.bindv6only;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index c0cac9cc3a28..381ce38940ae 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -674,6 +674,13 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 			retv = ipv6_sock_ac_drop(sk, mreq.ipv6mr_ifindex, &mreq.ipv6mr_acaddr);
 		break;
 	}
+	case IPV6_MULTICAST_ALL:
+		if (optlen < sizeof(int))
+			goto e_inval;
+		np->mc_all = valbool;
+		retv = 0;
+		break;
+
 	case MCAST_JOIN_GROUP:
 	case MCAST_LEAVE_GROUP:
 	{
@@ -1266,6 +1273,10 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 		val = np->mcast_oif;
 		break;
 
+	case IPV6_MULTICAST_ALL:
+		val = np->mc_all;
+		break;
+
 	case IPV6_UNICAST_IF:
 		val = (__force int)htonl((__u32) np->ucast_oif);
 		break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4ae54aaca373..6895e1dc0b03 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -636,7 +636,7 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
 	}
 	if (!mc) {
 		rcu_read_unlock();
-		return true;
+		return np->mc_all;
 	}
 	read_lock(&mc->sflock);
 	psl = mc->sflist;
-- 
2.19.0.rc2

^ permalink raw reply related

* KASAN: use-after-free Read in bpf_prog_kallsyms_add
From: syzbot @ 2018-09-10  8:30 UTC (permalink / raw)
  To: ast, daniel, linux-kernel, netdev, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    f6f3bac08ff9 tools/bpf: bpftool: add net support
git tree:       bpf-next
console output: https://syzkaller.appspot.com/x/log.txt?x=151ff9b6400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8f59875069d721b6
dashboard link: https://syzkaller.appspot.com/bug?extid=ac0311cfc9e80cd2e0e8
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ac0311cfc9e80cd2e0e8@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __list_add_valid+0x8f/0xb0 lib/list_debug.c:26
Read of size 8 at addr ffff8801b843a220 by task syz-executor2/19913

CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
  print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
  kasan_report_error mm/kasan/report.c:354 [inline]
  kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
  __list_add_valid+0x8f/0xb0 lib/list_debug.c:26
  __list_add_rcu include/linux/rculist.h:52 [inline]
  list_add_tail_rcu include/linux/rculist.h:101 [inline]
  bpf_prog_ksym_node_add kernel/bpf/core.c:457 [inline]
  bpf_prog_kallsyms_add+0x200/0x9b0 kernel/bpf/core.c:488
  bpf_prog_load+0x13d1/0x1cb0 kernel/bpf/syscall.c:1442
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041f598 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041f710 R08: ffff880197a4a600 R09: ffffed003b584732
R10: ffffed003b584732 R11: ffff8801dac23993 R12: 1ffff10034083ed5
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#2] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041ee38 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041efb0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083de9
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#3] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041e6d8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041e850 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083cfd
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#4] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041df78 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041e0f0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083c11
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#5] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041d818 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041d990 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083b25
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#6] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041d0b8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041d230 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083a39
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#7] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041c958 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041cad0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff1003408394d
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#8] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041c1f8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041c370 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083861
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#9] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041ba98 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041bc10 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083775
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#10] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041b338 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041b4b0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083689
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#11] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041abd8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041ad50 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff1003408359d
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#12] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041a478 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041a5f0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff100340834b1
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#13] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a0419d18 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0419e90 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff100340833c5
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Oops: 0000 [#14] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a04195b8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0419730 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff100340832d9
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#15] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a0418e58 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0418fd0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff100340831ed
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#16] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a04186f8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0418870 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083101
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#17] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a0417f98 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0418110 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034083015
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#18] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a0417838 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a04179b0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034082f29
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#19] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a04170d8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0417250 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034082e3d
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
BUG: unable to handle kernel paging request at ffffc90001935030
PGD 1da948067 P4D 1da948067 PUD 1da949067 PMD 1d45bd067 PTE 0
Thread overran stack, or stack corrupted
Oops: 0000 [#20] PREEMPT SMP KASAN
CPU: 0 PID: 19913 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #93
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a0416978 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a0416af0 R08: ffff880197a4a600 R09: 0000000000000001
R10: ffffed003b584732 R11: 0000000000000000 R12: 1ffff10034082d51
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
Modules linked in:
Dumping ftrace buffer:
---------------------------------
CPU:0 [LOST 7646 EVENTS]
syz-exec-16687   0...1 217412324us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412329us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412334us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412339us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412344us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412349us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412354us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412359us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412364us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412369us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412374us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412379us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412384us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412389us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412394us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412399us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412404us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412409us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412414us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412419us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412424us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412429us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412434us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412439us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412445us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412449us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412454us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412459us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412463us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412469us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412473us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412479us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412484us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412489us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412507us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412513us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412518us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412523us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412528us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412532us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412538us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412543us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412548us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412553us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412558us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412563us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412568us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412573us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412578us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412583us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412588us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412593us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412598us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412603us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412609us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412614us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412619us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412624us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412629us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412635us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412640us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412645us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412650us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412655us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412660us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412665us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412670us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412676us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412681us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412686us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412691us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412696us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412701us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412706us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412711us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412716us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412722us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412727us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412732us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412737us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412742us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412748us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412761us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412767us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412772us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412777us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412782us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412788us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412793us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412798us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412802us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412807us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412812us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412817us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412822us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412826us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412832us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412837us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412842us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412846us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412851us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412856us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412863us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412868us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412873us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412878us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412883us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412888us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412893us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412898us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412903us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412908us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412913us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412918us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412924us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412929us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412934us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412939us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412944us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412949us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412954us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412959us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412965us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412970us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412975us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412980us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412985us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412990us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217412995us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217413000us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217413006us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217413011us : 0: u000000000958b6c8	
syz-exec-16687   0.N.1 217413051us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415442us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415448us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415453us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415457us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415462us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415466us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415470us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415474us : 0: u000000000958b6c8	
syz-exec-16687   0...1 217415479us : 0: u000000000958b6c8	
syz-exec-16687   0.N.1 217415630us : 0: u000000000958b6c8	
---------------------------------
CR2: ffffc90001935030
---[ end trace 4908ab663d8e7ff1 ]---
RIP: 0010:bpf_prog_ebpf_jited include/linux/filter.h:898 [inline]
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:381 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:435 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x289/0x4a0 kernel/bpf/core.c:509
Code: 03 42 80 3c 30 00 0f 85 b1 01 00 00 4d 8b 6f 50 49 8d 7d 30 48 89 fa  
48 c1 ea 03 42 80 3c 32 00 0f 85 ab 01 00 00 49 8d 7d 02 <4d> 8b 65 30 48  
89 fa 48 89 f9 48 c1 ea 03 83 e1 07 42 0f b6 14 32
RSP: 0018:ffff8801a041f598 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8801b843a1f0 RCX: ffffffff818b41d1
RDX: 1ffff92000326a06 RSI: 0000000000000008 RDI: ffffc90001935002
RBP: ffff8801a041f710 R08: ffff880197a4a600 R09: ffffed003b584732
R10: ffffed003b584732 R11: ffff8801dac23993 R12: 1ffff10034083ed5
R13: ffffc90001935000 R14: dffffc0000000000 R15: ffff8801b843a1f0
FS:  00007f1716646700(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90001935030 CR3: 00000001cd5b5000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.

^ permalink raw reply

* KASAN: use-after-free Read in psock_map_pop
From: syzbot @ 2018-09-10  8:31 UTC (permalink / raw)
  To: ast, daniel, linux-kernel, netdev, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    28619527b8a7 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree:       bpf
console output: https://syzkaller.appspot.com/x/log.txt?x=1442c149400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8f59875069d721b6
dashboard link: https://syzkaller.appspot.com/bug?extid=5bbe234204453085d43e
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17fb118e400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=169f48be400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+5bbe234204453085d43e@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x37c2/0x4ec0  
kernel/locking/lockdep.c:3291
Read of size 8 at addr ffff8801be270b88 by task syz-executor843/16792

CPU: 0 PID: 16792 Comm: syz-executor843 Not tainted 4.19.0-rc2+ #51
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
  print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
  kasan_report_error mm/kasan/report.c:354 [inline]
  kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
  __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
  __lock_acquire+0x37c2/0x4ec0 kernel/locking/lockdep.c:3291
  lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3901
  __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
  _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
  spin_lock_bh include/linux/spinlock.h:334 [inline]
  psock_map_pop.isra.22+0x93/0x3b0 kernel/bpf/sockmap.c:298
  bpf_tcp_close+0x6ca/0x10c0 kernel/bpf/sockmap.c:380
  inet_release+0x104/0x1f0 net/ipv4/af_inet.c:428
  inet6_release+0x50/0x70 net/ipv6/af_inet6.c:457
  __sock_release+0xd7/0x250 net/socket.c:579
  sock_close+0x19/0x20 net/socket.c:1139
  __fput+0x385/0xa30 fs/file_table.c:278
  ____fput+0x15/0x20 fs/file_table.c:309
  task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
  tracehook_notify_resume include/linux/tracehook.h:193 [inline]
  exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
  prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
  do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4063c1
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48  
83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48  
89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007ffdfa87cf10 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000004063c1
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 0000000000000003
RBP: 00000000006ddc30 R08: 00000000006ddc30 R09: 0000000000406c00
R10: 00007ffdfa87cf30 R11: 0000000000000293 R12: 00000000006ddc3c
R13: 00000000000003e8 R14: 0000000000000004 R15: 000000000000002d

Allocated by task 16796:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
  kmem_cache_alloc_node_trace+0x14c/0x740 mm/slab.c:3663
  kmalloc_node include/linux/slab.h:551 [inline]
  kzalloc_node include/linux/slab.h:718 [inline]
  smap_init_psock kernel/bpf/sockmap.c:1614 [inline]
  __sock_map_ctx_update_elem.isra.23+0x7a9/0x12f0 kernel/bpf/sockmap.c:1918
  sock_map_ctx_update_elem.isra.24+0x1a3/0xbe0 kernel/bpf/sockmap.c:1983
  sock_map_update_elem+0x22a/0x5a0 kernel/bpf/sockmap.c:2109
  map_update_elem+0x753/0xd50 kernel/bpf/syscall.c:799
  __do_sys_bpf kernel/bpf/syscall.c:2363 [inline]
  __se_sys_bpf kernel/bpf/syscall.c:2334 [inline]
  __x64_sys_bpf+0x32d/0x510 kernel/bpf/syscall.c:2334
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 14:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
  kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
  __cache_free mm/slab.c:3498 [inline]
  kfree+0xcf/0x230 mm/slab.c:3813
  smap_gc_work+0x910/0xc70 kernel/bpf/sockmap.c:1607
  process_one_work+0xc90/0x1b90 kernel/workqueue.c:2153
  worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
  kthread+0x35a/0x420 kernel/kthread.c:246
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413

The buggy address belongs to the object at ffff8801be270940
  which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 584 bytes inside of
  1024-byte region [ffff8801be270940, ffff8801be270d40)
The buggy address belongs to the page:
page:ffffea0006f89c00 count:1 mapcount:0 mapping:ffff8801da800ac0 index:0x0  
compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea0006fa1408 ffffea0006f8ea08 ffff8801da800ac0
raw: 0000000000000000 ffff8801be270040 0000000100000007 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801be270a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801be270b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801be270b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff8801be270c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801be270c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply

* KASAN: use-after-free Read in sock_i_uid
From: syzbot @ 2018-09-10  8:36 UTC (permalink / raw)
  To: davem, jon.maloy, linux-kernel, netdev, syzkaller-bugs,
	tipc-discussion, ying.xue

Hello,

syzbot found the following crash on:

HEAD commit:    3d0e7a9e00fd Merge tag 'md/4.19-rc2' of git://git.kernel.o..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1261e98e400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8f59875069d721b6
dashboard link: https://syzkaller.appspot.com/bug?extid=b239ac9b3c007f9cef90
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+b239ac9b3c007f9cef90@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: use-after-free in sock_i_uid+0x9c/0xb0 net/core/sock.c:1910
Read of size 4 at addr ffff8801c4333a34 by task syz-executor2/10612

CPU: 1 PID: 10612 Comm: syz-executor2 Not tainted 4.19.0-rc2+ #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
  print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
  kasan_report_error mm/kasan/report.c:354 [inline]
  kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
  __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
  sock_i_uid+0x9c/0xb0 net/core/sock.c:1910
  tipc_sk_fill_sock_diag+0x3f7/0xd90 net/tipc/socket.c:3317
  __tipc_add_sock_diag+0x233/0x360 net/tipc/diag.c:62
  tipc_nl_sk_walk+0x122/0x1d0 net/tipc/socket.c:3250
  tipc_diag_dump+0x24/0x30 net/tipc/diag.c:73
  netlink_dump+0x519/0xd50 net/netlink/af_netlink.c:2233
  __netlink_dump_start+0x4f1/0x6f0 net/netlink/af_netlink.c:2329
  netlink_dump_start include/linux/netlink.h:213 [inline]
  tipc_sock_diag_handler_dump+0x28e/0x3d0 net/tipc/diag.c:91
  __sock_diag_cmd net/core/sock_diag.c:232 [inline]
  sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263
  netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2454
  sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274
  netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
  netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1343
  netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1908
  sock_sendmsg_nosec net/socket.c:621 [inline]
  sock_sendmsg+0xd5/0x120 net/socket.c:631
  ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114
  __sys_sendmsg+0x11d/0x280 net/socket.c:2152
  __do_sys_sendmsg net/socket.c:2161 [inline]
  __se_sys_sendmsg net/socket.c:2159 [inline]
  __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457099
Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f5a612d4c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f5a612d56d4 RCX: 0000000000457099
RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000006
RBP: 0000000000930140 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004d4bc0 R14: 00000000004c910b R15: 0000000000000001

Allocated by task 10609:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
  kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
  kmem_cache_alloc+0x12e/0x730 mm/slab.c:3554
  sock_alloc_inode+0x1d/0x260 net/socket.c:244
  alloc_inode+0x63/0x190 fs/inode.c:210
  new_inode_pseudo+0x71/0x1a0 fs/inode.c:903
  sock_alloc+0x41/0x270 net/socket.c:547
  __sock_create+0x175/0x930 net/socket.c:1239
  sock_create net/socket.c:1315 [inline]
  __sys_socket+0x106/0x260 net/socket.c:1345
  __do_sys_socket net/socket.c:1354 [inline]
  __se_sys_socket net/socket.c:1352 [inline]
  __x64_sys_socket+0x73/0xb0 net/socket.c:1352
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 10609:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
  kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
  __cache_free mm/slab.c:3498 [inline]
  kmem_cache_free+0x83/0x290 mm/slab.c:3756
  sock_destroy_inode+0x51/0x60 net/socket.c:272
  destroy_inode+0x159/0x200 fs/inode.c:267
  evict+0x5e0/0x980 fs/inode.c:575
  iput_final fs/inode.c:1547 [inline]
  iput+0x679/0xa90 fs/inode.c:1573
  dentry_unlink_inode+0x461/0x5e0 fs/dcache.c:374
  __dentry_kill+0x44c/0x7a0 fs/dcache.c:566
  dentry_kill+0xc9/0x5a0 fs/dcache.c:685
  dput.part.26+0x660/0x790 fs/dcache.c:846
  dput+0x15/0x20 fs/dcache.c:828
  __fput+0x4cf/0xa30 fs/file_table.c:291
  ____fput+0x15/0x20 fs/file_table.c:309
  task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
  get_signal+0x155e/0x1980 kernel/signal.c:2343
  do_signal+0x9c/0x21e0 arch/x86/kernel/signal.c:816
  exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
  prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
  syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
  do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8801c4333a00
  which belongs to the cache sock_inode_cache of size 984
The buggy address is located 52 bytes inside of
  984-byte region [ffff8801c4333a00, ffff8801c4333dd8)
The buggy address belongs to the page:
page:ffffea000710ccc0 count:1 mapcount:0 mapping:ffff8801d9489b40  
index:0xffff8801c4333ffd
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea000726fac8 ffffea00074f1b88 ffff8801d9489b40
raw: ffff8801c4333ffd ffff8801c4333100 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801c4333900: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
  ffff8801c4333980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff8801c4333a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                      ^
  ffff8801c4333a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801c4333b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.

^ permalink raw reply

* Reply For More Info
From: Mr Fridman Mikhail @ 2018-09-10  0:13 UTC (permalink / raw)
  To: Recipients

I have a donation for you and for my charity work in your region. Please reply me ASAp for more info 

^ permalink raw reply

* Re: [PATCH 3/4] of: Convert to using %pOFn instead of device_node.name
From: Thierry Reding @ 2018-09-10  9:06 UTC (permalink / raw)
  To: Joe Perches
  Cc: Rob Herring, Frank Rowand, devicetree, linux-kernel, Andrew Lunn,
	Florian Fainelli, netdev
In-Reply-To: <0999919005219fa94ccc69ff57659d47911d3abd.camel@perches.com>

[-- Attachment #1: Type: text/plain, Size: 3223 bytes --]

On Fri, Sep 07, 2018 at 05:30:23PM -0700, Joe Perches wrote:
> On Fri, 2018-09-07 at 14:29 +0200, Thierry Reding wrote:
> > On Tue, Aug 28, 2018 at 10:52:53AM -0500, Rob Herring wrote:
> > > In preparation to remove the node name pointer from struct device_node,
> > > convert printf users to use the %pOFn format specifier.
> > > 
> > > Cc: Frank Rowand <frowand.list@gmail.com>
> > > Cc: Andrew Lunn <andrew@lunn.ch>
> > > Cc: Florian Fainelli <f.fainelli@gmail.com>
> > > Cc: devicetree@vger.kernel.org
> > > Cc: netdev@vger.kernel.org
> > > Signed-off-by: Rob Herring <robh@kernel.org>
> > > ---
> > >  drivers/of/device.c   |  4 ++--
> > >  drivers/of/of_mdio.c  | 12 ++++++------
> > >  drivers/of/of_numa.c  |  4 ++--
> > >  drivers/of/overlay.c  |  4 ++--
> > >  drivers/of/platform.c |  8 ++++----
> > >  drivers/of/unittest.c | 12 ++++++------
> > >  6 files changed, 22 insertions(+), 22 deletions(-)
> > > 
> > > diff --git a/drivers/of/device.c b/drivers/of/device.c
> > > index 5957cd4fa262..daa075d87317 100644
> > > --- a/drivers/of/device.c
> > > +++ b/drivers/of/device.c
> > > @@ -219,7 +219,7 @@ static ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len
> > >  		return -ENODEV;
> > >  
> > >  	/* Name & Type */
> > > -	csize = snprintf(str, len, "of:N%sT%s", dev->of_node->name,
> > > +	csize = snprintf(str, len, "of:N%pOFnT%s", dev->of_node,
> > >  			 dev->of_node->type);
> > >  	tsize = csize;
> > >  	len -= csize;
> > 
> > This seems to cause the modalias to be improperly constructed. As a
> > consequence, automatic module loading at boot time is now broken. I
> > think the reason why this fails is because vsnprintf() will skip all
> > alpha-numeric characters after a call to pointer(). Presumably this
> > is meant to be a generic way of skipping whatever specifiers we throw
> > at it.
> > 
> > Unfortunately for the case of OF modaliases, this means that the 'T'
> > character gets eaten, so we end up with something like this:
> > 
> > 	# udevadm info /sys/bus/platform/devices/54200000.dc
> > 	[...]
> > 	E: MODALIAS=of:Ndc<NULL>Cnvidia,tegra124-dc
> > 	[...]
> > 
> > instead of this:
> > 
> > 	# udevadm info /sys/bus/platform/devices/54200000.dc
> > 	[...]
> > 	E: MODALIAS=of:NdcT<NULL>Cnvidia,tegra124-dc
> > 	[...]
> > 
> > Everything is back to normal if I revert this patch. However, since
> > that's obviously not what we want, I think perhaps what we need is a
> > way for pointer() (and its implementations) to report back how many
> > characters in the format string it consumed so that we can support
> > these kinds of back-to-back strings.
> > 
> > If nobody else has the time I can look into coding up a fix, but in the
> > meantime it might be best to back this one out until we can handle the
> > OF modalias format string.
> 
> Or just use 2 consecutive snprintf calls
> 
> 	csize = snprintf(str, len, "of:N%pOFn", dev->of_node);
> 	csize += snprintf(str + csize, len - csize, "T%s",
> 			  dev->of_node->type);

Yeah, that's what I ended up doing. Rob came up with another alternative
which is to output the 'T' via %c, which also works around the issue.

Thierry

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox