[RESEND PATCH v6 2/8] mfd: retu: Drop -mfd suffix from I2C device ID name

[Javier Martinez Canillas]

It's not correct to encode the subsystem in the I2C device name, so
drop the -mfd suffix. To maintain bisect-ability, change driver and
platform code / DTS users in the same patch.

Suggested-by: Lee Jones 
Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Aaro Koskinen 
Acked-by: Tony Lindgren 
Reviewed-by: Wolfram Sang 

---

Changes in v6:
- Add Wolfram Sang's Reviewed-by tag.

Changes in v5:
- Add Rob Herring's Acked-by tag.
- Add Aaro Koskinen's Acked-by tag.
- Add Tony Lindgren's Acked-by tag.

Changes in v4: None
Changes in v3: None
Changes in v2: None

 arch/arm/boot/dts/omap2420-n8x0-common.dtsi | 4 ++--
 arch/arm/mach-omap1/board-nokia770.c| 4 ++--
 drivers/mfd/retu-mfd.c  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/arm/boot/dts/omap2420-n8x0-common.dtsi 
b/arch/arm/boot/dts/omap2420-n8x0-common.dtsi
index 7e5ffc583c90..1b06430c8013 100644
--- a/arch/arm/boot/dts/omap2420-n8x0-common.dtsi
+++ b/arch/arm/boot/dts/omap2420-n8x0-common.dtsi
@@ -15,8 +15,8 @@
>;
#address-cells = <1>;
#size-cells = <0>;
-   retu_mfd: retu@1 {
-   compatible = "retu-mfd";
+   retu: retu@1 {
+   compatible = "retu";
interrupt-parent = <>;
interrupts = <12 IRQ_TYPE_EDGE_RISING>;
reg = <0x1>;
diff --git a/arch/arm/mach-omap1/board-nokia770.c 
b/arch/arm/mach-omap1/board-nokia770.c
index ee8d9f553db4..06243c0b12d2 100644
--- a/arch/arm/mach-omap1/board-nokia770.c
+++ b/arch/arm/mach-omap1/board-nokia770.c
@@ -233,10 +233,10 @@ static struct platform_device nokia770_cbus_device = {
 
 static struct i2c_board_info nokia770_i2c_board_info_2[] __initdata = {
{
-   I2C_BOARD_INFO("retu-mfd", 0x01),
+   I2C_BOARD_INFO("retu", 0x01),
},
{
-   I2C_BOARD_INFO("tahvo-mfd", 0x02),
+   I2C_BOARD_INFO("tahvo", 0x02),
},
 };
 
diff --git a/drivers/mfd/retu-mfd.c b/drivers/mfd/retu-mfd.c
index d4c114abeb75..53e1d386d2c0 100644
--- a/drivers/mfd/retu-mfd.c
+++ b/drivers/mfd/retu-mfd.c
@@ -302,8 +302,8 @@ static int retu_remove(struct i2c_client *i2c)
 }
 
 static const struct i2c_device_id retu_id[] = {
-   { "retu-mfd", 0 },
-   { "tahvo-mfd", 0 },
+   { "retu", 0 },
+   { "tahvo", 0 },
{ }
 };
 MODULE_DEVICE_TABLE(i2c, retu_id);
-- 
2.9.3

[RESEND PATCH v6 7/8] mfd: tps6105x: Add OF device ID table

[Javier Martinez Canillas]

The driver doesn't have a struct of_device_id table but supported devices
are registered via Device Trees. This is working on the assumption that a
I2C device registered via OF will always match a legacy I2C device ID and
that the MODALIAS reported will always be of the form i2c:.

But this could change in the future so the correct approach is to have a
OF device ID table if the devices are registered via OF.

Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Tony Lindgren 
Acked-by: Lee Jones 

---

Changes in v6: None
Changes in v5:
- Add Rob Herring's Acked-by tag.
- Add Acked-by: Tony Lindgren 's Acked-by tag.
- Add Lee Jones 's Acked-by tag.

Changes in v4: None
Changes in v3:
- Add a vendor prefix to the compatible string (Rob Herring).

Changes in v2:
- Don't use of_match_ptr() to avoid build warning when CONFIG_OF is disabled.

 drivers/mfd/tps6105x.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/drivers/mfd/tps6105x.c b/drivers/mfd/tps6105x.c
index baa12ea666fb..187848c93779 100644
--- a/drivers/mfd/tps6105x.c
+++ b/drivers/mfd/tps6105x.c
@@ -173,9 +173,17 @@ static const struct i2c_device_id tps6105x_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, tps6105x_id);
 
+static const struct of_device_id tps6105x_of_match[] = {
+   { .compatible = "ti,tps61050" },
+   { .compatible = "ti,tps61052" },
+   { },
+};
+MODULE_DEVICE_TABLE(of, tps6105x_of_match);
+
 static struct i2c_driver tps6105x_driver = {
.driver = {
.name   = "tps6105x",
+   .of_match_table = tps6105x_of_match,
},
.probe  = tps6105x_probe,
.remove = tps6105x_remove,
-- 
2.9.3

[RESEND PATCH v6 2/8] mfd: retu: Drop -mfd suffix from I2C device ID name

[Javier Martinez Canillas]

It's not correct to encode the subsystem in the I2C device name, so
drop the -mfd suffix. To maintain bisect-ability, change driver and
platform code / DTS users in the same patch.

Suggested-by: Lee Jones 
Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Aaro Koskinen 
Acked-by: Tony Lindgren 
Reviewed-by: Wolfram Sang 

---

Changes in v6:
- Add Wolfram Sang's Reviewed-by tag.

Changes in v5:
- Add Rob Herring's Acked-by tag.
- Add Aaro Koskinen's Acked-by tag.
- Add Tony Lindgren's Acked-by tag.

Changes in v4: None
Changes in v3: None
Changes in v2: None

 arch/arm/boot/dts/omap2420-n8x0-common.dtsi | 4 ++--
 arch/arm/mach-omap1/board-nokia770.c| 4 ++--
 drivers/mfd/retu-mfd.c  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/arm/boot/dts/omap2420-n8x0-common.dtsi 
b/arch/arm/boot/dts/omap2420-n8x0-common.dtsi
index 7e5ffc583c90..1b06430c8013 100644
--- a/arch/arm/boot/dts/omap2420-n8x0-common.dtsi
+++ b/arch/arm/boot/dts/omap2420-n8x0-common.dtsi
@@ -15,8 +15,8 @@
>;
#address-cells = <1>;
#size-cells = <0>;
-   retu_mfd: retu@1 {
-   compatible = "retu-mfd";
+   retu: retu@1 {
+   compatible = "retu";
interrupt-parent = <>;
interrupts = <12 IRQ_TYPE_EDGE_RISING>;
reg = <0x1>;
diff --git a/arch/arm/mach-omap1/board-nokia770.c 
b/arch/arm/mach-omap1/board-nokia770.c
index ee8d9f553db4..06243c0b12d2 100644
--- a/arch/arm/mach-omap1/board-nokia770.c
+++ b/arch/arm/mach-omap1/board-nokia770.c
@@ -233,10 +233,10 @@ static struct platform_device nokia770_cbus_device = {
 
 static struct i2c_board_info nokia770_i2c_board_info_2[] __initdata = {
{
-   I2C_BOARD_INFO("retu-mfd", 0x01),
+   I2C_BOARD_INFO("retu", 0x01),
},
{
-   I2C_BOARD_INFO("tahvo-mfd", 0x02),
+   I2C_BOARD_INFO("tahvo", 0x02),
},
 };
 
diff --git a/drivers/mfd/retu-mfd.c b/drivers/mfd/retu-mfd.c
index d4c114abeb75..53e1d386d2c0 100644
--- a/drivers/mfd/retu-mfd.c
+++ b/drivers/mfd/retu-mfd.c
@@ -302,8 +302,8 @@ static int retu_remove(struct i2c_client *i2c)
 }
 
 static const struct i2c_device_id retu_id[] = {
-   { "retu-mfd", 0 },
-   { "tahvo-mfd", 0 },
+   { "retu", 0 },
+   { "tahvo", 0 },
{ }
 };
 MODULE_DEVICE_TABLE(i2c, retu_id);
-- 
2.9.3

[RESEND PATCH v6 7/8] mfd: tps6105x: Add OF device ID table

[Javier Martinez Canillas]

The driver doesn't have a struct of_device_id table but supported devices
are registered via Device Trees. This is working on the assumption that a
I2C device registered via OF will always match a legacy I2C device ID and
that the MODALIAS reported will always be of the form i2c:.

But this could change in the future so the correct approach is to have a
OF device ID table if the devices are registered via OF.

Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Tony Lindgren 
Acked-by: Lee Jones 

---

Changes in v6: None
Changes in v5:
- Add Rob Herring's Acked-by tag.
- Add Acked-by: Tony Lindgren 's Acked-by tag.
- Add Lee Jones 's Acked-by tag.

Changes in v4: None
Changes in v3:
- Add a vendor prefix to the compatible string (Rob Herring).

Changes in v2:
- Don't use of_match_ptr() to avoid build warning when CONFIG_OF is disabled.

 drivers/mfd/tps6105x.c | 8 
 1 file changed, 8 insertions(+)

diff --git a/drivers/mfd/tps6105x.c b/drivers/mfd/tps6105x.c
index baa12ea666fb..187848c93779 100644
--- a/drivers/mfd/tps6105x.c
+++ b/drivers/mfd/tps6105x.c
@@ -173,9 +173,17 @@ static const struct i2c_device_id tps6105x_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, tps6105x_id);
 
+static const struct of_device_id tps6105x_of_match[] = {
+   { .compatible = "ti,tps61050" },
+   { .compatible = "ti,tps61052" },
+   { },
+};
+MODULE_DEVICE_TABLE(of, tps6105x_of_match);
+
 static struct i2c_driver tps6105x_driver = {
.driver = {
.name   = "tps6105x",
+   .of_match_table = tps6105x_of_match,
},
.probe  = tps6105x_probe,
.remove = tps6105x_remove,
-- 
2.9.3

[RESEND PATCH v6 1/8] dt-bindings: mfd: Add retu/tahvo ASIC chips bindings

[Javier Martinez Canillas]

There are Device Tree source files defining a device node for the
retu/tahvo I2C chip, but there isn't a DT binding document for it.

Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Aaro Koskinen 
Acked-by: Tony Lindgren 
Acked-by: Lee Jones 

---

Changes in v6:
- Mention CBUS address instead of I2C since that's the bus used (Wolfram Sang).
- Add a "i2c-cbus-gpio" comptible and use cbus0 for parent node (Wolfram Sang).

Changes in v5:
- Add missing properties for interrupts to DT binding doc (Rob Herring).
- Add Rob Herring's Acked-by tag.
- Add Aaro Koskinen's Acked-by tag.
- Add Acked-by: Tony Lindgren 's Acked-by tag.
- Add Lee Jones 's Acked-by tag.

Changes in v4:
- Use "dt-bindings: mfd:" prefix in subject line (Rob Herring).
- Add information about what functions the device serve (Lee Jones).
- Avoid using MFD in Device Tree (Lee Jones).

Changes in v3: None
Changes in v2: None

 Documentation/devicetree/bindings/mfd/retu.txt | 25 +
 1 file changed, 25 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/mfd/retu.txt

diff --git a/Documentation/devicetree/bindings/mfd/retu.txt 
b/Documentation/devicetree/bindings/mfd/retu.txt
new file mode 100644
index ..876242394a16
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/retu.txt
@@ -0,0 +1,25 @@
+* Device tree bindings for Nokia Retu and Tahvo multi-function device
+
+Retu and Tahvo are a multi-function devices found on Nokia Internet
+Tablets (770, N800 and N810). The Retu chip provides watchdog timer
+and power button control functionalities while Tahvo chip provides
+USB transceiver functionality.
+
+Required properties:
+- compatible:  "nokia,retu" or "nokia,tahvo"
+- reg: Specifies the CBUS slave address of the ASIC chip
+- interrupts:  The interrupt line the device is connected to
+- interrupt-parent:The parent interrupt controller
+
+Example:
+
+cbus0 {
+   compatible = "i2c-cbus-gpio";
+   ...
+   retu: retu@1 {
+   compatible = "nokia,retu";
+   interrupt-parent = <>;
+   interrupts = <12 IRQ_TYPE_EDGE_RISING>;
+   reg = <0x1>;
+   };
+};
-- 
2.9.3

[RESEND PATCH v6 6/8] dt-bindings: mfd: Add TI tps6105x chip bindings

[Javier Martinez Canillas]

There are Device Tree source files defining a device node for the
tps61050/61052 I2C chip but there isn't a binding document for it.

Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Tony Lindgren 

---

Changes in v6: None
Changes in v5:
- Add Rob Herring's Acked-by tag.
- Add Acked-by: Tony Lindgren 's Acked-by tag.

Changes in v4:
- Use "dt-bindings: mfd:" prefix in subject line (Rob Herring).
- Add information about what functions the device serve (Lee Jones).

Changes in v3: None
Changes in v2: None

 Documentation/devicetree/bindings/mfd/tps6105x.txt | 17 +
 1 file changed, 17 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/mfd/tps6105x.txt

diff --git a/Documentation/devicetree/bindings/mfd/tps6105x.txt 
b/Documentation/devicetree/bindings/mfd/tps6105x.txt
new file mode 100644
index ..93602c7a19c8
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/tps6105x.txt
@@ -0,0 +1,17 @@
+* Device tree bindings for TI TPS61050/61052 Boost Converters
+
+The TP61050/TPS61052 is a high-power "white LED driver". The
+device provides LED, GPIO and regulator functionalities.
+
+Required properties:
+- compatible:  "ti,tps61050" or "ti,tps61052"
+- reg: Specifies the I2C slave address
+
+Example:
+
+i2c0 {
+   tps61052@33 {
+   compatible = "ti,tps61052";
+   reg = <0x33>;
+   };
+};
-- 
2.9.3

[RESEND PATCH v6 1/8] dt-bindings: mfd: Add retu/tahvo ASIC chips bindings

[Javier Martinez Canillas]

There are Device Tree source files defining a device node for the
retu/tahvo I2C chip, but there isn't a DT binding document for it.

Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Aaro Koskinen 
Acked-by: Tony Lindgren 
Acked-by: Lee Jones 

---

Changes in v6:
- Mention CBUS address instead of I2C since that's the bus used (Wolfram Sang).
- Add a "i2c-cbus-gpio" comptible and use cbus0 for parent node (Wolfram Sang).

Changes in v5:
- Add missing properties for interrupts to DT binding doc (Rob Herring).
- Add Rob Herring's Acked-by tag.
- Add Aaro Koskinen's Acked-by tag.
- Add Acked-by: Tony Lindgren 's Acked-by tag.
- Add Lee Jones 's Acked-by tag.

Changes in v4:
- Use "dt-bindings: mfd:" prefix in subject line (Rob Herring).
- Add information about what functions the device serve (Lee Jones).
- Avoid using MFD in Device Tree (Lee Jones).

Changes in v3: None
Changes in v2: None

 Documentation/devicetree/bindings/mfd/retu.txt | 25 +
 1 file changed, 25 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/mfd/retu.txt

diff --git a/Documentation/devicetree/bindings/mfd/retu.txt 
b/Documentation/devicetree/bindings/mfd/retu.txt
new file mode 100644
index ..876242394a16
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/retu.txt
@@ -0,0 +1,25 @@
+* Device tree bindings for Nokia Retu and Tahvo multi-function device
+
+Retu and Tahvo are a multi-function devices found on Nokia Internet
+Tablets (770, N800 and N810). The Retu chip provides watchdog timer
+and power button control functionalities while Tahvo chip provides
+USB transceiver functionality.
+
+Required properties:
+- compatible:  "nokia,retu" or "nokia,tahvo"
+- reg: Specifies the CBUS slave address of the ASIC chip
+- interrupts:  The interrupt line the device is connected to
+- interrupt-parent:The parent interrupt controller
+
+Example:
+
+cbus0 {
+   compatible = "i2c-cbus-gpio";
+   ...
+   retu: retu@1 {
+   compatible = "nokia,retu";
+   interrupt-parent = <>;
+   interrupts = <12 IRQ_TYPE_EDGE_RISING>;
+   reg = <0x1>;
+   };
+};
-- 
2.9.3

[RESEND PATCH v6 6/8] dt-bindings: mfd: Add TI tps6105x chip bindings

[Javier Martinez Canillas]

There are Device Tree source files defining a device node for the
tps61050/61052 I2C chip but there isn't a binding document for it.

Signed-off-by: Javier Martinez Canillas 
Acked-by: Rob Herring 
Acked-by: Tony Lindgren 

---

Changes in v6: None
Changes in v5:
- Add Rob Herring's Acked-by tag.
- Add Acked-by: Tony Lindgren 's Acked-by tag.

Changes in v4:
- Use "dt-bindings: mfd:" prefix in subject line (Rob Herring).
- Add information about what functions the device serve (Lee Jones).

Changes in v3: None
Changes in v2: None

 Documentation/devicetree/bindings/mfd/tps6105x.txt | 17 +
 1 file changed, 17 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/mfd/tps6105x.txt

diff --git a/Documentation/devicetree/bindings/mfd/tps6105x.txt 
b/Documentation/devicetree/bindings/mfd/tps6105x.txt
new file mode 100644
index ..93602c7a19c8
--- /dev/null
+++ b/Documentation/devicetree/bindings/mfd/tps6105x.txt
@@ -0,0 +1,17 @@
+* Device tree bindings for TI TPS61050/61052 Boost Converters
+
+The TP61050/TPS61052 is a high-power "white LED driver". The
+device provides LED, GPIO and regulator functionalities.
+
+Required properties:
+- compatible:  "ti,tps61050" or "ti,tps61052"
+- reg: Specifies the I2C slave address
+
+Example:
+
+i2c0 {
+   tps61052@33 {
+   compatible = "ti,tps61052";
+   reg = <0x33>;
+   };
+};
-- 
2.9.3

[RFC v2 1/2] swait: add idle variants which don't contribute to load average

[Luis R. Rodriguez]

There are cases where folks are using an interruptible swait when
using kthreads. This is rather confusing given you'd expect
interruptible waits to be -- interruptible, but kthreads are not
interruptible ! The reason for such practice though is to avoid
having these kthreads contribute to the system load average.

When systems are idle some kthreads may spend a lot of time blocking if
using swait_event_timeout(). This would contribute to the system load
average. On systems without preemption this would mean the load average
of an idle system is bumped to 2 instead of 0. On systems with PREEMPT=y
this would mean the load average of an idle system is bumped to 3
instead of 0.

This adds proper API using TASK_IDLE to make such goals explicit and
avoid confusion.

Suggested-by: "Eric W. Biederman" 
Signed-off-by: Luis R. Rodriguez 
---
 include/linux/swait.h | 25 +
 1 file changed, 25 insertions(+)

diff --git a/include/linux/swait.h b/include/linux/swait.h
index 2c700694d50a..105c70e23286 100644
--- a/include/linux/swait.h
+++ b/include/linux/swait.h
@@ -194,4 +194,29 @@ do {   
\
__ret;  \
 })
 
+#define __swait_event_idle(wq, condition)  \
+   ___swait_event(wq, condition, TASK_IDLE, 0, schedule())
+
+#define swait_event_idle(wq, condition)
\
+({ \
+   int __ret = 0;  \
+   if (!(condition))   \
+   __ret = __swait_event_idle(wq, condition);  \
+   __ret;  \
+})
+
+#define __swait_event_idle_timeout(wq, condition, timeout) \
+   ___swait_event(wq, ___wait_cond_timeout(condition), \
+  TASK_IDLE, timeout,  \
+  __ret = schedule_timeout(__ret))
+
+#define swait_event_idle_timeout(wq, condition, timeout)   \
+({ \
+   long __ret = timeout;   \
+   if (!___wait_cond_timeout(condition))   \
+   __ret = __swait_event_idle_timeout(wq,  \
+  condition, timeout); \
+   __ret;  \
+})
+
 #endif /* _LINUX_SWAIT_H */
-- 
2.11.0

[RFC v2 1/2] swait: add idle variants which don't contribute to load average

[Luis R. Rodriguez]

There are cases where folks are using an interruptible swait when
using kthreads. This is rather confusing given you'd expect
interruptible waits to be -- interruptible, but kthreads are not
interruptible ! The reason for such practice though is to avoid
having these kthreads contribute to the system load average.

When systems are idle some kthreads may spend a lot of time blocking if
using swait_event_timeout(). This would contribute to the system load
average. On systems without preemption this would mean the load average
of an idle system is bumped to 2 instead of 0. On systems with PREEMPT=y
this would mean the load average of an idle system is bumped to 3
instead of 0.

This adds proper API using TASK_IDLE to make such goals explicit and
avoid confusion.

Suggested-by: "Eric W. Biederman" 
Signed-off-by: Luis R. Rodriguez 
---
 include/linux/swait.h | 25 +
 1 file changed, 25 insertions(+)

diff --git a/include/linux/swait.h b/include/linux/swait.h
index 2c700694d50a..105c70e23286 100644
--- a/include/linux/swait.h
+++ b/include/linux/swait.h
@@ -194,4 +194,29 @@ do {   
\
__ret;  \
 })
 
+#define __swait_event_idle(wq, condition)  \
+   ___swait_event(wq, condition, TASK_IDLE, 0, schedule())
+
+#define swait_event_idle(wq, condition)
\
+({ \
+   int __ret = 0;  \
+   if (!(condition))   \
+   __ret = __swait_event_idle(wq, condition);  \
+   __ret;  \
+})
+
+#define __swait_event_idle_timeout(wq, condition, timeout) \
+   ___swait_event(wq, ___wait_cond_timeout(condition), \
+  TASK_IDLE, timeout,  \
+  __ret = schedule_timeout(__ret))
+
+#define swait_event_idle_timeout(wq, condition, timeout)   \
+({ \
+   long __ret = timeout;   \
+   if (!___wait_cond_timeout(condition))   \
+   __ret = __swait_event_idle_timeout(wq,  \
+  condition, timeout); \
+   __ret;  \
+})
+
 #endif /* _LINUX_SWAIT_H */
-- 
2.11.0

Re: [PATCH 4/4] i2c: rcar: check for DMA-capable buffers

[Shuah Khan]

On Thu, Jun 15, 2017 at 12:30 PM, Wolfram Sang
 wrote:
> Handling this is special for this driver. Because the hardware needs to
> initialize the next message in interrupt context, we cannot use the
> i2c_check_msg_for_dma() directly. This helper only works reliably in
> process context. So, we need to check during initial preparation of the
> whole transfer and need to disable DMA completely for the whole transfer
> once a message with a not-DMA-capable buffer is found.
>
> Signed-off-by: Wolfram Sang 
> Signed-off-by: Wolfram Sang 
> ---
>  drivers/i2c/busses/i2c-rcar.c | 18 +-
>  1 file changed, 13 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
> index 8be3e6cb8fe686..2b679ba4b75066 100644
> --- a/drivers/i2c/busses/i2c-rcar.c
> +++ b/drivers/i2c/busses/i2c-rcar.c
> @@ -111,8 +111,11 @@
>  #define ID_ARBLOST (1 << 3)
>  #define ID_NACK(1 << 4)
>  /* persistent flags */
> +#define ID_P_NODMA (1 << 30)
>  #define ID_P_PM_BLOCKED(1 << 31)
> -#define ID_P_MASK  ID_P_PM_BLOCKED
> +#define ID_P_MASK  (ID_P_PM_BLOCKED | ID_P_NODMA)
> +
> +#define RCAR_DMA_THRESHOLD 8
>
>  enum rcar_i2c_type {
> I2C_RCAR_GEN1,
> @@ -358,8 +361,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
> unsigned char *buf;
> int len;
>
> -   /* Do not use DMA if it's not available or for messages < 8 bytes */
> -   if (IS_ERR(chan) || msg->len < 8)
> +   if (IS_ERR(chan) || msg->len < RCAR_DMA_THRESHOLD || priv->flags & 
> ID_P_NODMA)

Might be more efficient to check for ID_P_NODMA first instead of msg->len.

> return;
>
> if (read) {
> @@ -657,11 +659,15 @@ static void rcar_i2c_request_dma(struct rcar_i2c_priv 
> *priv,
>  struct i2c_msg *msg)
>  {
> struct device *dev = rcar_i2c_priv_to_dev(priv);
> -   bool read;
> +   bool read = msg->flags & I2C_M_RD;
> struct dma_chan *chan;
> enum dma_transfer_direction dir;
>
> -   read = msg->flags & I2C_M_RD;
> +   /* we need to check here because we need the 'current' context */
> +   if (i2c_check_msg_for_dma(msg, RCAR_DMA_THRESHOLD, NULL) == -EFAULT) {
> +   dev_dbg(dev, "skipping DMA for this whole transfer\n");

Adding reason for skipping will be helpful.

> +   priv->flags |= ID_P_NODMA;
> +   }
>
> chan = read ? priv->dma_rx : priv->dma_tx;
> if (PTR_ERR(chan) != -EPROBE_DEFER)
> @@ -740,6 +746,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
> if (ret < 0 && ret != -ENXIO)
> dev_err(dev, "error %d : %x\n", ret, priv->flags);
>
> +   priv->flags &= ~ID_P_NODMA;
> +
> return ret;
>  }
>
> --
> 2.11.0
>

thanks,
-- Shuah

Re: [PATCH 4/4] i2c: rcar: check for DMA-capable buffers

[Shuah Khan]

On Thu, Jun 15, 2017 at 12:30 PM, Wolfram Sang
 wrote:
> Handling this is special for this driver. Because the hardware needs to
> initialize the next message in interrupt context, we cannot use the
> i2c_check_msg_for_dma() directly. This helper only works reliably in
> process context. So, we need to check during initial preparation of the
> whole transfer and need to disable DMA completely for the whole transfer
> once a message with a not-DMA-capable buffer is found.
>
> Signed-off-by: Wolfram Sang 
> Signed-off-by: Wolfram Sang 
> ---
>  drivers/i2c/busses/i2c-rcar.c | 18 +-
>  1 file changed, 13 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
> index 8be3e6cb8fe686..2b679ba4b75066 100644
> --- a/drivers/i2c/busses/i2c-rcar.c
> +++ b/drivers/i2c/busses/i2c-rcar.c
> @@ -111,8 +111,11 @@
>  #define ID_ARBLOST (1 << 3)
>  #define ID_NACK(1 << 4)
>  /* persistent flags */
> +#define ID_P_NODMA (1 << 30)
>  #define ID_P_PM_BLOCKED(1 << 31)
> -#define ID_P_MASK  ID_P_PM_BLOCKED
> +#define ID_P_MASK  (ID_P_PM_BLOCKED | ID_P_NODMA)
> +
> +#define RCAR_DMA_THRESHOLD 8
>
>  enum rcar_i2c_type {
> I2C_RCAR_GEN1,
> @@ -358,8 +361,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
> unsigned char *buf;
> int len;
>
> -   /* Do not use DMA if it's not available or for messages < 8 bytes */
> -   if (IS_ERR(chan) || msg->len < 8)
> +   if (IS_ERR(chan) || msg->len < RCAR_DMA_THRESHOLD || priv->flags & 
> ID_P_NODMA)

Might be more efficient to check for ID_P_NODMA first instead of msg->len.

> return;
>
> if (read) {
> @@ -657,11 +659,15 @@ static void rcar_i2c_request_dma(struct rcar_i2c_priv 
> *priv,
>  struct i2c_msg *msg)
>  {
> struct device *dev = rcar_i2c_priv_to_dev(priv);
> -   bool read;
> +   bool read = msg->flags & I2C_M_RD;
> struct dma_chan *chan;
> enum dma_transfer_direction dir;
>
> -   read = msg->flags & I2C_M_RD;
> +   /* we need to check here because we need the 'current' context */
> +   if (i2c_check_msg_for_dma(msg, RCAR_DMA_THRESHOLD, NULL) == -EFAULT) {
> +   dev_dbg(dev, "skipping DMA for this whole transfer\n");

Adding reason for skipping will be helpful.

> +   priv->flags |= ID_P_NODMA;
> +   }
>
> chan = read ? priv->dma_rx : priv->dma_tx;
> if (PTR_ERR(chan) != -EPROBE_DEFER)
> @@ -740,6 +746,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
> if (ret < 0 && ret != -ENXIO)
> dev_err(dev, "error %d : %x\n", ret, priv->flags);
>
> +   priv->flags &= ~ID_P_NODMA;
> +
> return ret;
>  }
>
> --
> 2.11.0
>

thanks,
-- Shuah

[RFC v2 2/2] rcu: use idle versions of swait to make idle-hack clear

[Luis R. Rodriguez]

These RCU waits were set to use interruptible waits to avoid the kthreads
contributing to system load average, even though they are not interruptible
as they are spawned from a kthread. Use the new TASK_IDLE swaits which makes
it clear our goal, and removes confusion about these paths possibly being
interruptible -- they are not.

When the system is idle the RCU grace-period kthread will spend all its time
blocked inside the swait_event_interruptible(). If the interruptible() was
not used, then this kthread would contribute to the load average. This means
that an idle system would have a load average of 2 (or 3 if PREEMPT=y),
rather than the load average of 0 that almost fifty years of UNIX has
conditioned sysadms to expect.

The same argument applies to swait_event_interruptible_timeout() use. The
RCU grace-period kthread spends its time blocked inside this call while
waiting for grace periods to complete. In particular, if there was only one
busy CPU, but that CPU was frequently invoking call_rcu(), then the RCU
grace-period kthread would spend almost all its time blocked inside the
swait_event_interruptible_timeout(). This would mean that the load average
would be 2 rather than the expected 1 for the single busy CPU.

Signed-off-by: Luis R. Rodriguez 
---
 kernel/rcu/tree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 695fee7cafe0..1de8e55636c0 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2191,7 +2191,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
   READ_ONCE(rsp->gpnum),
   TPS("reqwait"));
rsp->gp_state = RCU_GP_WAIT_GPS;
-   swait_event_interruptible(rsp->gp_wq,
+   swait_event_idle(rsp->gp_wq,
 READ_ONCE(rsp->gp_flags) &
 RCU_GP_FLAG_INIT);
rsp->gp_state = RCU_GP_DONE_GPS;
@@ -2224,7 +2224,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
   READ_ONCE(rsp->gpnum),
   TPS("fqswait"));
rsp->gp_state = RCU_GP_WAIT_FQS;
-   ret = swait_event_interruptible_timeout(rsp->gp_wq,
+   ret = swait_event_idle_timeout(rsp->gp_wq,
rcu_gp_fqs_check_wake(rsp, ), j);
rsp->gp_state = RCU_GP_DOING_FQS;
/* Locking provides needed memory barriers. */
-- 
2.11.0

[RFC v2 0/2] swait: add idle to make idle-hacks on kthreads explicit

[Luis R. Rodriguez]

While reviewing RCU's interruptible swaits I noticed signals were actually
not expected. Paul explained that the reason signals are not expected is
we use kthreads, which don't get signals, furthermore the code avoided the
uninterruptible swaits as otherwise it would contribute to the system load
average on idle, bumping it from 0 to 2 or 3 (depending on preemption).

Since this can be confusing its best to be explicit about the requirements and
goals. This patch depends on the other killable swaits [0] recently proposed as
well interms of context. Thee patch can however be tested independently if
the hunk is addressed separately.

[0] https://lkml.kernel.org/r/20170614222017.14653-3-mcg...@kernel.org

Luis R. Rodriguez (2):
  swait: add idle variants which don't contribute to load average
  rcu: use idle versions of swait to make idle-hack clear

 include/linux/swait.h | 25 +
 kernel/rcu/tree.c |  4 ++--
 2 files changed, 27 insertions(+), 2 deletions(-)

-- 
2.11.0

[RFC v2 2/2] rcu: use idle versions of swait to make idle-hack clear

[Luis R. Rodriguez]

These RCU waits were set to use interruptible waits to avoid the kthreads
contributing to system load average, even though they are not interruptible
as they are spawned from a kthread. Use the new TASK_IDLE swaits which makes
it clear our goal, and removes confusion about these paths possibly being
interruptible -- they are not.

When the system is idle the RCU grace-period kthread will spend all its time
blocked inside the swait_event_interruptible(). If the interruptible() was
not used, then this kthread would contribute to the load average. This means
that an idle system would have a load average of 2 (or 3 if PREEMPT=y),
rather than the load average of 0 that almost fifty years of UNIX has
conditioned sysadms to expect.

The same argument applies to swait_event_interruptible_timeout() use. The
RCU grace-period kthread spends its time blocked inside this call while
waiting for grace periods to complete. In particular, if there was only one
busy CPU, but that CPU was frequently invoking call_rcu(), then the RCU
grace-period kthread would spend almost all its time blocked inside the
swait_event_interruptible_timeout(). This would mean that the load average
would be 2 rather than the expected 1 for the single busy CPU.

Signed-off-by: Luis R. Rodriguez 
---
 kernel/rcu/tree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 695fee7cafe0..1de8e55636c0 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2191,7 +2191,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
   READ_ONCE(rsp->gpnum),
   TPS("reqwait"));
rsp->gp_state = RCU_GP_WAIT_GPS;
-   swait_event_interruptible(rsp->gp_wq,
+   swait_event_idle(rsp->gp_wq,
 READ_ONCE(rsp->gp_flags) &
 RCU_GP_FLAG_INIT);
rsp->gp_state = RCU_GP_DONE_GPS;
@@ -2224,7 +2224,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
   READ_ONCE(rsp->gpnum),
   TPS("fqswait"));
rsp->gp_state = RCU_GP_WAIT_FQS;
-   ret = swait_event_interruptible_timeout(rsp->gp_wq,
+   ret = swait_event_idle_timeout(rsp->gp_wq,
rcu_gp_fqs_check_wake(rsp, ), j);
rsp->gp_state = RCU_GP_DOING_FQS;
/* Locking provides needed memory barriers. */
-- 
2.11.0

[RFC v2 0/2] swait: add idle to make idle-hacks on kthreads explicit

[Luis R. Rodriguez]

While reviewing RCU's interruptible swaits I noticed signals were actually
not expected. Paul explained that the reason signals are not expected is
we use kthreads, which don't get signals, furthermore the code avoided the
uninterruptible swaits as otherwise it would contribute to the system load
average on idle, bumping it from 0 to 2 or 3 (depending on preemption).

Since this can be confusing its best to be explicit about the requirements and
goals. This patch depends on the other killable swaits [0] recently proposed as
well interms of context. Thee patch can however be tested independently if
the hunk is addressed separately.

[0] https://lkml.kernel.org/r/20170614222017.14653-3-mcg...@kernel.org

Luis R. Rodriguez (2):
  swait: add idle variants which don't contribute to load average
  rcu: use idle versions of swait to make idle-hack clear

 include/linux/swait.h | 25 +
 kernel/rcu/tree.c |  4 ++--
 2 files changed, 27 insertions(+), 2 deletions(-)

-- 
2.11.0

Re: [PATCH] Doc: net: dsa: b53: update location of referenced dsa.txt

[David Miller]

Please re-post this with the netdev mailing list CC:'d, thank you.

Re: [PATCH] Doc: net: dsa: b53: update location of referenced dsa.txt

[David Miller]

Please re-post this with the netdev mailing list CC:'d, thank you.

Re: [PATCH 3/4] watchdog: Split up config options

[Don Zickus]

On Fri, Jun 16, 2017 at 01:59:00AM +1000, Nicholas Piggin wrote:
> On Thu, 15 Jun 2017 11:51:22 -0400
> Don Zickus  wrote:
> 
> > On Thu, Jun 15, 2017 at 01:04:01PM +1000, Nicholas Piggin wrote:
> > > > +#ifdef CONFIG_HARDLOCKUP_DETECTOR
> > > >   /* boot commands */
> > > >   /*
> > > >* Should we panic when a soft-lockup or hard-lockup occurs:
> > > > @@ -69,9 +73,6 @@ static int __init hardlockup_panic_setup(char *str)
> > > >  return 1;
> > > >   }
> > > >   __setup("nmi_watchdog=", hardlockup_panic_setup);
> > > > -
> > > > -#else
> > > > -unsigned long __read_mostly watchdog_enabled = SOFT_WATCHDOG_ENABLED;
> > > >   #endif
> > > > 
> > > >   #ifdef CONFIG_SOFTLOCKUP_DETECTOR  
> > > 
> > > Hmm, I guess I missed this because sparc parses nmi_watchdog=, but it
> > > also relies on the watchdog_enabled value.
> > > 
> > > I guess I can fold your incremental patch in. I hope we could get
> > > sparc quickly to adopt the complate HAVE_HARDLOCKUP_DETECTOR_ARCH soon
> > > afterwards though, so we only have 2 cases -- complete hardlockup
> > > detector, or the very bare minimum NMI_WATCHDOG.  
> > 
> > Hi Nick,
> > 
> > I agree.  Let's move forward with this temp fix just to get things in the
> > kernel for initial testing.  Then follow up with a cleanup patch.  The idea
> > is we can always revert the cleanup patch if things still don't quite work.
> > 
> > Thoughts?
> 
> Hi Don,
> 
> Yeah that sounds good to me. Would you like me to re-test things
> and resend the series?

Yes, please.  Thanks!

Cheers,
Don

Re: [PATCH 3/4] watchdog: Split up config options

[Don Zickus]

On Fri, Jun 16, 2017 at 01:59:00AM +1000, Nicholas Piggin wrote:
> On Thu, 15 Jun 2017 11:51:22 -0400
> Don Zickus  wrote:
> 
> > On Thu, Jun 15, 2017 at 01:04:01PM +1000, Nicholas Piggin wrote:
> > > > +#ifdef CONFIG_HARDLOCKUP_DETECTOR
> > > >   /* boot commands */
> > > >   /*
> > > >* Should we panic when a soft-lockup or hard-lockup occurs:
> > > > @@ -69,9 +73,6 @@ static int __init hardlockup_panic_setup(char *str)
> > > >  return 1;
> > > >   }
> > > >   __setup("nmi_watchdog=", hardlockup_panic_setup);
> > > > -
> > > > -#else
> > > > -unsigned long __read_mostly watchdog_enabled = SOFT_WATCHDOG_ENABLED;
> > > >   #endif
> > > > 
> > > >   #ifdef CONFIG_SOFTLOCKUP_DETECTOR  
> > > 
> > > Hmm, I guess I missed this because sparc parses nmi_watchdog=, but it
> > > also relies on the watchdog_enabled value.
> > > 
> > > I guess I can fold your incremental patch in. I hope we could get
> > > sparc quickly to adopt the complate HAVE_HARDLOCKUP_DETECTOR_ARCH soon
> > > afterwards though, so we only have 2 cases -- complete hardlockup
> > > detector, or the very bare minimum NMI_WATCHDOG.  
> > 
> > Hi Nick,
> > 
> > I agree.  Let's move forward with this temp fix just to get things in the
> > kernel for initial testing.  Then follow up with a cleanup patch.  The idea
> > is we can always revert the cleanup patch if things still don't quite work.
> > 
> > Thoughts?
> 
> Hi Don,
> 
> Yeah that sounds good to me. Would you like me to re-test things
> and resend the series?

Yes, please.  Thanks!

Cheers,
Don

Re: [PATCH 0/4] i2c: document DMA handling and add helpers for it

[Wolfram Sang]

On Thu, Jun 15, 2017 at 08:30:35PM +0200, Wolfram Sang wrote:
> So, after revisiting old mail threads and taking part in a similar discussion
> on the USB list, here is what I cooked up to document and ease DMA handling 
> for
> I2C within Linux. Please have a look at the documentation introduced in patch 
> 2
> for further details.
> 
> The branch can be found here:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git 
> renesas/topic/i2c-core-dma
> 
> And big kudos to Renesas Electronics for funding this work, thank you very 
> much!

I forgot to write that those patches have been tested with a Renesas Salvator-X
board (r8a7796/M3-W) and a Renesas Lager board (r8a7790/H2). A more
detailed test description can be found here:

http://elinux.org/Tests:I2C-core-DMA

And sorry for the doubled Signed-offs below the patches. My mistake
here, there should be only the ones from sang-engineering.com.



signature.asc
Description: PGP signature

Re: [PATCH 0/4] i2c: document DMA handling and add helpers for it

[Wolfram Sang]

On Thu, Jun 15, 2017 at 08:30:35PM +0200, Wolfram Sang wrote:
> So, after revisiting old mail threads and taking part in a similar discussion
> on the USB list, here is what I cooked up to document and ease DMA handling 
> for
> I2C within Linux. Please have a look at the documentation introduced in patch 
> 2
> for further details.
> 
> The branch can be found here:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git 
> renesas/topic/i2c-core-dma
> 
> And big kudos to Renesas Electronics for funding this work, thank you very 
> much!

I forgot to write that those patches have been tested with a Renesas Salvator-X
board (r8a7796/M3-W) and a Renesas Lager board (r8a7790/H2). A more
detailed test description can be found here:

http://elinux.org/Tests:I2C-core-DMA

And sorry for the doubled Signed-offs below the patches. My mistake
here, there should be only the ones from sang-engineering.com.



signature.asc
Description: PGP signature

Re: [PATCH] sparc/time: make of_device_ids const

[David Miller]

From: Arvind Yadav 
Date: Thu, 15 Jun 2017 16:30:20 +0530

> of_device_ids are not supposed to change at runtime. All functions
> working with of_device_ids provided by  work with const
> of_device_ids. So mark the non-const structs as const.
> 
> Signed-off-by: Arvind Yadav 

Applied.

Re: [PATCH] sparc/time: make of_device_ids const

[David Miller]

From: Arvind Yadav 
Date: Thu, 15 Jun 2017 16:30:20 +0530

> of_device_ids are not supposed to change at runtime. All functions
> working with of_device_ids provided by  work with const
> of_device_ids. So mark the non-const structs as const.
> 
> Signed-off-by: Arvind Yadav 

Applied.

[PATCH 4.4 05/46] Call echo service immediately after socket reconnect

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Sachin Prabhu 

commit b8c600120fc87d53642476f48c8055b38d6e14c7 upstream.

Commit 4fcd1813e640 ("Fix reconnect to not defer smb3 session reconnect
long after socket reconnect") changes the behaviour of the SMB2 echo
service and causes it to renegotiate after a socket reconnect. However
under default settings, the echo service could take up to 120 seconds to
be scheduled.

The patch forces the echo service to be called immediately resulting a
negotiate call being made immediately on reconnect.

Signed-off-by: Sachin Prabhu 
Reviewed-by: Pavel Shilovsky 
Signed-off-by: Steve French 
Acked-by: Sachin Prabhu 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/cifs/connect.c |   24 ++--
 1 file changed, 18 insertions(+), 6 deletions(-)

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -412,6 +412,9 @@ cifs_reconnect(struct TCP_Server_Info *s
}
} while (server->tcpStatus == CifsNeedReconnect);
 
+   if (server->tcpStatus == CifsNeedNegotiate)
+   mod_delayed_work(cifsiod_wq, >echo, 0);
+
return rc;
 }
 
@@ -421,18 +424,27 @@ cifs_echo_request(struct work_struct *wo
int rc;
struct TCP_Server_Info *server = container_of(work,
struct TCP_Server_Info, echo.work);
+   unsigned long echo_interval;
+
+   /*
+* If we need to renegotiate, set echo interval to zero to
+* immediately call echo service where we can renegotiate.
+*/
+   if (server->tcpStatus == CifsNeedNegotiate)
+   echo_interval = 0;
+   else
+   echo_interval = SMB_ECHO_INTERVAL;
 
/*
-* We cannot send an echo if it is disabled or until the
-* NEGOTIATE_PROTOCOL request is done, which is indicated by
-* server->ops->need_neg() == true. Also, no need to ping if
-* we got a response recently.
+* We cannot send an echo if it is disabled.
+* Also, no need to ping if we got a response recently.
 */
 
if (server->tcpStatus == CifsNeedReconnect ||
-   server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
+   server->tcpStatus == CifsExiting ||
+   server->tcpStatus == CifsNew ||
(server->ops->can_echo && !server->ops->can_echo(server)) ||
-   time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
+   time_before(jiffies, server->lstrp + echo_interval - HZ))
goto requeue_echo;
 
rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS;

[PATCH 4.4 05/46] Call echo service immediately after socket reconnect

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Sachin Prabhu 

commit b8c600120fc87d53642476f48c8055b38d6e14c7 upstream.

Commit 4fcd1813e640 ("Fix reconnect to not defer smb3 session reconnect
long after socket reconnect") changes the behaviour of the SMB2 echo
service and causes it to renegotiate after a socket reconnect. However
under default settings, the echo service could take up to 120 seconds to
be scheduled.

The patch forces the echo service to be called immediately resulting a
negotiate call being made immediately on reconnect.

Signed-off-by: Sachin Prabhu 
Reviewed-by: Pavel Shilovsky 
Signed-off-by: Steve French 
Acked-by: Sachin Prabhu 
Signed-off-by: Pavel Shilovsky 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/cifs/connect.c |   24 ++--
 1 file changed, 18 insertions(+), 6 deletions(-)

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -412,6 +412,9 @@ cifs_reconnect(struct TCP_Server_Info *s
}
} while (server->tcpStatus == CifsNeedReconnect);
 
+   if (server->tcpStatus == CifsNeedNegotiate)
+   mod_delayed_work(cifsiod_wq, >echo, 0);
+
return rc;
 }
 
@@ -421,18 +424,27 @@ cifs_echo_request(struct work_struct *wo
int rc;
struct TCP_Server_Info *server = container_of(work,
struct TCP_Server_Info, echo.work);
+   unsigned long echo_interval;
+
+   /*
+* If we need to renegotiate, set echo interval to zero to
+* immediately call echo service where we can renegotiate.
+*/
+   if (server->tcpStatus == CifsNeedNegotiate)
+   echo_interval = 0;
+   else
+   echo_interval = SMB_ECHO_INTERVAL;
 
/*
-* We cannot send an echo if it is disabled or until the
-* NEGOTIATE_PROTOCOL request is done, which is indicated by
-* server->ops->need_neg() == true. Also, no need to ping if
-* we got a response recently.
+* We cannot send an echo if it is disabled.
+* Also, no need to ping if we got a response recently.
 */
 
if (server->tcpStatus == CifsNeedReconnect ||
-   server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
+   server->tcpStatus == CifsExiting ||
+   server->tcpStatus == CifsNew ||
(server->ops->can_echo && !server->ops->can_echo(server)) ||
-   time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
+   time_before(jiffies, server->lstrp + echo_interval - HZ))
goto requeue_echo;
 
rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS;

[PATCH 4.4 01/46] s390/vmem: fix identity mapping

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Heiko Carstens 

commit c34a69059d7876e0793eb410deedfb08ccb22b02 upstream.

The identity mapping is suboptimal for the last 2GB frame. The mapping
will be established with a mix of 4KB and 1MB mappings instead of a
single 2GB mapping.

This happens because of a off-by-one bug introduced with
commit 50be63450728 ("s390/mm: Convert bootmem to memblock").

Currently the identity mapping looks like this:

0x8000-0x000180004G PUD RW
0x00018000-0x0001fff0 2047M PMD RW
0x0001fff0-0x00021M PTE RW

With the bug fixed it looks like this:

0x8000-0x00026G PUD RW

Fixes: 50be63450728 ("s390/mm: Convert bootmem to memblock")
Signed-off-by: Heiko Carstens 
Signed-off-by: Martin Schwidefsky 
Cc: Jean Delvare 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/s390/mm/vmem.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -372,7 +372,7 @@ void __init vmem_map_init(void)
ro_end = (unsigned long)&_eshared & PAGE_MASK;
for_each_memblock(memory, reg) {
start = reg->base;
-   end = reg->base + reg->size - 1;
+   end = reg->base + reg->size;
if (start >= ro_end || end <= ro_start)
vmem_add_mem(start, end - start, 0);
else if (start >= ro_start && end <= ro_end)

[PATCH 4.4 01/46] s390/vmem: fix identity mapping

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Heiko Carstens 

commit c34a69059d7876e0793eb410deedfb08ccb22b02 upstream.

The identity mapping is suboptimal for the last 2GB frame. The mapping
will be established with a mix of 4KB and 1MB mappings instead of a
single 2GB mapping.

This happens because of a off-by-one bug introduced with
commit 50be63450728 ("s390/mm: Convert bootmem to memblock").

Currently the identity mapping looks like this:

0x8000-0x000180004G PUD RW
0x00018000-0x0001fff0 2047M PMD RW
0x0001fff0-0x00021M PTE RW

With the bug fixed it looks like this:

0x8000-0x00026G PUD RW

Fixes: 50be63450728 ("s390/mm: Convert bootmem to memblock")
Signed-off-by: Heiko Carstens 
Signed-off-by: Martin Schwidefsky 
Cc: Jean Delvare 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/s390/mm/vmem.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -372,7 +372,7 @@ void __init vmem_map_init(void)
ro_end = (unsigned long)&_eshared & PAGE_MASK;
for_each_memblock(memory, reg) {
start = reg->base;
-   end = reg->base + reg->size - 1;
+   end = reg->base + reg->size;
if (start >= ro_end || end <= ro_start)
vmem_add_mem(start, end - start, 0);
else if (start >= ro_start && end <= ro_end)

[PATCH 4.4 03/46] ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Fabio Estevam 

commit 46350b71a09ccf3573649e03db55d4b61d5da231 upstream.

Table 8 from MX6DL datasheet (IMX6SDLCEC Rev. 5, 06/2015):
http://cache.nxp.com/files/32bit/doc/data_sheet/IMX6SDLCEC.pdf

states the following:

"LDO Output Set Point (VDD_ARM_CAP) = 1.125 V minimum for operation
up to 396 MHz."

So fix the entry by adding the 25mV margin value as done in the other
entries of the table, which results in 1.15V for 396MHz operation.

Signed-off-by: Fabio Estevam 
Signed-off-by: Shawn Guo 
Cc: Stephane Fillod 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/boot/dts/imx6dl.dtsi |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/imx6dl.dtsi
+++ b/arch/arm/boot/dts/imx6dl.dtsi
@@ -30,7 +30,7 @@
/* kHzuV */
996000  125
792000  1175000
-   396000  1075000
+   396000  115
>;
fsl,soc-operating-points = <
/* ARM kHz  SOC-PU uV */

[PATCH 4.4 03/46] ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Fabio Estevam 

commit 46350b71a09ccf3573649e03db55d4b61d5da231 upstream.

Table 8 from MX6DL datasheet (IMX6SDLCEC Rev. 5, 06/2015):
http://cache.nxp.com/files/32bit/doc/data_sheet/IMX6SDLCEC.pdf

states the following:

"LDO Output Set Point (VDD_ARM_CAP) = 1.125 V minimum for operation
up to 396 MHz."

So fix the entry by adding the 25mV margin value as done in the other
entries of the table, which results in 1.15V for 396MHz operation.

Signed-off-by: Fabio Estevam 
Signed-off-by: Shawn Guo 
Cc: Stephane Fillod 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/boot/dts/imx6dl.dtsi |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/imx6dl.dtsi
+++ b/arch/arm/boot/dts/imx6dl.dtsi
@@ -30,7 +30,7 @@
/* kHzuV */
996000  125
792000  1175000
-   396000  1075000
+   396000  115
>;
fsl,soc-operating-points = <
/* ARM kHz  SOC-PU uV */

[PATCH 4.4 00/46] 4.4.73-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 4.4.73 release.
There are 46 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Jun 17 17:51:59 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.73-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git 
linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 4.4.73-rc1

Dan Carpenter 
sparc64: make string buffers large enough

Christian Borntraeger 
s390/kvm: do not rely on the ILC on kvm host protection fauls

Max Filippov 
xtensa: don't use linux IRQ #0

Parthasarathy Bhuvaragan 
tipc: ignore requests when the connection state is not CONNECTED

Eric Dumazet 
proc: add a schedule point in proc_pid_readdir()

Coly Li 
romfs: use different way to generate fsid for BLOCK or MTD

Xin Long 
sctp: sctp_addr_id2transport should verify the addr before looking up assoc

hayeswang 
r8152: avoid start_xmit to schedule napi when napi is disabled

hayeswang 
r8152: fix rtl8152_post_reset function

hayeswang 
r8152: re-schedule napi for tx

Chuck Lever 
nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"

Kazuya Mizuguchi 
ravb: unmap descriptors when freeing rings

Y.C. Chen 
drm/ast: Fixed system hanged if disable P2A

Lyude Paul 
drm/nouveau: Don't enabling polling twice on runtime resume

Helge Deller 
parisc, parport_gsc: Fixes for printk continuation lines

Alexey Khoroshilov 
net: adaptec: starfire: add checks for dma mapping errors

Jisheng Zhang 
pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES

Arseny Solokha 
gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page

Jack Morgenstein 
net/mlx4_core: Avoid command timeouts during VF driver device shutdown

Ben Skeggs 
drm/nouveau/fence/g84-: protect against concurrent access to semaphore 
buffers

Ben Skeggs 
drm/nouveau: prevent userspace from deleting client object

Dimitris Michailidis 
ipv6: fix flow labels when the traffic class is non-0

David Howells 
FS-Cache: Initialise stores_lock in netfs cookie

David Howells 
fscache: Clear outstanding writes when disabling a cookie

David Howells 
fscache: Fix dead object requeue

Stanislaw Gruszka 
ethtool: do not vzalloc(0) on registers dump

Ard Biesheuvel 
log2: make order_base_2() behave correctly on const input value zero

Peter Zijlstra 
kasan: respect /proc/sys/kernel/traceoff_on_warning

David Lin 
jump label: pass kbuild_cflags when checking for asm goto support

Rafael J. Wysocki 
PM / runtime: Avoid false-positive warnings from might_sleep_if()

Linus Lüssing 
ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping 
switches

Ricardo Ribalda Delgado 
i2c: piix4: Fix request_region size

Stefan Brüns 
sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications

Stefan Brüns 
sierra_net: Skip validating irrelevant fields for IDLE LSIs

Kejian Yan 
net: hns: Fix the device being used for dma mapping during TX

Ralf Baechle 
NET: mkiss: Fix panic

Ralf Baechle 
NET: Fix /proc/net/arp for AX.25

Jonathan T. Leighton 
ipv6: Inhibit IPv4-mapped src address on the wire.

Jonathan T. Leighton 
ipv6: Handle IPv4-mapped src to in6addr_any dst.

Anssi Hannula 
net: xilinx_emaclite: fix receive buffer overflow

Anssi Hannula 
net: xilinx_emaclite: fix freezes due to unordered I/O

Sachin Prabhu 
Call echo service immediately after socket reconnect

Malcolm Priestley 
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped 

[PATCH 4.4 00/46] 4.4.73-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 4.4.73 release.
There are 46 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Jun 17 17:51:59 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.73-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git 
linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-
Pseudo-Shortlog of commits:

Greg Kroah-Hartman 
Linux 4.4.73-rc1

Dan Carpenter 
sparc64: make string buffers large enough

Christian Borntraeger 
s390/kvm: do not rely on the ILC on kvm host protection fauls

Max Filippov 
xtensa: don't use linux IRQ #0

Parthasarathy Bhuvaragan 
tipc: ignore requests when the connection state is not CONNECTED

Eric Dumazet 
proc: add a schedule point in proc_pid_readdir()

Coly Li 
romfs: use different way to generate fsid for BLOCK or MTD

Xin Long 
sctp: sctp_addr_id2transport should verify the addr before looking up assoc

hayeswang 
r8152: avoid start_xmit to schedule napi when napi is disabled

hayeswang 
r8152: fix rtl8152_post_reset function

hayeswang 
r8152: re-schedule napi for tx

Chuck Lever 
nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"

Kazuya Mizuguchi 
ravb: unmap descriptors when freeing rings

Y.C. Chen 
drm/ast: Fixed system hanged if disable P2A

Lyude Paul 
drm/nouveau: Don't enabling polling twice on runtime resume

Helge Deller 
parisc, parport_gsc: Fixes for printk continuation lines

Alexey Khoroshilov 
net: adaptec: starfire: add checks for dma mapping errors

Jisheng Zhang 
pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES

Arseny Solokha 
gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page

Jack Morgenstein 
net/mlx4_core: Avoid command timeouts during VF driver device shutdown

Ben Skeggs 
drm/nouveau/fence/g84-: protect against concurrent access to semaphore 
buffers

Ben Skeggs 
drm/nouveau: prevent userspace from deleting client object

Dimitris Michailidis 
ipv6: fix flow labels when the traffic class is non-0

David Howells 
FS-Cache: Initialise stores_lock in netfs cookie

David Howells 
fscache: Clear outstanding writes when disabling a cookie

David Howells 
fscache: Fix dead object requeue

Stanislaw Gruszka 
ethtool: do not vzalloc(0) on registers dump

Ard Biesheuvel 
log2: make order_base_2() behave correctly on const input value zero

Peter Zijlstra 
kasan: respect /proc/sys/kernel/traceoff_on_warning

David Lin 
jump label: pass kbuild_cflags when checking for asm goto support

Rafael J. Wysocki 
PM / runtime: Avoid false-positive warnings from might_sleep_if()

Linus Lüssing 
ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping 
switches

Ricardo Ribalda Delgado 
i2c: piix4: Fix request_region size

Stefan Brüns 
sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications

Stefan Brüns 
sierra_net: Skip validating irrelevant fields for IDLE LSIs

Kejian Yan 
net: hns: Fix the device being used for dma mapping during TX

Ralf Baechle 
NET: mkiss: Fix panic

Ralf Baechle 
NET: Fix /proc/net/arp for AX.25

Jonathan T. Leighton 
ipv6: Inhibit IPv4-mapped src address on the wire.

Jonathan T. Leighton 
ipv6: Handle IPv4-mapped src to in6addr_any dst.

Anssi Hannula 
net: xilinx_emaclite: fix receive buffer overflow

Anssi Hannula 
net: xilinx_emaclite: fix freezes due to unordered I/O

Sachin Prabhu 
Call echo service immediately after socket reconnect

Malcolm Priestley 
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

Fabio Estevam 
ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation

Richard 
partitions/msdos: FreeBSD UFS2 file systems are not recognized

Heiko Carstens 
s390/vmem: fix identity mapping


-

Diffstat:

 Makefile   |   6 +-
 arch/arm/boot/dts/imx6dl.dtsi  |   2 +-
 arch/s390/kernel/entry.S   |  19 ++-
 arch/s390/mm/vmem.c|   2 +-
 arch/sparc/kernel/traps_64.c   |   4 +-
 arch/xtensa/include/asm/irq.h  |   3 +-
 arch/xtensa/kernel/irq.c   |   5 -
 .../platforms/xtfpga/include/platform/hardware.h   |   6 +-
 arch/xtensa/platforms/xtfpga/setup.c   |  10 +-
 block/partitions/msdos.c   |   2 +
 drivers/base/power/runtime.c   |  11 +-
 drivers/gpu/drm/ast/ast_drv.h  |   1 +
 drivers/gpu/drm/ast/ast_main.c 

[PATCH 4.4 15/46] i2c: piix4: Fix request_region size

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ricardo Ribalda 


[ Upstream commit f43128c75202f29ee71aa83e6c320a911137c189 ]

Since '701dc207bf55 ("i2c: piix4: Avoid race conditions with IMC")' we
are using the SMBSLVCNT register at offset 0x8. We need to request it.

Fixes: 701dc207bf55 ("i2c: piix4: Avoid race conditions with IMC")
Signed-off-by: Ricardo Ribalda Delgado 
Signed-off-by: Jean Delvare 
Signed-off-by: Wolfram Sang 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/i2c/busses/i2c-piix4.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -54,7 +54,7 @@
 #define SMBSLVDAT  (0xC + piix4_smba)
 
 /* count for request_region */
-#define SMBIOSIZE  8
+#define SMBIOSIZE  9
 
 /* PCI Address Constants */
 #define SMBBA  0x090

[PATCH 2/2] perf coresight: Remove superfluous check before use

[Kim Phillips]

cs_etm_evsel is guaranteed to be set at this point in the function.

Signed-off-by: Kim Phillips 
---
 tools/perf/arch/arm/util/cs-etm.c | 25 -
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/tools/perf/arch/arm/util/cs-etm.c 
b/tools/perf/arch/arm/util/cs-etm.c
index 29361d9b635a..8e1e9469caf2 100644
--- a/tools/perf/arch/arm/util/cs-etm.c
+++ b/tools/perf/arch/arm/util/cs-etm.c
@@ -202,19 +202,18 @@ static int cs_etm_recording_options(struct 
auxtrace_record *itr,
pr_debug2("%s snapshot size: %zu\n", CORESIGHT_ETM_PMU_NAME,
  opts->auxtrace_snapshot_size);
 
-   if (cs_etm_evsel) {
-   /*
-* To obtain the auxtrace buffer file descriptor, the auxtrace
-* event must come first.
-*/
-   perf_evlist__to_front(evlist, cs_etm_evsel);
-   /*
-* In the case of per-cpu mmaps, we need the CPU on the
-* AUX event.
-*/
-   if (!cpu_map__empty(cpus))
-   perf_evsel__set_sample_bit(cs_etm_evsel, CPU);
-   }
+   /*
+* To obtain the auxtrace buffer file descriptor, the auxtrace
+* event must come first.
+*/
+   perf_evlist__to_front(evlist, cs_etm_evsel);
+
+   /*
+* In the case of per-cpu mmaps, we need the CPU on the
+* AUX event.
+*/
+   if (!cpu_map__empty(cpus))
+   perf_evsel__set_sample_bit(cs_etm_evsel, CPU);
 
/* Add dummy event to keep tracking */
if (opts->full_auxtrace) {
-- 
2.11.0

[PATCH 4.4 15/46] i2c: piix4: Fix request_region size

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ricardo Ribalda 


[ Upstream commit f43128c75202f29ee71aa83e6c320a911137c189 ]

Since '701dc207bf55 ("i2c: piix4: Avoid race conditions with IMC")' we
are using the SMBSLVCNT register at offset 0x8. We need to request it.

Fixes: 701dc207bf55 ("i2c: piix4: Avoid race conditions with IMC")
Signed-off-by: Ricardo Ribalda Delgado 
Signed-off-by: Jean Delvare 
Signed-off-by: Wolfram Sang 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/i2c/busses/i2c-piix4.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -54,7 +54,7 @@
 #define SMBSLVDAT  (0xC + piix4_smba)
 
 /* count for request_region */
-#define SMBIOSIZE  8
+#define SMBIOSIZE  9
 
 /* PCI Address Constants */
 #define SMBBA  0x090

[PATCH 2/2] perf coresight: Remove superfluous check before use

[Kim Phillips]

cs_etm_evsel is guaranteed to be set at this point in the function.

Signed-off-by: Kim Phillips 
---
 tools/perf/arch/arm/util/cs-etm.c | 25 -
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/tools/perf/arch/arm/util/cs-etm.c 
b/tools/perf/arch/arm/util/cs-etm.c
index 29361d9b635a..8e1e9469caf2 100644
--- a/tools/perf/arch/arm/util/cs-etm.c
+++ b/tools/perf/arch/arm/util/cs-etm.c
@@ -202,19 +202,18 @@ static int cs_etm_recording_options(struct 
auxtrace_record *itr,
pr_debug2("%s snapshot size: %zu\n", CORESIGHT_ETM_PMU_NAME,
  opts->auxtrace_snapshot_size);
 
-   if (cs_etm_evsel) {
-   /*
-* To obtain the auxtrace buffer file descriptor, the auxtrace
-* event must come first.
-*/
-   perf_evlist__to_front(evlist, cs_etm_evsel);
-   /*
-* In the case of per-cpu mmaps, we need the CPU on the
-* AUX event.
-*/
-   if (!cpu_map__empty(cpus))
-   perf_evsel__set_sample_bit(cs_etm_evsel, CPU);
-   }
+   /*
+* To obtain the auxtrace buffer file descriptor, the auxtrace
+* event must come first.
+*/
+   perf_evlist__to_front(evlist, cs_etm_evsel);
+
+   /*
+* In the case of per-cpu mmaps, we need the CPU on the
+* AUX event.
+*/
+   if (!cpu_map__empty(cpus))
+   perf_evsel__set_sample_bit(cs_etm_evsel, CPU);
 
/* Add dummy event to keep tracking */
if (opts->full_auxtrace) {
-- 
2.11.0

Re: [PATCH v7 10/26] x86/insn-eval: Add utility functions to get segment selector

[Ricardo Neri]

On Tue, 2017-05-30 at 12:35 +0200, Borislav Petkov wrote:
> On Fri, May 05, 2017 at 11:17:08AM -0700, Ricardo Neri wrote:
> > When computing a linear address and segmentation is used, we need to know
> > the base address of the segment involved in the computation. In most of
> > the cases, the segment base address will be zero as in USER_DS/USER32_DS.
> > However, it may be possible that a user space program defines its own
> > segments via a local descriptor table. In such a case, the segment base
> > address may not be zero .Thus, the segment base address is needed to
> > calculate correctly the linear address.
> > 
> > The segment selector to be used when computing a linear address is
> > determined by either any of segment override prefixes in the
> > instruction or inferred from the registers involved in the computation of
> > the effective address; in that order. Also, there are cases when the
> > overrides shall be ignored (code segments are always selected by the CS
> > segment register; string instructions always use the ES segment register
> > along with the EDI register).
> > 
> > For clarity, this process can be split into two steps: resolving the
> > relevant segment register to use and, once known, read its value to
> > obtain the segment selector.
> > 
> > The method to obtain the segment selector depends on several factors. In
> > 32-bit builds, segment selectors are saved into the pt_regs structure
> > when switching to kernel mode. The same is also true for virtual-8086
> > mode. In 64-bit builds, segmentation is mostly ignored, except when
> > running a program in 32-bit legacy mode. In this case, CS and SS can be
> > obtained from pt_regs. DS, ES, FS and GS can be read directly from
> > the respective segment registers.
> > 
> > Lastly, the only two segment registers that are not ignored in long mode
> > are FS and GS. In these two cases, base addresses are obtained from the
> > respective MSRs.
> > 
> > Cc: Dave Hansen 
> > Cc: Adam Buchbinder 
> > Cc: Colin Ian King 
> > Cc: Lorenzo Stoakes 
> > Cc: Qiaowei Ren 
> > Cc: Arnaldo Carvalho de Melo 
> > Cc: Masami Hiramatsu 
> > Cc: Adrian Hunter 
> > Cc: Kees Cook 
> > Cc: Thomas Garnier 
> > Cc: Peter Zijlstra 
> > Cc: Borislav Petkov 
> > Cc: Dmitry Vyukov 
> > Cc: Ravi V. Shankar 
> > Cc: x...@kernel.org
> > Signed-off-by: Ricardo Neri 
> > ---
> >  arch/x86/lib/insn-eval.c | 256 
> > +++
> >  1 file changed, 256 insertions(+)
> > 
> > diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
> > index 1634762..0a496f4 100644
> > --- a/arch/x86/lib/insn-eval.c
> > +++ b/arch/x86/lib/insn-eval.c
> > @@ -9,6 +9,7 @@
> >  #include 
> >  #include 
> >  #include 
> > +#include 
> >  
> >  enum reg_type {
> > REG_TYPE_RM = 0,
> > @@ -33,6 +34,17 @@ enum string_instruction {
> > SCASW_SCASD = 0xaf,
> >  };
> >  
> > +enum segment_register {
> > +   SEG_REG_INVAL = -1,
> > +   SEG_REG_IGNORE = 0,
> > +   SEG_REG_CS = 0x23,
> > +   SEG_REG_SS = 0x36,
> > +   SEG_REG_DS = 0x3e,
> > +   SEG_REG_ES = 0x26,
> > +   SEG_REG_FS = 0x64,
> > +   SEG_REG_GS = 0x65,
> > +};
> 
> Yuck, didn't we talk about this already?

I am sorry Borislav. I thought you agreed that I could use the values of
the segment override prefixes to identify the segment registers [1].
> 
> Those are segment override prefixes so call them as such.
> 
> #define SEG_OVR_PFX_CS0x23
> #define SEG_OVR_PFX_SS0x36
> ...
> 
> and we already have those!
> 
> arch/x86/include/asm/inat.h:
> ...
> #define INAT_PFX_CS 5   /* 0x2E */
> #define INAT_PFX_DS 6   /* 0x3E */
> #define INAT_PFX_ES 7   /* 0x26 */
> #define INAT_PFX_FS 8   /* 0x64 */
> #define INAT_PFX_GS 9   /* 0x65 */
> #define INAT_PFX_SS 10  /* 0x36 */
> 
> well, kinda, they're numbers there and not the actual prefix values.

These numbers can 'translated' to the actual value of the prefixes via
inat_get_opcode_attribute(). In my next version I am planning to use
these function and reuse the aforementioned definitions.

> 
> And then there's:
> 
> arch/x86/kernel/uprobes.c::is_prefix_bad() which looks at some of those.
> 
> Please add your defines to inat.h

Will do.

> and make that function is_prefix_bad()
> use them instead of naked numbers. We need to pay attention to all those
> different things needing to look at insn opcodes and not let them go
> unwieldy by each defining and duplicating stuff.

I have implemented this change and will be part of my next version.
> 
> >  /**
> >   * is_string_instruction - Determine if instruction is a string 

Re: [PATCH v7 10/26] x86/insn-eval: Add utility functions to get segment selector

[Ricardo Neri]

On Tue, 2017-05-30 at 12:35 +0200, Borislav Petkov wrote:
> On Fri, May 05, 2017 at 11:17:08AM -0700, Ricardo Neri wrote:
> > When computing a linear address and segmentation is used, we need to know
> > the base address of the segment involved in the computation. In most of
> > the cases, the segment base address will be zero as in USER_DS/USER32_DS.
> > However, it may be possible that a user space program defines its own
> > segments via a local descriptor table. In such a case, the segment base
> > address may not be zero .Thus, the segment base address is needed to
> > calculate correctly the linear address.
> > 
> > The segment selector to be used when computing a linear address is
> > determined by either any of segment override prefixes in the
> > instruction or inferred from the registers involved in the computation of
> > the effective address; in that order. Also, there are cases when the
> > overrides shall be ignored (code segments are always selected by the CS
> > segment register; string instructions always use the ES segment register
> > along with the EDI register).
> > 
> > For clarity, this process can be split into two steps: resolving the
> > relevant segment register to use and, once known, read its value to
> > obtain the segment selector.
> > 
> > The method to obtain the segment selector depends on several factors. In
> > 32-bit builds, segment selectors are saved into the pt_regs structure
> > when switching to kernel mode. The same is also true for virtual-8086
> > mode. In 64-bit builds, segmentation is mostly ignored, except when
> > running a program in 32-bit legacy mode. In this case, CS and SS can be
> > obtained from pt_regs. DS, ES, FS and GS can be read directly from
> > the respective segment registers.
> > 
> > Lastly, the only two segment registers that are not ignored in long mode
> > are FS and GS. In these two cases, base addresses are obtained from the
> > respective MSRs.
> > 
> > Cc: Dave Hansen 
> > Cc: Adam Buchbinder 
> > Cc: Colin Ian King 
> > Cc: Lorenzo Stoakes 
> > Cc: Qiaowei Ren 
> > Cc: Arnaldo Carvalho de Melo 
> > Cc: Masami Hiramatsu 
> > Cc: Adrian Hunter 
> > Cc: Kees Cook 
> > Cc: Thomas Garnier 
> > Cc: Peter Zijlstra 
> > Cc: Borislav Petkov 
> > Cc: Dmitry Vyukov 
> > Cc: Ravi V. Shankar 
> > Cc: x...@kernel.org
> > Signed-off-by: Ricardo Neri 
> > ---
> >  arch/x86/lib/insn-eval.c | 256 
> > +++
> >  1 file changed, 256 insertions(+)
> > 
> > diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
> > index 1634762..0a496f4 100644
> > --- a/arch/x86/lib/insn-eval.c
> > +++ b/arch/x86/lib/insn-eval.c
> > @@ -9,6 +9,7 @@
> >  #include 
> >  #include 
> >  #include 
> > +#include 
> >  
> >  enum reg_type {
> > REG_TYPE_RM = 0,
> > @@ -33,6 +34,17 @@ enum string_instruction {
> > SCASW_SCASD = 0xaf,
> >  };
> >  
> > +enum segment_register {
> > +   SEG_REG_INVAL = -1,
> > +   SEG_REG_IGNORE = 0,
> > +   SEG_REG_CS = 0x23,
> > +   SEG_REG_SS = 0x36,
> > +   SEG_REG_DS = 0x3e,
> > +   SEG_REG_ES = 0x26,
> > +   SEG_REG_FS = 0x64,
> > +   SEG_REG_GS = 0x65,
> > +};
> 
> Yuck, didn't we talk about this already?

I am sorry Borislav. I thought you agreed that I could use the values of
the segment override prefixes to identify the segment registers [1].
> 
> Those are segment override prefixes so call them as such.
> 
> #define SEG_OVR_PFX_CS0x23
> #define SEG_OVR_PFX_SS0x36
> ...
> 
> and we already have those!
> 
> arch/x86/include/asm/inat.h:
> ...
> #define INAT_PFX_CS 5   /* 0x2E */
> #define INAT_PFX_DS 6   /* 0x3E */
> #define INAT_PFX_ES 7   /* 0x26 */
> #define INAT_PFX_FS 8   /* 0x64 */
> #define INAT_PFX_GS 9   /* 0x65 */
> #define INAT_PFX_SS 10  /* 0x36 */
> 
> well, kinda, they're numbers there and not the actual prefix values.

These numbers can 'translated' to the actual value of the prefixes via
inat_get_opcode_attribute(). In my next version I am planning to use
these function and reuse the aforementioned definitions.

> 
> And then there's:
> 
> arch/x86/kernel/uprobes.c::is_prefix_bad() which looks at some of those.
> 
> Please add your defines to inat.h

Will do.

> and make that function is_prefix_bad()
> use them instead of naked numbers. We need to pay attention to all those
> different things needing to look at insn opcodes and not let them go
> unwieldy by each defining and duplicating stuff.

I have implemented this change and will be part of my next version.
> 
> >  /**
> >   * is_string_instruction - Determine if instruction is a string instruction
> >   * @insn:  Instruction structure containing the opcode
> > @@ -83,6 +95,250 @@ static bool is_string_instruction(struct insn *insn)
> > }
> >  }
> >  
> > +/**
> > + * resolve_seg_register() - obtain segment register
> 
> That function is still returning the segment override prefix and we use
> *that* to determine the segment register.

[PATCH 4.4 18/46] jump label: pass kbuild_cflags when checking for asm goto support

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: David Lin 


[ Upstream commit 35f860f9ba6aac56cc38e8b18916d833a83f1157 ]

Some versions of ARM GCC compiler such as Android toolchain throws in a
'-fpic' flag by default.  This causes the gcc-goto check script to fail
although some config would have '-fno-pic' flag in the KBUILD_CFLAGS.

This patch passes the KBUILD_CFLAGS to the check script so that the
script does not rely on the default config from different compilers.

Link: http://lkml.kernel.org/r/20170120234329.78868-1-dtw...@google.com
Signed-off-by: David Lin 
Acked-by: Steven Rostedt 
Cc: Michal Marek 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 Makefile |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/Makefile
+++ b/Makefile
@@ -789,7 +789,7 @@ KBUILD_CFLAGS   += $(call cc-option,-Wer
 KBUILD_ARFLAGS := $(call ar-option,D)
 
 # check for 'asm goto'
-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y)
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) 
$(KBUILD_CFLAGS)), y)
KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
 endif

[PATCH 4.4 18/46] jump label: pass kbuild_cflags when checking for asm goto support

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: David Lin 


[ Upstream commit 35f860f9ba6aac56cc38e8b18916d833a83f1157 ]

Some versions of ARM GCC compiler such as Android toolchain throws in a
'-fpic' flag by default.  This causes the gcc-goto check script to fail
although some config would have '-fno-pic' flag in the KBUILD_CFLAGS.

This patch passes the KBUILD_CFLAGS to the check script so that the
script does not rely on the default config from different compilers.

Link: http://lkml.kernel.org/r/20170120234329.78868-1-dtw...@google.com
Signed-off-by: David Lin 
Acked-by: Steven Rostedt 
Cc: Michal Marek 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 Makefile |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/Makefile
+++ b/Makefile
@@ -789,7 +789,7 @@ KBUILD_CFLAGS   += $(call cc-option,-Wer
 KBUILD_ARFLAGS := $(call ar-option,D)
 
 # check for 'asm goto'
-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y)
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) 
$(KBUILD_CFLAGS)), y)
KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
 endif

[PATCH 4.4 20/46] log2: make order_base_2() behave correctly on const input value zero

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit 29905b52fad0854351f57bab867647e4982285bf upstream.

The function order_base_2() is defined (according to the comment block)
as returning zero on input zero, but subsequently passes the input into
roundup_pow_of_two(), which is explicitly undefined for input zero.

This has gone unnoticed until now, but optimization passes in GCC 7 may
produce constant folded function instances where a constant value of
zero is passed into order_base_2(), resulting in link errors against the
deliberately undefined 'ilog2_NaN'.

So update order_base_2() to adhere to its own documented interface.

[ See

 http://marc.info/?l=linux-kernel=147672952517795=2

  and follow-up discussion for more background. The gcc "optimization
  pass" is really just broken, but now the GCC trunk problem seems to
  have escaped out of just specially built daily images, so we need to
  work around it in mainline.- Linus ]

Signed-off-by: Ard Biesheuvel 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/log2.h |   13 -
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/include/linux/log2.h
+++ b/include/linux/log2.h
@@ -194,6 +194,17 @@ unsigned long __rounddown_pow_of_two(uns
  *  ... and so on.
  */
 
-#define order_base_2(n) ilog2(roundup_pow_of_two(n))
+static inline __attribute_const__
+int __order_base_2(unsigned long n)
+{
+   return n > 1 ? ilog2(n - 1) + 1 : 0;
+}
 
+#define order_base_2(n)\
+(  \
+   __builtin_constant_p(n) ? ( \
+   ((n) == 0 || (n) == 1) ? 0 :\
+   ilog2((n) - 1) + 1) :   \
+   __order_base_2(n)   \
+)
 #endif /* _LINUX_LOG2_H */

[PATCH 4.4 20/46] log2: make order_base_2() behave correctly on const input value zero

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit 29905b52fad0854351f57bab867647e4982285bf upstream.

The function order_base_2() is defined (according to the comment block)
as returning zero on input zero, but subsequently passes the input into
roundup_pow_of_two(), which is explicitly undefined for input zero.

This has gone unnoticed until now, but optimization passes in GCC 7 may
produce constant folded function instances where a constant value of
zero is passed into order_base_2(), resulting in link errors against the
deliberately undefined 'ilog2_NaN'.

So update order_base_2() to adhere to its own documented interface.

[ See

 http://marc.info/?l=linux-kernel=147672952517795=2

  and follow-up discussion for more background. The gcc "optimization
  pass" is really just broken, but now the GCC trunk problem seems to
  have escaped out of just specially built daily images, so we need to
  work around it in mainline.- Linus ]

Signed-off-by: Ard Biesheuvel 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/log2.h |   13 -
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/include/linux/log2.h
+++ b/include/linux/log2.h
@@ -194,6 +194,17 @@ unsigned long __rounddown_pow_of_two(uns
  *  ... and so on.
  */
 
-#define order_base_2(n) ilog2(roundup_pow_of_two(n))
+static inline __attribute_const__
+int __order_base_2(unsigned long n)
+{
+   return n > 1 ? ilog2(n - 1) + 1 : 0;
+}
 
+#define order_base_2(n)\
+(  \
+   __builtin_constant_p(n) ? ( \
+   ((n) == 0 || (n) == 1) ? 0 :\
+   ilog2((n) - 1) + 1) :   \
+   __order_base_2(n)   \
+)
 #endif /* _LINUX_LOG2_H */

[PATCH 4.4 24/46] FS-Cache: Initialise stores_lock in netfs cookie

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: David Howells 


[ Upstream commit 62deb8187d116581c88c69a2dd9b5c16588545d4 ]

Initialise the stores_lock in fscache netfs cookies.  Technically, it
shouldn't be necessary, since the netfs cookie is an index and stores no
data, but initialising it anyway adds insignificant overhead.

Signed-off-by: David Howells 
Reviewed-by: Jeff Layton 
Acked-by: Steve Dickson 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/fscache/netfs.c |1 +
 1 file changed, 1 insertion(+)

--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -48,6 +48,7 @@ int __fscache_register_netfs(struct fsca
cookie->flags   = 1 << FSCACHE_COOKIE_ENABLED;
 
spin_lock_init(>lock);
+   spin_lock_init(>stores_lock);
INIT_HLIST_HEAD(>backing_objects);
 
/* check the netfs type is not already present */

[PATCH 4.4 24/46] FS-Cache: Initialise stores_lock in netfs cookie

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: David Howells 


[ Upstream commit 62deb8187d116581c88c69a2dd9b5c16588545d4 ]

Initialise the stores_lock in fscache netfs cookies.  Technically, it
shouldn't be necessary, since the netfs cookie is an index and stores no
data, but initialising it anyway adds insignificant overhead.

Signed-off-by: David Howells 
Reviewed-by: Jeff Layton 
Acked-by: Steve Dickson 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/fscache/netfs.c |1 +
 1 file changed, 1 insertion(+)

--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -48,6 +48,7 @@ int __fscache_register_netfs(struct fsca
cookie->flags   = 1 << FSCACHE_COOKIE_ENABLED;
 
spin_lock_init(>lock);
+   spin_lock_init(>stores_lock);
INIT_HLIST_HEAD(>backing_objects);
 
/* check the netfs type is not already present */

[PATCH 4.4 36/46] nfs: Fix "Dont increment lock sequence ID after NFS4ERR_MOVED"

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Chuck Lever 


[ Upstream commit 406dab8450ec76eca88a1af2fc15d18a2b36ca49 ]

Lock sequence IDs are bumped in decode_lock by calling
nfs_increment_seqid(). nfs_increment_sequid() does not use the
seqid_mutating_err() function fixed in commit 059aa7348241 ("Don't
increment lock sequence ID after NFS4ERR_MOVED").

Fixes: 059aa7348241 ("Don't increment lock sequence ID after ...")
Signed-off-by: Chuck Lever 
Tested-by: Xuan Qi 
Cc: sta...@vger.kernel.org # v3.7+
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4state.c |1 +
 1 file changed, 1 insertion(+)

--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1072,6 +1072,7 @@ static void nfs_increment_seqid(int stat
case -NFS4ERR_BADXDR:
case -NFS4ERR_RESOURCE:
case -NFS4ERR_NOFILEHANDLE:
+   case -NFS4ERR_MOVED:
/* Non-seqid mutating errors */
return;
};

[PATCH 4.4 36/46] nfs: Fix "Dont increment lock sequence ID after NFS4ERR_MOVED"

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Chuck Lever 


[ Upstream commit 406dab8450ec76eca88a1af2fc15d18a2b36ca49 ]

Lock sequence IDs are bumped in decode_lock by calling
nfs_increment_seqid(). nfs_increment_sequid() does not use the
seqid_mutating_err() function fixed in commit 059aa7348241 ("Don't
increment lock sequence ID after NFS4ERR_MOVED").

Fixes: 059aa7348241 ("Don't increment lock sequence ID after ...")
Signed-off-by: Chuck Lever 
Tested-by: Xuan Qi 
Cc: sta...@vger.kernel.org # v3.7+
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4state.c |1 +
 1 file changed, 1 insertion(+)

--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1072,6 +1072,7 @@ static void nfs_increment_seqid(int stat
case -NFS4ERR_BADXDR:
case -NFS4ERR_RESOURCE:
case -NFS4ERR_NOFILEHANDLE:
+   case -NFS4ERR_MOVED:
/* Non-seqid mutating errors */
return;
};

[PATCH 4.4 23/46] fscache: Clear outstanding writes when disabling a cookie

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: David Howells 


[ Upstream commit 6bdded59c8933940ac7e5b416448276ac89d1144 ]

fscache_disable_cookie() needs to clear the outstanding writes on the
cookie it's disabling because they cannot be completed after.

Without this, fscache_nfs_open_file() gets stuck because it disables the
cookie when the file is opened for writing but can't uncache the pages till
afterwards - otherwise there's a race between the open routine and anyone
who already has it open R/O and is still reading from it.

Looking in /proc/pid/stack of the offending process shows:

[] __fscache_wait_on_page_write+0x82/0x9b [fscache]
[] __fscache_uncache_all_inode_pages+0x91/0xe1 [fscache]
[] nfs_fscache_open_file+0x59/0x9e [nfs]
[] nfs4_file_open+0x17f/0x1b8 [nfsv4]
[] do_dentry_open+0x16d/0x2b7
[] vfs_open+0x5c/0x65
[] path_openat+0x785/0x8fb
[] do_filp_open+0x48/0x9e
[] do_sys_open+0x13b/0x1cb
[] SyS_open+0x19/0x1b
[] do_syscall_64+0x80/0x17a
[] return_from_SYSCALL_64+0x0/0x7a
[] 0x

Reported-by: Jianhong Yin 
Signed-off-by: David Howells 
Acked-by: Jeff Layton 
Acked-by: Steve Dickson 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/fscache/cookie.c |5 +
 fs/fscache/object.c |6 ++
 2 files changed, 11 insertions(+)

--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fsc
hlist_for_each_entry(object, >backing_objects, 
cookie_link) {
if (invalidate)
set_bit(FSCACHE_OBJECT_RETIRED, >flags);
+   clear_bit(FSCACHE_OBJECT_PENDING_WRITE, >flags);
fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL);
}
} else {
@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fsc
wait_on_atomic_t(>n_active, fscache_wait_atomic_t,
 TASK_UNINTERRUPTIBLE);
 
+   /* Make sure any pending writes are cancelled. */
+   if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
+   fscache_invalidate_writes(cookie);
+
/* Reset the cookie state if it wasn't relinquished */
if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, >flags)) {
atomic_inc(>n_active);
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -650,6 +650,12 @@ static const struct fscache_state *fscac
fscache_mark_object_dead(object);
object->oob_event_mask = 0;
 
+   if (test_bit(FSCACHE_OBJECT_RETIRED, >flags)) {
+   /* Reject any new read/write ops and abort any that are 
pending. */
+   clear_bit(FSCACHE_OBJECT_PENDING_WRITE, >flags);
+   fscache_cancel_all_ops(object);
+   }
+
if (list_empty(>dependents) &&
object->n_ops == 0 &&
object->n_children == 0)

[PATCH 4.9 066/108] nfs: Fix "Dont increment lock sequence ID after NFS4ERR_MOVED"

[Greg Kroah-Hartman]

4.9-stable review patch.  If anyone has any objections, please let me know.

--

From: Chuck Lever 


[ Upstream commit 406dab8450ec76eca88a1af2fc15d18a2b36ca49 ]

Lock sequence IDs are bumped in decode_lock by calling
nfs_increment_seqid(). nfs_increment_sequid() does not use the
seqid_mutating_err() function fixed in commit 059aa7348241 ("Don't
increment lock sequence ID after NFS4ERR_MOVED").

Fixes: 059aa7348241 ("Don't increment lock sequence ID after ...")
Signed-off-by: Chuck Lever 
Tested-by: Xuan Qi 
Cc: sta...@vger.kernel.org # v3.7+
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4state.c |1 +
 1 file changed, 1 insertion(+)

--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1079,6 +1079,7 @@ static void nfs_increment_seqid(int stat
case -NFS4ERR_BADXDR:
case -NFS4ERR_RESOURCE:
case -NFS4ERR_NOFILEHANDLE:
+   case -NFS4ERR_MOVED:
/* Non-seqid mutating errors */
return;
};

[PATCH 4.4 23/46] fscache: Clear outstanding writes when disabling a cookie

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: David Howells 


[ Upstream commit 6bdded59c8933940ac7e5b416448276ac89d1144 ]

fscache_disable_cookie() needs to clear the outstanding writes on the
cookie it's disabling because they cannot be completed after.

Without this, fscache_nfs_open_file() gets stuck because it disables the
cookie when the file is opened for writing but can't uncache the pages till
afterwards - otherwise there's a race between the open routine and anyone
who already has it open R/O and is still reading from it.

Looking in /proc/pid/stack of the offending process shows:

[] __fscache_wait_on_page_write+0x82/0x9b [fscache]
[] __fscache_uncache_all_inode_pages+0x91/0xe1 [fscache]
[] nfs_fscache_open_file+0x59/0x9e [nfs]
[] nfs4_file_open+0x17f/0x1b8 [nfsv4]
[] do_dentry_open+0x16d/0x2b7
[] vfs_open+0x5c/0x65
[] path_openat+0x785/0x8fb
[] do_filp_open+0x48/0x9e
[] do_sys_open+0x13b/0x1cb
[] SyS_open+0x19/0x1b
[] do_syscall_64+0x80/0x17a
[] return_from_SYSCALL_64+0x0/0x7a
[] 0x

Reported-by: Jianhong Yin 
Signed-off-by: David Howells 
Acked-by: Jeff Layton 
Acked-by: Steve Dickson 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/fscache/cookie.c |5 +
 fs/fscache/object.c |6 ++
 2 files changed, 11 insertions(+)

--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fsc
hlist_for_each_entry(object, >backing_objects, 
cookie_link) {
if (invalidate)
set_bit(FSCACHE_OBJECT_RETIRED, >flags);
+   clear_bit(FSCACHE_OBJECT_PENDING_WRITE, >flags);
fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL);
}
} else {
@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fsc
wait_on_atomic_t(>n_active, fscache_wait_atomic_t,
 TASK_UNINTERRUPTIBLE);
 
+   /* Make sure any pending writes are cancelled. */
+   if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
+   fscache_invalidate_writes(cookie);
+
/* Reset the cookie state if it wasn't relinquished */
if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, >flags)) {
atomic_inc(>n_active);
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -650,6 +650,12 @@ static const struct fscache_state *fscac
fscache_mark_object_dead(object);
object->oob_event_mask = 0;
 
+   if (test_bit(FSCACHE_OBJECT_RETIRED, >flags)) {
+   /* Reject any new read/write ops and abort any that are 
pending. */
+   clear_bit(FSCACHE_OBJECT_PENDING_WRITE, >flags);
+   fscache_cancel_all_ops(object);
+   }
+
if (list_empty(>dependents) &&
object->n_ops == 0 &&
object->n_children == 0)

[PATCH 4.9 066/108] nfs: Fix "Dont increment lock sequence ID after NFS4ERR_MOVED"

[Greg Kroah-Hartman]

4.9-stable review patch.  If anyone has any objections, please let me know.

--

From: Chuck Lever 


[ Upstream commit 406dab8450ec76eca88a1af2fc15d18a2b36ca49 ]

Lock sequence IDs are bumped in decode_lock by calling
nfs_increment_seqid(). nfs_increment_sequid() does not use the
seqid_mutating_err() function fixed in commit 059aa7348241 ("Don't
increment lock sequence ID after NFS4ERR_MOVED").

Fixes: 059aa7348241 ("Don't increment lock sequence ID after ...")
Signed-off-by: Chuck Lever 
Tested-by: Xuan Qi 
Cc: sta...@vger.kernel.org # v3.7+
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4state.c |1 +
 1 file changed, 1 insertion(+)

--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1079,6 +1079,7 @@ static void nfs_increment_seqid(int stat
case -NFS4ERR_BADXDR:
case -NFS4ERR_RESOURCE:
case -NFS4ERR_NOFILEHANDLE:
+   case -NFS4ERR_MOVED:
/* Non-seqid mutating errors */
return;
};

[PATCH 4.4 25/46] ipv6: fix flow labels when the traffic class is non-0

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dimitris Michailidis 


[ Upstream commit 90427ef5d2a4b9a24079889bf16afdcdaebc4240 ]

ip6_make_flowlabel() determines the flow label for IPv6 packets. It's
supposed to be passed a flow label, which it returns as is if non-0 and
in some other cases, otherwise it calculates a new value.

The problem is callers often pass a flowi6.flowlabel, which may also
contain traffic class bits. If the traffic class is non-0
ip6_make_flowlabel() mistakes the non-0 it gets as a flow label and
returns the whole thing. Thus it can return a 'flow label' longer than
20b and the low 20b of that is typically 0 resulting in packets with 0
label. Moreover, different packets of a flow may be labeled differently.
For a TCP flow with ECN non-payload and payload packets get different
labels as exemplified by this pair of consecutive packets:

(pure ACK)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
        = Traffic Class: 0x00 (DSCP: CS0, 
ECN: Not-ECT)
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..00      = Explicit Congestion 
Notification: Not ECN-Capable Transport (0)
   0001 1100 1110 0100 1001 = Flow Label: 0x1ce49
Payload Length: 32
Next Header: TCP (6)

(payload)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
  0010      = Traffic Class: 0x02 (DSCP: CS0, 
ECN: ECT(0))
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..10      = Explicit Congestion 
Notification: ECN-Capable Transport codepoint '10' (2)
        = Flow Label: 0x0
Payload Length: 688
Next Header: TCP (6)

This patch allows ip6_make_flowlabel() to be passed more than just a
flow label and has it extract the part it really wants. This was simpler
than modifying the callers. With this patch packets like the above become

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
        = Traffic Class: 0x00 (DSCP: CS0, 
ECN: Not-ECT)
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..00      = Explicit Congestion 
Notification: Not ECN-Capable Transport (0)
   1010  1010 0101 1110 = Flow Label: 0xafa5e
Payload Length: 32
Next Header: TCP (6)

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
  0010      = Traffic Class: 0x02 (DSCP: CS0, 
ECN: ECT(0))
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..10      = Explicit Congestion 
Notification: ECN-Capable Transport codepoint '10' (2)
   1010  1010 0101 1110 = Flow Label: 0xafa5e
Payload Length: 688
Next Header: TCP (6)

Signed-off-by: Dimitris Michailidis 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/net/ipv6.h |5 +
 1 file changed, 5 insertions(+)

--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -744,6 +744,11 @@ static inline __be32 ip6_make_flowlabel(
 {
u32 hash;
 
+   /* @flowlabel may include more than a flow label, eg, the traffic class.
+* Here we want only the flow label value.
+*/
+   flowlabel &= IPV6_FLOWLABEL_MASK;
+
if (flowlabel ||
net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF ||
(!autolabel &&

[PATCH 4.4 25/46] ipv6: fix flow labels when the traffic class is non-0

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dimitris Michailidis 


[ Upstream commit 90427ef5d2a4b9a24079889bf16afdcdaebc4240 ]

ip6_make_flowlabel() determines the flow label for IPv6 packets. It's
supposed to be passed a flow label, which it returns as is if non-0 and
in some other cases, otherwise it calculates a new value.

The problem is callers often pass a flowi6.flowlabel, which may also
contain traffic class bits. If the traffic class is non-0
ip6_make_flowlabel() mistakes the non-0 it gets as a flow label and
returns the whole thing. Thus it can return a 'flow label' longer than
20b and the low 20b of that is typically 0 resulting in packets with 0
label. Moreover, different packets of a flow may be labeled differently.
For a TCP flow with ECN non-payload and payload packets get different
labels as exemplified by this pair of consecutive packets:

(pure ACK)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
        = Traffic Class: 0x00 (DSCP: CS0, 
ECN: Not-ECT)
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..00      = Explicit Congestion 
Notification: Not ECN-Capable Transport (0)
   0001 1100 1110 0100 1001 = Flow Label: 0x1ce49
Payload Length: 32
Next Header: TCP (6)

(payload)
Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
  0010      = Traffic Class: 0x02 (DSCP: CS0, 
ECN: ECT(0))
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..10      = Explicit Congestion 
Notification: ECN-Capable Transport codepoint '10' (2)
        = Flow Label: 0x0
Payload Length: 688
Next Header: TCP (6)

This patch allows ip6_make_flowlabel() to be passed more than just a
flow label and has it extract the part it really wants. This was simpler
than modifying the callers. With this patch packets like the above become

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
        = Traffic Class: 0x00 (DSCP: CS0, 
ECN: Not-ECT)
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..00      = Explicit Congestion 
Notification: Not ECN-Capable Transport (0)
   1010  1010 0101 1110 = Flow Label: 0xafa5e
Payload Length: 32
Next Header: TCP (6)

Internet Protocol Version 6, Src: 2002:af5:11a3::, Dst: 2002:af5:11a2::
0110  = Version: 6
  0010      = Traffic Class: 0x02 (DSCP: CS0, 
ECN: ECT(0))
  00..      = Differentiated Services 
Codepoint: Default (0)
  ..10      = Explicit Congestion 
Notification: ECN-Capable Transport codepoint '10' (2)
   1010  1010 0101 1110 = Flow Label: 0xafa5e
Payload Length: 688
Next Header: TCP (6)

Signed-off-by: Dimitris Michailidis 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/net/ipv6.h |5 +
 1 file changed, 5 insertions(+)

--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -744,6 +744,11 @@ static inline __be32 ip6_make_flowlabel(
 {
u32 hash;
 
+   /* @flowlabel may include more than a flow label, eg, the traffic class.
+* Here we want only the flow label value.
+*/
+   flowlabel &= IPV6_FLOWLABEL_MASK;
+
if (flowlabel ||
net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF ||
(!autolabel &&

[PATCH 4.4 29/46] gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Arseny Solokha 


[ Upstream commit 4af0e5bb95ee3ba5ea4bd7dbb94e1648a5279cc9 ]

In spite of switching to paged allocation of Rx buffers, the driver still
called dma_unmap_single() in the Rx queues tear-down path.

The DMA region unmapping code in free_skb_rx_queue() basically predates
the introduction of paged allocation to the driver. While being refactored,
it apparently hasn't reflected the change in the DMA API usage by its
counterpart gfar_new_page().

As a result, setting an interface to the DOWN state now yields the following:

  # ip link set eth2 down
  fsl-gianfar ffe24000.ethernet: DMA-API: device driver frees DMA memory with 
wrong function [device address=0x1ecd] [size=40]
  [ cut here ]
  WARNING: CPU: 1 PID: 189 at lib/dma-debug.c:1123 check_unmap+0x8e0/0xa28
  CPU: 1 PID: 189 Comm: ip Tainted: G   O4.9.5 #1
  task: dee73400 task.stack: dede2000
  NIP: c02101e8 LR: c02101e8 CTR: c0260d74
  REGS: dede3bb0 TRAP: 0700   Tainted: G   O (4.9.5)
  MSR: 00021000   CR: 2800  XER: 

  GPR00: c02101e8 dede3c60 dee73400 00b6 dfbd033c dfbd36c4 1f622000 dede2000
  GPR08: 0007 c05b1634 1f622000  22002484 100a9904  
  GPR16:  db4c849c 0002 db4c8480 0001 df142240 db4c84bc 
  GPR24: c0706148 c070 00029000 c07552e8 c07323b4 dede3cb8 c07605e0 db535540
  NIP [c02101e8] check_unmap+0x8e0/0xa28
  LR [c02101e8] check_unmap+0x8e0/0xa28
  Call Trace:
  [dede3c60] [c02101e8] check_unmap+0x8e0/0xa28 (unreliable)
  [dede3cb0] [c02103b8] debug_dma_unmap_page+0x88/0x9c
  [dede3d30] [c02dffbc] free_skb_resources+0x2c4/0x404
  [dede3d80] [c02e39b4] gfar_close+0x24/0xc8
  [dede3da0] [c0361550] __dev_close_many+0xa0/0xf8
  [dede3dd0] [c03616f0] __dev_close+0x2c/0x4c
  [dede3df0] [c036b1b8] __dev_change_flags+0xa0/0x174
  [dede3e10] [c036b2ac] dev_change_flags+0x20/0x60
  [dede3e30] [c03e130c] devinet_ioctl+0x540/0x824
  [dede3e90] [c0347dcc] sock_ioctl+0x134/0x298
  [dede3eb0] [c0111814] do_vfs_ioctl+0xac/0x854
  [dede3f20] [c0111ffc] SyS_ioctl+0x40/0x74
  [dede3f40] [c000f290] ret_from_syscall+0x0/0x3c
  --- interrupt: c01 at 0xff45da0
  LR = 0xff45cd0
  Instruction dump:
  811d001c 7c66482e 813d0020 9061000c 807f000c 5463103a 7cc6182e 3c60c052
  386309ac 90c10008 4cc63182 4826b845 <0fe0> 4bfffa60 3c80c052 388402c4
  ---[ end trace 695ae6d7ac1d0c47 ]---
  Mapped at:
   [] gfar_alloc_rx_buffs+0x178/0x248
   [] startup_gfar+0x368/0x570
   [] __dev_open+0xdc/0x150
   [] __dev_change_flags+0xa0/0x174
   [] dev_change_flags+0x20/0x60

Even though the issue was discovered in 4.9 kernel, the code in question
is identical in the current net and net-next trees.

Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G")
Signed-off-by: Arseny Solokha 
Acked-by: Claudiu Manoil 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/freescale/gianfar.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1999,8 +1999,8 @@ static void free_skb_rx_queue(struct gfa
if (!rxb->page)
continue;
 
-   dma_unmap_single(rx_queue->dev, rxb->dma,
-PAGE_SIZE, DMA_FROM_DEVICE);
+   dma_unmap_page(rx_queue->dev, rxb->dma,
+  PAGE_SIZE, DMA_FROM_DEVICE);
__free_page(rxb->page);
 
rxb->page = NULL;

[PATCH 4.4 27/46] drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Skeggs 


[ Upstream commit 96692b097ba76d0c637ae8af47b29c73da33c9d0 ]

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/nouveau/nouveau_fence.h |1 +
 drivers/gpu/drm/nouveau/nv84_fence.c|6 ++
 2 files changed, 7 insertions(+)

--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -99,6 +99,7 @@ struct nv84_fence_priv {
struct nouveau_bo *bo;
struct nouveau_bo *bo_gart;
u32 *suspend;
+   struct mutex mutex;
 };
 
 u64  nv84_fence_crtc(struct nouveau_channel *, int);
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -121,8 +121,10 @@ nv84_fence_context_del(struct nouveau_ch
}
 
nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence);
+   mutex_lock(>mutex);
nouveau_bo_vma_del(priv->bo, >vma_gart);
nouveau_bo_vma_del(priv->bo, >vma);
+   mutex_unlock(>mutex);
nouveau_fence_context_del(>base);
chan->fence = NULL;
nouveau_fence_context_free(>base);
@@ -148,11 +150,13 @@ nv84_fence_context_new(struct nouveau_ch
fctx->base.sync32 = nv84_fence_sync32;
fctx->base.sequence = nv84_fence_read(chan);
 
+   mutex_lock(>mutex);
ret = nouveau_bo_vma_add(priv->bo, cli->vm, >vma);
if (ret == 0) {
ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm,
>vma_gart);
}
+   mutex_unlock(>mutex);
 
/* map display semaphore buffers into channel's vm */
for (i = 0; !ret && i < chan->drm->dev->mode_config.num_crtc; i++) {
@@ -232,6 +236,8 @@ nv84_fence_create(struct nouveau_drm *dr
priv->base.context_base = fence_context_alloc(priv->base.contexts);
priv->base.uevent = true;
 
+   mutex_init(>mutex);
+
/* Use VRAM if there is any ; otherwise fallback to system memory */
domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM :
 /*

[PATCH 4.4 27/46] drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Skeggs 


[ Upstream commit 96692b097ba76d0c637ae8af47b29c73da33c9d0 ]

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/nouveau/nouveau_fence.h |1 +
 drivers/gpu/drm/nouveau/nv84_fence.c|6 ++
 2 files changed, 7 insertions(+)

--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -99,6 +99,7 @@ struct nv84_fence_priv {
struct nouveau_bo *bo;
struct nouveau_bo *bo_gart;
u32 *suspend;
+   struct mutex mutex;
 };
 
 u64  nv84_fence_crtc(struct nouveau_channel *, int);
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -121,8 +121,10 @@ nv84_fence_context_del(struct nouveau_ch
}
 
nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence);
+   mutex_lock(>mutex);
nouveau_bo_vma_del(priv->bo, >vma_gart);
nouveau_bo_vma_del(priv->bo, >vma);
+   mutex_unlock(>mutex);
nouveau_fence_context_del(>base);
chan->fence = NULL;
nouveau_fence_context_free(>base);
@@ -148,11 +150,13 @@ nv84_fence_context_new(struct nouveau_ch
fctx->base.sync32 = nv84_fence_sync32;
fctx->base.sequence = nv84_fence_read(chan);
 
+   mutex_lock(>mutex);
ret = nouveau_bo_vma_add(priv->bo, cli->vm, >vma);
if (ret == 0) {
ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm,
>vma_gart);
}
+   mutex_unlock(>mutex);
 
/* map display semaphore buffers into channel's vm */
for (i = 0; !ret && i < chan->drm->dev->mode_config.num_crtc; i++) {
@@ -232,6 +236,8 @@ nv84_fence_create(struct nouveau_drm *dr
priv->base.context_base = fence_context_alloc(priv->base.contexts);
priv->base.uevent = true;
 
+   mutex_init(>mutex);
+
/* Use VRAM if there is any ; otherwise fallback to system memory */
domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM :
 /*

[PATCH 4.4 29/46] gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Arseny Solokha 


[ Upstream commit 4af0e5bb95ee3ba5ea4bd7dbb94e1648a5279cc9 ]

In spite of switching to paged allocation of Rx buffers, the driver still
called dma_unmap_single() in the Rx queues tear-down path.

The DMA region unmapping code in free_skb_rx_queue() basically predates
the introduction of paged allocation to the driver. While being refactored,
it apparently hasn't reflected the change in the DMA API usage by its
counterpart gfar_new_page().

As a result, setting an interface to the DOWN state now yields the following:

  # ip link set eth2 down
  fsl-gianfar ffe24000.ethernet: DMA-API: device driver frees DMA memory with 
wrong function [device address=0x1ecd] [size=40]
  [ cut here ]
  WARNING: CPU: 1 PID: 189 at lib/dma-debug.c:1123 check_unmap+0x8e0/0xa28
  CPU: 1 PID: 189 Comm: ip Tainted: G   O4.9.5 #1
  task: dee73400 task.stack: dede2000
  NIP: c02101e8 LR: c02101e8 CTR: c0260d74
  REGS: dede3bb0 TRAP: 0700   Tainted: G   O (4.9.5)
  MSR: 00021000   CR: 2800  XER: 

  GPR00: c02101e8 dede3c60 dee73400 00b6 dfbd033c dfbd36c4 1f622000 dede2000
  GPR08: 0007 c05b1634 1f622000  22002484 100a9904  
  GPR16:  db4c849c 0002 db4c8480 0001 df142240 db4c84bc 
  GPR24: c0706148 c070 00029000 c07552e8 c07323b4 dede3cb8 c07605e0 db535540
  NIP [c02101e8] check_unmap+0x8e0/0xa28
  LR [c02101e8] check_unmap+0x8e0/0xa28
  Call Trace:
  [dede3c60] [c02101e8] check_unmap+0x8e0/0xa28 (unreliable)
  [dede3cb0] [c02103b8] debug_dma_unmap_page+0x88/0x9c
  [dede3d30] [c02dffbc] free_skb_resources+0x2c4/0x404
  [dede3d80] [c02e39b4] gfar_close+0x24/0xc8
  [dede3da0] [c0361550] __dev_close_many+0xa0/0xf8
  [dede3dd0] [c03616f0] __dev_close+0x2c/0x4c
  [dede3df0] [c036b1b8] __dev_change_flags+0xa0/0x174
  [dede3e10] [c036b2ac] dev_change_flags+0x20/0x60
  [dede3e30] [c03e130c] devinet_ioctl+0x540/0x824
  [dede3e90] [c0347dcc] sock_ioctl+0x134/0x298
  [dede3eb0] [c0111814] do_vfs_ioctl+0xac/0x854
  [dede3f20] [c0111ffc] SyS_ioctl+0x40/0x74
  [dede3f40] [c000f290] ret_from_syscall+0x0/0x3c
  --- interrupt: c01 at 0xff45da0
  LR = 0xff45cd0
  Instruction dump:
  811d001c 7c66482e 813d0020 9061000c 807f000c 5463103a 7cc6182e 3c60c052
  386309ac 90c10008 4cc63182 4826b845 <0fe0> 4bfffa60 3c80c052 388402c4
  ---[ end trace 695ae6d7ac1d0c47 ]---
  Mapped at:
   [] gfar_alloc_rx_buffs+0x178/0x248
   [] startup_gfar+0x368/0x570
   [] __dev_open+0xdc/0x150
   [] __dev_change_flags+0xa0/0x174
   [] dev_change_flags+0x20/0x60

Even though the issue was discovered in 4.9 kernel, the code in question
is identical in the current net and net-next trees.

Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G")
Signed-off-by: Arseny Solokha 
Acked-by: Claudiu Manoil 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/freescale/gianfar.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1999,8 +1999,8 @@ static void free_skb_rx_queue(struct gfa
if (!rxb->page)
continue;
 
-   dma_unmap_single(rx_queue->dev, rxb->dma,
-PAGE_SIZE, DMA_FROM_DEVICE);
+   dma_unmap_page(rx_queue->dev, rxb->dma,
+  PAGE_SIZE, DMA_FROM_DEVICE);
__free_page(rxb->page);
 
rxb->page = NULL;

[PATCH 4.4 26/46] drm/nouveau: prevent userspace from deleting client object

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Skeggs 


[ Upstream commit c966b6279f610a24ac1d42dcbe30e10fa61220b2 ]

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/nouveau/nouveau_usif.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/nouveau/nouveau_usif.c
+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c
@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void _
if (nvif_unpack(argv->v0, 0, 0, true)) {
/* block access to objects not created via this interface */
owner = argv->v0.owner;
-   if (argv->v0.object == 0ULL)
+   if (argv->v0.object == 0ULL &&
+   argv->v0.type != NVIF_IOCTL_V0_DEL)
argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
else
argv->v0.owner = NVDRM_OBJECT_USIF;

[PATCH 4.4 31/46] net: adaptec: starfire: add checks for dma mapping errors

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexey Khoroshilov 


[ Upstream commit d1156b489fa734d1af763d6a07b1637c01bb0aed ]

init_ring(), refill_rx_ring() and start_tx() don't check
if mapping dma memory succeed.
The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/adaptec/starfire.c |   45 ++--
 1 file changed, 43 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/adaptec/starfire.c
+++ b/drivers/net/ethernet/adaptec/starfire.c
@@ -1153,6 +1153,12 @@ static void init_ring(struct net_device
if (skb == NULL)
break;
np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, 
np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+   if (pci_dma_mapping_error(np->pci_dev,
+ np->rx_info[i].mapping)) {
+   dev_kfree_skb(skb);
+   np->rx_info[i].skb = NULL;
+   break;
+   }
/* Grrr, we cannot offset to correctly align the IP header. */
np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | 
RxDescValid);
}
@@ -1183,8 +1189,9 @@ static netdev_tx_t start_tx(struct sk_bu
 {
struct netdev_private *np = netdev_priv(dev);
unsigned int entry;
+   unsigned int prev_tx;
u32 status;
-   int i;
+   int i, j;
 
/*
 * be cautious here, wrapping the queue has weird semantics
@@ -1202,6 +1209,7 @@ static netdev_tx_t start_tx(struct sk_bu
}
 #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */
 
+   prev_tx = np->cur_tx;
entry = np->cur_tx % TX_RING_SIZE;
for (i = 0; i < skb_num_frags(skb); i++) {
int wrap_ring = 0;
@@ -1235,6 +1243,11 @@ static netdev_tx_t start_tx(struct sk_bu
   skb_frag_size(this_frag),
   PCI_DMA_TODEVICE);
}
+   if (pci_dma_mapping_error(np->pci_dev,
+ np->tx_info[entry].mapping)) {
+   dev->stats.tx_dropped++;
+   goto err_out;
+   }
 
np->tx_ring[entry].addr = 
cpu_to_dma(np->tx_info[entry].mapping);
np->tx_ring[entry].status = cpu_to_le32(status);
@@ -1269,8 +1282,30 @@ static netdev_tx_t start_tx(struct sk_bu
netif_stop_queue(dev);
 
return NETDEV_TX_OK;
-}
 
+err_out:
+   entry = prev_tx % TX_RING_SIZE;
+   np->tx_info[entry].skb = NULL;
+   if (i > 0) {
+   pci_unmap_single(np->pci_dev,
+np->tx_info[entry].mapping,
+skb_first_frag_len(skb),
+PCI_DMA_TODEVICE);
+   np->tx_info[entry].mapping = 0;
+   entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE;
+   for (j = 1; j < i; j++) {
+   pci_unmap_single(np->pci_dev,
+np->tx_info[entry].mapping,
+skb_frag_size(
+   _shinfo(skb)->frags[j-1]),
+PCI_DMA_TODEVICE);
+   entry++;
+   }
+   }
+   dev_kfree_skb_any(skb);
+   np->cur_tx = prev_tx;
+   return NETDEV_TX_OK;
+}
 
 /* The interrupt handler does all of the Rx thread work and cleans up
after the Tx thread. */
@@ -1570,6 +1605,12 @@ static void refill_rx_ring(struct net_de
break;  /* Better luck next round. */
np->rx_info[entry].mapping =
pci_map_single(np->pci_dev, skb->data, 
np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+   if (pci_dma_mapping_error(np->pci_dev,
+   np->rx_info[entry].mapping)) {
+   dev_kfree_skb(skb);
+   np->rx_info[entry].skb = NULL;
+   break;
+   }
np->rx_ring[entry].rxaddr =
cpu_to_dma(np->rx_info[entry].mapping | 
RxDescValid);
}

[PATCH 4.4 26/46] drm/nouveau: prevent userspace from deleting client object

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ben Skeggs 


[ Upstream commit c966b6279f610a24ac1d42dcbe30e10fa61220b2 ]

Signed-off-by: Ben Skeggs 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/nouveau/nouveau_usif.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/nouveau/nouveau_usif.c
+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c
@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void _
if (nvif_unpack(argv->v0, 0, 0, true)) {
/* block access to objects not created via this interface */
owner = argv->v0.owner;
-   if (argv->v0.object == 0ULL)
+   if (argv->v0.object == 0ULL &&
+   argv->v0.type != NVIF_IOCTL_V0_DEL)
argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
else
argv->v0.owner = NVDRM_OBJECT_USIF;

[PATCH 4.4 31/46] net: adaptec: starfire: add checks for dma mapping errors

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Alexey Khoroshilov 


[ Upstream commit d1156b489fa734d1af763d6a07b1637c01bb0aed ]

init_ring(), refill_rx_ring() and start_tx() don't check
if mapping dma memory succeed.
The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/adaptec/starfire.c |   45 ++--
 1 file changed, 43 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/adaptec/starfire.c
+++ b/drivers/net/ethernet/adaptec/starfire.c
@@ -1153,6 +1153,12 @@ static void init_ring(struct net_device
if (skb == NULL)
break;
np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, 
np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+   if (pci_dma_mapping_error(np->pci_dev,
+ np->rx_info[i].mapping)) {
+   dev_kfree_skb(skb);
+   np->rx_info[i].skb = NULL;
+   break;
+   }
/* Grrr, we cannot offset to correctly align the IP header. */
np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | 
RxDescValid);
}
@@ -1183,8 +1189,9 @@ static netdev_tx_t start_tx(struct sk_bu
 {
struct netdev_private *np = netdev_priv(dev);
unsigned int entry;
+   unsigned int prev_tx;
u32 status;
-   int i;
+   int i, j;
 
/*
 * be cautious here, wrapping the queue has weird semantics
@@ -1202,6 +1209,7 @@ static netdev_tx_t start_tx(struct sk_bu
}
 #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */
 
+   prev_tx = np->cur_tx;
entry = np->cur_tx % TX_RING_SIZE;
for (i = 0; i < skb_num_frags(skb); i++) {
int wrap_ring = 0;
@@ -1235,6 +1243,11 @@ static netdev_tx_t start_tx(struct sk_bu
   skb_frag_size(this_frag),
   PCI_DMA_TODEVICE);
}
+   if (pci_dma_mapping_error(np->pci_dev,
+ np->tx_info[entry].mapping)) {
+   dev->stats.tx_dropped++;
+   goto err_out;
+   }
 
np->tx_ring[entry].addr = 
cpu_to_dma(np->tx_info[entry].mapping);
np->tx_ring[entry].status = cpu_to_le32(status);
@@ -1269,8 +1282,30 @@ static netdev_tx_t start_tx(struct sk_bu
netif_stop_queue(dev);
 
return NETDEV_TX_OK;
-}
 
+err_out:
+   entry = prev_tx % TX_RING_SIZE;
+   np->tx_info[entry].skb = NULL;
+   if (i > 0) {
+   pci_unmap_single(np->pci_dev,
+np->tx_info[entry].mapping,
+skb_first_frag_len(skb),
+PCI_DMA_TODEVICE);
+   np->tx_info[entry].mapping = 0;
+   entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE;
+   for (j = 1; j < i; j++) {
+   pci_unmap_single(np->pci_dev,
+np->tx_info[entry].mapping,
+skb_frag_size(
+   _shinfo(skb)->frags[j-1]),
+PCI_DMA_TODEVICE);
+   entry++;
+   }
+   }
+   dev_kfree_skb_any(skb);
+   np->cur_tx = prev_tx;
+   return NETDEV_TX_OK;
+}
 
 /* The interrupt handler does all of the Rx thread work and cleans up
after the Tx thread. */
@@ -1570,6 +1605,12 @@ static void refill_rx_ring(struct net_de
break;  /* Better luck next round. */
np->rx_info[entry].mapping =
pci_map_single(np->pci_dev, skb->data, 
np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+   if (pci_dma_mapping_error(np->pci_dev,
+   np->rx_info[entry].mapping)) {
+   dev_kfree_skb(skb);
+   np->rx_info[entry].skb = NULL;
+   break;
+   }
np->rx_ring[entry].rxaddr =
cpu_to_dma(np->rx_info[entry].mapping | 
RxDescValid);
}

[PATCH 4.4 33/46] drm/nouveau: Dont enabling polling twice on runtime resume

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Lyude Paul 


[ Upstream commit cae9ff036eea577856d5b12860b4c79c5e71db4a ]

As it turns out, on cards that actually have CRTCs on them we're already
calling drm_kms_helper_poll_enable(drm_dev) from
nouveau_display_resume() before we call it in
nouveau_pmops_runtime_resume(). This leads us to accidentally trying to
enable polling twice, which results in a potential deadlock between the
RPM locks and drm_dev->mode_config.mutex if we end up trying to enable
polling the second time while output_poll_execute is running and holding
the mode_config lock. As such, make sure we only enable polling in
nouveau_pmops_runtime_resume() if we need to.

This fixes hangs observed on the ThinkPad W541

Signed-off-by: Lyude 
Cc: Hans de Goede 
Cc: Kilian Singer 
Cc: Lukas Wunner 
Cc: David Airlie 
Signed-off-by: Dave Airlie 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/nouveau/nouveau_display.c |3 ++-
 drivers/gpu/drm/nouveau/nouveau_drm.c |5 -
 2 files changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -370,7 +370,8 @@ nouveau_display_init(struct drm_device *
return ret;
 
/* enable polling for external displays */
-   drm_kms_helper_poll_enable(dev);
+   if (!dev->mode_config.poll_enabled)
+   drm_kms_helper_poll_enable(dev);
 
/* enable hotplug interrupts */
list_for_each_entry(connector, >mode_config.connector_list, head) {
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -743,7 +743,10 @@ nouveau_pmops_runtime_resume(struct devi
pci_set_master(pdev);
 
ret = nouveau_do_resume(drm_dev, true);
-   drm_kms_helper_poll_enable(drm_dev);
+
+   if (!drm_dev->mode_config.poll_enabled)
+   drm_kms_helper_poll_enable(drm_dev);
+
/* do magic */
nvif_mask(>object, 0x088488, (1 << 25), (1 << 25));
vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON);

[PATCH 4.4 33/46] drm/nouveau: Dont enabling polling twice on runtime resume

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Lyude Paul 


[ Upstream commit cae9ff036eea577856d5b12860b4c79c5e71db4a ]

As it turns out, on cards that actually have CRTCs on them we're already
calling drm_kms_helper_poll_enable(drm_dev) from
nouveau_display_resume() before we call it in
nouveau_pmops_runtime_resume(). This leads us to accidentally trying to
enable polling twice, which results in a potential deadlock between the
RPM locks and drm_dev->mode_config.mutex if we end up trying to enable
polling the second time while output_poll_execute is running and holding
the mode_config lock. As such, make sure we only enable polling in
nouveau_pmops_runtime_resume() if we need to.

This fixes hangs observed on the ThinkPad W541

Signed-off-by: Lyude 
Cc: Hans de Goede 
Cc: Kilian Singer 
Cc: Lukas Wunner 
Cc: David Airlie 
Signed-off-by: Dave Airlie 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/nouveau/nouveau_display.c |3 ++-
 drivers/gpu/drm/nouveau/nouveau_drm.c |5 -
 2 files changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -370,7 +370,8 @@ nouveau_display_init(struct drm_device *
return ret;
 
/* enable polling for external displays */
-   drm_kms_helper_poll_enable(dev);
+   if (!dev->mode_config.poll_enabled)
+   drm_kms_helper_poll_enable(dev);
 
/* enable hotplug interrupts */
list_for_each_entry(connector, >mode_config.connector_list, head) {
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -743,7 +743,10 @@ nouveau_pmops_runtime_resume(struct devi
pci_set_master(pdev);
 
ret = nouveau_do_resume(drm_dev, true);
-   drm_kms_helper_poll_enable(drm_dev);
+
+   if (!drm_dev->mode_config.poll_enabled)
+   drm_kms_helper_poll_enable(drm_dev);
+
/* do magic */
nvif_mask(>object, 0x088488, (1 << 25), (1 << 25));
vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON);

[PATCH 4.4 07/46] net: xilinx_emaclite: fix receive buffer overflow

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Anssi Hannula 


[ Upstream commit cd224553641848dd17800fe559e4ff5d208553e8 ]

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula 
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/xilinx/xilinx_emaclite.c |   10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -379,7 +379,7 @@ static int xemaclite_send_data(struct ne
  *
  * Return: Total number of bytes received
  */
-static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
+static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
 {
void __iomem *addr;
u16 length, proto_type;
@@ -419,7 +419,7 @@ static u16 xemaclite_recv_data(struct ne
 
/* Check if received ethernet frame is a raw ethernet frame
 * or an IP packet or an ARP packet */
-   if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) {
+   if (proto_type > ETH_DATA_LEN) {
 
if (proto_type == ETH_P_IP) {
length = ((ntohl(xemaclite_readl(addr +
@@ -427,6 +427,7 @@ static u16 xemaclite_recv_data(struct ne
XEL_RXBUFF_OFFSET)) >>
XEL_HEADER_SHIFT) &
XEL_RPLR_LENGTH_MASK);
+   length = min_t(u16, length, ETH_DATA_LEN);
length += ETH_HLEN + ETH_FCS_LEN;
 
} else if (proto_type == ETH_P_ARP)
@@ -439,6 +440,9 @@ static u16 xemaclite_recv_data(struct ne
/* Use the length in the frame, plus the header and trailer */
length = proto_type + ETH_HLEN + ETH_FCS_LEN;
 
+   if (WARN_ON(length > maxlen))
+   length = maxlen;
+
/* Read from the EmacLite device */
xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
data, length);
@@ -613,7 +617,7 @@ static void xemaclite_rx_handler(struct
 
skb_reserve(skb, 2);
 
-   len = xemaclite_recv_data(lp, (u8 *) skb->data);
+   len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
 
if (!len) {
dev->stats.rx_errors++;

[PATCH 4.4 34/46] drm/ast: Fixed system hanged if disable P2A

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: "Y.C. Chen" 


[ Upstream commit 6c971c09f38704513c426ba6515f22fb3d6c87d5 ]

The original ast driver will access some BMC configuration through P2A bridge
that can be disabled since AST2300 and after.
It will cause system hanged if P2A bridge is disabled.
Here is the update to fix it.

Signed-off-by: Y.C. Chen 
Signed-off-by: Dave Airlie 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/ast/ast_drv.h  |1 
 drivers/gpu/drm/ast/ast_main.c |  157 +
 drivers/gpu/drm/ast/ast_post.c |   18 +++-
 3 files changed, 97 insertions(+), 79 deletions(-)

--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -113,6 +113,7 @@ struct ast_private {
struct ttm_bo_kmap_obj cache_kmap;
int next_cursor;
bool support_wide_screen;
+   bool DisableP2A;
 
enum ast_tx_chip tx_chip_type;
u8 dp501_maxclk;
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -124,6 +124,12 @@ static int ast_detect_chip(struct drm_de
} else
*need_post = false;
 
+   /* Check P2A Access */
+   ast->DisableP2A = true;
+   data = ast_read32(ast, 0xf004);
+   if (data != 0x)
+   ast->DisableP2A = false;
+
/* Check if we support wide screen */
switch (ast->chip) {
case AST1180:
@@ -140,15 +146,17 @@ static int ast_detect_chip(struct drm_de
ast->support_wide_screen = true;
else {
ast->support_wide_screen = false;
-   /* Read SCU7c (silicon revision register) */
-   ast_write32(ast, 0xf004, 0x1e6e);
-   ast_write32(ast, 0xf000, 0x1);
-   data = ast_read32(ast, 0x1207c);
-   data &= 0x300;
-   if (ast->chip == AST2300 && data == 0x0) /* ast1300 */
-   ast->support_wide_screen = true;
-   if (ast->chip == AST2400 && data == 0x100) /* ast1400 */
-   ast->support_wide_screen = true;
+   if (ast->DisableP2A == false) {
+   /* Read SCU7c (silicon revision register) */
+   ast_write32(ast, 0xf004, 0x1e6e);
+   ast_write32(ast, 0xf000, 0x1);
+   data = ast_read32(ast, 0x1207c);
+   data &= 0x300;
+   if (ast->chip == AST2300 && data == 0x0) /* 
ast1300 */
+   ast->support_wide_screen = true;
+   if (ast->chip == AST2400 && data == 0x100) /* 
ast1400 */
+   ast->support_wide_screen = true;
+   }
}
break;
}
@@ -216,80 +224,81 @@ static int ast_get_dram_info(struct drm_
uint32_t data, data2;
uint32_t denum, num, div, ref_pll;
 
-   ast_write32(ast, 0xf004, 0x1e6e);
-   ast_write32(ast, 0xf000, 0x1);
-
-
-   ast_write32(ast, 0x1, 0xfc600309);
-
-   do {
-   if (pci_channel_offline(dev->pdev))
-   return -EIO;
-   } while (ast_read32(ast, 0x1) != 0x01);
-   data = ast_read32(ast, 0x10004);
-
-   if (data & 0x40)
+   if (ast->DisableP2A)
+   {
ast->dram_bus_width = 16;
+   ast->dram_type = AST_DRAM_1Gx16;
+   ast->mclk = 396;
+   }
else
-   ast->dram_bus_width = 32;
+   {
+   ast_write32(ast, 0xf004, 0x1e6e);
+   ast_write32(ast, 0xf000, 0x1);
+   data = ast_read32(ast, 0x10004);
+
+   if (data & 0x40)
+   ast->dram_bus_width = 16;
+   else
+   ast->dram_bus_width = 32;
+
+   if (ast->chip == AST2300 || ast->chip == AST2400) {
+   switch (data & 0x03) {
+   case 0:
+   ast->dram_type = AST_DRAM_512Mx16;
+   break;
+   default:
+   case 1:
+   ast->dram_type = AST_DRAM_1Gx16;
+   break;
+   case 2:
+   ast->dram_type = AST_DRAM_2Gx16;
+   break;
+   case 3:
+   ast->dram_type = AST_DRAM_4Gx16;
+   break;
+   }
+   } else {
+   switch 

[PATCH 4.4 07/46] net: xilinx_emaclite: fix receive buffer overflow

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Anssi Hannula 


[ Upstream commit cd224553641848dd17800fe559e4ff5d208553e8 ]

xilinx_emaclite looks at the received data to try to determine the
Ethernet packet length but does not properly clamp it if
proto_type == ETH_P_IP or 1500 < proto_type <= 1518, causing a buffer
overflow and a panic via skb_panic() as the length exceeds the allocated
skb size.

Fix those cases.

Also add an additional unconditional check with WARN_ON() at the end.

Signed-off-by: Anssi Hannula 
Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver")
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/xilinx/xilinx_emaclite.c |   10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -379,7 +379,7 @@ static int xemaclite_send_data(struct ne
  *
  * Return: Total number of bytes received
  */
-static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data)
+static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen)
 {
void __iomem *addr;
u16 length, proto_type;
@@ -419,7 +419,7 @@ static u16 xemaclite_recv_data(struct ne
 
/* Check if received ethernet frame is a raw ethernet frame
 * or an IP packet or an ARP packet */
-   if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) {
+   if (proto_type > ETH_DATA_LEN) {
 
if (proto_type == ETH_P_IP) {
length = ((ntohl(xemaclite_readl(addr +
@@ -427,6 +427,7 @@ static u16 xemaclite_recv_data(struct ne
XEL_RXBUFF_OFFSET)) >>
XEL_HEADER_SHIFT) &
XEL_RPLR_LENGTH_MASK);
+   length = min_t(u16, length, ETH_DATA_LEN);
length += ETH_HLEN + ETH_FCS_LEN;
 
} else if (proto_type == ETH_P_ARP)
@@ -439,6 +440,9 @@ static u16 xemaclite_recv_data(struct ne
/* Use the length in the frame, plus the header and trailer */
length = proto_type + ETH_HLEN + ETH_FCS_LEN;
 
+   if (WARN_ON(length > maxlen))
+   length = maxlen;
+
/* Read from the EmacLite device */
xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET),
data, length);
@@ -613,7 +617,7 @@ static void xemaclite_rx_handler(struct
 
skb_reserve(skb, 2);
 
-   len = xemaclite_recv_data(lp, (u8 *) skb->data);
+   len = xemaclite_recv_data(lp, (u8 *) skb->data, len);
 
if (!len) {
dev->stats.rx_errors++;

[PATCH 4.4 34/46] drm/ast: Fixed system hanged if disable P2A

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: "Y.C. Chen" 


[ Upstream commit 6c971c09f38704513c426ba6515f22fb3d6c87d5 ]

The original ast driver will access some BMC configuration through P2A bridge
that can be disabled since AST2300 and after.
It will cause system hanged if P2A bridge is disabled.
Here is the update to fix it.

Signed-off-by: Y.C. Chen 
Signed-off-by: Dave Airlie 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/gpu/drm/ast/ast_drv.h  |1 
 drivers/gpu/drm/ast/ast_main.c |  157 +
 drivers/gpu/drm/ast/ast_post.c |   18 +++-
 3 files changed, 97 insertions(+), 79 deletions(-)

--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -113,6 +113,7 @@ struct ast_private {
struct ttm_bo_kmap_obj cache_kmap;
int next_cursor;
bool support_wide_screen;
+   bool DisableP2A;
 
enum ast_tx_chip tx_chip_type;
u8 dp501_maxclk;
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -124,6 +124,12 @@ static int ast_detect_chip(struct drm_de
} else
*need_post = false;
 
+   /* Check P2A Access */
+   ast->DisableP2A = true;
+   data = ast_read32(ast, 0xf004);
+   if (data != 0x)
+   ast->DisableP2A = false;
+
/* Check if we support wide screen */
switch (ast->chip) {
case AST1180:
@@ -140,15 +146,17 @@ static int ast_detect_chip(struct drm_de
ast->support_wide_screen = true;
else {
ast->support_wide_screen = false;
-   /* Read SCU7c (silicon revision register) */
-   ast_write32(ast, 0xf004, 0x1e6e);
-   ast_write32(ast, 0xf000, 0x1);
-   data = ast_read32(ast, 0x1207c);
-   data &= 0x300;
-   if (ast->chip == AST2300 && data == 0x0) /* ast1300 */
-   ast->support_wide_screen = true;
-   if (ast->chip == AST2400 && data == 0x100) /* ast1400 */
-   ast->support_wide_screen = true;
+   if (ast->DisableP2A == false) {
+   /* Read SCU7c (silicon revision register) */
+   ast_write32(ast, 0xf004, 0x1e6e);
+   ast_write32(ast, 0xf000, 0x1);
+   data = ast_read32(ast, 0x1207c);
+   data &= 0x300;
+   if (ast->chip == AST2300 && data == 0x0) /* 
ast1300 */
+   ast->support_wide_screen = true;
+   if (ast->chip == AST2400 && data == 0x100) /* 
ast1400 */
+   ast->support_wide_screen = true;
+   }
}
break;
}
@@ -216,80 +224,81 @@ static int ast_get_dram_info(struct drm_
uint32_t data, data2;
uint32_t denum, num, div, ref_pll;
 
-   ast_write32(ast, 0xf004, 0x1e6e);
-   ast_write32(ast, 0xf000, 0x1);
-
-
-   ast_write32(ast, 0x1, 0xfc600309);
-
-   do {
-   if (pci_channel_offline(dev->pdev))
-   return -EIO;
-   } while (ast_read32(ast, 0x1) != 0x01);
-   data = ast_read32(ast, 0x10004);
-
-   if (data & 0x40)
+   if (ast->DisableP2A)
+   {
ast->dram_bus_width = 16;
+   ast->dram_type = AST_DRAM_1Gx16;
+   ast->mclk = 396;
+   }
else
-   ast->dram_bus_width = 32;
+   {
+   ast_write32(ast, 0xf004, 0x1e6e);
+   ast_write32(ast, 0xf000, 0x1);
+   data = ast_read32(ast, 0x10004);
+
+   if (data & 0x40)
+   ast->dram_bus_width = 16;
+   else
+   ast->dram_bus_width = 32;
+
+   if (ast->chip == AST2300 || ast->chip == AST2400) {
+   switch (data & 0x03) {
+   case 0:
+   ast->dram_type = AST_DRAM_512Mx16;
+   break;
+   default:
+   case 1:
+   ast->dram_type = AST_DRAM_1Gx16;
+   break;
+   case 2:
+   ast->dram_type = AST_DRAM_2Gx16;
+   break;
+   case 3:
+   ast->dram_type = AST_DRAM_4Gx16;
+   break;
+   }
+   } else {
+   switch (data & 0x0c) {
+   case 0:
+   case 4:
+   ast->dram_type 

Re: [PATCH 2/2] Input: pm8941-pwrkey: Introduce reboot mode support

[Bjorn Andersson]

On Thu 15 Jun 09:26 PDT 2017, Sebastian Reichel wrote:

> Hi,
> 
> On Mon, Jun 12, 2017 at 04:32:03PM -0700, Bjorn Andersson wrote:
[..]
> > As such if we split the non-input related handling into another driver
> > we would need to make the input driver create a subdevice during probe -
> > or create a new pon-driver with a new compatible that internally spawns
> > the pwrkey driver. Neither seems desirable to me...
> 
> The pon-driver would have been the proper solution, but with the
> binding already being defined that's no longer a nice option :(
> 

We have a binding for the "qcom,pm8941-pwrkey", but as long as we
maintain the compatibility in the input driver with this we could come
up with a new binding for the "pon" block.

> > The features of the PON block not yet shown on LKML are status registers
> > to indicate the reason for powering up the PMIC and a watchdog (which I
> > don't believe is used or exposed today).
> 
> So we have a block, which has watchdog, powerdown, reboot, boot-reason,
> reboot-mode and power key. To me that does not look like it should be
> one driver.
> 

Unfortunately I do agree with this.

It would make sense to describe the pon in a single DT-node and have a
pon-driver spawning off individual driver for each functionality. That
way we get a clean representation in DT and we get clean implementation
of each component...

Regards,
Bjorn

Re: [PATCH 2/2] Input: pm8941-pwrkey: Introduce reboot mode support

[Bjorn Andersson]

On Thu 15 Jun 09:26 PDT 2017, Sebastian Reichel wrote:

> Hi,
> 
> On Mon, Jun 12, 2017 at 04:32:03PM -0700, Bjorn Andersson wrote:
[..]
> > As such if we split the non-input related handling into another driver
> > we would need to make the input driver create a subdevice during probe -
> > or create a new pon-driver with a new compatible that internally spawns
> > the pwrkey driver. Neither seems desirable to me...
> 
> The pon-driver would have been the proper solution, but with the
> binding already being defined that's no longer a nice option :(
> 

We have a binding for the "qcom,pm8941-pwrkey", but as long as we
maintain the compatibility in the input driver with this we could come
up with a new binding for the "pon" block.

> > The features of the PON block not yet shown on LKML are status registers
> > to indicate the reason for powering up the PMIC and a watchdog (which I
> > don't believe is used or exposed today).
> 
> So we have a block, which has watchdog, powerdown, reboot, boot-reason,
> reboot-mode and power key. To me that does not look like it should be
> one driver.
> 

Unfortunately I do agree with this.

It would make sense to describe the pon in a single DT-node and have a
pon-driver spawning off individual driver for each functionality. That
way we get a clean representation in DT and we get clean implementation
of each component...

Regards,
Bjorn

[PATCH 4.4 35/46] ravb: unmap descriptors when freeing rings

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Kazuya Mizuguchi 


[ Upstream commit a47b70ea86bdeb3091341f5ae3ef580f1a1ad822 ]

"swiotlb buffer is full" errors occur after repeated initialisation of a
device - f.e. suspend/resume or ip link set up/down. This is because memory
mapped using dma_map_single() in ravb_ring_format() and ravb_start_xmit()
is not released.  Resolve this problem by unmapping descriptors when
freeing rings.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Kazuya Mizuguchi 
[simon: reworked]
Signed-off-by: Simon Horman 
Acked-by: Sergei Shtylyov 
Signed-off-by: David S. Miller 

Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/renesas/ravb_main.c |  112 +--
 1 file changed, 64 insertions(+), 48 deletions(-)

--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -171,6 +171,49 @@ static struct mdiobb_ops bb_ops = {
.get_mdio_data = ravb_get_mdio_data,
 };
 
+/* Free TX skb function for AVB-IP */
+static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only)
+{
+   struct ravb_private *priv = netdev_priv(ndev);
+   struct net_device_stats *stats = >stats[q];
+   struct ravb_tx_desc *desc;
+   int free_num = 0;
+   int entry;
+   u32 size;
+
+   for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
+   bool txed;
+
+   entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] *
+NUM_TX_DESC);
+   desc = >tx_ring[q][entry];
+   txed = desc->die_dt == DT_FEMPTY;
+   if (free_txed_only && !txed)
+   break;
+   /* Descriptor type must be checked before all other reads */
+   dma_rmb();
+   size = le16_to_cpu(desc->ds_tagl) & TX_DS;
+   /* Free the original skb. */
+   if (priv->tx_skb[q][entry / NUM_TX_DESC]) {
+   dma_unmap_single(ndev->dev.parent, 
le32_to_cpu(desc->dptr),
+size, DMA_TO_DEVICE);
+   /* Last packet descriptor? */
+   if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) {
+   entry /= NUM_TX_DESC;
+   dev_kfree_skb_any(priv->tx_skb[q][entry]);
+   priv->tx_skb[q][entry] = NULL;
+   if (txed)
+   stats->tx_packets++;
+   }
+   free_num++;
+   }
+   if (txed)
+   stats->tx_bytes += size;
+   desc->die_dt = DT_EEMPTY;
+   }
+   return free_num;
+}
+
 /* Free skb's and DMA buffers for Ethernet AVB */
 static void ravb_ring_free(struct net_device *ndev, int q)
 {
@@ -186,19 +229,21 @@ static void ravb_ring_free(struct net_de
kfree(priv->rx_skb[q]);
priv->rx_skb[q] = NULL;
 
-   /* Free TX skb ringbuffer */
-   if (priv->tx_skb[q]) {
-   for (i = 0; i < priv->num_tx_ring[q]; i++)
-   dev_kfree_skb(priv->tx_skb[q][i]);
-   }
-   kfree(priv->tx_skb[q]);
-   priv->tx_skb[q] = NULL;
-
/* Free aligned TX buffers */
kfree(priv->tx_align[q]);
priv->tx_align[q] = NULL;
 
if (priv->rx_ring[q]) {
+   for (i = 0; i < priv->num_rx_ring[q]; i++) {
+   struct ravb_ex_rx_desc *desc = >rx_ring[q][i];
+
+   if (!dma_mapping_error(ndev->dev.parent,
+  le32_to_cpu(desc->dptr)))
+   dma_unmap_single(ndev->dev.parent,
+le32_to_cpu(desc->dptr),
+PKT_BUF_SZ,
+DMA_FROM_DEVICE);
+   }
ring_size = sizeof(struct ravb_ex_rx_desc) *
(priv->num_rx_ring[q] + 1);
dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q],
@@ -207,12 +252,20 @@ static void ravb_ring_free(struct net_de
}
 
if (priv->tx_ring[q]) {
+   ravb_tx_free(ndev, q, false);
+
ring_size = sizeof(struct ravb_tx_desc) *
(priv->num_tx_ring[q] * NUM_TX_DESC + 1);
dma_free_coherent(ndev->dev.parent, ring_size, priv->tx_ring[q],
  priv->tx_desc_dma[q]);
priv->tx_ring[q] = NULL;
}
+
+   /* Free 

[PATCH 4.4 35/46] ravb: unmap descriptors when freeing rings

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Kazuya Mizuguchi 


[ Upstream commit a47b70ea86bdeb3091341f5ae3ef580f1a1ad822 ]

"swiotlb buffer is full" errors occur after repeated initialisation of a
device - f.e. suspend/resume or ip link set up/down. This is because memory
mapped using dma_map_single() in ravb_ring_format() and ravb_start_xmit()
is not released.  Resolve this problem by unmapping descriptors when
freeing rings.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Kazuya Mizuguchi 
[simon: reworked]
Signed-off-by: Simon Horman 
Acked-by: Sergei Shtylyov 
Signed-off-by: David S. Miller 

Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/renesas/ravb_main.c |  112 +--
 1 file changed, 64 insertions(+), 48 deletions(-)

--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -171,6 +171,49 @@ static struct mdiobb_ops bb_ops = {
.get_mdio_data = ravb_get_mdio_data,
 };
 
+/* Free TX skb function for AVB-IP */
+static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only)
+{
+   struct ravb_private *priv = netdev_priv(ndev);
+   struct net_device_stats *stats = >stats[q];
+   struct ravb_tx_desc *desc;
+   int free_num = 0;
+   int entry;
+   u32 size;
+
+   for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
+   bool txed;
+
+   entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] *
+NUM_TX_DESC);
+   desc = >tx_ring[q][entry];
+   txed = desc->die_dt == DT_FEMPTY;
+   if (free_txed_only && !txed)
+   break;
+   /* Descriptor type must be checked before all other reads */
+   dma_rmb();
+   size = le16_to_cpu(desc->ds_tagl) & TX_DS;
+   /* Free the original skb. */
+   if (priv->tx_skb[q][entry / NUM_TX_DESC]) {
+   dma_unmap_single(ndev->dev.parent, 
le32_to_cpu(desc->dptr),
+size, DMA_TO_DEVICE);
+   /* Last packet descriptor? */
+   if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) {
+   entry /= NUM_TX_DESC;
+   dev_kfree_skb_any(priv->tx_skb[q][entry]);
+   priv->tx_skb[q][entry] = NULL;
+   if (txed)
+   stats->tx_packets++;
+   }
+   free_num++;
+   }
+   if (txed)
+   stats->tx_bytes += size;
+   desc->die_dt = DT_EEMPTY;
+   }
+   return free_num;
+}
+
 /* Free skb's and DMA buffers for Ethernet AVB */
 static void ravb_ring_free(struct net_device *ndev, int q)
 {
@@ -186,19 +229,21 @@ static void ravb_ring_free(struct net_de
kfree(priv->rx_skb[q]);
priv->rx_skb[q] = NULL;
 
-   /* Free TX skb ringbuffer */
-   if (priv->tx_skb[q]) {
-   for (i = 0; i < priv->num_tx_ring[q]; i++)
-   dev_kfree_skb(priv->tx_skb[q][i]);
-   }
-   kfree(priv->tx_skb[q]);
-   priv->tx_skb[q] = NULL;
-
/* Free aligned TX buffers */
kfree(priv->tx_align[q]);
priv->tx_align[q] = NULL;
 
if (priv->rx_ring[q]) {
+   for (i = 0; i < priv->num_rx_ring[q]; i++) {
+   struct ravb_ex_rx_desc *desc = >rx_ring[q][i];
+
+   if (!dma_mapping_error(ndev->dev.parent,
+  le32_to_cpu(desc->dptr)))
+   dma_unmap_single(ndev->dev.parent,
+le32_to_cpu(desc->dptr),
+PKT_BUF_SZ,
+DMA_FROM_DEVICE);
+   }
ring_size = sizeof(struct ravb_ex_rx_desc) *
(priv->num_rx_ring[q] + 1);
dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q],
@@ -207,12 +252,20 @@ static void ravb_ring_free(struct net_de
}
 
if (priv->tx_ring[q]) {
+   ravb_tx_free(ndev, q, false);
+
ring_size = sizeof(struct ravb_tx_desc) *
(priv->num_tx_ring[q] * NUM_TX_DESC + 1);
dma_free_coherent(ndev->dev.parent, ring_size, priv->tx_ring[q],
  priv->tx_desc_dma[q]);
priv->tx_ring[q] = NULL;
}
+
+   /* Free TX skb ringbuffer.
+* SKBs are freed by ravb_tx_free() call above.
+*/
+   kfree(priv->tx_skb[q]);
+   priv->tx_skb[q] = NULL;
 }
 
 /* Format skb and descriptor buffer for Ethernet AVB 

[PATCH 4.4 32/46] parisc, parport_gsc: Fixes for printk continuation lines

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Helge Deller 


[ Upstream commit 83b5d1e3d3013dbf90645a5d07179d018c8243fa ]

Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/parport/parport_gsc.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -293,7 +293,7 @@ struct parport *parport_gsc_probe_port(u
p->irq = PARPORT_IRQ_NONE;
}
if (p->irq != PARPORT_IRQ_NONE) {
-   printk(", irq %d", p->irq);
+   pr_cont(", irq %d", p->irq);
 
if (p->dma == PARPORT_DMA_AUTO) {
p->dma = PARPORT_DMA_NONE;
@@ -303,8 +303,8 @@ struct parport *parport_gsc_probe_port(u
is mandatory (see above) */
p->dma = PARPORT_DMA_NONE;
 
-   printk(" [");
-#define printmode(x) 
{if(p->modes_MODE_##x){printk("%s%s",f?",":"",#x);f++;}}
+   pr_cont(" [");
+#define printmode(x) 
{if(p->modes_MODE_##x){pr_cont("%s%s",f?",":"",#x);f++;}}
{
int f = 0;
printmode(PCSPP);
@@ -315,7 +315,7 @@ struct parport *parport_gsc_probe_port(u
 // printmode(DMA);
}
 #undef printmode
-   printk("]\n");
+   pr_cont("]\n");
 
if (p->irq != PARPORT_IRQ_NONE) {
if (request_irq (p->irq, parport_irq_handler,

[PATCH 4.4 08/46] ipv6: Handle IPv4-mapped src to in6addr_any dst.

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: "Jonathan T. Leighton" 


[ Upstream commit 052d2369d1b479cdbbe020fdd6d057d3c342db74 ]

This patch adds a check on the type of the source address for the case
where the destination address is in6addr_any. If the source is an
IPv4-mapped IPv6 source address, the destination is changed to
:::127.0.0.1, and otherwise the destination is changed to ::1. This
is done in three locations to handle UDP calls to either connect() or
sendmsg() and TCP calls to connect(). Note that udpv6_sendmsg() delays
handling an in6addr_any destination until very late, so the patch only
needs to handle the case where the source is an IPv4-mapped IPv6
address.

Signed-off-by: Jonathan T. Leighton 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv6/datagram.c |   14 +-
 net/ipv6/tcp_ipv6.c |   11 ---
 net/ipv6/udp.c  |4 
 3 files changed, 21 insertions(+), 8 deletions(-)

--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -76,18 +76,22 @@ static int __ip6_datagram_connect(struct
}
}
 
-   addr_type = ipv6_addr_type(>sin6_addr);
-
-   if (addr_type == IPV6_ADDR_ANY) {
+   if (ipv6_addr_any(>sin6_addr)) {
/*
 *  connect to self
 */
-   usin->sin6_addr.s6_addr[15] = 0x01;
+   if (ipv6_addr_v4mapped(>sk_v6_rcv_saddr))
+   ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+  >sin6_addr);
+   else
+   usin->sin6_addr = in6addr_loopback;
}
 
+   addr_type = ipv6_addr_type(>sin6_addr);
+
daddr = >sin6_addr;
 
-   if (addr_type == IPV6_ADDR_MAPPED) {
+   if (addr_type & IPV6_ADDR_MAPPED) {
struct sockaddr_in sin;
 
if (__ipv6_only_sock(sk)) {
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -149,8 +149,13 @@ static int tcp_v6_connect(struct sock *s
 *  connect() to INADDR_ANY means loopback (BSD'ism).
 */
 
-   if (ipv6_addr_any(>sin6_addr))
-   usin->sin6_addr.s6_addr[15] = 0x1;
+   if (ipv6_addr_any(>sin6_addr)) {
+   if (ipv6_addr_v4mapped(>sk_v6_rcv_saddr))
+   ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+  >sin6_addr);
+   else
+   usin->sin6_addr = in6addr_loopback;
+   }
 
addr_type = ipv6_addr_type(>sin6_addr);
 
@@ -189,7 +194,7 @@ static int tcp_v6_connect(struct sock *s
 *  TCP over IPv4
 */
 
-   if (addr_type == IPV6_ADDR_MAPPED) {
+   if (addr_type & IPV6_ADDR_MAPPED) {
u32 exthdrlen = icsk->icsk_ext_hdr_len;
struct sockaddr_in sin;
 
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1136,6 +1136,10 @@ int udpv6_sendmsg(struct sock *sk, struc
if (addr_len < SIN6_LEN_RFC2133)
return -EINVAL;
daddr = >sin6_addr;
+   if (ipv6_addr_any(daddr) &&
+   ipv6_addr_v4mapped(>saddr))
+   ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+  daddr);
break;
case AF_INET:
goto do_udp_sendmsg;

[PATCH 4.4 32/46] parisc, parport_gsc: Fixes for printk continuation lines

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Helge Deller 


[ Upstream commit 83b5d1e3d3013dbf90645a5d07179d018c8243fa ]

Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/parport/parport_gsc.c |8 
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -293,7 +293,7 @@ struct parport *parport_gsc_probe_port(u
p->irq = PARPORT_IRQ_NONE;
}
if (p->irq != PARPORT_IRQ_NONE) {
-   printk(", irq %d", p->irq);
+   pr_cont(", irq %d", p->irq);
 
if (p->dma == PARPORT_DMA_AUTO) {
p->dma = PARPORT_DMA_NONE;
@@ -303,8 +303,8 @@ struct parport *parport_gsc_probe_port(u
is mandatory (see above) */
p->dma = PARPORT_DMA_NONE;
 
-   printk(" [");
-#define printmode(x) 
{if(p->modes_MODE_##x){printk("%s%s",f?",":"",#x);f++;}}
+   pr_cont(" [");
+#define printmode(x) 
{if(p->modes_MODE_##x){pr_cont("%s%s",f?",":"",#x);f++;}}
{
int f = 0;
printmode(PCSPP);
@@ -315,7 +315,7 @@ struct parport *parport_gsc_probe_port(u
 // printmode(DMA);
}
 #undef printmode
-   printk("]\n");
+   pr_cont("]\n");
 
if (p->irq != PARPORT_IRQ_NONE) {
if (request_irq (p->irq, parport_irq_handler,

[PATCH 4.4 08/46] ipv6: Handle IPv4-mapped src to in6addr_any dst.

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: "Jonathan T. Leighton" 


[ Upstream commit 052d2369d1b479cdbbe020fdd6d057d3c342db74 ]

This patch adds a check on the type of the source address for the case
where the destination address is in6addr_any. If the source is an
IPv4-mapped IPv6 source address, the destination is changed to
:::127.0.0.1, and otherwise the destination is changed to ::1. This
is done in three locations to handle UDP calls to either connect() or
sendmsg() and TCP calls to connect(). Note that udpv6_sendmsg() delays
handling an in6addr_any destination until very late, so the patch only
needs to handle the case where the source is an IPv4-mapped IPv6
address.

Signed-off-by: Jonathan T. Leighton 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv6/datagram.c |   14 +-
 net/ipv6/tcp_ipv6.c |   11 ---
 net/ipv6/udp.c  |4 
 3 files changed, 21 insertions(+), 8 deletions(-)

--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -76,18 +76,22 @@ static int __ip6_datagram_connect(struct
}
}
 
-   addr_type = ipv6_addr_type(>sin6_addr);
-
-   if (addr_type == IPV6_ADDR_ANY) {
+   if (ipv6_addr_any(>sin6_addr)) {
/*
 *  connect to self
 */
-   usin->sin6_addr.s6_addr[15] = 0x01;
+   if (ipv6_addr_v4mapped(>sk_v6_rcv_saddr))
+   ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+  >sin6_addr);
+   else
+   usin->sin6_addr = in6addr_loopback;
}
 
+   addr_type = ipv6_addr_type(>sin6_addr);
+
daddr = >sin6_addr;
 
-   if (addr_type == IPV6_ADDR_MAPPED) {
+   if (addr_type & IPV6_ADDR_MAPPED) {
struct sockaddr_in sin;
 
if (__ipv6_only_sock(sk)) {
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -149,8 +149,13 @@ static int tcp_v6_connect(struct sock *s
 *  connect() to INADDR_ANY means loopback (BSD'ism).
 */
 
-   if (ipv6_addr_any(>sin6_addr))
-   usin->sin6_addr.s6_addr[15] = 0x1;
+   if (ipv6_addr_any(>sin6_addr)) {
+   if (ipv6_addr_v4mapped(>sk_v6_rcv_saddr))
+   ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+  >sin6_addr);
+   else
+   usin->sin6_addr = in6addr_loopback;
+   }
 
addr_type = ipv6_addr_type(>sin6_addr);
 
@@ -189,7 +194,7 @@ static int tcp_v6_connect(struct sock *s
 *  TCP over IPv4
 */
 
-   if (addr_type == IPV6_ADDR_MAPPED) {
+   if (addr_type & IPV6_ADDR_MAPPED) {
u32 exthdrlen = icsk->icsk_ext_hdr_len;
struct sockaddr_in sin;
 
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1136,6 +1136,10 @@ int udpv6_sendmsg(struct sock *sk, struc
if (addr_len < SIN6_LEN_RFC2133)
return -EINVAL;
daddr = >sin6_addr;
+   if (ipv6_addr_any(daddr) &&
+   ipv6_addr_v4mapped(>saddr))
+   ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+  daddr);
break;
case AF_INET:
goto do_udp_sendmsg;

[PATCH 4.4 30/46] pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Jisheng Zhang 


[ Upstream commit e82d02580af45663fad6d3596e4344c606e81e10 ]

This should be a typo.

Signed-off-by: Jisheng Zhang 
Signed-off-by: Linus Walleij 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/pinctrl/berlin/berlin-bg4ct.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/berlin/berlin-bg4ct.c
+++ b/drivers/pinctrl/berlin/berlin-bg4ct.c
@@ -217,7 +217,7 @@ static const struct berlin_desc_group be
BERLIN_PINCTRL_GROUP("SCRD0_CRD_PRES", 0xc, 0x3, 0x15,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"), /* GPIO20 */
BERLIN_PINCTRL_FUNCTION(0x1, "scrd0"), /* crd pres */
-   BERLIN_PINCTRL_FUNCTION(0x1, "sd1a")), /* DAT3 */
+   BERLIN_PINCTRL_FUNCTION(0x3, "sd1a")), /* DAT3 */
BERLIN_PINCTRL_GROUP("SPI1_SS0n", 0xc, 0x3, 0x18,
BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */
BERLIN_PINCTRL_FUNCTION(0x1, "gpio"), /* GPIO37 */

[PATCH 4.4 30/46] pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Jisheng Zhang 


[ Upstream commit e82d02580af45663fad6d3596e4344c606e81e10 ]

This should be a typo.

Signed-off-by: Jisheng Zhang 
Signed-off-by: Linus Walleij 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/pinctrl/berlin/berlin-bg4ct.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/berlin/berlin-bg4ct.c
+++ b/drivers/pinctrl/berlin/berlin-bg4ct.c
@@ -217,7 +217,7 @@ static const struct berlin_desc_group be
BERLIN_PINCTRL_GROUP("SCRD0_CRD_PRES", 0xc, 0x3, 0x15,
BERLIN_PINCTRL_FUNCTION(0x0, "gpio"), /* GPIO20 */
BERLIN_PINCTRL_FUNCTION(0x1, "scrd0"), /* crd pres */
-   BERLIN_PINCTRL_FUNCTION(0x1, "sd1a")), /* DAT3 */
+   BERLIN_PINCTRL_FUNCTION(0x3, "sd1a")), /* DAT3 */
BERLIN_PINCTRL_GROUP("SPI1_SS0n", 0xc, 0x3, 0x18,
BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */
BERLIN_PINCTRL_FUNCTION(0x1, "gpio"), /* GPIO37 */

[PATCH 4.4 12/46] net: hns: Fix the device being used for dma mapping during TX

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Kejian Yan 


[ Upstream commit b85ea006b6bebb692628f11882af41c3e12e1e09 ]

This patch fixes the device being used to DMA map skb->data.
Erroneous device assignment causes the crash when SMMU is enabled.
This happens during TX since buffer gets DMA mapped with device
correspondign to net_device and gets unmapped using the device
related to DSAF.

Signed-off-by: Kejian Yan 
Reviewed-by: Yisen Zhuang 
Signed-off-by: Salil Mehta 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -105,8 +105,8 @@ int hns_nic_net_xmit_hw(struct net_devic
struct hns_nic_ring_data *ring_data)
 {
struct hns_nic_priv *priv = netdev_priv(ndev);
-   struct device *dev = priv->dev;
struct hnae_ring *ring = ring_data->ring;
+   struct device *dev = ring_to_dev(ring);
struct netdev_queue *dev_queue;
struct skb_frag_struct *frag;
int buf_num;

[PATCH 4.4 12/46] net: hns: Fix the device being used for dma mapping during TX

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Kejian Yan 


[ Upstream commit b85ea006b6bebb692628f11882af41c3e12e1e09 ]

This patch fixes the device being used to DMA map skb->data.
Erroneous device assignment causes the crash when SMMU is enabled.
This happens during TX since buffer gets DMA mapped with device
correspondign to net_device and gets unmapped using the device
related to DSAF.

Signed-off-by: Kejian Yan 
Reviewed-by: Yisen Zhuang 
Signed-off-by: Salil Mehta 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -105,8 +105,8 @@ int hns_nic_net_xmit_hw(struct net_devic
struct hns_nic_ring_data *ring_data)
 {
struct hns_nic_priv *priv = netdev_priv(ndev);
-   struct device *dev = priv->dev;
struct hnae_ring *ring = ring_data->ring;
+   struct device *dev = ring_to_dev(ring);
struct netdev_queue *dev_queue;
struct skb_frag_struct *frag;
int buf_num;

[PATCH 0/4] i2c: document DMA handling and add helpers for it

[Wolfram Sang]

So, after revisiting old mail threads and taking part in a similar discussion
on the USB list, here is what I cooked up to document and ease DMA handling for
I2C within Linux. Please have a look at the documentation introduced in patch 2
for further details.

The branch can be found here:

git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git 
renesas/topic/i2c-core-dma

And big kudos to Renesas Electronics for funding this work, thank you very much!

Regards,

   Wolfram

Changes since RFC:

* the helper i2c_check_msg_for_dma() can optionally take a pointer and then it
  will attach a bounce buffer to it in case the message buffer is not DMA safe
* a second helper was added. i2c_release_bounce_buf() will copy data back to
  the message buffer and release the bounce buffer
* the documentation has been extended to match the above
* no ifdeffery around CONFIG_DMA_API_DEBUG anymore. The I2C core behaviour
  should not depend on such symbols.
* the i2c-sh_mobile driver has been updated to use bounce buffers


Wolfram Sang (4):
  i2c: add helpers to ease DMA handling
  i2c: add docs to clarify DMA handling
  i2c: sh_mobile: use helper to decide if DMA is useful
  i2c: rcar: check for DMA-capable buffers

 Documentation/i2c/DMA-considerations | 37 
 drivers/i2c/busses/i2c-rcar.c| 18 +++---
 drivers/i2c/busses/i2c-sh_mobile.c   |  8 +++--
 include/linux/i2c.h  | 65 
 4 files changed, 121 insertions(+), 7 deletions(-)
 create mode 100644 Documentation/i2c/DMA-considerations

-- 
2.11.0

[PATCH 0/4] i2c: document DMA handling and add helpers for it

[Wolfram Sang]

So, after revisiting old mail threads and taking part in a similar discussion
on the USB list, here is what I cooked up to document and ease DMA handling for
I2C within Linux. Please have a look at the documentation introduced in patch 2
for further details.

The branch can be found here:

git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git 
renesas/topic/i2c-core-dma

And big kudos to Renesas Electronics for funding this work, thank you very much!

Regards,

   Wolfram

Changes since RFC:

* the helper i2c_check_msg_for_dma() can optionally take a pointer and then it
  will attach a bounce buffer to it in case the message buffer is not DMA safe
* a second helper was added. i2c_release_bounce_buf() will copy data back to
  the message buffer and release the bounce buffer
* the documentation has been extended to match the above
* no ifdeffery around CONFIG_DMA_API_DEBUG anymore. The I2C core behaviour
  should not depend on such symbols.
* the i2c-sh_mobile driver has been updated to use bounce buffers


Wolfram Sang (4):
  i2c: add helpers to ease DMA handling
  i2c: add docs to clarify DMA handling
  i2c: sh_mobile: use helper to decide if DMA is useful
  i2c: rcar: check for DMA-capable buffers

 Documentation/i2c/DMA-considerations | 37 
 drivers/i2c/busses/i2c-rcar.c| 18 +++---
 drivers/i2c/busses/i2c-sh_mobile.c   |  8 +++--
 include/linux/i2c.h  | 65 
 4 files changed, 121 insertions(+), 7 deletions(-)
 create mode 100644 Documentation/i2c/DMA-considerations

-- 
2.11.0

Re: [PATCH net-next 0/3] r8152: support new chips

[David Miller]

From: Hayes Wang 
Date: Thu, 15 Jun 2017 14:44:01 +0800

> These patches are used to support new chips.

Series applied, thank you.

Re: [PATCH net-next 0/3] r8152: support new chips

[David Miller]

From: Hayes Wang 
Date: Thu, 15 Jun 2017 14:44:01 +0800

> These patches are used to support new chips.

Series applied, thank you.

[PATCH 1/4] i2c: add helpers to ease DMA handling

[Wolfram Sang]

One helper checks if DMA is suitable and optionally creates a bounce
buffer, if not. The other function returns the bounce buffer and makes
sure the data is properly copied back to the message.

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 include/linux/i2c.h | 65 +
 1 file changed, 65 insertions(+)

diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 72d0ece70ed30d..7204d38eaff07c 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -33,7 +33,10 @@
 #include 
 #include/* for Host Notify IRQ */
 #include   /* for struct device_node */
+#include 
 #include /* for swab16 */
+#include 
+#include 
 #include 
 
 extern struct bus_type i2c_bus_type;
@@ -764,6 +767,68 @@ static inline u8 i2c_8bit_addr_from_msg(const struct 
i2c_msg *msg)
return (msg->addr << 1) | (msg->flags & I2C_M_RD ? 1 : 0);
 }
 
+/**
+ * i2c_check_msg_for_dma - check if a message is suitable for DMA
+ * @msg: the message to be checked
+ * @threshold: the amount of byte from which using DMA makes sense
+ * @ptr_for_bounce_buf: if not NULL, a bounce buffer will be attached to this
+ * ptr, if needed. The bounce buffer must be freed by the
+ * caller using i2c_release_bounce_buf().
+ *
+ * Return: -ERANGE if message is smaller than threshold
+ *-EFAULT if message buffer is not DMA capable and no bounce buffer
+ *was requested
+ *-ENOMEM if a bounce buffer could not be created
+ *0 if message is suitable for DMA
+ *
+ * Note: This function should only be called from process context! It uses
+ * helper functions which work on the 'current' task.
+ */
+static inline int i2c_check_msg_for_dma(struct i2c_msg *msg, unsigned int 
threshold,
+   u8 **ptr_for_bounce_buf)
+{
+   if (ptr_for_bounce_buf)
+   *ptr_for_bounce_buf = NULL;
+
+   if (msg->len < threshold)
+   return -ERANGE;
+
+   if (!virt_addr_valid(msg->buf) || object_is_on_stack(msg->buf)) {
+   pr_debug("msg buffer to 0x%04x is not DMA safe%s\n", msg->addr,
+ptr_for_bounce_buf ? ", trying bounce buffer" : "");
+   if (ptr_for_bounce_buf) {
+   if (msg->flags & I2C_M_RD)
+   *ptr_for_bounce_buf = kzalloc(msg->len, 
GFP_KERNEL);
+   else
+   *ptr_for_bounce_buf = kmemdup(msg->buf, 
msg->len,
+ GFP_KERNEL);
+   if (!*ptr_for_bounce_buf)
+   return -ENOMEM;
+   } else {
+   return -EFAULT;
+   }
+   }
+
+   return 0;
+}
+
+/**
+ * i2c_release_bounce_buf - copy data back from bounce buffer and release it
+ * @msg: the message to be copied back to
+ * @bounce_buf: the bounce buffer obtained from i2c_check_msg_for_dma().
+ * May be NULL.
+ */
+static inline void i2c_release_bounce_buf(struct i2c_msg *msg, u8 *bounce_buf)
+{
+   if (!bounce_buf)
+   return;
+
+   if (msg->flags & I2C_M_RD)
+   memcpy(msg->buf, bounce_buf, msg->len);
+
+   kfree(bounce_buf);
+}
+
 int i2c_handle_smbus_host_notify(struct i2c_adapter *adap, unsigned short 
addr);
 /**
  * module_i2c_driver() - Helper macro for registering a modular I2C driver
-- 
2.11.0

[PATCH 1/4] i2c: add helpers to ease DMA handling

[Wolfram Sang]

One helper checks if DMA is suitable and optionally creates a bounce
buffer, if not. The other function returns the bounce buffer and makes
sure the data is properly copied back to the message.

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 include/linux/i2c.h | 65 +
 1 file changed, 65 insertions(+)

diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 72d0ece70ed30d..7204d38eaff07c 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -33,7 +33,10 @@
 #include 
 #include/* for Host Notify IRQ */
 #include   /* for struct device_node */
+#include 
 #include /* for swab16 */
+#include 
+#include 
 #include 
 
 extern struct bus_type i2c_bus_type;
@@ -764,6 +767,68 @@ static inline u8 i2c_8bit_addr_from_msg(const struct 
i2c_msg *msg)
return (msg->addr << 1) | (msg->flags & I2C_M_RD ? 1 : 0);
 }
 
+/**
+ * i2c_check_msg_for_dma - check if a message is suitable for DMA
+ * @msg: the message to be checked
+ * @threshold: the amount of byte from which using DMA makes sense
+ * @ptr_for_bounce_buf: if not NULL, a bounce buffer will be attached to this
+ * ptr, if needed. The bounce buffer must be freed by the
+ * caller using i2c_release_bounce_buf().
+ *
+ * Return: -ERANGE if message is smaller than threshold
+ *-EFAULT if message buffer is not DMA capable and no bounce buffer
+ *was requested
+ *-ENOMEM if a bounce buffer could not be created
+ *0 if message is suitable for DMA
+ *
+ * Note: This function should only be called from process context! It uses
+ * helper functions which work on the 'current' task.
+ */
+static inline int i2c_check_msg_for_dma(struct i2c_msg *msg, unsigned int 
threshold,
+   u8 **ptr_for_bounce_buf)
+{
+   if (ptr_for_bounce_buf)
+   *ptr_for_bounce_buf = NULL;
+
+   if (msg->len < threshold)
+   return -ERANGE;
+
+   if (!virt_addr_valid(msg->buf) || object_is_on_stack(msg->buf)) {
+   pr_debug("msg buffer to 0x%04x is not DMA safe%s\n", msg->addr,
+ptr_for_bounce_buf ? ", trying bounce buffer" : "");
+   if (ptr_for_bounce_buf) {
+   if (msg->flags & I2C_M_RD)
+   *ptr_for_bounce_buf = kzalloc(msg->len, 
GFP_KERNEL);
+   else
+   *ptr_for_bounce_buf = kmemdup(msg->buf, 
msg->len,
+ GFP_KERNEL);
+   if (!*ptr_for_bounce_buf)
+   return -ENOMEM;
+   } else {
+   return -EFAULT;
+   }
+   }
+
+   return 0;
+}
+
+/**
+ * i2c_release_bounce_buf - copy data back from bounce buffer and release it
+ * @msg: the message to be copied back to
+ * @bounce_buf: the bounce buffer obtained from i2c_check_msg_for_dma().
+ * May be NULL.
+ */
+static inline void i2c_release_bounce_buf(struct i2c_msg *msg, u8 *bounce_buf)
+{
+   if (!bounce_buf)
+   return;
+
+   if (msg->flags & I2C_M_RD)
+   memcpy(msg->buf, bounce_buf, msg->len);
+
+   kfree(bounce_buf);
+}
+
 int i2c_handle_smbus_host_notify(struct i2c_adapter *adap, unsigned short 
addr);
 /**
  * module_i2c_driver() - Helper macro for registering a modular I2C driver
-- 
2.11.0

[PATCH 4/4] i2c: rcar: check for DMA-capable buffers

[Wolfram Sang]

Handling this is special for this driver. Because the hardware needs to
initialize the next message in interrupt context, we cannot use the
i2c_check_msg_for_dma() directly. This helper only works reliably in
process context. So, we need to check during initial preparation of the
whole transfer and need to disable DMA completely for the whole transfer
once a message with a not-DMA-capable buffer is found.

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 drivers/i2c/busses/i2c-rcar.c | 18 +-
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 8be3e6cb8fe686..2b679ba4b75066 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -111,8 +111,11 @@
 #define ID_ARBLOST (1 << 3)
 #define ID_NACK(1 << 4)
 /* persistent flags */
+#define ID_P_NODMA (1 << 30)
 #define ID_P_PM_BLOCKED(1 << 31)
-#define ID_P_MASK  ID_P_PM_BLOCKED
+#define ID_P_MASK  (ID_P_PM_BLOCKED | ID_P_NODMA)
+
+#define RCAR_DMA_THRESHOLD 8
 
 enum rcar_i2c_type {
I2C_RCAR_GEN1,
@@ -358,8 +361,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
unsigned char *buf;
int len;
 
-   /* Do not use DMA if it's not available or for messages < 8 bytes */
-   if (IS_ERR(chan) || msg->len < 8)
+   if (IS_ERR(chan) || msg->len < RCAR_DMA_THRESHOLD || priv->flags & 
ID_P_NODMA)
return;
 
if (read) {
@@ -657,11 +659,15 @@ static void rcar_i2c_request_dma(struct rcar_i2c_priv 
*priv,
 struct i2c_msg *msg)
 {
struct device *dev = rcar_i2c_priv_to_dev(priv);
-   bool read;
+   bool read = msg->flags & I2C_M_RD;
struct dma_chan *chan;
enum dma_transfer_direction dir;
 
-   read = msg->flags & I2C_M_RD;
+   /* we need to check here because we need the 'current' context */
+   if (i2c_check_msg_for_dma(msg, RCAR_DMA_THRESHOLD, NULL) == -EFAULT) {
+   dev_dbg(dev, "skipping DMA for this whole transfer\n");
+   priv->flags |= ID_P_NODMA;
+   }
 
chan = read ? priv->dma_rx : priv->dma_tx;
if (PTR_ERR(chan) != -EPROBE_DEFER)
@@ -740,6 +746,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
if (ret < 0 && ret != -ENXIO)
dev_err(dev, "error %d : %x\n", ret, priv->flags);
 
+   priv->flags &= ~ID_P_NODMA;
+
return ret;
 }
 
-- 
2.11.0

[PATCH 4/4] i2c: rcar: check for DMA-capable buffers

[Wolfram Sang]

Handling this is special for this driver. Because the hardware needs to
initialize the next message in interrupt context, we cannot use the
i2c_check_msg_for_dma() directly. This helper only works reliably in
process context. So, we need to check during initial preparation of the
whole transfer and need to disable DMA completely for the whole transfer
once a message with a not-DMA-capable buffer is found.

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 drivers/i2c/busses/i2c-rcar.c | 18 +-
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 8be3e6cb8fe686..2b679ba4b75066 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -111,8 +111,11 @@
 #define ID_ARBLOST (1 << 3)
 #define ID_NACK(1 << 4)
 /* persistent flags */
+#define ID_P_NODMA (1 << 30)
 #define ID_P_PM_BLOCKED(1 << 31)
-#define ID_P_MASK  ID_P_PM_BLOCKED
+#define ID_P_MASK  (ID_P_PM_BLOCKED | ID_P_NODMA)
+
+#define RCAR_DMA_THRESHOLD 8
 
 enum rcar_i2c_type {
I2C_RCAR_GEN1,
@@ -358,8 +361,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
unsigned char *buf;
int len;
 
-   /* Do not use DMA if it's not available or for messages < 8 bytes */
-   if (IS_ERR(chan) || msg->len < 8)
+   if (IS_ERR(chan) || msg->len < RCAR_DMA_THRESHOLD || priv->flags & 
ID_P_NODMA)
return;
 
if (read) {
@@ -657,11 +659,15 @@ static void rcar_i2c_request_dma(struct rcar_i2c_priv 
*priv,
 struct i2c_msg *msg)
 {
struct device *dev = rcar_i2c_priv_to_dev(priv);
-   bool read;
+   bool read = msg->flags & I2C_M_RD;
struct dma_chan *chan;
enum dma_transfer_direction dir;
 
-   read = msg->flags & I2C_M_RD;
+   /* we need to check here because we need the 'current' context */
+   if (i2c_check_msg_for_dma(msg, RCAR_DMA_THRESHOLD, NULL) == -EFAULT) {
+   dev_dbg(dev, "skipping DMA for this whole transfer\n");
+   priv->flags |= ID_P_NODMA;
+   }
 
chan = read ? priv->dma_rx : priv->dma_tx;
if (PTR_ERR(chan) != -EPROBE_DEFER)
@@ -740,6 +746,8 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
if (ret < 0 && ret != -ENXIO)
dev_err(dev, "error %d : %x\n", ret, priv->flags);
 
+   priv->flags &= ~ID_P_NODMA;
+
return ret;
 }
 
-- 
2.11.0

[PATCH 2/4] i2c: add docs to clarify DMA handling

[Wolfram Sang]

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 Documentation/i2c/DMA-considerations | 37 
 1 file changed, 37 insertions(+)
 create mode 100644 Documentation/i2c/DMA-considerations

diff --git a/Documentation/i2c/DMA-considerations 
b/Documentation/i2c/DMA-considerations
new file mode 100644
index 00..92cdb6835ccf95
--- /dev/null
+++ b/Documentation/i2c/DMA-considerations
@@ -0,0 +1,37 @@
+Linux I2C and DMA
+-
+
+Given that I2C is a low-speed bus where largely small messages are transferred,
+it is not considered a prime user of DMA access. At this time of writing, only
+10% of I2C bus master drivers have DMA support implemented. And the vast
+majority of transactions are so small that setting up DMA for it will likely
+add more overhead than a plain PIO transfer.
+
+Therefore, it is *not* mandatory that the buffer of an I2C message is DMA safe.
+It does not seem reasonable to apply additional burdens when the feature is so
+rarely used. However, it is recommended to use a DMA-safe buffer if your
+message size is likely applicable for DMA. Most drivers have this threshold
+around 8 bytes. As of today, this is mostly an educated guess, however.
+
+To support this scenario, drivers wishing to implement DMA can use helper
+functions from the I2C core. One checks if a message is DMA capable in terms of
+size and memory type. It can optionally also create a bounce buffer:
+
+   i2c_check_msg_for_dma(msg, threshold, _buf);
+
+The other one releases the bounce buffer ensuring data is copied back to the
+message:
+
+   i2c_release_bounce_buf(msg, bounce_buf);
+
+Please check the in-kernel documentation for details. The i2c-sh_mobile driver
+can be used as a reference example.
+
+The bounce buffer handling from the core is generic and simple. It will always
+allocate a new buffer. If you want a more sophisticated buffer handling (e.g.
+reusing pre-allocated buffers), you can skip the generic handling from the core
+and implement your own.
+
+If you plan to use DMA with I2C (or with any other bus, actually) make sure you
+have CONFIG_DMA_API_DEBUG enabled during development. It can help you find
+various issues which can be complex to debug otherwise.
-- 
2.11.0

[PATCH 2/4] i2c: add docs to clarify DMA handling

[Wolfram Sang]

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 Documentation/i2c/DMA-considerations | 37 
 1 file changed, 37 insertions(+)
 create mode 100644 Documentation/i2c/DMA-considerations

diff --git a/Documentation/i2c/DMA-considerations 
b/Documentation/i2c/DMA-considerations
new file mode 100644
index 00..92cdb6835ccf95
--- /dev/null
+++ b/Documentation/i2c/DMA-considerations
@@ -0,0 +1,37 @@
+Linux I2C and DMA
+-
+
+Given that I2C is a low-speed bus where largely small messages are transferred,
+it is not considered a prime user of DMA access. At this time of writing, only
+10% of I2C bus master drivers have DMA support implemented. And the vast
+majority of transactions are so small that setting up DMA for it will likely
+add more overhead than a plain PIO transfer.
+
+Therefore, it is *not* mandatory that the buffer of an I2C message is DMA safe.
+It does not seem reasonable to apply additional burdens when the feature is so
+rarely used. However, it is recommended to use a DMA-safe buffer if your
+message size is likely applicable for DMA. Most drivers have this threshold
+around 8 bytes. As of today, this is mostly an educated guess, however.
+
+To support this scenario, drivers wishing to implement DMA can use helper
+functions from the I2C core. One checks if a message is DMA capable in terms of
+size and memory type. It can optionally also create a bounce buffer:
+
+   i2c_check_msg_for_dma(msg, threshold, _buf);
+
+The other one releases the bounce buffer ensuring data is copied back to the
+message:
+
+   i2c_release_bounce_buf(msg, bounce_buf);
+
+Please check the in-kernel documentation for details. The i2c-sh_mobile driver
+can be used as a reference example.
+
+The bounce buffer handling from the core is generic and simple. It will always
+allocate a new buffer. If you want a more sophisticated buffer handling (e.g.
+reusing pre-allocated buffers), you can skip the generic handling from the core
+and implement your own.
+
+If you plan to use DMA with I2C (or with any other bus, actually) make sure you
+have CONFIG_DMA_API_DEBUG enabled during development. It can help you find
+various issues which can be complex to debug otherwise.
-- 
2.11.0

[PATCH 4.4 04/46] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Malcolm Priestley 

commit baabd567f87be05330faa5140f72a91960e7405a upstream.

The driver attempts to alter memory that is mapped to PCI device.

This is because tx_fwinfo_8190pci points to skb->data

Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.

Signed-off-by: Malcolm Priestley 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c |   13 +
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1185,8 +1185,7 @@ void  rtl92e_fill_tx_desc(struct net_dev
  struct cb_desc *cb_desc, struct sk_buff *skb)
 {
struct r8192_priv *priv = rtllib_priv(dev);
-   dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-PCI_DMA_TODEVICE);
+   dma_addr_t mapping;
struct tx_fwinfo_8190pci *pTxFwInfo = NULL;
 
pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1197,8 +1196,6 @@ void  rtl92e_fill_tx_desc(struct net_dev
pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
  pTxFwInfo->TxRate, cb_desc);
 
-   if (pci_dma_mapping_error(priv->pdev, mapping))
-   netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
if (cb_desc->bAMPDUEnable) {
pTxFwInfo->AllowAggregation = 1;
pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1233,6 +1230,14 @@ void  rtl92e_fill_tx_desc(struct net_dev
}
 
memset((u8 *)pdesc, 0, 12);
+
+   mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+PCI_DMA_TODEVICE);
+   if (pci_dma_mapping_error(priv->pdev, mapping)) {
+   netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+   return;
+   }
+
pdesc->LINIP = 0;
pdesc->CmdInit = 1;
pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;

[PATCH 4.4 04/46] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Malcolm Priestley 

commit baabd567f87be05330faa5140f72a91960e7405a upstream.

The driver attempts to alter memory that is mapped to PCI device.

This is because tx_fwinfo_8190pci points to skb->data

Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.

Signed-off-by: Malcolm Priestley 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c |   13 +
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1185,8 +1185,7 @@ void  rtl92e_fill_tx_desc(struct net_dev
  struct cb_desc *cb_desc, struct sk_buff *skb)
 {
struct r8192_priv *priv = rtllib_priv(dev);
-   dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-PCI_DMA_TODEVICE);
+   dma_addr_t mapping;
struct tx_fwinfo_8190pci *pTxFwInfo = NULL;
 
pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1197,8 +1196,6 @@ void  rtl92e_fill_tx_desc(struct net_dev
pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
  pTxFwInfo->TxRate, cb_desc);
 
-   if (pci_dma_mapping_error(priv->pdev, mapping))
-   netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
if (cb_desc->bAMPDUEnable) {
pTxFwInfo->AllowAggregation = 1;
pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1233,6 +1230,14 @@ void  rtl92e_fill_tx_desc(struct net_dev
}
 
memset((u8 *)pdesc, 0, 12);
+
+   mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+PCI_DMA_TODEVICE);
+   if (pci_dma_mapping_error(priv->pdev, mapping)) {
+   netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+   return;
+   }
+
pdesc->LINIP = 0;
pdesc->CmdInit = 1;
pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;

[PATCH 4.4 11/46] NET: mkiss: Fix panic

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ralf Baechle 


[ Upstream commit 7ba1b689038726d34e3244c1ac9e2e18c2ea4787 ]

If a USB-to-serial adapter is unplugged, the driver re-initializes, with
dev->hard_header_len and dev->addr_len set to zero, instead of the correct
values.  If then a packet is sent through the half-dead interface, the
kernel will panic due to running out of headroom in the skb when pushing
for the AX.25 headers resulting in this panic:

[] (skb_panic) from [] (skb_push+0x4c/0x50)
[] (skb_push) from [] (ax25_hard_header+0x34/0xf4 [ax25])
[] (ax25_hard_header [ax25]) from [] (ax_header+0x38/0x40 
[mkiss])
[] (ax_header [mkiss]) from [] 
(neigh_compat_output+0x8c/0xd8)
[] (neigh_compat_output) from [] 
(ip_finish_output+0x2a0/0x914)
[] (ip_finish_output) from [] (ip_output+0xd8/0xf0)
[] (ip_output) from [] (ip_local_out_sk+0x44/0x48)

This patch makes mkiss behave like the 6pack driver. 6pack does not
panic.  In 6pack.c sp_setup() (same function name here) the values for
dev->hard_header_len and dev->addr_len are set to the same values as in
my mkiss patch.

[r...@linux-mips.org: Massages original submission to conform to the usual
standards for patch submissions.]

Signed-off-by: Thomas Osterried 
Signed-off-by: Ralf Baechle 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/hamradio/mkiss.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -648,8 +648,8 @@ static void ax_setup(struct net_device *
 {
/* Finish setting up the DEVICE info. */
dev->mtu = AX_MTU;
-   dev->hard_header_len = 0;
-   dev->addr_len= 0;
+   dev->hard_header_len = AX25_MAX_HEADER_LEN;
+   dev->addr_len= AX25_ADDR_LEN;
dev->type= ARPHRD_AX25;
dev->tx_queue_len= 10;
dev->header_ops  = _header_ops;

[PATCH 3/4] i2c: sh_mobile: use helper to decide if DMA is useful

[Wolfram Sang]

This ensures that we fall back to PIO if the buffer is too small for DMA
being useful. Otherwise, we use DMA. A bounce buffer might be applied if
the original message buffer is not DMA safe

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 drivers/i2c/busses/i2c-sh_mobile.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-sh_mobile.c 
b/drivers/i2c/busses/i2c-sh_mobile.c
index 2e097d97d258bc..4b874e508111e7 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -145,6 +145,7 @@ struct sh_mobile_i2c_data {
struct dma_chan *dma_rx;
struct scatterlist sg;
enum dma_data_direction dma_direction;
+   u8 *bounce_buf;
 };
 
 struct sh_mobile_dt_config {
@@ -548,6 +549,8 @@ static void sh_mobile_i2c_dma_callback(void *data)
pd->pos = pd->msg->len;
pd->stop_after_dma = true;
 
+   i2c_release_bounce_buf(pd->msg, pd->bounce_buf);
+
iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
 }
 
@@ -595,6 +598,7 @@ static void sh_mobile_i2c_xfer_dma(struct 
sh_mobile_i2c_data *pd)
struct dma_async_tx_descriptor *txdesc;
dma_addr_t dma_addr;
dma_cookie_t cookie;
+   u8 *dma_buf = pd->bounce_buf ?: pd->msg->buf;
 
if (PTR_ERR(chan) == -EPROBE_DEFER) {
if (read)
@@ -608,7 +612,7 @@ static void sh_mobile_i2c_xfer_dma(struct 
sh_mobile_i2c_data *pd)
if (IS_ERR(chan))
return;
 
-   dma_addr = dma_map_single(chan->device->dev, pd->msg->buf, 
pd->msg->len, dir);
+   dma_addr = dma_map_single(chan->device->dev, dma_buf, pd->msg->len, 
dir);
if (dma_mapping_error(chan->device->dev, dma_addr)) {
dev_dbg(pd->dev, "dma map failed, using PIO\n");
return;
@@ -665,7 +669,7 @@ static int start_ch(struct sh_mobile_i2c_data *pd, struct 
i2c_msg *usr_msg,
pd->pos = -1;
pd->sr = 0;
 
-   if (pd->msg->len > 8)
+   if (i2c_check_msg_for_dma(pd->msg, 8, >bounce_buf) == 0)
sh_mobile_i2c_xfer_dma(pd);
 
/* Enable all interrupts to begin with */
-- 
2.11.0

[PATCH 4.4 11/46] NET: mkiss: Fix panic

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ralf Baechle 


[ Upstream commit 7ba1b689038726d34e3244c1ac9e2e18c2ea4787 ]

If a USB-to-serial adapter is unplugged, the driver re-initializes, with
dev->hard_header_len and dev->addr_len set to zero, instead of the correct
values.  If then a packet is sent through the half-dead interface, the
kernel will panic due to running out of headroom in the skb when pushing
for the AX.25 headers resulting in this panic:

[] (skb_panic) from [] (skb_push+0x4c/0x50)
[] (skb_push) from [] (ax25_hard_header+0x34/0xf4 [ax25])
[] (ax25_hard_header [ax25]) from [] (ax_header+0x38/0x40 
[mkiss])
[] (ax_header [mkiss]) from [] 
(neigh_compat_output+0x8c/0xd8)
[] (neigh_compat_output) from [] 
(ip_finish_output+0x2a0/0x914)
[] (ip_finish_output) from [] (ip_output+0xd8/0xf0)
[] (ip_output) from [] (ip_local_out_sk+0x44/0x48)

This patch makes mkiss behave like the 6pack driver. 6pack does not
panic.  In 6pack.c sp_setup() (same function name here) the values for
dev->hard_header_len and dev->addr_len are set to the same values as in
my mkiss patch.

[r...@linux-mips.org: Massages original submission to conform to the usual
standards for patch submissions.]

Signed-off-by: Thomas Osterried 
Signed-off-by: Ralf Baechle 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/hamradio/mkiss.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -648,8 +648,8 @@ static void ax_setup(struct net_device *
 {
/* Finish setting up the DEVICE info. */
dev->mtu = AX_MTU;
-   dev->hard_header_len = 0;
-   dev->addr_len= 0;
+   dev->hard_header_len = AX25_MAX_HEADER_LEN;
+   dev->addr_len= AX25_ADDR_LEN;
dev->type= ARPHRD_AX25;
dev->tx_queue_len= 10;
dev->header_ops  = _header_ops;

[PATCH 3/4] i2c: sh_mobile: use helper to decide if DMA is useful

[Wolfram Sang]

This ensures that we fall back to PIO if the buffer is too small for DMA
being useful. Otherwise, we use DMA. A bounce buffer might be applied if
the original message buffer is not DMA safe

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
---
 drivers/i2c/busses/i2c-sh_mobile.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-sh_mobile.c 
b/drivers/i2c/busses/i2c-sh_mobile.c
index 2e097d97d258bc..4b874e508111e7 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -145,6 +145,7 @@ struct sh_mobile_i2c_data {
struct dma_chan *dma_rx;
struct scatterlist sg;
enum dma_data_direction dma_direction;
+   u8 *bounce_buf;
 };
 
 struct sh_mobile_dt_config {
@@ -548,6 +549,8 @@ static void sh_mobile_i2c_dma_callback(void *data)
pd->pos = pd->msg->len;
pd->stop_after_dma = true;
 
+   i2c_release_bounce_buf(pd->msg, pd->bounce_buf);
+
iic_set_clr(pd, ICIC, 0, ICIC_TDMAE | ICIC_RDMAE);
 }
 
@@ -595,6 +598,7 @@ static void sh_mobile_i2c_xfer_dma(struct 
sh_mobile_i2c_data *pd)
struct dma_async_tx_descriptor *txdesc;
dma_addr_t dma_addr;
dma_cookie_t cookie;
+   u8 *dma_buf = pd->bounce_buf ?: pd->msg->buf;
 
if (PTR_ERR(chan) == -EPROBE_DEFER) {
if (read)
@@ -608,7 +612,7 @@ static void sh_mobile_i2c_xfer_dma(struct 
sh_mobile_i2c_data *pd)
if (IS_ERR(chan))
return;
 
-   dma_addr = dma_map_single(chan->device->dev, pd->msg->buf, 
pd->msg->len, dir);
+   dma_addr = dma_map_single(chan->device->dev, dma_buf, pd->msg->len, 
dir);
if (dma_mapping_error(chan->device->dev, dma_addr)) {
dev_dbg(pd->dev, "dma map failed, using PIO\n");
return;
@@ -665,7 +669,7 @@ static int start_ch(struct sh_mobile_i2c_data *pd, struct 
i2c_msg *usr_msg,
pd->pos = -1;
pd->sr = 0;
 
-   if (pd->msg->len > 8)
+   if (i2c_check_msg_for_dma(pd->msg, 8, >bounce_buf) == 0)
sh_mobile_i2c_xfer_dma(pd);
 
/* Enable all interrupts to begin with */
-- 
2.11.0

Re: LTS testing with latest kselftests - some failures

[Shuah Khan]

Hi Sumit,

On 06/15/2017 11:56 AM, Sumit Semwal wrote:
> Hello Greg, Shuah,
> 
> While testing 4.4.y and 4.9.y LTS kernels with latest kselftest, we
> found a couple more test failures due to test-kernel mismatch:
> 
> 1. firmware tests: - linux 4.5 [1] and 4.10 [2] added a few updates to
> tests, and related updates to lib/test_firmware.c to improve the
> tests. Stable-4.4 misses these patches to lib/test_firmware.c. Stable
> 4.9 misses the second update.

I will take a look the commit list your provided and see if it makes sense
to back-port. As we discussed earlier in this thread, fixes are something
that can be back-ported to include in the stable releases. Updates will not
be.

> 2. Bitmap test - test got added in 4.5, fails if test_bitmap.ko isn't present.

If you can send a patch to have it exit gracefully and change the message
to say unsupported feature, I can pull that into mainline can mark it for
stable inclusion if it qualifies.

> 
> 3. 'seccomp ptrace hole closure' patches got added in 4.7 [3] -
> feature and test together.
> - This one also seems like a security hole being closed, and the
> 'feature' could be a candidate for stable backports, but Arnd tried
> that, and it was quite non-trivial. So perhaps  we'll need some help
> from the subsystem developers here.

This is something I need to look at and consult with Security maintainers.

> 
> For all the 3 listed above, we will try and update the tests to gracefully 
> exit.

That is great.

> 
> 
> 4. bpf tests: These seem to have build failures in mainline as well -
> I also tried to build kselftest-next, but a simple 'make -C
> tools/testing/selftests/bpf' seems to error out. Are there any special
> instructions to build these? [I tried x86_64, arm64 cross-compile on x86_64]

Hmm. I didn't notice this one. I will check and see what's going on there.

> 
> 
> I will also individually request subsystem authors / mailing lists for
> each of these towards help in improving these tests if required, but
> wanted to use this thread as a converging point.

Please cc me and linux-kselftest mailing list.

Thanks for reporting the problems.

> 
> 
> [1]: https://lkml.org/lkml/2015/12/8/816
> Patches added via [1]:
> eb910947c82f (test: firmware_class: add asynchronous request trigger)
> be4a1326d12c (test: firmware_class: use kstrndup() where appropriate)
> 47e0bbb7fa98 (test: firmware_class: report errors properly on failure)
> 
> [2]: https://lkml.org/lkml/2017/1/23/440
> Patch added via [2]:
> 061132d2b9c9 (test_firmware: add test custom fallback trigger)
> 
> [3]: https://lkml.org/lkml/2016/6/9/627
> 
> 

thanks,
-- Shuah

[PATCH 4.4 40/46] sctp: sctp_addr_id2transport should verify the addr before looking up assoc

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Xin Long 


[ Upstream commit 6f29a130613191d3c6335169febe002cba00edf5 ]

sctp_addr_id2transport is a function for sockopt to look up assoc by
address. As the address is from userspace, it can be a v4-mapped v6
address. But in sctp protocol stack, it always handles a v4-mapped
v6 address as a v4 address. So it's necessary to convert it to a v4
address before looking up assoc by address.

This patch is to fix it by calling sctp_verify_addr in which it can do
this conversion before calling sctp_endpoint_lookup_assoc, just like
what sctp_sendmsg and __sctp_connect do for the address from users.

Signed-off-by: Xin Long 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 net/sctp/socket.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_
  sctp_assoc_t id)
 {
struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
-   struct sctp_transport *transport;
+   struct sctp_af *af = sctp_get_af_specific(addr->ss_family);
union sctp_addr *laddr = (union sctp_addr *)addr;
+   struct sctp_transport *transport;
+
+   if (sctp_verify_addr(sk, laddr, af->sockaddr_len))
+   return NULL;
 
addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
   laddr,

Re: LTS testing with latest kselftests - some failures

[Shuah Khan]

Hi Sumit,

On 06/15/2017 11:56 AM, Sumit Semwal wrote:
> Hello Greg, Shuah,
> 
> While testing 4.4.y and 4.9.y LTS kernels with latest kselftest, we
> found a couple more test failures due to test-kernel mismatch:
> 
> 1. firmware tests: - linux 4.5 [1] and 4.10 [2] added a few updates to
> tests, and related updates to lib/test_firmware.c to improve the
> tests. Stable-4.4 misses these patches to lib/test_firmware.c. Stable
> 4.9 misses the second update.

I will take a look the commit list your provided and see if it makes sense
to back-port. As we discussed earlier in this thread, fixes are something
that can be back-ported to include in the stable releases. Updates will not
be.

> 2. Bitmap test - test got added in 4.5, fails if test_bitmap.ko isn't present.

If you can send a patch to have it exit gracefully and change the message
to say unsupported feature, I can pull that into mainline can mark it for
stable inclusion if it qualifies.

> 
> 3. 'seccomp ptrace hole closure' patches got added in 4.7 [3] -
> feature and test together.
> - This one also seems like a security hole being closed, and the
> 'feature' could be a candidate for stable backports, but Arnd tried
> that, and it was quite non-trivial. So perhaps  we'll need some help
> from the subsystem developers here.

This is something I need to look at and consult with Security maintainers.

> 
> For all the 3 listed above, we will try and update the tests to gracefully 
> exit.

That is great.

> 
> 
> 4. bpf tests: These seem to have build failures in mainline as well -
> I also tried to build kselftest-next, but a simple 'make -C
> tools/testing/selftests/bpf' seems to error out. Are there any special
> instructions to build these? [I tried x86_64, arm64 cross-compile on x86_64]

Hmm. I didn't notice this one. I will check and see what's going on there.

> 
> 
> I will also individually request subsystem authors / mailing lists for
> each of these towards help in improving these tests if required, but
> wanted to use this thread as a converging point.

Please cc me and linux-kselftest mailing list.

Thanks for reporting the problems.

> 
> 
> [1]: https://lkml.org/lkml/2015/12/8/816
> Patches added via [1]:
> eb910947c82f (test: firmware_class: add asynchronous request trigger)
> be4a1326d12c (test: firmware_class: use kstrndup() where appropriate)
> 47e0bbb7fa98 (test: firmware_class: report errors properly on failure)
> 
> [2]: https://lkml.org/lkml/2017/1/23/440
> Patch added via [2]:
> 061132d2b9c9 (test_firmware: add test custom fallback trigger)
> 
> [3]: https://lkml.org/lkml/2016/6/9/627
> 
> 

thanks,
-- Shuah

[PATCH 4.4 40/46] sctp: sctp_addr_id2transport should verify the addr before looking up assoc

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Xin Long 


[ Upstream commit 6f29a130613191d3c6335169febe002cba00edf5 ]

sctp_addr_id2transport is a function for sockopt to look up assoc by
address. As the address is from userspace, it can be a v4-mapped v6
address. But in sctp protocol stack, it always handles a v4-mapped
v6 address as a v4 address. So it's necessary to convert it to a v4
address before looking up assoc by address.

This patch is to fix it by calling sctp_verify_addr in which it can do
this conversion before calling sctp_endpoint_lookup_assoc, just like
what sctp_sendmsg and __sctp_connect do for the address from users.

Signed-off-by: Xin Long 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 net/sctp/socket.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_
  sctp_assoc_t id)
 {
struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
-   struct sctp_transport *transport;
+   struct sctp_af *af = sctp_get_af_specific(addr->ss_family);
union sctp_addr *laddr = (union sctp_addr *)addr;
+   struct sctp_transport *transport;
+
+   if (sctp_verify_addr(sk, laddr, af->sockaddr_len))
+   return NULL;
 
addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
   laddr,

[PATCH 4.4 10/46] NET: Fix /proc/net/arp for AX.25

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Ralf Baechle 


[ Upstream commit 4872e57c812dd312bf8193b5933fa60585cda42f ]

When sending ARP requests over AX.25 links the hwaddress in the neighbour
cache are not getting initialized.  For such an incomplete arp entry
ax2asc2 will generate an empty string resulting in /proc/net/arp output
like the following:

$ cat /proc/net/arp
IP address   HW type Flags   HW addressMask Device
192.168.122.10x1 0x2 52:54:00:00:5d:5f *ens3
172.20.1.99  0x3 0x0  *bpq0

The missing field will confuse the procfs parsing of arp(8) resulting in
incorrect output for the device such as the following:

$ arp
Address  HWtype  HWaddress   Flags MaskIface
gateway  ether   52:54:00:00:5d:5f   C ens3
172.20.1.99  (incomplete)  ens3

This changes the content of /proc/net/arp to:

$ cat /proc/net/arp
IP address   HW type Flags   HW addressMask Device
172.20.1.99  0x3 0x0 * *bpq0
192.168.122.10x1 0x2 52:54:00:00:5d:5f *ens3

To do so it change ax2asc to put the string "*" in buf for a NULL address
argument.  Finally the HW address field is left aligned in a 17 character
field (the length of an ethernet HW address in the usual hex notation) for
readability.

Signed-off-by: Ralf Baechle 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 net/ipv4/arp.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1250,7 +1250,7 @@ void __init arp_init(void)
 /*
  * ax25 -> ASCII conversion
  */
-static char *ax2asc2(ax25_address *a, char *buf)
+static void ax2asc2(ax25_address *a, char *buf)
 {
char c, *s;
int n;
@@ -1272,10 +1272,10 @@ static char *ax2asc2(ax25_address *a, ch
*s++ = n + '0';
*s++ = '\0';
 
-   if (*buf == '\0' || *buf == '-')
-   return "*";
-
-   return buf;
+   if (*buf == '\0' || *buf == '-') {
+   buf[0] = '*';
+   buf[1] = '\0';
+   }
 }
 #endif /* CONFIG_AX25 */
 
@@ -1309,7 +1309,7 @@ static void arp_format_neigh_entry(struc
}
 #endif
sprintf(tbuf, "%pI4", n->primary_key);
-   seq_printf(seq, "%-16s 0x%-10x0x%-10x%s *%s\n",
+   seq_printf(seq, "%-16s 0x%-10x0x%-10x%-17s *%s\n",
   tbuf, hatype, arp_state_to_flags(n), hbuffer, dev->name);
read_unlock(>lock);
 }

[PATCH 4.4 39/46] r8152: avoid start_xmit to schedule napi when napi is disabled

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: hayeswang 


[ Upstream commit de9bf29dd6e4a8a874cb92f8901aed50a9d0b1d3 ]

Stop the tx when the napi is disabled to prevent napi_schedule() is
called.

Signed-off-by: Hayes Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/net/usb/r8152.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2993,10 +2993,13 @@ static void set_carrier(struct r8152 *tp
if (!netif_carrier_ok(netdev)) {
tp->rtl_ops.enable(tp);
set_bit(RTL8152_SET_RX_MODE, >flags);
+   netif_stop_queue(netdev);
napi_disable(>napi);
netif_carrier_on(netdev);
rtl_start_rx(tp);
napi_enable(>napi);
+   netif_wake_queue(netdev);
+   netif_info(tp, link, netdev, "carrier on\n");
}
} else {
if (netif_carrier_ok(netdev)) {
@@ -3004,6 +3007,7 @@ static void set_carrier(struct r8152 *tp
napi_disable(>napi);
tp->rtl_ops.disable(tp);
napi_enable(>napi);
+   netif_info(tp, link, netdev, "carrier off\n");
}
}
 }
@@ -3388,12 +3392,12 @@ static int rtl8152_pre_reset(struct usb_
if (!netif_running(netdev))
return 0;
 
+   netif_stop_queue(netdev);
napi_disable(>napi);
clear_bit(WORK_ENABLE, >flags);
usb_kill_urb(tp->intr_urb);
cancel_delayed_work_sync(>schedule);
if (netif_carrier_ok(netdev)) {
-   netif_stop_queue(netdev);
mutex_lock(>control);
tp->rtl_ops.disable(tp);
mutex_unlock(>control);
@@ -3421,10 +3425,10 @@ static int rtl8152_post_reset(struct usb
rtl_start_rx(tp);
rtl8152_set_rx_mode(netdev);
mutex_unlock(>control);
-   netif_wake_queue(netdev);
}
 
napi_enable(>napi);
+   netif_wake_queue(netdev);
usb_submit_urb(tp->intr_urb, GFP_KERNEL);
 
return 0;