[PATCH 3.18 002/185] MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Maciej W. Rozycki 

commit 9a3a92ccfe3620743d4ae57c987dc8e9c5f88996 upstream.

Check the TIF_32BIT_FPREGS task setting of the tracee rather than the
tracer in determining the layout of floating-point general registers in
the floating-point context, correcting access to odd-numbered registers
for o32 tracees where the setting disagrees between the two processes.

Fixes: 597ce1723e0f ("MIPS: Support for 64-bit FP with O32 binaries")
Signed-off-by: Maciej W. Rozycki 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc:  # 3.14+
Signed-off-by: James Hogan 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kernel/ptrace.c   |4 ++--
 arch/mips/kernel/ptrace32.c |4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -702,7 +702,7 @@ long arch_ptrace(struct task_struct *chi
fregs = get_fpu_regs(child);
 
 #ifdef CONFIG_32BIT
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even
@@ -796,7 +796,7 @@ long arch_ptrace(struct task_struct *chi
child->thread.fpu.fcr31 = 0;
}
 #ifdef CONFIG_32BIT
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -97,7 +97,7 @@ long compat_arch_ptrace(struct task_stru
break;
}
fregs = get_fpu_regs(child);
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even
@@ -203,7 +203,7 @@ long compat_arch_ptrace(struct task_stru
   sizeof(child->thread.fpu));
child->thread.fpu.fcr31 = 0;
}
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even

[PATCH 3.18 002/185] MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Maciej W. Rozycki 

commit 9a3a92ccfe3620743d4ae57c987dc8e9c5f88996 upstream.

Check the TIF_32BIT_FPREGS task setting of the tracee rather than the
tracer in determining the layout of floating-point general registers in
the floating-point context, correcting access to odd-numbered registers
for o32 tracees where the setting disagrees between the two processes.

Fixes: 597ce1723e0f ("MIPS: Support for 64-bit FP with O32 binaries")
Signed-off-by: Maciej W. Rozycki 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc:  # 3.14+
Signed-off-by: James Hogan 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kernel/ptrace.c   |4 ++--
 arch/mips/kernel/ptrace32.c |4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -702,7 +702,7 @@ long arch_ptrace(struct task_struct *chi
fregs = get_fpu_regs(child);
 
 #ifdef CONFIG_32BIT
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even
@@ -796,7 +796,7 @@ long arch_ptrace(struct task_struct *chi
child->thread.fpu.fcr31 = 0;
}
 #ifdef CONFIG_32BIT
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -97,7 +97,7 @@ long compat_arch_ptrace(struct task_stru
break;
}
fregs = get_fpu_regs(child);
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even
@@ -203,7 +203,7 @@ long compat_arch_ptrace(struct task_stru
   sizeof(child->thread.fpu));
child->thread.fpu.fcr31 = 0;
}
-   if (test_thread_flag(TIF_32BIT_FPREGS)) {
+   if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
/*
 * The odd registers are actually the high
 * order bits of the values stored in the even

[PATCH 3.18 014/185] PCI: Add function 1 DMA alias quirk for Marvell 9128

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Williamson 

[ Upstream commit aa008206634363ef800fbd5f0262016c9ff81dea ]

The Marvell 9128 is the original device generating bug 42679, from which
many other Marvell DMA alias quirks have been sourced, but we didn't have
positive confirmation of the fix on 9128 until now.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=42679
Link: https://www.spinics.net/lists/kvm/msg161459.html
Reported-by: Binarus 
Tested-by: Binarus 
Signed-off-by: Alex Williamson 
Signed-off-by: Bjorn Helgaas 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/pci/quirks.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3559,6 +3559,8 @@ static void quirk_dma_func1_alias(struct
  */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
 quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
+quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
 quirk_dma_func1_alias);

[PATCH 3.18 015/185] tools lib traceevent: Fix get_field_str() for dynamic strings

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (VMware)" 

[ Upstream commit d777f8de99b05d399c0e4e51cdce016f26bd971b ]

If a field is a dynamic string, get_field_str() returned just the
offset/size value and not the string. Have it parse the offset/size
correctly to return the actual string. Otherwise filtering fails when
trying to filter fields that are dynamic strings.

Reported-by: Gopanapalli Pradeep 
Signed-off-by: Steven Rostedt 
Acked-by: Namhyung Kim 
Cc: Andrew Morton 
Link: http://lkml.kernel.org/r/20180112004823.146333...@goodmis.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/lib/traceevent/parse-filter.c |   10 +-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/tools/lib/traceevent/parse-filter.c
+++ b/tools/lib/traceevent/parse-filter.c
@@ -1867,17 +1867,25 @@ static const char *get_field_str(struct
struct pevent *pevent;
unsigned long long addr;
const char *val = NULL;
+   unsigned int size;
char hex[64];
 
/* If the field is not a string convert it */
if (arg->str.field->flags & FIELD_IS_STRING) {
val = record->data + arg->str.field->offset;
+   size = arg->str.field->size;
+
+   if (arg->str.field->flags & FIELD_IS_DYNAMIC) {
+   addr = *(unsigned int *)val;
+   val = record->data + (addr & 0x);
+   size = addr >> 16;
+   }
 
/*
 * We need to copy the data since we can't be sure the field
 * is null terminated.
 */
-   if (*(val + arg->str.field->size - 1)) {
+   if (*(val + size - 1)) {
/* copy it */
memcpy(arg->str.buffer, val, arg->str.field->size);
/* the buffer is already NULL terminated */

[PATCH 3.18 014/185] PCI: Add function 1 DMA alias quirk for Marvell 9128

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Williamson 

[ Upstream commit aa008206634363ef800fbd5f0262016c9ff81dea ]

The Marvell 9128 is the original device generating bug 42679, from which
many other Marvell DMA alias quirks have been sourced, but we didn't have
positive confirmation of the fix on 9128 until now.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=42679
Link: https://www.spinics.net/lists/kvm/msg161459.html
Reported-by: Binarus 
Tested-by: Binarus 
Signed-off-by: Alex Williamson 
Signed-off-by: Bjorn Helgaas 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/pci/quirks.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3559,6 +3559,8 @@ static void quirk_dma_func1_alias(struct
  */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
 quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
+quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
 quirk_dma_func1_alias);

[PATCH 3.18 015/185] tools lib traceevent: Fix get_field_str() for dynamic strings

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: "Steven Rostedt (VMware)" 

[ Upstream commit d777f8de99b05d399c0e4e51cdce016f26bd971b ]

If a field is a dynamic string, get_field_str() returned just the
offset/size value and not the string. Have it parse the offset/size
correctly to return the actual string. Otherwise filtering fails when
trying to filter fields that are dynamic strings.

Reported-by: Gopanapalli Pradeep 
Signed-off-by: Steven Rostedt 
Acked-by: Namhyung Kim 
Cc: Andrew Morton 
Link: http://lkml.kernel.org/r/20180112004823.146333...@goodmis.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 tools/lib/traceevent/parse-filter.c |   10 +-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/tools/lib/traceevent/parse-filter.c
+++ b/tools/lib/traceevent/parse-filter.c
@@ -1867,17 +1867,25 @@ static const char *get_field_str(struct
struct pevent *pevent;
unsigned long long addr;
const char *val = NULL;
+   unsigned int size;
char hex[64];
 
/* If the field is not a string convert it */
if (arg->str.field->flags & FIELD_IS_STRING) {
val = record->data + arg->str.field->offset;
+   size = arg->str.field->size;
+
+   if (arg->str.field->flags & FIELD_IS_DYNAMIC) {
+   addr = *(unsigned int *)val;
+   val = record->data + (addr & 0x);
+   size = addr >> 16;
+   }
 
/*
 * We need to copy the data since we can't be sure the field
 * is null terminated.
 */
-   if (*(val + arg->str.field->size - 1)) {
+   if (*(val + size - 1)) {
/* copy it */
memcpy(arg->str.buffer, val, arg->str.field->size);
/* the buffer is already NULL terminated */

[PATCH 3.18 013/185] tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anna-Maria Gleixner 

[ Upstream commit 91633eed73a3ac37aaece5c8c1f93a18bae616a9 ]

So far only CLOCK_MONOTONIC and CLOCK_REALTIME were taken into account as
well as HRTIMER_MODE_ABS/REL in the hrtimer_init tracepoint. The query for
detecting the ABS or REL timer modes is not valid anymore, it got broken
by the introduction of HRTIMER_MODE_PINNED.

HRTIMER_MODE_PINNED is not evaluated in the hrtimer_init() call, but for the
sake of completeness print all given modes.

Signed-off-by: Anna-Maria Gleixner 
Cc: Christoph Hellwig 
Cc: John Stultz 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: keesc...@chromium.org
Link: http://lkml.kernel.org/r/20171221104205.7269-9-anna-ma...@linutronix.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/trace/events/timer.h |   20 
 1 file changed, 16 insertions(+), 4 deletions(-)

--- a/include/trace/events/timer.h
+++ b/include/trace/events/timer.h
@@ -121,6 +121,20 @@ DEFINE_EVENT(timer_class, timer_cancel,
TP_ARGS(timer)
 );
 
+#define decode_clockid(type)   \
+   __print_symbolic(type,  \
+   { CLOCK_REALTIME,   "CLOCK_REALTIME"},  \
+   { CLOCK_MONOTONIC,  "CLOCK_MONOTONIC"   },  \
+   { CLOCK_BOOTTIME,   "CLOCK_BOOTTIME"},  \
+   { CLOCK_TAI,"CLOCK_TAI" })
+
+#define decode_hrtimer_mode(mode)  \
+   __print_symbolic(mode,  \
+   { HRTIMER_MODE_ABS, "ABS"   },  \
+   { HRTIMER_MODE_REL, "REL"   },  \
+   { HRTIMER_MODE_ABS_PINNED,  "ABS|PINNED"},  \
+   { HRTIMER_MODE_REL_PINNED,  "REL|PINNED"})
+
 /**
  * hrtimer_init - called when the hrtimer is initialized
  * @hrtimer:   pointer to struct hrtimer
@@ -147,10 +161,8 @@ TRACE_EVENT(hrtimer_init,
),
 
TP_printk("hrtimer=%p clockid=%s mode=%s", __entry->hrtimer,
- __entry->clockid == CLOCK_REALTIME ?
-   "CLOCK_REALTIME" : "CLOCK_MONOTONIC",
- __entry->mode == HRTIMER_MODE_ABS ?
-   "HRTIMER_MODE_ABS" : "HRTIMER_MODE_REL")
+ decode_clockid(__entry->clockid),
+ decode_hrtimer_mode(__entry->mode))
 );
 
 /**

[PATCH 3.18 017/185] nfs: Do not convert nfs_idmap_cache_timeout to jiffies

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Jan Chochol 

[ Upstream commit cbebc6ef4fc830f4040d4140bf53484812d5d5d9 ]

Since commit 57e62324e469 ("NFS: Store the legacy idmapper result in the
keyring") nfs_idmap_cache_timeout changed units from jiffies to seconds.
Unfortunately sysctl interface was not updated accordingly.

As a effect updating /proc/sys/fs/nfs/idmap_cache_timeout with some
value will incorrectly multiply this value by HZ.
Also reading /proc/sys/fs/nfs/idmap_cache_timeout will show real value
divided by HZ.

Fixes: 57e62324e469 ("NFS: Store the legacy idmapper result in the keyring")
Signed-off-by: Jan Chochol 
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4sysctl.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/nfs4sysctl.c
+++ b/fs/nfs/nfs4sysctl.c
@@ -31,7 +31,7 @@ static struct ctl_table nfs4_cb_sysctls[
.data = _idmap_cache_timeout,
.maxlen = sizeof(int),
.mode = 0644,
-   .proc_handler = proc_dointvec_jiffies,
+   .proc_handler = proc_dointvec,
},
{ }
 };

[PATCH 3.18 013/185] tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Anna-Maria Gleixner 

[ Upstream commit 91633eed73a3ac37aaece5c8c1f93a18bae616a9 ]

So far only CLOCK_MONOTONIC and CLOCK_REALTIME were taken into account as
well as HRTIMER_MODE_ABS/REL in the hrtimer_init tracepoint. The query for
detecting the ABS or REL timer modes is not valid anymore, it got broken
by the introduction of HRTIMER_MODE_PINNED.

HRTIMER_MODE_PINNED is not evaluated in the hrtimer_init() call, but for the
sake of completeness print all given modes.

Signed-off-by: Anna-Maria Gleixner 
Cc: Christoph Hellwig 
Cc: John Stultz 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: keesc...@chromium.org
Link: http://lkml.kernel.org/r/20171221104205.7269-9-anna-ma...@linutronix.de
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/trace/events/timer.h |   20 
 1 file changed, 16 insertions(+), 4 deletions(-)

--- a/include/trace/events/timer.h
+++ b/include/trace/events/timer.h
@@ -121,6 +121,20 @@ DEFINE_EVENT(timer_class, timer_cancel,
TP_ARGS(timer)
 );
 
+#define decode_clockid(type)   \
+   __print_symbolic(type,  \
+   { CLOCK_REALTIME,   "CLOCK_REALTIME"},  \
+   { CLOCK_MONOTONIC,  "CLOCK_MONOTONIC"   },  \
+   { CLOCK_BOOTTIME,   "CLOCK_BOOTTIME"},  \
+   { CLOCK_TAI,"CLOCK_TAI" })
+
+#define decode_hrtimer_mode(mode)  \
+   __print_symbolic(mode,  \
+   { HRTIMER_MODE_ABS, "ABS"   },  \
+   { HRTIMER_MODE_REL, "REL"   },  \
+   { HRTIMER_MODE_ABS_PINNED,  "ABS|PINNED"},  \
+   { HRTIMER_MODE_REL_PINNED,  "REL|PINNED"})
+
 /**
  * hrtimer_init - called when the hrtimer is initialized
  * @hrtimer:   pointer to struct hrtimer
@@ -147,10 +161,8 @@ TRACE_EVENT(hrtimer_init,
),
 
TP_printk("hrtimer=%p clockid=%s mode=%s", __entry->hrtimer,
- __entry->clockid == CLOCK_REALTIME ?
-   "CLOCK_REALTIME" : "CLOCK_MONOTONIC",
- __entry->mode == HRTIMER_MODE_ABS ?
-   "HRTIMER_MODE_ABS" : "HRTIMER_MODE_REL")
+ decode_clockid(__entry->clockid),
+ decode_hrtimer_mode(__entry->mode))
 );
 
 /**

[PATCH 3.18 017/185] nfs: Do not convert nfs_idmap_cache_timeout to jiffies

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Jan Chochol 

[ Upstream commit cbebc6ef4fc830f4040d4140bf53484812d5d5d9 ]

Since commit 57e62324e469 ("NFS: Store the legacy idmapper result in the
keyring") nfs_idmap_cache_timeout changed units from jiffies to seconds.
Unfortunately sysctl interface was not updated accordingly.

As a effect updating /proc/sys/fs/nfs/idmap_cache_timeout with some
value will incorrectly multiply this value by HZ.
Also reading /proc/sys/fs/nfs/idmap_cache_timeout will show real value
divided by HZ.

Fixes: 57e62324e469 ("NFS: Store the legacy idmapper result in the keyring")
Signed-off-by: Jan Chochol 
Signed-off-by: Trond Myklebust 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/nfs/nfs4sysctl.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/nfs4sysctl.c
+++ b/fs/nfs/nfs4sysctl.c
@@ -31,7 +31,7 @@ static struct ctl_table nfs4_cb_sysctls[
.data = _idmap_cache_timeout,
.maxlen = sizeof(int),
.mode = 0644,
-   .proc_handler = proc_dointvec_jiffies,
+   .proc_handler = proc_dointvec,
},
{ }
 };

[PATCH 3.18 003/185] KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable"

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Colin Ian King 

commit ba3696e94d9d590d9a7e55f68e81c25dba515191 upstream.

Trivial fix to spelling mistake in debugfs_entries text.

Fixes: 669e846e6c4e ("KVM/MIPS32: MIPS arch specific APIs for KVM")
Signed-off-by: Colin Ian King 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc: kernel-janit...@vger.kernel.org
Cc:  # 3.10+
Signed-off-by: James Hogan 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kvm/mips.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -39,7 +39,7 @@ struct kvm_stats_debugfs_item debugfs_en
{ "cache",VCPU_STAT(cache_exits),KVM_STAT_VCPU },
{ "signal",   VCPU_STAT(signal_exits),   KVM_STAT_VCPU },
{ "interrupt",VCPU_STAT(int_exits),  KVM_STAT_VCPU },
-   { "cop_unsuable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
+   { "cop_unusable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
{ "tlbmod",   VCPU_STAT(tlbmod_exits),   KVM_STAT_VCPU },
{ "tlbmiss_ld",   VCPU_STAT(tlbmiss_ld_exits),   KVM_STAT_VCPU },
{ "tlbmiss_st",   VCPU_STAT(tlbmiss_st_exits),   KVM_STAT_VCPU },

[PATCH 3.18 003/185] KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable"

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Colin Ian King 

commit ba3696e94d9d590d9a7e55f68e81c25dba515191 upstream.

Trivial fix to spelling mistake in debugfs_entries text.

Fixes: 669e846e6c4e ("KVM/MIPS32: MIPS arch specific APIs for KVM")
Signed-off-by: Colin Ian King 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc: kernel-janit...@vger.kernel.org
Cc:  # 3.10+
Signed-off-by: James Hogan 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kvm/mips.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -39,7 +39,7 @@ struct kvm_stats_debugfs_item debugfs_en
{ "cache",VCPU_STAT(cache_exits),KVM_STAT_VCPU },
{ "signal",   VCPU_STAT(signal_exits),   KVM_STAT_VCPU },
{ "interrupt",VCPU_STAT(int_exits),  KVM_STAT_VCPU },
-   { "cop_unsuable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
+   { "cop_unusable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
{ "tlbmod",   VCPU_STAT(tlbmod_exits),   KVM_STAT_VCPU },
{ "tlbmiss_ld",   VCPU_STAT(tlbmiss_ld_exits),   KVM_STAT_VCPU },
{ "tlbmiss_st",   VCPU_STAT(tlbmiss_st_exits),   KVM_STAT_VCPU },

[PATCH 3.18 020/185] kconfig: Fix automatic menu creation mem leak

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Ulf Magnusson 

[ Upstream commit ae7440ef0c8013d68c00dad6900e7cce5311bb1c ]

expr_trans_compare() always allocates and returns a new expression,
giving the following leak outline:

...
*Allocate*
basedep = expr_trans_compare(basedep, E_UNEQUAL, _no);
...
for (menu = parent->next; menu; menu = menu->next) {
...
*Copy*
dep2 = expr_copy(basedep);
...
*Free copy*
expr_free(dep2);
}
*basedep lost!*

Fix by freeing 'basedep' after the loop.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

LEAK SUMMARY:
   definitely lost: 344,376 bytes in 14,349 blocks
   ...

Summary after the fix:

LEAK SUMMARY:
   definitely lost: 44,448 bytes in 1,852 blocks
   ...

Signed-off-by: Ulf Magnusson 
Signed-off-by: Masahiro Yamada 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 scripts/kconfig/menu.c |1 +
 1 file changed, 1 insertion(+)

--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -364,6 +364,7 @@ void menu_finalize(struct menu *parent)
menu->parent = parent;
last_menu = menu;
}
+   expr_free(basedep);
if (last_menu) {
parent->list = parent->next;
parent->next = last_menu->next;

[PATCH 3.18 020/185] kconfig: Fix automatic menu creation mem leak

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Ulf Magnusson 

[ Upstream commit ae7440ef0c8013d68c00dad6900e7cce5311bb1c ]

expr_trans_compare() always allocates and returns a new expression,
giving the following leak outline:

...
*Allocate*
basedep = expr_trans_compare(basedep, E_UNEQUAL, _no);
...
for (menu = parent->next; menu; menu = menu->next) {
...
*Copy*
dep2 = expr_copy(basedep);
...
*Free copy*
expr_free(dep2);
}
*basedep lost!*

Fix by freeing 'basedep' after the loop.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

LEAK SUMMARY:
   definitely lost: 344,376 bytes in 14,349 blocks
   ...

Summary after the fix:

LEAK SUMMARY:
   definitely lost: 44,448 bytes in 1,852 blocks
   ...

Signed-off-by: Ulf Magnusson 
Signed-off-by: Masahiro Yamada 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 scripts/kconfig/menu.c |1 +
 1 file changed, 1 insertion(+)

--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -364,6 +364,7 @@ void menu_finalize(struct menu *parent)
menu->parent = parent;
last_menu = menu;
}
+   expr_free(basedep);
if (last_menu) {
parent->list = parent->next;
parent->next = last_menu->next;

[PATCH 3.18 023/185] scsi: fas216: fix sense buffer initialization

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

[ Upstream commit 96d5eaa9bb74d299508d811d865c2c41b38b0301 ]

While testing with the ARM specific memset() macro removed, I ran into a
compiler warning that shows an old bug:

drivers/scsi/arm/fas216.c: In function 'fas216_rq_sns_done':
drivers/scsi/arm/fas216.c:2014:40: error: argument to 'sizeof' in 'memset' call 
is the same expression as the destination; did you mean to provide an explicit 
length? [-Werror=sizeof-pointer-memaccess]

It turns out that the definition of the scsi_cmd structure changed back
in linux-2.6.25, so now we clear only four bytes (sizeof(pointer))
instead of 96 (SCSI_SENSE_BUFFERSIZE). I did not check whether we
actually need to initialize the buffer here, but it's clear that if we
do it, we should use the correct size.

Fixes: de25deb18016 ("[SCSI] use dynamically allocated sense buffer")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/arm/fas216.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2010,7 +2010,7 @@ static void fas216_rq_sns_done(FAS216_In
 * have valid data in the sense buffer that could
 * confuse the higher levels.
 */
-   memset(SCpnt->sense_buffer, 0, sizeof(SCpnt->sense_buffer));
+   memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
 //printk("scsi%d.%c: sense buffer: ", info->host->host_no, '0' + 
SCpnt->device->id);
 //{ int i; for (i = 0; i < 32; i++) printk("%02x ", SCpnt->sense_buffer[i]); 
printk("\n"); }
/*

[PATCH 3.18 023/185] scsi: fas216: fix sense buffer initialization

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

[ Upstream commit 96d5eaa9bb74d299508d811d865c2c41b38b0301 ]

While testing with the ARM specific memset() macro removed, I ran into a
compiler warning that shows an old bug:

drivers/scsi/arm/fas216.c: In function 'fas216_rq_sns_done':
drivers/scsi/arm/fas216.c:2014:40: error: argument to 'sizeof' in 'memset' call 
is the same expression as the destination; did you mean to provide an explicit 
length? [-Werror=sizeof-pointer-memaccess]

It turns out that the definition of the scsi_cmd structure changed back
in linux-2.6.25, so now we clear only four bytes (sizeof(pointer))
instead of 96 (SCSI_SENSE_BUFFERSIZE). I did not check whether we
actually need to initialize the buffer here, but it's clear that if we
do it, we should use the correct size.

Fixes: de25deb18016 ("[SCSI] use dynamically allocated sense buffer")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/arm/fas216.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2010,7 +2010,7 @@ static void fas216_rq_sns_done(FAS216_In
 * have valid data in the sense buffer that could
 * confuse the higher levels.
 */
-   memset(SCpnt->sense_buffer, 0, sizeof(SCpnt->sense_buffer));
+   memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
 //printk("scsi%d.%c: sense buffer: ", info->host->host_no, '0' + 
SCpnt->device->id);
 //{ int i; for (i = 0; i < 32; i++) printk("%02x ", SCpnt->sense_buffer[i]); 
printk("\n"); }
/*

[PATCH 3.18 021/185] kconfig: Fix expr_free() E_NOT leak

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Ulf Magnusson 

[ Upstream commit 5b1374b3b3c2fc4f63a398adfa446fb8eff791a4 ]

Only the E_NOT operand and not the E_NOT node itself was freed, due to
accidentally returning too early in expr_free(). Outline of leak:

switch (e->type) {
...
case E_NOT:
expr_free(e->left.expr);
return;
...
}
*Never reached, 'e' leaked*
free(e);

Fix by changing the 'return' to a 'break'.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

LEAK SUMMARY:
   definitely lost: 44,448 bytes in 1,852 blocks
   ...

Summary after the fix:

LEAK SUMMARY:
   definitely lost: 1,608 bytes in 67 blocks
   ...

Signed-off-by: Ulf Magnusson 
Signed-off-by: Masahiro Yamada 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 scripts/kconfig/expr.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/scripts/kconfig/expr.c
+++ b/scripts/kconfig/expr.c
@@ -106,7 +106,7 @@ void expr_free(struct expr *e)
break;
case E_NOT:
expr_free(e->left.expr);
-   return;
+   break;
case E_EQUAL:
case E_UNEQUAL:
break;

[PATCH 3.18 021/185] kconfig: Fix expr_free() E_NOT leak

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Ulf Magnusson 

[ Upstream commit 5b1374b3b3c2fc4f63a398adfa446fb8eff791a4 ]

Only the E_NOT operand and not the E_NOT node itself was freed, due to
accidentally returning too early in expr_free(). Outline of leak:

switch (e->type) {
...
case E_NOT:
expr_free(e->left.expr);
return;
...
}
*Never reached, 'e' leaked*
free(e);

Fix by changing the 'return' to a 'break'.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

LEAK SUMMARY:
   definitely lost: 44,448 bytes in 1,852 blocks
   ...

Summary after the fix:

LEAK SUMMARY:
   definitely lost: 1,608 bytes in 67 blocks
   ...

Signed-off-by: Ulf Magnusson 
Signed-off-by: Masahiro Yamada 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 scripts/kconfig/expr.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/scripts/kconfig/expr.c
+++ b/scripts/kconfig/expr.c
@@ -106,7 +106,7 @@ void expr_free(struct expr *e)
break;
case E_NOT:
expr_free(e->left.expr);
-   return;
+   break;
case E_EQUAL:
case E_UNEQUAL:
break;

[PATCH 3.18 030/185] mm/mempolicy: add nodes_empty check in SYSC_migrate_pages

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Yisheng Xie 

[ Upstream commit 0486a38bcc4749808edbc848f1bcf232042770fc ]

As in manpage of migrate_pages, the errno should be set to EINVAL when
none of the node IDs specified by new_nodes are on-line and allowed by
the process's current cpuset context, or none of the specified nodes
contain memory.  However, when test by following case:

new_nodes = 0;
old_nodes = 0xf;
ret = migrate_pages(pid, old_nodes, new_nodes, MAX);

The ret will be 0 and no errno is set.  As the new_nodes is empty, we
should expect EINVAL as documented.

To fix the case like above, this patch check whether target nodes AND
current task_nodes is empty, and then check whether AND
node_states[N_MEMORY] is empty.

Link: 
http://lkml.kernel.org/r/1510882624-44342-4-git-send-email-xieyishe...@huawei.com
Signed-off-by: Yisheng Xie 
Acked-by: Vlastimil Babka 
Cc: Andi Kleen 
Cc: Chris Salls 
Cc: Christopher Lameter 
Cc: David Rientjes 
Cc: Ingo Molnar 
Cc: Naoya Horiguchi 
Cc: Tan Xiaojun 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 mm/mempolicy.c |   10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1464,10 +1464,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
goto out_put;
}
 
-   if (!nodes_subset(*new, node_states[N_MEMORY])) {
-   err = -EINVAL;
+   task_nodes = cpuset_mems_allowed(current);
+   nodes_and(*new, *new, task_nodes);
+   if (nodes_empty(*new))
+   goto out_put;
+
+   nodes_and(*new, *new, node_states[N_MEMORY]);
+   if (nodes_empty(*new))
goto out_put;
-   }
 
err = security_task_movememory(task);
if (err)

[PATCH 3.18 030/185] mm/mempolicy: add nodes_empty check in SYSC_migrate_pages

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Yisheng Xie 

[ Upstream commit 0486a38bcc4749808edbc848f1bcf232042770fc ]

As in manpage of migrate_pages, the errno should be set to EINVAL when
none of the node IDs specified by new_nodes are on-line and allowed by
the process's current cpuset context, or none of the specified nodes
contain memory.  However, when test by following case:

new_nodes = 0;
old_nodes = 0xf;
ret = migrate_pages(pid, old_nodes, new_nodes, MAX);

The ret will be 0 and no errno is set.  As the new_nodes is empty, we
should expect EINVAL as documented.

To fix the case like above, this patch check whether target nodes AND
current task_nodes is empty, and then check whether AND
node_states[N_MEMORY] is empty.

Link: 
http://lkml.kernel.org/r/1510882624-44342-4-git-send-email-xieyishe...@huawei.com
Signed-off-by: Yisheng Xie 
Acked-by: Vlastimil Babka 
Cc: Andi Kleen 
Cc: Chris Salls 
Cc: Christopher Lameter 
Cc: David Rientjes 
Cc: Ingo Molnar 
Cc: Naoya Horiguchi 
Cc: Tan Xiaojun 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 mm/mempolicy.c |   10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1464,10 +1464,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
goto out_put;
}
 
-   if (!nodes_subset(*new, node_states[N_MEMORY])) {
-   err = -EINVAL;
+   task_nodes = cpuset_mems_allowed(current);
+   nodes_and(*new, *new, task_nodes);
+   if (nodes_empty(*new))
+   goto out_put;
+
+   nodes_and(*new, *new, node_states[N_MEMORY]);
+   if (nodes_empty(*new))
goto out_put;
-   }
 
err = security_task_movememory(task);
if (err)

[PATCH 3.18 026/185] RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Leon Romanovsky 

[ Upstream commit b081808a66345ba725b77ecd8d759bee874cd937 ]

Failure in XRCD FW deallocation command leaves memory leaked and
returns error to the user which he can't do anything about it.

This patch changes behavior to always free memory and always return
success to the user.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Reviewed-by: Majd Dibbiny 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/infiniband/hw/mlx5/qp.c |5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3032,12 +3032,9 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd
int err;
 
err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn);
-   if (err) {
+   if (err)
mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn);
-   return err;
-   }
 
kfree(xrcd);
-
return 0;
 }

[PATCH 3.18 024/185] HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

[ Upstream commit 7ad81482cad67cbe1ec808490d1ddfc420c42008 ]

We get the "new_profile_index" value from the mouse device when we're
handling raw events.  Smatch taints it as untrusted data and complains
that we need a bounds check.  This seems like a reasonable warning
otherwise there is a small read beyond the end of the array.

Fixes: 0e70f97f257e ("HID: roccat: Add support for Kova[+] mouse")
Signed-off-by: Dan Carpenter 
Acked-by: Silvan Jegen 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/hid/hid-roccat-kovaplus.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(u
 static void kovaplus_profile_activated(struct kovaplus_device *kovaplus,
uint new_profile_index)
 {
+   if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings))
+   return;
kovaplus->actual_profile = new_profile_index;
kovaplus->actual_cpi = 
kovaplus->profile_settings[new_profile_index].cpi_startup_level;
kovaplus->actual_x_sensitivity = 
kovaplus->profile_settings[new_profile_index].sensitivity_x;

[PATCH 3.18 024/185] HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

[ Upstream commit 7ad81482cad67cbe1ec808490d1ddfc420c42008 ]

We get the "new_profile_index" value from the mouse device when we're
handling raw events.  Smatch taints it as untrusted data and complains
that we need a bounds check.  This seems like a reasonable warning
otherwise there is a small read beyond the end of the array.

Fixes: 0e70f97f257e ("HID: roccat: Add support for Kova[+] mouse")
Signed-off-by: Dan Carpenter 
Acked-by: Silvan Jegen 
Signed-off-by: Jiri Kosina 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/hid/hid-roccat-kovaplus.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(u
 static void kovaplus_profile_activated(struct kovaplus_device *kovaplus,
uint new_profile_index)
 {
+   if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings))
+   return;
kovaplus->actual_profile = new_profile_index;
kovaplus->actual_cpi = 
kovaplus->profile_settings[new_profile_index].cpi_startup_level;
kovaplus->actual_x_sensitivity = 
kovaplus->profile_settings[new_profile_index].sensitivity_x;

[PATCH 3.18 026/185] RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Leon Romanovsky 

[ Upstream commit b081808a66345ba725b77ecd8d759bee874cd937 ]

Failure in XRCD FW deallocation command leaves memory leaked and
returns error to the user which he can't do anything about it.

This patch changes behavior to always free memory and always return
success to the user.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Reviewed-by: Majd Dibbiny 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/infiniband/hw/mlx5/qp.c |5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3032,12 +3032,9 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd
int err;
 
err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn);
-   if (err) {
+   if (err)
mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn);
-   return err;
-   }
 
kfree(xrcd);
-
return 0;
 }

[PATCH 3.18 028/185] ocfs2/acl: use ip_xattr_sem to protect getting extended attribute

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: piaojun 

[ Upstream commit 16c8d569f5704a84164f30ff01b29879f3438065 ]

The race between *set_acl and *get_acl will cause getting incomplete
xattr data as below:

  processAprocessB

  ocfs2_set_acl
ocfs2_xattr_set
  __ocfs2_xattr_set_handle

  ocfs2_get_acl_nolock
ocfs2_xattr_get_nolock:

processB may get incomplete xattr data if processA hasn't set_acl done.

So we should use 'ip_xattr_sem' to protect getting extended attribute in
ocfs2_get_acl_nolock(), as other processes could be changing it
concurrently.

Link: http://lkml.kernel.org/r/5a5ddcff.7030...@huawei.com
Signed-off-by: Jun Piao 
Reviewed-by: Alex Chen 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Junxiao Bi 
Cc: Joseph Qi 
Cc: Changwei Ge 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/ocfs2/acl.c   |6 ++
 fs/ocfs2/xattr.c |2 ++
 2 files changed, 8 insertions(+)

--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -300,7 +300,9 @@ struct posix_acl *ocfs2_iop_get_acl(stru
if (ret < 0)
return ERR_PTR(ret);
 
+   down_read(_I(inode)->ip_xattr_sem);
acl = ocfs2_get_acl_nolock(inode, type, di_bh);
+   up_read(_I(inode)->ip_xattr_sem);
 
brelse(di_bh);
 
@@ -319,7 +321,9 @@ int ocfs2_acl_chmod(struct inode *inode,
if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
return 0;
 
+   down_read(_I(inode)->ip_xattr_sem);
acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
+   up_read(_I(inode)->ip_xattr_sem);
if (IS_ERR(acl) || !acl)
return PTR_ERR(acl);
ret = __posix_acl_chmod(, GFP_KERNEL, inode->i_mode);
@@ -350,8 +354,10 @@ int ocfs2_init_acl(handle_t *handle,
 
if (!S_ISLNK(inode->i_mode)) {
if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
+   down_read(_I(dir)->ip_xattr_sem);
acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT,
   dir_bh);
+   up_read(_I(dir)->ip_xattr_sem);
if (IS_ERR(acl))
return PTR_ERR(acl);
}
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -645,9 +645,11 @@ int ocfs2_calc_xattr_init(struct inode *
 si->value_len);
 
if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
+   down_read(_I(dir)->ip_xattr_sem);
acl_len = ocfs2_xattr_get_nolock(dir, dir_bh,
OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT,
"", NULL, 0);
+   up_read(_I(dir)->ip_xattr_sem);
if (acl_len > 0) {
a_size = ocfs2_xattr_entry_real_size(0, acl_len);
if (S_ISDIR(mode))

[PATCH 3.18 028/185] ocfs2/acl: use ip_xattr_sem to protect getting extended attribute

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: piaojun 

[ Upstream commit 16c8d569f5704a84164f30ff01b29879f3438065 ]

The race between *set_acl and *get_acl will cause getting incomplete
xattr data as below:

  processAprocessB

  ocfs2_set_acl
ocfs2_xattr_set
  __ocfs2_xattr_set_handle

  ocfs2_get_acl_nolock
ocfs2_xattr_get_nolock:

processB may get incomplete xattr data if processA hasn't set_acl done.

So we should use 'ip_xattr_sem' to protect getting extended attribute in
ocfs2_get_acl_nolock(), as other processes could be changing it
concurrently.

Link: http://lkml.kernel.org/r/5a5ddcff.7030...@huawei.com
Signed-off-by: Jun Piao 
Reviewed-by: Alex Chen 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Junxiao Bi 
Cc: Joseph Qi 
Cc: Changwei Ge 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/ocfs2/acl.c   |6 ++
 fs/ocfs2/xattr.c |2 ++
 2 files changed, 8 insertions(+)

--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -300,7 +300,9 @@ struct posix_acl *ocfs2_iop_get_acl(stru
if (ret < 0)
return ERR_PTR(ret);
 
+   down_read(_I(inode)->ip_xattr_sem);
acl = ocfs2_get_acl_nolock(inode, type, di_bh);
+   up_read(_I(inode)->ip_xattr_sem);
 
brelse(di_bh);
 
@@ -319,7 +321,9 @@ int ocfs2_acl_chmod(struct inode *inode,
if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
return 0;
 
+   down_read(_I(inode)->ip_xattr_sem);
acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
+   up_read(_I(inode)->ip_xattr_sem);
if (IS_ERR(acl) || !acl)
return PTR_ERR(acl);
ret = __posix_acl_chmod(, GFP_KERNEL, inode->i_mode);
@@ -350,8 +354,10 @@ int ocfs2_init_acl(handle_t *handle,
 
if (!S_ISLNK(inode->i_mode)) {
if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
+   down_read(_I(dir)->ip_xattr_sem);
acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT,
   dir_bh);
+   up_read(_I(dir)->ip_xattr_sem);
if (IS_ERR(acl))
return PTR_ERR(acl);
}
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -645,9 +645,11 @@ int ocfs2_calc_xattr_init(struct inode *
 si->value_len);
 
if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
+   down_read(_I(dir)->ip_xattr_sem);
acl_len = ocfs2_xattr_get_nolock(dir, dir_bh,
OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT,
"", NULL, 0);
+   up_read(_I(dir)->ip_xattr_sem);
if (acl_len > 0) {
a_size = ocfs2_xattr_entry_real_size(0, acl_len);
if (S_ISDIR(mode))

[PATCH 3.18 031/185] asm-generic: provide generic_pmdp_establish()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: "Kirill A. Shutemov" 

[ Upstream commit c58f0bb77ed8bf93dfdde762b01cb67eebbdfc29 ]

Patch series "Do not lose dirty bit on THP pages", v4.

Vlastimil noted that pmdp_invalidate() is not atomic and we can lose
dirty and access bits if CPU sets them after pmdp dereference, but
before set_pmd_at().

The bug can lead to data loss, but the race window is tiny and I haven't
seen any reports that suggested that it happens in reality.  So I don't
think it worth sending it to stable.

Unfortunately, there's no way to address the issue in a generic way.  We
need to fix all architectures that support THP one-by-one.

All architectures that have THP supported have to provide atomic
pmdp_invalidate() that returns previous value.

If generic implementation of pmdp_invalidate() is used, architecture
needs to provide atomic pmdp_estabish().

pmdp_estabish() is not used out-side generic implementation of
pmdp_invalidate() so far, but I think this can change in the future.

This patch (of 12):

This is an implementation of pmdp_establish() that is only suitable for
an architecture that doesn't have hardware dirty/accessed bits.  In this
case we can't race with CPU which sets these bits and non-atomic
approach is fine.

Link: 
http://lkml.kernel.org/r/20171213105756.69879-2-kirill.shute...@linux.intel.com
Signed-off-by: Kirill A. Shutemov 
Cc: Vlastimil Babka 
Cc: Andrea Arcangeli 
Cc: Michal Hocko 
Cc: Aneesh Kumar K.V 
Cc: Catalin Marinas 
Cc: David Daney 
Cc: David Miller 
Cc: H. Peter Anvin 
Cc: Hugh Dickins 
Cc: Ingo Molnar 
Cc: Martin Schwidefsky 
Cc: Nitin Gupta 
Cc: Ralf Baechle 
Cc: Thomas Gleixner 
Cc: Vineet Gupta 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/asm-generic/pgtable.h |   15 +++
 1 file changed, 15 insertions(+)

--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -181,6 +181,21 @@ extern void pgtable_trans_huge_deposit(s
 extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t 
*pmdp);
 #endif
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+/*
+ * This is an implementation of pmdp_establish() that is only suitable for an
+ * architecture that doesn't have hardware dirty/accessed bits. In this case we
+ * can't race with CPU which sets these bits and non-atomic aproach is fine.
+ */
+static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma,
+   unsigned long address, pmd_t *pmdp, pmd_t pmd)
+{
+   pmd_t old_pmd = *pmdp;
+   set_pmd_at(vma->vm_mm, address, pmdp, pmd);
+   return old_pmd;
+}
+#endif
+
 #ifndef __HAVE_ARCH_PMDP_INVALIDATE
 extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
pmd_t *pmdp);

[PATCH 3.18 027/185] ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: piaojun 

[ Upstream commit 025bcbde3634b2c9b316f227fed13ad6ad6817fb ]

If metadata is corrupted such as 'invalid inode block', we will get
failed by calling 'mount()' and then set filesystem readonly as below:

  ocfs2_mount
ocfs2_initialize_super
  ocfs2_init_global_system_inodes
ocfs2_iget
  ocfs2_read_locked_inode
ocfs2_validate_inode_block
  ocfs2_error
ocfs2_handle_error
  ocfs2_set_ro_flag(osb, 0);  // set readonly

In this situation we need return -EROFS to 'mount.ocfs2', so that user
can fix it by fsck.  And then mount again.  In addition, 'mount.ocfs2'
should be updated correspondingly as it only return 1 for all errno.
And I will post a patch for 'mount.ocfs2' too.

Link: http://lkml.kernel.org/r/5a4302fa.2010...@huawei.com
Signed-off-by: Jun Piao 
Reviewed-by: Alex Chen 
Reviewed-by: Joseph Qi 
Reviewed-by: Changwei Ge 
Reviewed-by: Gang He 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Junxiao Bi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/ocfs2/super.c |5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -467,9 +467,8 @@ static int ocfs2_init_global_system_inod
new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
if (!new) {
ocfs2_release_system_inodes(osb);
-   status = -EINVAL;
+   status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
mlog_errno(status);
-   /* FIXME: Should ERROR_RO_FS */
mlog(ML_ERROR, "Unable to load system inode %d, "
 "possibly corrupt fs?", i);
goto bail;
@@ -498,7 +497,7 @@ static int ocfs2_init_local_system_inode
new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
if (!new) {
ocfs2_release_system_inodes(osb);
-   status = -EINVAL;
+   status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n",
 status, i, osb->slot_num);
goto bail;

Re: [PATCH V2 rdma-next 3/4] RDMA/hns: Add reset process for RoCE in hip08

[Jason Gunthorpe]

On Sat, May 26, 2018 at 09:47:43AM +0800, Wei Hu (Xavier) wrote:
> 
> 
> On 2018/5/25 22:55, Jason Gunthorpe wrote:
> > On Fri, May 25, 2018 at 01:54:31PM +0800, Wei Hu (Xavier) wrote:
> >>
> >> On 2018/5/25 5:31, Jason Gunthorpe wrote:
>   static const struct hnae3_client_ops hns_roce_hw_v2_ops = {
>   .init_instance = hns_roce_hw_v2_init_instance,
>   .uninit_instance = hns_roce_hw_v2_uninit_instance,
>  +.reset_notify = hns_roce_hw_v2_reset_notify,
>   };
>   
>   static struct hnae3_client hns_roce_hw_v2_client = {
>  diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c 
>  b/drivers/infiniband/hw/hns/hns_roce_main.c
>  index 1b79a38..ac51372 100644
>  +++ b/drivers/infiniband/hw/hns/hns_roce_main.c
>  @@ -332,6 +332,9 @@ static struct ib_ucontext 
>  *hns_roce_alloc_ucontext(struct ib_device *ib_dev,
>   struct hns_roce_ib_alloc_ucontext_resp resp = {};
>   struct hns_roce_dev *hr_dev = to_hr_dev(ib_dev);
>   
>  +if (!hr_dev->active)
>  +return ERR_PTR(-EAGAIN);
> >>> This still doesn't make sense, ib_unregister_device already makes sure
> >>> that hns_roce_alloc_ucontext isn't running and won't be called before
> >>> returning, don't need another flag to do that.
> >>>
> >>> Since this is the only place the active flag is tested it can just be 
> >>> deleted
> >>> entirely.
> >> Hi, Jason
> >>
> >> roce reset process:
> >> 1. hr_dev->active = false;  //make sure no any process call
> >> ibv_open_device.   
> >> 2. call ib_dispatch_event() function to report IB_EVENT_DEVICE_FATAL
> >> event.
> >> 3. msleep(100);   // for some app to free resources
> >> 4. call ib_unregister_device().   
> >> 5. ...
> >> 6. ...
> >>
> >> There are 2 steps as above before calling ib_unregister_device(), we
> >> evaluate
> >> hr_dev->active with false to avoid no any process call
> >> ibv_open_device.
> > If you think this is the right flow then it is core issue to block new
> > opens, not an individual driver issue, send a core patch - eg add a
> > 'ib_driver_fatal_error()' call that does the dispatch and call it from
> > all the drivers using this IB_EVENT_DEVICE_FATAL
> Hi, Jason
> 
> It seem to be no difference between calling ib_driver_fatal_error and
> calling ib_dispatch_event  directly in manufacturer driver.
> 
> void ib_driver_fatal_error(struct ib_device *ib_dev, u8 port_num)
>  {
>struct ib_event event;
> 
>   event.event = IB_EVENT_DEVICE_FATAL;
> event.device = ib_dev;
> event.element.port_num = port_num;
> ib_dispatch_event();
> }

My point was the core code should block calling
hns_roce_alloc_ucontext after DEVICE_FATAL if we agree that is
correct, the driver shouldn't be doing it.

Jason

[PATCH 3.18 031/185] asm-generic: provide generic_pmdp_establish()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: "Kirill A. Shutemov" 

[ Upstream commit c58f0bb77ed8bf93dfdde762b01cb67eebbdfc29 ]

Patch series "Do not lose dirty bit on THP pages", v4.

Vlastimil noted that pmdp_invalidate() is not atomic and we can lose
dirty and access bits if CPU sets them after pmdp dereference, but
before set_pmd_at().

The bug can lead to data loss, but the race window is tiny and I haven't
seen any reports that suggested that it happens in reality.  So I don't
think it worth sending it to stable.

Unfortunately, there's no way to address the issue in a generic way.  We
need to fix all architectures that support THP one-by-one.

All architectures that have THP supported have to provide atomic
pmdp_invalidate() that returns previous value.

If generic implementation of pmdp_invalidate() is used, architecture
needs to provide atomic pmdp_estabish().

pmdp_estabish() is not used out-side generic implementation of
pmdp_invalidate() so far, but I think this can change in the future.

This patch (of 12):

This is an implementation of pmdp_establish() that is only suitable for
an architecture that doesn't have hardware dirty/accessed bits.  In this
case we can't race with CPU which sets these bits and non-atomic
approach is fine.

Link: 
http://lkml.kernel.org/r/20171213105756.69879-2-kirill.shute...@linux.intel.com
Signed-off-by: Kirill A. Shutemov 
Cc: Vlastimil Babka 
Cc: Andrea Arcangeli 
Cc: Michal Hocko 
Cc: Aneesh Kumar K.V 
Cc: Catalin Marinas 
Cc: David Daney 
Cc: David Miller 
Cc: H. Peter Anvin 
Cc: Hugh Dickins 
Cc: Ingo Molnar 
Cc: Martin Schwidefsky 
Cc: Nitin Gupta 
Cc: Ralf Baechle 
Cc: Thomas Gleixner 
Cc: Vineet Gupta 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/asm-generic/pgtable.h |   15 +++
 1 file changed, 15 insertions(+)

--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -181,6 +181,21 @@ extern void pgtable_trans_huge_deposit(s
 extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t 
*pmdp);
 #endif
 
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+/*
+ * This is an implementation of pmdp_establish() that is only suitable for an
+ * architecture that doesn't have hardware dirty/accessed bits. In this case we
+ * can't race with CPU which sets these bits and non-atomic aproach is fine.
+ */
+static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma,
+   unsigned long address, pmd_t *pmdp, pmd_t pmd)
+{
+   pmd_t old_pmd = *pmdp;
+   set_pmd_at(vma->vm_mm, address, pmdp, pmd);
+   return old_pmd;
+}
+#endif
+
 #ifndef __HAVE_ARCH_PMDP_INVALIDATE
 extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
pmd_t *pmdp);

[PATCH 3.18 027/185] ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: piaojun 

[ Upstream commit 025bcbde3634b2c9b316f227fed13ad6ad6817fb ]

If metadata is corrupted such as 'invalid inode block', we will get
failed by calling 'mount()' and then set filesystem readonly as below:

  ocfs2_mount
ocfs2_initialize_super
  ocfs2_init_global_system_inodes
ocfs2_iget
  ocfs2_read_locked_inode
ocfs2_validate_inode_block
  ocfs2_error
ocfs2_handle_error
  ocfs2_set_ro_flag(osb, 0);  // set readonly

In this situation we need return -EROFS to 'mount.ocfs2', so that user
can fix it by fsck.  And then mount again.  In addition, 'mount.ocfs2'
should be updated correspondingly as it only return 1 for all errno.
And I will post a patch for 'mount.ocfs2' too.

Link: http://lkml.kernel.org/r/5a4302fa.2010...@huawei.com
Signed-off-by: Jun Piao 
Reviewed-by: Alex Chen 
Reviewed-by: Joseph Qi 
Reviewed-by: Changwei Ge 
Reviewed-by: Gang He 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Junxiao Bi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 fs/ocfs2/super.c |5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -467,9 +467,8 @@ static int ocfs2_init_global_system_inod
new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
if (!new) {
ocfs2_release_system_inodes(osb);
-   status = -EINVAL;
+   status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
mlog_errno(status);
-   /* FIXME: Should ERROR_RO_FS */
mlog(ML_ERROR, "Unable to load system inode %d, "
 "possibly corrupt fs?", i);
goto bail;
@@ -498,7 +497,7 @@ static int ocfs2_init_local_system_inode
new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
if (!new) {
ocfs2_release_system_inodes(osb);
-   status = -EINVAL;
+   status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n",
 status, i, osb->slot_num);
goto bail;

Re: [PATCH V2 rdma-next 3/4] RDMA/hns: Add reset process for RoCE in hip08

[Jason Gunthorpe]

On Sat, May 26, 2018 at 09:47:43AM +0800, Wei Hu (Xavier) wrote:
> 
> 
> On 2018/5/25 22:55, Jason Gunthorpe wrote:
> > On Fri, May 25, 2018 at 01:54:31PM +0800, Wei Hu (Xavier) wrote:
> >>
> >> On 2018/5/25 5:31, Jason Gunthorpe wrote:
>   static const struct hnae3_client_ops hns_roce_hw_v2_ops = {
>   .init_instance = hns_roce_hw_v2_init_instance,
>   .uninit_instance = hns_roce_hw_v2_uninit_instance,
>  +.reset_notify = hns_roce_hw_v2_reset_notify,
>   };
>   
>   static struct hnae3_client hns_roce_hw_v2_client = {
>  diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c 
>  b/drivers/infiniband/hw/hns/hns_roce_main.c
>  index 1b79a38..ac51372 100644
>  +++ b/drivers/infiniband/hw/hns/hns_roce_main.c
>  @@ -332,6 +332,9 @@ static struct ib_ucontext 
>  *hns_roce_alloc_ucontext(struct ib_device *ib_dev,
>   struct hns_roce_ib_alloc_ucontext_resp resp = {};
>   struct hns_roce_dev *hr_dev = to_hr_dev(ib_dev);
>   
>  +if (!hr_dev->active)
>  +return ERR_PTR(-EAGAIN);
> >>> This still doesn't make sense, ib_unregister_device already makes sure
> >>> that hns_roce_alloc_ucontext isn't running and won't be called before
> >>> returning, don't need another flag to do that.
> >>>
> >>> Since this is the only place the active flag is tested it can just be 
> >>> deleted
> >>> entirely.
> >> Hi, Jason
> >>
> >> roce reset process:
> >> 1. hr_dev->active = false;  //make sure no any process call
> >> ibv_open_device.   
> >> 2. call ib_dispatch_event() function to report IB_EVENT_DEVICE_FATAL
> >> event.
> >> 3. msleep(100);   // for some app to free resources
> >> 4. call ib_unregister_device().   
> >> 5. ...
> >> 6. ...
> >>
> >> There are 2 steps as above before calling ib_unregister_device(), we
> >> evaluate
> >> hr_dev->active with false to avoid no any process call
> >> ibv_open_device.
> > If you think this is the right flow then it is core issue to block new
> > opens, not an individual driver issue, send a core patch - eg add a
> > 'ib_driver_fatal_error()' call that does the dispatch and call it from
> > all the drivers using this IB_EVENT_DEVICE_FATAL
> Hi, Jason
> 
> It seem to be no difference between calling ib_driver_fatal_error and
> calling ib_dispatch_event  directly in manufacturer driver.
> 
> void ib_driver_fatal_error(struct ib_device *ib_dev, u8 port_num)
>  {
>struct ib_event event;
> 
>   event.event = IB_EVENT_DEVICE_FATAL;
> event.device = ib_dev;
> event.element.port_num = port_num;
> ib_dispatch_event();
> }

My point was the core code should block calling
hns_roce_alloc_ucontext after DEVICE_FATAL if we agree that is
correct, the driver shouldn't be doing it.

Jason

[PATCH 3.18 033/185] IB/ipoib: Fix for potential no-carrier state

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Estrin 

[ Upstream commit 1029361084d18cc270f64dfd39529fafa10cfe01 ]

On reboot SM can program port pkey table before ipoib registered its
event handler, which could result in missing pkey event and leave root
interface with initial pkey value from index 0.

Since OPA port starts with invalid pkey in index 0, root interface will
fail to initialize and stay down with no-carrier flag.

For IB ipoib interface may end up with pkey different from value
opensm put in pkey table idx 0, resulting in connectivity issues
(different mcast groups, for example).

Close the window by calling event handler after registration
to make sure ipoib pkey is in sync with port pkey table.

Reviewed-by: Mike Marciniszyn 
Reviewed-by: Ira Weiny 
Signed-off-by: Alex Estrin 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1644,6 +1644,9 @@ static struct net_device *ipoib_add_port
goto event_failed;
}
 
+   /* call event handler to ensure pkey in sync */
+   queue_work(ipoib_workqueue, >flush_heavy);
+
result = register_netdev(priv->dev);
if (result) {
printk(KERN_WARNING "%s: couldn't register ipoib port %d; error 
%d\n",

[PATCH 3.18 033/185] IB/ipoib: Fix for potential no-carrier state

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Estrin 

[ Upstream commit 1029361084d18cc270f64dfd39529fafa10cfe01 ]

On reboot SM can program port pkey table before ipoib registered its
event handler, which could result in missing pkey event and leave root
interface with initial pkey value from index 0.

Since OPA port starts with invalid pkey in index 0, root interface will
fail to initialize and stay down with no-carrier flag.

For IB ipoib interface may end up with pkey different from value
opensm put in pkey table idx 0, resulting in connectivity issues
(different mcast groups, for example).

Close the window by calling event handler after registration
to make sure ipoib pkey is in sync with port pkey table.

Reviewed-by: Mike Marciniszyn 
Reviewed-by: Ira Weiny 
Signed-off-by: Alex Estrin 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/infiniband/ulp/ipoib/ipoib_main.c |3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1644,6 +1644,9 @@ static struct net_device *ipoib_add_port
goto event_failed;
}
 
+   /* call event handler to ensure pkey in sync */
+   queue_work(ipoib_workqueue, >flush_heavy);
+
result = register_netdev(priv->dev);
if (result) {
printk(KERN_WARNING "%s: couldn't register ipoib port %d; error 
%d\n",

[PATCH 3.18 032/185] mm: pin address_space before dereferencing it while isolating an LRU page

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

[ Upstream commit 69d763fc6d3aee787a3e8c8c35092b4f4960fa5d ]

Minchan Kim asked the following question -- what locks protects
address_space destroying when race happens between inode trauncation and
__isolate_lru_page? Jan Kara clarified by describing the race as follows

CPU1CPU2

truncate(inode) __isolate_lru_page()
  ...
  truncate_inode_page(mapping, page);
delete_from_page_cache(page)
  spin_lock_irqsave(>tree_lock, flags);
__delete_from_page_cache(page, NULL)
  page_cache_tree_delete(..)
...   mapping = page_mapping(page);
page->mapping = NULL;
...
  spin_unlock_irqrestore(>tree_lock, flags);
  page_cache_free_page(mapping, page)
put_page(page)
  if (put_page_testzero(page)) -> false
- inode now has no pages and can be freed including embedded address_space

  if (mapping && 
!mapping->a_ops->migratepage)
- we've dereferenced mapping which is potentially already free.

The race is theoretically possible but unlikely.  Before the
delete_from_page_cache, truncate_cleanup_page is called so the page is
likely to be !PageDirty or PageWriteback which gets skipped by the only
caller that checks the mappping in __isolate_lru_page.  Even if the race
occurs, a substantial amount of work has to happen during a tiny window
with no preemption but it could potentially be done using a virtual
machine to artifically slow one CPU or halt it during the critical
window.

This patch should eliminate the race with truncation by try-locking the
page before derefencing mapping and aborting if the lock was not
acquired.  There was a suggestion from Huang Ying to use RCU as a
side-effect to prevent mapping being freed.  However, I do not like the
solution as it's an unconventional means of preserving a mapping and
it's not a context where rcu_read_lock is obviously protecting rcu data.

Link: 
http://lkml.kernel.org/r/20180104102512.2qos3h5vqzeis...@techsingularity.net
Fixes: c82449352854 ("mm: compaction: make isolate_lru_page() filter-aware 
again")
Signed-off-by: Mel Gorman 
Acked-by: Minchan Kim 
Cc: "Huang, Ying" 
Cc: Jan Kara 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 mm/vmscan.c |   14 --
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1215,6 +1215,7 @@ int __isolate_lru_page(struct page *page
 
if (PageDirty(page)) {
struct address_space *mapping;
+   bool migrate_dirty;
 
/* ISOLATE_CLEAN means only clean pages */
if (mode & ISOLATE_CLEAN)
@@ -1223,10 +1224,19 @@ int __isolate_lru_page(struct page *page
/*
 * Only pages without mappings or that have a
 * ->migratepage callback are possible to migrate
-* without blocking
+* without blocking. However, we can be racing with
+* truncation so it's necessary to lock the page
+* to stabilise the mapping as truncation holds
+* the page lock until after the page is removed
+* from the page cache.
 */
+   if (!trylock_page(page))
+   return ret;
+
mapping = page_mapping(page);
-   if (mapping && !mapping->a_ops->migratepage)
+   migrate_dirty = mapping && mapping->a_ops->migratepage;
+   unlock_page(page);
+   if (!migrate_dirty)
return ret;
}
}

[PATCH 3.18 032/185] mm: pin address_space before dereferencing it while isolating an LRU page

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Mel Gorman 

[ Upstream commit 69d763fc6d3aee787a3e8c8c35092b4f4960fa5d ]

Minchan Kim asked the following question -- what locks protects
address_space destroying when race happens between inode trauncation and
__isolate_lru_page? Jan Kara clarified by describing the race as follows

CPU1CPU2

truncate(inode) __isolate_lru_page()
  ...
  truncate_inode_page(mapping, page);
delete_from_page_cache(page)
  spin_lock_irqsave(>tree_lock, flags);
__delete_from_page_cache(page, NULL)
  page_cache_tree_delete(..)
...   mapping = page_mapping(page);
page->mapping = NULL;
...
  spin_unlock_irqrestore(>tree_lock, flags);
  page_cache_free_page(mapping, page)
put_page(page)
  if (put_page_testzero(page)) -> false
- inode now has no pages and can be freed including embedded address_space

  if (mapping && 
!mapping->a_ops->migratepage)
- we've dereferenced mapping which is potentially already free.

The race is theoretically possible but unlikely.  Before the
delete_from_page_cache, truncate_cleanup_page is called so the page is
likely to be !PageDirty or PageWriteback which gets skipped by the only
caller that checks the mappping in __isolate_lru_page.  Even if the race
occurs, a substantial amount of work has to happen during a tiny window
with no preemption but it could potentially be done using a virtual
machine to artifically slow one CPU or halt it during the critical
window.

This patch should eliminate the race with truncation by try-locking the
page before derefencing mapping and aborting if the lock was not
acquired.  There was a suggestion from Huang Ying to use RCU as a
side-effect to prevent mapping being freed.  However, I do not like the
solution as it's an unconventional means of preserving a mapping and
it's not a context where rcu_read_lock is obviously protecting rcu data.

Link: 
http://lkml.kernel.org/r/20180104102512.2qos3h5vqzeis...@techsingularity.net
Fixes: c82449352854 ("mm: compaction: make isolate_lru_page() filter-aware 
again")
Signed-off-by: Mel Gorman 
Acked-by: Minchan Kim 
Cc: "Huang, Ying" 
Cc: Jan Kara 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 mm/vmscan.c |   14 --
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1215,6 +1215,7 @@ int __isolate_lru_page(struct page *page
 
if (PageDirty(page)) {
struct address_space *mapping;
+   bool migrate_dirty;
 
/* ISOLATE_CLEAN means only clean pages */
if (mode & ISOLATE_CLEAN)
@@ -1223,10 +1224,19 @@ int __isolate_lru_page(struct page *page
/*
 * Only pages without mappings or that have a
 * ->migratepage callback are possible to migrate
-* without blocking
+* without blocking. However, we can be racing with
+* truncation so it's necessary to lock the page
+* to stabilise the mapping as truncation holds
+* the page lock until after the page is removed
+* from the page cache.
 */
+   if (!trylock_page(page))
+   return ret;
+
mapping = page_mapping(page);
-   if (mapping && !mapping->a_ops->migratepage)
+   migrate_dirty = mapping && mapping->a_ops->migratepage;
+   unlock_page(page);
+   if (!migrate_dirty)
return ret;
}
}

[PATCH 3.18 008/185] xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Joe Jin 

commit 4855c92dbb7b3b85c23e88ab7ca04f99b9677b41 upstream.

When run raidconfig from Dom0 we found that the Xen DMA heap is reduced,
but Dom Heap is increased by the same size. Tracing raidconfig we found
that the related ioctl() in megaraid_sas will call dma_alloc_coherent()
to apply memory. If the memory allocated by Dom0 is not in the DMA area,
it will exchange memory with Xen to meet the requiment. Later drivers
call dma_free_coherent() to free the memory, on xen_swiotlb_free_coherent()
the check condition (dev_addr + size - 1 <= dma_mask) is always false,
it prevents calling xen_destroy_contiguous_region() to return the memory
to the Xen DMA heap.

This issue introduced by commit 6810df88dcfc2 "xen-swiotlb: When doing
coherent alloc/dealloc check before swizzling the MFNs.".

Signed-off-by: Joe Jin 
Tested-by: John Sobecki 
Reviewed-by: Rzeszutek Wilk 
Cc: sta...@vger.kernel.org
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/xen/swiotlb-xen.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -366,7 +366,7 @@ xen_swiotlb_free_coherent(struct device
 * physical address */
phys = xen_bus_to_phys(dev_addr);
 
-   if (((dev_addr + size - 1 > dma_mask)) ||
+   if (((dev_addr + size - 1 <= dma_mask)) ||
range_straddles_page_boundary(phys, size))
xen_destroy_contiguous_region(phys, order);
 

[PATCH 3.18 029/185] mm/mempolicy: fix the check of nodemask from user

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Yisheng Xie 

[ Upstream commit 56521e7a02b7b84a5e72691a1fb15570e6055545 ]

As Xiaojun reported the ltp of migrate_pages01 will fail on arm64 system
which has 4 nodes[0...3], all have memory and CONFIG_NODES_SHIFT=2:

  migrate_pages010  TINFO  :  test_invalid_nodes
  migrate_pages01   14  TFAIL  :  migrate_pages_common.c:45: unexpected failure 
- returned value = 0, expected: -1
  migrate_pages01   15  TFAIL  :  migrate_pages_common.c:55: call succeeded 
unexpectedly

In this case the test_invalid_nodes of migrate_pages01 will call:
SYSC_migrate_pages as:

  migrate_pages(0, , {0x0001}, 64, , {0x0010}, 64) = 0

The new nodes specifies one or more node IDs that are greater than the
maximum supported node ID, however, the errno is not set to EINVAL as
expected.

As man pages of set_mempolicy[1], mbind[2], and migrate_pages[3]
mentioned, when nodemask specifies one or more node IDs that are greater
than the maximum supported node ID, the errno should set to EINVAL.
However, get_nodes only check whether the part of bits
[BITS_PER_LONG*BITS_TO_LONGS(MAX_NUMNODES), maxnode) is zero or not, and
remain [MAX_NUMNODES, BITS_PER_LONG*BITS_TO_LONGS(MAX_NUMNODES)
unchecked.

This patch is to check the bits of [MAX_NUMNODES, maxnode) in get_nodes
to let migrate_pages set the errno to EINVAL when nodemask specifies one
or more node IDs that are greater than the maximum supported node ID,
which follows the manpage's guide.

[1] http://man7.org/linux/man-pages/man2/set_mempolicy.2.html
[2] http://man7.org/linux/man-pages/man2/mbind.2.html
[3] http://man7.org/linux/man-pages/man2/migrate_pages.2.html

Link: 
http://lkml.kernel.org/r/1510882624-44342-3-git-send-email-xieyishe...@huawei.com
Signed-off-by: Yisheng Xie 
Reported-by: Tan Xiaojun 
Acked-by: Vlastimil Babka 
Cc: Andi Kleen 
Cc: Chris Salls 
Cc: Christopher Lameter 
Cc: David Rientjes 
Cc: Ingo Molnar 
Cc: Naoya Horiguchi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 mm/mempolicy.c |   23 ---
 1 file changed, 20 insertions(+), 3 deletions(-)

--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1286,6 +1286,7 @@ static int get_nodes(nodemask_t *nodes,
 unsigned long maxnode)
 {
unsigned long k;
+   unsigned long t;
unsigned long nlongs;
unsigned long endmask;
 
@@ -1302,13 +1303,19 @@ static int get_nodes(nodemask_t *nodes,
else
endmask = (1UL << (maxnode % BITS_PER_LONG)) - 1;
 
-   /* When the user specified more nodes than supported just check
-  if the non supported part is all zero. */
+   /*
+* When the user specified more nodes than supported just check
+* if the non supported part is all zero.
+*
+* If maxnode have more longs than MAX_NUMNODES, check
+* the bits in that area first. And then go through to
+* check the rest bits which equal or bigger than MAX_NUMNODES.
+* Otherwise, just check bits [MAX_NUMNODES, maxnode).
+*/
if (nlongs > BITS_TO_LONGS(MAX_NUMNODES)) {
if (nlongs > PAGE_SIZE/sizeof(long))
return -EINVAL;
for (k = BITS_TO_LONGS(MAX_NUMNODES); k < nlongs; k++) {
-   unsigned long t;
if (get_user(t, nmask + k))
return -EFAULT;
if (k == nlongs - 1) {
@@ -1321,6 +1328,16 @@ static int get_nodes(nodemask_t *nodes,
endmask = ~0UL;
}
 
+   if (maxnode > MAX_NUMNODES && MAX_NUMNODES % BITS_PER_LONG != 0) {
+   unsigned long valid_mask = endmask;
+
+   valid_mask &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1);
+   if (get_user(t, nmask + nlongs - 1))
+   return -EFAULT;
+   if (t & valid_mask)
+   return -EINVAL;
+   }
+
if (copy_from_user(nodes_addr(*nodes), nmask, nlongs*sizeof(unsigned 
long)))
return -EFAULT;
nodes_addr(*nodes)[nlongs-1] &= endmask;

[PATCH 3.18 008/185] xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Joe Jin 

commit 4855c92dbb7b3b85c23e88ab7ca04f99b9677b41 upstream.

When run raidconfig from Dom0 we found that the Xen DMA heap is reduced,
but Dom Heap is increased by the same size. Tracing raidconfig we found
that the related ioctl() in megaraid_sas will call dma_alloc_coherent()
to apply memory. If the memory allocated by Dom0 is not in the DMA area,
it will exchange memory with Xen to meet the requiment. Later drivers
call dma_free_coherent() to free the memory, on xen_swiotlb_free_coherent()
the check condition (dev_addr + size - 1 <= dma_mask) is always false,
it prevents calling xen_destroy_contiguous_region() to return the memory
to the Xen DMA heap.

This issue introduced by commit 6810df88dcfc2 "xen-swiotlb: When doing
coherent alloc/dealloc check before swizzling the MFNs.".

Signed-off-by: Joe Jin 
Tested-by: John Sobecki 
Reviewed-by: Rzeszutek Wilk 
Cc: sta...@vger.kernel.org
Signed-off-by: Konrad Rzeszutek Wilk 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/xen/swiotlb-xen.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -366,7 +366,7 @@ xen_swiotlb_free_coherent(struct device
 * physical address */
phys = xen_bus_to_phys(dev_addr);
 
-   if (((dev_addr + size - 1 > dma_mask)) ||
+   if (((dev_addr + size - 1 <= dma_mask)) ||
range_straddles_page_boundary(phys, size))
xen_destroy_contiguous_region(phys, order);
 

[PATCH 3.18 029/185] mm/mempolicy: fix the check of nodemask from user

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Yisheng Xie 

[ Upstream commit 56521e7a02b7b84a5e72691a1fb15570e6055545 ]

As Xiaojun reported the ltp of migrate_pages01 will fail on arm64 system
which has 4 nodes[0...3], all have memory and CONFIG_NODES_SHIFT=2:

  migrate_pages010  TINFO  :  test_invalid_nodes
  migrate_pages01   14  TFAIL  :  migrate_pages_common.c:45: unexpected failure 
- returned value = 0, expected: -1
  migrate_pages01   15  TFAIL  :  migrate_pages_common.c:55: call succeeded 
unexpectedly

In this case the test_invalid_nodes of migrate_pages01 will call:
SYSC_migrate_pages as:

  migrate_pages(0, , {0x0001}, 64, , {0x0010}, 64) = 0

The new nodes specifies one or more node IDs that are greater than the
maximum supported node ID, however, the errno is not set to EINVAL as
expected.

As man pages of set_mempolicy[1], mbind[2], and migrate_pages[3]
mentioned, when nodemask specifies one or more node IDs that are greater
than the maximum supported node ID, the errno should set to EINVAL.
However, get_nodes only check whether the part of bits
[BITS_PER_LONG*BITS_TO_LONGS(MAX_NUMNODES), maxnode) is zero or not, and
remain [MAX_NUMNODES, BITS_PER_LONG*BITS_TO_LONGS(MAX_NUMNODES)
unchecked.

This patch is to check the bits of [MAX_NUMNODES, maxnode) in get_nodes
to let migrate_pages set the errno to EINVAL when nodemask specifies one
or more node IDs that are greater than the maximum supported node ID,
which follows the manpage's guide.

[1] http://man7.org/linux/man-pages/man2/set_mempolicy.2.html
[2] http://man7.org/linux/man-pages/man2/mbind.2.html
[3] http://man7.org/linux/man-pages/man2/migrate_pages.2.html

Link: 
http://lkml.kernel.org/r/1510882624-44342-3-git-send-email-xieyishe...@huawei.com
Signed-off-by: Yisheng Xie 
Reported-by: Tan Xiaojun 
Acked-by: Vlastimil Babka 
Cc: Andi Kleen 
Cc: Chris Salls 
Cc: Christopher Lameter 
Cc: David Rientjes 
Cc: Ingo Molnar 
Cc: Naoya Horiguchi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 mm/mempolicy.c |   23 ---
 1 file changed, 20 insertions(+), 3 deletions(-)

--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1286,6 +1286,7 @@ static int get_nodes(nodemask_t *nodes,
 unsigned long maxnode)
 {
unsigned long k;
+   unsigned long t;
unsigned long nlongs;
unsigned long endmask;
 
@@ -1302,13 +1303,19 @@ static int get_nodes(nodemask_t *nodes,
else
endmask = (1UL << (maxnode % BITS_PER_LONG)) - 1;
 
-   /* When the user specified more nodes than supported just check
-  if the non supported part is all zero. */
+   /*
+* When the user specified more nodes than supported just check
+* if the non supported part is all zero.
+*
+* If maxnode have more longs than MAX_NUMNODES, check
+* the bits in that area first. And then go through to
+* check the rest bits which equal or bigger than MAX_NUMNODES.
+* Otherwise, just check bits [MAX_NUMNODES, maxnode).
+*/
if (nlongs > BITS_TO_LONGS(MAX_NUMNODES)) {
if (nlongs > PAGE_SIZE/sizeof(long))
return -EINVAL;
for (k = BITS_TO_LONGS(MAX_NUMNODES); k < nlongs; k++) {
-   unsigned long t;
if (get_user(t, nmask + k))
return -EFAULT;
if (k == nlongs - 1) {
@@ -1321,6 +1328,16 @@ static int get_nodes(nodemask_t *nodes,
endmask = ~0UL;
}
 
+   if (maxnode > MAX_NUMNODES && MAX_NUMNODES % BITS_PER_LONG != 0) {
+   unsigned long valid_mask = endmask;
+
+   valid_mask &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1);
+   if (get_user(t, nmask + nlongs - 1))
+   return -EFAULT;
+   if (t & valid_mask)
+   return -EINVAL;
+   }
+
if (copy_from_user(nodes_addr(*nodes), nmask, nlongs*sizeof(unsigned 
long)))
return -EFAULT;
nodes_addr(*nodes)[nlongs-1] &= endmask;

Re: [PATCH] perf tools: Fix indexing for decoder packet queue

[Mathieu Poirier]

On 27 May 2018 at 21:13, Leo Yan  wrote:
> On Fri, May 25, 2018 at 05:10:54PM -0600, Mathieu Poirier wrote:
>> The tail of a queue is supposed to be pointing to the next available slot
>> in a queue.  In this implementation the tail is incremented before it is
>> used and as such points to the last used element, something that has the
>> immense advantage of centralizing tail management at a single location
>> and eliminating a lot of redundant code.
>>
>> But this needs to be taken into consideration on the dequeueing side where
>> the head also needs to be incremented before it is used, or the first
>> available element of the queue will be skipped.
>>
>> Signed-off-by: Mathieu Poirier 
>> ---
>>  tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 12 ++--
>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c 
>> b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
>> index c8b98fa22997..4d5fc374e730 100644
>> --- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
>> +++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
>> @@ -96,11 +96,19 @@ int cs_etm_decoder__get_packet(struct cs_etm_decoder 
>> *decoder,
>>   /* Nothing to do, might as well just return */
>>   if (decoder->packet_count == 0)
>>   return 0;
>> + /*
>> + * The queueing process in function cs_etm_decoder__buffer_packet()
>> + * increments the tail *before* using it.  This is somewhat counter
>> + * intuitive but it has the advantage of centralizing tail management
>> + * at a single location.  Because of that we need to follow the same
>> + * heuristic with the head, i.e we increment it before using its
>> + * value.  Otherwise the first element of the packet queue is not
>> + * used.
>> + */
>> + decoder->head = (decoder->head + 1) & (MAX_BUFFER - 1);
>>
>>   *packet = decoder->packet_buffer[decoder->head];
>>
>> - decoder->head = (decoder->head + 1) & (MAX_BUFFER - 1);
>> -
>
> I tested this patch and confirmed it can work well with python
> decoding script:
>
> Tested-by: Leo Yan 
>
> Actually, I have another idea for this fixing, seems to me
> the unchanged code has right logic for decoder->head, and I think this
> issue is more related with incorrect initialization index.  So we can
> change the initialization index for decoder->head as below.  How about
> you think for this?
>
> diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> index c8b98fa..b133260 100644
> --- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> +++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> @@ -249,7 +249,7 @@ static void cs_etm_decoder__clear_buffer(struct
> cs_etm_decoder *decoder)
>  {
> int i;
>
> -   decoder->head = 0;
> +   decoder->head = 1;

I flirted with that idea but thought the problem is really with the
tail and as such would have done:

decoder->tail = -1;

But since both head and tail are declared as u32 it would have
required changing the types to int, necessitating modifications
everywhere other parts of the code deals with them.  As such I just
decided to swap the order of events in cs_etm_decoder__get_packet().

I'm not strongly opinionated on this and can send another patch if you're keen.

Thanks for the feedback,
Mathieu


> decoder->tail = 0;
> decoder->packet_count = 0;
> for (i = 0; i < MAX_BUFFER; i++) {
>
> Thanks,
> Leo Yan
>
>>   decoder->packet_count--;
>>
>>   return 1;
>> --
>> 2.7.4
>>

Re: [PATCH] perf tools: Fix indexing for decoder packet queue

[Mathieu Poirier]

On 27 May 2018 at 21:13, Leo Yan  wrote:
> On Fri, May 25, 2018 at 05:10:54PM -0600, Mathieu Poirier wrote:
>> The tail of a queue is supposed to be pointing to the next available slot
>> in a queue.  In this implementation the tail is incremented before it is
>> used and as such points to the last used element, something that has the
>> immense advantage of centralizing tail management at a single location
>> and eliminating a lot of redundant code.
>>
>> But this needs to be taken into consideration on the dequeueing side where
>> the head also needs to be incremented before it is used, or the first
>> available element of the queue will be skipped.
>>
>> Signed-off-by: Mathieu Poirier 
>> ---
>>  tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 12 ++--
>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c 
>> b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
>> index c8b98fa22997..4d5fc374e730 100644
>> --- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
>> +++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
>> @@ -96,11 +96,19 @@ int cs_etm_decoder__get_packet(struct cs_etm_decoder 
>> *decoder,
>>   /* Nothing to do, might as well just return */
>>   if (decoder->packet_count == 0)
>>   return 0;
>> + /*
>> + * The queueing process in function cs_etm_decoder__buffer_packet()
>> + * increments the tail *before* using it.  This is somewhat counter
>> + * intuitive but it has the advantage of centralizing tail management
>> + * at a single location.  Because of that we need to follow the same
>> + * heuristic with the head, i.e we increment it before using its
>> + * value.  Otherwise the first element of the packet queue is not
>> + * used.
>> + */
>> + decoder->head = (decoder->head + 1) & (MAX_BUFFER - 1);
>>
>>   *packet = decoder->packet_buffer[decoder->head];
>>
>> - decoder->head = (decoder->head + 1) & (MAX_BUFFER - 1);
>> -
>
> I tested this patch and confirmed it can work well with python
> decoding script:
>
> Tested-by: Leo Yan 
>
> Actually, I have another idea for this fixing, seems to me
> the unchanged code has right logic for decoder->head, and I think this
> issue is more related with incorrect initialization index.  So we can
> change the initialization index for decoder->head as below.  How about
> you think for this?
>
> diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> index c8b98fa..b133260 100644
> --- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> +++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
> @@ -249,7 +249,7 @@ static void cs_etm_decoder__clear_buffer(struct
> cs_etm_decoder *decoder)
>  {
> int i;
>
> -   decoder->head = 0;
> +   decoder->head = 1;

I flirted with that idea but thought the problem is really with the
tail and as such would have done:

decoder->tail = -1;

But since both head and tail are declared as u32 it would have
required changing the types to int, necessitating modifications
everywhere other parts of the code deals with them.  As such I just
decided to swap the order of events in cs_etm_decoder__get_packet().

I'm not strongly opinionated on this and can send another patch if you're keen.

Thanks for the feedback,
Mathieu


> decoder->tail = 0;
> decoder->packet_count = 0;
> for (i = 0; i < MAX_BUFFER; i++) {
>
> Thanks,
> Leo Yan
>
>>   decoder->packet_count--;
>>
>>   return 1;
>> --
>> 2.7.4
>>

[PATCH 3.18 007/185] libata: Blacklist some Sandisk SSDs for NCQ

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Tejun Heo 

commit 322579dcc865b94b47345ad1b6002ad167f85405 upstream.

Sandisk SSDs SD7SN6S256G and SD8SN8U256G are regularly locking up
regularly under sustained moderate load with NCQ enabled.  Blacklist
for now.

Signed-off-by: Tejun Heo 
Reported-by: Dave Jones 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ata/libata-core.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4188,6 +4188,10 @@ static const struct ata_blacklist_entry
/* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
{ "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, },
 
+   /* Some Sandisk SSDs lock up hard with NCQ enabled.  Reported on
+  SD7SN6S256G and SD8SN8U256G */
+   { "SanDisk SD[78]SN*G", NULL,   ATA_HORKAGE_NONCQ, },
+
/* devices which puke on READ_NATIVE_MAX */
{ "HDS724040KLSA80","KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
{ "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA },

[PATCH 3.18 034/185] x86/power: Fix swsusp_arch_resume prototype

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

[ Upstream commit 328008a72d38b5bde6491e463405c34a81a65d3e ]

The declaration for swsusp_arch_resume marks it as 'asmlinkage', but the
definition in x86-32 does not, and it fails to include the header with the
declaration. This leads to a warning when building with
link-time-optimizations:

kernel/power/power.h:108:23: error: type of 'swsusp_arch_resume' does not match 
original declaration [-Werror=lto-type-mismatch]
 extern asmlinkage int swsusp_arch_resume(void);
   ^
arch/x86/power/hibernate_32.c:148:0: note: 'swsusp_arch_resume' was previously 
declared here
 int swsusp_arch_resume(void)

This moves the declaration into a globally visible header file and fixes up
both x86 definitions to match it.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Thomas Gleixner 
Cc: Len Brown 
Cc: Andi Kleen 
Cc: Nicolas Pitre 
Cc: linux...@vger.kernel.org
Cc: "Rafael J. Wysocki" 
Cc: Pavel Machek 
Cc: Bart Van Assche 
Link: https://lkml.kernel.org/r/20180202145634.200291-2-a...@arndb.de
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/x86/power/hibernate_32.c |2 +-
 arch/x86/power/hibernate_64.c |2 +-
 include/linux/suspend.h   |2 ++
 kernel/power/power.h  |3 ---
 4 files changed, 4 insertions(+), 5 deletions(-)

--- a/arch/x86/power/hibernate_32.c
+++ b/arch/x86/power/hibernate_32.c
@@ -142,7 +142,7 @@ static inline void resume_init_first_lev
 #endif
 }
 
-int swsusp_arch_resume(void)
+asmlinkage int swsusp_arch_resume(void)
 {
int error;
 
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -78,7 +78,7 @@ static int set_up_temporary_mappings(voi
return 0;
 }
 
-int swsusp_arch_resume(void)
+asmlinkage int swsusp_arch_resume(void)
 {
int error;
 
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -325,6 +325,8 @@ extern int swsusp_page_is_forbidden(stru
 extern void swsusp_set_page_free(struct page *);
 extern void swsusp_unset_page_free(struct page *);
 extern unsigned long get_safe_page(gfp_t gfp_mask);
+extern asmlinkage int swsusp_arch_suspend(void);
+extern asmlinkage int swsusp_arch_resume(void);
 
 extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
 extern int hibernate(void);
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -85,9 +85,6 @@ extern int in_suspend;
 extern dev_t swsusp_resume_device;
 extern sector_t swsusp_resume_block;
 
-extern asmlinkage int swsusp_arch_suspend(void);
-extern asmlinkage int swsusp_arch_resume(void);
-
 extern int create_basic_memory_bitmaps(void);
 extern void free_basic_memory_bitmaps(void);
 extern int hibernate_preallocate_memory(void);

[PATCH 3.18 007/185] libata: Blacklist some Sandisk SSDs for NCQ

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Tejun Heo 

commit 322579dcc865b94b47345ad1b6002ad167f85405 upstream.

Sandisk SSDs SD7SN6S256G and SD8SN8U256G are regularly locking up
regularly under sustained moderate load with NCQ enabled.  Blacklist
for now.

Signed-off-by: Tejun Heo 
Reported-by: Dave Jones 
Cc: sta...@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/ata/libata-core.c |4 
 1 file changed, 4 insertions(+)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4188,6 +4188,10 @@ static const struct ata_blacklist_entry
/* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
{ "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, },
 
+   /* Some Sandisk SSDs lock up hard with NCQ enabled.  Reported on
+  SD7SN6S256G and SD8SN8U256G */
+   { "SanDisk SD[78]SN*G", NULL,   ATA_HORKAGE_NONCQ, },
+
/* devices which puke on READ_NATIVE_MAX */
{ "HDS724040KLSA80","KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
{ "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA },

[PATCH 3.18 034/185] x86/power: Fix swsusp_arch_resume prototype

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

[ Upstream commit 328008a72d38b5bde6491e463405c34a81a65d3e ]

The declaration for swsusp_arch_resume marks it as 'asmlinkage', but the
definition in x86-32 does not, and it fails to include the header with the
declaration. This leads to a warning when building with
link-time-optimizations:

kernel/power/power.h:108:23: error: type of 'swsusp_arch_resume' does not match 
original declaration [-Werror=lto-type-mismatch]
 extern asmlinkage int swsusp_arch_resume(void);
   ^
arch/x86/power/hibernate_32.c:148:0: note: 'swsusp_arch_resume' was previously 
declared here
 int swsusp_arch_resume(void)

This moves the declaration into a globally visible header file and fixes up
both x86 definitions to match it.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Thomas Gleixner 
Cc: Len Brown 
Cc: Andi Kleen 
Cc: Nicolas Pitre 
Cc: linux...@vger.kernel.org
Cc: "Rafael J. Wysocki" 
Cc: Pavel Machek 
Cc: Bart Van Assche 
Link: https://lkml.kernel.org/r/20180202145634.200291-2-a...@arndb.de
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/x86/power/hibernate_32.c |2 +-
 arch/x86/power/hibernate_64.c |2 +-
 include/linux/suspend.h   |2 ++
 kernel/power/power.h  |3 ---
 4 files changed, 4 insertions(+), 5 deletions(-)

--- a/arch/x86/power/hibernate_32.c
+++ b/arch/x86/power/hibernate_32.c
@@ -142,7 +142,7 @@ static inline void resume_init_first_lev
 #endif
 }
 
-int swsusp_arch_resume(void)
+asmlinkage int swsusp_arch_resume(void)
 {
int error;
 
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -78,7 +78,7 @@ static int set_up_temporary_mappings(voi
return 0;
 }
 
-int swsusp_arch_resume(void)
+asmlinkage int swsusp_arch_resume(void)
 {
int error;
 
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -325,6 +325,8 @@ extern int swsusp_page_is_forbidden(stru
 extern void swsusp_set_page_free(struct page *);
 extern void swsusp_unset_page_free(struct page *);
 extern unsigned long get_safe_page(gfp_t gfp_mask);
+extern asmlinkage int swsusp_arch_suspend(void);
+extern asmlinkage int swsusp_arch_resume(void);
 
 extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
 extern int hibernate(void);
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -85,9 +85,6 @@ extern int in_suspend;
 extern dev_t swsusp_resume_device;
 extern sector_t swsusp_resume_block;
 
-extern asmlinkage int swsusp_arch_suspend(void);
-extern asmlinkage int swsusp_arch_resume(void);
-
 extern int create_basic_memory_bitmaps(void);
 extern void free_basic_memory_bitmaps(void);
 extern int hibernate_preallocate_memory(void);

Re: [PATCH] IB: Revert "remove redundant INFINIBAND kconfig dependencies"

[Jason Gunthorpe]

On Fri, May 25, 2018 at 11:29:59PM +0200, Arnd Bergmann wrote:
> Several subsystems depend on INFINIBAND_ADDR_TRANS, which in turn depends
> on INFINIBAND. However, when with CONFIG_INIFIBAND=m, this leads to a
> link error when another driver using it is built-in. The
> INFINIBAND_ADDR_TRANS dependency is insufficient here as this is
> a 'bool' symbol that does not force anything to be a module in turn.
> 
> fs/cifs/smbdirect.o: In function `smbd_disconnect_rdma_work':
> smbdirect.c:(.text+0x1e4): undefined reference to `rdma_disconnect'
> net/9p/trans_rdma.o: In function `rdma_request':
> trans_rdma.c:(.text+0x7bc): undefined reference to `rdma_disconnect'
> net/9p/trans_rdma.o: In function `rdma_destroy_trans':
> trans_rdma.c:(.text+0x830): undefined reference to `ib_destroy_qp'
> trans_rdma.c:(.text+0x858): undefined reference to `ib_dealloc_pd'
> 
> Fixes: 9533b292a7ac ("IB: remove redundant INFINIBAND kconfig dependencies")
> Signed-off-by: Arnd Bergmann 
> Acked-by: Greg Thelen 
> ---
> The patch that introduced the problem has been queued in the
> rdma-fixes/for-rc tree. Please revert the patch before sending
> the branch to Linus.
> ---
>  drivers/infiniband/ulp/srpt/Kconfig | 2 +-
>  drivers/nvme/host/Kconfig   | 2 +-
>  drivers/nvme/target/Kconfig | 2 +-
>  drivers/staging/lustre/lnet/Kconfig | 2 +-
>  fs/cifs/Kconfig | 2 +-
>  net/9p/Kconfig  | 2 +-
>  net/rds/Kconfig | 2 +-
>  net/sunrpc/Kconfig  | 2 +-
>  8 files changed, 8 insertions(+), 8 deletions(-)

Applied to for-rc, thanks

Jason

[PATCH 3.18 010/185] firewire-ohci: work around oversized DMA reads on JMicron controllers

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Hector Martin 

[ Upstream commit 188775181bc05f29372b305ef96485840e351fde ]

At least some JMicron controllers issue buggy oversized DMA reads when
fetching context descriptors, always fetching 0x20 bytes at once for
descriptors which are only 0x10 bytes long. This is often harmless, but
can cause page faults on modern systems with IOMMUs:

DMAR: [DMA Read] Request device [05:00.0] fault addr fff56000 [fault reason 06] 
PTE Read access is not set
firewire_ohci :05:00.0: DMA context IT0 has stopped, error code: 
evt_descriptor_read

This works around the problem by always leaving 0x10 padding bytes at
the end of descriptor buffer pages, which should be harmless to do
unconditionally for controllers in case others have the same behavior.

Signed-off-by: Hector Martin 
Reviewed-by: Clemens Ladisch 
Signed-off-by: Stefan Richter 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/firewire/ohci.c |8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -1137,7 +1137,13 @@ static int context_add_buffer(struct con
return -ENOMEM;
 
offset = (void *)>buffer - (void *)desc;
-   desc->buffer_size = PAGE_SIZE - offset;
+   /*
+* Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
+* for descriptors, even 0x10-byte ones. This can cause page faults when
+* an IOMMU is in use and the oversized read crosses a page boundary.
+* Work around this by always leaving at least 0x10 bytes of padding.
+*/
+   desc->buffer_size = PAGE_SIZE - offset - 0x10;
desc->buffer_bus = bus_addr + offset;
desc->used = 0;
 

[PATCH 3.18 010/185] firewire-ohci: work around oversized DMA reads on JMicron controllers

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Hector Martin 

[ Upstream commit 188775181bc05f29372b305ef96485840e351fde ]

At least some JMicron controllers issue buggy oversized DMA reads when
fetching context descriptors, always fetching 0x20 bytes at once for
descriptors which are only 0x10 bytes long. This is often harmless, but
can cause page faults on modern systems with IOMMUs:

DMAR: [DMA Read] Request device [05:00.0] fault addr fff56000 [fault reason 06] 
PTE Read access is not set
firewire_ohci :05:00.0: DMA context IT0 has stopped, error code: 
evt_descriptor_read

This works around the problem by always leaving 0x10 padding bytes at
the end of descriptor buffer pages, which should be harmless to do
unconditionally for controllers in case others have the same behavior.

Signed-off-by: Hector Martin 
Reviewed-by: Clemens Ladisch 
Signed-off-by: Stefan Richter 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/firewire/ohci.c |8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -1137,7 +1137,13 @@ static int context_add_buffer(struct con
return -ENOMEM;
 
offset = (void *)>buffer - (void *)desc;
-   desc->buffer_size = PAGE_SIZE - offset;
+   /*
+* Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
+* for descriptors, even 0x10-byte ones. This can cause page faults when
+* an IOMMU is in use and the oversized read crosses a page boundary.
+* Work around this by always leaving at least 0x10 bytes of padding.
+*/
+   desc->buffer_size = PAGE_SIZE - offset - 0x10;
desc->buffer_bus = bus_addr + offset;
desc->used = 0;
 

Re: [PATCH] IB: Revert "remove redundant INFINIBAND kconfig dependencies"

[Jason Gunthorpe]

On Fri, May 25, 2018 at 11:29:59PM +0200, Arnd Bergmann wrote:
> Several subsystems depend on INFINIBAND_ADDR_TRANS, which in turn depends
> on INFINIBAND. However, when with CONFIG_INIFIBAND=m, this leads to a
> link error when another driver using it is built-in. The
> INFINIBAND_ADDR_TRANS dependency is insufficient here as this is
> a 'bool' symbol that does not force anything to be a module in turn.
> 
> fs/cifs/smbdirect.o: In function `smbd_disconnect_rdma_work':
> smbdirect.c:(.text+0x1e4): undefined reference to `rdma_disconnect'
> net/9p/trans_rdma.o: In function `rdma_request':
> trans_rdma.c:(.text+0x7bc): undefined reference to `rdma_disconnect'
> net/9p/trans_rdma.o: In function `rdma_destroy_trans':
> trans_rdma.c:(.text+0x830): undefined reference to `ib_destroy_qp'
> trans_rdma.c:(.text+0x858): undefined reference to `ib_dealloc_pd'
> 
> Fixes: 9533b292a7ac ("IB: remove redundant INFINIBAND kconfig dependencies")
> Signed-off-by: Arnd Bergmann 
> Acked-by: Greg Thelen 
> ---
> The patch that introduced the problem has been queued in the
> rdma-fixes/for-rc tree. Please revert the patch before sending
> the branch to Linus.
> ---
>  drivers/infiniband/ulp/srpt/Kconfig | 2 +-
>  drivers/nvme/host/Kconfig   | 2 +-
>  drivers/nvme/target/Kconfig | 2 +-
>  drivers/staging/lustre/lnet/Kconfig | 2 +-
>  fs/cifs/Kconfig | 2 +-
>  net/9p/Kconfig  | 2 +-
>  net/rds/Kconfig | 2 +-
>  net/sunrpc/Kconfig  | 2 +-
>  8 files changed, 8 insertions(+), 8 deletions(-)

Applied to for-rc, thanks

Jason

[PATCH 3.18 001/185] MIPS: ptrace: Expose FIR register through FP regset

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Maciej W. Rozycki 

commit 71e909c0cdad28a1df1fa14442929e68615dee45 upstream.

Correct commit 7aeb753b5353 ("MIPS: Implement task_user_regset_view.")
and expose the FIR register using the unused 4 bytes at the end of the
NT_PRFPREG regset.  Without that register included clients cannot use
the PTRACE_GETREGSET request to retrieve the complete FPU register set
and have to resort to one of the older interfaces, either PTRACE_PEEKUSR
or PTRACE_GETFPREGS, to retrieve the missing piece of data.  Also the
register is irreversibly missing from core dumps.

This register is architecturally hardwired and read-only so the write
path does not matter.  Ignore data supplied on writes then.

Fixes: 7aeb753b5353 ("MIPS: Implement task_user_regset_view.")
Signed-off-by: James Hogan 
Signed-off-by: Maciej W. Rozycki 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc:  # 3.13+
Patchwork: https://patchwork.linux-mips.org/patch/19273/
Signed-off-by: James Hogan 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kernel/ptrace.c |   18 --
 1 file changed, 16 insertions(+), 2 deletions(-)

--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -444,7 +444,7 @@ static int fpr_get_msa(struct task_struc
 /*
  * Copy the floating-point context to the supplied NT_PRFPREG buffer.
  * Choose the appropriate helper for general registers, and then copy
- * the FCSR register separately.
+ * the FCSR and FIR registers separately.
  */
 static int fpr_get(struct task_struct *target,
   const struct user_regset *regset,
@@ -452,6 +452,7 @@ static int fpr_get(struct task_struct *t
   void *kbuf, void __user *ubuf)
 {
const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
+   const int fir_pos = fcr31_pos + sizeof(u32);
int err;
 
if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
@@ -464,6 +465,12 @@ static int fpr_get(struct task_struct *t
err = user_regset_copyout(, , , ,
  >thread.fpu.fcr31,
  fcr31_pos, fcr31_pos + sizeof(u32));
+   if (err)
+   return err;
+
+   err = user_regset_copyout(, , , ,
+ _cpu_data.fpu_id,
+ fir_pos, fir_pos + sizeof(u32));
 
return err;
 }
@@ -512,7 +519,8 @@ static int fpr_set_msa(struct task_struc
 /*
  * Copy the supplied NT_PRFPREG buffer to the floating-point context.
  * Choose the appropriate helper for general registers, and then copy
- * the FCSR register separately.
+ * the FCSR register separately.  Ignore the incoming FIR register
+ * contents though, as the register is read-only.
  *
  * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
  * which is supposed to have been guaranteed by the kernel before
@@ -526,6 +534,7 @@ static int fpr_set(struct task_struct *t
   const void *kbuf, const void __user *ubuf)
 {
const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
+   const int fir_pos = fcr31_pos + sizeof(u32);
u32 fcr31;
int err;
 
@@ -551,6 +560,11 @@ static int fpr_set(struct task_struct *t
target->thread.fpu.fcr31 = fcr31 & ~FPU_CSR_ALL_X;
}
 
+   if (count > 0)
+   err = user_regset_copyin_ignore(, , , ,
+   fir_pos,
+   fir_pos + sizeof(u32));
+
return err;
 }
 

[PATCH 3.18 001/185] MIPS: ptrace: Expose FIR register through FP regset

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Maciej W. Rozycki 

commit 71e909c0cdad28a1df1fa14442929e68615dee45 upstream.

Correct commit 7aeb753b5353 ("MIPS: Implement task_user_regset_view.")
and expose the FIR register using the unused 4 bytes at the end of the
NT_PRFPREG regset.  Without that register included clients cannot use
the PTRACE_GETREGSET request to retrieve the complete FPU register set
and have to resort to one of the older interfaces, either PTRACE_PEEKUSR
or PTRACE_GETFPREGS, to retrieve the missing piece of data.  Also the
register is irreversibly missing from core dumps.

This register is architecturally hardwired and read-only so the write
path does not matter.  Ignore data supplied on writes then.

Fixes: 7aeb753b5353 ("MIPS: Implement task_user_regset_view.")
Signed-off-by: James Hogan 
Signed-off-by: Maciej W. Rozycki 
Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc:  # 3.13+
Patchwork: https://patchwork.linux-mips.org/patch/19273/
Signed-off-by: James Hogan 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/mips/kernel/ptrace.c |   18 --
 1 file changed, 16 insertions(+), 2 deletions(-)

--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -444,7 +444,7 @@ static int fpr_get_msa(struct task_struc
 /*
  * Copy the floating-point context to the supplied NT_PRFPREG buffer.
  * Choose the appropriate helper for general registers, and then copy
- * the FCSR register separately.
+ * the FCSR and FIR registers separately.
  */
 static int fpr_get(struct task_struct *target,
   const struct user_regset *regset,
@@ -452,6 +452,7 @@ static int fpr_get(struct task_struct *t
   void *kbuf, void __user *ubuf)
 {
const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
+   const int fir_pos = fcr31_pos + sizeof(u32);
int err;
 
if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
@@ -464,6 +465,12 @@ static int fpr_get(struct task_struct *t
err = user_regset_copyout(, , , ,
  >thread.fpu.fcr31,
  fcr31_pos, fcr31_pos + sizeof(u32));
+   if (err)
+   return err;
+
+   err = user_regset_copyout(, , , ,
+ _cpu_data.fpu_id,
+ fir_pos, fir_pos + sizeof(u32));
 
return err;
 }
@@ -512,7 +519,8 @@ static int fpr_set_msa(struct task_struc
 /*
  * Copy the supplied NT_PRFPREG buffer to the floating-point context.
  * Choose the appropriate helper for general registers, and then copy
- * the FCSR register separately.
+ * the FCSR register separately.  Ignore the incoming FIR register
+ * contents though, as the register is read-only.
  *
  * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
  * which is supposed to have been guaranteed by the kernel before
@@ -526,6 +534,7 @@ static int fpr_set(struct task_struct *t
   const void *kbuf, const void __user *ubuf)
 {
const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
+   const int fir_pos = fcr31_pos + sizeof(u32);
u32 fcr31;
int err;
 
@@ -551,6 +560,11 @@ static int fpr_set(struct task_struct *t
target->thread.fpu.fcr31 = fcr31 & ~FPU_CSR_ALL_X;
}
 
+   if (count > 0)
+   err = user_regset_copyin_ignore(, , , ,
+   fir_pos,
+   fir_pos + sizeof(u32));
+
return err;
 }
 

[PATCH 3.18 036/185] ACPI: processor_perflib: Do not send _PPC change notification if not ready

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen Yu 

[ Upstream commit ba1edb9a5125a617d612f98eead14b9b84e75c3a ]

The following warning was triggered after resumed from S3 -
if all the nonboot CPUs were put offline before suspend:

[ 1840.329515] unchecked MSR access error: RDMSR from 0x771 at rIP: 
0x86061e3a (native_read_msr+0xa/0x30)
[ 1840.329516] Call Trace:
[ 1840.329521]  __rdmsr_on_cpu+0x33/0x50
[ 1840.329525]  generic_exec_single+0x81/0xb0
[ 1840.329527]  smp_call_function_single+0xd2/0x100
[ 1840.329530]  ? acpi_ds_result_pop+0xdd/0xf2
[ 1840.329532]  ? acpi_ds_create_operand+0x215/0x23c
[ 1840.329534]  rdmsrl_on_cpu+0x57/0x80
[ 1840.329536]  ? cpumask_next+0x1b/0x20
[ 1840.329538]  ? rdmsrl_on_cpu+0x57/0x80
[ 1840.329541]  intel_pstate_update_perf_limits+0xf3/0x220
[ 1840.329544]  ? notifier_call_chain+0x4a/0x70
[ 1840.329546]  intel_pstate_set_policy+0x4e/0x150
[ 1840.329548]  cpufreq_set_policy+0xcd/0x2f0
[ 1840.329550]  cpufreq_update_policy+0xb2/0x130
[ 1840.329552]  ? cpufreq_update_policy+0x130/0x130
[ 1840.329556]  acpi_processor_ppc_has_changed+0x65/0x80
[ 1840.329558]  acpi_processor_notify+0x80/0x100
[ 1840.329561]  acpi_ev_notify_dispatch+0x44/0x5c
[ 1840.329563]  acpi_os_execute_deferred+0x14/0x20
[ 1840.329565]  process_one_work+0x193/0x3c0
[ 1840.329567]  worker_thread+0x35/0x3b0
[ 1840.329569]  kthread+0x125/0x140
[ 1840.329571]  ? process_one_work+0x3c0/0x3c0
[ 1840.329572]  ? kthread_park+0x60/0x60
[ 1840.329575]  ? do_syscall_64+0x67/0x180
[ 1840.329577]  ret_from_fork+0x25/0x30
[ 1840.329585] unchecked MSR access error: WRMSR to 0x774 (tried to write 
0x) at rIP: 0x86061f78 (native_write_msr+0x8/0x30)
[ 1840.329586] Call Trace:
[ 1840.329587]  __wrmsr_on_cpu+0x37/0x40
[ 1840.329589]  generic_exec_single+0x81/0xb0
[ 1840.329592]  smp_call_function_single+0xd2/0x100
[ 1840.329594]  ? acpi_ds_create_operand+0x215/0x23c
[ 1840.329595]  ? cpumask_next+0x1b/0x20
[ 1840.329597]  wrmsrl_on_cpu+0x57/0x70
[ 1840.329598]  ? rdmsrl_on_cpu+0x57/0x80
[ 1840.329599]  ? wrmsrl_on_cpu+0x57/0x70
[ 1840.329602]  intel_pstate_hwp_set+0xd3/0x150
[ 1840.329604]  intel_pstate_set_policy+0x119/0x150
[ 1840.329606]  cpufreq_set_policy+0xcd/0x2f0
[ 1840.329607]  cpufreq_update_policy+0xb2/0x130
[ 1840.329610]  ? cpufreq_update_policy+0x130/0x130
[ 1840.329613]  acpi_processor_ppc_has_changed+0x65/0x80
[ 1840.329615]  acpi_processor_notify+0x80/0x100
[ 1840.329617]  acpi_ev_notify_dispatch+0x44/0x5c
[ 1840.329619]  acpi_os_execute_deferred+0x14/0x20
[ 1840.329620]  process_one_work+0x193/0x3c0
[ 1840.329622]  worker_thread+0x35/0x3b0
[ 1840.329624]  kthread+0x125/0x140
[ 1840.329625]  ? process_one_work+0x3c0/0x3c0
[ 1840.329626]  ? kthread_park+0x60/0x60
[ 1840.329628]  ? do_syscall_64+0x67/0x180
[ 1840.329631]  ret_from_fork+0x25/0x30

This is because if there's only one online CPU, the MSR_PM_ENABLE
(package wide)can not be enabled after resumed, due to
intel_pstate_hwp_enable() will only be invoked on AP's online
process after resumed - if there's no AP online, the HWP remains
disabled after resumed (BIOS has disabled it in S3). Then if
there comes a _PPC change notification which touches HWP register
during this stage, the warning is triggered.

Since we don't call acpi_processor_register_performance() when
HWP is enabled, the pr->performance will be NULL. When this is
NULL we don't need to do _PPC change notification.

Reported-by: Doug Smythies 
Suggested-by: Srinivas Pandruvada 
Signed-off-by: Yu Chen 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/acpi/processor_perflib.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -165,7 +165,7 @@ int acpi_processor_ppc_has_changed(struc
 {
int ret;
 
-   if (ignore_ppc) {
+   if (ignore_ppc || !pr->performance) {
/*
 * Only when it is notification event, the _OST object
 * will be evaluated. Otherwise it is skipped.

[PATCH 3.18 047/185] scsi: bnx2fc: Fix check in SCSI completion handler for timed out request

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Chad Dupuis 

[ Upstream commit ecf7ff49945f5741fa1da112f994939f942031d3 ]

When a request times out we set the io_req flag BNX2FC_FLAG_IO_COMPL so
that if a subsequent completion comes in on that task ID we will ignore
it.  The issue is that in the check for this flag there is a missing
return so we will continue to process a request which may have already
been returned to the ownership of the SCSI layer.  This can cause
unpredictable results.

Solution is to add in the missing return.

[mkp: typo plus title shortening]

Signed-off-by: Chad Dupuis 
Reviewed-by: Laurence Oberman 
Tested-by: Laurence Oberman 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/bnx2fc/bnx2fc_io.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1932,6 +1932,7 @@ void bnx2fc_process_scsi_cmd_compl(struc
/* we will not receive ABTS response for this IO */
BNX2FC_IO_DBG(io_req, "Timer context finished processing "
   "this scsi cmd\n");
+   return;
}
 
/* Cancel the timeout_work, as we received IO completion */

[PATCH 3.18 036/185] ACPI: processor_perflib: Do not send _PPC change notification if not ready

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen Yu 

[ Upstream commit ba1edb9a5125a617d612f98eead14b9b84e75c3a ]

The following warning was triggered after resumed from S3 -
if all the nonboot CPUs were put offline before suspend:

[ 1840.329515] unchecked MSR access error: RDMSR from 0x771 at rIP: 
0x86061e3a (native_read_msr+0xa/0x30)
[ 1840.329516] Call Trace:
[ 1840.329521]  __rdmsr_on_cpu+0x33/0x50
[ 1840.329525]  generic_exec_single+0x81/0xb0
[ 1840.329527]  smp_call_function_single+0xd2/0x100
[ 1840.329530]  ? acpi_ds_result_pop+0xdd/0xf2
[ 1840.329532]  ? acpi_ds_create_operand+0x215/0x23c
[ 1840.329534]  rdmsrl_on_cpu+0x57/0x80
[ 1840.329536]  ? cpumask_next+0x1b/0x20
[ 1840.329538]  ? rdmsrl_on_cpu+0x57/0x80
[ 1840.329541]  intel_pstate_update_perf_limits+0xf3/0x220
[ 1840.329544]  ? notifier_call_chain+0x4a/0x70
[ 1840.329546]  intel_pstate_set_policy+0x4e/0x150
[ 1840.329548]  cpufreq_set_policy+0xcd/0x2f0
[ 1840.329550]  cpufreq_update_policy+0xb2/0x130
[ 1840.329552]  ? cpufreq_update_policy+0x130/0x130
[ 1840.329556]  acpi_processor_ppc_has_changed+0x65/0x80
[ 1840.329558]  acpi_processor_notify+0x80/0x100
[ 1840.329561]  acpi_ev_notify_dispatch+0x44/0x5c
[ 1840.329563]  acpi_os_execute_deferred+0x14/0x20
[ 1840.329565]  process_one_work+0x193/0x3c0
[ 1840.329567]  worker_thread+0x35/0x3b0
[ 1840.329569]  kthread+0x125/0x140
[ 1840.329571]  ? process_one_work+0x3c0/0x3c0
[ 1840.329572]  ? kthread_park+0x60/0x60
[ 1840.329575]  ? do_syscall_64+0x67/0x180
[ 1840.329577]  ret_from_fork+0x25/0x30
[ 1840.329585] unchecked MSR access error: WRMSR to 0x774 (tried to write 
0x) at rIP: 0x86061f78 (native_write_msr+0x8/0x30)
[ 1840.329586] Call Trace:
[ 1840.329587]  __wrmsr_on_cpu+0x37/0x40
[ 1840.329589]  generic_exec_single+0x81/0xb0
[ 1840.329592]  smp_call_function_single+0xd2/0x100
[ 1840.329594]  ? acpi_ds_create_operand+0x215/0x23c
[ 1840.329595]  ? cpumask_next+0x1b/0x20
[ 1840.329597]  wrmsrl_on_cpu+0x57/0x70
[ 1840.329598]  ? rdmsrl_on_cpu+0x57/0x80
[ 1840.329599]  ? wrmsrl_on_cpu+0x57/0x70
[ 1840.329602]  intel_pstate_hwp_set+0xd3/0x150
[ 1840.329604]  intel_pstate_set_policy+0x119/0x150
[ 1840.329606]  cpufreq_set_policy+0xcd/0x2f0
[ 1840.329607]  cpufreq_update_policy+0xb2/0x130
[ 1840.329610]  ? cpufreq_update_policy+0x130/0x130
[ 1840.329613]  acpi_processor_ppc_has_changed+0x65/0x80
[ 1840.329615]  acpi_processor_notify+0x80/0x100
[ 1840.329617]  acpi_ev_notify_dispatch+0x44/0x5c
[ 1840.329619]  acpi_os_execute_deferred+0x14/0x20
[ 1840.329620]  process_one_work+0x193/0x3c0
[ 1840.329622]  worker_thread+0x35/0x3b0
[ 1840.329624]  kthread+0x125/0x140
[ 1840.329625]  ? process_one_work+0x3c0/0x3c0
[ 1840.329626]  ? kthread_park+0x60/0x60
[ 1840.329628]  ? do_syscall_64+0x67/0x180
[ 1840.329631]  ret_from_fork+0x25/0x30

This is because if there's only one online CPU, the MSR_PM_ENABLE
(package wide)can not be enabled after resumed, due to
intel_pstate_hwp_enable() will only be invoked on AP's online
process after resumed - if there's no AP online, the HWP remains
disabled after resumed (BIOS has disabled it in S3). Then if
there comes a _PPC change notification which touches HWP register
during this stage, the warning is triggered.

Since we don't call acpi_processor_register_performance() when
HWP is enabled, the pr->performance will be NULL. When this is
NULL we don't need to do _PPC change notification.

Reported-by: Doug Smythies 
Suggested-by: Srinivas Pandruvada 
Signed-off-by: Yu Chen 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/acpi/processor_perflib.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -165,7 +165,7 @@ int acpi_processor_ppc_has_changed(struc
 {
int ret;
 
-   if (ignore_ppc) {
+   if (ignore_ppc || !pr->performance) {
/*
 * Only when it is notification event, the _OST object
 * will be evaluated. Otherwise it is skipped.

[PATCH 3.18 047/185] scsi: bnx2fc: Fix check in SCSI completion handler for timed out request

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Chad Dupuis 

[ Upstream commit ecf7ff49945f5741fa1da112f994939f942031d3 ]

When a request times out we set the io_req flag BNX2FC_FLAG_IO_COMPL so
that if a subsequent completion comes in on that task ID we will ignore
it.  The issue is that in the check for this flag there is a missing
return so we will continue to process a request which may have already
been returned to the ownership of the SCSI layer.  This can cause
unpredictable results.

Solution is to add in the missing return.

[mkp: typo plus title shortening]

Signed-off-by: Chad Dupuis 
Reviewed-by: Laurence Oberman 
Tested-by: Laurence Oberman 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/bnx2fc/bnx2fc_io.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1932,6 +1932,7 @@ void bnx2fc_process_scsi_cmd_compl(struc
/* we will not receive ABTS response for this IO */
BNX2FC_IO_DBG(io_req, "Timer context finished processing "
   "this scsi cmd\n");
+   return;
}
 
/* Cancel the timeout_work, as we received IO completion */

[PATCH 3.18 049/185] scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

[ Upstream commit a7043e9529f3c367cc4d82997e00be034cbe57ca ]

My static checker complains about an out of bounds read:

drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by: Dan Carpenter 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/message/fusion/mptctl.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2694,6 +2694,8 @@ mptctl_hp_targetinfo(unsigned long arg)
__FILE__, __LINE__, iocnum);
return -ENODEV;
}
+   if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+   return -EINVAL;
dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo 
called.\n",
ioc->name));
 

[PATCH 3.18 049/185] scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

[ Upstream commit a7043e9529f3c367cc4d82997e00be034cbe57ca ]

My static checker complains about an out of bounds read:

drivers/message/fusion/mptctl.c:2786 mptctl_hp_targetinfo()
error: buffer overflow 'hd->sel_timeout' 255 <= u32max.

It's true that we probably should have a bounds check here.

Signed-off-by: Dan Carpenter 
Reviewed-by: Johannes Thumshirn 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/message/fusion/mptctl.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2694,6 +2694,8 @@ mptctl_hp_targetinfo(unsigned long arg)
__FILE__, __LINE__, iocnum);
return -ENODEV;
}
+   if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+   return -EINVAL;
dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo 
called.\n",
ioc->name));
 

[PATCH 3.18 046/185] scsi: ufs: Enable quirk to ignore sending WRITE_SAME command

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Sujit Reddy Thumma 

[ Upstream commit 84af7e8b895088d89f246d6b0f82717fafdebf61 ]

WRITE_SAME command is not supported by UFS. Enable a quirk for the upper
level drivers to not send WRITE SAME command.

[mkp: botched patch, applied by hand]

Signed-off-by: Sujit Reddy Thumma 
Signed-off-by: Subhash Jadavani 
Signed-off-by: Asutosh Das 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/ufs/ufshcd.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -2795,6 +2795,8 @@ static int ufshcd_slave_alloc(struct scs
/* REPORT SUPPORTED OPERATION CODES is not supported */
sdev->no_report_opcodes = 1;
 
+   /* WRITE_SAME command is not supported */
+   sdev->no_write_same = 1;
 
ufshcd_set_queue_depth(sdev);
 

[PATCH 3.18 046/185] scsi: ufs: Enable quirk to ignore sending WRITE_SAME command

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Sujit Reddy Thumma 

[ Upstream commit 84af7e8b895088d89f246d6b0f82717fafdebf61 ]

WRITE_SAME command is not supported by UFS. Enable a quirk for the upper
level drivers to not send WRITE SAME command.

[mkp: botched patch, applied by hand]

Signed-off-by: Sujit Reddy Thumma 
Signed-off-by: Subhash Jadavani 
Signed-off-by: Asutosh Das 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/ufs/ufshcd.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -2795,6 +2795,8 @@ static int ufshcd_slave_alloc(struct scs
/* REPORT SUPPORTED OPERATION CODES is not supported */
sdev->no_report_opcodes = 1;
 
+   /* WRITE_SAME command is not supported */
+   sdev->no_write_same = 1;
 
ufshcd_set_queue_depth(sdev);
 

Re: [PATCH 12/12] ARM: dts: exynos5250-arndale: add dsi and panel nodes

[Krzysztof Kozlowski]

On Mon, May 28, 2018 at 11:55 AM, Maciej Purski  wrote:
> The patch adds bridge and panel nodes.
> It adds also DSI properties specific for arndale board.
>
> Signed-off-by: Andrzej Hajda 
> Signed-off-by: Maciej Purski 
> ---
>  arch/arm/boot/dts/exynos5250-arndale.dts | 39 
> 
>  1 file changed, 39 insertions(+)
>
> diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts 
> b/arch/arm/boot/dts/exynos5250-arndale.dts
> index 80221fa..6f0b1c4 100644
> --- a/arch/arm/boot/dts/exynos5250-arndale.dts
> +++ b/arch/arm/boot/dts/exynos5250-arndale.dts
> @@ -71,6 +71,17 @@
> };
> };
>
> +   panel: panel {
> +   compatible = "boe,hv070wsa-100";
> +   power-supply = <_3v3_reg>;
> +   enable-gpios = < 3 GPIO_ACTIVE_HIGH>;
> +   port {
> +   panel_ep: endpoint {
> +   remote-endpoint = <_out_ep>;
> +   };
> +   };
> +   };
> +
> regulators {
> compatible = "simple-bus";
> #address-cells = <1>;
> @@ -476,6 +487,34 @@
> };
>  };
>
> +_0 {

Please put the node alphabetically, so before 

Also this patch should be squashed with previous one (regulators),
because adding non-controllable fixed regulators on its own does not
bring benefits. Linux will not disable them. You added these
regulators for the bridge below. Without the bridge, their existence
does not have much sense.

Best regards,
Krzysztof

> +   vddcore-supply = <_reg>;
> +   vddio-supply = <_reg>;
> +   samsung,pll-clock-frequency = <2400>;
> +   samsung,burst-clock-frequency = <32000>;
> +   samsung,esc-clock-frequency = <1000>;
> +   status = "okay";
> +
> +   bridge@0 {
> +   reg = <0>;
> +   compatible = "toshiba,tc358764";
> +   vddc-supply = <_1v2_reg>;
> +   vddio-supply = <_1v8_reg>;
> +   vddmipi-supply = <_1v2_reg>;
> +   vddlvds133-supply = <_3v3_reg>;
> +   vddlvds112-supply = <_1v2_reg>;
> +   reset-gpios = < 6 GPIO_ACTIVE_LOW>;
> +   #address-cells = <1>;
> +   #size-cells = <0>;
> +   port@1 {
> +   reg = <1>;
> +   bridge_out_ep: endpoint {
> +   remote-endpoint = <_ep>;
> +   };
> +   };
> +   };
> +};
> +
>  _2 {
> status = "okay";
> /* used by HDMI DDC */
> --
> 2.7.4
>

Re: [PATCH v2 3/6] mtd: rawnand: add NVIDIA Tegra NAND Flash controller driver

[Benjamin Lindqvist]

Note that it's certainly possible to encode U-Boot and kernel with
RS[4] and still use RS[8] for the rootfs even if the boot rom doesn't
support it. This whole 'use-bootable-ecc-only' business seems a bit
overengineered.

2018-05-28 14:43 GMT+02:00 Stefan Agner :
> On 28.05.2018 13:57, Dmitry Osipenko wrote:
>> On 28.05.2018 00:54, Stefan Agner wrote:
>>> Add support for the NAND flash controller found on NVIDIA
>>> Tegra 2 SoCs. This implementation does not make use of the
>>> command queue feature. Regular operations/data transfers are
>>> done in PIO mode. Page read/writes with hardware ECC make
>>> use of the DMA for data transfer.
>>>
>>> Signed-off-by: Lucas Stach 
>>> Signed-off-by: Stefan Agner 
>>> ---
>>>  MAINTAINERS   |   7 +
>>>  drivers/mtd/nand/raw/Kconfig  |   6 +
>>>  drivers/mtd/nand/raw/Makefile |   1 +
>>>  drivers/mtd/nand/raw/tegra_nand.c | 999 ++
>>>  4 files changed, 1013 insertions(+)
>>>  create mode 100644 drivers/mtd/nand/raw/tegra_nand.c
>>>
>>> diff --git a/MAINTAINERS b/MAINTAINERS
>>> index 58b9861ccf99..8cbbb7111742 100644
>>> --- a/MAINTAINERS
>>> +++ b/MAINTAINERS
>>> @@ -13844,6 +13844,13 @@ M:  Laxman Dewangan 
>>>  S:  Supported
>>>  F:  drivers/input/keyboard/tegra-kbc.c
>>>
>>> +TEGRA NAND DRIVER
>>> +M:  Stefan Agner 
>>> +M:  Lucas Stach 
>>> +S:  Maintained
>>> +F:  Documentation/devicetree/bindings/mtd/nvidia,tegra20-nand.txt
>>> +F:  drivers/mtd/nand/raw/tegra_nand.c
>>> +
>>>  TEGRA PWM DRIVER
>>>  M:  Thierry Reding 
>>>  S:  Supported
>>> diff --git a/drivers/mtd/nand/raw/Kconfig b/drivers/mtd/nand/raw/Kconfig
>>> index 19a2b283fbbe..012c63c6ab47 100644
>>> --- a/drivers/mtd/nand/raw/Kconfig
>>> +++ b/drivers/mtd/nand/raw/Kconfig
>>> @@ -534,4 +534,10 @@ config MTD_NAND_MTK
>>>Enables support for NAND controller on MTK SoCs.
>>>This controller is found on mt27xx, mt81xx, mt65xx SoCs.
>>>
>>> +config MTD_NAND_TEGRA
>>> +tristate "Support for NAND on NVIDIA Tegra"
>>> +depends on ARCH_TEGRA || COMPILE_TEST
>>> +help
>>> +  Enables support for NAND flash on NVIDIA Tegra SoC based boards.
>>> +
>>>  endif # MTD_NAND
>>> diff --git a/drivers/mtd/nand/raw/Makefile b/drivers/mtd/nand/raw/Makefile
>>> index 165b7ef9e9a1..d5a5f9832b88 100644
>>> --- a/drivers/mtd/nand/raw/Makefile
>>> +++ b/drivers/mtd/nand/raw/Makefile
>>> @@ -56,6 +56,7 @@ obj-$(CONFIG_MTD_NAND_HISI504) += 
>>> hisi504_nand.o
>>>  obj-$(CONFIG_MTD_NAND_BRCMNAND) += brcmnand/
>>>  obj-$(CONFIG_MTD_NAND_QCOM) += qcom_nandc.o
>>>  obj-$(CONFIG_MTD_NAND_MTK)  += mtk_ecc.o mtk_nand.o
>>> +obj-$(CONFIG_MTD_NAND_TEGRA)+= tegra_nand.o
>>>
>>>  nand-objs := nand_base.o nand_bbt.o nand_timings.o nand_ids.o
>>>  nand-objs += nand_amd.o
>>> diff --git a/drivers/mtd/nand/raw/tegra_nand.c 
>>> b/drivers/mtd/nand/raw/tegra_nand.c
>>> new file mode 100644
>>> index ..1a0833d97472
>>> --- /dev/null
>>> +++ b/drivers/mtd/nand/raw/tegra_nand.c
>>> @@ -0,0 +1,999 @@
>>> +// SPDX-License-Identifier: GPL-2.0
>>> +/*
>>> + * Copyright (C) 2018 Stefan Agner 
>>> + * Copyright (C) 2014-2015 Lucas Stach 
>>> + * Copyright (C) 2012 Avionic Design GmbH
>>> + */
>>> +
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +
>>> +#define CMD 0x00
>>> +#define   CMD_GO(1 << 31)
>>> +#define   CMD_CLE   (1 << 30)
>>> +#define   CMD_ALE   (1 << 29)
>>> +#define   CMD_PIO   (1 << 28)
>>> +#define   CMD_TX(1 << 27)
>>> +#define   CMD_RX(1 << 26)
>>> +#define   CMD_SEC_CMD   (1 << 25)
>>> +#define   CMD_AFT_DAT   (1 << 24)
>>> +#define   CMD_TRANS_SIZE(x) (((x - 1) & 0xf) << 20)
>>> +#define   CMD_A_VALID   (1 << 19)
>>> +#define   CMD_B_VALID   (1 << 18)
>>> +#define   CMD_RD_STATUS_CHK (1 << 17)
>>> +#define   CMD_RBSY_CHK  (1 << 16)
>>> +#define   CMD_CE(x) (1 << (8 + ((x) & 0x7)))
>>> +#define   CMD_CLE_SIZE(x)   (((x - 1) & 0x3) << 4)
>>> +#define   CMD_ALE_SIZE(x)   (((x - 1) & 0xf) << 0)
>>> +
>>> +#define STATUS  0x04
>>> +
>>> +#define ISR 0x08
>>> +#define   ISR_CORRFAIL_ERR  (1 << 24)
>>> +#define   ISR_UND   (1 << 7)
>>> +#define   

[PATCH 3.18 050/185] scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Bart Van Assche 

[ Upstream commit c02189e12ce3bf3808cb880569d3b10249f50bd9 ]

A left shift must shift less than the bit width of the left argument.
Avoid triggering undefined behavior if ha->mbx_count == 32.

This patch avoids that UBSAN reports the following complaint:

UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
shift exponent 32 is too large for 32-bit type 'int'
Call Trace:
 dump_stack+0x4e/0x6c
 ubsan_epilogue+0xd/0x3b
 __ubsan_handle_shift_out_of_bounds+0x112/0x14c
 qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
 qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
 qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
 qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
 qla2x00_chip_diag+0x354/0x45f [qla2xxx]
 qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
 qla2x00_probe_one+0x1681/0x392e [qla2xxx]
 pci_device_probe+0x10b/0x1f1
 driver_probe_device+0x21f/0x3a4
 __driver_attach+0xa9/0xe1
 bus_for_each_dev+0x6e/0xb5
 driver_attach+0x22/0x3c
 bus_add_driver+0x1d1/0x2ae
 driver_register+0x78/0x130
 __pci_register_driver+0x75/0xa8
 qla2x00_module_init+0x21b/0x267 [qla2xxx]
 do_one_initcall+0x5a/0x1e2
 do_init_module+0x9d/0x285
 load_module+0x20db/0x38e3
 SYSC_finit_module+0xa8/0xbc
 SyS_finit_module+0x9/0xb
 do_syscall_64+0x77/0x271
 entry_SYSCALL64_slow_path+0x25/0x25

Reported-by: Meelis Roos 
Signed-off-by: Bart Van Assche 
Cc: Himanshu Madhani 
Reviewed-by: Laurence Oberman 
Acked-by: Himanshu Madhani 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla2xxx/qla_isr.c |6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -268,7 +268,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *
struct device_reg_2xxx __iomem *reg = >iobase->isp;
 
/* Read all mbox registers? */
-   mboxes = (1 << ha->mbx_count) - 1;
+   WARN_ON_ONCE(ha->mbx_count > 32);
+   mboxes = (1ULL << ha->mbx_count) - 1;
if (!ha->mcp)
ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
else
@@ -2454,7 +2455,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *
struct device_reg_24xx __iomem *reg = >iobase->isp24;
 
/* Read all mbox registers? */
-   mboxes = (1 << ha->mbx_count) - 1;
+   WARN_ON_ONCE(ha->mbx_count > 32);
+   mboxes = (1ULL << ha->mbx_count) - 1;
if (!ha->mcp)
ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
else

Re: [PATCH 12/12] ARM: dts: exynos5250-arndale: add dsi and panel nodes

[Krzysztof Kozlowski]

On Mon, May 28, 2018 at 11:55 AM, Maciej Purski  wrote:
> The patch adds bridge and panel nodes.
> It adds also DSI properties specific for arndale board.
>
> Signed-off-by: Andrzej Hajda 
> Signed-off-by: Maciej Purski 
> ---
>  arch/arm/boot/dts/exynos5250-arndale.dts | 39 
> 
>  1 file changed, 39 insertions(+)
>
> diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts 
> b/arch/arm/boot/dts/exynos5250-arndale.dts
> index 80221fa..6f0b1c4 100644
> --- a/arch/arm/boot/dts/exynos5250-arndale.dts
> +++ b/arch/arm/boot/dts/exynos5250-arndale.dts
> @@ -71,6 +71,17 @@
> };
> };
>
> +   panel: panel {
> +   compatible = "boe,hv070wsa-100";
> +   power-supply = <_3v3_reg>;
> +   enable-gpios = < 3 GPIO_ACTIVE_HIGH>;
> +   port {
> +   panel_ep: endpoint {
> +   remote-endpoint = <_out_ep>;
> +   };
> +   };
> +   };
> +
> regulators {
> compatible = "simple-bus";
> #address-cells = <1>;
> @@ -476,6 +487,34 @@
> };
>  };
>
> +_0 {

Please put the node alphabetically, so before 

Also this patch should be squashed with previous one (regulators),
because adding non-controllable fixed regulators on its own does not
bring benefits. Linux will not disable them. You added these
regulators for the bridge below. Without the bridge, their existence
does not have much sense.

Best regards,
Krzysztof

> +   vddcore-supply = <_reg>;
> +   vddio-supply = <_reg>;
> +   samsung,pll-clock-frequency = <2400>;
> +   samsung,burst-clock-frequency = <32000>;
> +   samsung,esc-clock-frequency = <1000>;
> +   status = "okay";
> +
> +   bridge@0 {
> +   reg = <0>;
> +   compatible = "toshiba,tc358764";
> +   vddc-supply = <_1v2_reg>;
> +   vddio-supply = <_1v8_reg>;
> +   vddmipi-supply = <_1v2_reg>;
> +   vddlvds133-supply = <_3v3_reg>;
> +   vddlvds112-supply = <_1v2_reg>;
> +   reset-gpios = < 6 GPIO_ACTIVE_LOW>;
> +   #address-cells = <1>;
> +   #size-cells = <0>;
> +   port@1 {
> +   reg = <1>;
> +   bridge_out_ep: endpoint {
> +   remote-endpoint = <_ep>;
> +   };
> +   };
> +   };
> +};
> +
>  _2 {
> status = "okay";
> /* used by HDMI DDC */
> --
> 2.7.4
>

Re: [PATCH v2 3/6] mtd: rawnand: add NVIDIA Tegra NAND Flash controller driver

[Benjamin Lindqvist]

Note that it's certainly possible to encode U-Boot and kernel with
RS[4] and still use RS[8] for the rootfs even if the boot rom doesn't
support it. This whole 'use-bootable-ecc-only' business seems a bit
overengineered.

2018-05-28 14:43 GMT+02:00 Stefan Agner :
> On 28.05.2018 13:57, Dmitry Osipenko wrote:
>> On 28.05.2018 00:54, Stefan Agner wrote:
>>> Add support for the NAND flash controller found on NVIDIA
>>> Tegra 2 SoCs. This implementation does not make use of the
>>> command queue feature. Regular operations/data transfers are
>>> done in PIO mode. Page read/writes with hardware ECC make
>>> use of the DMA for data transfer.
>>>
>>> Signed-off-by: Lucas Stach 
>>> Signed-off-by: Stefan Agner 
>>> ---
>>>  MAINTAINERS   |   7 +
>>>  drivers/mtd/nand/raw/Kconfig  |   6 +
>>>  drivers/mtd/nand/raw/Makefile |   1 +
>>>  drivers/mtd/nand/raw/tegra_nand.c | 999 ++
>>>  4 files changed, 1013 insertions(+)
>>>  create mode 100644 drivers/mtd/nand/raw/tegra_nand.c
>>>
>>> diff --git a/MAINTAINERS b/MAINTAINERS
>>> index 58b9861ccf99..8cbbb7111742 100644
>>> --- a/MAINTAINERS
>>> +++ b/MAINTAINERS
>>> @@ -13844,6 +13844,13 @@ M:  Laxman Dewangan 
>>>  S:  Supported
>>>  F:  drivers/input/keyboard/tegra-kbc.c
>>>
>>> +TEGRA NAND DRIVER
>>> +M:  Stefan Agner 
>>> +M:  Lucas Stach 
>>> +S:  Maintained
>>> +F:  Documentation/devicetree/bindings/mtd/nvidia,tegra20-nand.txt
>>> +F:  drivers/mtd/nand/raw/tegra_nand.c
>>> +
>>>  TEGRA PWM DRIVER
>>>  M:  Thierry Reding 
>>>  S:  Supported
>>> diff --git a/drivers/mtd/nand/raw/Kconfig b/drivers/mtd/nand/raw/Kconfig
>>> index 19a2b283fbbe..012c63c6ab47 100644
>>> --- a/drivers/mtd/nand/raw/Kconfig
>>> +++ b/drivers/mtd/nand/raw/Kconfig
>>> @@ -534,4 +534,10 @@ config MTD_NAND_MTK
>>>Enables support for NAND controller on MTK SoCs.
>>>This controller is found on mt27xx, mt81xx, mt65xx SoCs.
>>>
>>> +config MTD_NAND_TEGRA
>>> +tristate "Support for NAND on NVIDIA Tegra"
>>> +depends on ARCH_TEGRA || COMPILE_TEST
>>> +help
>>> +  Enables support for NAND flash on NVIDIA Tegra SoC based boards.
>>> +
>>>  endif # MTD_NAND
>>> diff --git a/drivers/mtd/nand/raw/Makefile b/drivers/mtd/nand/raw/Makefile
>>> index 165b7ef9e9a1..d5a5f9832b88 100644
>>> --- a/drivers/mtd/nand/raw/Makefile
>>> +++ b/drivers/mtd/nand/raw/Makefile
>>> @@ -56,6 +56,7 @@ obj-$(CONFIG_MTD_NAND_HISI504) += 
>>> hisi504_nand.o
>>>  obj-$(CONFIG_MTD_NAND_BRCMNAND) += brcmnand/
>>>  obj-$(CONFIG_MTD_NAND_QCOM) += qcom_nandc.o
>>>  obj-$(CONFIG_MTD_NAND_MTK)  += mtk_ecc.o mtk_nand.o
>>> +obj-$(CONFIG_MTD_NAND_TEGRA)+= tegra_nand.o
>>>
>>>  nand-objs := nand_base.o nand_bbt.o nand_timings.o nand_ids.o
>>>  nand-objs += nand_amd.o
>>> diff --git a/drivers/mtd/nand/raw/tegra_nand.c 
>>> b/drivers/mtd/nand/raw/tegra_nand.c
>>> new file mode 100644
>>> index ..1a0833d97472
>>> --- /dev/null
>>> +++ b/drivers/mtd/nand/raw/tegra_nand.c
>>> @@ -0,0 +1,999 @@
>>> +// SPDX-License-Identifier: GPL-2.0
>>> +/*
>>> + * Copyright (C) 2018 Stefan Agner 
>>> + * Copyright (C) 2014-2015 Lucas Stach 
>>> + * Copyright (C) 2012 Avionic Design GmbH
>>> + */
>>> +
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +
>>> +#define CMD 0x00
>>> +#define   CMD_GO(1 << 31)
>>> +#define   CMD_CLE   (1 << 30)
>>> +#define   CMD_ALE   (1 << 29)
>>> +#define   CMD_PIO   (1 << 28)
>>> +#define   CMD_TX(1 << 27)
>>> +#define   CMD_RX(1 << 26)
>>> +#define   CMD_SEC_CMD   (1 << 25)
>>> +#define   CMD_AFT_DAT   (1 << 24)
>>> +#define   CMD_TRANS_SIZE(x) (((x - 1) & 0xf) << 20)
>>> +#define   CMD_A_VALID   (1 << 19)
>>> +#define   CMD_B_VALID   (1 << 18)
>>> +#define   CMD_RD_STATUS_CHK (1 << 17)
>>> +#define   CMD_RBSY_CHK  (1 << 16)
>>> +#define   CMD_CE(x) (1 << (8 + ((x) & 0x7)))
>>> +#define   CMD_CLE_SIZE(x)   (((x - 1) & 0x3) << 4)
>>> +#define   CMD_ALE_SIZE(x)   (((x - 1) & 0xf) << 0)
>>> +
>>> +#define STATUS  0x04
>>> +
>>> +#define ISR 0x08
>>> +#define   ISR_CORRFAIL_ERR  (1 << 24)
>>> +#define   ISR_UND   (1 << 7)
>>> +#define   ISR_OVR   (1 << 6)
>>> +#define   ISR_CMD_DONE  (1 << 5)
>>> +#define   ISR_ECC_ERR   (1 

[PATCH 3.18 050/185] scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Bart Van Assche 

[ Upstream commit c02189e12ce3bf3808cb880569d3b10249f50bd9 ]

A left shift must shift less than the bit width of the left argument.
Avoid triggering undefined behavior if ha->mbx_count == 32.

This patch avoids that UBSAN reports the following complaint:

UBSAN: Undefined behaviour in drivers/scsi/qla2xxx/qla_isr.c:275:14
shift exponent 32 is too large for 32-bit type 'int'
Call Trace:
 dump_stack+0x4e/0x6c
 ubsan_epilogue+0xd/0x3b
 __ubsan_handle_shift_out_of_bounds+0x112/0x14c
 qla2x00_mbx_completion+0x1c5/0x25d [qla2xxx]
 qla2300_intr_handler+0x1ea/0x3bb [qla2xxx]
 qla2x00_mailbox_command+0x77b/0x139a [qla2xxx]
 qla2x00_mbx_reg_test+0x83/0x114 [qla2xxx]
 qla2x00_chip_diag+0x354/0x45f [qla2xxx]
 qla2x00_initialize_adapter+0x2c2/0xa4e [qla2xxx]
 qla2x00_probe_one+0x1681/0x392e [qla2xxx]
 pci_device_probe+0x10b/0x1f1
 driver_probe_device+0x21f/0x3a4
 __driver_attach+0xa9/0xe1
 bus_for_each_dev+0x6e/0xb5
 driver_attach+0x22/0x3c
 bus_add_driver+0x1d1/0x2ae
 driver_register+0x78/0x130
 __pci_register_driver+0x75/0xa8
 qla2x00_module_init+0x21b/0x267 [qla2xxx]
 do_one_initcall+0x5a/0x1e2
 do_init_module+0x9d/0x285
 load_module+0x20db/0x38e3
 SYSC_finit_module+0xa8/0xbc
 SyS_finit_module+0x9/0xb
 do_syscall_64+0x77/0x271
 entry_SYSCALL64_slow_path+0x25/0x25

Reported-by: Meelis Roos 
Signed-off-by: Bart Van Assche 
Cc: Himanshu Madhani 
Reviewed-by: Laurence Oberman 
Acked-by: Himanshu Madhani 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla2xxx/qla_isr.c |6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -268,7 +268,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *
struct device_reg_2xxx __iomem *reg = >iobase->isp;
 
/* Read all mbox registers? */
-   mboxes = (1 << ha->mbx_count) - 1;
+   WARN_ON_ONCE(ha->mbx_count > 32);
+   mboxes = (1ULL << ha->mbx_count) - 1;
if (!ha->mcp)
ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
else
@@ -2454,7 +2455,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *
struct device_reg_24xx __iomem *reg = >iobase->isp24;
 
/* Read all mbox registers? */
-   mboxes = (1 << ha->mbx_count) - 1;
+   WARN_ON_ONCE(ha->mbx_count > 32);
+   mboxes = (1ULL << ha->mbx_count) - 1;
if (!ha->mcp)
ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
else

[PATCH 3.18 054/185] scsi: aacraid: fix shutdown crash when init fails

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Meelis Roos 

[ Upstream commit 00c20cdc79259c6c5bf978b21af96c2d3edb646d ]

When aacraid init fails with "AAC0: adapter self-test failed.", shutdown
leads to UBSAN warning and then oops:

[154316.118423] 

[154316.118508] UBSAN: Undefined behaviour in drivers/scsi/scsi_lib.c:2328:27
[154316.118566] member access within null pointer of type 'struct Scsi_Host'
[154316.118631] CPU: 2 PID: 14530 Comm: reboot Tainted: GW
4.15.0-dirty #89
[154316.118701] Hardware name: Hewlett Packard HP NetServer/HP System Board, 
BIOS 4.06.46 PW 06/25/2003
[154316.118774] Call Trace:
[154316.118848]  dump_stack+0x48/0x65
[154316.118916]  ubsan_epilogue+0xe/0x40
[154316.118976]  __ubsan_handle_type_mismatch+0xfb/0x180
[154316.119043]  scsi_block_requests+0x20/0x30
[154316.119135]  aac_shutdown+0x18/0x40 [aacraid]
[154316.119196]  pci_device_shutdown+0x33/0x50
[154316.119269]  device_shutdown+0x18a/0x390
[...]
[154316.123435] BUG: unable to handle kernel NULL pointer dereference at 
00f4
[154316.123515] IP: scsi_block_requests+0xa/0x30

This is because aac_shutdown() does

struct Scsi_Host *shost = pci_get_drvdata(dev);
scsi_block_requests(shost);

and that assumes shost has been assigned with pci_set_drvdata().

However, pci_set_drvdata(pdev, shost) is done in aac_probe_one() far
after bailing out with error from calling the init function
((*aac_drivers[index].init)(aac)), and when the init function fails, no
error is returned from aac_probe_one() so PCI layer assumes there is
driver attached, and tries to shut it down later.

Fix it by returning error from aac_probe_one() when card-specific init
function fails.

This fixes reboot on my HP NetRAID-4M with dead battery.

Signed-off-by: Meelis Roos 
Reviewed-by: Dave Carroll 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/aacraid/linit.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1172,8 +1172,10 @@ static int aac_probe_one(struct pci_dev
 *  Map in the registers from the adapter.
 */
aac->base_size = AAC_MIN_FOOTPRINT_SIZE;
-   if ((*aac_drivers[index].init)(aac))
+   if ((*aac_drivers[index].init)(aac)) {
+   error = -ENODEV;
goto out_unmap;
+   }
 
if (aac->sync_mode) {
if (aac_sync_mode)

[PATCH 3.18 054/185] scsi: aacraid: fix shutdown crash when init fails

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Meelis Roos 

[ Upstream commit 00c20cdc79259c6c5bf978b21af96c2d3edb646d ]

When aacraid init fails with "AAC0: adapter self-test failed.", shutdown
leads to UBSAN warning and then oops:

[154316.118423] 

[154316.118508] UBSAN: Undefined behaviour in drivers/scsi/scsi_lib.c:2328:27
[154316.118566] member access within null pointer of type 'struct Scsi_Host'
[154316.118631] CPU: 2 PID: 14530 Comm: reboot Tainted: GW
4.15.0-dirty #89
[154316.118701] Hardware name: Hewlett Packard HP NetServer/HP System Board, 
BIOS 4.06.46 PW 06/25/2003
[154316.118774] Call Trace:
[154316.118848]  dump_stack+0x48/0x65
[154316.118916]  ubsan_epilogue+0xe/0x40
[154316.118976]  __ubsan_handle_type_mismatch+0xfb/0x180
[154316.119043]  scsi_block_requests+0x20/0x30
[154316.119135]  aac_shutdown+0x18/0x40 [aacraid]
[154316.119196]  pci_device_shutdown+0x33/0x50
[154316.119269]  device_shutdown+0x18a/0x390
[...]
[154316.123435] BUG: unable to handle kernel NULL pointer dereference at 
00f4
[154316.123515] IP: scsi_block_requests+0xa/0x30

This is because aac_shutdown() does

struct Scsi_Host *shost = pci_get_drvdata(dev);
scsi_block_requests(shost);

and that assumes shost has been assigned with pci_set_drvdata().

However, pci_set_drvdata(pdev, shost) is done in aac_probe_one() far
after bailing out with error from calling the init function
((*aac_drivers[index].init)(aac)), and when the init function fails, no
error is returned from aac_probe_one() so PCI layer assumes there is
driver attached, and tries to shut it down later.

Fix it by returning error from aac_probe_one() when card-specific init
function fails.

This fixes reboot on my HP NetRAID-4M with dead battery.

Signed-off-by: Meelis Roos 
Reviewed-by: Dave Carroll 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/aacraid/linit.c |4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1172,8 +1172,10 @@ static int aac_probe_one(struct pci_dev
 *  Map in the registers from the adapter.
 */
aac->base_size = AAC_MIN_FOOTPRINT_SIZE;
-   if ((*aac_drivers[index].init)(aac))
+   if ((*aac_drivers[index].init)(aac)) {
+   error = -ENODEV;
goto out_unmap;
+   }
 
if (aac->sync_mode) {
if (aac_sync_mode)

[PATCH 3.18 055/185] scsi: qla4xxx: skip error recovery in case of register disconnect.

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Manish Rangankar 

[ Upstream commit 1bc5ad3a6acdcf56f83272f2de1cd2389ea9e9e2 ]

A system crashes when continuously removing/re-adding the storage
controller.

Signed-off-by: Manish Rangankar 
Reviewed-by: Ewan D. Milne 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla4xxx/ql4_def.h |2 +
 drivers/scsi/qla4xxx/ql4_os.c  |   46 +
 2 files changed, 48 insertions(+)

--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -167,6 +167,8 @@
 #define DEV_DB_NON_PERSISTENT  0
 #define DEV_DB_PERSISTENT  1
 
+#define QL4_ISP_REG_DISCONNECT 0xU
+
 #define COPY_ISID(dst_isid, src_isid) {\
int i, j;   \
for (i = 0, j = ISID_SIZE - 1; i < ISID_SIZE;)  \
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -268,6 +268,24 @@ static struct iscsi_transport qla4xxx_is
 
 static struct scsi_transport_template *qla4xxx_scsi_transport;
 
+static int qla4xxx_isp_check_reg(struct scsi_qla_host *ha)
+{
+   u32 reg_val = 0;
+   int rval = QLA_SUCCESS;
+
+   if (is_qla8022(ha))
+   reg_val = readl(>qla4_82xx_reg->host_status);
+   else if (is_qla8032(ha) || is_qla8042(ha))
+   reg_val = qla4_8xxx_rd_direct(ha, QLA8XXX_PEG_ALIVE_COUNTER);
+   else
+   reg_val = readw(>reg->ctrl_status);
+
+   if (reg_val == QL4_ISP_REG_DISCONNECT)
+   rval = QLA_ERROR;
+
+   return rval;
+}
+
 static int qla4xxx_send_ping(struct Scsi_Host *shost, uint32_t iface_num,
 uint32_t iface_type, uint32_t payload_size,
 uint32_t pid, struct sockaddr *dst_addr)
@@ -9230,10 +9248,17 @@ static int qla4xxx_eh_abort(struct scsi_
struct srb *srb = NULL;
int ret = SUCCESS;
int wait = 0;
+   int rval;
 
ql4_printk(KERN_INFO, ha, "scsi%ld:%d:%llu: Abort command issued 
cmd=%p, cdb=0x%x\n",
   ha->host_no, id, lun, cmd, cmd->cmnd[0]);
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
spin_lock_irqsave(>hardware_lock, flags);
srb = (struct srb *) CMD_SP(cmd);
if (!srb) {
@@ -9285,6 +9310,7 @@ static int qla4xxx_eh_device_reset(struc
struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
struct ddb_entry *ddb_entry = cmd->device->hostdata;
int ret = FAILED, stat;
+   int rval;
 
if (!ddb_entry)
return ret;
@@ -9304,6 +9330,12 @@ static int qla4xxx_eh_device_reset(struc
  cmd, jiffies, cmd->request->timeout / HZ,
  ha->dpc_flags, cmd->result, cmd->allowed));
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
/* FIXME: wait for hba to go online */
stat = qla4xxx_reset_lun(ha, ddb_entry, cmd->device->lun);
if (stat != QLA_SUCCESS) {
@@ -9347,6 +9379,7 @@ static int qla4xxx_eh_target_reset(struc
struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
struct ddb_entry *ddb_entry = cmd->device->hostdata;
int stat, ret;
+   int rval;
 
if (!ddb_entry)
return FAILED;
@@ -9364,6 +9397,12 @@ static int qla4xxx_eh_target_reset(struc
  ha->host_no, cmd, jiffies, cmd->request->timeout / HZ,
  ha->dpc_flags, cmd->result, cmd->allowed));
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
stat = qla4xxx_reset_target(ha, ddb_entry);
if (stat != QLA_SUCCESS) {
starget_printk(KERN_INFO, scsi_target(cmd->device),
@@ -9418,9 +9457,16 @@ static int qla4xxx_eh_host_reset(struct
 {
int return_status = FAILED;
struct scsi_qla_host *ha;
+   int rval;
 
ha = to_qla_host(cmd->device->host);
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
if ((is_qla8032(ha) || is_qla8042(ha)) && ql4xdontresethba)
qla4_83xx_set_idc_dontreset(ha);
 

[PATCH 3.18 055/185] scsi: qla4xxx: skip error recovery in case of register disconnect.

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Manish Rangankar 

[ Upstream commit 1bc5ad3a6acdcf56f83272f2de1cd2389ea9e9e2 ]

A system crashes when continuously removing/re-adding the storage
controller.

Signed-off-by: Manish Rangankar 
Reviewed-by: Ewan D. Milne 
Reviewed-by: Tomas Henzl 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 drivers/scsi/qla4xxx/ql4_def.h |2 +
 drivers/scsi/qla4xxx/ql4_os.c  |   46 +
 2 files changed, 48 insertions(+)

--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -167,6 +167,8 @@
 #define DEV_DB_NON_PERSISTENT  0
 #define DEV_DB_PERSISTENT  1
 
+#define QL4_ISP_REG_DISCONNECT 0xU
+
 #define COPY_ISID(dst_isid, src_isid) {\
int i, j;   \
for (i = 0, j = ISID_SIZE - 1; i < ISID_SIZE;)  \
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -268,6 +268,24 @@ static struct iscsi_transport qla4xxx_is
 
 static struct scsi_transport_template *qla4xxx_scsi_transport;
 
+static int qla4xxx_isp_check_reg(struct scsi_qla_host *ha)
+{
+   u32 reg_val = 0;
+   int rval = QLA_SUCCESS;
+
+   if (is_qla8022(ha))
+   reg_val = readl(>qla4_82xx_reg->host_status);
+   else if (is_qla8032(ha) || is_qla8042(ha))
+   reg_val = qla4_8xxx_rd_direct(ha, QLA8XXX_PEG_ALIVE_COUNTER);
+   else
+   reg_val = readw(>reg->ctrl_status);
+
+   if (reg_val == QL4_ISP_REG_DISCONNECT)
+   rval = QLA_ERROR;
+
+   return rval;
+}
+
 static int qla4xxx_send_ping(struct Scsi_Host *shost, uint32_t iface_num,
 uint32_t iface_type, uint32_t payload_size,
 uint32_t pid, struct sockaddr *dst_addr)
@@ -9230,10 +9248,17 @@ static int qla4xxx_eh_abort(struct scsi_
struct srb *srb = NULL;
int ret = SUCCESS;
int wait = 0;
+   int rval;
 
ql4_printk(KERN_INFO, ha, "scsi%ld:%d:%llu: Abort command issued 
cmd=%p, cdb=0x%x\n",
   ha->host_no, id, lun, cmd, cmd->cmnd[0]);
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
spin_lock_irqsave(>hardware_lock, flags);
srb = (struct srb *) CMD_SP(cmd);
if (!srb) {
@@ -9285,6 +9310,7 @@ static int qla4xxx_eh_device_reset(struc
struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
struct ddb_entry *ddb_entry = cmd->device->hostdata;
int ret = FAILED, stat;
+   int rval;
 
if (!ddb_entry)
return ret;
@@ -9304,6 +9330,12 @@ static int qla4xxx_eh_device_reset(struc
  cmd, jiffies, cmd->request->timeout / HZ,
  ha->dpc_flags, cmd->result, cmd->allowed));
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
/* FIXME: wait for hba to go online */
stat = qla4xxx_reset_lun(ha, ddb_entry, cmd->device->lun);
if (stat != QLA_SUCCESS) {
@@ -9347,6 +9379,7 @@ static int qla4xxx_eh_target_reset(struc
struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
struct ddb_entry *ddb_entry = cmd->device->hostdata;
int stat, ret;
+   int rval;
 
if (!ddb_entry)
return FAILED;
@@ -9364,6 +9397,12 @@ static int qla4xxx_eh_target_reset(struc
  ha->host_no, cmd, jiffies, cmd->request->timeout / HZ,
  ha->dpc_flags, cmd->result, cmd->allowed));
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
stat = qla4xxx_reset_target(ha, ddb_entry);
if (stat != QLA_SUCCESS) {
starget_printk(KERN_INFO, scsi_target(cmd->device),
@@ -9418,9 +9457,16 @@ static int qla4xxx_eh_host_reset(struct
 {
int return_status = FAILED;
struct scsi_qla_host *ha;
+   int rval;
 
ha = to_qla_host(cmd->device->host);
 
+   rval = qla4xxx_isp_check_reg(ha);
+   if (rval != QLA_SUCCESS) {
+   ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, 
exiting.\n");
+   return FAILED;
+   }
+
if ((is_qla8032(ha) || is_qla8042(ha)) && ql4xdontresethba)
qla4_83xx_set_idc_dontreset(ha);
 

[PATCH] sh: pass machine size to sparse

[Luc Van Oostenryck]

By default, sparse assumes a 64bit machine when compiled on x86-64
and 32bit when compiled on anything else.

This can of course create all sort of problems, like issuing false
warnings like: 'shift too big (32) for type unsigned long', or
worse, to not emit legitimate warnings.

Fix this by passing to sparse the appropriate -m32/-m64 flag

Signed-off-by: Luc Van Oostenryck 
---
 arch/sh/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 65300193b..3a195c9d5 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -206,6 +206,8 @@ ifeq ($(CONFIG_DWARF_UNWINDER),y)
   KBUILD_CFLAGS += -fasynchronous-unwind-tables
 endif
 
+CHECKFLAGS += -m$(BITS)
+
 libs-$(CONFIG_SUPERH32):= arch/sh/lib/ $(libs-y)
 libs-$(CONFIG_SUPERH64):= arch/sh/lib64/ $(libs-y)
 
-- 
2.17.0

[PATCH 3.18 057/185] ARM: OMAP1: clock: Fix debugfs_create_*() usage

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Geert Uytterhoeven 

[ Upstream commit 8cbbf1745dcde7ba7e423dc70619d223de90fd43 ]

When exposing data access through debugfs, the correct
debugfs_create_*() functions must be used, depending on data type.

Remove all casts from data pointers passed to debugfs_create_*()
functions, as such casts prevent the compiler from flagging bugs.

Correct all wrong usage:
  - clk.rate is unsigned long, not u32,
  - clk.flags is u8, not u32, which exposed the successive
clk.rate_offset and clk.src_offset fields.

Signed-off-by: Geert Uytterhoeven 
Acked-by: Aaro Koskinen 
Signed-off-by: Tony Lindgren 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/arm/mach-omap1/clock.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/arm/mach-omap1/clock.c
+++ b/arch/arm/mach-omap1/clock.c
@@ -1031,17 +1031,17 @@ static int clk_debugfs_register_one(stru
return -ENOMEM;
c->dent = d;
 
-   d = debugfs_create_u8("usecount", S_IRUGO, c->dent, (u8 *)>usecount);
+   d = debugfs_create_u8("usecount", S_IRUGO, c->dent, >usecount);
if (!d) {
err = -ENOMEM;
goto err_out;
}
-   d = debugfs_create_u32("rate", S_IRUGO, c->dent, (u32 *)>rate);
+   d = debugfs_create_ulong("rate", S_IRUGO, c->dent, >rate);
if (!d) {
err = -ENOMEM;
goto err_out;
}
-   d = debugfs_create_x32("flags", S_IRUGO, c->dent, (u32 *)>flags);
+   d = debugfs_create_x8("flags", S_IRUGO, c->dent, >flags);
if (!d) {
err = -ENOMEM;
goto err_out;

[PATCH] sh: pass machine size to sparse

[Luc Van Oostenryck]

By default, sparse assumes a 64bit machine when compiled on x86-64
and 32bit when compiled on anything else.

This can of course create all sort of problems, like issuing false
warnings like: 'shift too big (32) for type unsigned long', or
worse, to not emit legitimate warnings.

Fix this by passing to sparse the appropriate -m32/-m64 flag

Signed-off-by: Luc Van Oostenryck 
---
 arch/sh/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 65300193b..3a195c9d5 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -206,6 +206,8 @@ ifeq ($(CONFIG_DWARF_UNWINDER),y)
   KBUILD_CFLAGS += -fasynchronous-unwind-tables
 endif
 
+CHECKFLAGS += -m$(BITS)
+
 libs-$(CONFIG_SUPERH32):= arch/sh/lib/ $(libs-y)
 libs-$(CONFIG_SUPERH64):= arch/sh/lib64/ $(libs-y)
 
-- 
2.17.0

[PATCH 3.18 057/185] ARM: OMAP1: clock: Fix debugfs_create_*() usage

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Geert Uytterhoeven 

[ Upstream commit 8cbbf1745dcde7ba7e423dc70619d223de90fd43 ]

When exposing data access through debugfs, the correct
debugfs_create_*() functions must be used, depending on data type.

Remove all casts from data pointers passed to debugfs_create_*()
functions, as such casts prevent the compiler from flagging bugs.

Correct all wrong usage:
  - clk.rate is unsigned long, not u32,
  - clk.flags is u8, not u32, which exposed the successive
clk.rate_offset and clk.src_offset fields.

Signed-off-by: Geert Uytterhoeven 
Acked-by: Aaro Koskinen 
Signed-off-by: Tony Lindgren 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 arch/arm/mach-omap1/clock.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/arm/mach-omap1/clock.c
+++ b/arch/arm/mach-omap1/clock.c
@@ -1031,17 +1031,17 @@ static int clk_debugfs_register_one(stru
return -ENOMEM;
c->dent = d;
 
-   d = debugfs_create_u8("usecount", S_IRUGO, c->dent, (u8 *)>usecount);
+   d = debugfs_create_u8("usecount", S_IRUGO, c->dent, >usecount);
if (!d) {
err = -ENOMEM;
goto err_out;
}
-   d = debugfs_create_u32("rate", S_IRUGO, c->dent, (u32 *)>rate);
+   d = debugfs_create_ulong("rate", S_IRUGO, c->dent, >rate);
if (!d) {
err = -ENOMEM;
goto err_out;
}
-   d = debugfs_create_x32("flags", S_IRUGO, c->dent, (u32 *)>flags);
+   d = debugfs_create_x8("flags", S_IRUGO, c->dent, >flags);
if (!d) {
err = -ENOMEM;
goto err_out;

Re: [PATCH] IB: Revert "remove redundant INFINIBAND kconfig dependencies"

[Jason Gunthorpe]

On Fri, May 25, 2018 at 05:32:52PM -0700, Greg Thelen wrote:
> On Fri, May 25, 2018 at 2:32 PM Arnd Bergmann  wrote:
> 
> > Several subsystems depend on INFINIBAND_ADDR_TRANS, which in turn depends
> > on INFINIBAND. However, when with CONFIG_INIFIBAND=m, this leads to a
> > link error when another driver using it is built-in. The
> > INFINIBAND_ADDR_TRANS dependency is insufficient here as this is
> > a 'bool' symbol that does not force anything to be a module in turn.
> 
> > fs/cifs/smbdirect.o: In function `smbd_disconnect_rdma_work':
> > smbdirect.c:(.text+0x1e4): undefined reference to `rdma_disconnect'
> > net/9p/trans_rdma.o: In function `rdma_request':
> > trans_rdma.c:(.text+0x7bc): undefined reference to `rdma_disconnect'
> > net/9p/trans_rdma.o: In function `rdma_destroy_trans':
> > trans_rdma.c:(.text+0x830): undefined reference to `ib_destroy_qp'
> > trans_rdma.c:(.text+0x858): undefined reference to `ib_dealloc_pd'
> 
> > Fixes: 9533b292a7ac ("IB: remove redundant INFINIBAND kconfig
> dependencies")
> > Signed-off-by: Arnd Bergmann 
> 
> Acked-by: Greg Thelen 
> 
> Sorry for the 9533b292a7ac problem.
> At this point the in release cycle, I think Arnd's revert is best.
> 
> If there is interest, I've put a little thought into an alternative fix:
> making INFINIBAND_ADDR_TRANS tristate.  But it's nontrivial.
> So I prefer this simple revert for now.

Is that a normal thing to do?

> Doug: do you need anything from me on this?

I can take the revert..

Jason

Re: [PATCH] IB: Revert "remove redundant INFINIBAND kconfig dependencies"

[Jason Gunthorpe]

On Fri, May 25, 2018 at 05:32:52PM -0700, Greg Thelen wrote:
> On Fri, May 25, 2018 at 2:32 PM Arnd Bergmann  wrote:
> 
> > Several subsystems depend on INFINIBAND_ADDR_TRANS, which in turn depends
> > on INFINIBAND. However, when with CONFIG_INIFIBAND=m, this leads to a
> > link error when another driver using it is built-in. The
> > INFINIBAND_ADDR_TRANS dependency is insufficient here as this is
> > a 'bool' symbol that does not force anything to be a module in turn.
> 
> > fs/cifs/smbdirect.o: In function `smbd_disconnect_rdma_work':
> > smbdirect.c:(.text+0x1e4): undefined reference to `rdma_disconnect'
> > net/9p/trans_rdma.o: In function `rdma_request':
> > trans_rdma.c:(.text+0x7bc): undefined reference to `rdma_disconnect'
> > net/9p/trans_rdma.o: In function `rdma_destroy_trans':
> > trans_rdma.c:(.text+0x830): undefined reference to `ib_destroy_qp'
> > trans_rdma.c:(.text+0x858): undefined reference to `ib_dealloc_pd'
> 
> > Fixes: 9533b292a7ac ("IB: remove redundant INFINIBAND kconfig
> dependencies")
> > Signed-off-by: Arnd Bergmann 
> 
> Acked-by: Greg Thelen 
> 
> Sorry for the 9533b292a7ac problem.
> At this point the in release cycle, I think Arnd's revert is best.
> 
> If there is interest, I've put a little thought into an alternative fix:
> making INFINIBAND_ADDR_TRANS tristate.  But it's nontrivial.
> So I prefer this simple revert for now.

Is that a normal thing to do?

> Doug: do you need anything from me on this?

I can take the revert..

Jason

[PATCH] powerpc/64: Fix build failure with GCC 8.1

[Christophe Leroy]

  CC  arch/powerpc/kernel/nvram_64.o
arch/powerpc/kernel/nvram_64.c: In function 'nvram_create_partition':
arch/powerpc/kernel/nvram_64.c:1042:2: error: 'strncpy' specified bound 12 
equals destination size [-Werror=stringop-truncation]
  strncpy(new_part->header.name, name, 12);
  ^~~~

  CC  arch/powerpc/kernel/trace/ftrace.o
In function 'make_field',
inlined from 'ps3_repository_read_boot_dat_address' at 
arch/powerpc/platforms/ps3/repository.c:900:9:
arch/powerpc/platforms/ps3/repository.c:106:2: error: 'strncpy' output 
truncated before terminating nul copying 8 bytes from a string of the same 
length [-Werror=stringop-truncation]
  strncpy((char *), text, 8);
  ^~~~

Signed-off-by: Christophe Leroy 
---
 arch/powerpc/kernel/nvram_64.c  | 2 +-
 arch/powerpc/platforms/ps3/repository.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index ba681dac7b46..7507448cd904 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -1039,7 +1039,7 @@ loff_t __init nvram_create_partition(const char *name, 
int sig,
new_part->index = free_part->index;
new_part->header.signature = sig;
new_part->header.length = size;
-   strncpy(new_part->header.name, name, 12);
+   strncpy(new_part->header.name, name, sizeof(new_part->header.name) - 1);
new_part->header.checksum = nvram_checksum(_part->header);
 
rc = nvram_write_header(new_part);
diff --git a/arch/powerpc/platforms/ps3/repository.c 
b/arch/powerpc/platforms/ps3/repository.c
index 50dbaf24b1ee..b4d6628eec5e 100644
--- a/arch/powerpc/platforms/ps3/repository.c
+++ b/arch/powerpc/platforms/ps3/repository.c
@@ -101,9 +101,9 @@ static u64 make_first_field(const char *text, u64 index)
 
 static u64 make_field(const char *text, u64 index)
 {
-   u64 n;
+   u64 n = 0;
 
-   strncpy((char *), text, 8);
+   memcpy((char *), text, min(sizeof(n), strlen(text)));
return n + index;
 }
 
-- 
2.13.3

[PATCH] powerpc/64: Fix build failure with GCC 8.1

[Christophe Leroy]

  CC  arch/powerpc/kernel/nvram_64.o
arch/powerpc/kernel/nvram_64.c: In function 'nvram_create_partition':
arch/powerpc/kernel/nvram_64.c:1042:2: error: 'strncpy' specified bound 12 
equals destination size [-Werror=stringop-truncation]
  strncpy(new_part->header.name, name, 12);
  ^~~~

  CC  arch/powerpc/kernel/trace/ftrace.o
In function 'make_field',
inlined from 'ps3_repository_read_boot_dat_address' at 
arch/powerpc/platforms/ps3/repository.c:900:9:
arch/powerpc/platforms/ps3/repository.c:106:2: error: 'strncpy' output 
truncated before terminating nul copying 8 bytes from a string of the same 
length [-Werror=stringop-truncation]
  strncpy((char *), text, 8);
  ^~~~

Signed-off-by: Christophe Leroy 
---
 arch/powerpc/kernel/nvram_64.c  | 2 +-
 arch/powerpc/platforms/ps3/repository.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index ba681dac7b46..7507448cd904 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -1039,7 +1039,7 @@ loff_t __init nvram_create_partition(const char *name, 
int sig,
new_part->index = free_part->index;
new_part->header.signature = sig;
new_part->header.length = size;
-   strncpy(new_part->header.name, name, 12);
+   strncpy(new_part->header.name, name, sizeof(new_part->header.name) - 1);
new_part->header.checksum = nvram_checksum(_part->header);
 
rc = nvram_write_header(new_part);
diff --git a/arch/powerpc/platforms/ps3/repository.c 
b/arch/powerpc/platforms/ps3/repository.c
index 50dbaf24b1ee..b4d6628eec5e 100644
--- a/arch/powerpc/platforms/ps3/repository.c
+++ b/arch/powerpc/platforms/ps3/repository.c
@@ -101,9 +101,9 @@ static u64 make_first_field(const char *text, u64 index)
 
 static u64 make_field(const char *text, u64 index)
 {
-   u64 n;
+   u64 n = 0;
 
-   strncpy((char *), text, 8);
+   memcpy((char *), text, min(sizeof(n), strlen(text)));
return n + index;
 }
 
-- 
2.13.3

Re: [PATCH v4 6/6] tty/serial: atmel: changed the driver to work under at91-usart mfd

[Richard Genoud]

On 25/05/2018 19:19, Radu Pirea wrote:
> This patch modifies the place where resources and device tree properties
> are searched.
> 
> Signed-off-by: Radu Pirea 
> ---
>  drivers/tty/serial/Kconfig|  1 +
>  drivers/tty/serial/atmel_serial.c | 40 +--
>  2 files changed, 23 insertions(+), 18 deletions(-)
the stdout-path property of the chosen node is still broken in this verion.
if :
stdout-path = "serial0:115200n8";
is set in the DTS, the console output should go on serial0 (aka dbgu)
cf Documentation/devicetree/bindings/chosen.txt

With this patch applied, this is not the case anymore.
Adding console=ttyS0,115200 in the chosen node is not the solution here.


regards,
Richard.

Re: [PATCH v4 6/6] tty/serial: atmel: changed the driver to work under at91-usart mfd

[Richard Genoud]

On 25/05/2018 19:19, Radu Pirea wrote:
> This patch modifies the place where resources and device tree properties
> are searched.
> 
> Signed-off-by: Radu Pirea 
> ---
>  drivers/tty/serial/Kconfig|  1 +
>  drivers/tty/serial/atmel_serial.c | 40 +--
>  2 files changed, 23 insertions(+), 18 deletions(-)
the stdout-path property of the chosen node is still broken in this verion.
if :
stdout-path = "serial0:115200n8";
is set in the DTS, the console output should go on serial0 (aka dbgu)
cf Documentation/devicetree/bindings/chosen.txt

With this patch applied, this is not the case anymore.
Adding console=ttyS0,115200 in the chosen node is not the solution here.


regards,
Richard.

[PATCH 0/5] Remove sh_mobile_ceu_camera from arch/sh

[Jacopo Mondi]

Hello,
this series removes dependencies on the soc_camera based
sh_mobile_ceu_camera driver from 3 board files in arch/sh and from one
sensor driver used by one of those boards.

Hans, this means there are no more user of the soc_camera framework that I know
of in Linux, and I guess we can now plan of to remove that framework.

A note on the sensor driver: I haven't been able to find any documentation
for the SHARP RJ54N1CB0C sensor and so I inferred as much as possible from the
existing code. It seems to me that the sensor needs to power-up/enable gpios
(both active high) and I have registered them from the kfr2r09 board file,
assuming this was not a platform-specific design, but something the sensor
requires. As per the previous drivers ported away from soc_camera, I'm in
favour of moving them to staging if they do not match the quality expected
from a modern V4L2 sensor driver. Ie. framerate control is missing, and I
know this has been a blocker for other drivers in the past.

What I've done to three board files closely resembles what I done already for
Migo-R and Ecovec, and it listed in the single commit messages.

The only tough one is probably ap325rxa, which had an additional sensor
registered but controlled from i2c transaction of magic blobs from the board
file. I dare to remove that sensor registration completely as it seems to me
there is no diver for that at all in mainline.

Last, this patch is based on the media tree master branch, with Akinobu Mita's
patches on ov772x driver on top, which I strangely see only partially applied
to the media master tree [1]

Hans, as this is mostly media-related work, but mostly on SH architecture, I
would like to ask if these should go through you or SH tree.

All of that has only been compile tested. It's pretty hard to find this
platforms around and testing would be awesome if somebody happens to have
one of these.

Thanks
   j

[1] https://patchwork.linuxtv.org/patch/49318/
https://patchwork.linuxtv.org/patch/49317/
https://patchwork.linuxtv.org/patch/49312/

Jacopo Mondi (5):
  media: i2c: Copy rj54n1cb0c soc_camera sensor driver
  media: i2c: rj54n1: Remove soc_camera dependencies
  arch: sh: kfr2r09: Use new renesas-ceu camera driver
  arch: sh: ms7724se: Use new renesas-ceu camera driver
  arch: sh: ap325rxa: Use new renesas-ceu camera driver

 arch/sh/boards/mach-ap325rxa/setup.c   |  282 ++-
 arch/sh/boards/mach-kfr2r09/setup.c|  216 +++--
 arch/sh/boards/mach-se/7724/setup.c|  120 ++-
 arch/sh/kernel/cpu/sh4a/clock-sh7723.c |2 +-
 drivers/media/i2c/Kconfig  |   11 +
 drivers/media/i2c/Makefile |1 +
 drivers/media/i2c/rj54n1cb0c.c | 1437 
 7 files changed, 1710 insertions(+), 359 deletions(-)
 create mode 100644 drivers/media/i2c/rj54n1cb0c.c

--
2.7.4

[PATCH 0/5] Remove sh_mobile_ceu_camera from arch/sh

[Jacopo Mondi]

Hello,
this series removes dependencies on the soc_camera based
sh_mobile_ceu_camera driver from 3 board files in arch/sh and from one
sensor driver used by one of those boards.

Hans, this means there are no more user of the soc_camera framework that I know
of in Linux, and I guess we can now plan of to remove that framework.

A note on the sensor driver: I haven't been able to find any documentation
for the SHARP RJ54N1CB0C sensor and so I inferred as much as possible from the
existing code. It seems to me that the sensor needs to power-up/enable gpios
(both active high) and I have registered them from the kfr2r09 board file,
assuming this was not a platform-specific design, but something the sensor
requires. As per the previous drivers ported away from soc_camera, I'm in
favour of moving them to staging if they do not match the quality expected
from a modern V4L2 sensor driver. Ie. framerate control is missing, and I
know this has been a blocker for other drivers in the past.

What I've done to three board files closely resembles what I done already for
Migo-R and Ecovec, and it listed in the single commit messages.

The only tough one is probably ap325rxa, which had an additional sensor
registered but controlled from i2c transaction of magic blobs from the board
file. I dare to remove that sensor registration completely as it seems to me
there is no diver for that at all in mainline.

Last, this patch is based on the media tree master branch, with Akinobu Mita's
patches on ov772x driver on top, which I strangely see only partially applied
to the media master tree [1]

Hans, as this is mostly media-related work, but mostly on SH architecture, I
would like to ask if these should go through you or SH tree.

All of that has only been compile tested. It's pretty hard to find this
platforms around and testing would be awesome if somebody happens to have
one of these.

Thanks
   j

[1] https://patchwork.linuxtv.org/patch/49318/
https://patchwork.linuxtv.org/patch/49317/
https://patchwork.linuxtv.org/patch/49312/

Jacopo Mondi (5):
  media: i2c: Copy rj54n1cb0c soc_camera sensor driver
  media: i2c: rj54n1: Remove soc_camera dependencies
  arch: sh: kfr2r09: Use new renesas-ceu camera driver
  arch: sh: ms7724se: Use new renesas-ceu camera driver
  arch: sh: ap325rxa: Use new renesas-ceu camera driver

 arch/sh/boards/mach-ap325rxa/setup.c   |  282 ++-
 arch/sh/boards/mach-kfr2r09/setup.c|  216 +++--
 arch/sh/boards/mach-se/7724/setup.c|  120 ++-
 arch/sh/kernel/cpu/sh4a/clock-sh7723.c |2 +-
 drivers/media/i2c/Kconfig  |   11 +
 drivers/media/i2c/Makefile |1 +
 drivers/media/i2c/rj54n1cb0c.c | 1437 
 7 files changed, 1710 insertions(+), 359 deletions(-)
 create mode 100644 drivers/media/i2c/rj54n1cb0c.c

--
2.7.4

[PATCH 3/5] arch: sh: kfr2r09: Use new renesas-ceu camera driver

[Jacopo Mondi]

Use the new renesas-ceu camera driver in kfr2r09 board file instead of
the soc_camera based sh_mobile_ceu_camera driver.

Get rid of soc_camera specific components, and move clk and gpio handling
away from board file, registering the clock source and the enable gpios
for driver consumption.

Memory for the CEU video buffers is now reserved with membocks APIs,
and need to be declared as dma_coherent during machine initialization to
remove that architecture specific part from CEU driver.

While at there update license to SPDX header and sort headers alphabetically.

No need to udapte the clock source names, as
commit c2f9b05fd5c1 ("media: arch: sh: ecovec: Use new renesas-ceu camera 
driver")
already updated it to the new ceu driver name for all SH7724 boards (possibly
breaking kfr2r09 before this commit).

Compile tested only.

Signed-off-by: Jacopo Mondi 
---
 arch/sh/boards/mach-kfr2r09/setup.c | 217 +---
 1 file changed, 103 insertions(+), 114 deletions(-)

diff --git a/arch/sh/boards/mach-kfr2r09/setup.c 
b/arch/sh/boards/mach-kfr2r09/setup.c
index 6af..e59c577 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -1,41 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * KFR2R09 board support code
  *
  * Copyright (C) 2009 Magnus Damm
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
  */
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
+
+#include 
+#include 
+#include 
+#include 
+
+#include 
+
+#include 
 #include 
-#include 
+#include 
 #include 
+#include 
+#include 
+#include 
 #include 
 #include 
-#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
 #include 
+#include 
 #include 
 #include 
+#include 
 #include 
 #include 
-#include 
+
+#include 
+
+#include 
 #include 
-#include 
-#include 
+
 #include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
+
+#define CEU_BUFFER_MEMORY_SIZE (4 << 20)
+static phys_addr_t ceu_dma_membase;
+
+/* set VIO_CKO clock to 25MHz */
+#define CEU_MCLK_FREQ  2500
+#define DRVCRB 0xA405018C
 
 static struct mtd_partition kfr2r09_nor_flash_partitions[] =
 {
@@ -230,8 +242,17 @@ static struct platform_device kfr2r09_usb0_gadget_device = 
{
.resource   = kfr2r09_usb0_gadget_resources,
 };
 
-static struct sh_mobile_ceu_info sh_mobile_ceu_info = {
-   .flags = SH_CEU_FLAG_USE_8BIT_BUS,
+static struct ceu_platform_data ceu_pdata = {
+   .num_subdevs= 1,
+   .subdevs = {
+   { /* [0] = rj54n1cb0c */
+   .flags  = 0,
+   .bus_width  = 8,
+   .bus_shift  = 0,
+   .i2c_adapter_id = 1,
+   .i2c_address= 0x50,
+   },
+   },
 };
 
 static struct resource kfr2r09_ceu_resources[] = {
@@ -246,109 +267,35 @@ static struct resource kfr2r09_ceu_resources[] = {
.end= evt2irq(0x880),
.flags  = IORESOURCE_IRQ,
},
-   [2] = {
-   /* place holder for contiguous memory */
-   },
 };
 
 static struct platform_device kfr2r09_ceu_device = {
-   .name   = "sh_mobile_ceu",
+   .name   = "renesas-ceu",
.id = 0, /* "ceu0" clock */
.num_resources  = ARRAY_SIZE(kfr2r09_ceu_resources),
.resource   = kfr2r09_ceu_resources,
.dev= {
-   .platform_data  = _mobile_ceu_info,
+   .platform_data  = _pdata,
},
 };
 
-static struct i2c_board_info kfr2r09_i2c_camera = {
-   I2C_BOARD_INFO("rj54n1cb0c", 0x50),
-};
-
-static struct clk *camera_clk;
-
-/* set VIO_CKO clock to 25MHz */
-#define CEU_MCLK_FREQ 2500
-
-#define DRVCRB 0xA405018C
-static int camera_power(struct device *dev, int mode)
-{
-   int ret;
-
-   if (mode) {
-   long rate;
-
-   camera_clk = clk_get(NULL, "video_clk");
-   if (IS_ERR(camera_clk))
-   return PTR_ERR(camera_clk);
-
-   rate = clk_round_rate(camera_clk, CEU_MCLK_FREQ);
-   ret = clk_set_rate(camera_clk, rate);
-   if (ret < 0)
-   goto eclkrate;
-
-   /* set DRVCRB
-*
-* use 1.8 V for VccQ_VIO
-* use 2.85V for VccQ_SR
-*/
-   __raw_writew((__raw_readw(DRVCRB) & ~0x0003) | 0x0001, DRVCRB);
-
-   /* reset clear */
-   ret = gpio_request(GPIO_PTB4, NULL);
-   if (ret < 0)
-   goto eptb4;
-   ret = gpio_request(GPIO_PTB7, NULL);
-   if (ret < 0)
-   goto eptb7;
-

[PATCH 3/5] arch: sh: kfr2r09: Use new renesas-ceu camera driver

[Jacopo Mondi]

Use the new renesas-ceu camera driver in kfr2r09 board file instead of
the soc_camera based sh_mobile_ceu_camera driver.

Get rid of soc_camera specific components, and move clk and gpio handling
away from board file, registering the clock source and the enable gpios
for driver consumption.

Memory for the CEU video buffers is now reserved with membocks APIs,
and need to be declared as dma_coherent during machine initialization to
remove that architecture specific part from CEU driver.

While at there update license to SPDX header and sort headers alphabetically.

No need to udapte the clock source names, as
commit c2f9b05fd5c1 ("media: arch: sh: ecovec: Use new renesas-ceu camera 
driver")
already updated it to the new ceu driver name for all SH7724 boards (possibly
breaking kfr2r09 before this commit).

Compile tested only.

Signed-off-by: Jacopo Mondi 
---
 arch/sh/boards/mach-kfr2r09/setup.c | 217 +---
 1 file changed, 103 insertions(+), 114 deletions(-)

diff --git a/arch/sh/boards/mach-kfr2r09/setup.c 
b/arch/sh/boards/mach-kfr2r09/setup.c
index 6af..e59c577 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -1,41 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * KFR2R09 board support code
  *
  * Copyright (C) 2009 Magnus Damm
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
  */
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
+
+#include 
+#include 
+#include 
+#include 
+
+#include 
+
+#include 
 #include 
-#include 
+#include 
 #include 
+#include 
+#include 
+#include 
 #include 
 #include 
-#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
 #include 
+#include 
 #include 
 #include 
+#include 
 #include 
 #include 
-#include 
+
+#include 
+
+#include 
 #include 
-#include 
-#include 
+
 #include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
+
+#define CEU_BUFFER_MEMORY_SIZE (4 << 20)
+static phys_addr_t ceu_dma_membase;
+
+/* set VIO_CKO clock to 25MHz */
+#define CEU_MCLK_FREQ  2500
+#define DRVCRB 0xA405018C
 
 static struct mtd_partition kfr2r09_nor_flash_partitions[] =
 {
@@ -230,8 +242,17 @@ static struct platform_device kfr2r09_usb0_gadget_device = 
{
.resource   = kfr2r09_usb0_gadget_resources,
 };
 
-static struct sh_mobile_ceu_info sh_mobile_ceu_info = {
-   .flags = SH_CEU_FLAG_USE_8BIT_BUS,
+static struct ceu_platform_data ceu_pdata = {
+   .num_subdevs= 1,
+   .subdevs = {
+   { /* [0] = rj54n1cb0c */
+   .flags  = 0,
+   .bus_width  = 8,
+   .bus_shift  = 0,
+   .i2c_adapter_id = 1,
+   .i2c_address= 0x50,
+   },
+   },
 };
 
 static struct resource kfr2r09_ceu_resources[] = {
@@ -246,109 +267,35 @@ static struct resource kfr2r09_ceu_resources[] = {
.end= evt2irq(0x880),
.flags  = IORESOURCE_IRQ,
},
-   [2] = {
-   /* place holder for contiguous memory */
-   },
 };
 
 static struct platform_device kfr2r09_ceu_device = {
-   .name   = "sh_mobile_ceu",
+   .name   = "renesas-ceu",
.id = 0, /* "ceu0" clock */
.num_resources  = ARRAY_SIZE(kfr2r09_ceu_resources),
.resource   = kfr2r09_ceu_resources,
.dev= {
-   .platform_data  = _mobile_ceu_info,
+   .platform_data  = _pdata,
},
 };
 
-static struct i2c_board_info kfr2r09_i2c_camera = {
-   I2C_BOARD_INFO("rj54n1cb0c", 0x50),
-};
-
-static struct clk *camera_clk;
-
-/* set VIO_CKO clock to 25MHz */
-#define CEU_MCLK_FREQ 2500
-
-#define DRVCRB 0xA405018C
-static int camera_power(struct device *dev, int mode)
-{
-   int ret;
-
-   if (mode) {
-   long rate;
-
-   camera_clk = clk_get(NULL, "video_clk");
-   if (IS_ERR(camera_clk))
-   return PTR_ERR(camera_clk);
-
-   rate = clk_round_rate(camera_clk, CEU_MCLK_FREQ);
-   ret = clk_set_rate(camera_clk, rate);
-   if (ret < 0)
-   goto eclkrate;
-
-   /* set DRVCRB
-*
-* use 1.8 V for VccQ_VIO
-* use 2.85V for VccQ_SR
-*/
-   __raw_writew((__raw_readw(DRVCRB) & ~0x0003) | 0x0001, DRVCRB);
-
-   /* reset clear */
-   ret = gpio_request(GPIO_PTB4, NULL);
-   if (ret < 0)
-   goto eptb4;
-   ret = gpio_request(GPIO_PTB7, NULL);
-   if (ret < 0)
-   goto eptb7;
-
-   ret = 

Re: [PATCH 10/12] ARM: dts: exynos5250: add DSI node

[Krzysztof Kozlowski]

On Mon, May 28, 2018 at 11:54 AM, Maciej Purski  wrote:
> The patch adds common part of DSI node for Exynos5250 platforms.
>
> Signed-off-by: Andrzej Hajda 
> Signed-off-by: Maciej Purski 
> ---
>  arch/arm/boot/dts/exynos5250.dtsi | 14 ++
>  1 file changed, 14 insertions(+)


This should be squashed with previous patch because it is logically
the same feature. The purpose of PHY is this DSI node so splitting it
is slightly too much.

Best regards,
Krzysztof

Re: [PATCH 10/12] ARM: dts: exynos5250: add DSI node

[Krzysztof Kozlowski]

On Mon, May 28, 2018 at 11:54 AM, Maciej Purski  wrote:
> The patch adds common part of DSI node for Exynos5250 platforms.
>
> Signed-off-by: Andrzej Hajda 
> Signed-off-by: Maciej Purski 
> ---
>  arch/arm/boot/dts/exynos5250.dtsi | 14 ++
>  1 file changed, 14 insertions(+)


This should be squashed with previous patch because it is logically
the same feature. The purpose of PHY is this DSI node so splitting it
is slightly too much.

Best regards,
Krzysztof

[PATCH 4/5] arch: sh: ms7724se: Use new renesas-ceu camera driver

[Jacopo Mondi]

Use the new renesas-ceu camera driver is ms7724se board file instead of
the soc_camera based sh_mobile_ceu_camera driver.

Get rid of soc_camera specific components, and register CEU0 and CEU1 with
no active video subdevices.

Memory for the CEU video buffers is now reserved with membocks APIs
and need to be declared as dma_coherent during machine initialization to
remove that architecture specific part from CEU driver.

While at there update license to SPDX header and sort headers
alphabetically.

No need to udapte the clock source names, as
commit c2f9b05fd5c1 ("media: arch: sh: ecovec: Use new renesas-ceu camera 
driver")
already updated it to the new ceu driver name for all SH7724 boards
(possibly breaking ms7724se before this commit).

Compile tested only.

Signed-off-by: Jacopo Mondi 
---
 arch/sh/boards/mach-se/7724/setup.c | 120 
 1 file changed, 79 insertions(+), 41 deletions(-)

diff --git a/arch/sh/boards/mach-se/7724/setup.c 
b/arch/sh/boards/mach-se/7724/setup.c
index 2559525..fdbec22a 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -1,43 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * linux/arch/sh/boards/se/7724/setup.c
  *
  * Copyright (C) 2009 Renesas Solutions Corp.
  *
  * Kuninori Morimoto 
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
  */
+#include 
+#include 
+#include 
+#include 
 
-#include 
+#include 
+
+#include 
 #include 
+#include 
+#include 
+#include 
+#include 
 #include 
-#include 
-#include 
+#include 
 #include 
+#include 
 #include 
-#include 
+#include 
 #include 
 #include 
-#include 
-#include 
-#include 
-#include 
-#include 
 #include 
 #include 
+#include 
+#include 
 #include 
-#include 
-#include 
+
+#include 
+#include 
+
 #include 
 #include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
+
+#include 
+
+#define CEU_BUFFER_MEMORY_SIZE (4 << 20)
+static phys_addr_t ceu0_dma_membase;
+static phys_addr_t ceu1_dma_membase;
 
 /*
  * SWx1234 5678
@@ -216,8 +222,8 @@ static struct platform_device lcdc_device = {
 };
 
 /* CEU0 */
-static struct sh_mobile_ceu_info sh_mobile_ceu0_info = {
-   .flags = SH_CEU_FLAG_USE_8BIT_BUS,
+static struct ceu_platform_data ceu0_pdata = {
+   .num_subdevs = 0,
 };
 
 static struct resource ceu0_resources[] = {
@@ -231,24 +237,21 @@ static struct resource ceu0_resources[] = {
.start  = evt2irq(0x880),
.flags  = IORESOURCE_IRQ,
},
-   [2] = {
-   /* place holder for contiguous memory */
-   },
 };
 
 static struct platform_device ceu0_device = {
-   .name   = "sh_mobile_ceu",
-   .id = 0, /* "ceu0" clock */
+   .name   = "renesas-ceu",
+   .id = 0, /* "ceu.0" clock */
.num_resources  = ARRAY_SIZE(ceu0_resources),
.resource   = ceu0_resources,
.dev= {
-   .platform_data  = _mobile_ceu0_info,
+   .platform_data  = _pdata,
},
 };
 
 /* CEU1 */
-static struct sh_mobile_ceu_info sh_mobile_ceu1_info = {
-   .flags = SH_CEU_FLAG_USE_8BIT_BUS,
+static struct ceu_platform_data ceu1_pdata = {
+   .num_subdevs = 0,
 };
 
 static struct resource ceu1_resources[] = {
@@ -262,18 +265,15 @@ static struct resource ceu1_resources[] = {
.start  = evt2irq(0x9e0),
.flags  = IORESOURCE_IRQ,
},
-   [2] = {
-   /* place holder for contiguous memory */
-   },
 };
 
 static struct platform_device ceu1_device = {
-   .name   = "sh_mobile_ceu",
-   .id = 1, /* "ceu1" clock */
+   .name   = "renesas-ceu",
+   .id = 1, /* "ceu.1" clock */
.num_resources  = ARRAY_SIZE(ceu1_resources),
.resource   = ceu1_resources,
.dev= {
-   .platform_data  = _mobile_ceu1_info,
+   .platform_data  = _pdata,
},
 };
 
@@ -574,13 +574,16 @@ static struct platform_device vou_device = {
},
 };
 
+static struct platform_device *ms7724se_ceu_devices[] __initdata = {
+   _device,
+   _device,
+};
+
 static struct platform_device *ms7724se_devices[] __initdata = {
_device,
_eth_device,
_device,
_flash_device,
-   _device,
-   _device,
_device,
_eth_device,
_usb0_host_device,
@@ -797,7 +800,6 @@ static int __init devices_setup(void)
gpio_request(GPIO_FN_VIO0_CLK, NULL);
gpio_request(GPIO_FN_VIO0_FLD, NULL);
gpio_request(GPIO_FN_VIO0_HD,  NULL);
-   platform_resource_setup_memory(_device, "ceu0", 4 << 20);
 
/* enable CEU1 */
gpio_request(GPIO_FN_VIO1_D7,  NULL);
@@ -812,7 +814,6 @@ static int 

[PATCH 4/5] arch: sh: ms7724se: Use new renesas-ceu camera driver

[Jacopo Mondi]

Use the new renesas-ceu camera driver is ms7724se board file instead of
the soc_camera based sh_mobile_ceu_camera driver.

Get rid of soc_camera specific components, and register CEU0 and CEU1 with
no active video subdevices.

Memory for the CEU video buffers is now reserved with membocks APIs
and need to be declared as dma_coherent during machine initialization to
remove that architecture specific part from CEU driver.

While at there update license to SPDX header and sort headers
alphabetically.

No need to udapte the clock source names, as
commit c2f9b05fd5c1 ("media: arch: sh: ecovec: Use new renesas-ceu camera 
driver")
already updated it to the new ceu driver name for all SH7724 boards
(possibly breaking ms7724se before this commit).

Compile tested only.

Signed-off-by: Jacopo Mondi 
---
 arch/sh/boards/mach-se/7724/setup.c | 120 
 1 file changed, 79 insertions(+), 41 deletions(-)

diff --git a/arch/sh/boards/mach-se/7724/setup.c 
b/arch/sh/boards/mach-se/7724/setup.c
index 2559525..fdbec22a 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -1,43 +1,49 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * linux/arch/sh/boards/se/7724/setup.c
  *
  * Copyright (C) 2009 Renesas Solutions Corp.
  *
  * Kuninori Morimoto 
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
  */
+#include 
+#include 
+#include 
+#include 
 
-#include 
+#include 
+
+#include 
 #include 
+#include 
+#include 
+#include 
+#include 
 #include 
-#include 
-#include 
+#include 
 #include 
+#include 
 #include 
-#include 
+#include 
 #include 
 #include 
-#include 
-#include 
-#include 
-#include 
-#include 
 #include 
 #include 
+#include 
+#include 
 #include 
-#include 
-#include 
+
+#include 
+#include 
+
 #include 
 #include 
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
+
+#include 
+
+#define CEU_BUFFER_MEMORY_SIZE (4 << 20)
+static phys_addr_t ceu0_dma_membase;
+static phys_addr_t ceu1_dma_membase;
 
 /*
  * SWx1234 5678
@@ -216,8 +222,8 @@ static struct platform_device lcdc_device = {
 };
 
 /* CEU0 */
-static struct sh_mobile_ceu_info sh_mobile_ceu0_info = {
-   .flags = SH_CEU_FLAG_USE_8BIT_BUS,
+static struct ceu_platform_data ceu0_pdata = {
+   .num_subdevs = 0,
 };
 
 static struct resource ceu0_resources[] = {
@@ -231,24 +237,21 @@ static struct resource ceu0_resources[] = {
.start  = evt2irq(0x880),
.flags  = IORESOURCE_IRQ,
},
-   [2] = {
-   /* place holder for contiguous memory */
-   },
 };
 
 static struct platform_device ceu0_device = {
-   .name   = "sh_mobile_ceu",
-   .id = 0, /* "ceu0" clock */
+   .name   = "renesas-ceu",
+   .id = 0, /* "ceu.0" clock */
.num_resources  = ARRAY_SIZE(ceu0_resources),
.resource   = ceu0_resources,
.dev= {
-   .platform_data  = _mobile_ceu0_info,
+   .platform_data  = _pdata,
},
 };
 
 /* CEU1 */
-static struct sh_mobile_ceu_info sh_mobile_ceu1_info = {
-   .flags = SH_CEU_FLAG_USE_8BIT_BUS,
+static struct ceu_platform_data ceu1_pdata = {
+   .num_subdevs = 0,
 };
 
 static struct resource ceu1_resources[] = {
@@ -262,18 +265,15 @@ static struct resource ceu1_resources[] = {
.start  = evt2irq(0x9e0),
.flags  = IORESOURCE_IRQ,
},
-   [2] = {
-   /* place holder for contiguous memory */
-   },
 };
 
 static struct platform_device ceu1_device = {
-   .name   = "sh_mobile_ceu",
-   .id = 1, /* "ceu1" clock */
+   .name   = "renesas-ceu",
+   .id = 1, /* "ceu.1" clock */
.num_resources  = ARRAY_SIZE(ceu1_resources),
.resource   = ceu1_resources,
.dev= {
-   .platform_data  = _mobile_ceu1_info,
+   .platform_data  = _pdata,
},
 };
 
@@ -574,13 +574,16 @@ static struct platform_device vou_device = {
},
 };
 
+static struct platform_device *ms7724se_ceu_devices[] __initdata = {
+   _device,
+   _device,
+};
+
 static struct platform_device *ms7724se_devices[] __initdata = {
_device,
_eth_device,
_device,
_flash_device,
-   _device,
-   _device,
_device,
_eth_device,
_usb0_host_device,
@@ -797,7 +800,6 @@ static int __init devices_setup(void)
gpio_request(GPIO_FN_VIO0_CLK, NULL);
gpio_request(GPIO_FN_VIO0_FLD, NULL);
gpio_request(GPIO_FN_VIO0_HD,  NULL);
-   platform_resource_setup_memory(_device, "ceu0", 4 << 20);
 
/* enable CEU1 */
gpio_request(GPIO_FN_VIO1_D7,  NULL);
@@ -812,7 +814,6 @@ static int __init devices_setup(void)

[PATCH 5/5] arch: sh: ap325rxa: Use new renesas-ceu camera driver

[Jacopo Mondi]

Use the new renesas-ceu camera driver in ap325rxa board file instead of
the soc_camera based sh_mobile_ceu_camera driver.

Get rid of soc_camera specific components, and register CEU0 with a single
video sensor (ov7725).

Memory for the CEU video buffers is now reserved with membocks APIs
and need to be declared as dma_coherent during machine initialization to
remove that architecture specific part from CEU driver.

The ap325rxa board file registers another camera (ncm03j) for which I found no
driver in mainline kernel version, and that was configured/probed by sending
i2c messages (of 'magic blobs) from the board file itself. I removed the
sensor registration from this new version as it used soc_camera components
that will be later removed.

While at there update license to SPDX header and sort headers alphabetically.

Compile tested only.

Signed-off-by: Jacopo Mondi 
---
 arch/sh/boards/mach-ap325rxa/setup.c   | 282 +
 arch/sh/kernel/cpu/sh4a/clock-sh7723.c |   2 +-
 2 files changed, 80 insertions(+), 204 deletions(-)

diff --git a/arch/sh/boards/mach-ap325rxa/setup.c 
b/arch/sh/boards/mach-ap325rxa/setup.c
index de8393c..8f234d04 100644
--- a/arch/sh/boards/mach-ap325rxa/setup.c
+++ b/arch/sh/boards/mach-ap325rxa/setup.c
@@ -1,40 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Renesas - AP-325RXA
  * (Compatible with Algo System ., LTD. - AP-320A)
  *
  * Copyright (C) 2008 Renesas Solutions Corp.
  * Author : Yusuke Goda 
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
  */
 
-#include 
+#include 
+#include 
+#include 
+
+#include 
+
+#include 
+#include 
 #include 
+#include 
+#include 
+#include 
+#include 
 #include 
-#include 
+#include 
+#include 
 #include 
 #include 
 #include 
-#include 
-#include 
-#include 
+#include 
 #include 
 #include 
+#include 
 #include 
-#include 
 #include 
-#include 
+
+#include 
 #include 
-#include 
-#include 
-#include 
+
 #include 
-#include 
-#include 
-#include 
-#include 
+
+#define CEU_BUFFER_MEMORY_SIZE (4 << 20)
+static phys_addr_t ceu_dma_membase;
 
 /* Dummy supplies, where voltage doesn't matter */
 static struct regulator_consumer_supply dummy_supplies[] = {
@@ -253,150 +258,25 @@ static struct platform_device lcdc_device = {
},
 };
 
-static void camera_power(int val)
-{
-   gpio_set_value(GPIO_PTZ5, val); /* RST_CAM/RSTB */
-   mdelay(10);
-}
-
-#ifdef CONFIG_I2C
-/* support for the old ncm03j camera */
-static unsigned char camera_ncm03j_magic[] =
-{
-   0x87, 0x00, 0x88, 0x08, 0x89, 0x01, 0x8A, 0xE8,
-   0x1D, 0x00, 0x1E, 0x8A, 0x21, 0x00, 0x33, 0x36,
-   0x36, 0x60, 0x37, 0x08, 0x3B, 0x31, 0x44, 0x0F,
-   0x46, 0xF0, 0x4B, 0x28, 0x4C, 0x21, 0x4D, 0x55,
-   0x4E, 0x1B, 0x4F, 0xC7, 0x50, 0xFC, 0x51, 0x12,
-   0x58, 0x02, 0x66, 0xC0, 0x67, 0x46, 0x6B, 0xA0,
-   0x6C, 0x34, 0x7E, 0x25, 0x7F, 0x25, 0x8D, 0x0F,
-   0x92, 0x40, 0x93, 0x04, 0x94, 0x26, 0x95, 0x0A,
-   0x99, 0x03, 0x9A, 0xF0, 0x9B, 0x14, 0x9D, 0x7A,
-   0xC5, 0x02, 0xD6, 0x07, 0x59, 0x00, 0x5A, 0x1A,
-   0x5B, 0x2A, 0x5C, 0x37, 0x5D, 0x42, 0x5E, 0x56,
-   0xC8, 0x00, 0xC9, 0x1A, 0xCA, 0x2A, 0xCB, 0x37,
-   0xCC, 0x42, 0xCD, 0x56, 0xCE, 0x00, 0xCF, 0x1A,
-   0xD0, 0x2A, 0xD1, 0x37, 0xD2, 0x42, 0xD3, 0x56,
-   0x5F, 0x68, 0x60, 0x87, 0x61, 0xA3, 0x62, 0xBC,
-   0x63, 0xD4, 0x64, 0xEA, 0xD6, 0x0F,
-};
-
-static int camera_probe(void)
-{
-   struct i2c_adapter *a = i2c_get_adapter(0);
-   struct i2c_msg msg;
-   int ret;
-
-   if (!a)
-   return -ENODEV;
-
-   camera_power(1);
-   msg.addr = 0x6e;
-   msg.buf = camera_ncm03j_magic;
-   msg.len = 2;
-   msg.flags = 0;
-   ret = i2c_transfer(a, , 1);
-   camera_power(0);
-
-   return ret;
-}
-
-static int camera_set_capture(struct soc_camera_platform_info *info,
- int enable)
-{
-   struct i2c_adapter *a = i2c_get_adapter(0);
-   struct i2c_msg msg;
-   int ret = 0;
-   int i;
-
-   camera_power(0);
-   if (!enable)
-   return 0; /* no disable for now */
-
-   camera_power(1);
-   for (i = 0; i < ARRAY_SIZE(camera_ncm03j_magic); i += 2) {
-   u_int8_t buf[8];
-
-   msg.addr = 0x6e;
-   msg.buf = buf;
-   msg.len = 2;
-   msg.flags = 0;
-
-   buf[0] = camera_ncm03j_magic[i];
-   buf[1] = camera_ncm03j_magic[i + 1];
-
-   ret = (ret < 0) ? ret : i2c_transfer(a, , 1);
-   }
-
-   return ret;
-}
-
-static int ap325rxa_camera_add(struct soc_camera_device *icd);
-static void ap325rxa_camera_del(struct soc_camera_device *icd);
-
-static struct soc_camera_platform_info camera_info = {
-   .format_name = "UYVY",
- 

Re: [PATCH] HID: rmi: use HID_QUIRK_NO_INPUT_SYNC

[Benjamin Tissoires]

On Fri, May 25, 2018 at 2:51 PM, Benjamin Tissoires
 wrote:
> When we receive a RMI4 report, we should not unconditionally send an
> input_sync event. Instead, we should let the rmi4 transport layer do it
> for us.
>
> This fixes a situation where we might receive X in a report and the rest
> in a subsequent one. And this messes up user space.
>
> Link: https://bugs.freedesktop.org/show_bug.cgi?id=100436
>
> Signed-off-by: Benjamin Tissoires 
> ---
>
> Hi,
>
> Oscar, do you mind if we add your "Tested-by: Oscar Morante "?

As mentioned in comment 25 of the bug above
(https://bugs.freedesktop.org/show_bug.cgi?id=100436#c25), oscar is
fine adding his tested-by line.

Cheers,
Benjamin

>
> Andrew, can you check for any sides effects please?
>
> Cheers,
> Benjamin
>
>  drivers/hid/hid-rmi.c | 20 
>  1 file changed, 20 insertions(+)
>
> diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
> index 9c9362149641..9e33165250a3 100644
> --- a/drivers/hid/hid-rmi.c
> +++ b/drivers/hid/hid-rmi.c
> @@ -413,6 +413,24 @@ static int rmi_event(struct hid_device *hdev, struct 
> hid_field *field,
> return 0;
>  }
>
> +static void rmi_report(struct hid_device *hid, struct hid_report *report)
> +{
> +   struct hid_field *field = report->field[0];
> +
> +   if (!(hid->claimed & HID_CLAIMED_INPUT))
> +   return;
> +
> +   switch (report->id) {
> +   case RMI_READ_DATA_REPORT_ID:
> +   /* fall-through */
> +   case RMI_ATTN_REPORT_ID:
> +   return;
> +   }
> +
> +   if (field && field->hidinput && field->hidinput->input)
> +   input_sync(field->hidinput->input);
> +}
> +
>  #ifdef CONFIG_PM
>  static int rmi_suspend(struct hid_device *hdev, pm_message_t message)
>  {
> @@ -637,6 +655,7 @@ static int rmi_probe(struct hid_device *hdev, const 
> struct hid_device_id *id)
> hid_set_drvdata(hdev, data);
>
> hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
> +   hdev->quirks |= HID_QUIRK_NO_INPUT_SYNC;
>
> ret = hid_parse(hdev);
> if (ret) {
> @@ -744,6 +763,7 @@ static struct hid_driver rmi_driver = {
> .remove = rmi_remove,
> .event  = rmi_event,
> .raw_event  = rmi_raw_event,
> +   .report = rmi_report,
> .input_mapping  = rmi_input_mapping,
> .input_configured   = rmi_input_configured,
>  #ifdef CONFIG_PM
> --
> 2.14.3
>

[PATCH 1/5] media: i2c: Copy rj54n1cb0c soc_camera sensor driver

[Jacopo Mondi]

Copy the soc_camera based driver in v4l2 sensor driver directory.
This commit just copies the original file without modifying it.
No modification to KConfig and Makefile as soc_camera framework
dependencies need to be removed first in next commit.

Signed-off-by: Jacopo Mondi 
---
 drivers/media/i2c/rj54n1cb0c.c | 1416 
 1 file changed, 1416 insertions(+)
 create mode 100644 drivers/media/i2c/rj54n1cb0c.c

diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
new file mode 100644
index 000..02398d0
--- /dev/null
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -0,0 +1,1416 @@
+/*
+ * Driver for RJ54N1CB0C CMOS Image Sensor from Sharp
+ *
+ * Copyright (C) 2009, Guennadi Liakhovetski 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#define RJ54N1_DEV_CODE0x0400
+#define RJ54N1_DEV_CODE2   0x0401
+#define RJ54N1_OUT_SEL 0x0403
+#define RJ54N1_XY_OUTPUT_SIZE_S_H  0x0404
+#define RJ54N1_X_OUTPUT_SIZE_S_L   0x0405
+#define RJ54N1_Y_OUTPUT_SIZE_S_L   0x0406
+#define RJ54N1_XY_OUTPUT_SIZE_P_H  0x0407
+#define RJ54N1_X_OUTPUT_SIZE_P_L   0x0408
+#define RJ54N1_Y_OUTPUT_SIZE_P_L   0x0409
+#define RJ54N1_LINE_LENGTH_PCK_S_H 0x040a
+#define RJ54N1_LINE_LENGTH_PCK_S_L 0x040b
+#define RJ54N1_LINE_LENGTH_PCK_P_H 0x040c
+#define RJ54N1_LINE_LENGTH_PCK_P_L 0x040d
+#define RJ54N1_RESIZE_N0x040e
+#define RJ54N1_RESIZE_N_STEP   0x040f
+#define RJ54N1_RESIZE_STEP 0x0410
+#define RJ54N1_RESIZE_HOLD_H   0x0411
+#define RJ54N1_RESIZE_HOLD_L   0x0412
+#define RJ54N1_H_OBEN_OFS  0x0413
+#define RJ54N1_V_OBEN_OFS  0x0414
+#define RJ54N1_RESIZE_CONTROL  0x0415
+#define RJ54N1_STILL_CONTROL   0x0417
+#define RJ54N1_INC_USE_SEL_H   0x0425
+#define RJ54N1_INC_USE_SEL_L   0x0426
+#define RJ54N1_MIRROR_STILL_MODE   0x0427
+#define RJ54N1_INIT_START  0x0428
+#define RJ54N1_SCALE_1_2_LEV   0x0429
+#define RJ54N1_SCALE_4_LEV 0x042a
+#define RJ54N1_Y_GAIN  0x04d8
+#define RJ54N1_APT_GAIN_UP 0x04fa
+#define RJ54N1_RA_SEL_UL   0x0530
+#define RJ54N1_BYTE_SWAP   0x0531
+#define RJ54N1_OUT_SIGPO   0x053b
+#define RJ54N1_WB_SEL_WEIGHT_I 0x054e
+#define RJ54N1_BIT8_WB 0x0569
+#define RJ54N1_HCAPS_WB0x056a
+#define RJ54N1_VCAPS_WB0x056b
+#define RJ54N1_HCAPE_WB0x056c
+#define RJ54N1_VCAPE_WB0x056d
+#define RJ54N1_EXPOSURE_CONTROL0x058c
+#define RJ54N1_FRAME_LENGTH_S_H0x0595
+#define RJ54N1_FRAME_LENGTH_S_L0x0596
+#define RJ54N1_FRAME_LENGTH_P_H0x0597
+#define RJ54N1_FRAME_LENGTH_P_L0x0598
+#define RJ54N1_PEAK_H  0x05b7
+#define RJ54N1_PEAK_50 0x05b8
+#define RJ54N1_PEAK_60 0x05b9
+#define RJ54N1_PEAK_DIFF   0x05ba
+#define RJ54N1_IOC 0x05ef
+#define RJ54N1_TG_BYPASS   0x0700
+#define RJ54N1_PLL_L   0x0701
+#define RJ54N1_PLL_N   0x0702
+#define RJ54N1_PLL_EN  0x0704
+#define RJ54N1_RATIO_TG0x0706
+#define RJ54N1_RATIO_T 0x0707
+#define RJ54N1_RATIO_R 0x0708
+#define RJ54N1_RAMP_TGCLK_EN   0x0709
+#define RJ54N1_OCLK_DSP0x0710
+#define RJ54N1_RATIO_OP0x0711
+#define RJ54N1_RATIO_O 0x0712
+#define RJ54N1_OCLK_SEL_EN 0x0713
+#define RJ54N1_CLK_RST 0x0717
+#define RJ54N1_RESET_STANDBY   0x0718
+#define RJ54N1_FWFLG   0x07fe
+
+#define E_EXCLK(1 << 7)
+#define SOFT_STDBY (1 << 4)
+#define SEN_RSTX   (1 << 2)
+#define TG_RSTX(1 << 1)
+#define DSP_RSTX   (1 << 0)
+
+#define RESIZE_HOLD_SEL(1 << 2)
+#define RESIZE_GO  (1 << 1)
+
+/*
+ * When cropping, the camera automatically centers the cropped region, there
+ * doesn't seem to be a way to specify an explicit location of the rectangle.
+ */
+#define RJ54N1_COLUMN_SKIP 0
+#define RJ54N1_ROW_SKIP0
+#define RJ54N1_MAX_WIDTH   1600
+#define RJ54N1_MAX_HEIGHT  1200
+
+#define PLL_L   

[PATCH 5/5] arch: sh: ap325rxa: Use new renesas-ceu camera driver

[Jacopo Mondi]

Use the new renesas-ceu camera driver in ap325rxa board file instead of
the soc_camera based sh_mobile_ceu_camera driver.

Get rid of soc_camera specific components, and register CEU0 with a single
video sensor (ov7725).

Memory for the CEU video buffers is now reserved with membocks APIs
and need to be declared as dma_coherent during machine initialization to
remove that architecture specific part from CEU driver.

The ap325rxa board file registers another camera (ncm03j) for which I found no
driver in mainline kernel version, and that was configured/probed by sending
i2c messages (of 'magic blobs) from the board file itself. I removed the
sensor registration from this new version as it used soc_camera components
that will be later removed.

While at there update license to SPDX header and sort headers alphabetically.

Compile tested only.

Signed-off-by: Jacopo Mondi 
---
 arch/sh/boards/mach-ap325rxa/setup.c   | 282 +
 arch/sh/kernel/cpu/sh4a/clock-sh7723.c |   2 +-
 2 files changed, 80 insertions(+), 204 deletions(-)

diff --git a/arch/sh/boards/mach-ap325rxa/setup.c 
b/arch/sh/boards/mach-ap325rxa/setup.c
index de8393c..8f234d04 100644
--- a/arch/sh/boards/mach-ap325rxa/setup.c
+++ b/arch/sh/boards/mach-ap325rxa/setup.c
@@ -1,40 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Renesas - AP-325RXA
  * (Compatible with Algo System ., LTD. - AP-320A)
  *
  * Copyright (C) 2008 Renesas Solutions Corp.
  * Author : Yusuke Goda 
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
  */
 
-#include 
+#include 
+#include 
+#include 
+
+#include 
+
+#include 
+#include 
 #include 
+#include 
+#include 
+#include 
+#include 
 #include 
-#include 
+#include 
+#include 
 #include 
 #include 
 #include 
-#include 
-#include 
-#include 
+#include 
 #include 
 #include 
+#include 
 #include 
-#include 
 #include 
-#include 
+
+#include 
 #include 
-#include 
-#include 
-#include 
+
 #include 
-#include 
-#include 
-#include 
-#include 
+
+#define CEU_BUFFER_MEMORY_SIZE (4 << 20)
+static phys_addr_t ceu_dma_membase;
 
 /* Dummy supplies, where voltage doesn't matter */
 static struct regulator_consumer_supply dummy_supplies[] = {
@@ -253,150 +258,25 @@ static struct platform_device lcdc_device = {
},
 };
 
-static void camera_power(int val)
-{
-   gpio_set_value(GPIO_PTZ5, val); /* RST_CAM/RSTB */
-   mdelay(10);
-}
-
-#ifdef CONFIG_I2C
-/* support for the old ncm03j camera */
-static unsigned char camera_ncm03j_magic[] =
-{
-   0x87, 0x00, 0x88, 0x08, 0x89, 0x01, 0x8A, 0xE8,
-   0x1D, 0x00, 0x1E, 0x8A, 0x21, 0x00, 0x33, 0x36,
-   0x36, 0x60, 0x37, 0x08, 0x3B, 0x31, 0x44, 0x0F,
-   0x46, 0xF0, 0x4B, 0x28, 0x4C, 0x21, 0x4D, 0x55,
-   0x4E, 0x1B, 0x4F, 0xC7, 0x50, 0xFC, 0x51, 0x12,
-   0x58, 0x02, 0x66, 0xC0, 0x67, 0x46, 0x6B, 0xA0,
-   0x6C, 0x34, 0x7E, 0x25, 0x7F, 0x25, 0x8D, 0x0F,
-   0x92, 0x40, 0x93, 0x04, 0x94, 0x26, 0x95, 0x0A,
-   0x99, 0x03, 0x9A, 0xF0, 0x9B, 0x14, 0x9D, 0x7A,
-   0xC5, 0x02, 0xD6, 0x07, 0x59, 0x00, 0x5A, 0x1A,
-   0x5B, 0x2A, 0x5C, 0x37, 0x5D, 0x42, 0x5E, 0x56,
-   0xC8, 0x00, 0xC9, 0x1A, 0xCA, 0x2A, 0xCB, 0x37,
-   0xCC, 0x42, 0xCD, 0x56, 0xCE, 0x00, 0xCF, 0x1A,
-   0xD0, 0x2A, 0xD1, 0x37, 0xD2, 0x42, 0xD3, 0x56,
-   0x5F, 0x68, 0x60, 0x87, 0x61, 0xA3, 0x62, 0xBC,
-   0x63, 0xD4, 0x64, 0xEA, 0xD6, 0x0F,
-};
-
-static int camera_probe(void)
-{
-   struct i2c_adapter *a = i2c_get_adapter(0);
-   struct i2c_msg msg;
-   int ret;
-
-   if (!a)
-   return -ENODEV;
-
-   camera_power(1);
-   msg.addr = 0x6e;
-   msg.buf = camera_ncm03j_magic;
-   msg.len = 2;
-   msg.flags = 0;
-   ret = i2c_transfer(a, , 1);
-   camera_power(0);
-
-   return ret;
-}
-
-static int camera_set_capture(struct soc_camera_platform_info *info,
- int enable)
-{
-   struct i2c_adapter *a = i2c_get_adapter(0);
-   struct i2c_msg msg;
-   int ret = 0;
-   int i;
-
-   camera_power(0);
-   if (!enable)
-   return 0; /* no disable for now */
-
-   camera_power(1);
-   for (i = 0; i < ARRAY_SIZE(camera_ncm03j_magic); i += 2) {
-   u_int8_t buf[8];
-
-   msg.addr = 0x6e;
-   msg.buf = buf;
-   msg.len = 2;
-   msg.flags = 0;
-
-   buf[0] = camera_ncm03j_magic[i];
-   buf[1] = camera_ncm03j_magic[i + 1];
-
-   ret = (ret < 0) ? ret : i2c_transfer(a, , 1);
-   }
-
-   return ret;
-}
-
-static int ap325rxa_camera_add(struct soc_camera_device *icd);
-static void ap325rxa_camera_del(struct soc_camera_device *icd);
-
-static struct soc_camera_platform_info camera_info = {
-   .format_name = "UYVY",
-   .format_depth = 16,
-   .format = {
-

Re: [PATCH] HID: rmi: use HID_QUIRK_NO_INPUT_SYNC

[Benjamin Tissoires]

On Fri, May 25, 2018 at 2:51 PM, Benjamin Tissoires
 wrote:
> When we receive a RMI4 report, we should not unconditionally send an
> input_sync event. Instead, we should let the rmi4 transport layer do it
> for us.
>
> This fixes a situation where we might receive X in a report and the rest
> in a subsequent one. And this messes up user space.
>
> Link: https://bugs.freedesktop.org/show_bug.cgi?id=100436
>
> Signed-off-by: Benjamin Tissoires 
> ---
>
> Hi,
>
> Oscar, do you mind if we add your "Tested-by: Oscar Morante "?

As mentioned in comment 25 of the bug above
(https://bugs.freedesktop.org/show_bug.cgi?id=100436#c25), oscar is
fine adding his tested-by line.

Cheers,
Benjamin

>
> Andrew, can you check for any sides effects please?
>
> Cheers,
> Benjamin
>
>  drivers/hid/hid-rmi.c | 20 
>  1 file changed, 20 insertions(+)
>
> diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
> index 9c9362149641..9e33165250a3 100644
> --- a/drivers/hid/hid-rmi.c
> +++ b/drivers/hid/hid-rmi.c
> @@ -413,6 +413,24 @@ static int rmi_event(struct hid_device *hdev, struct 
> hid_field *field,
> return 0;
>  }
>
> +static void rmi_report(struct hid_device *hid, struct hid_report *report)
> +{
> +   struct hid_field *field = report->field[0];
> +
> +   if (!(hid->claimed & HID_CLAIMED_INPUT))
> +   return;
> +
> +   switch (report->id) {
> +   case RMI_READ_DATA_REPORT_ID:
> +   /* fall-through */
> +   case RMI_ATTN_REPORT_ID:
> +   return;
> +   }
> +
> +   if (field && field->hidinput && field->hidinput->input)
> +   input_sync(field->hidinput->input);
> +}
> +
>  #ifdef CONFIG_PM
>  static int rmi_suspend(struct hid_device *hdev, pm_message_t message)
>  {
> @@ -637,6 +655,7 @@ static int rmi_probe(struct hid_device *hdev, const 
> struct hid_device_id *id)
> hid_set_drvdata(hdev, data);
>
> hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
> +   hdev->quirks |= HID_QUIRK_NO_INPUT_SYNC;
>
> ret = hid_parse(hdev);
> if (ret) {
> @@ -744,6 +763,7 @@ static struct hid_driver rmi_driver = {
> .remove = rmi_remove,
> .event  = rmi_event,
> .raw_event  = rmi_raw_event,
> +   .report = rmi_report,
> .input_mapping  = rmi_input_mapping,
> .input_configured   = rmi_input_configured,
>  #ifdef CONFIG_PM
> --
> 2.14.3
>

[PATCH 1/5] media: i2c: Copy rj54n1cb0c soc_camera sensor driver

[Jacopo Mondi]

Copy the soc_camera based driver in v4l2 sensor driver directory.
This commit just copies the original file without modifying it.
No modification to KConfig and Makefile as soc_camera framework
dependencies need to be removed first in next commit.

Signed-off-by: Jacopo Mondi 
---
 drivers/media/i2c/rj54n1cb0c.c | 1416 
 1 file changed, 1416 insertions(+)
 create mode 100644 drivers/media/i2c/rj54n1cb0c.c

diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
new file mode 100644
index 000..02398d0
--- /dev/null
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -0,0 +1,1416 @@
+/*
+ * Driver for RJ54N1CB0C CMOS Image Sensor from Sharp
+ *
+ * Copyright (C) 2009, Guennadi Liakhovetski 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#define RJ54N1_DEV_CODE0x0400
+#define RJ54N1_DEV_CODE2   0x0401
+#define RJ54N1_OUT_SEL 0x0403
+#define RJ54N1_XY_OUTPUT_SIZE_S_H  0x0404
+#define RJ54N1_X_OUTPUT_SIZE_S_L   0x0405
+#define RJ54N1_Y_OUTPUT_SIZE_S_L   0x0406
+#define RJ54N1_XY_OUTPUT_SIZE_P_H  0x0407
+#define RJ54N1_X_OUTPUT_SIZE_P_L   0x0408
+#define RJ54N1_Y_OUTPUT_SIZE_P_L   0x0409
+#define RJ54N1_LINE_LENGTH_PCK_S_H 0x040a
+#define RJ54N1_LINE_LENGTH_PCK_S_L 0x040b
+#define RJ54N1_LINE_LENGTH_PCK_P_H 0x040c
+#define RJ54N1_LINE_LENGTH_PCK_P_L 0x040d
+#define RJ54N1_RESIZE_N0x040e
+#define RJ54N1_RESIZE_N_STEP   0x040f
+#define RJ54N1_RESIZE_STEP 0x0410
+#define RJ54N1_RESIZE_HOLD_H   0x0411
+#define RJ54N1_RESIZE_HOLD_L   0x0412
+#define RJ54N1_H_OBEN_OFS  0x0413
+#define RJ54N1_V_OBEN_OFS  0x0414
+#define RJ54N1_RESIZE_CONTROL  0x0415
+#define RJ54N1_STILL_CONTROL   0x0417
+#define RJ54N1_INC_USE_SEL_H   0x0425
+#define RJ54N1_INC_USE_SEL_L   0x0426
+#define RJ54N1_MIRROR_STILL_MODE   0x0427
+#define RJ54N1_INIT_START  0x0428
+#define RJ54N1_SCALE_1_2_LEV   0x0429
+#define RJ54N1_SCALE_4_LEV 0x042a
+#define RJ54N1_Y_GAIN  0x04d8
+#define RJ54N1_APT_GAIN_UP 0x04fa
+#define RJ54N1_RA_SEL_UL   0x0530
+#define RJ54N1_BYTE_SWAP   0x0531
+#define RJ54N1_OUT_SIGPO   0x053b
+#define RJ54N1_WB_SEL_WEIGHT_I 0x054e
+#define RJ54N1_BIT8_WB 0x0569
+#define RJ54N1_HCAPS_WB0x056a
+#define RJ54N1_VCAPS_WB0x056b
+#define RJ54N1_HCAPE_WB0x056c
+#define RJ54N1_VCAPE_WB0x056d
+#define RJ54N1_EXPOSURE_CONTROL0x058c
+#define RJ54N1_FRAME_LENGTH_S_H0x0595
+#define RJ54N1_FRAME_LENGTH_S_L0x0596
+#define RJ54N1_FRAME_LENGTH_P_H0x0597
+#define RJ54N1_FRAME_LENGTH_P_L0x0598
+#define RJ54N1_PEAK_H  0x05b7
+#define RJ54N1_PEAK_50 0x05b8
+#define RJ54N1_PEAK_60 0x05b9
+#define RJ54N1_PEAK_DIFF   0x05ba
+#define RJ54N1_IOC 0x05ef
+#define RJ54N1_TG_BYPASS   0x0700
+#define RJ54N1_PLL_L   0x0701
+#define RJ54N1_PLL_N   0x0702
+#define RJ54N1_PLL_EN  0x0704
+#define RJ54N1_RATIO_TG0x0706
+#define RJ54N1_RATIO_T 0x0707
+#define RJ54N1_RATIO_R 0x0708
+#define RJ54N1_RAMP_TGCLK_EN   0x0709
+#define RJ54N1_OCLK_DSP0x0710
+#define RJ54N1_RATIO_OP0x0711
+#define RJ54N1_RATIO_O 0x0712
+#define RJ54N1_OCLK_SEL_EN 0x0713
+#define RJ54N1_CLK_RST 0x0717
+#define RJ54N1_RESET_STANDBY   0x0718
+#define RJ54N1_FWFLG   0x07fe
+
+#define E_EXCLK(1 << 7)
+#define SOFT_STDBY (1 << 4)
+#define SEN_RSTX   (1 << 2)
+#define TG_RSTX(1 << 1)
+#define DSP_RSTX   (1 << 0)
+
+#define RESIZE_HOLD_SEL(1 << 2)
+#define RESIZE_GO  (1 << 1)
+
+/*
+ * When cropping, the camera automatically centers the cropped region, there
+ * doesn't seem to be a way to specify an explicit location of the rectangle.
+ */
+#define RJ54N1_COLUMN_SKIP 0
+#define RJ54N1_ROW_SKIP0
+#define RJ54N1_MAX_WIDTH   1600
+#define RJ54N1_MAX_HEIGHT  1200
+
+#define PLL_L  2
+#define PLL_N   

[PATCH 2/5] media: i2c: rj54n1: Remove soc_camera dependencies

[Jacopo Mondi]

Remove soc_camera framework dependencies from rj54n1 sensor driver.
- Handle clock
- Handle GPIOs (named 'powerup' and 'enable')
- Register the async subdevice
- Remove g/s_mbus_config as they're deprecated.
- Adjust build system
- List the driver as maintained for 'Odd Fixes' as I don't have HW to test.

This commits does not remove the original soc_camera based driver.

Compiled tested only.

Signed-off-by: Jacopo Mondi 
---
 MAINTAINERS|   8 +++
 drivers/media/i2c/Kconfig  |  11 +++
 drivers/media/i2c/Makefile |   1 +
 drivers/media/i2c/rj54n1cb0c.c | 153 +++--
 4 files changed, 107 insertions(+), 66 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index cbcd5ab..0dd7532 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -12680,6 +12680,14 @@ W: 
http://www.ibm.com/developerworks/linux/linux390/
 S: Supported
 F: net/smc/
 
+SHARP RJ54N1CB0C SENSOR DRIVER
+M: Jacopo Mondi 
+L: linux-me...@vger.kernel.org
+T: git git://linuxtv.org/media_tree.git
+S: Odd fixes
+F: drivers/media/i2c/rj54n1cb0c.c
+F: include/media/i2c/rj54n1cb0c.h
+
 SH_VEU V4L2 MEM2MEM DRIVER
 L: linux-me...@vger.kernel.org
 S: Orphan
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index b95b447..7b5a224 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -846,6 +846,17 @@ config VIDEO_NOON010PC30
 
 source "drivers/media/i2c/m5mols/Kconfig"
 
+config VIDEO_RJ54N1
+   tristate "Sharp RJ54N1CB0C sensor support"
+   depends on I2C && VIDEO_V4L2
+   depends on MEDIA_CAMERA_SUPPORT
+   help
+ This is a V4L2 sensor-level driver for Sharp RJ54N1CB0C CMOS image
+ sensor.
+
+ To compile this driver as a module, choose M here: the
+ module will be called rj54n1.
+
 config VIDEO_S5K6AA
tristate "Samsung S5K6AAFX sensor support"
depends on MEDIA_CAMERA_SUPPORT
diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
index ff6e291..3f9c1f7 100644
--- a/drivers/media/i2c/Makefile
+++ b/drivers/media/i2c/Makefile
@@ -86,6 +86,7 @@ obj-$(CONFIG_VIDEO_MT9V011) += mt9v011.o
 obj-$(CONFIG_VIDEO_MT9V032) += mt9v032.o
 obj-$(CONFIG_VIDEO_SR030PC30)  += sr030pc30.o
 obj-$(CONFIG_VIDEO_NOON010PC30)+= noon010pc30.o
+obj-$(CONFIG_VIDEO_RJ54N1) += rj54n1cb0c.o
 obj-$(CONFIG_VIDEO_S5K6AA) += s5k6aa.o
 obj-$(CONFIG_VIDEO_S5K6A3) += s5k6a3.o
 obj-$(CONFIG_VIDEO_S5K4ECGX)   += s5k4ecgx.o
diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
index 02398d0..6ad998a 100644
--- a/drivers/media/i2c/rj54n1cb0c.c
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -1,25 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for RJ54N1CB0C CMOS Image Sensor from Sharp
  *
- * Copyright (C) 2009, Guennadi Liakhovetski 
+ * Copyright (C) 2018, Jacopo Mondi 
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
+ * Copyright (C) 2009, Guennadi Liakhovetski 
  */
 
+#include 
 #include 
+#include 
 #include 
+#include 
 #include 
 #include 
 #include 
-#include 
 
 #include 
-#include 
-#include 
-#include 
+#include 
 #include 
+#include 
 
 #define RJ54N1_DEV_CODE0x0400
 #define RJ54N1_DEV_CODE2   0x0401
@@ -151,7 +151,9 @@ struct rj54n1_clock_div {
 struct rj54n1 {
struct v4l2_subdev subdev;
struct v4l2_ctrl_handler hdl;
-   struct v4l2_clk *clk;
+   struct clk *clk;
+   struct gpio_desc *pwup_gpio;
+   struct gpio_desc *enable_gpio;
struct rj54n1_clock_div clk_div;
const struct rj54n1_datafmt *fmt;
struct v4l2_rect rect;  /* Sensor window */
@@ -545,8 +547,7 @@ static int rj54n1_set_selection(struct v4l2_subdev *sd,
struct i2c_client *client = v4l2_get_subdevdata(sd);
struct rj54n1 *rj54n1 = to_rj54n1(client);
const struct v4l2_rect *rect = >r;
-   int dummy = 0, output_w, output_h,
-   input_w = rect->width, input_h = rect->height;
+   int output_w, output_h, input_w = rect->width, input_h = rect->height;
int ret;
 
if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE ||
@@ -554,11 +555,8 @@ static int rj54n1_set_selection(struct v4l2_subdev *sd,
return -EINVAL;
 
/* arbitrary minimum width and height, edges unimportant */
-   soc_camera_limit_side(, _w,
-RJ54N1_COLUMN_SKIP, 8, RJ54N1_MAX_WIDTH);
-
-   soc_camera_limit_side(, _h,
-RJ54N1_ROW_SKIP, 8, RJ54N1_MAX_HEIGHT);
+   v4l_bound_align_image(_w, 8, RJ54N1_MAX_WIDTH, 0,
+ _h, 8, RJ54N1_MAX_HEIGHT, 0, 0);
 
output_w = (input_w * 1024 + rj54n1->resize / 2) / 

[PATCH 2/5] media: i2c: rj54n1: Remove soc_camera dependencies

[Jacopo Mondi]

Remove soc_camera framework dependencies from rj54n1 sensor driver.
- Handle clock
- Handle GPIOs (named 'powerup' and 'enable')
- Register the async subdevice
- Remove g/s_mbus_config as they're deprecated.
- Adjust build system
- List the driver as maintained for 'Odd Fixes' as I don't have HW to test.

This commits does not remove the original soc_camera based driver.

Compiled tested only.

Signed-off-by: Jacopo Mondi 
---
 MAINTAINERS|   8 +++
 drivers/media/i2c/Kconfig  |  11 +++
 drivers/media/i2c/Makefile |   1 +
 drivers/media/i2c/rj54n1cb0c.c | 153 +++--
 4 files changed, 107 insertions(+), 66 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index cbcd5ab..0dd7532 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -12680,6 +12680,14 @@ W: 
http://www.ibm.com/developerworks/linux/linux390/
 S: Supported
 F: net/smc/
 
+SHARP RJ54N1CB0C SENSOR DRIVER
+M: Jacopo Mondi 
+L: linux-me...@vger.kernel.org
+T: git git://linuxtv.org/media_tree.git
+S: Odd fixes
+F: drivers/media/i2c/rj54n1cb0c.c
+F: include/media/i2c/rj54n1cb0c.h
+
 SH_VEU V4L2 MEM2MEM DRIVER
 L: linux-me...@vger.kernel.org
 S: Orphan
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index b95b447..7b5a224 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -846,6 +846,17 @@ config VIDEO_NOON010PC30
 
 source "drivers/media/i2c/m5mols/Kconfig"
 
+config VIDEO_RJ54N1
+   tristate "Sharp RJ54N1CB0C sensor support"
+   depends on I2C && VIDEO_V4L2
+   depends on MEDIA_CAMERA_SUPPORT
+   help
+ This is a V4L2 sensor-level driver for Sharp RJ54N1CB0C CMOS image
+ sensor.
+
+ To compile this driver as a module, choose M here: the
+ module will be called rj54n1.
+
 config VIDEO_S5K6AA
tristate "Samsung S5K6AAFX sensor support"
depends on MEDIA_CAMERA_SUPPORT
diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
index ff6e291..3f9c1f7 100644
--- a/drivers/media/i2c/Makefile
+++ b/drivers/media/i2c/Makefile
@@ -86,6 +86,7 @@ obj-$(CONFIG_VIDEO_MT9V011) += mt9v011.o
 obj-$(CONFIG_VIDEO_MT9V032) += mt9v032.o
 obj-$(CONFIG_VIDEO_SR030PC30)  += sr030pc30.o
 obj-$(CONFIG_VIDEO_NOON010PC30)+= noon010pc30.o
+obj-$(CONFIG_VIDEO_RJ54N1) += rj54n1cb0c.o
 obj-$(CONFIG_VIDEO_S5K6AA) += s5k6aa.o
 obj-$(CONFIG_VIDEO_S5K6A3) += s5k6a3.o
 obj-$(CONFIG_VIDEO_S5K4ECGX)   += s5k4ecgx.o
diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
index 02398d0..6ad998a 100644
--- a/drivers/media/i2c/rj54n1cb0c.c
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -1,25 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for RJ54N1CB0C CMOS Image Sensor from Sharp
  *
- * Copyright (C) 2009, Guennadi Liakhovetski 
+ * Copyright (C) 2018, Jacopo Mondi 
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
+ * Copyright (C) 2009, Guennadi Liakhovetski 
  */
 
+#include 
 #include 
+#include 
 #include 
+#include 
 #include 
 #include 
 #include 
-#include 
 
 #include 
-#include 
-#include 
-#include 
+#include 
 #include 
+#include 
 
 #define RJ54N1_DEV_CODE0x0400
 #define RJ54N1_DEV_CODE2   0x0401
@@ -151,7 +151,9 @@ struct rj54n1_clock_div {
 struct rj54n1 {
struct v4l2_subdev subdev;
struct v4l2_ctrl_handler hdl;
-   struct v4l2_clk *clk;
+   struct clk *clk;
+   struct gpio_desc *pwup_gpio;
+   struct gpio_desc *enable_gpio;
struct rj54n1_clock_div clk_div;
const struct rj54n1_datafmt *fmt;
struct v4l2_rect rect;  /* Sensor window */
@@ -545,8 +547,7 @@ static int rj54n1_set_selection(struct v4l2_subdev *sd,
struct i2c_client *client = v4l2_get_subdevdata(sd);
struct rj54n1 *rj54n1 = to_rj54n1(client);
const struct v4l2_rect *rect = >r;
-   int dummy = 0, output_w, output_h,
-   input_w = rect->width, input_h = rect->height;
+   int output_w, output_h, input_w = rect->width, input_h = rect->height;
int ret;
 
if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE ||
@@ -554,11 +555,8 @@ static int rj54n1_set_selection(struct v4l2_subdev *sd,
return -EINVAL;
 
/* arbitrary minimum width and height, edges unimportant */
-   soc_camera_limit_side(, _w,
-RJ54N1_COLUMN_SKIP, 8, RJ54N1_MAX_WIDTH);
-
-   soc_camera_limit_side(, _h,
-RJ54N1_ROW_SKIP, 8, RJ54N1_MAX_HEIGHT);
+   v4l_bound_align_image(_w, 8, RJ54N1_MAX_WIDTH, 0,
+ _h, 8, RJ54N1_MAX_HEIGHT, 0, 0);
 
output_w = (input_w * 1024 + rj54n1->resize / 2) / rj54n1->resize;
output_h = (input_h * 1024 + rj54n1->resize / 2) / rj54n1->resize;
@@ -618,6 +616,9 @@ static int 

[PATCH 3.18 059/185] mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

[ Upstream commit 651b9920d7a694ffb1f885aef2bbb068a25d9d66 ]

This ensures that mac80211 allocated management frames are properly
aligned, which makes copying them more efficient.
For instance, mt76 uses iowrite32_copy to copy beacon frames to beacon
template memory on the chip.
Misaligned 32-bit accesses cause CPU exceptions on MIPS and should be
avoided.

Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/net/mac80211.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3368,7 +3368,7 @@ static inline int ieee80211_sta_ps_trans
  * The TX headroom reserved by mac80211 for its own tx_status functions.
  * This is enough for the radiotap header.
  */
-#define IEEE80211_TX_STATUS_HEADROOM   14
+#define IEEE80211_TX_STATUS_HEADROOM   ALIGN(14, 4)
 
 /**
  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames

[PATCH 3.18 059/185] mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4

[Greg Kroah-Hartman]

3.18-stable review patch.  If anyone has any objections, please let me know.

--

From: Felix Fietkau 

[ Upstream commit 651b9920d7a694ffb1f885aef2bbb068a25d9d66 ]

This ensures that mac80211 allocated management frames are properly
aligned, which makes copying them more efficient.
For instance, mt76 uses iowrite32_copy to copy beacon frames to beacon
template memory on the chip.
Misaligned 32-bit accesses cause CPU exceptions on MIPS and should be
avoided.

Signed-off-by: Felix Fietkau 
Signed-off-by: Johannes Berg 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman 
---
 include/net/mac80211.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3368,7 +3368,7 @@ static inline int ieee80211_sta_ps_trans
  * The TX headroom reserved by mac80211 for its own tx_status functions.
  * This is enough for the radiotap header.
  */
-#define IEEE80211_TX_STATUS_HEADROOM   14
+#define IEEE80211_TX_STATUS_HEADROOM   ALIGN(14, 4)
 
 /**
  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames

Re: [PATCH v3 net-next 2/2] tcp: minor optimization around tcp_hdr() usage in tcp receive path

[Eric Dumazet]

On Mon, May 28, 2018 at 8:36 AM Yafang Shao  wrote:

> This is additional to the commit ea1627c20c34 ("tcp: minor optimizations
around tcp_hdr() usage").
> At this point, skb->data is same with tcp_hdr() as tcp header has not
> been pulled yet.

> Cc: Eric Dumazet 
> Signed-off-by: Yafang Shao 
> ---
>   net/ipv4/tcp_ipv4.c | 2 +-
>   net/ipv6/tcp_ipv6.c | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)

> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index adbdb50..d179386 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1486,7 +1486,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff
*skb)
>  sk->sk_rx_dst = NULL;
>  }
>  }
> -   tcp_rcv_established(sk, skb, tcp_hdr(skb));
> +   tcp_rcv_established(sk, skb, (const struct tcphdr
*)skb->data);
>  return 0;
>  }

> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 7d47c2b..1c633ff 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -1322,7 +1322,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct
sk_buff *skb)
>  }
>  }

> -   tcp_rcv_established(sk, skb, tcp_hdr(skb));
> +   tcp_rcv_established(sk, skb, (const struct tcphdr
*)skb->data);
>  if (opt_skb)
>  goto ipv6_pktoptions;
>  return 0;
> --
> 1.8.3.1


I would rather remove the third parameter of tcp_rcv_established() instead
of duplicating the cast.

Re: [PATCH v3 net-next 2/2] tcp: minor optimization around tcp_hdr() usage in tcp receive path

[Eric Dumazet]

On Mon, May 28, 2018 at 8:36 AM Yafang Shao  wrote:

> This is additional to the commit ea1627c20c34 ("tcp: minor optimizations
around tcp_hdr() usage").
> At this point, skb->data is same with tcp_hdr() as tcp header has not
> been pulled yet.

> Cc: Eric Dumazet 
> Signed-off-by: Yafang Shao 
> ---
>   net/ipv4/tcp_ipv4.c | 2 +-
>   net/ipv6/tcp_ipv6.c | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)

> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index adbdb50..d179386 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -1486,7 +1486,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff
*skb)
>  sk->sk_rx_dst = NULL;
>  }
>  }
> -   tcp_rcv_established(sk, skb, tcp_hdr(skb));
> +   tcp_rcv_established(sk, skb, (const struct tcphdr
*)skb->data);
>  return 0;
>  }

> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 7d47c2b..1c633ff 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -1322,7 +1322,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct
sk_buff *skb)
>  }
>  }

> -   tcp_rcv_established(sk, skb, tcp_hdr(skb));
> +   tcp_rcv_established(sk, skb, (const struct tcphdr
*)skb->data);
>  if (opt_skb)
>  goto ipv6_pktoptions;
>  return 0;
> --
> 1.8.3.1


I would rather remove the third parameter of tcp_rcv_established() instead
of duplicating the cast.