[REGRESSION][BISECTED] Boot stall related to drivers/pci/hotplug/acpiphp_glue.c

2018-09-16 Thread Peter Anemone
Dear kernel developers
I reported a bug at Bugzilla, but Greg Kroah-Hartman pointed me in
mailing lists. Here's my bug report:

Linux has been unbootable for me from 4.18 upwards. Even the fallback
image does not boot. This has not been fixed yet in 4.19-rc3. acpi=off
kernel parameter lets me boot 4.18.6 and 4.19-rc3.

I used git bisect to track down the first bad commit:
84c8b58ed3addf17d3beb2e5037b001ffa65c5ef

The commit is about:
"ACPI / hotplug / PCI: Don't scan bridges managed by native hotplug"
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=84c8b58ed3addf17d3beb2e5037b001ffa65c5ef

Linux 4.17 booted fine. Reverting commit
84c8b58ed3addf17d3beb2e5037b001ffa65c5ef makes 4.18 and 4.19-rc3
bootable again (without the acpi=off parameter).

Information about my system:
Model: HP 6730b laptop
CPU: Intel Core 2 Duo P8600
Boot manager: systemd-boot (UEFI)
More information of my system as attachments on the bug report at Bugzilla.

Link to the bug report:
https://bugzilla.kernel.org/show_bug.cgi?id=201127

Thanks for all the good work!
-Peter


[REGRESSION][BISECTED] Boot stall related to drivers/pci/hotplug/acpiphp_glue.c

2018-09-16 Thread Peter Anemone
Dear kernel developers
I reported a bug at Bugzilla, but Greg Kroah-Hartman pointed me in
mailing lists. Here's my bug report:

Linux has been unbootable for me from 4.18 upwards. Even the fallback
image does not boot. This has not been fixed yet in 4.19-rc3. acpi=off
kernel parameter lets me boot 4.18.6 and 4.19-rc3.

I used git bisect to track down the first bad commit:
84c8b58ed3addf17d3beb2e5037b001ffa65c5ef

The commit is about:
"ACPI / hotplug / PCI: Don't scan bridges managed by native hotplug"
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=84c8b58ed3addf17d3beb2e5037b001ffa65c5ef

Linux 4.17 booted fine. Reverting commit
84c8b58ed3addf17d3beb2e5037b001ffa65c5ef makes 4.18 and 4.19-rc3
bootable again (without the acpi=off parameter).

Information about my system:
Model: HP 6730b laptop
CPU: Intel Core 2 Duo P8600
Boot manager: systemd-boot (UEFI)
More information of my system as attachments on the bug report at Bugzilla.

Link to the bug report:
https://bugzilla.kernel.org/show_bug.cgi?id=201127

Thanks for all the good work!
-Peter


Re: [PATCH] arm64: dts: rockchip: add initial dts support for Rockpro64 board

2018-09-16 Thread Rob Herring
On Fri, Sep 14, 2018 at 05:39:09PM +0530, Akash Gajjar wrote:
> Rockpro64 board is a rockchip RK3399 based board from pine64.org.
> This commit adds initial device tree support for Rockpro64 board.
> 
> Signed-off-by: Akash Gajjar 
> ---
>  Documentation/devicetree/bindings/arm/rockchip.txt |   4 +
>  arch/arm64/boot/dts/rockchip/Makefile  |   1 +
>  arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts  | 770 
> +
>  3 files changed, 775 insertions(+)
>  create mode 100644 arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
> 
> diff --git a/Documentation/devicetree/bindings/arm/rockchip.txt 
> b/Documentation/devicetree/bindings/arm/rockchip.txt
> index acfd3c7..ac95183 100644
> --- a/Documentation/devicetree/bindings/arm/rockchip.txt
> +++ b/Documentation/devicetree/bindings/arm/rockchip.txt
> @@ -160,6 +160,10 @@ Rockchip platforms device tree bindings
>  Required root node properties:
>  - compatible = "pine64,rock64", "rockchip,rk3328";
>  
> +- Pine64 RockPro64 board:
> +Required root node properties:
> +- compatible = "pine64,rockpro64", "rockchip,rk3399";
> +
>  - Rockchip PX3 Evaluation board:
>  Required root node properties:
>- compatible = "rockchip,px3-evb", "rockchip,px3", "rockchip,rk3188";
> diff --git a/arch/arm64/boot/dts/rockchip/Makefile 
> b/arch/arm64/boot/dts/rockchip/Makefile
> index b0092d9..03d523a 100644
> --- a/arch/arm64/boot/dts/rockchip/Makefile
> +++ b/arch/arm64/boot/dts/rockchip/Makefile
> @@ -14,5 +14,6 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-firefly.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-gru-bob.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-gru-kevin.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-puma-haikou.dtb
> +dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-rockpro64.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-sapphire.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-sapphire-excavator.dtb
> diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts 
> b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
> new file mode 100644
> index 000..9e2d4d9
> --- /dev/null
> +++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
> @@ -0,0 +1,770 @@
> +// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
> +/*
> + * Copyright (c) 2017 Fuzhou Rockchip Electronics Co., Ltd.
> + */
> +
> +/dts-v1/;
> +#include 
> +#include 
> +#include "rk3399.dtsi"
> +#include "rk3399-opp.dtsi"
> +
> +/ {
> + model = "Pine64 RockPro64";
> + compatible = "pine64,rockpro64", "rockchip,rk3399";
> +
> + chosen {
> + stdout-path = "serial2:150n8";
> + };
> +
> + backlight: backlight {
> + compatible = "pwm-backlight";
> + enable-gpios = < RK_PB5 GPIO_ACTIVE_HIGH>;
> + pwms = < 0 25000 0>;
> + brightness-levels = <
> +   0   1   2   3   4   5   6   7
> +   8   9  10  11  12  13  14  15
> +  16  17  18  19  20  21  22  23

There's a binding now so you don't have to list every single entry.

Rob


Re: [PATCH] arm64: dts: rockchip: add initial dts support for Rockpro64 board

2018-09-16 Thread Rob Herring
On Fri, Sep 14, 2018 at 05:39:09PM +0530, Akash Gajjar wrote:
> Rockpro64 board is a rockchip RK3399 based board from pine64.org.
> This commit adds initial device tree support for Rockpro64 board.
> 
> Signed-off-by: Akash Gajjar 
> ---
>  Documentation/devicetree/bindings/arm/rockchip.txt |   4 +
>  arch/arm64/boot/dts/rockchip/Makefile  |   1 +
>  arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts  | 770 
> +
>  3 files changed, 775 insertions(+)
>  create mode 100644 arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
> 
> diff --git a/Documentation/devicetree/bindings/arm/rockchip.txt 
> b/Documentation/devicetree/bindings/arm/rockchip.txt
> index acfd3c7..ac95183 100644
> --- a/Documentation/devicetree/bindings/arm/rockchip.txt
> +++ b/Documentation/devicetree/bindings/arm/rockchip.txt
> @@ -160,6 +160,10 @@ Rockchip platforms device tree bindings
>  Required root node properties:
>  - compatible = "pine64,rock64", "rockchip,rk3328";
>  
> +- Pine64 RockPro64 board:
> +Required root node properties:
> +- compatible = "pine64,rockpro64", "rockchip,rk3399";
> +
>  - Rockchip PX3 Evaluation board:
>  Required root node properties:
>- compatible = "rockchip,px3-evb", "rockchip,px3", "rockchip,rk3188";
> diff --git a/arch/arm64/boot/dts/rockchip/Makefile 
> b/arch/arm64/boot/dts/rockchip/Makefile
> index b0092d9..03d523a 100644
> --- a/arch/arm64/boot/dts/rockchip/Makefile
> +++ b/arch/arm64/boot/dts/rockchip/Makefile
> @@ -14,5 +14,6 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-firefly.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-gru-bob.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-gru-kevin.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-puma-haikou.dtb
> +dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-rockpro64.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-sapphire.dtb
>  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-sapphire-excavator.dtb
> diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts 
> b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
> new file mode 100644
> index 000..9e2d4d9
> --- /dev/null
> +++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
> @@ -0,0 +1,770 @@
> +// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
> +/*
> + * Copyright (c) 2017 Fuzhou Rockchip Electronics Co., Ltd.
> + */
> +
> +/dts-v1/;
> +#include 
> +#include 
> +#include "rk3399.dtsi"
> +#include "rk3399-opp.dtsi"
> +
> +/ {
> + model = "Pine64 RockPro64";
> + compatible = "pine64,rockpro64", "rockchip,rk3399";
> +
> + chosen {
> + stdout-path = "serial2:150n8";
> + };
> +
> + backlight: backlight {
> + compatible = "pwm-backlight";
> + enable-gpios = < RK_PB5 GPIO_ACTIVE_HIGH>;
> + pwms = < 0 25000 0>;
> + brightness-levels = <
> +   0   1   2   3   4   5   6   7
> +   8   9  10  11  12  13  14  15
> +  16  17  18  19  20  21  22  23

There's a binding now so you don't have to list every single entry.

Rob


Re: [PATCH] MAINTAINERS: Add me as a keys/trusted maintainer

2018-09-16 Thread James Bottomley
On Sun, 2018-09-16 at 22:19 +0300, Jarkko Sakkinen wrote:
> On Thu, Sep 13, 2018 at 05:45:54PM +0100, David Howells wrote:
> > Jarkko Sakkinen  wrote:
> > 
> > > David, what do you think?
> > 
> > Which David?
> > 
> > I think you need to ask James and Mimi since they're the current
> > maintainers.
> > 
> > David
> 
> Right, of course, sorry!
> 
> James, Mimi?

Not having seen the email thread, I assume it's a patch to add Jarkko
as a Trusted Keys maintainer?  If so that's fine by me.

James



Re: [PATCH] MAINTAINERS: Add me as a keys/trusted maintainer

2018-09-16 Thread James Bottomley
On Sun, 2018-09-16 at 22:19 +0300, Jarkko Sakkinen wrote:
> On Thu, Sep 13, 2018 at 05:45:54PM +0100, David Howells wrote:
> > Jarkko Sakkinen  wrote:
> > 
> > > David, what do you think?
> > 
> > Which David?
> > 
> > I think you need to ask James and Mimi since they're the current
> > maintainers.
> > 
> > David
> 
> Right, of course, sorry!
> 
> James, Mimi?

Not having seen the email thread, I assume it's a patch to add Jarkko
as a Trusted Keys maintainer?  If so that's fine by me.

James



[PATCH mmc-next] mmc: sdhci: fix __sdhci_adma_write_desc

2018-09-16 Thread Jisheng Zhang
If hosts provides ops->adma_write_desc, we should not fall back to the
general sdhci_adma_write_desc().

Signed-off-by: Jisheng Zhang 
---

Hi Ulf, Adrian,

When I introduced .adma_write_desc, I made a mistake since v4 -- if the host
provide ops->adma_write_desc, we should just call it and don't fall back
to the general sdhci_adma_write_desc(). Before v4, the adma_write_desc return
int, since v4 there's no return value, so when I prepared the v4, I just
removed return, this is where the mistake is from. I dunno how to handle
this case, fold the patch into previous commit or apply it as a separate patch?

I'm very sorry for this. In fact, Adrian caught another similar bug during
review.

Sorry about the inconvenience,
Jisheng

 drivers/mmc/host/sdhci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 0dda6f4b6a24..99bdae53fa2e 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -649,8 +649,8 @@ static inline void __sdhci_adma_write_desc(struct 
sdhci_host *host,
 {
if (host->ops->adma_write_desc)
host->ops->adma_write_desc(host, desc, addr, len, cmd);
-
-   sdhci_adma_write_desc(host, desc, addr, len, cmd);
+   else
+   sdhci_adma_write_desc(host, desc, addr, len, cmd);
 }
 
 static void sdhci_adma_mark_end(void *desc)
-- 
2.19.0



[PATCH mmc-next] mmc: sdhci: fix __sdhci_adma_write_desc

2018-09-16 Thread Jisheng Zhang
If hosts provides ops->adma_write_desc, we should not fall back to the
general sdhci_adma_write_desc().

Signed-off-by: Jisheng Zhang 
---

Hi Ulf, Adrian,

When I introduced .adma_write_desc, I made a mistake since v4 -- if the host
provide ops->adma_write_desc, we should just call it and don't fall back
to the general sdhci_adma_write_desc(). Before v4, the adma_write_desc return
int, since v4 there's no return value, so when I prepared the v4, I just
removed return, this is where the mistake is from. I dunno how to handle
this case, fold the patch into previous commit or apply it as a separate patch?

I'm very sorry for this. In fact, Adrian caught another similar bug during
review.

Sorry about the inconvenience,
Jisheng

 drivers/mmc/host/sdhci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 0dda6f4b6a24..99bdae53fa2e 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -649,8 +649,8 @@ static inline void __sdhci_adma_write_desc(struct 
sdhci_host *host,
 {
if (host->ops->adma_write_desc)
host->ops->adma_write_desc(host, desc, addr, len, cmd);
-
-   sdhci_adma_write_desc(host, desc, addr, len, cmd);
+   else
+   sdhci_adma_write_desc(host, desc, addr, len, cmd);
 }
 
 static void sdhci_adma_mark_end(void *desc)
-- 
2.19.0



[PATCH RESEND] phy: phy-twl4030-usb: fix denied runtime access

2018-09-16 Thread Andreas Kemnade
When runtime is not enabled, pm_runtime_get_sync() returns -EACCESS,
the counter will be incremented but the resume callback not called,
so enumeration and charging will not start properly.
To avoid that happen, wait and try again later.

Practically this happens when the device is woken up from suspend by
plugging in usb.

Signed-off-by: Andreas Kemnade 
---
 drivers/phy/ti/phy-twl4030-usb.c | 9 +
 1 file changed, 9 insertions(+)

diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
index a44680d64f9b..1f3cf4e48383 100644
--- a/drivers/phy/ti/phy-twl4030-usb.c
+++ b/drivers/phy/ti/phy-twl4030-usb.c
@@ -552,6 +552,15 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
 
status = twl4030_usb_linkstat(twl);
 
+   /* we might get here too early when runtime is not ready yet
+* and we will get an EACCESS later, so try again later
+*/
+   if (!pm_runtime_enabled(twl->dev)) {
+   cancel_delayed_work(>id_workaround_work);
+   schedule_delayed_work(>id_workaround_work, HZ);
+   return IRQ_HANDLED;
+   }
+
mutex_lock(>lock);
if (status >= 0 && status != twl->linkstat) {
status_changed =
-- 
2.11.0



[PATCH RESEND] phy: phy-twl4030-usb: fix denied runtime access

2018-09-16 Thread Andreas Kemnade
When runtime is not enabled, pm_runtime_get_sync() returns -EACCESS,
the counter will be incremented but the resume callback not called,
so enumeration and charging will not start properly.
To avoid that happen, wait and try again later.

Practically this happens when the device is woken up from suspend by
plugging in usb.

Signed-off-by: Andreas Kemnade 
---
 drivers/phy/ti/phy-twl4030-usb.c | 9 +
 1 file changed, 9 insertions(+)

diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
index a44680d64f9b..1f3cf4e48383 100644
--- a/drivers/phy/ti/phy-twl4030-usb.c
+++ b/drivers/phy/ti/phy-twl4030-usb.c
@@ -552,6 +552,15 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
 
status = twl4030_usb_linkstat(twl);
 
+   /* we might get here too early when runtime is not ready yet
+* and we will get an EACCESS later, so try again later
+*/
+   if (!pm_runtime_enabled(twl->dev)) {
+   cancel_delayed_work(>id_workaround_work);
+   schedule_delayed_work(>id_workaround_work, HZ);
+   return IRQ_HANDLED;
+   }
+
mutex_lock(>lock);
if (status >= 0 && status != twl->linkstat) {
status_changed =
-- 
2.11.0



Re: [PATCH 0/9] psi: pressure stall information for CPU, memory, and IO v4

2018-09-16 Thread Daniel Drake
Hi Suren

On Fri, Sep 7, 2018 at 11:58 PM, Suren Baghdasaryan  wrote:
> Thanks for the new patchset! Backported to 4.9 and retested on ARMv8 8
> code system running Android. Signals behave as expected reacting to
> memory pressure, no jumps in "total" counters that would indicate an
> overflow/underflow issues. Nicely done!

Can you share your Linux v4.9 psi backport somewhere?

Thanks
Daniel


Re: [PATCH 0/9] psi: pressure stall information for CPU, memory, and IO v4

2018-09-16 Thread Daniel Drake
Hi Suren

On Fri, Sep 7, 2018 at 11:58 PM, Suren Baghdasaryan  wrote:
> Thanks for the new patchset! Backported to 4.9 and retested on ARMv8 8
> code system running Android. Signals behave as expected reacting to
> memory pressure, no jumps in "total" counters that would indicate an
> overflow/underflow issues. Nicely done!

Can you share your Linux v4.9 psi backport somewhere?

Thanks
Daniel


[PATCH RESEND] twl4030_charger: fix charging current out-of-bounds

2018-09-16 Thread Andreas Kemnade
the charging current uses unsigned int variables, if we step back
if the current is still low, we would run into negative which
means setting the target to a huge value.
Better add checks here.

Signed-off-by: Andreas Kemnade 
---
 drivers/power/supply/twl4030_charger.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/twl4030_charger.c 
b/drivers/power/supply/twl4030_charger.c
index b72838663872..c954b7234393 100644
--- a/drivers/power/supply/twl4030_charger.c
+++ b/drivers/power/supply/twl4030_charger.c
@@ -421,7 +421,8 @@ static void twl4030_current_worker(struct work_struct *data)
 
if (v < USB_MIN_VOLT) {
/* Back up and stop adjusting. */
-   bci->usb_cur -= USB_CUR_STEP;
+   if (bci->usb_cur >= USB_CUR_STEP)
+   bci->usb_cur -= USB_CUR_STEP;
bci->usb_cur_target = bci->usb_cur;
} else if (bci->usb_cur >= bci->usb_cur_target ||
   bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
-- 
2.11.0



[PATCH RESEND] twl4030_charger: fix charging current out-of-bounds

2018-09-16 Thread Andreas Kemnade
the charging current uses unsigned int variables, if we step back
if the current is still low, we would run into negative which
means setting the target to a huge value.
Better add checks here.

Signed-off-by: Andreas Kemnade 
---
 drivers/power/supply/twl4030_charger.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/twl4030_charger.c 
b/drivers/power/supply/twl4030_charger.c
index b72838663872..c954b7234393 100644
--- a/drivers/power/supply/twl4030_charger.c
+++ b/drivers/power/supply/twl4030_charger.c
@@ -421,7 +421,8 @@ static void twl4030_current_worker(struct work_struct *data)
 
if (v < USB_MIN_VOLT) {
/* Back up and stop adjusting. */
-   bci->usb_cur -= USB_CUR_STEP;
+   if (bci->usb_cur >= USB_CUR_STEP)
+   bci->usb_cur -= USB_CUR_STEP;
bci->usb_cur_target = bci->usb_cur;
} else if (bci->usb_cur >= bci->usb_cur_target ||
   bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
-- 
2.11.0



Re: [PATCH 4.18 082/197] block: dont warn for flush on read-only device

2018-09-16 Thread Greg Kroah-Hartman
On Sun, Sep 16, 2018 at 09:04:04PM -0700, Stefan Agner wrote:
> Hi Greg,
> 
> The follow up patch 8b2ded1c94c0 ("block: don't warn when doing fsync
> on read-only devices") should get applied too, since it correctly
> fixes what this patch tried to fix.

Already queueud up, thanks!

greg k-h


Re: [PATCH 4.18 082/197] block: dont warn for flush on read-only device

2018-09-16 Thread Greg Kroah-Hartman
On Sun, Sep 16, 2018 at 09:04:04PM -0700, Stefan Agner wrote:
> Hi Greg,
> 
> The follow up patch 8b2ded1c94c0 ("block: don't warn when doing fsync
> on read-only devices") should get applied too, since it correctly
> fixes what this patch tried to fix.

Already queueud up, thanks!

greg k-h


Re: [PATCH 2/2] tools: hv: fcopy: set 'error' in case an unknown operation was requested

2018-09-16 Thread Greg KH
On Mon, Sep 17, 2018 at 04:14:55AM +, k...@linuxonhyperv.com wrote:
> From: Vitaly Kuznetsov 
> 
> 'error' variable is left uninitialized in case we see an unknown operation.
> As we don't immediately return and proceed to pwrite() we need to set it
> to something, HV_E_FAIL sounds good enough.
> 
> Signed-off-by: Vitaly Kuznetsov 
> Signed-off-by: K. Y. Srinivasan 
> ---
>  tools/hv/hv_fcopy_daemon.c | 1 +
>  1 file changed, 1 insertion(+)

No need to backport for stable?



Re: [PATCH 2/2] tools: hv: fcopy: set 'error' in case an unknown operation was requested

2018-09-16 Thread Greg KH
On Mon, Sep 17, 2018 at 04:14:55AM +, k...@linuxonhyperv.com wrote:
> From: Vitaly Kuznetsov 
> 
> 'error' variable is left uninitialized in case we see an unknown operation.
> As we don't immediately return and proceed to pwrite() we need to set it
> to something, HV_E_FAIL sounds good enough.
> 
> Signed-off-by: Vitaly Kuznetsov 
> Signed-off-by: K. Y. Srinivasan 
> ---
>  tools/hv/hv_fcopy_daemon.c | 1 +
>  1 file changed, 1 insertion(+)

No need to backport for stable?



Re: [PATCH net-next v4 18/20] crypto: port ChaCha20 to Zinc

2018-09-16 Thread Jason A. Donenfeld
Hey Martin,

Thanks for running these and pointing this out. I've replicated the
results with tcrypt and fixed some issues, and the next patch series
should be a lot closer to what you'd expect, instead of the regression
you noticed. Most of the slowdown happened as a result of over-eager
XSAVEs, which I've now rectified. I'm still working on a few other
facets of it, but I believe v5 will be more satisfactory when posted.

Regards,
Jason


Re: [PATCH net-next v4 18/20] crypto: port ChaCha20 to Zinc

2018-09-16 Thread Jason A. Donenfeld
Hey Martin,

Thanks for running these and pointing this out. I've replicated the
results with tcrypt and fixed some issues, and the next patch series
should be a lot closer to what you'd expect, instead of the regression
you noticed. Most of the slowdown happened as a result of over-eager
XSAVEs, which I've now rectified. I'm still working on a few other
facets of it, but I believe v5 will be more satisfactory when posted.

Regards,
Jason


Re: [PATCH net-next v3 02/17] zinc: introduce minimal cryptography library

2018-09-16 Thread David Miller
From: Andy Lutomirski 
Date: Sun, 16 Sep 2018 21:09:11 -0700

> CRYPTO API
> M:  Herbert Xu 
> M:  "David S. Miller" 
> L:  linux-cry...@vger.kernel.org
> 
> Herbert hasn't replied to any of these submissions.  You're the other
> maintainer :)

Herbert is the primary crypto maintainer, I haven't done a serious
review of crypto code in ages.

So yes, Herbert review is what is important here.


Re: [PATCH net-next v3 02/17] zinc: introduce minimal cryptography library

2018-09-16 Thread David Miller
From: Andy Lutomirski 
Date: Sun, 16 Sep 2018 21:09:11 -0700

> CRYPTO API
> M:  Herbert Xu 
> M:  "David S. Miller" 
> L:  linux-cry...@vger.kernel.org
> 
> Herbert hasn't replied to any of these submissions.  You're the other
> maintainer :)

Herbert is the primary crypto maintainer, I haven't done a serious
review of crypto code in ages.

So yes, Herbert review is what is important here.


[GIT PULL] ext4 fixes for 4.19-rc5

2018-09-16 Thread Theodore Y. Ts'o
[ This pull request was originally intended for 4.19-rc4, but some
  testing hiccups delayed my sending this earlier.  Given Linus's
  comments, I'm not sure whether PULL requests should be going to Linus
  or Greg, so I'm sending it to both.  -- Ted ]

The following changes since commit 863c37fcb14f8b66ea831b45fb35a53ac4a8d69e:

  ext4: remove unneeded variable "err" in ext4_mb_release_inode_pa() 
(2018-08-04 17:34:07 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git 
tags/ext4_for_linus_stable

for you to fetch changes up to cce6c9f7e6029caee45c459db5b3e78fec6973cb:

  ext4, dax: set ext4_dax_aops for dax files (2018-09-15 21:37:59 -0400)


Various ext4 bug fixes; primarily making ext4 more robust against
maliciously crafted file systems, and some DAX fixes.


Eric Biggers (1):
  ext4: show test_dummy_encryption mount option in /proc/mounts

Li Dongyang (1):
  ext4: don't mark mmp buffer head dirty

Ross Zwisler (1):
  ext4: close race between direct IO and ext4_break_layouts()

Theodore Ts'o (7):
  ext4: add nonstring annotations to ext4.h
  ext4: check to make sure the rename(2)'s destination is not freed
  ext4: avoid divide by zero fault when deleting corrupted inline 
directories
  ext4: avoid arithemetic overflow that can trigger a BUG
  ext4: recalucate superblock checksum after updating free blocks/inodes
  ext4: fix online resize's handling of a too-small final block group
  ext4: fix online resizing for bigalloc file systems with a 1k block size

Toshi Kani (2):
  ext4, dax: add ext4_bmap to ext4_dax_aops
  ext4, dax: set ext4_dax_aops for dax files

 fs/ext4/dir.c| 20 +---
 fs/ext4/ext4.h   | 20 +---
 fs/ext4/inline.c |  4 +++-
 fs/ext4/inode.c  | 20 +++-
 fs/ext4/mmp.c|  1 -
 fs/ext4/namei.c  |  6 ++
 fs/ext4/resize.c | 23 ++-
 fs/ext4/super.c  |  4 
 8 files changed, 72 insertions(+), 26 deletions(-)


[GIT PULL] ext4 fixes for 4.19-rc5

2018-09-16 Thread Theodore Y. Ts'o
[ This pull request was originally intended for 4.19-rc4, but some
  testing hiccups delayed my sending this earlier.  Given Linus's
  comments, I'm not sure whether PULL requests should be going to Linus
  or Greg, so I'm sending it to both.  -- Ted ]

The following changes since commit 863c37fcb14f8b66ea831b45fb35a53ac4a8d69e:

  ext4: remove unneeded variable "err" in ext4_mb_release_inode_pa() 
(2018-08-04 17:34:07 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git 
tags/ext4_for_linus_stable

for you to fetch changes up to cce6c9f7e6029caee45c459db5b3e78fec6973cb:

  ext4, dax: set ext4_dax_aops for dax files (2018-09-15 21:37:59 -0400)


Various ext4 bug fixes; primarily making ext4 more robust against
maliciously crafted file systems, and some DAX fixes.


Eric Biggers (1):
  ext4: show test_dummy_encryption mount option in /proc/mounts

Li Dongyang (1):
  ext4: don't mark mmp buffer head dirty

Ross Zwisler (1):
  ext4: close race between direct IO and ext4_break_layouts()

Theodore Ts'o (7):
  ext4: add nonstring annotations to ext4.h
  ext4: check to make sure the rename(2)'s destination is not freed
  ext4: avoid divide by zero fault when deleting corrupted inline 
directories
  ext4: avoid arithemetic overflow that can trigger a BUG
  ext4: recalucate superblock checksum after updating free blocks/inodes
  ext4: fix online resize's handling of a too-small final block group
  ext4: fix online resizing for bigalloc file systems with a 1k block size

Toshi Kani (2):
  ext4, dax: add ext4_bmap to ext4_dax_aops
  ext4, dax: set ext4_dax_aops for dax files

 fs/ext4/dir.c| 20 +---
 fs/ext4/ext4.h   | 20 +---
 fs/ext4/inline.c |  4 +++-
 fs/ext4/inode.c  | 20 +++-
 fs/ext4/mmp.c|  1 -
 fs/ext4/namei.c  |  6 ++
 fs/ext4/resize.c | 23 ++-
 fs/ext4/super.c  |  4 
 8 files changed, 72 insertions(+), 26 deletions(-)


[PATCH v5 6/6] arm64/mm: Move {idmap_pg_dir .. swapper_pg_dir} to rodata section.

2018-09-16 Thread Jun Yao
Move the idmap_pg_dir/tramp_pg_dir/reserved_ttbr0/swapper_pg_dir to
the rodata section. When the kernel is initialized, the
idmap_pg_dir, tramp_pg_dir and reserved_ttbr0 will not change. And
it's safe to move them to rodata section.

Signed-off-by: Jun Yao 
---
 arch/arm64/kernel/vmlinux.lds.S | 39 -
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index a634def77442..328925b308fc 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -64,8 +64,13 @@ jiffies = jiffies_64;
*(.entry.tramp.text)\
. = ALIGN(PAGE_SIZE);   \
__entry_tramp_text_end = .;
+
+#define TRAMP_PG_TABLE \
+   tramp_pg_dir = .;   \
+   . += PAGE_SIZE;
 #else
 #define TRAMP_TEXT
+#define TRAMP_PG_TABLE
 #endif
 
 #define INIT_PG_TABLES \
@@ -74,6 +79,24 @@ jiffies = jiffies_64;
. += SWAPPER_DIR_SIZE;  \
init_pg_end = .;
 
+#ifdef CONFIG_ARM64_SW_TTBR0_PAN
+#define RESERVED_PG_TABLE  \
+   reserved_ttbr0 = .; \
+   . += RESERVED_TTBR0_SIZE;
+#else
+#define RESERVED_PG_TABLE
+#endif
+
+#define KERNEL_PG_TABLES   \
+   . = ALIGN(PAGE_SIZE);   \
+   idmap_pg_dir = .;   \
+   . += IDMAP_DIR_SIZE;\
+   TRAMP_PG_TABLE  \
+   RESERVED_PG_TABLE   \
+   swapper_pg_dir = .; \
+   . += PAGE_SIZE; \
+   swapper_pg_end = .;
+
 /*
  * The size of the PE/COFF section that covers the kernel image, which
  * runs from stext to _edata, must be a round multiple of the PE/COFF
@@ -143,6 +166,7 @@ SECTIONS
RO_DATA(PAGE_SIZE)  /* everything from this point to */
EXCEPTION_TABLE(8)  /* __init_begin will be marked RO NX */
NOTES
+   KERNEL_PG_TABLES
 
. = ALIGN(SEGMENT_ALIGN);
__init_begin = .;
@@ -224,21 +248,6 @@ SECTIONS
BSS_SECTION(0, 0, 0)
 
. = ALIGN(PAGE_SIZE);
-   idmap_pg_dir = .;
-   . += IDMAP_DIR_SIZE;
-
-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
-   tramp_pg_dir = .;
-   . += PAGE_SIZE;
-#endif
-
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
-   reserved_ttbr0 = .;
-   . += RESERVED_TTBR0_SIZE;
-#endif
-   swapper_pg_dir = .;
-   . += PAGE_SIZE;
-   swapper_pg_end = .;
 
__pecoff_data_size = ABSOLUTE(. - __initdata_begin);
_end = .;
-- 
2.17.1



[PATCH v5 6/6] arm64/mm: Move {idmap_pg_dir .. swapper_pg_dir} to rodata section.

2018-09-16 Thread Jun Yao
Move the idmap_pg_dir/tramp_pg_dir/reserved_ttbr0/swapper_pg_dir to
the rodata section. When the kernel is initialized, the
idmap_pg_dir, tramp_pg_dir and reserved_ttbr0 will not change. And
it's safe to move them to rodata section.

Signed-off-by: Jun Yao 
---
 arch/arm64/kernel/vmlinux.lds.S | 39 -
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index a634def77442..328925b308fc 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -64,8 +64,13 @@ jiffies = jiffies_64;
*(.entry.tramp.text)\
. = ALIGN(PAGE_SIZE);   \
__entry_tramp_text_end = .;
+
+#define TRAMP_PG_TABLE \
+   tramp_pg_dir = .;   \
+   . += PAGE_SIZE;
 #else
 #define TRAMP_TEXT
+#define TRAMP_PG_TABLE
 #endif
 
 #define INIT_PG_TABLES \
@@ -74,6 +79,24 @@ jiffies = jiffies_64;
. += SWAPPER_DIR_SIZE;  \
init_pg_end = .;
 
+#ifdef CONFIG_ARM64_SW_TTBR0_PAN
+#define RESERVED_PG_TABLE  \
+   reserved_ttbr0 = .; \
+   . += RESERVED_TTBR0_SIZE;
+#else
+#define RESERVED_PG_TABLE
+#endif
+
+#define KERNEL_PG_TABLES   \
+   . = ALIGN(PAGE_SIZE);   \
+   idmap_pg_dir = .;   \
+   . += IDMAP_DIR_SIZE;\
+   TRAMP_PG_TABLE  \
+   RESERVED_PG_TABLE   \
+   swapper_pg_dir = .; \
+   . += PAGE_SIZE; \
+   swapper_pg_end = .;
+
 /*
  * The size of the PE/COFF section that covers the kernel image, which
  * runs from stext to _edata, must be a round multiple of the PE/COFF
@@ -143,6 +166,7 @@ SECTIONS
RO_DATA(PAGE_SIZE)  /* everything from this point to */
EXCEPTION_TABLE(8)  /* __init_begin will be marked RO NX */
NOTES
+   KERNEL_PG_TABLES
 
. = ALIGN(SEGMENT_ALIGN);
__init_begin = .;
@@ -224,21 +248,6 @@ SECTIONS
BSS_SECTION(0, 0, 0)
 
. = ALIGN(PAGE_SIZE);
-   idmap_pg_dir = .;
-   . += IDMAP_DIR_SIZE;
-
-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
-   tramp_pg_dir = .;
-   . += PAGE_SIZE;
-#endif
-
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
-   reserved_ttbr0 = .;
-   . += RESERVED_TTBR0_SIZE;
-#endif
-   swapper_pg_dir = .;
-   . += PAGE_SIZE;
-   swapper_pg_end = .;
 
__pecoff_data_size = ABSOLUTE(. - __initdata_begin);
_end = .;
-- 
2.17.1



[PATCH v5 4/6] arm64/mm: Create the final page table directly in swapper_pg_dir.

2018-09-16 Thread Jun Yao
As the initial page table is created in the init_pg_dir, we can set
up the final page table directly in the swapper_pg_dir. And it only
contains the top level page table, so we can reduce it to a page
size.

Signed-off-by: Jun Yao 
---
 arch/arm64/kernel/vmlinux.lds.S |  2 +-
 arch/arm64/mm/mmu.c | 29 ++---
 2 files changed, 3 insertions(+), 28 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 612ffc0bbe11..a634def77442 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -237,7 +237,7 @@ SECTIONS
. += RESERVED_TTBR0_SIZE;
 #endif
swapper_pg_dir = .;
-   . += SWAPPER_DIR_SIZE;
+   . += PAGE_SIZE;
swapper_pg_end = .;
 
__pecoff_data_size = ABSOLUTE(. - __initdata_begin);
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index af80dca335ce..71532bcd76c1 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -629,35 +629,10 @@ static void __init map_kernel(pgd_t *pgdp)
  */
 void __init paging_init(void)
 {
-   phys_addr_t pgd_phys = early_pgtable_alloc();
-   pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
-
-   map_kernel(pgdp);
-   map_mem(pgdp);
-
-   /*
-* We want to reuse the original swapper_pg_dir so we don't have to
-* communicate the new address to non-coherent secondaries in
-* secondary_entry, and so cpu_switch_mm can generate the address with
-* adrp+add rather than a load from some global variable.
-*
-* To do this we need to go via a temporary pgd.
-*/
-   cpu_replace_ttbr1(__va(pgd_phys));
-   memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
+   map_kernel(swapper_pg_dir);
+   map_mem(swapper_pg_dir);
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
init_mm.pgd = swapper_pg_dir;
-
-   pgd_clear_fixmap();
-   memblock_free(pgd_phys, PAGE_SIZE);
-
-   /*
-* We only reuse the PGD from the swapper_pg_dir, not the pud + pmd
-* allocated with it.
-*/
-   memblock_free(__pa_symbol(swapper_pg_dir) + PAGE_SIZE,
- __pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir)
- - PAGE_SIZE);
 }
 
 /*
-- 
2.17.1



[PATCH v5 1/6] arm64/mm: Introduce the init_pg_dir.

2018-09-16 Thread Jun Yao
To make the swapper_pg_dir read only, we will move it to the rodata
section. And force the kernel to set up the initial page table in
the init_pg_dir. After generating all levels page table, we copy
only the top level into the swapper_pg_dir during paging_init().

In this patch, just add the init_pg_dir to vmlinux.lds.S and
boiler-plate clearing/cleaning/invalidating it in head.S.

Signed-off-by: Jun Yao 
---
 arch/arm64/include/asm/assembler.h | 29 +
 arch/arm64/kernel/head.S   | 22 +++---
 arch/arm64/kernel/vmlinux.lds.S|  8 
 3 files changed, 52 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/include/asm/assembler.h 
b/arch/arm64/include/asm/assembler.h
index 0bcc98dbba56..e7bdc324d538 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -456,6 +456,35 @@ USER(\label, icivau, \tmp2)// 
invalidate I line PoU
b.ne9998b
.endm
 
+/*
+ * clear_page - clear one page
+ *
+ * start:  page aligned virtual address
+ */
+   .macro clear_page, start:req
+9996:  stp xzr, xzr, [\start], #16
+   stp xzr, xzr, [\start], #16
+   stp xzr, xzr, [\start], #16
+   stp xzr, xzr, [\start], #16
+   tst \start, #(PAGE_SIZE - 1)
+   b.ne9996b
+   .endm
+
+/*
+ * clear_pages - clear contiguous pages
+ *
+ * start, end: page aligned virtual addresses
+ */
+   .macro clear_pages, start:req, end:req
+   sub \end, \end, \start
+   lsr \end, \end, #(PAGE_SHIFT)
+9997:  cbz \end, 9998f
+   clear_page \start
+   sub \end, \end, #1
+   b   9997b
+9998:
+   .endm
+
 /*
  * Annotate a function as position independent, i.e., safe to be called before
  * the kernel virtual mapping is activated.
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index b0853069702f..2c83a8c47e3f 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -295,18 +295,21 @@ __create_page_tables:
sub x1, x1, x0
bl  __inval_dcache_area
 
+   adrpx0, init_pg_dir
+   adrpx1, init_pg_end
+   sub x1, x1, x0
+   bl  __inval_dcache_area
+
/*
 * Clear the idmap and swapper page tables.
 */
adrpx0, idmap_pg_dir
adrpx1, swapper_pg_end
-   sub x1, x1, x0
-1: stp xzr, xzr, [x0], #16
-   stp xzr, xzr, [x0], #16
-   stp xzr, xzr, [x0], #16
-   stp xzr, xzr, [x0], #16
-   subsx1, x1, #64
-   b.ne1b
+   clear_pages x0, x1
+
+   adrpx0, init_pg_dir
+   adrpx1, init_pg_end
+   clear_pages x0, x1
 
mov x7, SWAPPER_MM_MMUFLAGS
 
@@ -395,6 +398,11 @@ __create_page_tables:
dmb sy
bl  __inval_dcache_area
 
+   adrpx0, init_pg_dir
+   adrpx1, init_pg_end
+   sub x1, x1, x0
+   bl  __inval_dcache_area
+
ret x28
 ENDPROC(__create_page_tables)
.ltorg
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 605d1b60469c..612ffc0bbe11 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -68,6 +68,12 @@ jiffies = jiffies_64;
 #define TRAMP_TEXT
 #endif
 
+#define INIT_PG_TABLES \
+   . = ALIGN(PAGE_SIZE);   \
+   init_pg_dir = .;\
+   . += SWAPPER_DIR_SIZE;  \
+   init_pg_end = .;
+
 /*
  * The size of the PE/COFF section that covers the kernel image, which
  * runs from stext to _edata, must be a round multiple of the PE/COFF
@@ -161,6 +167,8 @@ SECTIONS
__inittext_end = .;
__initdata_begin = .;
 
+   INIT_PG_TABLES
+
.init.data : {
INIT_DATA
INIT_SETUP(16)
-- 
2.17.1



[PATCH v5 2/6] arm64/mm: Pass ttbr1 as a parameter to __enable_mmu().

2018-09-16 Thread Jun Yao
The kernel will set up the initial page table in the init_pg_dir.
However, it will create the final page table in the swapper_pg_dir
during the initialization process. We need to let __enable_mmu()
know which page table to use.

Signed-off-by: Jun Yao 
---
 arch/arm64/kernel/head.S  | 19 +++
 arch/arm64/kernel/sleep.S |  1 +
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 2c83a8c47e3f..de2aaea00bd2 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -714,6 +714,7 @@ secondary_startup:
 * Common entry point for secondary CPUs.
 */
bl  __cpu_setup // initialise processor
+   adrpx1, swapper_pg_dir
bl  __enable_mmu
ldr x8, =__secondary_switched
br  x8
@@ -756,6 +757,7 @@ ENDPROC(__secondary_switched)
  * Enable the MMU.
  *
  *  x0  = SCTLR_EL1 value for turning on the MMU.
+ *  x1  = TTBR1_EL1 value for turning on the MMU.
  *
  * Returns to the caller via x30/lr. This requires the caller to be covered
  * by the .idmap.text section.
@@ -764,15 +766,15 @@ ENDPROC(__secondary_switched)
  * If it isn't, park the CPU
  */
 ENTRY(__enable_mmu)
-   mrs x1, ID_AA64MMFR0_EL1
-   ubfxx2, x1, #ID_AA64MMFR0_TGRAN_SHIFT, 4
-   cmp x2, #ID_AA64MMFR0_TGRAN_SUPPORTED
+   mrs x5, ID_AA64MMFR0_EL1
+   ubfxx6, x5, #ID_AA64MMFR0_TGRAN_SHIFT, 4
+   cmp x6, #ID_AA64MMFR0_TGRAN_SUPPORTED
b.ne__no_granule_support
-   update_early_cpu_boot_status 0, x1, x2
-   adrpx1, idmap_pg_dir
-   adrpx2, swapper_pg_dir
-   phys_to_ttbr x3, x1
-   phys_to_ttbr x4, x2
+   update_early_cpu_boot_status 0, x5, x6
+   adrpx5, idmap_pg_dir
+   mov x6, x1
+   phys_to_ttbr x3, x5
+   phys_to_ttbr x4, x6
msr ttbr0_el1, x3   // load TTBR0
msr ttbr1_el1, x4   // load TTBR1
isb
@@ -831,6 +833,7 @@ __primary_switch:
mrs x20, sctlr_el1  // preserve old SCTLR_EL1 value
 #endif
 
+   adrpx1, swapper_pg_dir
bl  __enable_mmu
 #ifdef CONFIG_RELOCATABLE
bl  __relocate_kernel
diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
index bebec8ef9372..3e53ffa07994 100644
--- a/arch/arm64/kernel/sleep.S
+++ b/arch/arm64/kernel/sleep.S
@@ -101,6 +101,7 @@ ENTRY(cpu_resume)
bl  el2_setup   // if in EL2 drop to EL1 cleanly
bl  __cpu_setup
/* enable the MMU early - so we can access sleep_save_stash by va */
+   adrpx1, swapper_pg_dir
bl  __enable_mmu
ldr x8, =_cpu_resume
br  x8
-- 
2.17.1



[PATCH v5 0/6] Move swapper_pg_dir to rodata section.

2018-09-16 Thread Jun Yao
Version 5 changes:
1. Correct spelling and indentation errors[1].
2. Update init_mm.pgd by assembly[2].
3. Simplify set_p?d() by introducing set_swapper_pgd()[3].
4. Reduce unnecessary tlbi for every write to swapper_pg_dir
   during paging_init()[3].

v4: https://www.spinics.net/lists/arm-kernel/msg672195.html
v3: https://www.spinics.net/lists/arm-kernel/msg662537.html
v2: https://patchwork.kernel.org/patch/10485641/
v1: https://patchwork.kernel.org/patch/10476595/

[1] https://www.spinics.net/lists/arm-kernel/msg675189.html
[2] https://www.spinics.net/lists/arm-kernel/msg675193.html
[3] https://www.spinics.net/lists/arm-kernel/msg675196.html

Jun Yao (6):
  arm64/mm: Introduce the init_pg_dir.
  arm64/mm: Pass ttbr1 as a parameter to __enable_mmu().
  arm64/mm: Create the initial page table in the init_pg_dir.
  arm64/mm: Create the final page table directly in swapper_pg_dir.
  arm64/mm: Populate the swapper_pg_dir by fixmap.
  arm64/mm: Move {idmap_pg_dir .. swapper_pg_dir} to rodata section.

 arch/arm64/include/asm/assembler.h | 29 ++
 arch/arm64/include/asm/pgtable.h   | 36 ++
 arch/arm64/kernel/asm-offsets.c|  1 +
 arch/arm64/kernel/head.S   | 48 --
 arch/arm64/kernel/sleep.S  |  1 +
 arch/arm64/kernel/vmlinux.lds.S| 47 +++--
 arch/arm64/mm/mmu.c| 45 +---
 7 files changed, 147 insertions(+), 60 deletions(-)

-- 
2.17.1



[PATCH v5 5/6] arm64/mm: Populate the swapper_pg_dir by fixmap.

2018-09-16 Thread Jun Yao
Since we will move the swapper_pg_dir to rodata section, we need a
way to update it. The fixmap can handle it. When the swapper_pg_dir
needs to be updated, we map it dynamically. The map will be
canceled after the update is complete. In this way, we can defend
against KSMA(Kernel Space Mirror Attack).

Signed-off-by: Jun Yao 
---
 arch/arm64/include/asm/pgtable.h | 38 ++--
 arch/arm64/mm/mmu.c  | 25 +++--
 2 files changed, 54 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index b11d6fc62a62..9e643fc2453d 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -429,8 +429,29 @@ extern pgprot_t phys_mem_access_prot(struct file *file, 
unsigned long pfn,
 PUD_TYPE_TABLE)
 #endif
 
+extern pgd_t init_pg_dir[PTRS_PER_PGD];
+extern pgd_t init_pg_end[];
+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
+extern pgd_t swapper_pg_end[];
+extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
+extern pgd_t tramp_pg_dir[PTRS_PER_PGD];
+
+extern void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd);
+
+static inline bool in_swapper_pgdir(void *addr)
+{
+   return ((unsigned long)addr & PAGE_MASK) ==
+   ((unsigned long)swapper_pg_dir & PAGE_MASK);
+}
+
 static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
+#ifdef __PAGETABLE_PMD_FOLDED
+   if (in_swapper_pgdir(pmdp)) {
+   set_swapper_pgd((pgd_t *)pmdp, __pgd(pmd_val(pmd)));
+   return;
+   }
+#endif
WRITE_ONCE(*pmdp, pmd);
 
if (pmd_valid(pmd))
@@ -484,6 +505,12 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 
 static inline void set_pud(pud_t *pudp, pud_t pud)
 {
+#ifdef __PAGETABLE_PUD_FOLDED
+   if (in_swapper_pgdir(pudp)) {
+   set_swapper_pgd((pgd_t *)pudp, __pgd(pud_val(pud)));
+   return;
+   }
+#endif
WRITE_ONCE(*pudp, pud);
 
if (pud_valid(pud))
@@ -538,6 +565,10 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 
 static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
+   if (in_swapper_pgdir(pgdp)) {
+   set_swapper_pgd(pgdp, pgd);
+   return;
+   }
WRITE_ONCE(*pgdp, pgd);
dsb(ishst);
 }
@@ -718,13 +749,6 @@ static inline pmd_t pmdp_establish(struct vm_area_struct 
*vma,
 }
 #endif
 
-extern pgd_t init_pg_dir[PTRS_PER_PGD];
-extern pgd_t init_pg_end[];
-extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-extern pgd_t swapper_pg_end[];
-extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
-extern pgd_t tramp_pg_dir[PTRS_PER_PGD];
-
 /*
  * Encode and decode a swap entry:
  * bits 0-1:   present (must be zero)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 71532bcd76c1..a8a60927f716 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -67,6 +67,24 @@ static pte_t bm_pte[PTRS_PER_PTE] __page_aligned_bss;
 static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused;
 static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused;
 
+static DEFINE_SPINLOCK(swapper_pgdir_lock);
+
+void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd)
+{
+   pgd_t *fixmap_pgdp;
+
+   spin_lock(_pgdir_lock);
+   fixmap_pgdp = pgd_set_fixmap(__pa(pgdp));
+   WRITE_ONCE(*fixmap_pgdp, pgd);
+   /*
+* We need dsb(ishst) here to ensure the page-table-walker sees
+* our new entry before set_p?d() returns. The fixmap's
+* flush_tlb_kernel_range() via clear_fixmap() does this for us.
+*/
+   pgd_clear_fixmap();
+   spin_unlock(_pgdir_lock);
+}
+
 pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
  unsigned long size, pgprot_t vma_prot)
 {
@@ -629,8 +647,11 @@ static void __init map_kernel(pgd_t *pgdp)
  */
 void __init paging_init(void)
 {
-   map_kernel(swapper_pg_dir);
-   map_mem(swapper_pg_dir);
+   pgd_t *pgdp = pgd_set_fixmap(__pa_symbol(swapper_pg_dir));
+
+   map_kernel(pgdp);
+   map_mem(pgdp);
+   pgd_clear_fixmap();
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
init_mm.pgd = swapper_pg_dir;
 }
-- 
2.17.1



[PATCH v5 3/6] arm64/mm: Create the initial page table in the init_pg_dir.

2018-09-16 Thread Jun Yao
Create the initial page table in the init_pg_dir. And update the
init_mm.pgd to make sure that pgd_offset_k() works correctly. When
the final page table is created, we redirect the init_mm.pgd to the
swapper_pg_dir.

Signed-off-by: Jun Yao 
---
 arch/arm64/include/asm/pgtable.h | 2 ++
 arch/arm64/kernel/asm-offsets.c  | 1 +
 arch/arm64/kernel/head.S | 9 +++--
 arch/arm64/mm/mmu.c  | 1 +
 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 2ab2031b778c..b11d6fc62a62 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -718,6 +718,8 @@ static inline pmd_t pmdp_establish(struct vm_area_struct 
*vma,
 }
 #endif
 
+extern pgd_t init_pg_dir[PTRS_PER_PGD];
+extern pgd_t init_pg_end[];
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 extern pgd_t swapper_pg_end[];
 extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index 323aeb5f2fe6..43f52cfdfad4 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -82,6 +82,7 @@ int main(void)
   DEFINE(S_FRAME_SIZE, sizeof(struct pt_regs));
   BLANK();
   DEFINE(MM_CONTEXT_ID,offsetof(struct mm_struct, 
context.id.counter));
+  DEFINE(MM_PGD,   offsetof(struct mm_struct, pgd));
   BLANK();
   DEFINE(VMA_VM_MM,offsetof(struct vm_area_struct, vm_mm));
   DEFINE(VMA_VM_FLAGS, offsetof(struct vm_area_struct, vm_flags));
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index de2aaea00bd2..cf8a58211b80 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -376,7 +376,7 @@ __create_page_tables:
/*
 * Map the kernel image (starting with PHYS_OFFSET).
 */
-   adrpx0, swapper_pg_dir
+   adrpx0, init_pg_dir
mov_q   x5, KIMAGE_VADDR + TEXT_OFFSET  // compile time __va(_text)
add x5, x5, x23 // add KASLR displacement
mov x4, PTRS_PER_PGD
@@ -439,6 +439,11 @@ __primary_switched:
bl  __pi_memset
dsb ishst   // Make zero page visible to PTW
 
+   // Update init_mm.pgd
+   adrpx0, init_pg_dir
+   adr_l   x1, init_mm
+   str x0, [x1, #MM_PGD]
+
 #ifdef CONFIG_KASAN
bl  kasan_early_init
 #endif
@@ -833,7 +838,7 @@ __primary_switch:
mrs x20, sctlr_el1  // preserve old SCTLR_EL1 value
 #endif
 
-   adrpx1, swapper_pg_dir
+   adrpx1, init_pg_dir
bl  __enable_mmu
 #ifdef CONFIG_RELOCATABLE
bl  __relocate_kernel
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 65f86271f02b..af80dca335ce 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -646,6 +646,7 @@ void __init paging_init(void)
cpu_replace_ttbr1(__va(pgd_phys));
memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
+   init_mm.pgd = swapper_pg_dir;
 
pgd_clear_fixmap();
memblock_free(pgd_phys, PAGE_SIZE);
-- 
2.17.1



[PATCH v5 4/6] arm64/mm: Create the final page table directly in swapper_pg_dir.

2018-09-16 Thread Jun Yao
As the initial page table is created in the init_pg_dir, we can set
up the final page table directly in the swapper_pg_dir. And it only
contains the top level page table, so we can reduce it to a page
size.

Signed-off-by: Jun Yao 
---
 arch/arm64/kernel/vmlinux.lds.S |  2 +-
 arch/arm64/mm/mmu.c | 29 ++---
 2 files changed, 3 insertions(+), 28 deletions(-)

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 612ffc0bbe11..a634def77442 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -237,7 +237,7 @@ SECTIONS
. += RESERVED_TTBR0_SIZE;
 #endif
swapper_pg_dir = .;
-   . += SWAPPER_DIR_SIZE;
+   . += PAGE_SIZE;
swapper_pg_end = .;
 
__pecoff_data_size = ABSOLUTE(. - __initdata_begin);
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index af80dca335ce..71532bcd76c1 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -629,35 +629,10 @@ static void __init map_kernel(pgd_t *pgdp)
  */
 void __init paging_init(void)
 {
-   phys_addr_t pgd_phys = early_pgtable_alloc();
-   pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
-
-   map_kernel(pgdp);
-   map_mem(pgdp);
-
-   /*
-* We want to reuse the original swapper_pg_dir so we don't have to
-* communicate the new address to non-coherent secondaries in
-* secondary_entry, and so cpu_switch_mm can generate the address with
-* adrp+add rather than a load from some global variable.
-*
-* To do this we need to go via a temporary pgd.
-*/
-   cpu_replace_ttbr1(__va(pgd_phys));
-   memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
+   map_kernel(swapper_pg_dir);
+   map_mem(swapper_pg_dir);
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
init_mm.pgd = swapper_pg_dir;
-
-   pgd_clear_fixmap();
-   memblock_free(pgd_phys, PAGE_SIZE);
-
-   /*
-* We only reuse the PGD from the swapper_pg_dir, not the pud + pmd
-* allocated with it.
-*/
-   memblock_free(__pa_symbol(swapper_pg_dir) + PAGE_SIZE,
- __pa_symbol(swapper_pg_end) - __pa_symbol(swapper_pg_dir)
- - PAGE_SIZE);
 }
 
 /*
-- 
2.17.1



[PATCH v5 1/6] arm64/mm: Introduce the init_pg_dir.

2018-09-16 Thread Jun Yao
To make the swapper_pg_dir read only, we will move it to the rodata
section. And force the kernel to set up the initial page table in
the init_pg_dir. After generating all levels page table, we copy
only the top level into the swapper_pg_dir during paging_init().

In this patch, just add the init_pg_dir to vmlinux.lds.S and
boiler-plate clearing/cleaning/invalidating it in head.S.

Signed-off-by: Jun Yao 
---
 arch/arm64/include/asm/assembler.h | 29 +
 arch/arm64/kernel/head.S   | 22 +++---
 arch/arm64/kernel/vmlinux.lds.S|  8 
 3 files changed, 52 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/include/asm/assembler.h 
b/arch/arm64/include/asm/assembler.h
index 0bcc98dbba56..e7bdc324d538 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -456,6 +456,35 @@ USER(\label, icivau, \tmp2)// 
invalidate I line PoU
b.ne9998b
.endm
 
+/*
+ * clear_page - clear one page
+ *
+ * start:  page aligned virtual address
+ */
+   .macro clear_page, start:req
+9996:  stp xzr, xzr, [\start], #16
+   stp xzr, xzr, [\start], #16
+   stp xzr, xzr, [\start], #16
+   stp xzr, xzr, [\start], #16
+   tst \start, #(PAGE_SIZE - 1)
+   b.ne9996b
+   .endm
+
+/*
+ * clear_pages - clear contiguous pages
+ *
+ * start, end: page aligned virtual addresses
+ */
+   .macro clear_pages, start:req, end:req
+   sub \end, \end, \start
+   lsr \end, \end, #(PAGE_SHIFT)
+9997:  cbz \end, 9998f
+   clear_page \start
+   sub \end, \end, #1
+   b   9997b
+9998:
+   .endm
+
 /*
  * Annotate a function as position independent, i.e., safe to be called before
  * the kernel virtual mapping is activated.
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index b0853069702f..2c83a8c47e3f 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -295,18 +295,21 @@ __create_page_tables:
sub x1, x1, x0
bl  __inval_dcache_area
 
+   adrpx0, init_pg_dir
+   adrpx1, init_pg_end
+   sub x1, x1, x0
+   bl  __inval_dcache_area
+
/*
 * Clear the idmap and swapper page tables.
 */
adrpx0, idmap_pg_dir
adrpx1, swapper_pg_end
-   sub x1, x1, x0
-1: stp xzr, xzr, [x0], #16
-   stp xzr, xzr, [x0], #16
-   stp xzr, xzr, [x0], #16
-   stp xzr, xzr, [x0], #16
-   subsx1, x1, #64
-   b.ne1b
+   clear_pages x0, x1
+
+   adrpx0, init_pg_dir
+   adrpx1, init_pg_end
+   clear_pages x0, x1
 
mov x7, SWAPPER_MM_MMUFLAGS
 
@@ -395,6 +398,11 @@ __create_page_tables:
dmb sy
bl  __inval_dcache_area
 
+   adrpx0, init_pg_dir
+   adrpx1, init_pg_end
+   sub x1, x1, x0
+   bl  __inval_dcache_area
+
ret x28
 ENDPROC(__create_page_tables)
.ltorg
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 605d1b60469c..612ffc0bbe11 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -68,6 +68,12 @@ jiffies = jiffies_64;
 #define TRAMP_TEXT
 #endif
 
+#define INIT_PG_TABLES \
+   . = ALIGN(PAGE_SIZE);   \
+   init_pg_dir = .;\
+   . += SWAPPER_DIR_SIZE;  \
+   init_pg_end = .;
+
 /*
  * The size of the PE/COFF section that covers the kernel image, which
  * runs from stext to _edata, must be a round multiple of the PE/COFF
@@ -161,6 +167,8 @@ SECTIONS
__inittext_end = .;
__initdata_begin = .;
 
+   INIT_PG_TABLES
+
.init.data : {
INIT_DATA
INIT_SETUP(16)
-- 
2.17.1



[PATCH v5 2/6] arm64/mm: Pass ttbr1 as a parameter to __enable_mmu().

2018-09-16 Thread Jun Yao
The kernel will set up the initial page table in the init_pg_dir.
However, it will create the final page table in the swapper_pg_dir
during the initialization process. We need to let __enable_mmu()
know which page table to use.

Signed-off-by: Jun Yao 
---
 arch/arm64/kernel/head.S  | 19 +++
 arch/arm64/kernel/sleep.S |  1 +
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 2c83a8c47e3f..de2aaea00bd2 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -714,6 +714,7 @@ secondary_startup:
 * Common entry point for secondary CPUs.
 */
bl  __cpu_setup // initialise processor
+   adrpx1, swapper_pg_dir
bl  __enable_mmu
ldr x8, =__secondary_switched
br  x8
@@ -756,6 +757,7 @@ ENDPROC(__secondary_switched)
  * Enable the MMU.
  *
  *  x0  = SCTLR_EL1 value for turning on the MMU.
+ *  x1  = TTBR1_EL1 value for turning on the MMU.
  *
  * Returns to the caller via x30/lr. This requires the caller to be covered
  * by the .idmap.text section.
@@ -764,15 +766,15 @@ ENDPROC(__secondary_switched)
  * If it isn't, park the CPU
  */
 ENTRY(__enable_mmu)
-   mrs x1, ID_AA64MMFR0_EL1
-   ubfxx2, x1, #ID_AA64MMFR0_TGRAN_SHIFT, 4
-   cmp x2, #ID_AA64MMFR0_TGRAN_SUPPORTED
+   mrs x5, ID_AA64MMFR0_EL1
+   ubfxx6, x5, #ID_AA64MMFR0_TGRAN_SHIFT, 4
+   cmp x6, #ID_AA64MMFR0_TGRAN_SUPPORTED
b.ne__no_granule_support
-   update_early_cpu_boot_status 0, x1, x2
-   adrpx1, idmap_pg_dir
-   adrpx2, swapper_pg_dir
-   phys_to_ttbr x3, x1
-   phys_to_ttbr x4, x2
+   update_early_cpu_boot_status 0, x5, x6
+   adrpx5, idmap_pg_dir
+   mov x6, x1
+   phys_to_ttbr x3, x5
+   phys_to_ttbr x4, x6
msr ttbr0_el1, x3   // load TTBR0
msr ttbr1_el1, x4   // load TTBR1
isb
@@ -831,6 +833,7 @@ __primary_switch:
mrs x20, sctlr_el1  // preserve old SCTLR_EL1 value
 #endif
 
+   adrpx1, swapper_pg_dir
bl  __enable_mmu
 #ifdef CONFIG_RELOCATABLE
bl  __relocate_kernel
diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
index bebec8ef9372..3e53ffa07994 100644
--- a/arch/arm64/kernel/sleep.S
+++ b/arch/arm64/kernel/sleep.S
@@ -101,6 +101,7 @@ ENTRY(cpu_resume)
bl  el2_setup   // if in EL2 drop to EL1 cleanly
bl  __cpu_setup
/* enable the MMU early - so we can access sleep_save_stash by va */
+   adrpx1, swapper_pg_dir
bl  __enable_mmu
ldr x8, =_cpu_resume
br  x8
-- 
2.17.1



[PATCH v5 0/6] Move swapper_pg_dir to rodata section.

2018-09-16 Thread Jun Yao
Version 5 changes:
1. Correct spelling and indentation errors[1].
2. Update init_mm.pgd by assembly[2].
3. Simplify set_p?d() by introducing set_swapper_pgd()[3].
4. Reduce unnecessary tlbi for every write to swapper_pg_dir
   during paging_init()[3].

v4: https://www.spinics.net/lists/arm-kernel/msg672195.html
v3: https://www.spinics.net/lists/arm-kernel/msg662537.html
v2: https://patchwork.kernel.org/patch/10485641/
v1: https://patchwork.kernel.org/patch/10476595/

[1] https://www.spinics.net/lists/arm-kernel/msg675189.html
[2] https://www.spinics.net/lists/arm-kernel/msg675193.html
[3] https://www.spinics.net/lists/arm-kernel/msg675196.html

Jun Yao (6):
  arm64/mm: Introduce the init_pg_dir.
  arm64/mm: Pass ttbr1 as a parameter to __enable_mmu().
  arm64/mm: Create the initial page table in the init_pg_dir.
  arm64/mm: Create the final page table directly in swapper_pg_dir.
  arm64/mm: Populate the swapper_pg_dir by fixmap.
  arm64/mm: Move {idmap_pg_dir .. swapper_pg_dir} to rodata section.

 arch/arm64/include/asm/assembler.h | 29 ++
 arch/arm64/include/asm/pgtable.h   | 36 ++
 arch/arm64/kernel/asm-offsets.c|  1 +
 arch/arm64/kernel/head.S   | 48 --
 arch/arm64/kernel/sleep.S  |  1 +
 arch/arm64/kernel/vmlinux.lds.S| 47 +++--
 arch/arm64/mm/mmu.c| 45 +---
 7 files changed, 147 insertions(+), 60 deletions(-)

-- 
2.17.1



[PATCH v5 5/6] arm64/mm: Populate the swapper_pg_dir by fixmap.

2018-09-16 Thread Jun Yao
Since we will move the swapper_pg_dir to rodata section, we need a
way to update it. The fixmap can handle it. When the swapper_pg_dir
needs to be updated, we map it dynamically. The map will be
canceled after the update is complete. In this way, we can defend
against KSMA(Kernel Space Mirror Attack).

Signed-off-by: Jun Yao 
---
 arch/arm64/include/asm/pgtable.h | 38 ++--
 arch/arm64/mm/mmu.c  | 25 +++--
 2 files changed, 54 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index b11d6fc62a62..9e643fc2453d 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -429,8 +429,29 @@ extern pgprot_t phys_mem_access_prot(struct file *file, 
unsigned long pfn,
 PUD_TYPE_TABLE)
 #endif
 
+extern pgd_t init_pg_dir[PTRS_PER_PGD];
+extern pgd_t init_pg_end[];
+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
+extern pgd_t swapper_pg_end[];
+extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
+extern pgd_t tramp_pg_dir[PTRS_PER_PGD];
+
+extern void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd);
+
+static inline bool in_swapper_pgdir(void *addr)
+{
+   return ((unsigned long)addr & PAGE_MASK) ==
+   ((unsigned long)swapper_pg_dir & PAGE_MASK);
+}
+
 static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
+#ifdef __PAGETABLE_PMD_FOLDED
+   if (in_swapper_pgdir(pmdp)) {
+   set_swapper_pgd((pgd_t *)pmdp, __pgd(pmd_val(pmd)));
+   return;
+   }
+#endif
WRITE_ONCE(*pmdp, pmd);
 
if (pmd_valid(pmd))
@@ -484,6 +505,12 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 
 static inline void set_pud(pud_t *pudp, pud_t pud)
 {
+#ifdef __PAGETABLE_PUD_FOLDED
+   if (in_swapper_pgdir(pudp)) {
+   set_swapper_pgd((pgd_t *)pudp, __pgd(pud_val(pud)));
+   return;
+   }
+#endif
WRITE_ONCE(*pudp, pud);
 
if (pud_valid(pud))
@@ -538,6 +565,10 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 
 static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
+   if (in_swapper_pgdir(pgdp)) {
+   set_swapper_pgd(pgdp, pgd);
+   return;
+   }
WRITE_ONCE(*pgdp, pgd);
dsb(ishst);
 }
@@ -718,13 +749,6 @@ static inline pmd_t pmdp_establish(struct vm_area_struct 
*vma,
 }
 #endif
 
-extern pgd_t init_pg_dir[PTRS_PER_PGD];
-extern pgd_t init_pg_end[];
-extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-extern pgd_t swapper_pg_end[];
-extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
-extern pgd_t tramp_pg_dir[PTRS_PER_PGD];
-
 /*
  * Encode and decode a swap entry:
  * bits 0-1:   present (must be zero)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 71532bcd76c1..a8a60927f716 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -67,6 +67,24 @@ static pte_t bm_pte[PTRS_PER_PTE] __page_aligned_bss;
 static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused;
 static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused;
 
+static DEFINE_SPINLOCK(swapper_pgdir_lock);
+
+void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd)
+{
+   pgd_t *fixmap_pgdp;
+
+   spin_lock(_pgdir_lock);
+   fixmap_pgdp = pgd_set_fixmap(__pa(pgdp));
+   WRITE_ONCE(*fixmap_pgdp, pgd);
+   /*
+* We need dsb(ishst) here to ensure the page-table-walker sees
+* our new entry before set_p?d() returns. The fixmap's
+* flush_tlb_kernel_range() via clear_fixmap() does this for us.
+*/
+   pgd_clear_fixmap();
+   spin_unlock(_pgdir_lock);
+}
+
 pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
  unsigned long size, pgprot_t vma_prot)
 {
@@ -629,8 +647,11 @@ static void __init map_kernel(pgd_t *pgdp)
  */
 void __init paging_init(void)
 {
-   map_kernel(swapper_pg_dir);
-   map_mem(swapper_pg_dir);
+   pgd_t *pgdp = pgd_set_fixmap(__pa_symbol(swapper_pg_dir));
+
+   map_kernel(pgdp);
+   map_mem(pgdp);
+   pgd_clear_fixmap();
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
init_mm.pgd = swapper_pg_dir;
 }
-- 
2.17.1



[PATCH v5 3/6] arm64/mm: Create the initial page table in the init_pg_dir.

2018-09-16 Thread Jun Yao
Create the initial page table in the init_pg_dir. And update the
init_mm.pgd to make sure that pgd_offset_k() works correctly. When
the final page table is created, we redirect the init_mm.pgd to the
swapper_pg_dir.

Signed-off-by: Jun Yao 
---
 arch/arm64/include/asm/pgtable.h | 2 ++
 arch/arm64/kernel/asm-offsets.c  | 1 +
 arch/arm64/kernel/head.S | 9 +++--
 arch/arm64/mm/mmu.c  | 1 +
 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 2ab2031b778c..b11d6fc62a62 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -718,6 +718,8 @@ static inline pmd_t pmdp_establish(struct vm_area_struct 
*vma,
 }
 #endif
 
+extern pgd_t init_pg_dir[PTRS_PER_PGD];
+extern pgd_t init_pg_end[];
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 extern pgd_t swapper_pg_end[];
 extern pgd_t idmap_pg_dir[PTRS_PER_PGD];
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index 323aeb5f2fe6..43f52cfdfad4 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -82,6 +82,7 @@ int main(void)
   DEFINE(S_FRAME_SIZE, sizeof(struct pt_regs));
   BLANK();
   DEFINE(MM_CONTEXT_ID,offsetof(struct mm_struct, 
context.id.counter));
+  DEFINE(MM_PGD,   offsetof(struct mm_struct, pgd));
   BLANK();
   DEFINE(VMA_VM_MM,offsetof(struct vm_area_struct, vm_mm));
   DEFINE(VMA_VM_FLAGS, offsetof(struct vm_area_struct, vm_flags));
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index de2aaea00bd2..cf8a58211b80 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -376,7 +376,7 @@ __create_page_tables:
/*
 * Map the kernel image (starting with PHYS_OFFSET).
 */
-   adrpx0, swapper_pg_dir
+   adrpx0, init_pg_dir
mov_q   x5, KIMAGE_VADDR + TEXT_OFFSET  // compile time __va(_text)
add x5, x5, x23 // add KASLR displacement
mov x4, PTRS_PER_PGD
@@ -439,6 +439,11 @@ __primary_switched:
bl  __pi_memset
dsb ishst   // Make zero page visible to PTW
 
+   // Update init_mm.pgd
+   adrpx0, init_pg_dir
+   adr_l   x1, init_mm
+   str x0, [x1, #MM_PGD]
+
 #ifdef CONFIG_KASAN
bl  kasan_early_init
 #endif
@@ -833,7 +838,7 @@ __primary_switch:
mrs x20, sctlr_el1  // preserve old SCTLR_EL1 value
 #endif
 
-   adrpx1, swapper_pg_dir
+   adrpx1, init_pg_dir
bl  __enable_mmu
 #ifdef CONFIG_RELOCATABLE
bl  __relocate_kernel
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 65f86271f02b..af80dca335ce 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -646,6 +646,7 @@ void __init paging_init(void)
cpu_replace_ttbr1(__va(pgd_phys));
memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
+   init_mm.pgd = swapper_pg_dir;
 
pgd_clear_fixmap();
memblock_free(pgd_phys, PAGE_SIZE);
-- 
2.17.1



Re: KSM not working in 4.9 Kernel

2018-09-16 Thread Mike Rapoport
On Sun, Sep 16, 2018 at 10:35:17PM +0530, Pintu Kumar wrote:
> On Sun, Sep 16, 2018 at 9:02 PM Mike Rapoport  wrote:
> >
> > On Fri, Sep 14, 2018 at 07:58:01PM +0530, Pintu Kumar wrote:
> > > Hi All,
> > >
> > > Board: Hikey620 ARM64
> > > Kernel: 4.9.20
> > >
> > > I am trying to verify KSM (Kernel Same Page Merging) functionality on
> > > 4.9 Kernel using "mmap" and madvise user space test utility.
> > > But to my observation, it seems KSM is not working for me.
> > > CONFIG_KSM=y is enabled in kernel.
> > > ksm_init is also called during boot up.
> > >   443 ?SN 0:00 [ksmd]
> > >
> > > ksmd thread is also running.
> > >
> > > However, when I see the sysfs, no values are written.
> > > ~ # grep -H '' /sys/kernel/mm/ksm/*
> > > /sys/kernel/mm/ksm/pages_hashed:0
> > > /sys/kernel/mm/ksm/pages_scanned:0
> > > /sys/kernel/mm/ksm/pages_shared:0
> > > /sys/kernel/mm/ksm/pages_sharing:0
> > > /sys/kernel/mm/ksm/pages_to_scan:200
> > > /sys/kernel/mm/ksm/pages_unshared:0
> > > /sys/kernel/mm/ksm/pages_volatile:0
> > > /sys/kernel/mm/ksm/run:1
> > > /sys/kernel/mm/ksm/sleep_millisecs:1000
> > >
> > > So, please let me know if I am doing any thing wrong.
> > >
> > > This is the test utility:
> > > int main(int argc, char *argv[])
> > > {
> > > int i, n, size;
> > > char *buffer;
> > > void *addr;
> > >
> > > n = 100;
> > > size = 100 * getpagesize();
> > > for (i = 0; i < n; i++) {
> > > buffer = (char *)malloc(size);
> > > memset(buffer, 0xff, size);
> > > addr =  mmap(NULL, size,
> > >PROT_READ | PROT_EXEC | PROT_WRITE,
> > > MAP_PRIVATE | MAP_ANONYMOUS,
> > >-1, 0);
> > > madvise(addr, size, MADV_MERGEABLE);
> >
> > Just mmap'ing an area does not allocate any physical pages, so KSM has
> > nothing to merge.
> >
> > You need to memset(addr,...) after mmap().
> >
> 
> Yes, I am doing memset also.
> memset(addr, 0xff, size);
> 
> But still no effect.
> And I checked LTP test cases. It almost doing the same thing.
> 
> I observed that [ksmd] thread is not waking up at all.
> I gave some print inside it, but I could never saw that prints coming.
> I could not find it running either in top command during the operation.
> Is there anything needs to be done, to wakw up ksmd?
> I already set: echo 1 > /sys/kernel/mm/ksm.

It should be echo 1 > /sys/kernel/mm/ksm/run
 
> 
> 
> > > sleep(1);
> > > }
> > > printf("Donepress ^C\n");
> > >
> > > pause();
> > >
> > > return 0;
> > > }
> > >
> > >
> > >
> > > Thanks,
> > > Pintu
> > >
> >
> > --
> > Sincerely yours,
> > Mike.
> >
> 

-- 
Sincerely yours,
Mike.



Re: KSM not working in 4.9 Kernel

2018-09-16 Thread Mike Rapoport
On Sun, Sep 16, 2018 at 10:35:17PM +0530, Pintu Kumar wrote:
> On Sun, Sep 16, 2018 at 9:02 PM Mike Rapoport  wrote:
> >
> > On Fri, Sep 14, 2018 at 07:58:01PM +0530, Pintu Kumar wrote:
> > > Hi All,
> > >
> > > Board: Hikey620 ARM64
> > > Kernel: 4.9.20
> > >
> > > I am trying to verify KSM (Kernel Same Page Merging) functionality on
> > > 4.9 Kernel using "mmap" and madvise user space test utility.
> > > But to my observation, it seems KSM is not working for me.
> > > CONFIG_KSM=y is enabled in kernel.
> > > ksm_init is also called during boot up.
> > >   443 ?SN 0:00 [ksmd]
> > >
> > > ksmd thread is also running.
> > >
> > > However, when I see the sysfs, no values are written.
> > > ~ # grep -H '' /sys/kernel/mm/ksm/*
> > > /sys/kernel/mm/ksm/pages_hashed:0
> > > /sys/kernel/mm/ksm/pages_scanned:0
> > > /sys/kernel/mm/ksm/pages_shared:0
> > > /sys/kernel/mm/ksm/pages_sharing:0
> > > /sys/kernel/mm/ksm/pages_to_scan:200
> > > /sys/kernel/mm/ksm/pages_unshared:0
> > > /sys/kernel/mm/ksm/pages_volatile:0
> > > /sys/kernel/mm/ksm/run:1
> > > /sys/kernel/mm/ksm/sleep_millisecs:1000
> > >
> > > So, please let me know if I am doing any thing wrong.
> > >
> > > This is the test utility:
> > > int main(int argc, char *argv[])
> > > {
> > > int i, n, size;
> > > char *buffer;
> > > void *addr;
> > >
> > > n = 100;
> > > size = 100 * getpagesize();
> > > for (i = 0; i < n; i++) {
> > > buffer = (char *)malloc(size);
> > > memset(buffer, 0xff, size);
> > > addr =  mmap(NULL, size,
> > >PROT_READ | PROT_EXEC | PROT_WRITE,
> > > MAP_PRIVATE | MAP_ANONYMOUS,
> > >-1, 0);
> > > madvise(addr, size, MADV_MERGEABLE);
> >
> > Just mmap'ing an area does not allocate any physical pages, so KSM has
> > nothing to merge.
> >
> > You need to memset(addr,...) after mmap().
> >
> 
> Yes, I am doing memset also.
> memset(addr, 0xff, size);
> 
> But still no effect.
> And I checked LTP test cases. It almost doing the same thing.
> 
> I observed that [ksmd] thread is not waking up at all.
> I gave some print inside it, but I could never saw that prints coming.
> I could not find it running either in top command during the operation.
> Is there anything needs to be done, to wakw up ksmd?
> I already set: echo 1 > /sys/kernel/mm/ksm.

It should be echo 1 > /sys/kernel/mm/ksm/run
 
> 
> 
> > > sleep(1);
> > > }
> > > printf("Donepress ^C\n");
> > >
> > > pause();
> > >
> > > return 0;
> > > }
> > >
> > >
> > >
> > > Thanks,
> > > Pintu
> > >
> >
> > --
> > Sincerely yours,
> > Mike.
> >
> 

-- 
Sincerely yours,
Mike.



[PATCH 2/2] tools: hv: fcopy: set 'error' in case an unknown operation was requested

2018-09-16 Thread kys
From: Vitaly Kuznetsov 

'error' variable is left uninitialized in case we see an unknown operation.
As we don't immediately return and proceed to pwrite() we need to set it
to something, HV_E_FAIL sounds good enough.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
---
 tools/hv/hv_fcopy_daemon.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/hv/hv_fcopy_daemon.c b/tools/hv/hv_fcopy_daemon.c
index d78aed86af09..8ff8cb1a11f4 100644
--- a/tools/hv/hv_fcopy_daemon.c
+++ b/tools/hv/hv_fcopy_daemon.c
@@ -234,6 +234,7 @@ int main(int argc, char *argv[])
break;
 
default:
+   error = HV_E_FAIL;
syslog(LOG_ERR, "Unknown operation: %d",
buffer.hdr.operation);
 
-- 
2.18.0



[PATCH 1/2] Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()

2018-09-16 Thread kys
From: Dexuan Cui 

With CONFIG_DEBUG_PREEMPT=y, I always see this warning:
BUG: using smp_processor_id() in preemptible []

Fix the false warning by using get/put_cpu().

Here vmbus_connect() sends a message to the host and waits for the
host's response. The host will deliver the response message and an
interrupt on CPU msg->target_vcpu, and later the interrupt handler
will wake up vmbus_connect(). vmbus_connect() doesn't really have
to run on the same cpu as CPU msg->target_vcpu, so it's safe to
call put_cpu() just here.

Signed-off-by: Dexuan Cui 
Cc: sta...@vger.kernel.org
Cc: K. Y. Srinivasan 
Cc: Haiyang Zhang 
Cc: Stephen Hemminger 
Signed-off-by: K. Y. Srinivasan 
---
 drivers/hv/connection.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index ced041899456..f4d08c8ac7f8 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -76,6 +76,7 @@ static int vmbus_negotiate_version(struct 
vmbus_channel_msginfo *msginfo,
__u32 version)
 {
int ret = 0;
+   unsigned int cur_cpu;
struct vmbus_channel_initiate_contact *msg;
unsigned long flags;
 
@@ -118,9 +119,10 @@ static int vmbus_negotiate_version(struct 
vmbus_channel_msginfo *msginfo,
 * the CPU attempting to connect may not be CPU 0.
 */
if (version >= VERSION_WIN8_1) {
-   msg->target_vcpu =
-   hv_cpu_number_to_vp_number(smp_processor_id());
-   vmbus_connection.connect_cpu = smp_processor_id();
+   cur_cpu = get_cpu();
+   msg->target_vcpu = hv_cpu_number_to_vp_number(cur_cpu);
+   vmbus_connection.connect_cpu = cur_cpu;
+   put_cpu();
} else {
msg->target_vcpu = 0;
vmbus_connection.connect_cpu = 0;
-- 
2.18.0



[PATCH 2/2] tools: hv: fcopy: set 'error' in case an unknown operation was requested

2018-09-16 Thread kys
From: Vitaly Kuznetsov 

'error' variable is left uninitialized in case we see an unknown operation.
As we don't immediately return and proceed to pwrite() we need to set it
to something, HV_E_FAIL sounds good enough.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
---
 tools/hv/hv_fcopy_daemon.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/hv/hv_fcopy_daemon.c b/tools/hv/hv_fcopy_daemon.c
index d78aed86af09..8ff8cb1a11f4 100644
--- a/tools/hv/hv_fcopy_daemon.c
+++ b/tools/hv/hv_fcopy_daemon.c
@@ -234,6 +234,7 @@ int main(int argc, char *argv[])
break;
 
default:
+   error = HV_E_FAIL;
syslog(LOG_ERR, "Unknown operation: %d",
buffer.hdr.operation);
 
-- 
2.18.0



[PATCH 1/2] Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()

2018-09-16 Thread kys
From: Dexuan Cui 

With CONFIG_DEBUG_PREEMPT=y, I always see this warning:
BUG: using smp_processor_id() in preemptible []

Fix the false warning by using get/put_cpu().

Here vmbus_connect() sends a message to the host and waits for the
host's response. The host will deliver the response message and an
interrupt on CPU msg->target_vcpu, and later the interrupt handler
will wake up vmbus_connect(). vmbus_connect() doesn't really have
to run on the same cpu as CPU msg->target_vcpu, so it's safe to
call put_cpu() just here.

Signed-off-by: Dexuan Cui 
Cc: sta...@vger.kernel.org
Cc: K. Y. Srinivasan 
Cc: Haiyang Zhang 
Cc: Stephen Hemminger 
Signed-off-by: K. Y. Srinivasan 
---
 drivers/hv/connection.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index ced041899456..f4d08c8ac7f8 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -76,6 +76,7 @@ static int vmbus_negotiate_version(struct 
vmbus_channel_msginfo *msginfo,
__u32 version)
 {
int ret = 0;
+   unsigned int cur_cpu;
struct vmbus_channel_initiate_contact *msg;
unsigned long flags;
 
@@ -118,9 +119,10 @@ static int vmbus_negotiate_version(struct 
vmbus_channel_msginfo *msginfo,
 * the CPU attempting to connect may not be CPU 0.
 */
if (version >= VERSION_WIN8_1) {
-   msg->target_vcpu =
-   hv_cpu_number_to_vp_number(smp_processor_id());
-   vmbus_connection.connect_cpu = smp_processor_id();
+   cur_cpu = get_cpu();
+   msg->target_vcpu = hv_cpu_number_to_vp_number(cur_cpu);
+   vmbus_connection.connect_cpu = cur_cpu;
+   put_cpu();
} else {
msg->target_vcpu = 0;
vmbus_connection.connect_cpu = 0;
-- 
2.18.0



[PATCH 0/2] Drivers: hv: Miscellaneous fixes

2018-09-16 Thread kys
From: "K. Y. Srinivasan" 

Some miscellaneous fixes.

Dexuan Cui (1):
  Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()

Vitaly Kuznetsov (1):
  tools: hv: fcopy: set 'error' in case an unknown operation was
requested

 drivers/hv/connection.c| 8 +---
 tools/hv/hv_fcopy_daemon.c | 1 +
 2 files changed, 6 insertions(+), 3 deletions(-)

-- 
2.18.0



[PATCH 0/2] Drivers: hv: Miscellaneous fixes

2018-09-16 Thread kys
From: "K. Y. Srinivasan" 

Some miscellaneous fixes.

Dexuan Cui (1):
  Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()

Vitaly Kuznetsov (1):
  tools: hv: fcopy: set 'error' in case an unknown operation was
requested

 drivers/hv/connection.c| 8 +---
 tools/hv/hv_fcopy_daemon.c | 1 +
 2 files changed, 6 insertions(+), 3 deletions(-)

-- 
2.18.0



Re: [PATCH net-next v3 02/17] zinc: introduce minimal cryptography library

2018-09-16 Thread Andy Lutomirski
On Tue, Sep 11, 2018 at 4:57 PM David Miller  wrote:
>
> From: Andrew Lunn 
> Date: Wed, 12 Sep 2018 01:30:15 +0200
>
> > Just as an FYI:
> >
> > 1) I don't think anybody in netdev has taken a serious look at the
> > network code yet. There is little point until the controversial part
> > of the code, Zinc, has been sorted out.
> >
> > 2) I personally would be surprised if DaveM took this code without
> > having an Acked-by from the crypto subsystem people. In the same way,
> > i doubt the crypto people would take an Ethernet driver without having
> > DaveM's Acked-by.
>
> Both of Andrew's statements are completely true.
>
> I'm not looking at any of the networking bits until the crypto stuff
> is fully sorted and fully supported and Ack'd by crypto folks.

So, as a process question, whom exactly are we waiting for:

CRYPTO API
M:  Herbert Xu 
M:  "David S. Miller" 
L:  linux-cry...@vger.kernel.org

Herbert hasn't replied to any of these submissions.  You're the other
maintainer :)

To the extent that you (DaveM) want my ack, here's what I think of the
series so far:

The new APIs to the crypto primitives are good.  For code that wants
to do a specific known crypto operation, they are much, much more
pleasant to use than the existing crypto API.  The code cleanups in
the big keys patch speak for themselves IMO.  I have no problem with
the addition of a brand-new API to the kernel, especially when it's a
nice one like Zinc's, even if that API starts out with only a couple
of users.

Zinc's arrangement of arch code is just fine.  Sure, there are
arguments that putting arch-specific code in arch/ is better, but this
is mostly bikeshedding IMO.

There has been some discussion of the exact best way to handle
simd_relax() and some other minor nitpicks of API details.  This kind
of stuff doesn't need to block the series -- it can always be reworked
down the road if needed.

There are two things I don't like right now, though:

1. Zinc conflates the addition of a new API with the replacement of
some algorithm implementations.  This is problematic.  Look at the
recent benchmarks of ipsec before and after this series.  Apparently
big packets get faster and small packets get slower.  It would be
really nice to bisect the series to narrow down *where* the regression
came from, but, as currently structured, you can't.

The right way to do this is to rearrange the series.  First, the new
Zinc APIs should be added, and they should be backed with the
*existing* crypto code.  (If the code needs to be moved or copied to a
new location, so be it.  The patch will be messy because somehow the
Zinc API is going to have to dispatch to the arch-specific code, and
the way that the crypto API handles it is not exactly friendly to this
type of use.  So be it.)  Then another patch should switch the crypto
API to use the Zinc interface.  That patch, *by itself*, can be
benchmarked.  If it causes a regression for small ipsec packets, then
it can be tracked down relatively easily.  Once this is all done, the
actual crypto implementation can be changed, and that changed can be
reviewed on its own merits.

As a simplistic example, I wrote this code a while back:

https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git/commit/?h=crypto/sha256_bpf=e9e12f056f2abed50a30b762db9185799f5864e6

and its two parents.  This series added a more Zinc-like API to
SHA256.  And it did it without replacing the SHA256 implementation.
Doing this for Zinc would be a bit more complication, since the arch
code would need to be invoked too, but it should be doable.

FWIW, Wireguard should not actually depend on the replacement of the
crypto implementation.

2. The new Zinc crypto implementations look like they're brand new.  I
realize that they have some history, some of them are derived from
OpenSSL, etc, but none of this is really apparent in the patches
themselves.  It would be great if the kernel could literally share the
same code as something like OpenSSL, since OpenSSL gets much more
attention than the kernel's crypto.  Failing that, it would be nice if
the patches made it more clear how the code differs from its origin.
At the very least, though, if the replacement of the crypto code were,
as above, a patch that just replaced the crypto code, it would be much
easier to review and benchmark intelligently.

--Andy


Re: [PATCH net-next v3 02/17] zinc: introduce minimal cryptography library

2018-09-16 Thread Andy Lutomirski
On Tue, Sep 11, 2018 at 4:57 PM David Miller  wrote:
>
> From: Andrew Lunn 
> Date: Wed, 12 Sep 2018 01:30:15 +0200
>
> > Just as an FYI:
> >
> > 1) I don't think anybody in netdev has taken a serious look at the
> > network code yet. There is little point until the controversial part
> > of the code, Zinc, has been sorted out.
> >
> > 2) I personally would be surprised if DaveM took this code without
> > having an Acked-by from the crypto subsystem people. In the same way,
> > i doubt the crypto people would take an Ethernet driver without having
> > DaveM's Acked-by.
>
> Both of Andrew's statements are completely true.
>
> I'm not looking at any of the networking bits until the crypto stuff
> is fully sorted and fully supported and Ack'd by crypto folks.

So, as a process question, whom exactly are we waiting for:

CRYPTO API
M:  Herbert Xu 
M:  "David S. Miller" 
L:  linux-cry...@vger.kernel.org

Herbert hasn't replied to any of these submissions.  You're the other
maintainer :)

To the extent that you (DaveM) want my ack, here's what I think of the
series so far:

The new APIs to the crypto primitives are good.  For code that wants
to do a specific known crypto operation, they are much, much more
pleasant to use than the existing crypto API.  The code cleanups in
the big keys patch speak for themselves IMO.  I have no problem with
the addition of a brand-new API to the kernel, especially when it's a
nice one like Zinc's, even if that API starts out with only a couple
of users.

Zinc's arrangement of arch code is just fine.  Sure, there are
arguments that putting arch-specific code in arch/ is better, but this
is mostly bikeshedding IMO.

There has been some discussion of the exact best way to handle
simd_relax() and some other minor nitpicks of API details.  This kind
of stuff doesn't need to block the series -- it can always be reworked
down the road if needed.

There are two things I don't like right now, though:

1. Zinc conflates the addition of a new API with the replacement of
some algorithm implementations.  This is problematic.  Look at the
recent benchmarks of ipsec before and after this series.  Apparently
big packets get faster and small packets get slower.  It would be
really nice to bisect the series to narrow down *where* the regression
came from, but, as currently structured, you can't.

The right way to do this is to rearrange the series.  First, the new
Zinc APIs should be added, and they should be backed with the
*existing* crypto code.  (If the code needs to be moved or copied to a
new location, so be it.  The patch will be messy because somehow the
Zinc API is going to have to dispatch to the arch-specific code, and
the way that the crypto API handles it is not exactly friendly to this
type of use.  So be it.)  Then another patch should switch the crypto
API to use the Zinc interface.  That patch, *by itself*, can be
benchmarked.  If it causes a regression for small ipsec packets, then
it can be tracked down relatively easily.  Once this is all done, the
actual crypto implementation can be changed, and that changed can be
reviewed on its own merits.

As a simplistic example, I wrote this code a while back:

https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git/commit/?h=crypto/sha256_bpf=e9e12f056f2abed50a30b762db9185799f5864e6

and its two parents.  This series added a more Zinc-like API to
SHA256.  And it did it without replacing the SHA256 implementation.
Doing this for Zinc would be a bit more complication, since the arch
code would need to be invoked too, but it should be doable.

FWIW, Wireguard should not actually depend on the replacement of the
crypto implementation.

2. The new Zinc crypto implementations look like they're brand new.  I
realize that they have some history, some of them are derived from
OpenSSL, etc, but none of this is really apparent in the patches
themselves.  It would be great if the kernel could literally share the
same code as something like OpenSSL, since OpenSSL gets much more
attention than the kernel's crypto.  Failing that, it would be nice if
the patches made it more clear how the code differs from its origin.
At the very least, though, if the replacement of the crypto code were,
as above, a patch that just replaced the crypto code, it would be much
easier to review and benchmark intelligently.

--Andy


Re: [PATCH 4.18 082/197] block: dont warn for flush on read-only device

2018-09-16 Thread Stefan Agner
Hi Greg,

The follow up patch 8b2ded1c94c0 ("block: don't warn when doing fsync on 
read-only devices") should get applied too, since it correctly fixes what this 
patch tried to fix.

--
Stefan

On 13.09.2018 06:30, Greg Kroah-Hartman wrote:
> 4.18-stable review patch.  If anyone has any objections, please let me know.
> 
> --
> 
> From: Jens Axboe 
> 
> [ Upstream commit b089cfd95d32638335c551651a8e00fd2c4edb0b ]
> 
> Don't warn for a flush issued to a read-only device. It's not strictly
> a writable command, as it doesn't change any on-media data by itself.
> 
> Reported-by: Stefan Agner 
> Fixes: 721c7fc701c7 ("block: fail op_is_write() requests to read-only 
> partitions")
> Signed-off-by: Jens Axboe 
> Signed-off-by: Sasha Levin 
> Signed-off-by: Greg Kroah-Hartman 
> ---
>  block/blk-core.c |4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> --- a/block/blk-core.c
> +++ b/block/blk-core.c
> @@ -2159,7 +2159,9 @@ static inline bool should_fail_request(s
>  
>  static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
>  {
> - if (part->policy && op_is_write(bio_op(bio))) {
> + const int op = bio_op(bio);
> +
> + if (part->policy && (op_is_write(op) && !op_is_flush(op))) {
>   char b[BDEVNAME_SIZE];
>  
>   WARN_ONCE(1,


Re: [PATCH 4.18 082/197] block: dont warn for flush on read-only device

2018-09-16 Thread Stefan Agner
Hi Greg,

The follow up patch 8b2ded1c94c0 ("block: don't warn when doing fsync on 
read-only devices") should get applied too, since it correctly fixes what this 
patch tried to fix.

--
Stefan

On 13.09.2018 06:30, Greg Kroah-Hartman wrote:
> 4.18-stable review patch.  If anyone has any objections, please let me know.
> 
> --
> 
> From: Jens Axboe 
> 
> [ Upstream commit b089cfd95d32638335c551651a8e00fd2c4edb0b ]
> 
> Don't warn for a flush issued to a read-only device. It's not strictly
> a writable command, as it doesn't change any on-media data by itself.
> 
> Reported-by: Stefan Agner 
> Fixes: 721c7fc701c7 ("block: fail op_is_write() requests to read-only 
> partitions")
> Signed-off-by: Jens Axboe 
> Signed-off-by: Sasha Levin 
> Signed-off-by: Greg Kroah-Hartman 
> ---
>  block/blk-core.c |4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> --- a/block/blk-core.c
> +++ b/block/blk-core.c
> @@ -2159,7 +2159,9 @@ static inline bool should_fail_request(s
>  
>  static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
>  {
> - if (part->policy && op_is_write(bio_op(bio))) {
> + const int op = bio_op(bio);
> +
> + if (part->policy && (op_is_write(op) && !op_is_flush(op))) {
>   char b[BDEVNAME_SIZE];
>  
>   WARN_ONCE(1,


Re: [PATCH 2/2] power: supply: Add Spreadtrum SC27XX fuel gauge unit driver

2018-09-16 Thread Baolin Wang
Hi Sebastian,

On 16 September 2018 at 22:35, Sebastian Reichel
 wrote:
> Hi,
>
> Looks mostly good. I have a couple of comments in addition to the
> ones from the binding about using battery_info for the OCV ->
> capacity mapping.

OK.

>> +
>> +static int sc27xx_fgu_get_vbat_vol(struct sc27xx_fgu_data *data, int *val)
>> +{
>> + int ret, vol;
>> +
>> + ret = regmap_read(data->regmap, data->base + SC27XX_FGU_VOLTAGE, );
>> + if (ret)
>> + return ret;
>> +
>> + /*
>> +  * It is ADC values reading from registers which need to convert to
>> +  * corresponding voltage values.
>> +  */
>> + *val = sc27xx_fgu_adc_to_voltage(vol);
>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_current(struct sc27xx_fgu_data *data, int *val)
>> +{
>> + int ret, cur;
>> +
>> + ret = regmap_read(data->regmap, data->base + SC27XX_FGU_CURRENT, );
>> + if (ret)
>> + return ret;
>> +
>> + /*
>> +  * It is ADC values reading from registers which need to convert to
>> +  * corresponding current values.
>> +  */
>> + *val = sc27xx_fgu_adc_to_current(cur - SC27XX_FGU_CUR_BASIC_ADC);
>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_vbat_ocv(struct sc27xx_fgu_data *data, int *val)
>> +{
>> + int vol, cur, ret;
>> +
>> + ret = sc27xx_fgu_get_vbat_vol(data, );
>> + if (ret)
>> + return ret;
>> +
>> + ret = sc27xx_fgu_get_current(data, );
>> + if (ret)
>> + return ret;
>> +
>> + *val = vol - (cur * data->inner_resist) / 1000;
>
> You multiply this with 1000 directly after this function to get back
> to uV. Just drop the division and the multiplication.

But the vol's unit is mV, so I can change to:

 *val = vol * 1000 - cur * data->inner_resist;

>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_temp(struct sc27xx_fgu_data *data, int *temp)
>> +{
>> + return iio_read_channel_processed(data->channel, temp);
>> +}
>> +
>> +static int sc27xx_fgu_get_health(struct sc27xx_fgu_data *data, int *health)
>> +{
>> + int ret, vol;
>> +
>> + ret = sc27xx_fgu_get_vbat_vol(data, );
>> + if (ret)
>> + return ret;
>> +
>> + if (vol > data->max_volt)
>> + *health = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
>> + else
>> + *health = POWER_SUPPLY_HEALTH_GOOD;
>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_status(struct sc27xx_fgu_data *data, int *status)
>> +{
>> + union power_supply_propval val;
>> + struct power_supply *psy;
>> + int i, ret = -EINVAL;
>> +
>> + for (i = 0; i < ARRAY_SIZE(sc27xx_charger_supply_name); i++) {
>> + psy = power_supply_get_by_name(sc27xx_charger_supply_name[i]);
>> + if (!psy)
>> + continue;
>> +
>> + ret = power_supply_get_property(psy, POWER_SUPPLY_PROP_STATUS,
>> + );
>> + power_supply_put(psy);
>> + if (ret)
>> + return ret;
>> +
>> + *status = val.intval;
>> + }
>> +
>> + return ret;
>> +}
>> +
>> +static int sc27xx_fgu_get_property(struct power_supply *psy,
>> +enum power_supply_property psp,
>> +union power_supply_propval *val)
>> +{
>> + struct sc27xx_fgu_data *data = power_supply_get_drvdata(psy);
>> + int ret = 0;
>> + int value;
>> +
>> + mutex_lock(>lock);
>> +
>> + switch (psp) {
>> + case POWER_SUPPLY_PROP_STATUS:
>> + ret = sc27xx_fgu_get_status(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_HEALTH:
>> + ret = sc27xx_fgu_get_health(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_PRESENT:
>> + val->intval = data->bat_present;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_TEMP:
>> + ret = sc27xx_fgu_get_temp(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_TECHNOLOGY:
>> + val->intval = POWER_SUPPLY_TECHNOLOGY_LION;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_CAPACITY:
>> + ret = sc27xx_fgu_get_capacity(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_VOLTAGE_NOW:
>> + ret = sc27xx_fgu_get_vbat_vol(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value * 1000;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_VOLTAGE_OCV:
>> 

Re: [PATCH 2/2] power: supply: Add Spreadtrum SC27XX fuel gauge unit driver

2018-09-16 Thread Baolin Wang
Hi Sebastian,

On 16 September 2018 at 22:35, Sebastian Reichel
 wrote:
> Hi,
>
> Looks mostly good. I have a couple of comments in addition to the
> ones from the binding about using battery_info for the OCV ->
> capacity mapping.

OK.

>> +
>> +static int sc27xx_fgu_get_vbat_vol(struct sc27xx_fgu_data *data, int *val)
>> +{
>> + int ret, vol;
>> +
>> + ret = regmap_read(data->regmap, data->base + SC27XX_FGU_VOLTAGE, );
>> + if (ret)
>> + return ret;
>> +
>> + /*
>> +  * It is ADC values reading from registers which need to convert to
>> +  * corresponding voltage values.
>> +  */
>> + *val = sc27xx_fgu_adc_to_voltage(vol);
>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_current(struct sc27xx_fgu_data *data, int *val)
>> +{
>> + int ret, cur;
>> +
>> + ret = regmap_read(data->regmap, data->base + SC27XX_FGU_CURRENT, );
>> + if (ret)
>> + return ret;
>> +
>> + /*
>> +  * It is ADC values reading from registers which need to convert to
>> +  * corresponding current values.
>> +  */
>> + *val = sc27xx_fgu_adc_to_current(cur - SC27XX_FGU_CUR_BASIC_ADC);
>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_vbat_ocv(struct sc27xx_fgu_data *data, int *val)
>> +{
>> + int vol, cur, ret;
>> +
>> + ret = sc27xx_fgu_get_vbat_vol(data, );
>> + if (ret)
>> + return ret;
>> +
>> + ret = sc27xx_fgu_get_current(data, );
>> + if (ret)
>> + return ret;
>> +
>> + *val = vol - (cur * data->inner_resist) / 1000;
>
> You multiply this with 1000 directly after this function to get back
> to uV. Just drop the division and the multiplication.

But the vol's unit is mV, so I can change to:

 *val = vol * 1000 - cur * data->inner_resist;

>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_temp(struct sc27xx_fgu_data *data, int *temp)
>> +{
>> + return iio_read_channel_processed(data->channel, temp);
>> +}
>> +
>> +static int sc27xx_fgu_get_health(struct sc27xx_fgu_data *data, int *health)
>> +{
>> + int ret, vol;
>> +
>> + ret = sc27xx_fgu_get_vbat_vol(data, );
>> + if (ret)
>> + return ret;
>> +
>> + if (vol > data->max_volt)
>> + *health = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
>> + else
>> + *health = POWER_SUPPLY_HEALTH_GOOD;
>> +
>> + return 0;
>> +}
>> +
>> +static int sc27xx_fgu_get_status(struct sc27xx_fgu_data *data, int *status)
>> +{
>> + union power_supply_propval val;
>> + struct power_supply *psy;
>> + int i, ret = -EINVAL;
>> +
>> + for (i = 0; i < ARRAY_SIZE(sc27xx_charger_supply_name); i++) {
>> + psy = power_supply_get_by_name(sc27xx_charger_supply_name[i]);
>> + if (!psy)
>> + continue;
>> +
>> + ret = power_supply_get_property(psy, POWER_SUPPLY_PROP_STATUS,
>> + );
>> + power_supply_put(psy);
>> + if (ret)
>> + return ret;
>> +
>> + *status = val.intval;
>> + }
>> +
>> + return ret;
>> +}
>> +
>> +static int sc27xx_fgu_get_property(struct power_supply *psy,
>> +enum power_supply_property psp,
>> +union power_supply_propval *val)
>> +{
>> + struct sc27xx_fgu_data *data = power_supply_get_drvdata(psy);
>> + int ret = 0;
>> + int value;
>> +
>> + mutex_lock(>lock);
>> +
>> + switch (psp) {
>> + case POWER_SUPPLY_PROP_STATUS:
>> + ret = sc27xx_fgu_get_status(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_HEALTH:
>> + ret = sc27xx_fgu_get_health(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_PRESENT:
>> + val->intval = data->bat_present;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_TEMP:
>> + ret = sc27xx_fgu_get_temp(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_TECHNOLOGY:
>> + val->intval = POWER_SUPPLY_TECHNOLOGY_LION;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_CAPACITY:
>> + ret = sc27xx_fgu_get_capacity(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_VOLTAGE_NOW:
>> + ret = sc27xx_fgu_get_vbat_vol(data, );
>> + if (ret)
>> + goto error;
>> +
>> + val->intval = value * 1000;
>> + break;
>> +
>> + case POWER_SUPPLY_PROP_VOLTAGE_OCV:
>> 

Re: [PATCH net-next] net/smc: cast sizeof to int for comparison

2018-09-16 Thread YueHaibing
On 2018/9/15 19:35, Andreas Schwab wrote:
> On Sep 15 2018, YueHaibing  wrote:
> 
>> Comparing an int to a size, which is unsigned, causes the int to become
>> unsigned, giving the wrong result. kernel_sendmsg can return a negative
>> error code.
>>
>> Signed-off-by: YueHaibing 
>> ---
>>  net/smc/smc_clc.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
>> index 83aba9a..fd0f5ce 100644
>> --- a/net/smc/smc_clc.c
>> +++ b/net/smc/smc_clc.c
>> @@ -446,7 +446,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, int 
>> smc_type,
>>  vec[i++].iov_len = sizeof(trl);
>>  /* due to the few bytes needed for clc-handshake this cannot block */
>>  len = kernel_sendmsg(smc->clcsock, , vec, i, plen);
>> -if (len < sizeof(pclc)) {
>> +if (len < (int)sizeof(pclc)) {
>>  if (len >= 0) {
>>  reason_code = -ENETUNREACH;
>>  smc->sk.sk_err = -reason_code;
> 
> It would perhaps be better to handle len < 0 first.

That need refactor the err hangding, is worth doing it?

> 
> Andreas.
> 



Re: [PATCH net-next] net/smc: cast sizeof to int for comparison

2018-09-16 Thread YueHaibing
On 2018/9/15 19:35, Andreas Schwab wrote:
> On Sep 15 2018, YueHaibing  wrote:
> 
>> Comparing an int to a size, which is unsigned, causes the int to become
>> unsigned, giving the wrong result. kernel_sendmsg can return a negative
>> error code.
>>
>> Signed-off-by: YueHaibing 
>> ---
>>  net/smc/smc_clc.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
>> index 83aba9a..fd0f5ce 100644
>> --- a/net/smc/smc_clc.c
>> +++ b/net/smc/smc_clc.c
>> @@ -446,7 +446,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, int 
>> smc_type,
>>  vec[i++].iov_len = sizeof(trl);
>>  /* due to the few bytes needed for clc-handshake this cannot block */
>>  len = kernel_sendmsg(smc->clcsock, , vec, i, plen);
>> -if (len < sizeof(pclc)) {
>> +if (len < (int)sizeof(pclc)) {
>>  if (len >= 0) {
>>  reason_code = -ENETUNREACH;
>>  smc->sk.sk_err = -reason_code;
> 
> It would perhaps be better to handle len < 0 first.

That need refactor the err hangding, is worth doing it?

> 
> Andreas.
> 



Re: [PATCH v3 3/3] thermal: broadcom: Add Stingray thermal driver

2018-09-16 Thread Srinath Mannam
Hi Daniel,

Thank you for your review comments.
I will address all your comments in next patch set.

Regards,
Srinath.

On Fri, Sep 14, 2018 at 7:50 PM, Daniel Lezcano
 wrote:
> On 09/08/2018 14:54, Srinath Mannam wrote:
>> From: Pramod Kumar 
>>
>> Adds stingray thermal driver to monitor six
>> thermal zones temperature and trips at critical temperature.
>
> Hi Pramod,
>
> could you elaborate a bit more the description? As you are introducing a
> new driver it would be nice to give the sensor details.
>
>> Signed-off-by: Pramod Kumar 
>> Signed-off-by: Srinath Mannam 
>> Reviewed-by: Ray Jui 
>> Reviewed-by: Scott Branden 
>> Reviewed-by: Vikram Prakash 
>> ---
>>  drivers/thermal/Kconfig   |   3 +-
>>  drivers/thermal/broadcom/Kconfig  |   9 ++
>>  drivers/thermal/broadcom/Makefile |   1 +
>>  drivers/thermal/broadcom/sr-thermal.c | 216 
>> ++
>>  4 files changed, 228 insertions(+), 1 deletion(-)
>>  create mode 100644 drivers/thermal/broadcom/sr-thermal.c
>>
>> diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
>> index 8297988..26d39d4 100644
>> --- a/drivers/thermal/Kconfig
>> +++ b/drivers/thermal/Kconfig
>> @@ -416,7 +416,8 @@ config MTK_THERMAL
>> controller present in Mediatek SoCs
>>
>>  menu "Broadcom thermal drivers"
>> -depends on ARCH_BCM || ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
>> +depends on ARCH_BCM || ARCH_BRCMSTB || ARCH_BCM2835 || ARCH_BCM_IPROC || \
>> + COMPILE_TEST
>>  source "drivers/thermal/broadcom/Kconfig"
>>  endmenu
>>
>> diff --git a/drivers/thermal/broadcom/Kconfig 
>> b/drivers/thermal/broadcom/Kconfig
>> index c106a15..dc9a9bd 100644
>> --- a/drivers/thermal/broadcom/Kconfig
>> +++ b/drivers/thermal/broadcom/Kconfig
>> @@ -22,3 +22,12 @@ config BCM_NS_THERMAL
>> BCM4708, BCM4709, BCM5301x, BCM95852X, etc). It contains DMU (Device
>> Management Unit) block with a thermal sensor that allows checking CPU
>> temperature.
>> +
>> +config BCM_SR_THERMAL
>> + tristate "Stingray thermal driver"
>> + depends on ARCH_BCM_IPROC || COMPILE_TEST
>> + default ARCH_BCM_IPROC
>> + help
>> +   Support for the Stingray family of SoCs. Its different blocks like
>> +   iHost, CRMU and NITRO has thermal sensor that allows checking its
>> +   temperature.
>> diff --git a/drivers/thermal/broadcom/Makefile 
>> b/drivers/thermal/broadcom/Makefile
>> index fae10ec..79df69e 100644
>> --- a/drivers/thermal/broadcom/Makefile
>> +++ b/drivers/thermal/broadcom/Makefile
>> @@ -1,3 +1,4 @@
>>  obj-$(CONFIG_BCM2835_THERMAL)+= bcm2835_thermal.o
>>  obj-$(CONFIG_BRCMSTB_THERMAL)+= brcmstb_thermal.o
>>  obj-$(CONFIG_BCM_NS_THERMAL) += ns-thermal.o
>> +obj-$(CONFIG_BCM_SR_THERMAL) += sr-thermal.o
>> diff --git a/drivers/thermal/broadcom/sr-thermal.c 
>> b/drivers/thermal/broadcom/sr-thermal.c
>> new file mode 100644
>> index 000..909f80c
>> --- /dev/null
>> +++ b/drivers/thermal/broadcom/sr-thermal.c
>> @@ -0,0 +1,216 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +/*
>> + * Copyright (C) 2018 Broadcom
>> + */
>> +
>> +#include 
>> +#include 
>> +#include 
>> +#include 
>> +#include 
>> +
>> +#define TMON_CRIT_TEMP  105000 /* temp in millidegree C */
>
> I suggest to move this in the DT?
>
>> +#define SR_TMON_MAX_LIST6
>> +
>> +/*
>> + * In stingray thermal IO memory,
>> + * Total Number of available TMONs MASK is at offset 0
>> + * temperature registers BASE is at 4 byte offset.
>> + * Each TMON temperature register size is 4.
>> + */
>> +#define SR_TMON_TEMP_BASE(id)   ((id) * 0x4)
>> +
>> +static const char * const sr_tmon_names[SR_TMON_MAX_LIST] = {
>
> It will be more elegant to replace the macro SR_TMON_MAX_LIST by
> ARRAY_SIZE(sr_tmon_names) and declare this array as:
>
> static const char *const sr_tmon_name[] = {
> ...
> };
>
>> + "sr_tmon_ihost0",
>> + "sr_tmon_ihost1",
>> + "sr_tmon_ihost2",
>> + "sr_tmon_ihost3",
>> + "sr_tmon_crmu",
>> + "sr_tmon_nitro",
>> +};
>> +
>> +struct sr_tmon {
>> + struct thermal_zone_device *tz;
>> + unsigned int crit_temp;
>> + unsigned int tmon_id;
>> + struct sr_thermal *priv;
>> +};
>> +
>> +struct sr_thermal {
>> + struct device *dev;
>
> This field is used for dev_dbg, may be it could be removed along with
> the dev_dbg message?
>
>> + void __iomem *regs;
>> + struct sr_tmon tmon[SR_TMON_MAX_LIST];
>> +};
>> +
>> +static int sr_get_temp(struct thermal_zone_device *tz, int *temp)
>> +{
>> + struct sr_tmon *tmon = tz->devdata;
>> + struct sr_thermal *sr_thermal = tmon->priv;
>> +
>> + *temp = readl(sr_thermal->regs + SR_TMON_TEMP_BASE(tmon->tmon_id));
>> +
>> + return 0;
>> +}
>> +
>> +static int sr_get_trip_type(struct thermal_zone_device *tz, int trip,
>> + enum thermal_trip_type *type)
>> +{
>> + struct sr_tmon *tmon = tz->devdata;
>> + 

Re: [PATCH v3 3/3] thermal: broadcom: Add Stingray thermal driver

2018-09-16 Thread Srinath Mannam
Hi Daniel,

Thank you for your review comments.
I will address all your comments in next patch set.

Regards,
Srinath.

On Fri, Sep 14, 2018 at 7:50 PM, Daniel Lezcano
 wrote:
> On 09/08/2018 14:54, Srinath Mannam wrote:
>> From: Pramod Kumar 
>>
>> Adds stingray thermal driver to monitor six
>> thermal zones temperature and trips at critical temperature.
>
> Hi Pramod,
>
> could you elaborate a bit more the description? As you are introducing a
> new driver it would be nice to give the sensor details.
>
>> Signed-off-by: Pramod Kumar 
>> Signed-off-by: Srinath Mannam 
>> Reviewed-by: Ray Jui 
>> Reviewed-by: Scott Branden 
>> Reviewed-by: Vikram Prakash 
>> ---
>>  drivers/thermal/Kconfig   |   3 +-
>>  drivers/thermal/broadcom/Kconfig  |   9 ++
>>  drivers/thermal/broadcom/Makefile |   1 +
>>  drivers/thermal/broadcom/sr-thermal.c | 216 
>> ++
>>  4 files changed, 228 insertions(+), 1 deletion(-)
>>  create mode 100644 drivers/thermal/broadcom/sr-thermal.c
>>
>> diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
>> index 8297988..26d39d4 100644
>> --- a/drivers/thermal/Kconfig
>> +++ b/drivers/thermal/Kconfig
>> @@ -416,7 +416,8 @@ config MTK_THERMAL
>> controller present in Mediatek SoCs
>>
>>  menu "Broadcom thermal drivers"
>> -depends on ARCH_BCM || ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
>> +depends on ARCH_BCM || ARCH_BRCMSTB || ARCH_BCM2835 || ARCH_BCM_IPROC || \
>> + COMPILE_TEST
>>  source "drivers/thermal/broadcom/Kconfig"
>>  endmenu
>>
>> diff --git a/drivers/thermal/broadcom/Kconfig 
>> b/drivers/thermal/broadcom/Kconfig
>> index c106a15..dc9a9bd 100644
>> --- a/drivers/thermal/broadcom/Kconfig
>> +++ b/drivers/thermal/broadcom/Kconfig
>> @@ -22,3 +22,12 @@ config BCM_NS_THERMAL
>> BCM4708, BCM4709, BCM5301x, BCM95852X, etc). It contains DMU (Device
>> Management Unit) block with a thermal sensor that allows checking CPU
>> temperature.
>> +
>> +config BCM_SR_THERMAL
>> + tristate "Stingray thermal driver"
>> + depends on ARCH_BCM_IPROC || COMPILE_TEST
>> + default ARCH_BCM_IPROC
>> + help
>> +   Support for the Stingray family of SoCs. Its different blocks like
>> +   iHost, CRMU and NITRO has thermal sensor that allows checking its
>> +   temperature.
>> diff --git a/drivers/thermal/broadcom/Makefile 
>> b/drivers/thermal/broadcom/Makefile
>> index fae10ec..79df69e 100644
>> --- a/drivers/thermal/broadcom/Makefile
>> +++ b/drivers/thermal/broadcom/Makefile
>> @@ -1,3 +1,4 @@
>>  obj-$(CONFIG_BCM2835_THERMAL)+= bcm2835_thermal.o
>>  obj-$(CONFIG_BRCMSTB_THERMAL)+= brcmstb_thermal.o
>>  obj-$(CONFIG_BCM_NS_THERMAL) += ns-thermal.o
>> +obj-$(CONFIG_BCM_SR_THERMAL) += sr-thermal.o
>> diff --git a/drivers/thermal/broadcom/sr-thermal.c 
>> b/drivers/thermal/broadcom/sr-thermal.c
>> new file mode 100644
>> index 000..909f80c
>> --- /dev/null
>> +++ b/drivers/thermal/broadcom/sr-thermal.c
>> @@ -0,0 +1,216 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +/*
>> + * Copyright (C) 2018 Broadcom
>> + */
>> +
>> +#include 
>> +#include 
>> +#include 
>> +#include 
>> +#include 
>> +
>> +#define TMON_CRIT_TEMP  105000 /* temp in millidegree C */
>
> I suggest to move this in the DT?
>
>> +#define SR_TMON_MAX_LIST6
>> +
>> +/*
>> + * In stingray thermal IO memory,
>> + * Total Number of available TMONs MASK is at offset 0
>> + * temperature registers BASE is at 4 byte offset.
>> + * Each TMON temperature register size is 4.
>> + */
>> +#define SR_TMON_TEMP_BASE(id)   ((id) * 0x4)
>> +
>> +static const char * const sr_tmon_names[SR_TMON_MAX_LIST] = {
>
> It will be more elegant to replace the macro SR_TMON_MAX_LIST by
> ARRAY_SIZE(sr_tmon_names) and declare this array as:
>
> static const char *const sr_tmon_name[] = {
> ...
> };
>
>> + "sr_tmon_ihost0",
>> + "sr_tmon_ihost1",
>> + "sr_tmon_ihost2",
>> + "sr_tmon_ihost3",
>> + "sr_tmon_crmu",
>> + "sr_tmon_nitro",
>> +};
>> +
>> +struct sr_tmon {
>> + struct thermal_zone_device *tz;
>> + unsigned int crit_temp;
>> + unsigned int tmon_id;
>> + struct sr_thermal *priv;
>> +};
>> +
>> +struct sr_thermal {
>> + struct device *dev;
>
> This field is used for dev_dbg, may be it could be removed along with
> the dev_dbg message?
>
>> + void __iomem *regs;
>> + struct sr_tmon tmon[SR_TMON_MAX_LIST];
>> +};
>> +
>> +static int sr_get_temp(struct thermal_zone_device *tz, int *temp)
>> +{
>> + struct sr_tmon *tmon = tz->devdata;
>> + struct sr_thermal *sr_thermal = tmon->priv;
>> +
>> + *temp = readl(sr_thermal->regs + SR_TMON_TEMP_BASE(tmon->tmon_id));
>> +
>> + return 0;
>> +}
>> +
>> +static int sr_get_trip_type(struct thermal_zone_device *tz, int trip,
>> + enum thermal_trip_type *type)
>> +{
>> + struct sr_tmon *tmon = tz->devdata;
>> + 

Re: [PATCH 1/2] dt-bindings: power: Add Spreadtrum SC27XX fuel gauge unit documentation

2018-09-16 Thread Baolin Wang
Hi Sebastian,

On 16 September 2018 at 21:57, Sebastian Reichel
 wrote:
> Hi,
>
> On Wed, Sep 12, 2018 at 03:29:38PM +0800, Baolin Wang wrote:
>> This patch adds the binding documentation for Spreadtrum SC27XX series PMICs
>> fuel gauge unit device, which is used to calculate the battery capacity.
>>
>> Signed-off-by: Baolin Wang 
>> ---
>>  .../devicetree/bindings/power/supply/sc27xx-fg.txt |   55 
>> 
>>  1 file changed, 55 insertions(+)
>>  create mode 100644 
>> Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
>>
>> diff --git a/Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt 
>> b/Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
>> new file mode 100644
>> index 000..7447bae
>> --- /dev/null
>> +++ b/Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
>> @@ -0,0 +1,55 @@
>> +Spreadtrum SC27XX PMICs Fuel Gauge Unit Power Supply Bindings
>> +
>> +Required properties:
>> +- compatible: Should be one of the following:
>> +  "sprd,sc2720-fgu",
>> +  "sprd,sc2721-fgu",
>> +  "sprd,sc2723-fgu",
>> +  "sprd,sc2730-fgu",
>> +  "sprd,sc2731-fgu".
>> +- reg: The address offset of fuel gauge unit.
>> +- bat-detect-gpio: GPIO for battery detection.
>> +- io-channels: Specify the IIO ADC channel to get temperature.
>> +- io-channel-names: Should be "bat-temp".
>> +- sprd,inner-resist: Specify the the battery inner resistance (mOhm).
>
> This should be a property of the battery.without the sprd, prefix.

Right. But I did not find one proper property of the battery, so I
will add one new standard property of battery named
'inner-resistance-microohm' in next version. Is it OK for you?

>
>> +- sprd,ocv-cap-table: Provide the battery capacity percent with 
>> corresponding
>> +  open circuit voltage (ocv) of the battery, which is used to look up 
>> current
>> +  battery capacity according to current baterry ocv values.
>
> This should also be part of the battery binding. I just reviewed a
> patchset for the Qualcomm Battery Monitoring System, which needs the
> same functionality. The Qualcomm binding is more advanced, but
> should also support this simpler case. Thus I think it makes sense
> to use its description as base for adding support for this feature
> to Documentation/devicetree/bindings/power/supply/battery.txt

That's great. But could you give me the link of Qualcomm binding,
which I can change my bindings. Thanks for your comments.

-- 
Baolin Wang
Best Regards


Re: [PATCH 1/2] dt-bindings: power: Add Spreadtrum SC27XX fuel gauge unit documentation

2018-09-16 Thread Baolin Wang
Hi Sebastian,

On 16 September 2018 at 21:57, Sebastian Reichel
 wrote:
> Hi,
>
> On Wed, Sep 12, 2018 at 03:29:38PM +0800, Baolin Wang wrote:
>> This patch adds the binding documentation for Spreadtrum SC27XX series PMICs
>> fuel gauge unit device, which is used to calculate the battery capacity.
>>
>> Signed-off-by: Baolin Wang 
>> ---
>>  .../devicetree/bindings/power/supply/sc27xx-fg.txt |   55 
>> 
>>  1 file changed, 55 insertions(+)
>>  create mode 100644 
>> Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
>>
>> diff --git a/Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt 
>> b/Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
>> new file mode 100644
>> index 000..7447bae
>> --- /dev/null
>> +++ b/Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
>> @@ -0,0 +1,55 @@
>> +Spreadtrum SC27XX PMICs Fuel Gauge Unit Power Supply Bindings
>> +
>> +Required properties:
>> +- compatible: Should be one of the following:
>> +  "sprd,sc2720-fgu",
>> +  "sprd,sc2721-fgu",
>> +  "sprd,sc2723-fgu",
>> +  "sprd,sc2730-fgu",
>> +  "sprd,sc2731-fgu".
>> +- reg: The address offset of fuel gauge unit.
>> +- bat-detect-gpio: GPIO for battery detection.
>> +- io-channels: Specify the IIO ADC channel to get temperature.
>> +- io-channel-names: Should be "bat-temp".
>> +- sprd,inner-resist: Specify the the battery inner resistance (mOhm).
>
> This should be a property of the battery.without the sprd, prefix.

Right. But I did not find one proper property of the battery, so I
will add one new standard property of battery named
'inner-resistance-microohm' in next version. Is it OK for you?

>
>> +- sprd,ocv-cap-table: Provide the battery capacity percent with 
>> corresponding
>> +  open circuit voltage (ocv) of the battery, which is used to look up 
>> current
>> +  battery capacity according to current baterry ocv values.
>
> This should also be part of the battery binding. I just reviewed a
> patchset for the Qualcomm Battery Monitoring System, which needs the
> same functionality. The Qualcomm binding is more advanced, but
> should also support this simpler case. Thus I think it makes sense
> to use its description as base for adding support for this feature
> to Documentation/devicetree/bindings/power/supply/battery.txt

That's great. But could you give me the link of Qualcomm binding,
which I can change my bindings. Thanks for your comments.

-- 
Baolin Wang
Best Regards


Re: [PATCH] Documentation: soundwire: fix stream.rst markup warnings

2018-09-16 Thread Takashi Sakamoto

Hi,

On Sep 17 2018 09:34, Randy Dunlap wrote:

From: Randy Dunlap 

Fix kernel-doc markup warnings in soundwire/stream.rst:

rc4/Documentation/driver-api/soundwire/stream.rst:177: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:203: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:248: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:277: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:304: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:328: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:352: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:364: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.

Fixes: 89634f99a83e ("Documentation: soundwire: Add more documentation")

Signed-off-by: Randy Dunlap 
Cc: Pierre-Louis Bossart 
Cc: Sanyog Kale 
Cc: Shreyas NC 
Cc: Vinod Koul 
Cc: alsa-de...@alsa-project.org
Cc: linux-...@vger.kernel.org
---
  Documentation/driver-api/soundwire/stream.rst |8 
  1 file changed, 8 insertions(+)


Reviewed-by: Takashi Sakamoto 
Tested-by: Takashi Sakamoto 


Thanks

Takashi Sakamoto


Re: [PATCH] Documentation: soundwire: fix stream.rst markup warnings

2018-09-16 Thread Takashi Sakamoto

Hi,

On Sep 17 2018 09:34, Randy Dunlap wrote:

From: Randy Dunlap 

Fix kernel-doc markup warnings in soundwire/stream.rst:

rc4/Documentation/driver-api/soundwire/stream.rst:177: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:203: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:248: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:277: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:304: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:328: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:352: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.
rc4/Documentation/driver-api/soundwire/stream.rst:364: WARNING: Explicit markup 
ends without a blank line; unexpected unindent.

Fixes: 89634f99a83e ("Documentation: soundwire: Add more documentation")

Signed-off-by: Randy Dunlap 
Cc: Pierre-Louis Bossart 
Cc: Sanyog Kale 
Cc: Shreyas NC 
Cc: Vinod Koul 
Cc: alsa-de...@alsa-project.org
Cc: linux-...@vger.kernel.org
---
  Documentation/driver-api/soundwire/stream.rst |8 
  1 file changed, 8 insertions(+)


Reviewed-by: Takashi Sakamoto 
Tested-by: Takashi Sakamoto 


Thanks

Takashi Sakamoto


[PATCH AUTOSEL 4.18 003/136] tsl2550: fix lux1_input error in low light

2018-09-16 Thread Sasha Levin
From: Matt Ranostay 

[ Upstream commit ce054546cc2c26891cefa2f284d90d93b52205de ]

ADC channel 0 photodiode detects both infrared + visible light,
but ADC channel 1 just detects infrared. However, the latter is a bit
more sensitive in that range so complete darkness or low light causes
a error condition in which the chan0 - chan1 is negative that
results in a -EAGAIN.

This patch changes the resulting lux1_input sysfs attribute message from
"Resource temporarily unavailable" to a user-grokable lux value of 0.

Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Signed-off-by: Matt Ranostay 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/tsl2550.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
index adf46072cb37..3fce3b6a3624 100644
--- a/drivers/misc/tsl2550.c
+++ b/drivers/misc/tsl2550.c
@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
} else
lux = 0;
else
-   return -EAGAIN;
+   return 0;
 
/* LUX range check */
return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
-- 
2.17.1


[PATCH AUTOSEL 4.18 003/136] tsl2550: fix lux1_input error in low light

2018-09-16 Thread Sasha Levin
From: Matt Ranostay 

[ Upstream commit ce054546cc2c26891cefa2f284d90d93b52205de ]

ADC channel 0 photodiode detects both infrared + visible light,
but ADC channel 1 just detects infrared. However, the latter is a bit
more sensitive in that range so complete darkness or low light causes
a error condition in which the chan0 - chan1 is negative that
results in a -EAGAIN.

This patch changes the resulting lux1_input sysfs attribute message from
"Resource temporarily unavailable" to a user-grokable lux value of 0.

Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Signed-off-by: Matt Ranostay 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/tsl2550.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
index adf46072cb37..3fce3b6a3624 100644
--- a/drivers/misc/tsl2550.c
+++ b/drivers/misc/tsl2550.c
@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
} else
lux = 0;
else
-   return -EAGAIN;
+   return 0;
 
/* LUX range check */
return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
-- 
2.17.1


[PATCH AUTOSEL 4.18 005/136] vmci: type promotion bug in qp_host_get_user_memory()

2018-09-16 Thread Sasha Levin
From: Dan Carpenter 

[ Upstream commit 7fb2fd4e25fc1fb10dcb30b5519de257cfeae84c ]

The problem is that if get_user_pages_fast() fails and returns a
negative error code, it gets type promoted to a high positive value and
treated as a success.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c 
b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index b4d7774cfe07..d95e8648e7b3 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -668,7 +668,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
retval = get_user_pages_fast((uintptr_t) produce_uva,
 produce_q->kernel_if->num_pages, 1,
 produce_q->kernel_if->u.h.header_page);
-   if (retval < produce_q->kernel_if->num_pages) {
+   if (retval < (int)produce_q->kernel_if->num_pages) {
pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
retval);
qp_release_pages(produce_q->kernel_if->u.h.header_page,
@@ -680,7 +680,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
retval = get_user_pages_fast((uintptr_t) consume_uva,
 consume_q->kernel_if->num_pages, 1,
 consume_q->kernel_if->u.h.header_page);
-   if (retval < consume_q->kernel_if->num_pages) {
+   if (retval < (int)consume_q->kernel_if->num_pages) {
pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
retval);
qp_release_pages(consume_q->kernel_if->u.h.header_page,
-- 
2.17.1


[PATCH AUTOSEL 4.18 011/136] x86/numa_emulation: Fix emulated-to-physical node mapping

2018-09-16 Thread Sasha Levin
From: Dan Williams 

[ Upstream commit 3b6c62f363a19ce82bf378187ab97c9dc01e3927 ]

Without this change the distance table calculation for emulated nodes
may use the wrong numa node and report an incorrect distance.

Signed-off-by: Dan Williams 
Cc: David Rientjes 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Wei Yang 
Cc: linux...@kvack.org
Link: 
http://lkml.kernel.org/r/153089328103.27680.14778434392225818887.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 arch/x86/mm/numa_emulation.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
index 34a2a3bfde9c..22cbad56acab 100644
--- a/arch/x86/mm/numa_emulation.c
+++ b/arch/x86/mm/numa_emulation.c
@@ -61,7 +61,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei,
eb->nid = nid;
 
if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
-   emu_nid_to_phys[nid] = nid;
+   emu_nid_to_phys[nid] = pb->nid;
 
pb->start += size;
if (pb->start >= pb->end) {
-- 
2.17.1


[PATCH AUTOSEL 4.18 005/136] vmci: type promotion bug in qp_host_get_user_memory()

2018-09-16 Thread Sasha Levin
From: Dan Carpenter 

[ Upstream commit 7fb2fd4e25fc1fb10dcb30b5519de257cfeae84c ]

The problem is that if get_user_pages_fast() fails and returns a
negative error code, it gets type promoted to a high positive value and
treated as a success.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c 
b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index b4d7774cfe07..d95e8648e7b3 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -668,7 +668,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
retval = get_user_pages_fast((uintptr_t) produce_uva,
 produce_q->kernel_if->num_pages, 1,
 produce_q->kernel_if->u.h.header_page);
-   if (retval < produce_q->kernel_if->num_pages) {
+   if (retval < (int)produce_q->kernel_if->num_pages) {
pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
retval);
qp_release_pages(produce_q->kernel_if->u.h.header_page,
@@ -680,7 +680,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
retval = get_user_pages_fast((uintptr_t) consume_uva,
 consume_q->kernel_if->num_pages, 1,
 consume_q->kernel_if->u.h.header_page);
-   if (retval < consume_q->kernel_if->num_pages) {
+   if (retval < (int)consume_q->kernel_if->num_pages) {
pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
retval);
qp_release_pages(consume_q->kernel_if->u.h.header_page,
-- 
2.17.1


[PATCH AUTOSEL 4.18 011/136] x86/numa_emulation: Fix emulated-to-physical node mapping

2018-09-16 Thread Sasha Levin
From: Dan Williams 

[ Upstream commit 3b6c62f363a19ce82bf378187ab97c9dc01e3927 ]

Without this change the distance table calculation for emulated nodes
may use the wrong numa node and report an incorrect distance.

Signed-off-by: Dan Williams 
Cc: David Rientjes 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Wei Yang 
Cc: linux...@kvack.org
Link: 
http://lkml.kernel.org/r/153089328103.27680.14778434392225818887.st...@dwillia2-desk3.amr.corp.intel.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 arch/x86/mm/numa_emulation.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
index 34a2a3bfde9c..22cbad56acab 100644
--- a/arch/x86/mm/numa_emulation.c
+++ b/arch/x86/mm/numa_emulation.c
@@ -61,7 +61,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei,
eb->nid = nid;
 
if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
-   emu_nid_to_phys[nid] = nid;
+   emu_nid_to_phys[nid] = pb->nid;
 
pb->start += size;
if (pb->start >= pb->end) {
-- 
2.17.1


[PATCH AUTOSEL 4.18 014/136] misc: sram: enable clock before registering regions

2018-09-16 Thread Sasha Levin
From: Johan Hovold 

[ Upstream commit d5b9653dd2bb7a2b1c8cc783c5d3b607bbb6b271 ]

Make sure to enable the clock before registering regions and exporting
partitions to user space at which point we must be prepared for I/O.

Fixes: ee895ccdf776 ("misc: sram: fix enabled clock leak on error path")
Signed-off-by: Johan Hovold 
Reviewed-by: Vladimir Zapolskiy 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/sram.c | 13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index 679647713e36..74b183baf044 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -391,23 +391,23 @@ static int sram_probe(struct platform_device *pdev)
if (IS_ERR(sram->pool))
return PTR_ERR(sram->pool);
 
-   ret = sram_reserve_regions(sram, res);
-   if (ret)
-   return ret;
-
sram->clk = devm_clk_get(sram->dev, NULL);
if (IS_ERR(sram->clk))
sram->clk = NULL;
else
clk_prepare_enable(sram->clk);
 
+   ret = sram_reserve_regions(sram, res);
+   if (ret)
+   goto err_disable_clk;
+
platform_set_drvdata(pdev, sram);
 
init_func = of_device_get_match_data(>dev);
if (init_func) {
ret = init_func();
if (ret)
-   goto err_disable_clk;
+   goto err_free_partitions;
}
 
dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
@@ -415,10 +415,11 @@ static int sram_probe(struct platform_device *pdev)
 
return 0;
 
+err_free_partitions:
+   sram_free_partitions(sram);
 err_disable_clk:
if (sram->clk)
clk_disable_unprepare(sram->clk);
-   sram_free_partitions(sram);
 
return ret;
 }
-- 
2.17.1


[PATCH AUTOSEL 4.18 006/136] siox: don't create a thread without starting it

2018-09-16 Thread Sasha Levin
From: Uwe Kleine-König 

[ Upstream commit e890591413819eeb604207ad3261ba617b2ec0bb ]

When a siox master device is registered a kthread is created that is
only started when triggered by userspace. So this thread might be in
TASK_UNINTERRUPTIBLE state for long and trigger a warning

[  241.130465] INFO: task siox-0:626 blocked for more than 120 seconds.

with the respective debug settings enabled. It might be right to put an
unstarted thread to TASK_IDLE (in kernel/kthread.c:kthread()) instead,
but independant of this discussion it is cleaner for
siox_master_register() to start the thread immediately. The effect is
that it enters its own waiting state and then stays in state TASK_IDLE
which doesn't trigger the above warning.

As siox_poll_thread() uses some variables of the device the
initialisation of these is moved before thread creation.

Acked-by: Peter Zijlstra (Intel) 
Signed-off-by: Uwe Kleine-König 
Acked-by: Gavin Schenk 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/siox/siox-core.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/siox/siox-core.c b/drivers/siox/siox-core.c
index 16590dfaafa4..cef307c0399c 100644
--- a/drivers/siox/siox-core.c
+++ b/drivers/siox/siox-core.c
@@ -715,17 +715,17 @@ int siox_master_register(struct siox_master *smaster)
 
dev_set_name(>dev, "siox-%d", smaster->busno);
 
+   mutex_init(>lock);
+   INIT_LIST_HEAD(>devices);
+
smaster->last_poll = jiffies;
-   smaster->poll_thread = kthread_create(siox_poll_thread, smaster,
- "siox-%d", smaster->busno);
+   smaster->poll_thread = kthread_run(siox_poll_thread, smaster,
+  "siox-%d", smaster->busno);
if (IS_ERR(smaster->poll_thread)) {
smaster->active = 0;
return PTR_ERR(smaster->poll_thread);
}
 
-   mutex_init(>lock);
-   INIT_LIST_HEAD(>devices);
-
ret = device_add(>dev);
if (ret)
kthread_stop(smaster->poll_thread);
-- 
2.17.1


Re: [PATCH v3 3/3] i2c: designware: select gpio/default pin when prepare/unprepare recovery

2018-09-16 Thread Jisheng Zhang
+ DT maintainers

On Mon, 17 Sep 2018 11:29:49 +0800
Jisheng Zhang  wrote:

> On some platforms, the sda/scl pins are muxed with gpio functions, so
> they could be used for recovery. Select the gpio/default pin function
> when prepare/unprepare recovery.
> 
> Signed-off-by: Jisheng Zhang 
> ---
>  drivers/i2c/busses/i2c-designware-core.h   |  3 +++
>  drivers/i2c/busses/i2c-designware-master.c | 22 ++
>  2 files changed, 25 insertions(+)
> 
> diff --git a/drivers/i2c/busses/i2c-designware-core.h 
> b/drivers/i2c/busses/i2c-designware-core.h
> index e367b1af4ab2..01d5f01691a4 100644
> --- a/drivers/i2c/busses/i2c-designware-core.h
> +++ b/drivers/i2c/busses/i2c-designware-core.h
> @@ -271,6 +271,9 @@ struct dw_i2c_dev {
>   int (*init)(struct dw_i2c_dev *dev);
>   int mode;
>   struct i2c_bus_recovery_info rinfo;
> + struct pinctrl  *pinctrl;
> + struct pinctrl_state*pins_default;
> + struct pinctrl_state*pins_gpio;
>  };
>  
>  #define ACCESS_SWAP  0x0001
> diff --git a/drivers/i2c/busses/i2c-designware-master.c 
> b/drivers/i2c/busses/i2c-designware-master.c
> index 94d94b4a9a0d..384d6630366a 100644
> --- a/drivers/i2c/busses/i2c-designware-master.c
> +++ b/drivers/i2c/busses/i2c-designware-master.c
> @@ -17,6 +17,7 @@
>  #include 
>  #include 
>  #include 
> +#include 
>  #include 
>  #include 
>  
> @@ -629,6 +630,9 @@ static void i2c_dw_prepare_recovery(struct i2c_adapter 
> *adap)
>  {
>   struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
>  
> + if (dev->pinctrl && dev->pins_gpio)
> + pinctrl_select_state(dev->pinctrl, dev->pins_gpio);
> +
>   i2c_dw_disable(dev);
>   reset_control_assert(dev->rst);
>   i2c_dw_prepare_clk(dev, false);
> @@ -641,6 +645,9 @@ static void i2c_dw_unprepare_recovery(struct i2c_adapter 
> *adap)
>   i2c_dw_prepare_clk(dev, true);
>   reset_control_deassert(dev->rst);
>   i2c_dw_init_master(dev);
> +
> + if (dev->pinctrl && dev->pins_default)
> + pinctrl_select_state(dev->pinctrl, dev->pins_default);
>  }
>  
>  static int i2c_dw_init_recovery_info(struct dw_i2c_dev *dev)
> @@ -648,6 +655,8 @@ static int i2c_dw_init_recovery_info(struct dw_i2c_dev 
> *dev)
>   struct i2c_bus_recovery_info *rinfo = >rinfo;
>   struct i2c_adapter *adap = >adapter;
>   struct gpio_desc *gpio;
> + struct pinctrl *pinctrl;
> + struct pinctrl_state *s;
>   int r;
>  
>   gpio = devm_gpiod_get(dev->dev, "scl", GPIOD_OUT_HIGH);
> @@ -664,6 +673,19 @@ static int i2c_dw_init_recovery_info(struct dw_i2c_dev 
> *dev)
>   return PTR_ERR(gpio);
>   rinfo->sda_gpiod = gpio;
>  
> + pinctrl = devm_pinctrl_get(dev->dev);
> + if (PTR_ERR(pinctrl) == -EPROBE_DEFER)
> + return -EPROBE_DEFER;
> + if (!IS_ERR_OR_NULL(pinctrl)) {
> + dev->pinctrl = pinctrl;
> + s = pinctrl_lookup_state(pinctrl, PINCTRL_STATE_DEFAULT);
> + if (!IS_ERR_OR_NULL(s))
> + dev->pins_default = s;
> + s = pinctrl_lookup_state(pinctrl, "gpio");
> + if (!IS_ERR_OR_NULL(s))
> + dev->pins_gpio = s;
> + }
> +
>   rinfo->recover_bus = i2c_generic_scl_recovery;
>   rinfo->prepare_recovery = i2c_dw_prepare_recovery;
>   rinfo->unprepare_recovery = i2c_dw_unprepare_recovery;



[PATCH AUTOSEL 4.18 014/136] misc: sram: enable clock before registering regions

2018-09-16 Thread Sasha Levin
From: Johan Hovold 

[ Upstream commit d5b9653dd2bb7a2b1c8cc783c5d3b607bbb6b271 ]

Make sure to enable the clock before registering regions and exporting
partitions to user space at which point we must be prepared for I/O.

Fixes: ee895ccdf776 ("misc: sram: fix enabled clock leak on error path")
Signed-off-by: Johan Hovold 
Reviewed-by: Vladimir Zapolskiy 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/sram.c | 13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index 679647713e36..74b183baf044 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -391,23 +391,23 @@ static int sram_probe(struct platform_device *pdev)
if (IS_ERR(sram->pool))
return PTR_ERR(sram->pool);
 
-   ret = sram_reserve_regions(sram, res);
-   if (ret)
-   return ret;
-
sram->clk = devm_clk_get(sram->dev, NULL);
if (IS_ERR(sram->clk))
sram->clk = NULL;
else
clk_prepare_enable(sram->clk);
 
+   ret = sram_reserve_regions(sram, res);
+   if (ret)
+   goto err_disable_clk;
+
platform_set_drvdata(pdev, sram);
 
init_func = of_device_get_match_data(>dev);
if (init_func) {
ret = init_func();
if (ret)
-   goto err_disable_clk;
+   goto err_free_partitions;
}
 
dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
@@ -415,10 +415,11 @@ static int sram_probe(struct platform_device *pdev)
 
return 0;
 
+err_free_partitions:
+   sram_free_partitions(sram);
 err_disable_clk:
if (sram->clk)
clk_disable_unprepare(sram->clk);
-   sram_free_partitions(sram);
 
return ret;
 }
-- 
2.17.1


[PATCH AUTOSEL 4.18 006/136] siox: don't create a thread without starting it

2018-09-16 Thread Sasha Levin
From: Uwe Kleine-König 

[ Upstream commit e890591413819eeb604207ad3261ba617b2ec0bb ]

When a siox master device is registered a kthread is created that is
only started when triggered by userspace. So this thread might be in
TASK_UNINTERRUPTIBLE state for long and trigger a warning

[  241.130465] INFO: task siox-0:626 blocked for more than 120 seconds.

with the respective debug settings enabled. It might be right to put an
unstarted thread to TASK_IDLE (in kernel/kthread.c:kthread()) instead,
but independant of this discussion it is cleaner for
siox_master_register() to start the thread immediately. The effect is
that it enters its own waiting state and then stays in state TASK_IDLE
which doesn't trigger the above warning.

As siox_poll_thread() uses some variables of the device the
initialisation of these is moved before thread creation.

Acked-by: Peter Zijlstra (Intel) 
Signed-off-by: Uwe Kleine-König 
Acked-by: Gavin Schenk 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/siox/siox-core.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/siox/siox-core.c b/drivers/siox/siox-core.c
index 16590dfaafa4..cef307c0399c 100644
--- a/drivers/siox/siox-core.c
+++ b/drivers/siox/siox-core.c
@@ -715,17 +715,17 @@ int siox_master_register(struct siox_master *smaster)
 
dev_set_name(>dev, "siox-%d", smaster->busno);
 
+   mutex_init(>lock);
+   INIT_LIST_HEAD(>devices);
+
smaster->last_poll = jiffies;
-   smaster->poll_thread = kthread_create(siox_poll_thread, smaster,
- "siox-%d", smaster->busno);
+   smaster->poll_thread = kthread_run(siox_poll_thread, smaster,
+  "siox-%d", smaster->busno);
if (IS_ERR(smaster->poll_thread)) {
smaster->active = 0;
return PTR_ERR(smaster->poll_thread);
}
 
-   mutex_init(>lock);
-   INIT_LIST_HEAD(>devices);
-
ret = device_add(>dev);
if (ret)
kthread_stop(smaster->poll_thread);
-- 
2.17.1


Re: [PATCH v3 3/3] i2c: designware: select gpio/default pin when prepare/unprepare recovery

2018-09-16 Thread Jisheng Zhang
+ DT maintainers

On Mon, 17 Sep 2018 11:29:49 +0800
Jisheng Zhang  wrote:

> On some platforms, the sda/scl pins are muxed with gpio functions, so
> they could be used for recovery. Select the gpio/default pin function
> when prepare/unprepare recovery.
> 
> Signed-off-by: Jisheng Zhang 
> ---
>  drivers/i2c/busses/i2c-designware-core.h   |  3 +++
>  drivers/i2c/busses/i2c-designware-master.c | 22 ++
>  2 files changed, 25 insertions(+)
> 
> diff --git a/drivers/i2c/busses/i2c-designware-core.h 
> b/drivers/i2c/busses/i2c-designware-core.h
> index e367b1af4ab2..01d5f01691a4 100644
> --- a/drivers/i2c/busses/i2c-designware-core.h
> +++ b/drivers/i2c/busses/i2c-designware-core.h
> @@ -271,6 +271,9 @@ struct dw_i2c_dev {
>   int (*init)(struct dw_i2c_dev *dev);
>   int mode;
>   struct i2c_bus_recovery_info rinfo;
> + struct pinctrl  *pinctrl;
> + struct pinctrl_state*pins_default;
> + struct pinctrl_state*pins_gpio;
>  };
>  
>  #define ACCESS_SWAP  0x0001
> diff --git a/drivers/i2c/busses/i2c-designware-master.c 
> b/drivers/i2c/busses/i2c-designware-master.c
> index 94d94b4a9a0d..384d6630366a 100644
> --- a/drivers/i2c/busses/i2c-designware-master.c
> +++ b/drivers/i2c/busses/i2c-designware-master.c
> @@ -17,6 +17,7 @@
>  #include 
>  #include 
>  #include 
> +#include 
>  #include 
>  #include 
>  
> @@ -629,6 +630,9 @@ static void i2c_dw_prepare_recovery(struct i2c_adapter 
> *adap)
>  {
>   struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
>  
> + if (dev->pinctrl && dev->pins_gpio)
> + pinctrl_select_state(dev->pinctrl, dev->pins_gpio);
> +
>   i2c_dw_disable(dev);
>   reset_control_assert(dev->rst);
>   i2c_dw_prepare_clk(dev, false);
> @@ -641,6 +645,9 @@ static void i2c_dw_unprepare_recovery(struct i2c_adapter 
> *adap)
>   i2c_dw_prepare_clk(dev, true);
>   reset_control_deassert(dev->rst);
>   i2c_dw_init_master(dev);
> +
> + if (dev->pinctrl && dev->pins_default)
> + pinctrl_select_state(dev->pinctrl, dev->pins_default);
>  }
>  
>  static int i2c_dw_init_recovery_info(struct dw_i2c_dev *dev)
> @@ -648,6 +655,8 @@ static int i2c_dw_init_recovery_info(struct dw_i2c_dev 
> *dev)
>   struct i2c_bus_recovery_info *rinfo = >rinfo;
>   struct i2c_adapter *adap = >adapter;
>   struct gpio_desc *gpio;
> + struct pinctrl *pinctrl;
> + struct pinctrl_state *s;
>   int r;
>  
>   gpio = devm_gpiod_get(dev->dev, "scl", GPIOD_OUT_HIGH);
> @@ -664,6 +673,19 @@ static int i2c_dw_init_recovery_info(struct dw_i2c_dev 
> *dev)
>   return PTR_ERR(gpio);
>   rinfo->sda_gpiod = gpio;
>  
> + pinctrl = devm_pinctrl_get(dev->dev);
> + if (PTR_ERR(pinctrl) == -EPROBE_DEFER)
> + return -EPROBE_DEFER;
> + if (!IS_ERR_OR_NULL(pinctrl)) {
> + dev->pinctrl = pinctrl;
> + s = pinctrl_lookup_state(pinctrl, PINCTRL_STATE_DEFAULT);
> + if (!IS_ERR_OR_NULL(s))
> + dev->pins_default = s;
> + s = pinctrl_lookup_state(pinctrl, "gpio");
> + if (!IS_ERR_OR_NULL(s))
> + dev->pins_gpio = s;
> + }
> +
>   rinfo->recover_bus = i2c_generic_scl_recovery;
>   rinfo->prepare_recovery = i2c_dw_prepare_recovery;
>   rinfo->unprepare_recovery = i2c_dw_unprepare_recovery;



[PATCH AUTOSEL 4.18 009/136] net: hns3: Fix warning bug when doing lp selftest

2018-09-16 Thread Sasha Levin
From: Yunsheng Lin 

[ Upstream commit d7099d15478e89edb9bc6c6e3ab4cd341884a367 ]

The napi_alloc_skb is excepted to be called under the
non-preemptible code path when it is called by hns3_clean_rx_ring
during loopback selftest, otherwise the below warning will be
logged:

[   92.420780] BUG: using smp_processor_id() in preemptible
[] code: ethtool/1873

[   92.463202]  check_preemption_disabled+0xf8/0x100
[   92.467893]  debug_smp_processor_id+0x1c/0x28
[   92.472239]  __napi_alloc_skb+0x30/0x130
[   92.476158]  hns3_clean_rx_ring+0x118/0x5f0 [hns3]
[   92.480941]  hns3_self_test+0x32c/0x4d0 [hns3]
[   92.485375]  ethtool_self_test+0xdc/0x1e8
[   92.489372]  dev_ethtool+0x1020/0x1da8
[   92.493109]  dev_ioctl+0x188/0x3a0
[   92.496499]  sock_do_ioctl+0xf4/0x208
[   92.500148]  sock_ioctl+0x228/0x3e8
[   92.503626]  do_vfs_ioctl+0xc4/0x880
[   92.507189]  SyS_ioctl+0x94/0xa8
[   92.510404]  el0_svc_naked+0x30/0x34

This patch fix it by disabling preemption when calling
hns3_clean_rx_ring during loopback selftest.

Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 
driver")
Signed-off-by: Yunsheng Lin 
Signed-off-by: Peng Li 
Signed-off-by: Salil Mehta 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c 
b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 40c0425b4023..11620e003a8e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -201,7 +201,9 @@ static u32 hns3_lb_check_rx_ring(struct hns3_nic_priv 
*priv, u32 budget)
rx_group = >tqp_vector->rx_group;
pre_rx_pkt = rx_group->total_packets;
 
+   preempt_disable();
hns3_clean_rx_ring(ring, budget, hns3_lb_check_skb_data);
+   preempt_enable();
 
rcv_good_pkt_total += (rx_group->total_packets - pre_rx_pkt);
rx_group->total_packets = pre_rx_pkt;
-- 
2.17.1


[PATCH AUTOSEL 4.18 018/136] iommu/amd: make sure TLB to be flushed before IOVA freed

2018-09-16 Thread Sasha Levin
From: Zhen Lei 

[ Upstream commit 3c120143f584360a13614787e23ae2cdcb5e5ccd ]

Although the mapping has already been removed in the page table, it maybe
still exist in TLB. Suppose the freed IOVAs is reused by others before the
flush operation completed, the new user can not correctly access to its
meomory.

Signed-off-by: Zhen Lei 
Fixes: b1516a14657a ('iommu/amd: Implement flush queue')
Signed-off-by: Joerg Roedel 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/amd_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 596b95c50051..d77c97fe4a23 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2405,9 +2405,9 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
}
 
if (amd_iommu_unmap_flush) {
-   dma_ops_free_iova(dma_dom, dma_addr, pages);
domain_flush_tlb(_dom->domain);
domain_flush_complete(_dom->domain);
+   dma_ops_free_iova(dma_dom, dma_addr, pages);
} else {
pages = __roundup_pow_of_two(pages);
queue_iova(_dom->iovad, dma_addr >> PAGE_SHIFT, pages, 0);
-- 
2.17.1


[PATCH AUTOSEL 4.18 020/136] USB: serial: kobil_sct: fix modem-status error handling

2018-09-16 Thread Sasha Levin
From: Johan Hovold 

[ Upstream commit a420b5d939ee58f1d950f0ea782834056520aeaa ]

Make sure to return -EIO in case of a short modem-status read request.

While at it, split the debug message to not include the (zeroed)
transfer-buffer content in case of errors.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin 
---
 drivers/usb/serial/kobil_sct.c | 12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index a31ea7e194dd..a6ebed1e0f20 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -393,12 +393,20 @@ static int kobil_tiocmget(struct tty_struct *tty)
  transfer_buffer_length,
  KOBIL_TIMEOUT);
 
-   dev_dbg(>dev, "%s - Send get_status_line_state URB returns: %i. 
Statusline: %02x\n",
-   __func__, result, transfer_buffer[0]);
+   dev_dbg(>dev, "Send get_status_line_state URB returns: %i\n",
+   result);
+   if (result < 1) {
+   if (result >= 0)
+   result = -EIO;
+   goto out_free;
+   }
+
+   dev_dbg(>dev, "Statusline: %02x\n", transfer_buffer[0]);
 
result = 0;
if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
result = TIOCM_DSR;
+out_free:
kfree(transfer_buffer);
return result;
 }
-- 
2.17.1


[PATCH AUTOSEL 4.18 009/136] net: hns3: Fix warning bug when doing lp selftest

2018-09-16 Thread Sasha Levin
From: Yunsheng Lin 

[ Upstream commit d7099d15478e89edb9bc6c6e3ab4cd341884a367 ]

The napi_alloc_skb is excepted to be called under the
non-preemptible code path when it is called by hns3_clean_rx_ring
during loopback selftest, otherwise the below warning will be
logged:

[   92.420780] BUG: using smp_processor_id() in preemptible
[] code: ethtool/1873

[   92.463202]  check_preemption_disabled+0xf8/0x100
[   92.467893]  debug_smp_processor_id+0x1c/0x28
[   92.472239]  __napi_alloc_skb+0x30/0x130
[   92.476158]  hns3_clean_rx_ring+0x118/0x5f0 [hns3]
[   92.480941]  hns3_self_test+0x32c/0x4d0 [hns3]
[   92.485375]  ethtool_self_test+0xdc/0x1e8
[   92.489372]  dev_ethtool+0x1020/0x1da8
[   92.493109]  dev_ioctl+0x188/0x3a0
[   92.496499]  sock_do_ioctl+0xf4/0x208
[   92.500148]  sock_ioctl+0x228/0x3e8
[   92.503626]  do_vfs_ioctl+0xc4/0x880
[   92.507189]  SyS_ioctl+0x94/0xa8
[   92.510404]  el0_svc_naked+0x30/0x34

This patch fix it by disabling preemption when calling
hns3_clean_rx_ring during loopback selftest.

Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 
driver")
Signed-off-by: Yunsheng Lin 
Signed-off-by: Peng Li 
Signed-off-by: Salil Mehta 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c 
b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 40c0425b4023..11620e003a8e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -201,7 +201,9 @@ static u32 hns3_lb_check_rx_ring(struct hns3_nic_priv 
*priv, u32 budget)
rx_group = >tqp_vector->rx_group;
pre_rx_pkt = rx_group->total_packets;
 
+   preempt_disable();
hns3_clean_rx_ring(ring, budget, hns3_lb_check_skb_data);
+   preempt_enable();
 
rcv_good_pkt_total += (rx_group->total_packets - pre_rx_pkt);
rx_group->total_packets = pre_rx_pkt;
-- 
2.17.1


[PATCH AUTOSEL 4.18 018/136] iommu/amd: make sure TLB to be flushed before IOVA freed

2018-09-16 Thread Sasha Levin
From: Zhen Lei 

[ Upstream commit 3c120143f584360a13614787e23ae2cdcb5e5ccd ]

Although the mapping has already been removed in the page table, it maybe
still exist in TLB. Suppose the freed IOVAs is reused by others before the
flush operation completed, the new user can not correctly access to its
meomory.

Signed-off-by: Zhen Lei 
Fixes: b1516a14657a ('iommu/amd: Implement flush queue')
Signed-off-by: Joerg Roedel 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/amd_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 596b95c50051..d77c97fe4a23 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -2405,9 +2405,9 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
}
 
if (amd_iommu_unmap_flush) {
-   dma_ops_free_iova(dma_dom, dma_addr, pages);
domain_flush_tlb(_dom->domain);
domain_flush_complete(_dom->domain);
+   dma_ops_free_iova(dma_dom, dma_addr, pages);
} else {
pages = __roundup_pow_of_two(pages);
queue_iova(_dom->iovad, dma_addr >> PAGE_SHIFT, pages, 0);
-- 
2.17.1


[PATCH AUTOSEL 4.18 020/136] USB: serial: kobil_sct: fix modem-status error handling

2018-09-16 Thread Sasha Levin
From: Johan Hovold 

[ Upstream commit a420b5d939ee58f1d950f0ea782834056520aeaa ]

Make sure to return -EIO in case of a short modem-status read request.

While at it, split the debug message to not include the (zeroed)
transfer-buffer content in case of errors.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin 
---
 drivers/usb/serial/kobil_sct.c | 12 ++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index a31ea7e194dd..a6ebed1e0f20 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -393,12 +393,20 @@ static int kobil_tiocmget(struct tty_struct *tty)
  transfer_buffer_length,
  KOBIL_TIMEOUT);
 
-   dev_dbg(>dev, "%s - Send get_status_line_state URB returns: %i. 
Statusline: %02x\n",
-   __func__, result, transfer_buffer[0]);
+   dev_dbg(>dev, "Send get_status_line_state URB returns: %i\n",
+   result);
+   if (result < 1) {
+   if (result >= 0)
+   result = -EIO;
+   goto out_free;
+   }
+
+   dev_dbg(>dev, "Statusline: %02x\n", transfer_buffer[0]);
 
result = 0;
if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
result = TIOCM_DSR;
+out_free:
kfree(transfer_buffer);
return result;
 }
-- 
2.17.1


[PATCH AUTOSEL 4.18 019/136] Bluetooth: Add a new Realtek 8723DE ID 0bda:b009

2018-09-16 Thread Sasha Levin
From: Jian-Hong Pan 

[ Upstream commit 45ae68b8cfc25bdbffc11248001c47ab1b76ff6e ]

Without this patch we cannot turn on the Bluethooth adapter on HP
14-bs007la.

T:  Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=b009 Rev= 2.00
S:  Manufacturer=Realtek
S:  Product=802.11n WLAN Adapter
S:  SerialNumber=00e04c01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Jian-Hong Pan 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin 
---
 drivers/bluetooth/btusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f73a27ea28cc..75947f04fc75 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -374,6 +374,7 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 
/* Additional Realtek 8723DE Bluetooth devices */
+   { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 
/* Additional Realtek 8821AE Bluetooth devices */
-- 
2.17.1


[PATCH AUTOSEL 4.18 013/136] power: supply: axp288_charger: Fix initial constant_charge_current value

2018-09-16 Thread Sasha Levin
From: Hans de Goede 

[ Upstream commit f2a42595f0865886a2d40524b0e9d15600848670 ]

We should look at val which contains the value read from the register,
not ret which is always 0 on a successful read.

Signed-off-by: Hans de Goede 
Fixes: eac53b3664f59 ("power: supply: axp288_charger: Drop platform_data 
dependency")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin 
---
 drivers/power/supply/axp288_charger.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/axp288_charger.c 
b/drivers/power/supply/axp288_charger.c
index 6e1bc14c3304..735658ee1c60 100644
--- a/drivers/power/supply/axp288_charger.c
+++ b/drivers/power/supply/axp288_charger.c
@@ -718,7 +718,7 @@ static int charger_init_hw_regs(struct axp288_chrg_info 
*info)
}
 
/* Determine charge current limit */
-   cc = (ret & CHRG_CCCV_CC_MASK) >> CHRG_CCCV_CC_BIT_POS;
+   cc = (val & CHRG_CCCV_CC_MASK) >> CHRG_CCCV_CC_BIT_POS;
cc = (cc * CHRG_CCCV_CC_LSB_RES) + CHRG_CCCV_CC_OFFSET;
info->cc = cc;
 
-- 
2.17.1


[PATCH AUTOSEL 4.18 016/136] uwb: hwa-rc: fix memory leak at probe

2018-09-16 Thread Sasha Levin
From: Anton Vasilyev 

[ Upstream commit 11b71782c1d10d9bccc31825cf84291cd7588a1e ]

hwarc_probe() allocates memory for hwarc, but does not free it
if uwb_rc_add() or hwarc_get_version() fail.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/uwb/hwa-rc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 9a53912bdfe9..5d3ba747ae17 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -873,6 +873,7 @@ static int hwarc_probe(struct usb_interface *iface,
 error_rc_add:
usb_put_intf(iface);
usb_put_dev(hwarc->usb_dev);
+   kfree(hwarc);
 error_alloc:
uwb_rc_put(uwb_rc);
 error_rc_alloc:
-- 
2.17.1


Re: [PATCH v3 2/3] dt-bindings: i2c: designware: add optional pinctrl for bus recovery

2018-09-16 Thread Jisheng Zhang
+ DT maintainers

On Mon, 17 Sep 2018 11:28:30 +0800
Jisheng Zhang  wrote:

> Document the pinctrl property for bus recovery.
> 
> Signed-off-by: Jisheng Zhang 
> ---
>  Documentation/devicetree/bindings/i2c/i2c-designware.txt | 6 ++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/i2c/i2c-designware.txt 
> b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> index 1d6a6a8061ba..c1544d1f7b55 100644
> --- a/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> +++ b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> @@ -24,6 +24,9 @@ Optional properties :
>  
>   - sda-gpios: specify the gpio of the SDA line for gpio recovery
>  
> + - pinctrl: add extra pinctrl to configure i2c pins to gpio function for i2c
> +   bus recovery, call it "gpio" state
> +
>  Examples :
>  
>   i2c@f {
> @@ -46,6 +49,9 @@ Examples :
>   i2c-sda-hold-time-ns = <300>;
>   i2c-sda-falling-time-ns = <300>;
>   i2c-scl-falling-time-ns = <300>;
> + pinctrl-names = "default", "gpio";
> + pinctrl-0 = <_i2c1>;
> + pinctrl-1 = <_i2c1_gpio>;
>   scl-gpios = < 15 GPIO_ACTIVE_HIGH>;
>   sda-gpios = < 16 GPIO_ACTIVE_HIGH>;
>   };



[PATCH AUTOSEL 4.18 019/136] Bluetooth: Add a new Realtek 8723DE ID 0bda:b009

2018-09-16 Thread Sasha Levin
From: Jian-Hong Pan 

[ Upstream commit 45ae68b8cfc25bdbffc11248001c47ab1b76ff6e ]

Without this patch we cannot turn on the Bluethooth adapter on HP
14-bs007la.

T:  Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#=  4 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=b009 Rev= 2.00
S:  Manufacturer=Realtek
S:  Product=802.11n WLAN Adapter
S:  SerialNumber=00e04c01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Jian-Hong Pan 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Sasha Levin 
---
 drivers/bluetooth/btusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f73a27ea28cc..75947f04fc75 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -374,6 +374,7 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 
/* Additional Realtek 8723DE Bluetooth devices */
+   { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 
/* Additional Realtek 8821AE Bluetooth devices */
-- 
2.17.1


[PATCH AUTOSEL 4.18 013/136] power: supply: axp288_charger: Fix initial constant_charge_current value

2018-09-16 Thread Sasha Levin
From: Hans de Goede 

[ Upstream commit f2a42595f0865886a2d40524b0e9d15600848670 ]

We should look at val which contains the value read from the register,
not ret which is always 0 on a successful read.

Signed-off-by: Hans de Goede 
Fixes: eac53b3664f59 ("power: supply: axp288_charger: Drop platform_data 
dependency")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin 
---
 drivers/power/supply/axp288_charger.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/axp288_charger.c 
b/drivers/power/supply/axp288_charger.c
index 6e1bc14c3304..735658ee1c60 100644
--- a/drivers/power/supply/axp288_charger.c
+++ b/drivers/power/supply/axp288_charger.c
@@ -718,7 +718,7 @@ static int charger_init_hw_regs(struct axp288_chrg_info 
*info)
}
 
/* Determine charge current limit */
-   cc = (ret & CHRG_CCCV_CC_MASK) >> CHRG_CCCV_CC_BIT_POS;
+   cc = (val & CHRG_CCCV_CC_MASK) >> CHRG_CCCV_CC_BIT_POS;
cc = (cc * CHRG_CCCV_CC_LSB_RES) + CHRG_CCCV_CC_OFFSET;
info->cc = cc;
 
-- 
2.17.1


[PATCH AUTOSEL 4.18 016/136] uwb: hwa-rc: fix memory leak at probe

2018-09-16 Thread Sasha Levin
From: Anton Vasilyev 

[ Upstream commit 11b71782c1d10d9bccc31825cf84291cd7588a1e ]

hwarc_probe() allocates memory for hwarc, but does not free it
if uwb_rc_add() or hwarc_get_version() fail.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/uwb/hwa-rc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 9a53912bdfe9..5d3ba747ae17 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -873,6 +873,7 @@ static int hwarc_probe(struct usb_interface *iface,
 error_rc_add:
usb_put_intf(iface);
usb_put_dev(hwarc->usb_dev);
+   kfree(hwarc);
 error_alloc:
uwb_rc_put(uwb_rc);
 error_rc_alloc:
-- 
2.17.1


Re: [PATCH v3 2/3] dt-bindings: i2c: designware: add optional pinctrl for bus recovery

2018-09-16 Thread Jisheng Zhang
+ DT maintainers

On Mon, 17 Sep 2018 11:28:30 +0800
Jisheng Zhang  wrote:

> Document the pinctrl property for bus recovery.
> 
> Signed-off-by: Jisheng Zhang 
> ---
>  Documentation/devicetree/bindings/i2c/i2c-designware.txt | 6 ++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/i2c/i2c-designware.txt 
> b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> index 1d6a6a8061ba..c1544d1f7b55 100644
> --- a/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> +++ b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> @@ -24,6 +24,9 @@ Optional properties :
>  
>   - sda-gpios: specify the gpio of the SDA line for gpio recovery
>  
> + - pinctrl: add extra pinctrl to configure i2c pins to gpio function for i2c
> +   bus recovery, call it "gpio" state
> +
>  Examples :
>  
>   i2c@f {
> @@ -46,6 +49,9 @@ Examples :
>   i2c-sda-hold-time-ns = <300>;
>   i2c-sda-falling-time-ns = <300>;
>   i2c-scl-falling-time-ns = <300>;
> + pinctrl-names = "default", "gpio";
> + pinctrl-0 = <_i2c1>;
> + pinctrl-1 = <_i2c1_gpio>;
>   scl-gpios = < 15 GPIO_ACTIVE_HIGH>;
>   sda-gpios = < 16 GPIO_ACTIVE_HIGH>;
>   };



Re: [PATCH v3 1/3] dt-bindings: i2c: designware: add optional gpio recovery properties

2018-09-16 Thread Jisheng Zhang
+ DT maintainers

On Mon, 17 Sep 2018 11:27:41 +0800
Jisheng Zhang  wrote:

> Document the scl-gpios and sda-gpios properties for bus recovery.
> 
> Signed-off-by: Jisheng Zhang 
> ---
>  Documentation/devicetree/bindings/i2c/i2c-designware.txt | 6 ++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/i2c/i2c-designware.txt 
> b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> index fbb0a6d8b964..1d6a6a8061ba 100644
> --- a/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> +++ b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> @@ -20,6 +20,10 @@ Optional properties :
>   - i2c-sda-falling-time-ns : should contain the SDA falling time in 
> nanoseconds.
> This value which is by default 300ns is used to compute the tHIGH period.
>  
> + - scl-gpios: specify the gpio of the SCL line for gpio recovery
> +
> + - sda-gpios: specify the gpio of the SDA line for gpio recovery
> +
>  Examples :
>  
>   i2c@f {
> @@ -42,6 +46,8 @@ Examples :
>   i2c-sda-hold-time-ns = <300>;
>   i2c-sda-falling-time-ns = <300>;
>   i2c-scl-falling-time-ns = <300>;
> + scl-gpios = < 15 GPIO_ACTIVE_HIGH>;
> + sda-gpios = < 16 GPIO_ACTIVE_HIGH>;
>   };
>  
>   i2c@112 {



[PATCH AUTOSEL 4.18 024/136] power: remove possible deadlock when unregistering power_supply

2018-09-16 Thread Sasha Levin
From: Benjamin Tissoires 

[ Upstream commit 3ffa6583e24e1ad1abab836d24bfc9d2308074e5 ]

If a device gets removed right after having registered a power_supply node,
we might enter in a deadlock between the remove call (that has a lock on
the parent device) and the deferred register work.

Allow the deferred register work to exit without taking the lock when
we are in the remove state.

Stack trace on a Ubuntu 16.04:

[16072.109121] INFO: task kworker/u16:2:1180 blocked for more than 120 seconds.
[16072.109127]   Not tainted 4.13.0-41-generic #46~16.04.1-Ubuntu
[16072.109129] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this 
message.
[16072.109132] kworker/u16:2   D0  1180  2 0x8000
[16072.109142] Workqueue: events_power_efficient 
power_supply_deferred_register_work
[16072.109144] Call Trace:
[16072.109152]  __schedule+0x3d6/0x8b0
[16072.109155]  schedule+0x36/0x80
[16072.109158]  schedule_preempt_disabled+0xe/0x10
[16072.109161]  __mutex_lock.isra.2+0x2ab/0x4e0
[16072.109166]  __mutex_lock_slowpath+0x13/0x20
[16072.109168]  ? __mutex_lock_slowpath+0x13/0x20
[16072.109171]  mutex_lock+0x2f/0x40
[16072.109174]  power_supply_deferred_register_work+0x2b/0x50
[16072.109179]  process_one_work+0x15b/0x410
[16072.109182]  worker_thread+0x4b/0x460
[16072.109186]  kthread+0x10c/0x140
[16072.109189]  ? process_one_work+0x410/0x410
[16072.109191]  ? kthread_create_on_node+0x70/0x70
[16072.109194]  ret_from_fork+0x35/0x40
[16072.109199] INFO: task test:2257 blocked for more than 120 seconds.
[16072.109202]   Not tainted 4.13.0-41-generic #46~16.04.1-Ubuntu
[16072.109204] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this 
message.
[16072.109206] testD0  2257   2256 0x0004
[16072.109208] Call Trace:
[16072.109211]  __schedule+0x3d6/0x8b0
[16072.109215]  schedule+0x36/0x80
[16072.109218]  schedule_timeout+0x1f3/0x360
[16072.109221]  ? check_preempt_curr+0x5a/0xa0
[16072.109224]  ? ttwu_do_wakeup+0x1e/0x150
[16072.109227]  wait_for_completion+0xb4/0x140
[16072.109230]  ? wait_for_completion+0xb4/0x140
[16072.109233]  ? wake_up_q+0x70/0x70
[16072.109236]  flush_work+0x129/0x1e0
[16072.109240]  ? worker_detach_from_pool+0xb0/0xb0
[16072.109243]  __cancel_work_timer+0x10f/0x190
[16072.109247]  ? device_del+0x264/0x310
[16072.109250]  ? __wake_up+0x44/0x50
[16072.109253]  cancel_delayed_work_sync+0x13/0x20
[16072.109257]  power_supply_unregister+0x37/0xb0
[16072.109260]  devm_power_supply_release+0x11/0x20
[16072.109263]  release_nodes+0x110/0x200
[16072.109266]  devres_release_group+0x7c/0xb0
[16072.109274]  wacom_remove+0xc2/0x110 [wacom]
[16072.109279]  hid_device_remove+0x6e/0xd0 [hid]
[16072.109284]  device_release_driver_internal+0x158/0x210
[16072.109288]  device_release_driver+0x12/0x20
[16072.109291]  bus_remove_device+0xec/0x160
[16072.109293]  device_del+0x1de/0x310
[16072.109298]  hid_destroy_device+0x27/0x60 [hid]
[16072.109303]  usbhid_disconnect+0x51/0x70 [usbhid]
[16072.109308]  usb_unbind_interface+0x77/0x270
[16072.109311]  device_release_driver_internal+0x158/0x210
[16072.109315]  device_release_driver+0x12/0x20
[16072.109318]  usb_driver_release_interface+0x77/0x80
[16072.109321]  proc_ioctl+0x20f/0x250
[16072.109325]  usbdev_do_ioctl+0x57f/0x1140
[16072.109327]  ? __wake_up+0x44/0x50
[16072.109331]  usbdev_ioctl+0xe/0x20
[16072.109336]  do_vfs_ioctl+0xa4/0x600
[16072.109339]  ? vfs_write+0x15a/0x1b0
[16072.109343]  SyS_ioctl+0x79/0x90
[16072.109347]  entry_SYSCALL_64_fastpath+0x24/0xab
[16072.109349] RIP: 0033:0x7f20da807f47
[16072.109351] RSP: 002b:7ffc422ae398 EFLAGS: 0246 ORIG_RAX: 
0010
[16072.109353] RAX: ffda RBX: 010b8560 RCX: 7f20da807f47
[16072.109355] RDX: 7ffc422ae3a0 RSI: c0105512 RDI: 0009
[16072.109356] RBP:  R08: 7ffc422ae3e0 R09: 0010
[16072.109357] R10: 00a6 R11: 0246 R12: 
[16072.109359] R13: 010b8560 R14: 7ffc422ae2e0 R15: 

Reported-and-tested-by: Richard Hughes 
Tested-by: Aaron Skomra 
Signed-off-by: Benjamin Tissoires 
Fixes: 7f1a57fdd6cb ("power_supply: Fix possible NULL pointer dereference on 
early uevent")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin 
---
 drivers/power/supply/power_supply_core.c | 11 +--
 include/linux/power_supply.h |  1 +
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c 
b/drivers/power/supply/power_supply_core.c
index d21f478741c1..e85361878450 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -14,6 +14,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -140,8 +141,13 @@ static void power_supply_deferred_register_work(struct 
work_struct *work)
struct power_supply *psy = container_of(work, struct power_supply,

[PATCH AUTOSEL 4.18 012/136] staging: rts5208: fix missing error check on call to rtsx_write_register

2018-09-16 Thread Sasha Levin
From: Colin Ian King 

[ Upstream commit c5fae4f4fd28189b1062fb8ef7b21fec37cb8b17 ]

Currently the check on error return from the call to rtsx_write_register
is checking the error status from the previous call. Fix this by adding
in the missing assignment of retval.

Detected by CoverityScan, CID#709877

Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288")
Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/staging/rts5208/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
index d548bc695f9e..0421dd9277a8 100644
--- a/drivers/staging/rts5208/sd.c
+++ b/drivers/staging/rts5208/sd.c
@@ -4996,7 +4996,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct 
rtsx_chip *chip)
goto sd_execute_write_cmd_failed;
}
 
-   rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
+   retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
if (retval != STATUS_SUCCESS) {
rtsx_trace(chip);
goto sd_execute_write_cmd_failed;
-- 
2.17.1


Re: [PATCH v3 1/3] dt-bindings: i2c: designware: add optional gpio recovery properties

2018-09-16 Thread Jisheng Zhang
+ DT maintainers

On Mon, 17 Sep 2018 11:27:41 +0800
Jisheng Zhang  wrote:

> Document the scl-gpios and sda-gpios properties for bus recovery.
> 
> Signed-off-by: Jisheng Zhang 
> ---
>  Documentation/devicetree/bindings/i2c/i2c-designware.txt | 6 ++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/i2c/i2c-designware.txt 
> b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> index fbb0a6d8b964..1d6a6a8061ba 100644
> --- a/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> +++ b/Documentation/devicetree/bindings/i2c/i2c-designware.txt
> @@ -20,6 +20,10 @@ Optional properties :
>   - i2c-sda-falling-time-ns : should contain the SDA falling time in 
> nanoseconds.
> This value which is by default 300ns is used to compute the tHIGH period.
>  
> + - scl-gpios: specify the gpio of the SCL line for gpio recovery
> +
> + - sda-gpios: specify the gpio of the SDA line for gpio recovery
> +
>  Examples :
>  
>   i2c@f {
> @@ -42,6 +46,8 @@ Examples :
>   i2c-sda-hold-time-ns = <300>;
>   i2c-sda-falling-time-ns = <300>;
>   i2c-scl-falling-time-ns = <300>;
> + scl-gpios = < 15 GPIO_ACTIVE_HIGH>;
> + sda-gpios = < 16 GPIO_ACTIVE_HIGH>;
>   };
>  
>   i2c@112 {



[PATCH AUTOSEL 4.18 024/136] power: remove possible deadlock when unregistering power_supply

2018-09-16 Thread Sasha Levin
From: Benjamin Tissoires 

[ Upstream commit 3ffa6583e24e1ad1abab836d24bfc9d2308074e5 ]

If a device gets removed right after having registered a power_supply node,
we might enter in a deadlock between the remove call (that has a lock on
the parent device) and the deferred register work.

Allow the deferred register work to exit without taking the lock when
we are in the remove state.

Stack trace on a Ubuntu 16.04:

[16072.109121] INFO: task kworker/u16:2:1180 blocked for more than 120 seconds.
[16072.109127]   Not tainted 4.13.0-41-generic #46~16.04.1-Ubuntu
[16072.109129] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this 
message.
[16072.109132] kworker/u16:2   D0  1180  2 0x8000
[16072.109142] Workqueue: events_power_efficient 
power_supply_deferred_register_work
[16072.109144] Call Trace:
[16072.109152]  __schedule+0x3d6/0x8b0
[16072.109155]  schedule+0x36/0x80
[16072.109158]  schedule_preempt_disabled+0xe/0x10
[16072.109161]  __mutex_lock.isra.2+0x2ab/0x4e0
[16072.109166]  __mutex_lock_slowpath+0x13/0x20
[16072.109168]  ? __mutex_lock_slowpath+0x13/0x20
[16072.109171]  mutex_lock+0x2f/0x40
[16072.109174]  power_supply_deferred_register_work+0x2b/0x50
[16072.109179]  process_one_work+0x15b/0x410
[16072.109182]  worker_thread+0x4b/0x460
[16072.109186]  kthread+0x10c/0x140
[16072.109189]  ? process_one_work+0x410/0x410
[16072.109191]  ? kthread_create_on_node+0x70/0x70
[16072.109194]  ret_from_fork+0x35/0x40
[16072.109199] INFO: task test:2257 blocked for more than 120 seconds.
[16072.109202]   Not tainted 4.13.0-41-generic #46~16.04.1-Ubuntu
[16072.109204] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this 
message.
[16072.109206] testD0  2257   2256 0x0004
[16072.109208] Call Trace:
[16072.109211]  __schedule+0x3d6/0x8b0
[16072.109215]  schedule+0x36/0x80
[16072.109218]  schedule_timeout+0x1f3/0x360
[16072.109221]  ? check_preempt_curr+0x5a/0xa0
[16072.109224]  ? ttwu_do_wakeup+0x1e/0x150
[16072.109227]  wait_for_completion+0xb4/0x140
[16072.109230]  ? wait_for_completion+0xb4/0x140
[16072.109233]  ? wake_up_q+0x70/0x70
[16072.109236]  flush_work+0x129/0x1e0
[16072.109240]  ? worker_detach_from_pool+0xb0/0xb0
[16072.109243]  __cancel_work_timer+0x10f/0x190
[16072.109247]  ? device_del+0x264/0x310
[16072.109250]  ? __wake_up+0x44/0x50
[16072.109253]  cancel_delayed_work_sync+0x13/0x20
[16072.109257]  power_supply_unregister+0x37/0xb0
[16072.109260]  devm_power_supply_release+0x11/0x20
[16072.109263]  release_nodes+0x110/0x200
[16072.109266]  devres_release_group+0x7c/0xb0
[16072.109274]  wacom_remove+0xc2/0x110 [wacom]
[16072.109279]  hid_device_remove+0x6e/0xd0 [hid]
[16072.109284]  device_release_driver_internal+0x158/0x210
[16072.109288]  device_release_driver+0x12/0x20
[16072.109291]  bus_remove_device+0xec/0x160
[16072.109293]  device_del+0x1de/0x310
[16072.109298]  hid_destroy_device+0x27/0x60 [hid]
[16072.109303]  usbhid_disconnect+0x51/0x70 [usbhid]
[16072.109308]  usb_unbind_interface+0x77/0x270
[16072.109311]  device_release_driver_internal+0x158/0x210
[16072.109315]  device_release_driver+0x12/0x20
[16072.109318]  usb_driver_release_interface+0x77/0x80
[16072.109321]  proc_ioctl+0x20f/0x250
[16072.109325]  usbdev_do_ioctl+0x57f/0x1140
[16072.109327]  ? __wake_up+0x44/0x50
[16072.109331]  usbdev_ioctl+0xe/0x20
[16072.109336]  do_vfs_ioctl+0xa4/0x600
[16072.109339]  ? vfs_write+0x15a/0x1b0
[16072.109343]  SyS_ioctl+0x79/0x90
[16072.109347]  entry_SYSCALL_64_fastpath+0x24/0xab
[16072.109349] RIP: 0033:0x7f20da807f47
[16072.109351] RSP: 002b:7ffc422ae398 EFLAGS: 0246 ORIG_RAX: 
0010
[16072.109353] RAX: ffda RBX: 010b8560 RCX: 7f20da807f47
[16072.109355] RDX: 7ffc422ae3a0 RSI: c0105512 RDI: 0009
[16072.109356] RBP:  R08: 7ffc422ae3e0 R09: 0010
[16072.109357] R10: 00a6 R11: 0246 R12: 
[16072.109359] R13: 010b8560 R14: 7ffc422ae2e0 R15: 

Reported-and-tested-by: Richard Hughes 
Tested-by: Aaron Skomra 
Signed-off-by: Benjamin Tissoires 
Fixes: 7f1a57fdd6cb ("power_supply: Fix possible NULL pointer dereference on 
early uevent")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Sasha Levin 
---
 drivers/power/supply/power_supply_core.c | 11 +--
 include/linux/power_supply.h |  1 +
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c 
b/drivers/power/supply/power_supply_core.c
index d21f478741c1..e85361878450 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -14,6 +14,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -140,8 +141,13 @@ static void power_supply_deferred_register_work(struct 
work_struct *work)
struct power_supply *psy = container_of(work, struct power_supply,

[PATCH AUTOSEL 4.18 012/136] staging: rts5208: fix missing error check on call to rtsx_write_register

2018-09-16 Thread Sasha Levin
From: Colin Ian King 

[ Upstream commit c5fae4f4fd28189b1062fb8ef7b21fec37cb8b17 ]

Currently the check on error return from the call to rtsx_write_register
is checking the error status from the previous call. Fix this by adding
in the missing assignment of retval.

Detected by CoverityScan, CID#709877

Fixes: fa590c222fba ("staging: rts5208: add support for rts5208 and rts5288")
Signed-off-by: Colin Ian King 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/staging/rts5208/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
index d548bc695f9e..0421dd9277a8 100644
--- a/drivers/staging/rts5208/sd.c
+++ b/drivers/staging/rts5208/sd.c
@@ -4996,7 +4996,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct 
rtsx_chip *chip)
goto sd_execute_write_cmd_failed;
}
 
-   rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
+   retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
if (retval != STATUS_SUCCESS) {
rtsx_trace(chip);
goto sd_execute_write_cmd_failed;
-- 
2.17.1


[PATCH AUTOSEL 4.18 023/136] s390/mm: correct allocate_pgste proc_handler callback

2018-09-16 Thread Sasha Levin
From: Vasily Gorbik 

[ Upstream commit 5bedf8aa03c28cb8dc98bdd32a41b66d8f7d3eaa ]

Since proc_dointvec does not perform value range control,
proc_dointvec_minmax should be used to limit value range, which is
clearly intended here, as the internal representation of the value:

unsigned int alloc_pgste:1;

In fact it currently works, since we have

  mm->context.alloc_pgste = page_table_allocate_pgste || ...

... since commit 23fefe119ceb5 ("s390/kvm: avoid global config of 
vm.alloc_pgste=1")

Before that it was

   mm->context.alloc_pgste = page_table_allocate_pgste;

which was broken. That was introduced with commit 0b46e0a3ec0d7 ("s390/kvm:
remove delayed reallocation of page tables for KVM").

Fixes: 0b46e0a3ec0d7 ("s390/kvm: remove delayed reallocation of page tables for 
KVM")
Acked-by: Christian Borntraeger 
Reviewed-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Sasha Levin 
---
 arch/s390/mm/pgalloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index e3bd5627afef..76d89ee8b428 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -28,7 +28,7 @@ static struct ctl_table page_table_sysctl[] = {
.data   = _table_allocate_pgste,
.maxlen = sizeof(int),
.mode   = S_IRUGO | S_IWUSR,
-   .proc_handler   = proc_dointvec,
+   .proc_handler   = proc_dointvec_minmax,
.extra1 = _table_allocate_pgste_min,
.extra2 = _table_allocate_pgste_max,
},
-- 
2.17.1


[PATCH AUTOSEL 4.18 022/136] iommu/msm: Don't call iommu_device_{,un}link from atomic context

2018-09-16 Thread Sasha Levin
From: Niklas Cassel 

[ Upstream commit 379521462e4add27f3514da8e4ab1fd7a54fe1c7 ]

Fixes the following splat during boot:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:747
in_atomic(): 1, irqs_disabled(): 128, pid: 77, name: kworker/2:1
4 locks held by kworker/2:1/77:
 #0: (ptrval) ((wq_completion)"events"){+.+.}, at: process_one_work+0x1fc/0x8fc
 #1: (ptrval) (deferred_probe_work){+.+.}, at: process_one_work+0x1fc/0x8fc
 #2: (ptrval) (>mutex){}, at: __device_attach+0x40/0x178
 #3: (ptrval) (msm_iommu_lock){}, at: msm_iommu_add_device+0x28/0xcc
irq event stamp: 348
hardirqs last  enabled at (347): [] kfree+0xe0/0x3c0
hardirqs last disabled at (348): [] _raw_spin_lock_irqsave+0x2c/0x68
softirqs last  enabled at (0): [] copy_process.part.5+0x280/0x1a68
softirqs last disabled at (0): [<>]   (null)
Preemption disabled at:
[<>]   (null)
CPU: 2 PID: 77 Comm: kworker/2:1 Not tainted 
4.17.0-rc5-wt-ath-01075-gaca0516bb4cf #239
Hardware name: Generic DT based system
Workqueue: events deferred_probe_work_func
[] (unwind_backtrace) from [] (show_stack+0x20/0x24)
[] (show_stack) from [] (dump_stack+0xa0/0xcc)
[] (dump_stack) from [] (___might_sleep+0x1f8/0x2d4)
ath10k_sdio mmc2:0001:1: Direct firmware load for 
ath10k/QCA9377/hw1.0/board-2.bin failed with error -2
[] (___might_sleep) from [] (__might_sleep+0x70/0xa8)
[] (__might_sleep) from [] (__mutex_lock+0x50/0xb28)
[] (__mutex_lock) from [] (mutex_lock_nested+0x2c/0x34)
ath10k_sdio mmc2:0001:1: board_file api 1 bmi_id N/A crc32 544289f7
[] (mutex_lock_nested) from [] 
(kernfs_find_and_get_ns+0x30/0x5c)
[] (kernfs_find_and_get_ns) from [] 
(sysfs_add_link_to_group+0x28/0x58)
[] (sysfs_add_link_to_group) from [] 
(iommu_device_link+0x50/0xb4)
[] (iommu_device_link) from [] 
(msm_iommu_add_device+0xa0/0xcc)
[] (msm_iommu_add_device) from [] 
(add_iommu_group+0x3c/0x64)
[] (add_iommu_group) from [] (bus_for_each_dev+0x84/0xc4)
[] (bus_for_each_dev) from [] (bus_set_iommu+0xd0/0x10c)
[] (bus_set_iommu) from [] (msm_iommu_probe+0x5b8/0x66c)
[] (msm_iommu_probe) from [] (platform_drv_probe+0x60/0xbc)
[] (platform_drv_probe) from [] 
(driver_probe_device+0x30c/0x4cc)
[] (driver_probe_device) from [] 
(__device_attach_driver+0xac/0x14c)
[] (__device_attach_driver) from [] 
(bus_for_each_drv+0x68/0xc8)
[] (bus_for_each_drv) from [] (__device_attach+0xe4/0x178)
[] (__device_attach) from [] 
(device_initial_probe+0x1c/0x20)
[] (device_initial_probe) from [] 
(bus_probe_device+0x98/0xa0)
[] (bus_probe_device) from [] 
(deferred_probe_work_func+0x74/0x198)
[] (deferred_probe_work_func) from [] 
(process_one_work+0x2c4/0x8fc)
[] (process_one_work) from [] (worker_thread+0x2c4/0x5cc)
[] (worker_thread) from [] (kthread+0x180/0x188)
[] (kthread) from [] (ret_from_fork+0x14/0x20)

Fixes: 42df43b36163 ("iommu/msm: Make use of iommu_device_register interface")
Signed-off-by: Niklas Cassel 
Reviewed-by: Vivek Gautam 
Signed-off-by: Joerg Roedel 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/msm_iommu.c | 16 +---
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 0d3350463a3f..9a95c9b9d0d8 100644
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -395,20 +395,15 @@ static int msm_iommu_add_device(struct device *dev)
struct msm_iommu_dev *iommu;
struct iommu_group *group;
unsigned long flags;
-   int ret = 0;
 
spin_lock_irqsave(_iommu_lock, flags);
-
iommu = find_iommu_for_dev(dev);
+   spin_unlock_irqrestore(_iommu_lock, flags);
+
if (iommu)
iommu_device_link(>iommu, dev);
else
-   ret = -ENODEV;
-
-   spin_unlock_irqrestore(_iommu_lock, flags);
-
-   if (ret)
-   return ret;
+   return -ENODEV;
 
group = iommu_group_get_for_dev(dev);
if (IS_ERR(group))
@@ -425,13 +420,12 @@ static void msm_iommu_remove_device(struct device *dev)
unsigned long flags;
 
spin_lock_irqsave(_iommu_lock, flags);
-
iommu = find_iommu_for_dev(dev);
+   spin_unlock_irqrestore(_iommu_lock, flags);
+
if (iommu)
iommu_device_unlink(>iommu, dev);
 
-   spin_unlock_irqrestore(_iommu_lock, flags);
-
iommu_group_remove_device(dev);
 }
 
-- 
2.17.1


[PATCH AUTOSEL 4.18 023/136] s390/mm: correct allocate_pgste proc_handler callback

2018-09-16 Thread Sasha Levin
From: Vasily Gorbik 

[ Upstream commit 5bedf8aa03c28cb8dc98bdd32a41b66d8f7d3eaa ]

Since proc_dointvec does not perform value range control,
proc_dointvec_minmax should be used to limit value range, which is
clearly intended here, as the internal representation of the value:

unsigned int alloc_pgste:1;

In fact it currently works, since we have

  mm->context.alloc_pgste = page_table_allocate_pgste || ...

... since commit 23fefe119ceb5 ("s390/kvm: avoid global config of 
vm.alloc_pgste=1")

Before that it was

   mm->context.alloc_pgste = page_table_allocate_pgste;

which was broken. That was introduced with commit 0b46e0a3ec0d7 ("s390/kvm:
remove delayed reallocation of page tables for KVM").

Fixes: 0b46e0a3ec0d7 ("s390/kvm: remove delayed reallocation of page tables for 
KVM")
Acked-by: Christian Borntraeger 
Reviewed-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Sasha Levin 
---
 arch/s390/mm/pgalloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index e3bd5627afef..76d89ee8b428 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -28,7 +28,7 @@ static struct ctl_table page_table_sysctl[] = {
.data   = _table_allocate_pgste,
.maxlen = sizeof(int),
.mode   = S_IRUGO | S_IWUSR,
-   .proc_handler   = proc_dointvec,
+   .proc_handler   = proc_dointvec_minmax,
.extra1 = _table_allocate_pgste_min,
.extra2 = _table_allocate_pgste_max,
},
-- 
2.17.1


[PATCH AUTOSEL 4.18 022/136] iommu/msm: Don't call iommu_device_{,un}link from atomic context

2018-09-16 Thread Sasha Levin
From: Niklas Cassel 

[ Upstream commit 379521462e4add27f3514da8e4ab1fd7a54fe1c7 ]

Fixes the following splat during boot:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:747
in_atomic(): 1, irqs_disabled(): 128, pid: 77, name: kworker/2:1
4 locks held by kworker/2:1/77:
 #0: (ptrval) ((wq_completion)"events"){+.+.}, at: process_one_work+0x1fc/0x8fc
 #1: (ptrval) (deferred_probe_work){+.+.}, at: process_one_work+0x1fc/0x8fc
 #2: (ptrval) (>mutex){}, at: __device_attach+0x40/0x178
 #3: (ptrval) (msm_iommu_lock){}, at: msm_iommu_add_device+0x28/0xcc
irq event stamp: 348
hardirqs last  enabled at (347): [] kfree+0xe0/0x3c0
hardirqs last disabled at (348): [] _raw_spin_lock_irqsave+0x2c/0x68
softirqs last  enabled at (0): [] copy_process.part.5+0x280/0x1a68
softirqs last disabled at (0): [<>]   (null)
Preemption disabled at:
[<>]   (null)
CPU: 2 PID: 77 Comm: kworker/2:1 Not tainted 
4.17.0-rc5-wt-ath-01075-gaca0516bb4cf #239
Hardware name: Generic DT based system
Workqueue: events deferred_probe_work_func
[] (unwind_backtrace) from [] (show_stack+0x20/0x24)
[] (show_stack) from [] (dump_stack+0xa0/0xcc)
[] (dump_stack) from [] (___might_sleep+0x1f8/0x2d4)
ath10k_sdio mmc2:0001:1: Direct firmware load for 
ath10k/QCA9377/hw1.0/board-2.bin failed with error -2
[] (___might_sleep) from [] (__might_sleep+0x70/0xa8)
[] (__might_sleep) from [] (__mutex_lock+0x50/0xb28)
[] (__mutex_lock) from [] (mutex_lock_nested+0x2c/0x34)
ath10k_sdio mmc2:0001:1: board_file api 1 bmi_id N/A crc32 544289f7
[] (mutex_lock_nested) from [] 
(kernfs_find_and_get_ns+0x30/0x5c)
[] (kernfs_find_and_get_ns) from [] 
(sysfs_add_link_to_group+0x28/0x58)
[] (sysfs_add_link_to_group) from [] 
(iommu_device_link+0x50/0xb4)
[] (iommu_device_link) from [] 
(msm_iommu_add_device+0xa0/0xcc)
[] (msm_iommu_add_device) from [] 
(add_iommu_group+0x3c/0x64)
[] (add_iommu_group) from [] (bus_for_each_dev+0x84/0xc4)
[] (bus_for_each_dev) from [] (bus_set_iommu+0xd0/0x10c)
[] (bus_set_iommu) from [] (msm_iommu_probe+0x5b8/0x66c)
[] (msm_iommu_probe) from [] (platform_drv_probe+0x60/0xbc)
[] (platform_drv_probe) from [] 
(driver_probe_device+0x30c/0x4cc)
[] (driver_probe_device) from [] 
(__device_attach_driver+0xac/0x14c)
[] (__device_attach_driver) from [] 
(bus_for_each_drv+0x68/0xc8)
[] (bus_for_each_drv) from [] (__device_attach+0xe4/0x178)
[] (__device_attach) from [] 
(device_initial_probe+0x1c/0x20)
[] (device_initial_probe) from [] 
(bus_probe_device+0x98/0xa0)
[] (bus_probe_device) from [] 
(deferred_probe_work_func+0x74/0x198)
[] (deferred_probe_work_func) from [] 
(process_one_work+0x2c4/0x8fc)
[] (process_one_work) from [] (worker_thread+0x2c4/0x5cc)
[] (worker_thread) from [] (kthread+0x180/0x188)
[] (kthread) from [] (ret_from_fork+0x14/0x20)

Fixes: 42df43b36163 ("iommu/msm: Make use of iommu_device_register interface")
Signed-off-by: Niklas Cassel 
Reviewed-by: Vivek Gautam 
Signed-off-by: Joerg Roedel 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/msm_iommu.c | 16 +---
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
index 0d3350463a3f..9a95c9b9d0d8 100644
--- a/drivers/iommu/msm_iommu.c
+++ b/drivers/iommu/msm_iommu.c
@@ -395,20 +395,15 @@ static int msm_iommu_add_device(struct device *dev)
struct msm_iommu_dev *iommu;
struct iommu_group *group;
unsigned long flags;
-   int ret = 0;
 
spin_lock_irqsave(_iommu_lock, flags);
-
iommu = find_iommu_for_dev(dev);
+   spin_unlock_irqrestore(_iommu_lock, flags);
+
if (iommu)
iommu_device_link(>iommu, dev);
else
-   ret = -ENODEV;
-
-   spin_unlock_irqrestore(_iommu_lock, flags);
-
-   if (ret)
-   return ret;
+   return -ENODEV;
 
group = iommu_group_get_for_dev(dev);
if (IS_ERR(group))
@@ -425,13 +420,12 @@ static void msm_iommu_remove_device(struct device *dev)
unsigned long flags;
 
spin_lock_irqsave(_iommu_lock, flags);
-
iommu = find_iommu_for_dev(dev);
+   spin_unlock_irqrestore(_iommu_lock, flags);
+
if (iommu)
iommu_device_unlink(>iommu, dev);
 
-   spin_unlock_irqrestore(_iommu_lock, flags);
-
iommu_group_remove_device(dev);
 }
 
-- 
2.17.1


[PATCH AUTOSEL 4.18 031/136] RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c

2018-09-16 Thread Sasha Levin
From: Dan Carpenter 

[ Upstream commit c1dfc0114c901b4f46c85ceff0491debf2b2a2ec ]

The srq->swq[] is allocated in bnxt_qplib_create_srq().  It has
srq->hwq.max_elements elements so these tests should be > instead of >=
or we might go beyond the end of the array.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Dan Carpenter 
Acked-by: Selvin Xavier 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c 
b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 50d8f1fc98d5..e426b990c1dd 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -2354,7 +2354,7 @@ static int bnxt_qplib_cq_process_res_rc(struct 
bnxt_qplib_cq *cq,
srq = qp->srq;
if (!srq)
return -EINVAL;
-   if (wr_id_idx > srq->hwq.max_elements) {
+   if (wr_id_idx >= srq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process RC ");
dev_err(>hwq.pdev->dev,
@@ -2369,7 +2369,7 @@ static int bnxt_qplib_cq_process_res_rc(struct 
bnxt_qplib_cq *cq,
*pcqe = cqe;
} else {
rq = >rq;
-   if (wr_id_idx > rq->hwq.max_elements) {
+   if (wr_id_idx >= rq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process RC ");
dev_err(>hwq.pdev->dev,
@@ -2437,7 +2437,7 @@ static int bnxt_qplib_cq_process_res_ud(struct 
bnxt_qplib_cq *cq,
if (!srq)
return -EINVAL;
 
-   if (wr_id_idx > srq->hwq.max_elements) {
+   if (wr_id_idx >= srq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process UD ");
dev_err(>hwq.pdev->dev,
@@ -2452,7 +2452,7 @@ static int bnxt_qplib_cq_process_res_ud(struct 
bnxt_qplib_cq *cq,
*pcqe = cqe;
} else {
rq = >rq;
-   if (wr_id_idx > rq->hwq.max_elements) {
+   if (wr_id_idx >= rq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process UD ");
dev_err(>hwq.pdev->dev,
@@ -2546,7 +2546,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct 
bnxt_qplib_cq *cq,
"QPLIB: FP: SRQ used but not defined??");
return -EINVAL;
}
-   if (wr_id_idx > srq->hwq.max_elements) {
+   if (wr_id_idx >= srq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process Raw/QP1 ");
dev_err(>hwq.pdev->dev,
@@ -2561,7 +2561,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct 
bnxt_qplib_cq *cq,
*pcqe = cqe;
} else {
rq = >rq;
-   if (wr_id_idx > rq->hwq.max_elements) {
+   if (wr_id_idx >= rq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process Raw/QP1 RQ wr_id ");
dev_err(>hwq.pdev->dev,
-- 
2.17.1


[PATCH AUTOSEL 4.18 034/136] media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()

2018-09-16 Thread Sasha Levin
From: Sylwester Nawrocki 

[ Upstream commit 7c1b9a5aeed91bef98988ac0fcf38c8c1f4f9a3a ]

This patch fixes potential NULL pointer dereference as indicated
by the following static checker warning:

drivers/media/platform/exynos4-is/fimc-isp-video.c:408 
isp_video_try_fmt_mplane()
error: NULL dereference inside function '__isp_video_try_fmt(isp, 
>fmt.pix_mp, (0))()'.

Fixes: 34947b8aebe3: ("[media] exynos4-is: Add the FIMC-IS ISP capture DMA 
driver")

Reported-by: Dan Carpenter 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/platform/exynos4-is/fimc-isp-video.c | 11 ---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c 
b/drivers/media/platform/exynos4-is/fimc-isp-video.c
index 55ba696b8cf4..a920164f53f1 100644
--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
+++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
@@ -384,12 +384,17 @@ static void __isp_video_try_fmt(struct fimc_isp *isp,
struct v4l2_pix_format_mplane *pixm,
const struct fimc_fmt **fmt)
 {
-   *fmt = fimc_isp_find_format(>pixelformat, NULL, 2);
+   const struct fimc_fmt *__fmt;
+
+   __fmt = fimc_isp_find_format(>pixelformat, NULL, 2);
+
+   if (fmt)
+   *fmt = __fmt;
 
pixm->colorspace = V4L2_COLORSPACE_SRGB;
pixm->field = V4L2_FIELD_NONE;
-   pixm->num_planes = (*fmt)->memplanes;
-   pixm->pixelformat = (*fmt)->fourcc;
+   pixm->num_planes = __fmt->memplanes;
+   pixm->pixelformat = __fmt->fourcc;
/*
 * TODO: double check with the docmentation these width/height
 * constraints are correct.
-- 
2.17.1


[PATCH AUTOSEL 4.18 035/136] IB/mlx4: Test port number before querying type.

2018-09-16 Thread Sasha Levin
From: Tarick Bedeir 

[ Upstream commit f1228867adaf8890826f2b59e4caddb1c5cc2df7 ]

rdma_ah_find_type() can reach into ib_device->port_immutable with a
potentially out-of-bounds port number, so check that the port number is
valid first.

Fixes: 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
Signed-off-by: Tarick Bedeir 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/hw/mlx4/qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 3b8045fd23ed..b94e33a56e97 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -4047,9 +4047,9 @@ static void to_rdma_ah_attr(struct mlx4_ib_dev *ibdev,
u8 port_num = path->sched_queue & 0x40 ? 2 : 1;
 
memset(ah_attr, 0, sizeof(*ah_attr));
-   ah_attr->type = rdma_ah_find_type(>ib_dev, port_num);
if (port_num == 0 || port_num > dev->caps.num_ports)
return;
+   ah_attr->type = rdma_ah_find_type(>ib_dev, port_num);
 
if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE)
rdma_ah_set_sl(ah_attr, ((path->sched_queue >> 3) & 0x7) |
-- 
2.17.1


[PATCH AUTOSEL 4.18 031/136] RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c

2018-09-16 Thread Sasha Levin
From: Dan Carpenter 

[ Upstream commit c1dfc0114c901b4f46c85ceff0491debf2b2a2ec ]

The srq->swq[] is allocated in bnxt_qplib_create_srq().  It has
srq->hwq.max_elements elements so these tests should be > instead of >=
or we might go beyond the end of the array.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Dan Carpenter 
Acked-by: Selvin Xavier 
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c 
b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 50d8f1fc98d5..e426b990c1dd 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -2354,7 +2354,7 @@ static int bnxt_qplib_cq_process_res_rc(struct 
bnxt_qplib_cq *cq,
srq = qp->srq;
if (!srq)
return -EINVAL;
-   if (wr_id_idx > srq->hwq.max_elements) {
+   if (wr_id_idx >= srq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process RC ");
dev_err(>hwq.pdev->dev,
@@ -2369,7 +2369,7 @@ static int bnxt_qplib_cq_process_res_rc(struct 
bnxt_qplib_cq *cq,
*pcqe = cqe;
} else {
rq = >rq;
-   if (wr_id_idx > rq->hwq.max_elements) {
+   if (wr_id_idx >= rq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process RC ");
dev_err(>hwq.pdev->dev,
@@ -2437,7 +2437,7 @@ static int bnxt_qplib_cq_process_res_ud(struct 
bnxt_qplib_cq *cq,
if (!srq)
return -EINVAL;
 
-   if (wr_id_idx > srq->hwq.max_elements) {
+   if (wr_id_idx >= srq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process UD ");
dev_err(>hwq.pdev->dev,
@@ -2452,7 +2452,7 @@ static int bnxt_qplib_cq_process_res_ud(struct 
bnxt_qplib_cq *cq,
*pcqe = cqe;
} else {
rq = >rq;
-   if (wr_id_idx > rq->hwq.max_elements) {
+   if (wr_id_idx >= rq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process UD ");
dev_err(>hwq.pdev->dev,
@@ -2546,7 +2546,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct 
bnxt_qplib_cq *cq,
"QPLIB: FP: SRQ used but not defined??");
return -EINVAL;
}
-   if (wr_id_idx > srq->hwq.max_elements) {
+   if (wr_id_idx >= srq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process Raw/QP1 ");
dev_err(>hwq.pdev->dev,
@@ -2561,7 +2561,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct 
bnxt_qplib_cq *cq,
*pcqe = cqe;
} else {
rq = >rq;
-   if (wr_id_idx > rq->hwq.max_elements) {
+   if (wr_id_idx >= rq->hwq.max_elements) {
dev_err(>hwq.pdev->dev,
"QPLIB: FP: CQ Process Raw/QP1 RQ wr_id ");
dev_err(>hwq.pdev->dev,
-- 
2.17.1


  1   2   3   4   5   6   7   8   9   10   >