Re: [PATCH] scsi: lpfc: Add shutdown method for kexec

[Benjamin Herrenschmidt]

On Mon, 2017-03-06 at 22:46 -0500, Martin K. Petersen wrote:
> > > > > > "Mauricio" == Mauricio Faria de Oliveira  > > > > > et.ibm.com> writes:
> 
> Mauricio> On 02/12/2017 07:49 PM, Anton Blanchard wrote:
> > > We see lpfc devices regularly fail during kexec. Fix this by
> > > adding a
> > > shutdown method which mirrors the remove method.
> 
> Mauricio> @mkp, @jejb: may you please flag this patch for
> stable?  Thank
> Mauricio> you.
> 
> I don't recall a consensus being reached on this patch.

What would be the opposition ? Without it kexec breaks. With it, it
works ...

Now we all seem to agree that kexec should be overhauled to not use
shutdown but instead unbind drivers, but that's a more long term
project that nobody yet had a chance to tackle.

In the meantime, some systems need a functioning kexec to boot.

Cheers,
Ben.

Re: [PATCH 00/20] lpfc: Update lpfc to revision 11.2.0.10

[Martin K. Petersen]

> "James" == jsmart2021   writes:

James,

James> This set of patches are mainly cleanups and fixes to the large
James> nvme post that was recently integrated. It includes a patch to
James> break the mandate for both NVME and SCSI subystems.

A couple of the patches in this series felt quite a bit bigger than "a
fix". I let them in because I acknowledge that it was a pretty big chunk
of code that just got merged and that some fallout was inevitable.

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] scsi: lpfc: replace init_timer by setup_timer

[Martin K. Petersen]

> "Jiri" == Jiri Slaby  writes:

Jiri> From: Tomas Jasek  This patch shortens every
Jiri> init_timer in lpfc module followed by function and data assignment
Jiri> using setup_timer.  This is purely cleanup patch, it does not add
Jiri> new functionality nor remove any existing functionality.

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] vmw_pvscsi: handle the return value from pci_alloc_irq_vectors correctly

[Martin K. Petersen]

> "Christoph" == Christoph Hellwig  writes:

Christoph> It returns the number of vectors allocated when successful,
Christoph> so check for a negative error only.

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] scsi: lpfc: Add shutdown method for kexec

[Martin K. Petersen]

> "Mauricio" == Mauricio Faria de Oliveira  
> writes:

Mauricio> On 02/12/2017 07:49 PM, Anton Blanchard wrote:
>> We see lpfc devices regularly fail during kexec. Fix this by adding a
>> shutdown method which mirrors the remove method.

Mauricio> @mkp, @jejb: may you please flag this patch for stable?  Thank
Mauricio> you.

I don't recall a consensus being reached on this patch.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] scsi: qedf: Use vsprintf extension %pad

[Martin K. Petersen]

> "Joe" == Joe Perches  writes:

Joe> Using %llx for a dma_addr_t can lead to format/argument mismatches.
Joe> Use %pad and the address of the dma_addr_t instead.

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] aacraid: Fix typo in blink status

[Martin K. Petersen]

> "Raghava" == Raghava Aditya Renukunta 
>  writes:

Raghava> The return status of the adapter check on KERNEL_PANIC is
Raghava> supposed to be the upper 16 bits of the OMR status register.

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] [v2] scsi: qedi: fix build error without DEBUG_FS

[Martin K. Petersen]

> "Arnd" == Arnd Bergmann  writes:

Arnd> Without CONFIG_DEBUG_FS, we run into a link error:

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Re: [PATCH] qla2xxx: Fix ql_dump_buffer

[Martin K. Petersen]

> "Joe" == Joe Perches  writes:

Joe> Recent printk changes for KERN_CONT cause this logging to be
Joe> defectively emitted on multiple lines.  Fix it.

Applied to 4.11/scsi-fixes.

-- 
Martin K. Petersen  Oracle Linux Engineering

Help needed for a SCSI hang (SATA drives)

[V]

Hi,

I am reaching out regarding a SCSI error handler issue, which we see
in our lab systems.

Environment: Ubuntu 4.4.0-31-generic

Issue: Write IOs are getting stuck in our system randomly. All drives
seen with the issue are all SATA drives.
Root cause: SCSI error handler is not woken up (or) it is up, but not
able to flush commands and hence the IOs get stuck. (as the requests
are not flushed out and host is not restarted)

We have 6 instances seen till now.

This is what we see.
1) As part of testing our drives, we start lot of read/writes, along
with some user space utilities running to check the drive health.
1) In our recent testing, we see lot of commands going through the
"abort scheduled" path. And we see that in between, for one of the
commands, the error handler is not woken up, and majority of
processes, which were writing, gets stalled.
2) We are still trying to figure out what is causing this much number
of abort? Is it usual? Are there some other debugs, which I could
enable to get more information? We know these are user space commands
which are being aborted, but not sure which exact command it is for
now.
3) I see the "abort scheduled" messages in almost all drives in all
systems, hence i dont believe it is a drive issue.
4) I checked the host_failed and host_busy variables, both are set to
1 in system 1. 2nd one is still alive, havent taken a crash dump yet.
5) All drives seen with the issue are SATA drives.
6) I have attached udevadm info of a drive which failed in system 2.

Thanks in advance,
Viswesh


Logs
---
System 1

[371546.605736] sd 9:0:0:0: scsi_block_when_processing_errors: rtn: 1
[371546.606727] sd 9:0:0:0: scsi_block_when_processing_errors: rtn: 1
[371546.607721] sd 9:0:0:0: scsi_block_when_processing_errors: rtn: 1
[371546.618113] sd 9:0:0:0: [sg19] tag#20 abort scheduled
[371546.624039] sd 9:0:0:0: [sg19] tag#20 aborting command
[371546.624045] sd 9:0:0:0: [sg19] tag#20 cmd abort failed
[371546.624051] scsi host9: Waking error handler thread
[371546.624060] scsi host9: scsi_eh_9: waking up 0/1/1
[371546.624081] sd 9:0:0:0: [sg19] tag#20 scsi_eh_9: flush finish cmd
[371546.624095] scsi host9: waking up host to restart
[371546.624098] scsi host9: scsi_eh_9: sleeping


[371546.635314] sd 8:0:0:0: [sg17] tag#13 abort scheduled
[371546.640031] sd 8:0:0:0: [sg17] tag#13 aborting command
[371546.640037] sd 8:0:0:0: [sg17] tag#13 cmd abort failed
[371546.640043] scsi host8: Waking error handler thread
[371546.640078] scsi host8: scsi_eh_8: waking up 0/1/1
[371546.640098] sd 8:0:0:0: [sg17] tag#13 scsi_eh_8: flush finish cmd
[371546.640113] scsi host8: waking up host to restart
[371546.640117] scsi host8: scsi_eh_8: sleeping

[371546.657269] sd 6:0:0:0: [sg12] tag#1 abort scheduled
[371546.664034] sd 6:0:0:0: [sg12] tag#1 aborting command
[371546.664040] sd 6:0:0:0: [sg12] tag#1 cmd abort failed

Here we can see that, error handler is not woken up.  And the entire
IO subsystem goes for a toss.

[371777.594510] INFO: task md2_raid1:508 blocked for more than 120 seconds.
[371777.594571]  Not tainted 4.4.0-31-generic #50~14.04.1-Ubuntu
[371777.594613] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs"
disables this message.
[371777.594665] md2_raid1  D 883fed2afc780  508  2 0x
[371777.594673]  883fed2afc78 881fef0e8000 883fed21c4c0
883fed2b
[371777.594678]  883ff236e298 883ff236e000 883ff236e018
883ff236e018

By enabling more scsi logs(in a different system), including LL, we
get some more info ( I have enabled the full scsi levels for all
categories and it is still running)


System 2

[405197.171574] sd 5:0:0:0: [sg3] sg_write: count=3D88
[405197.171577] sd 5:0:0:0: scsi_block_when_processing_errors: rtn: 1
[405197.171581] sd 5:0:0:0: [sg3] sg_common_write:  scsi
opcode=3D0x85, cmd_size=3D16
[405197.171583] sd 5:0:0:0: [sg3] sg_start_req: dxfer_len=3D512
[405197.171605] sd 5:0:0:0: [sg3] sg_link_reserve: size=3D512
[405197.171623] sd 5:0:0:0: [sg3] sg_poll: res=3D0x104
[405197.172648] sd 5:0:0:0: [sg3] sg_cmd_done: pack_id=3D0, res=3D0x0
[405197.172701] sd 5:0:0:0: [sg3] sg_poll: res=3D0x145
[405197.172710] sd 5:0:0:0: [sg3] sg_read: count=3D88
[405197.172716] sd 5:0:0:0: [sg3] sg_finish_rem_req: res_used=3D1
[405197.172721] sd 5:0:0:0: [sg3] sg_unlink_reserve: req->k_use_sg=3D1
[405197.172756] sd 5:0:0:0: [sg3] sg_write: count=3D88
[405197.172760] sd 5:0:0:0: scsi_block_when_processing_errors: rtn: 1
[405197.172764] sd 5:0:0:0: [sg3] sg_common_write:  scsi
opcode=3D0x85, cmd_size=3D16
[405197.172767] sd 5:0:0:0: [sg3] sg_start_req: dxfer_len=3D512
[405197.172774] sd 5:0:0:0: [sg3] sg_link_reserve: size=3D512
[405197.172793] sd 5:0:0:0: [sg3] sg_poll: res=3D0x104
[405197.173806] sd 5:0:0:0: [sg3] sg_cmd_done: pack_id=3D0, res=3D0x0
[405197.173829] sd 5:0:0:0: [sg3] sg_poll: res=3D0x145
[405197.173836] sd 5:0:0:0: [sg3] sg_read: count=3D88
[405197.173839] sd 5:0:0:0: [sg3] sg_finish_rem_req: res_used=3D1

Re: [PATCH 21/29] drivers, s390: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t

[Benjamin Block]

On Mon, Mar 06, 2017 at 04:27:11PM +0100, Johannes Thumshirn wrote:
> On 03/06/2017 03:21 PM, Elena Reshetova wrote:
> > refcount_t type and corresponding API should be
> > used instead of atomic_t when the variable is used as
> > a reference counter. This allows to avoid accidental
> > refcounter overflows that might lead to use-after-free
> > situations.
> 
> The subject is wrong, should be something like "scsi: libfc convert
> fc_fcp_pkt.ref_cnt from atomic_t to refcount_t" but not s390.
> 

Yes please, I was extremely confused for a moment here.



Beste Grüße / Best regards,
  - Benjamin Block
-- 
Linux on z Systems Development / IBM Systems & Technology Group
  IBM Deutschland Research & Development GmbH 
Vorsitz. AufsR.: Martina Koederitz /Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: AmtsG Stuttgart, HRB 243294

Re: [PATCH] target/user: Fix possible overwrite of t_data_sg's lastiov[]

[Andy Grover]

On 03/05/2017 09:48 PM, Xiubo Li wrote:

Maybe fix this by exiting aasda() with iov pointing at the next unused
iov in the array?

May it shouldn't be the aasda()'s duty to increment the iov ptr.


Sure, your call.

[snip text where we agree current solution allows data block sharing,
and new approach does not, and we're both ok with that]


Option B is we go with changing the implementation to always use a
separate data block for BIDI data (BIDI cmds are rare so no big deal),
but then also please look into simplifying code in aasda() and
tcmu_queue_cmd_ring that may now be overly complex.


Yes, there still has other bugs like this one,  i will try to simplify
the code then.


Great :)


For the BIDI data, still hasn't been used by the tcmu-runner. Is any
other consumer using this?


Well with kernel APIs you just never know if somebody's using it but 
just not saying anything. But given this bug, how could they?


Regards -- Andy

[PATCH 0/3] hpsa updates

[Don Brace]

These patches are based on Linus's tree

The changes are:
 - add in a new offline volume status
 - limit the number of outstanding rescan operations
 - do not timeout reset operations

---

Don Brace (3):
  hpsa: update check for logical volume status
  hpsa: limit outstanding rescans
  hpsa: do not timeout reset operations


 drivers/scsi/hpsa.c |   44 +---
 drivers/scsi/hpsa.h |1 +
 drivers/scsi/hpsa_cmd.h |2 ++
 3 files changed, 32 insertions(+), 15 deletions(-)

--
Signature

[PATCH 3/3] hpsa: do not timeout reset operations

[Don Brace]

resets can take longer than DEFAULT_TIMEOUT

Reviewed-by: Scott Benesh 
Reviewed-by: Scott Teel 
Signed-off-by: Don Brace 
---
 drivers/scsi/hpsa.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index a36d3a6..30164b7 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2956,7 +2956,7 @@ static int hpsa_send_reset(struct ctlr_info *h, unsigned 
char *scsi3addr,
/* fill_cmd can't fail here, no data buffer to map. */
(void) fill_cmd(c, reset_type, h, NULL, 0, 0,
scsi3addr, TYPE_MSG);
-   rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, DEFAULT_TIMEOUT);
+   rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, NO_TIMEOUT);
if (rc) {
dev_warn(>pdev->dev, "Failed to send reset command\n");
goto out;

[PATCH 2/3] hpsa: limit outstanding rescans

[Don Brace]

avoid rescan storms. No need to queue another
if one is pending.

Reviewed-by: Scott Benesh 
Reviewed-by: Scott Teel 
Signed-off-by: Don Brace 
---
 drivers/scsi/hpsa.c |   16 +++-
 drivers/scsi/hpsa.h |1 +
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 1adc4ec..a36d3a6 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -5558,7 +5558,7 @@ static void hpsa_scan_complete(struct ctlr_info *h)
 
spin_lock_irqsave(>scan_lock, flags);
h->scan_finished = 1;
-   wake_up_all(>scan_wait_queue);
+   wake_up(>scan_wait_queue);
spin_unlock_irqrestore(>scan_lock, flags);
 }
 
@@ -5576,11 +5576,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
if (unlikely(lockup_detected(h)))
return hpsa_scan_complete(h);
 
+   /*
+* If a scan is alreay waiting to run, no need to add another
+*/
+   spin_lock_irqsave(>scan_lock, flags);
+   if (h->scan_waiting) {
+   spin_unlock_irqrestore(>scan_lock, flags);
+   return;
+   }
+
+   spin_unlock_irqrestore(>scan_lock, flags);
+
/* wait until any scan already in progress is finished. */
while (1) {
spin_lock_irqsave(>scan_lock, flags);
if (h->scan_finished)
break;
+   h->scan_waiting = 1;
spin_unlock_irqrestore(>scan_lock, flags);
wait_event(h->scan_wait_queue, h->scan_finished);
/* Note: We don't need to worry about a race between this
@@ -5590,6 +5602,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
 */
}
h->scan_finished = 0; /* mark scan as in progress */
+   h->scan_waiting = 0;
spin_unlock_irqrestore(>scan_lock, flags);
 
if (unlikely(lockup_detected(h)))
@@ -8792,6 +8805,7 @@ static int hpsa_init_one(struct pci_dev *pdev, const 
struct pci_device_id *ent)
init_waitqueue_head(>event_sync_wait_queue);
mutex_init(>reset_mutex);
h->scan_finished = 1; /* no scan currently in progress */
+   h->scan_waiting = 0;
 
pci_set_drvdata(pdev, h);
h->ndevices = 0;
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index bf6cdc1..6f04f2a 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -201,6 +201,7 @@ struct ctlr_info {
dma_addr_t  errinfo_pool_dhandle;
unsigned long   *cmd_pool_bits;
int scan_finished;
+   u8  scan_waiting : 1;
spinlock_t  scan_lock;
wait_queue_head_t   scan_wait_queue;
 

[PATCH 1/3] hpsa: update check for logical volume status

[Don Brace]

 - Add in a new case for volume offline. Resolves internal
   testing bug for multilun array management.
 - Return correct status for failed TURs.

Reviewed-by: Scott Benesh 
Reviewed-by: Scott Teel 
Signed-off-by: Don Brace 
---
 drivers/scsi/hpsa.c |   26 +-
 drivers/scsi/hpsa_cmd.h |2 ++
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 524a0c7..1adc4ec 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3735,7 +3735,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
DEFAULT_TIMEOUT);
if (rc) {
cmd_free(h, c);
-   return 0;
+   return 0xff;
}
sense = c->err_info->SenseInfo;
if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo))
@@ -3746,19 +3746,13 @@ static int hpsa_volume_offline(struct ctlr_info *h,
cmd_status = c->err_info->CommandStatus;
scsi_status = c->err_info->ScsiStatus;
cmd_free(h, c);
-   /* Is the volume 'not ready'? */
-   if (cmd_status != CMD_TARGET_STATUS ||
-   scsi_status != SAM_STAT_CHECK_CONDITION ||
-   sense_key != NOT_READY ||
-   asc != ASC_LUN_NOT_READY)  {
-   return 0;
-   }
 
/* Determine the reason for not ready state */
ldstat = hpsa_get_volume_status(h, scsi3addr);
 
/* Keep volume offline in certain cases: */
switch (ldstat) {
+   case HPSA_LV_FAILED:
case HPSA_LV_UNDERGOING_ERASE:
case HPSA_LV_NOT_AVAILABLE:
case HPSA_LV_UNDERGOING_RPI:
@@ -3853,10 +3847,10 @@ static int hpsa_update_device_info(struct ctlr_info *h,
/* Do an inquiry to the device to see what it is. */
if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
(unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
-   /* Inquiry failed (msg printed already) */
dev_err(>pdev->dev,
-   "hpsa_update_device_info: inquiry failed\n");
-   rc = -EIO;
+   "%s: inquiry failed, device will be skipped.\n",
+   __func__);
+   rc = HPSA_INQUIRY_FAILED;
goto bail_out;
}
 
@@ -3894,6 +3888,13 @@ static int hpsa_update_device_info(struct ctlr_info *h,
if (volume_offline < 0 || volume_offline > 0xff)
volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED;
this_device->volume_offline = volume_offline & 0xff;
+   if (volume_offline == HPSA_LV_FAILED) {
+   rc = HPSA_LV_FAILED;
+   dev_err(>pdev->dev,
+   "%s: LV failed, device will be skipped.\n",
+   __func__);
+   goto bail_out;
+   }
} else {
this_device->raid_level = RAID_UNKNOWN;
this_device->offload_config = 0;
@@ -4379,8 +4380,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h)
goto out;
}
if (rc) {
-   dev_warn(>pdev->dev,
-   "Inquiry failed, skipping device.\n");
+   h->drv_req_rescan = 1;
continue;
}
 
diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
index a584cdf..5961705 100644
--- a/drivers/scsi/hpsa_cmd.h
+++ b/drivers/scsi/hpsa_cmd.h
@@ -156,6 +156,7 @@
 #define CFGTBL_BusType_Fibre2G  0x0200l
 
 /* VPD Inquiry types */
+#define HPSA_INQUIRY_FAILED0x02
 #define HPSA_VPD_SUPPORTED_PAGES0x00
 #define HPSA_VPD_LV_DEVICE_ID   0x83
 #define HPSA_VPD_LV_DEVICE_GEOMETRY 0xC1
@@ -166,6 +167,7 @@
 /* Logical volume states */
 #define HPSA_VPD_LV_STATUS_UNSUPPORTED 0xff
 #define HPSA_LV_OK  0x0
+#define HPSA_LV_FAILED 0x01
 #define HPSA_LV_NOT_AVAILABLE  0x0b
 #define HPSA_LV_UNDERGOING_ERASE   0x0F
 #define HPSA_LV_UNDERGOING_RPI 0x12

Re: [bdi_unregister] 165a5e22fa INFO: task swapper:1 blocked for more than 120 seconds.

[James Bottomley]

On Mon, 2017-03-06 at 17:13 +0100, Jan Kara wrote:
> On Mon 06-03-17 07:44:55, James Bottomley wrote:
> > On Mon, 2017-03-06 at 16:14 +0100, Jan Kara wrote:
> > > On Mon 06-03-17 06:35:21, James Bottomley wrote:
> > > > On Mon, 2017-03-06 at 13:01 +0100, Jan Kara wrote:
> > > > > On Mon 06-03-17 11:27:33, Jan Kara wrote:
> > > > > > Hi,
> > > > > > 
> > > > > > On Sun 05-03-17 10:21:11, Wu Fengguang wrote:
> > > > > > > FYI next-20170303 is good while mainline is bad with this
> > > > > > > error.
> > > > > > > The attached reproduce-* may help reproduce the issue.
> > > > > > 
> > > > > > Thanks for report! So from the stacktrace we are in the
> > > > > > path 
> > > > > > testing removal of a device immediately after it has been
> > > > > > probed 
> > > > > > and for some reason bdi_unregister() hangs - likely waiting
> > > > > > for
> > > > > > cgroup-writeback references to drop. Given how early this
> > > > > > happens 
> > > > > > my guess is we fail to initialize something but for now I
> > > > > > don't
> > > > > > see 
> > > > > > how my patch could make a difference. I'm trying to
> > > > > > reproduce
> > > > > > this 
> > > > > > to be able to debug more...
> > > > > 
> > > > > OK, so after some debugging I think this is yet another
> > > > > problem
> > > > > in 
> > > > > SCSI initialization / destruction code which my patch only
> > > > > makes 
> > > > > visible (added relevant maintainers).
> > > > > 
> > > > > I can reproduce the problem reliably with enabling:
> > > > > 
> > > > > CONFIG_DEBUG_TEST_DRIVER_REMOVE=y
> > > > > CONFIG_SCSI_DEBUG=m
> > > > > CONFIG_BLK_CGROUP=y
> > > > > CONFIG_MEMCG=y
> > > > > (and thus CONFIG_CGROUP_WRITEBACK=y)
> > > > > 
> > > > > then 'modprobe scsi_debug' is all it takes to reproduce hang.
> > > > > Relevant kernel messages with some of my debugging added
> > > > > (attached is 
> > > > > a patch that adds those debug messages):
> > > > 
> > > > This looks to be precisely the same problem Dan Williams was
> > > > debugging
> > > > for us.
> > > > 
> > > > > [   58.721765] scsi host0: scsi_debug: version 1.86
> > > > > [20160430]
> > > > > [   58.721765]   dev_size_mb=8, opts=0x0, submit_queues=1,
> > > > > statistics=0
> > > > > [   58.728946] CGWB init 88007fbb2000
> > > > > [   58.730095] Created sdev 880078e1a000
> > > > > [   58.731611] scsi 0:0:0:0: Direct-Access Linux   
> > > > >  scsi_debug
> > > > > 0186 PQ : 0 ANSI: 7
> > > > > [   58.782246] sd 0:0:0:0: [sda] 16384 512-byte logical
> > > > > blocks:
> > > > > (8.39
> > > > > MB/8.00 MiB)
> > > > > [   58.789687] sd 0:0:0:0: [sda] Write Protect is off
> > > > > [   58.791140] sd 0:0:0:0: [sda] Mode Sense: 73 00 10 08
> > > > > [   58.800879] sd 0:0:0:0: [sda] Write cache: enabled, read
> > > > > cache:
> > > > > enabled, supports DPO and FUA
> > > > > [   58.893738] sd 0:0:0:0: [sda] Attached SCSI disk
> > > > > [   58.896808] Unreg1
> > > > > [   58.897960] Unreg2
> > > > > [   58.898637] Unreg3
> > > > > [   58.899100] CGWB 88007fbb2000 usage_cnt: 0
> > > > > [   58.94] Unreg4
> > > > > [   58.904976] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> > > > 
> > > > OK, can you put a WARN_ON trace in sd_shutdown and tell us
> > > > where
> > > > this
> > > > is coming from.  For the device to be reused after this we have
> > > > to
> > > > be
> > > > calling sd_shutdown() without going into SDEV_DEL.
> > > 
> > > Sure. The call trace is:
> > > 
> > > [   41.919244] [ cut here ]
> > > [   41.919263] WARNING: CPU: 4 PID: 2335 at
> > > drivers/scsi/sd.c:3332
> > > sd_shutdown+0x2f/0x100
> > > [   41.919268] Modules linked in: scsi_debug(+) netconsole loop
> > > btrfs
> > > raid6_pq zlib_deflate lzo_compress xor
> > > [   41.919319] CPU: 4 PID: 2335 Comm: modprobe Not tainted 4.11.0
> > > -rc1
> > > -xen+ #49
> > > [   41.919325] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> > > [   41.919331] Call Trace:
> > > [   41.919343]  dump_stack+0x8e/0xf0
> > > [   41.919354]  __warn+0x116/0x120
> > > [   41.919361]  warn_slowpath_null+0x1d/0x20
> > > [   41.919368]  sd_shutdown+0x2f/0x100
> > > [   41.919374]  sd_remove+0x70/0xd0
> > > 
> > > *** Here is the unexpected step I guess...
> > > 
> > > [   41.919383]  driver_probe_device+0xe0/0x4c0
> > 
> > Exactly.  It's this, I think
> > 
> > bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE)
> > &&
> >!drv->suppress_bind_attrs;
> > 
> > You have that config option set.
> 
> Yes - or better said 0-day testing has it set. Maybe that is not a 
> sane default for 0-day tests? The option is explicitely marked as
> "unstable"... Fengguang?
> 
> > So the drivers base layer is calling ->remove after probe and
> > triggering the destruction of the queue.
> > 
> > What to do about this (apart from nuke such a stupid option) is
> > somewhat more problematic.
> 
> I guess this is between you and Greg :).

Nice try, sport ... you qualify just behind Dan in the "not my problem"

[Bug 108621] kernel BUG in drivers/scsi/scsi_lib.c

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=108621

Szőgyényi Gábor (szg0...@freemail.hu) changed:

   What|Removed |Added

 CC||szg0...@freemail.hu

--- Comment #3 from Szőgyényi Gábor (szg0...@freemail.hu) ---
Please try to reproduce this bug with latest kernel image.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

Re: [PATCH] scsi: qedf: Use vsprintf extension %pad

[Chad Dupuis]

On Mon, 6 Mar 2017, 6:32pm -, Joe Perches wrote:

> Using %llx for a dma_addr_t can lead to format/argument mismatches.
> Use %pad and the address of the dma_addr_t instead.
> 
> Signed-off-by: Joe Perches 
> ---
>  drivers/scsi/qedf/qedf_main.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
> index d9d7a86b5f8b..8e2a160490e6 100644
> --- a/drivers/scsi/qedf/qedf_main.c
> +++ b/drivers/scsi/qedf/qedf_main.c
> @@ -2456,8 +2456,8 @@ static int qedf_alloc_bdq(struct qedf_ctx *qedf)
>   }
>  
>   QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC,
> - "BDQ PBL addr=0x%p dma=0x%llx.\n", qedf->bdq_pbl,
> - qedf->bdq_pbl_dma);
> +   "BDQ PBL addr=0x%p dma=%pad\n",
> +   qedf->bdq_pbl, >bdq_pbl_dma);
>  
>   /*
>* Populate BDQ PBL with physical and virtual address of individual
> 

Looks good.

Acked-by: Chad Dupuis 

Re: [PATCH] scsi: qedf: Fix defective logging format and argument mismatches

[Chad Dupuis]

On Sat, 4 Mar 2017, 8:07am -, Joe Perches wrote:

> Add __printf compiler verification of format and arguments.
> Fix fallout.
> 
> Signed-off-by: Joe Perches 
> ---
>  drivers/scsi/qedf/qedf_dbg.h | 13 -
>  drivers/scsi/qedf/qedf_fip.c |  2 +-
>  drivers/scsi/qedf/qedf_io.c  |  4 ++--
>  3 files changed, 11 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h

Thanks.

Acked-by: Chad Dupuis 

Re: [bdi_unregister] 165a5e22fa INFO: task swapper:1 blocked for more than 120 seconds.

[James Bottomley]

On Mon, 2017-03-06 at 16:14 +0100, Jan Kara wrote:
> On Mon 06-03-17 06:35:21, James Bottomley wrote:
> > On Mon, 2017-03-06 at 13:01 +0100, Jan Kara wrote:
> > > On Mon 06-03-17 11:27:33, Jan Kara wrote:
> > > > Hi,
> > > > 
> > > > On Sun 05-03-17 10:21:11, Wu Fengguang wrote:
> > > > > FYI next-20170303 is good while mainline is bad with this
> > > > > error.
> > > > > The attached reproduce-* may help reproduce the issue.
> > > > 
> > > > Thanks for report! So from the stacktrace we are in the path 
> > > > testing removal of a device immediately after it has been
> > > > probed 
> > > > and for some reason bdi_unregister() hangs - likely waiting for
> > > > cgroup-writeback references to drop. Given how early this
> > > > happens 
> > > > my guess is we fail to initialize something but for now I don't
> > > > see 
> > > > how my patch could make a difference. I'm trying to reproduce
> > > > this 
> > > > to be able to debug more...
> > > 
> > > OK, so after some debugging I think this is yet another problem
> > > in 
> > > SCSI initialization / destruction code which my patch only makes 
> > > visible (added relevant maintainers).
> > > 
> > > I can reproduce the problem reliably with enabling:
> > > 
> > > CONFIG_DEBUG_TEST_DRIVER_REMOVE=y
> > > CONFIG_SCSI_DEBUG=m
> > > CONFIG_BLK_CGROUP=y
> > > CONFIG_MEMCG=y
> > > (and thus CONFIG_CGROUP_WRITEBACK=y)
> > > 
> > > then 'modprobe scsi_debug' is all it takes to reproduce hang. 
> > > Relevant kernel messages with some of my debugging added
> > > (attached is 
> > > a patch that adds those debug messages):
> > 
> > This looks to be precisely the same problem Dan Williams was
> > debugging
> > for us.
> > 
> > > [   58.721765] scsi host0: scsi_debug: version 1.86 [20160430]
> > > [   58.721765]   dev_size_mb=8, opts=0x0, submit_queues=1,
> > > statistics=0
> > > [   58.728946] CGWB init 88007fbb2000
> > > [   58.730095] Created sdev 880078e1a000
> > > [   58.731611] scsi 0:0:0:0: Direct-Access Linux   
> > >  scsi_debug
> > > 0186 PQ : 0 ANSI: 7
> > > [   58.782246] sd 0:0:0:0: [sda] 16384 512-byte logical blocks:
> > > (8.39
> > > MB/8.00 MiB)
> > > [   58.789687] sd 0:0:0:0: [sda] Write Protect is off
> > > [   58.791140] sd 0:0:0:0: [sda] Mode Sense: 73 00 10 08
> > > [   58.800879] sd 0:0:0:0: [sda] Write cache: enabled, read
> > > cache:
> > > enabled, supports DPO and FUA
> > > [   58.893738] sd 0:0:0:0: [sda] Attached SCSI disk
> > > [   58.896808] Unreg1
> > > [   58.897960] Unreg2
> > > [   58.898637] Unreg3
> > > [   58.899100] CGWB 88007fbb2000 usage_cnt: 0
> > > [   58.94] Unreg4
> > > [   58.904976] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> > 
> > OK, can you put a WARN_ON trace in sd_shutdown and tell us where
> > this
> > is coming from.  For the device to be reused after this we have to
> > be
> > calling sd_shutdown() without going into SDEV_DEL.
> 
> Sure. The call trace is:
> 
> [   41.919244] [ cut here ]
> [   41.919263] WARNING: CPU: 4 PID: 2335 at drivers/scsi/sd.c:3332
> sd_shutdown+0x2f/0x100
> [   41.919268] Modules linked in: scsi_debug(+) netconsole loop btrfs
> raid6_pq zlib_deflate lzo_compress xor
> [   41.919319] CPU: 4 PID: 2335 Comm: modprobe Not tainted 4.11.0-rc1
> -xen+ #49
> [   41.919325] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [   41.919331] Call Trace:
> [   41.919343]  dump_stack+0x8e/0xf0
> [   41.919354]  __warn+0x116/0x120
> [   41.919361]  warn_slowpath_null+0x1d/0x20
> [   41.919368]  sd_shutdown+0x2f/0x100
> [   41.919374]  sd_remove+0x70/0xd0
> 
> *** Here is the unexpected step I guess...
> 
> [   41.919383]  driver_probe_device+0xe0/0x4c0

Exactly.  It's this, I think

bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE) &&
   !drv->suppress_bind_attrs;

You have that config option set.

So the drivers base layer is calling ->remove after probe and
triggering the destruction of the queue.

What to do about this (apart from nuke such a stupid option) is
somewhat more problematic.

James

Darlehen

[novita . rimawati]

Sie benötigen eine Finanzierung?

  Wir vergeben Darlehen. Bewerben Sie sich jetzt. Senden Sie

  uns u.a. Details zurück und Sie erhalten in Kürze Antwort



  Vorname:

  Familienname:

  Geschlecht:

  Land:

  Telefonnummer:

  benötigter Darlehensbetrag:

  Gewünschte Laufzeit:



  Mit freundlichen Grüßen

Re: [Xen-devel] [PATCH 29/29] drivers, xen: convert grant_map.users from atomic_t to refcount_t

[Boris Ostrovsky]

On 03/06/2017 09:21 AM, Elena Reshetova wrote:
> refcount_t type and corresponding API should be
> used instead of atomic_t when the variable is used as
> a reference counter. This allows to avoid accidental
> refcounter overflows that might lead to use-after-free
> situations.
>
> Signed-off-by: Elena Reshetova 
> Signed-off-by: Hans Liljestrand 
> Signed-off-by: Kees Cook 
> Signed-off-by: David Windsor 
> ---
>  drivers/xen/gntdev.c | 11 ++-
>  1 file changed, 6 insertions(+), 5 deletions(-)

Reviewed-by: Boris Ostrovsky 

Re: [PATCH] scsi: qedf: Fix defective logging format and argument mismatches

[Joe Perches]

On Mon, 2017-03-06 at 10:17 -0800, Joe Perches wrote:
> On Tue, 2017-03-07 at 02:03 +0800, kbuild test robot wrote:
> > Hi Joe,
> 
> Hi again Fengguang's robot.

Rehi.  OK, it is a new message.  Patch sent.

Re: [ANNOUNCE]: Broadcom (Emulex) FC Target driver - efct

[Bart Van Assche]

On Sun, 2017-03-05 at 17:35 +0100, Sebastian Herbszt wrote:
> Just like Hannes I do favour integration. I guess it could be
> comparable to qla2xxx + tcm_qla2xxx, lpfc + lpfc_scst and
> lpfc + tcm_lpfc. That approach might even help Bart with his
> target driver unification if he didn't give up on that topic.

Hello Sebastian,

That project is still on my to-do list :-) However, while I was
working on that project I hit bugs related to abort handling in
the QLogic FC and also in the iSCSI target drivers. I want to fix
these bugs first because otherwise if my tests fail it is not
possible to figure out whether I hit a regression or an existing
bug.

Bart.

[PATCH] scsi: qedf: Use vsprintf extension %pad

[Joe Perches]

Using %llx for a dma_addr_t can lead to format/argument mismatches.
Use %pad and the address of the dma_addr_t instead.

Signed-off-by: Joe Perches 
---
 drivers/scsi/qedf/qedf_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index d9d7a86b5f8b..8e2a160490e6 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2456,8 +2456,8 @@ static int qedf_alloc_bdq(struct qedf_ctx *qedf)
}
 
QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC,
-   "BDQ PBL addr=0x%p dma=0x%llx.\n", qedf->bdq_pbl,
-   qedf->bdq_pbl_dma);
+ "BDQ PBL addr=0x%p dma=%pad\n",
+ qedf->bdq_pbl, >bdq_pbl_dma);
 
/*
 * Populate BDQ PBL with physical and virtual address of individual
-- 
2.10.0.rc2.1.g053435c

Re: [PATCH] scsi: qedf: Fix defective logging format and argument mismatches

[kbuild test robot]

Hi Joe,

[auto build test WARNING on scsi/for-next]
[also build test WARNING on v4.11-rc1 next-20170306]
[if your patch is applied to the wrong git tree, please drop us a note to help 
improve the system]

url:
https://github.com/0day-ci/linux/commits/Joe-Perches/scsi-qedf-Fix-defective-logging-format-and-argument-mismatches/20170307-005400
base:   https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git for-next
config: xtensa-allmodconfig (attached as .config)
compiler: xtensa-linux-gcc (GCC) 4.9.0
reproduce:
wget 
https://raw.githubusercontent.com/01org/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
make.cross ARCH=xtensa 

All warnings (new ones prefixed by >>):

   drivers/scsi/qedf/qedf_main.c: In function 'qedf_alloc_bdq':
>> drivers/scsi/qedf/qedf_main.c:2458:2: warning: format '%llx' expects 
>> argument of type 'long long unsigned int', but argument 7 has type 
>> 'dma_addr_t' [-Wformat=]
 QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC,
 ^

vim +2458 drivers/scsi/qedf/qedf_main.c

61d8658b Dupuis, Chad 2017-02-15  2442  }
61d8658b Dupuis, Chad 2017-02-15  2443  }
61d8658b Dupuis, Chad 2017-02-15  2444  
61d8658b Dupuis, Chad 2017-02-15  2445  /* Alloc dma memory for BDQ 
page buffer list */
61d8658b Dupuis, Chad 2017-02-15  2446  qedf->bdq_pbl_mem_size =
61d8658b Dupuis, Chad 2017-02-15  2447  QEDF_BDQ_SIZE * 
sizeof(struct scsi_bd);
61d8658b Dupuis, Chad 2017-02-15  2448  qedf->bdq_pbl_mem_size =
61d8658b Dupuis, Chad 2017-02-15  2449  
ALIGN(qedf->bdq_pbl_mem_size, QEDF_PAGE_SIZE);
61d8658b Dupuis, Chad 2017-02-15  2450  
61d8658b Dupuis, Chad 2017-02-15  2451  qedf->bdq_pbl = 
dma_alloc_coherent(>pdev->dev,
61d8658b Dupuis, Chad 2017-02-15  2452  qedf->bdq_pbl_mem_size, 
>bdq_pbl_dma, GFP_KERNEL);
61d8658b Dupuis, Chad 2017-02-15  2453  if (!qedf->bdq_pbl) {
61d8658b Dupuis, Chad 2017-02-15  2454  
QEDF_ERR(&(qedf->dbg_ctx), "Could not allocate BDQ PBL.\n");
61d8658b Dupuis, Chad 2017-02-15  2455  return -ENOMEM;
61d8658b Dupuis, Chad 2017-02-15  2456  }
61d8658b Dupuis, Chad 2017-02-15  2457  
61d8658b Dupuis, Chad 2017-02-15 @2458  QEDF_INFO(&(qedf->dbg_ctx), 
QEDF_LOG_DISC,
61d8658b Dupuis, Chad 2017-02-15  2459  "BDQ PBL addr=0x%p 
dma=0x%llx.\n", qedf->bdq_pbl,
61d8658b Dupuis, Chad 2017-02-15  2460  qedf->bdq_pbl_dma);
61d8658b Dupuis, Chad 2017-02-15  2461  
61d8658b Dupuis, Chad 2017-02-15  2462  /*
61d8658b Dupuis, Chad 2017-02-15  2463   * Populate BDQ PBL with 
physical and virtual address of individual
61d8658b Dupuis, Chad 2017-02-15  2464   * BDQ buffers
61d8658b Dupuis, Chad 2017-02-15  2465   */
61d8658b Dupuis, Chad 2017-02-15  2466  pbl = (struct scsi_bd 
*)qedf->bdq_pbl;

:: The code at line 2458 was first introduced by commit
:: 61d8658b4a435eac729966cc94cdda077a8df5cd scsi: qedf: Add QLogic FastLinQ 
offload FCoE driver framework.

:: TO: Dupuis, Chad <chad.dup...@cavium.com>
:: CC: Martin K. Petersen <martin.peter...@oracle.com>

---
0-DAY kernel test infrastructureOpen Source Technology Center
https://lists.01.org/pipermail/kbuild-all   Intel Corporation


.config.gz
Description: application/gzip

Re: [PATCH] scsi: qedf: Fix defective logging format and argument mismatches

[kbuild test robot]

Hi Joe,

[auto build test WARNING on scsi/for-next]
[also build test WARNING on v4.11-rc1 next-20170306]
[if your patch is applied to the wrong git tree, please drop us a note to help 
improve the system]

url:
https://github.com/0day-ci/linux/commits/Joe-Perches/scsi-qedf-Fix-defective-logging-format-and-argument-mismatches/20170307-005400
base:   https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git for-next
config: parisc-allmodconfig (attached as .config)
compiler: hppa-linux-gnu-gcc (Debian 6.1.1-9) 6.1.1 20160705
reproduce:
wget 
https://raw.githubusercontent.com/01org/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
make.cross ARCH=parisc 

All warnings (new ones prefixed by >>):

   In file included from drivers/scsi/qedf/qedf.h:28:0,
from drivers/scsi/qedf/qedf_main.c:24:
   drivers/scsi/qedf/qedf_main.c: In function 'qedf_alloc_bdq':
>> drivers/scsi/qedf/qedf_main.c:2459:6: warning: format '%llx' expects 
>> argument of type 'long long unsigned int', but argument 7 has type 
>> 'dma_addr_t {aka unsigned int}' [-Wformat=]
 "BDQ PBL addr=0x%p dma=0x%llx.\n", qedf->bdq_pbl,
 ^
   drivers/scsi/qedf/qedf_dbg.h:82:50: note: in definition of macro 'QEDF_INFO'
  qedf_dbg_info(pdev, __func__, __LINE__, level, fmt, \
 ^~~

vim +2459 drivers/scsi/qedf/qedf_main.c

61d8658b Dupuis, Chad 2017-02-15  2443  }
61d8658b Dupuis, Chad 2017-02-15  2444  
61d8658b Dupuis, Chad 2017-02-15  2445  /* Alloc dma memory for BDQ 
page buffer list */
61d8658b Dupuis, Chad 2017-02-15  2446  qedf->bdq_pbl_mem_size =
61d8658b Dupuis, Chad 2017-02-15  2447  QEDF_BDQ_SIZE * 
sizeof(struct scsi_bd);
61d8658b Dupuis, Chad 2017-02-15  2448  qedf->bdq_pbl_mem_size =
61d8658b Dupuis, Chad 2017-02-15  2449  
ALIGN(qedf->bdq_pbl_mem_size, QEDF_PAGE_SIZE);
61d8658b Dupuis, Chad 2017-02-15  2450  
61d8658b Dupuis, Chad 2017-02-15  2451  qedf->bdq_pbl = 
dma_alloc_coherent(>pdev->dev,
61d8658b Dupuis, Chad 2017-02-15  2452  qedf->bdq_pbl_mem_size, 
>bdq_pbl_dma, GFP_KERNEL);
61d8658b Dupuis, Chad 2017-02-15  2453  if (!qedf->bdq_pbl) {
61d8658b Dupuis, Chad 2017-02-15  2454  
QEDF_ERR(&(qedf->dbg_ctx), "Could not allocate BDQ PBL.\n");
61d8658b Dupuis, Chad 2017-02-15  2455  return -ENOMEM;
61d8658b Dupuis, Chad 2017-02-15  2456  }
61d8658b Dupuis, Chad 2017-02-15  2457  
61d8658b Dupuis, Chad 2017-02-15  2458  QEDF_INFO(&(qedf->dbg_ctx), 
QEDF_LOG_DISC,
61d8658b Dupuis, Chad 2017-02-15 @2459  "BDQ PBL addr=0x%p 
dma=0x%llx.\n", qedf->bdq_pbl,
61d8658b Dupuis, Chad 2017-02-15  2460  qedf->bdq_pbl_dma);
61d8658b Dupuis, Chad 2017-02-15  2461  
61d8658b Dupuis, Chad 2017-02-15  2462  /*
61d8658b Dupuis, Chad 2017-02-15  2463   * Populate BDQ PBL with 
physical and virtual address of individual
61d8658b Dupuis, Chad 2017-02-15  2464   * BDQ buffers
61d8658b Dupuis, Chad 2017-02-15  2465   */
61d8658b Dupuis, Chad 2017-02-15  2466  pbl = (struct scsi_bd 
*)qedf->bdq_pbl;
61d8658b Dupuis, Chad 2017-02-15  2467  for (i = 0; i < QEDF_BDQ_SIZE; 
i++) {

:: The code at line 2459 was first introduced by commit
:: 61d8658b4a435eac729966cc94cdda077a8df5cd scsi: qedf: Add QLogic FastLinQ 
offload FCoE driver framework.

:: TO: Dupuis, Chad <chad.dup...@cavium.com>
:: CC: Martin K. Petersen <martin.peter...@oracle.com>

---
0-DAY kernel test infrastructureOpen Source Technology Center
https://lists.01.org/pipermail/kbuild-all   Intel Corporation


.config.gz
Description: application/gzip

Re: [PATCH] scsi: qedf: Fix defective logging format and argument mismatches

[Joe Perches]

On Tue, 2017-03-07 at 02:03 +0800, kbuild test robot wrote:
> Hi Joe,

Hi again Fengguang's robot.

> [auto build test WARNING on scsi/for-next]
> [also build test WARNING on v4.11-rc1 next-20170306]
> [if your patch is applied to the wrong git tree, please drop us a note to 
> help improve the system]
> 
> url:
> https://github.com/0day-ci/linux/commits/Joe-Perches/scsi-qedf-Fix-defective-logging-format-and-argument-mismatches/20170307-005400
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git for-next
> config: parisc-allmodconfig (attached as .config)
> compiler: hppa-linux-gnu-gcc (Debian 6.1.1-9) 6.1.1 20160705

Not new messages.

Re: [RFC] hv_storvsc: error handling.

[Stephen Hemminger]

> > I will try it, but it can't work for two reasons.
> > First, the INVALID_LUN error is masked off on INQUIRY in current code.
> > Second, the scsi_device is instantiated already as part of scan probe 
> > process
> > before it gets here.  
> 
> Was the invalid LUN in the LUN0 position. Inquiry of LUN0 support (when LUN0 
> is not populated)
> was added only recently to address host side issue.

When probing the code probes with LUN 1, ...

There is a cause where kernel does INQUIRY on LUN0, it looks kernel is asking 
for
page code 80 which is optional "Unit Serial Number".  And then WS2016 is 
returning
an error and invalid sense data.  The old masking of errors caused kernel to
interpret sense data as Unit Serial Number which is also not good but looks 
harmless.

 
> > The best solution so far is:
> > - remove old INQUIRY/SENSE error masking
> > + add new workaround for INQUIRY of device id on LUN 0
> >   which appears to be the reason for old masking
> > + return errors on missing LUN
> > + provide better transport services for hot remove (rather
> >   than detecting by failed I/O).  
> 
> This the mechanism used by the host for notifying LUN removal - invalid LUN 
> error code.

This has a couple of problems. First, it means that hotplug doesn't occur until
an I/O is done. Second the current code was not being truthful to block layer.
If it has to handle hotplug in this manner, it should have still failed the I/O.
If application was using direct I/O it would want to know that write failed.

Perhaps the existing channel mechanism can be used as notification path.

RE: [RFC] hv_storvsc: error handling.

[KY Srinivasan]

> -Original Message-
> From: Stephen Hemminger [mailto:step...@networkplumber.org]
> Sent: Monday, March 6, 2017 8:36 AM
> To: KY Srinivasan 
> Cc: James Bottomley ; Hannes
> Reinecke ; Christoph Hellwig ; James
> Bottomley ; Jens Axboe ;
> Linus Torvalds ; Martin K. Petersen
> ; Dexuan Cui ; Long
> Li ; Josh Poulson ; Adrian
> Suhov (Cloudbase Solutions SRL) ; linux-
> s...@vger.kernel.org; Haiyang Zhang 
> Subject: Re: [RFC] hv_storvsc: error handling.
> 
> On Sat, 4 Mar 2017 21:03:41 +
> KY Srinivasan  wrote:
> 
> > > -Original Message-
> > > From: Stephen Hemminger [mailto:step...@networkplumber.org]
> > > Sent: Friday, March 3, 2017 4:50 PM
> > > To: James Bottomley 
> > > Cc: Hannes Reinecke ; Christoph Hellwig ;
> > > James Bottomley ; Jens Axboe
> > > ; Linus Torvalds ;
> > > Martin K. Petersen ; KY Srinivasan
> > > ; Dexuan Cui ; Long Li
> > > ; Josh Poulson ;
> Adrian
> > > Suhov (Cloudbase Solutions SRL) ; linux-
> > > s...@vger.kernel.org; Haiyang Zhang 
> > > Subject: [RFC] hv_storvsc: error handling.
> > >
> > > Needs more testing but this does fix the observed problem.
> > >
> > > From: Stephen Hemminger 
> > >
> > > Subject: [PATCH] hv_storvsc: fix error handling
> > >
> > > The Hyper-V storvsc SCSI driver was hiding all errors in INQUIRY and
> > > MODE_SENSE commands. This caused the scan process to incorrectly
> think
> > > devices were present and online.  Also invalid LUN errors were not
> > > being handled correctly.
> > >
> > > This fixes problems booting a GEN2 VM on Hyper-V. It effectively
> > > reverts commit 4ed51a21c0f69 ("Staging: hv: storvsc: Fixup
> > > srb and scsi status for INQUIRY and MODE_SENSE")
> > >
> > > Signed-off-by: Stephen Hemminger 
> > > ---
> > >  drivers/scsi/storvsc_drv.c | 48 
> > > --
> > >  1 file changed, 4 insertions(+), 44 deletions(-)
> > >
> > > diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> > > index 638e5f427c90..8cc241fc54b8 100644
> > > --- a/drivers/scsi/storvsc_drv.c
> > > +++ b/drivers/scsi/storvsc_drv.c
> > > @@ -543,28 +543,6 @@ static void storvsc_host_scan(struct work_struct
> > > *work)
> > >   kfree(wrk);
> > >  }
> > >
> > > -static void storvsc_remove_lun(struct work_struct *work)
> > > -{
> > > - struct storvsc_scan_work *wrk;
> > > - struct scsi_device *sdev;
> > > -
> > > - wrk = container_of(work, struct storvsc_scan_work, work);
> > > - if (!scsi_host_get(wrk->host))
> > > - goto done;
> > > -
> > > - sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
> > > -
> > > - if (sdev) {
> > > - scsi_remove_device(sdev);
> > > - scsi_device_put(sdev);
> > > - }
> > > - scsi_host_put(wrk->host);
> > > -
> > > -done:
> > > - kfree(wrk);
> > > -}
> > > -
> > > -
> > >  /*
> > >   * We can get incoming messages from the host that are not in response
> to
> > >   * messages that we have sent out. An example of this would be
> messages
> > > @@ -955,8 +933,7 @@ static void storvsc_handle_error(struct
> > > vmscsi_request *vm_srb,
> > >   }
> > >   break;
> > >   case SRB_STATUS_INVALID_LUN:
> > > - do_work = true;
> > > - process_err_fn = storvsc_remove_lun;
> > > + set_host_byte(scmnd, DID_NO_CONNECT);
> > >   break;
> > >   case SRB_STATUS_ABORTED:
> > >   if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID
> > > &&
> > > @@ -1050,32 +1027,15 @@ static void storvsc_on_io_completion(struct
> > > storvsc_device *stor_device,
> > >
> > >   stor_pkt = >vstor_packet;
> > >
> > > - /*
> > > -  * The current SCSI handling on the host side does
> > > -  * not correctly handle:
> > > -  * INQUIRY command with page code parameter set to 0x80
> > > -  * MODE_SENSE command with cmd[2] == 0x1c
> > > -  *
> > > -  * Setup srb and scsi status so this won't be fatal.
> > > -  * We do this so we can distinguish truly fatal failues
> > > -  * (srb status == 0x4) and off-line the device in that case.
> > > -  */
> > > -
> > > - if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) ||
> > > -(stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) {
> > > - vstor_packet->vm_srb.scsi_status = 0;
> > > - vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS;
> > > - }
> > > -
> > > -
> > >   /* Copy over the status...etc */
> > >   

Re: [RFC] hv_storvsc: error handling.

[Stephen Hemminger]

On Sat, 4 Mar 2017 21:03:41 +
KY Srinivasan  wrote:

> > -Original Message-
> > From: Stephen Hemminger [mailto:step...@networkplumber.org]
> > Sent: Friday, March 3, 2017 4:50 PM
> > To: James Bottomley 
> > Cc: Hannes Reinecke ; Christoph Hellwig ;
> > James Bottomley ; Jens Axboe
> > ; Linus Torvalds ;
> > Martin K. Petersen ; KY Srinivasan
> > ; Dexuan Cui ; Long Li
> > ; Josh Poulson ; Adrian
> > Suhov (Cloudbase Solutions SRL) ; linux-
> > s...@vger.kernel.org; Haiyang Zhang 
> > Subject: [RFC] hv_storvsc: error handling.
> > 
> > Needs more testing but this does fix the observed problem.
> > 
> > From: Stephen Hemminger 
> > 
> > Subject: [PATCH] hv_storvsc: fix error handling
> > 
> > The Hyper-V storvsc SCSI driver was hiding all errors in INQUIRY and
> > MODE_SENSE commands. This caused the scan process to incorrectly think
> > devices were present and online.  Also invalid LUN errors were not
> > being handled correctly.
> > 
> > This fixes problems booting a GEN2 VM on Hyper-V. It effectively
> > reverts commit 4ed51a21c0f69 ("Staging: hv: storvsc: Fixup
> > srb and scsi status for INQUIRY and MODE_SENSE")
> > 
> > Signed-off-by: Stephen Hemminger 
> > ---
> >  drivers/scsi/storvsc_drv.c | 48 
> > --
> >  1 file changed, 4 insertions(+), 44 deletions(-)
> > 
> > diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> > index 638e5f427c90..8cc241fc54b8 100644
> > --- a/drivers/scsi/storvsc_drv.c
> > +++ b/drivers/scsi/storvsc_drv.c
> > @@ -543,28 +543,6 @@ static void storvsc_host_scan(struct work_struct
> > *work)
> > kfree(wrk);
> >  }
> > 
> > -static void storvsc_remove_lun(struct work_struct *work)
> > -{
> > -   struct storvsc_scan_work *wrk;
> > -   struct scsi_device *sdev;
> > -
> > -   wrk = container_of(work, struct storvsc_scan_work, work);
> > -   if (!scsi_host_get(wrk->host))
> > -   goto done;
> > -
> > -   sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
> > -
> > -   if (sdev) {
> > -   scsi_remove_device(sdev);
> > -   scsi_device_put(sdev);
> > -   }
> > -   scsi_host_put(wrk->host);
> > -
> > -done:
> > -   kfree(wrk);
> > -}
> > -
> > -
> >  /*
> >   * We can get incoming messages from the host that are not in response to
> >   * messages that we have sent out. An example of this would be messages
> > @@ -955,8 +933,7 @@ static void storvsc_handle_error(struct
> > vmscsi_request *vm_srb,
> > }
> > break;
> > case SRB_STATUS_INVALID_LUN:
> > -   do_work = true;
> > -   process_err_fn = storvsc_remove_lun;
> > +   set_host_byte(scmnd, DID_NO_CONNECT);
> > break;
> > case SRB_STATUS_ABORTED:
> > if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID
> > &&
> > @@ -1050,32 +1027,15 @@ static void storvsc_on_io_completion(struct
> > storvsc_device *stor_device,
> > 
> > stor_pkt = >vstor_packet;
> > 
> > -   /*
> > -* The current SCSI handling on the host side does
> > -* not correctly handle:
> > -* INQUIRY command with page code parameter set to 0x80
> > -* MODE_SENSE command with cmd[2] == 0x1c
> > -*
> > -* Setup srb and scsi status so this won't be fatal.
> > -* We do this so we can distinguish truly fatal failues
> > -* (srb status == 0x4) and off-line the device in that case.
> > -*/
> > -
> > -   if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) ||
> > -  (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) {
> > -   vstor_packet->vm_srb.scsi_status = 0;
> > -   vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS;
> > -   }
> > -
> > -
> > /* Copy over the status...etc */
> > stor_pkt->vm_srb.scsi_status = vstor_packet->vm_srb.scsi_status;
> > stor_pkt->vm_srb.srb_status = vstor_packet->vm_srb.srb_status;
> > stor_pkt->vm_srb.sense_info_length =
> > vstor_packet->vm_srb.sense_info_length;
> > 
> > -   if (vstor_packet->vm_srb.scsi_status != 0 ||
> > -   vstor_packet->vm_srb.srb_status != SRB_STATUS_SUCCESS)
> > +   if (stor_pkt->vm_srb.cdb[0] != INQUIRY &&
> > +   (vstor_packet->vm_srb.scsi_status != 0 ||
> > +vstor_packet->vm_srb.srb_status != SRB_STATUS_SUCCESS))
> > storvsc_log(device, STORVSC_LOGGING_WARN,
> > "cmd 0x%x scsi status 0x%x srb status 0x%x\n",
> > stor_pkt->vm_srb.cdb[0],
> > --  
> 
> This patch gets rid of the ability to "hot remove" LUNs. I don't think that 
> can be part of any
> solution. The INQUIRY hack I put in a long time ago was to deal with host 
> bugs on prior 

Re: [PATCH 11/29] drivers, media: convert cx88_core.refcount from atomic_t to refcount_t

[Sergei Shtylyov]

Hello.

On 03/06/2017 05:20 PM, Elena Reshetova wrote:


refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 

[...]

diff --git a/drivers/media/pci/cx88/cx88.h b/drivers/media/pci/cx88/cx88.h
index 115414c..16c1313 100644
--- a/drivers/media/pci/cx88/cx88.h
+++ b/drivers/media/pci/cx88/cx88.h
@@ -24,6 +24,7 @@
 #include 
 #include 
 #include 
+#include 

 #include 
 #include 
@@ -339,7 +340,7 @@ struct cx8802_dev;

 struct cx88_core {
struct list_head   devlist;
-   atomic_t   refcount;
+   refcount_t   refcount;


   Could you please keep the name aligned with above and below?



/* board name */
intnr;



MBR, Sergei

Re: [bdi_unregister] 165a5e22fa INFO: task swapper:1 blocked for more than 120 seconds.

[Jan Kara]

On Mon 06-03-17 07:44:55, James Bottomley wrote:
> On Mon, 2017-03-06 at 16:14 +0100, Jan Kara wrote:
> > On Mon 06-03-17 06:35:21, James Bottomley wrote:
> > > On Mon, 2017-03-06 at 13:01 +0100, Jan Kara wrote:
> > > > On Mon 06-03-17 11:27:33, Jan Kara wrote:
> > > > > Hi,
> > > > > 
> > > > > On Sun 05-03-17 10:21:11, Wu Fengguang wrote:
> > > > > > FYI next-20170303 is good while mainline is bad with this
> > > > > > error.
> > > > > > The attached reproduce-* may help reproduce the issue.
> > > > > 
> > > > > Thanks for report! So from the stacktrace we are in the path 
> > > > > testing removal of a device immediately after it has been
> > > > > probed 
> > > > > and for some reason bdi_unregister() hangs - likely waiting for
> > > > > cgroup-writeback references to drop. Given how early this
> > > > > happens 
> > > > > my guess is we fail to initialize something but for now I don't
> > > > > see 
> > > > > how my patch could make a difference. I'm trying to reproduce
> > > > > this 
> > > > > to be able to debug more...
> > > > 
> > > > OK, so after some debugging I think this is yet another problem
> > > > in 
> > > > SCSI initialization / destruction code which my patch only makes 
> > > > visible (added relevant maintainers).
> > > > 
> > > > I can reproduce the problem reliably with enabling:
> > > > 
> > > > CONFIG_DEBUG_TEST_DRIVER_REMOVE=y
> > > > CONFIG_SCSI_DEBUG=m
> > > > CONFIG_BLK_CGROUP=y
> > > > CONFIG_MEMCG=y
> > > > (and thus CONFIG_CGROUP_WRITEBACK=y)
> > > > 
> > > > then 'modprobe scsi_debug' is all it takes to reproduce hang. 
> > > > Relevant kernel messages with some of my debugging added
> > > > (attached is 
> > > > a patch that adds those debug messages):
> > > 
> > > This looks to be precisely the same problem Dan Williams was
> > > debugging
> > > for us.
> > > 
> > > > [   58.721765] scsi host0: scsi_debug: version 1.86 [20160430]
> > > > [   58.721765]   dev_size_mb=8, opts=0x0, submit_queues=1,
> > > > statistics=0
> > > > [   58.728946] CGWB init 88007fbb2000
> > > > [   58.730095] Created sdev 880078e1a000
> > > > [   58.731611] scsi 0:0:0:0: Direct-Access Linux   
> > > >  scsi_debug
> > > > 0186 PQ : 0 ANSI: 7
> > > > [   58.782246] sd 0:0:0:0: [sda] 16384 512-byte logical blocks:
> > > > (8.39
> > > > MB/8.00 MiB)
> > > > [   58.789687] sd 0:0:0:0: [sda] Write Protect is off
> > > > [   58.791140] sd 0:0:0:0: [sda] Mode Sense: 73 00 10 08
> > > > [   58.800879] sd 0:0:0:0: [sda] Write cache: enabled, read
> > > > cache:
> > > > enabled, supports DPO and FUA
> > > > [   58.893738] sd 0:0:0:0: [sda] Attached SCSI disk
> > > > [   58.896808] Unreg1
> > > > [   58.897960] Unreg2
> > > > [   58.898637] Unreg3
> > > > [   58.899100] CGWB 88007fbb2000 usage_cnt: 0
> > > > [   58.94] Unreg4
> > > > [   58.904976] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> > > 
> > > OK, can you put a WARN_ON trace in sd_shutdown and tell us where
> > > this
> > > is coming from.  For the device to be reused after this we have to
> > > be
> > > calling sd_shutdown() without going into SDEV_DEL.
> > 
> > Sure. The call trace is:
> > 
> > [   41.919244] [ cut here ]
> > [   41.919263] WARNING: CPU: 4 PID: 2335 at drivers/scsi/sd.c:3332
> > sd_shutdown+0x2f/0x100
> > [   41.919268] Modules linked in: scsi_debug(+) netconsole loop btrfs
> > raid6_pq zlib_deflate lzo_compress xor
> > [   41.919319] CPU: 4 PID: 2335 Comm: modprobe Not tainted 4.11.0-rc1
> > -xen+ #49
> > [   41.919325] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> > [   41.919331] Call Trace:
> > [   41.919343]  dump_stack+0x8e/0xf0
> > [   41.919354]  __warn+0x116/0x120
> > [   41.919361]  warn_slowpath_null+0x1d/0x20
> > [   41.919368]  sd_shutdown+0x2f/0x100
> > [   41.919374]  sd_remove+0x70/0xd0
> > 
> > *** Here is the unexpected step I guess...
> > 
> > [   41.919383]  driver_probe_device+0xe0/0x4c0
> 
> Exactly.  It's this, I think
> 
>   bool test_remove = IS_ENABLED(CONFIG_DEBUG_TEST_DRIVER_REMOVE) &&
>  !drv->suppress_bind_attrs;
> 
> You have that config option set.

Yes - or better said 0-day testing has it set. Maybe that is not a sane
default for 0-day tests? The option is explicitely marked as "unstable"...
Fengguang?

> So the drivers base layer is calling ->remove after probe and
> triggering the destruction of the queue.
> 
> What to do about this (apart from nuke such a stupid option) is
> somewhat more problematic.

I guess this is between you and Greg :).

Honza
-- 
Jan Kara 
SUSE Labs, CR

Re: [bdi_unregister] 165a5e22fa INFO: task swapper:1 blocked for more than 120 seconds.

[Jan Kara]

On Mon 06-03-17 06:35:21, James Bottomley wrote:
> On Mon, 2017-03-06 at 13:01 +0100, Jan Kara wrote:
> > On Mon 06-03-17 11:27:33, Jan Kara wrote:
> > > Hi,
> > > 
> > > On Sun 05-03-17 10:21:11, Wu Fengguang wrote:
> > > > FYI next-20170303 is good while mainline is bad with this error.
> > > > The attached reproduce-* may help reproduce the issue.
> > > 
> > > Thanks for report! So from the stacktrace we are in the path 
> > > testing removal of a device immediately after it has been probed 
> > > and for some reason bdi_unregister() hangs - likely waiting for 
> > > cgroup-writeback references to drop. Given how early this happens 
> > > my guess is we fail to initialize something but for now I don't see 
> > > how my patch could make a difference. I'm trying to reproduce this 
> > > to be able to debug more...
> > 
> > OK, so after some debugging I think this is yet another problem in 
> > SCSI initialization / destruction code which my patch only makes 
> > visible (added relevant maintainers).
> > 
> > I can reproduce the problem reliably with enabling:
> > 
> > CONFIG_DEBUG_TEST_DRIVER_REMOVE=y
> > CONFIG_SCSI_DEBUG=m
> > CONFIG_BLK_CGROUP=y
> > CONFIG_MEMCG=y
> > (and thus CONFIG_CGROUP_WRITEBACK=y)
> > 
> > then 'modprobe scsi_debug' is all it takes to reproduce hang. 
> > Relevant kernel messages with some of my debugging added (attached is 
> > a patch that adds those debug messages):
> 
> This looks to be precisely the same problem Dan Williams was debugging
> for us.
> 
> > [   58.721765] scsi host0: scsi_debug: version 1.86 [20160430]
> > [   58.721765]   dev_size_mb=8, opts=0x0, submit_queues=1,
> > statistics=0
> > [   58.728946] CGWB init 88007fbb2000
> > [   58.730095] Created sdev 880078e1a000
> > [   58.731611] scsi 0:0:0:0: Direct-Access Linuxscsi_debug
> > 0186 PQ : 0 ANSI: 7
> > [   58.782246] sd 0:0:0:0: [sda] 16384 512-byte logical blocks: (8.39
> > MB/8.00 MiB)
> > [   58.789687] sd 0:0:0:0: [sda] Write Protect is off
> > [   58.791140] sd 0:0:0:0: [sda] Mode Sense: 73 00 10 08
> > [   58.800879] sd 0:0:0:0: [sda] Write cache: enabled, read cache:
> > enabled, supports DPO and FUA
> > [   58.893738] sd 0:0:0:0: [sda] Attached SCSI disk
> > [   58.896808] Unreg1
> > [   58.897960] Unreg2
> > [   58.898637] Unreg3
> > [   58.899100] CGWB 88007fbb2000 usage_cnt: 0
> > [   58.94] Unreg4
> > [   58.904976] sd 0:0:0:0: [sda] Synchronizing SCSI cache
> 
> OK, can you put a WARN_ON trace in sd_shutdown and tell us where this
> is coming from.  For the device to be reused after this we have to be
> calling sd_shutdown() without going into SDEV_DEL.

Sure. The call trace is:

[   41.919244] [ cut here ]
[   41.919263] WARNING: CPU: 4 PID: 2335 at drivers/scsi/sd.c:3332 
sd_shutdown+0x2f/0x100
[   41.919268] Modules linked in: scsi_debug(+) netconsole loop btrfs raid6_pq 
zlib_deflate lzo_compress xor
[   41.919319] CPU: 4 PID: 2335 Comm: modprobe Not tainted 4.11.0-rc1-xen+ #49
[   41.919325] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   41.919331] Call Trace:
[   41.919343]  dump_stack+0x8e/0xf0
[   41.919354]  __warn+0x116/0x120
[   41.919361]  warn_slowpath_null+0x1d/0x20
[   41.919368]  sd_shutdown+0x2f/0x100
[   41.919374]  sd_remove+0x70/0xd0

*** Here is the unexpected step I guess...

[   41.919383]  driver_probe_device+0xe0/0x4c0
[   41.919395]  ? kobject_uevent_env+0x1bc/0x660
[   41.919403]  __device_attach_driver+0xfa/0x120
[   41.919410]  ? __driver_attach+0x110/0x110
[   41.919417]  bus_for_each_drv+0x68/0x90
[   41.919424]  __device_attach+0xb2/0x110
[   41.919432]  device_initial_probe+0x13/0x20
[   41.919439]  bus_probe_device+0xa8/0xc0
[   41.919446]  device_add+0x297/0x600
[   41.919453]  ? call_rcu_bh+0x20/0x20
[   41.919463]  ? mutex_unlock+0x12/0x20
[   41.919473]  scsi_sysfs_add_sdev+0x69/0x210
[   41.919480]  scsi_probe_and_add_lun+0xcfd/0xd10
[   41.919489]  ? find_next_zero_bit+0x10/0x20
[   41.919496]  __scsi_scan_target+0xd2/0x4c0
[   41.919506]  ? proc_register+0x41/0x130
[   41.919512]  ? proc_register+0x11c/0x130
[   41.919520]  ? trace_hardirqs_on+0xd/0x10
[   41.919527]  ? _raw_spin_unlock_irq+0x30/0x50
[   41.919534]  scsi_scan_channel+0x5f/0xa0
[   41.919541]  scsi_scan_host_selected+0xb9/0x120
[   41.919549]  do_scsi_scan_host+0x81/0x90
[   41.919555]  scsi_scan_host+0x17a/0x1b0
[   41.919568]  ? scsi_add_host_with_dma+0x302/0x310
[   41.919593]  sdebug_driver_probe+0x204/0x320 [scsi_debug]
[   41.919601]  ? driver_sysfs_add+0x90/0xb0
[   41.919608]  driver_probe_device+0xb3/0x4c0
[   41.919615]  ? kobject_uevent_env+0x1bc/0x660
[   41.919623]  __device_attach_driver+0xfa/0x120
[   41.919630]  ? __driver_attach+0x110/0x110
[   41.919636]  bus_for_each_drv+0x68/0x90
[   41.919643]  __device_attach+0xb2/0x110
[   41.919651]  device_initial_probe+0x13/0x20
[   41.919658]  bus_probe_device+0xa8/0xc0
[   41.919664]  device_add+0x297/0x600
[   41.919671]  ? dev_set_name+0x41/0x50
[   41.919681]  

Re: [PATCH 21/29] drivers, s390: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t

[Johannes Thumshirn]

On 03/06/2017 03:21 PM, Elena Reshetova wrote:
> refcount_t type and corresponding API should be
> used instead of atomic_t when the variable is used as
> a reference counter. This allows to avoid accidental
> refcounter overflows that might lead to use-after-free
> situations.

The subject is wrong, should be something like "scsi: libfc convert
fc_fcp_pkt.ref_cnt from atomic_t to refcount_t" but not s390.

Other than that
Acked-by: Johannes Thumshirn 

-- 
Johannes Thumshirn  Storage
jthumsh...@suse.de+49 911 74053 689
SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850

[PATCH 03/29] drivers, char: convert vma_data.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/char/mspec.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index a9c2fa3..7b75669 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -43,6 +43,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -89,7 +90,7 @@ static int is_sn2;
  * protect in fork case where multiple tasks share the vma_data.
  */
 struct vma_data {
-   atomic_t refcnt;/* Number of vmas sharing the data. */
+   refcount_t refcnt;  /* Number of vmas sharing the data. */
spinlock_t lock;/* Serialize access to this structure. */
int count;  /* Number of pages allocated. */
enum mspec_page_type type; /* Type of pages allocated. */
@@ -144,7 +145,7 @@ mspec_open(struct vm_area_struct *vma)
struct vma_data *vdata;
 
vdata = vma->vm_private_data;
-   atomic_inc(>refcnt);
+   refcount_inc(>refcnt);
 }
 
 /*
@@ -162,7 +163,7 @@ mspec_close(struct vm_area_struct *vma)
 
vdata = vma->vm_private_data;
 
-   if (!atomic_dec_and_test(>refcnt))
+   if (!refcount_dec_and_test(>refcnt))
return;
 
last_index = (vdata->vm_end - vdata->vm_start) >> PAGE_SHIFT;
@@ -274,7 +275,7 @@ mspec_mmap(struct file *file, struct vm_area_struct *vma,
vdata->vm_end = vma->vm_end;
vdata->type = type;
spin_lock_init(>lock);
-   atomic_set(>refcnt, 1);
+   refcount_set(>refcnt, 1);
vma->vm_private_data = vdata;
 
vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
-- 
2.7.4

[PATCH 21/29] drivers, s390: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/scsi/libfc/fc_fcp.c | 6 +++---
 include/scsi/libfc.h| 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 0e67621..a808e8e 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -154,7 +154,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport 
*lport, gfp_t gfp)
memset(fsp, 0, sizeof(*fsp));
fsp->lp = lport;
fsp->xfer_ddp = FC_XID_UNKNOWN;
-   atomic_set(>ref_cnt, 1);
+   refcount_set(>ref_cnt, 1);
init_timer(>timer);
fsp->timer.data = (unsigned long)fsp;
INIT_LIST_HEAD(>list);
@@ -175,7 +175,7 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport 
*lport, gfp_t gfp)
  */
 static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
 {
-   if (atomic_dec_and_test(>ref_cnt)) {
+   if (refcount_dec_and_test(>ref_cnt)) {
struct fc_fcp_internal *si = fc_get_scsi_internal(fsp->lp);
 
mempool_free(fsp, si->scsi_pkt_pool);
@@ -188,7 +188,7 @@ static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
  */
 static void fc_fcp_pkt_hold(struct fc_fcp_pkt *fsp)
 {
-   atomic_inc(>ref_cnt);
+   refcount_inc(>ref_cnt);
 }
 
 /**
diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
index da5033d..2109844 100644
--- a/include/scsi/libfc.h
+++ b/include/scsi/libfc.h
@@ -23,6 +23,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -321,7 +322,7 @@ struct fc_seq_els_data {
  */
 struct fc_fcp_pkt {
spinlock_tscsi_pkt_lock;
-   atomic_t  ref_cnt;
+   refcount_tref_cnt;
 
/* SCSI command and data transfer information */
u32   data_len;
-- 
2.7.4

[PATCH 20/29] drivers, s390: convert qeth_reply.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/s390/net/qeth_core.h  | 3 ++-
 drivers/s390/net/qeth_core_main.c | 8 +++-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index e7addea..e2c81d21 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -20,6 +20,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -641,7 +642,7 @@ struct qeth_reply {
int rc;
void *param;
struct qeth_card *card;
-   atomic_t refcnt;
+   refcount_t refcnt;
 };
 
 
diff --git a/drivers/s390/net/qeth_core_main.c 
b/drivers/s390/net/qeth_core_main.c
index 315d8a2..a2bf13f 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -555,7 +555,7 @@ static struct qeth_reply *qeth_alloc_reply(struct qeth_card 
*card)
 
reply = kzalloc(sizeof(struct qeth_reply), GFP_ATOMIC);
if (reply) {
-   atomic_set(>refcnt, 1);
+   refcount_set(>refcnt, 1);
atomic_set(>received, 0);
reply->card = card;
}
@@ -564,14 +564,12 @@ static struct qeth_reply *qeth_alloc_reply(struct 
qeth_card *card)
 
 static void qeth_get_reply(struct qeth_reply *reply)
 {
-   WARN_ON(atomic_read(>refcnt) <= 0);
-   atomic_inc(>refcnt);
+   refcount_inc(>refcnt);
 }
 
 static void qeth_put_reply(struct qeth_reply *reply)
 {
-   WARN_ON(atomic_read(>refcnt) <= 0);
-   if (atomic_dec_and_test(>refcnt))
+   if (refcount_dec_and_test(>refcnt))
kfree(reply);
 }
 
-- 
2.7.4

Re: [PATCH v3 17/20] usb: gadget: pch_udc: Replace PCI pool old API

[Felipe Balbi]

Peter Senna Tschudin  writes:
> On Sun, Feb 26, 2017 at 08:24:22PM +0100, Romain Perier wrote:
>> The PCI pool API is deprecated. This commits replaces the PCI pool old
>> API by the appropriated function with the DMA pool API.
>> 
> Reviewed-by: Peter Senna Tschudin 

Fine by me:

Acked-by: Felipe Balbi 

-- 
balbi


signature.asc
Description: PGP signature

Re: [PATCH] scsi: lpfc: Add shutdown method for kexec

[Mauricio Faria de Oliveira]

On 02/12/2017 07:49 PM, Anton Blanchard wrote:

We see lpfc devices regularly fail during kexec. Fix this by adding
a shutdown method which mirrors the remove method.


Reviewed-by: Mauricio Faria de Oliveira 
Tested-by: Mauricio Faria de Oliveira 

@mkp, @jejb: may you please flag this patch for stable?  Thank you.

This patch fixes a problem of some adapter ports going offline after
reboot on the following adapter, at least:

[10df:f100] Saturn-X: LightPulse Fibre Channel Host Adapter

# dmesg | grep lpfc
...
[   61.676728] lpfc 0003:12:00.0: 6:0442 Adapter failed to init,
mbxCmd x88 CONFIG_PORT, mbxStatus x0 Data: x0
[   92.766717] lpfc 0003:12:00.0: 6:0442 Adapter failed to init,
mbxCmd x88 CONFIG_PORT, mbxStatus x0 Data: x0
[  123.856717] lpfc 0003:12:00.0: 6:0442 Adapter failed to init,
mbxCmd x88 CONFIG_PORT, mbxStatus x0 Data: x0
...

--
Mauricio Faria de Oliveira
IBM Linux Technology Center

Re: [bdi_unregister] 165a5e22fa INFO: task swapper:1 blocked for more than 120 seconds.

[James Bottomley]

On Mon, 2017-03-06 at 13:01 +0100, Jan Kara wrote:
> On Mon 06-03-17 11:27:33, Jan Kara wrote:
> > Hi,
> > 
> > On Sun 05-03-17 10:21:11, Wu Fengguang wrote:
> > > FYI next-20170303 is good while mainline is bad with this error.
> > > The attached reproduce-* may help reproduce the issue.
> > 
> > Thanks for report! So from the stacktrace we are in the path 
> > testing removal of a device immediately after it has been probed 
> > and for some reason bdi_unregister() hangs - likely waiting for 
> > cgroup-writeback references to drop. Given how early this happens 
> > my guess is we fail to initialize something but for now I don't see 
> > how my patch could make a difference. I'm trying to reproduce this 
> > to be able to debug more...
> 
> OK, so after some debugging I think this is yet another problem in 
> SCSI initialization / destruction code which my patch only makes 
> visible (added relevant maintainers).
> 
> I can reproduce the problem reliably with enabling:
> 
> CONFIG_DEBUG_TEST_DRIVER_REMOVE=y
> CONFIG_SCSI_DEBUG=m
> CONFIG_BLK_CGROUP=y
> CONFIG_MEMCG=y
> (and thus CONFIG_CGROUP_WRITEBACK=y)
> 
> then 'modprobe scsi_debug' is all it takes to reproduce hang. 
> Relevant kernel messages with some of my debugging added (attached is 
> a patch that adds those debug messages):

This looks to be precisely the same problem Dan Williams was debugging
for us.

> [   58.721765] scsi host0: scsi_debug: version 1.86 [20160430]
> [   58.721765]   dev_size_mb=8, opts=0x0, submit_queues=1,
> statistics=0
> [   58.728946] CGWB init 88007fbb2000
> [   58.730095] Created sdev 880078e1a000
> [   58.731611] scsi 0:0:0:0: Direct-Access Linuxscsi_debug
> 0186 PQ : 0 ANSI: 7
> [   58.782246] sd 0:0:0:0: [sda] 16384 512-byte logical blocks: (8.39
> MB/8.00 MiB)
> [   58.789687] sd 0:0:0:0: [sda] Write Protect is off
> [   58.791140] sd 0:0:0:0: [sda] Mode Sense: 73 00 10 08
> [   58.800879] sd 0:0:0:0: [sda] Write cache: enabled, read cache:
> enabled, supports DPO and FUA
> [   58.893738] sd 0:0:0:0: [sda] Attached SCSI disk
> [   58.896808] Unreg1
> [   58.897960] Unreg2
> [   58.898637] Unreg3
> [   58.899100] CGWB 88007fbb2000 usage_cnt: 0
> [   58.94] Unreg4
> [   58.904976] sd 0:0:0:0: [sda] Synchronizing SCSI cache

OK, can you put a WARN_ON trace in sd_shutdown and tell us where this
is coming from.  For the device to be reused after this we have to be
calling sd_shutdown() without going into SDEV_DEL.

Thanks,

James

[PATCH 18/29] drivers, s390: convert urdev.ref_count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/s390/char/vmur.c | 8 
 drivers/s390/char/vmur.h | 4 +++-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 04aceb6..ced8151 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -110,7 +110,7 @@ static struct urdev *urdev_alloc(struct ccw_device *cdev)
mutex_init(>io_mutex);
init_waitqueue_head(>wait);
spin_lock_init(>open_lock);
-   atomic_set(>ref_count,  1);
+   refcount_set(>ref_count,  1);
urd->cdev = cdev;
get_device(>dev);
return urd;
@@ -126,7 +126,7 @@ static void urdev_free(struct urdev *urd)
 
 static void urdev_get(struct urdev *urd)
 {
-   atomic_inc(>ref_count);
+   refcount_inc(>ref_count);
 }
 
 static struct urdev *urdev_get_from_cdev(struct ccw_device *cdev)
@@ -159,7 +159,7 @@ static struct urdev *urdev_get_from_devno(u16 devno)
 
 static void urdev_put(struct urdev *urd)
 {
-   if (atomic_dec_and_test(>ref_count))
+   if (refcount_dec_and_test(>ref_count))
urdev_free(urd);
 }
 
@@ -946,7 +946,7 @@ static int ur_set_offline_force(struct ccw_device *cdev, 
int force)
rc = -EBUSY;
goto fail_urdev_put;
}
-   if (!force && (atomic_read(>ref_count) > 2)) {
+   if (!force && (refcount_read(>ref_count) > 2)) {
/* There is still a user of urd (e.g. ur_open) */
TRACE("ur_set_offline: BUSY\n");
rc = -EBUSY;
diff --git a/drivers/s390/char/vmur.h b/drivers/s390/char/vmur.h
index fa320ad..35ea9d1 100644
--- a/drivers/s390/char/vmur.h
+++ b/drivers/s390/char/vmur.h
@@ -11,6 +11,8 @@
 #ifndef _VMUR_H_
 #define _VMUR_H_
 
+#include 
+
 #define DEV_CLASS_UR_I 0x20 /* diag210 unit record input device class */
 #define DEV_CLASS_UR_O 0x10 /* diag210 unit record output device class */
 /*
@@ -69,7 +71,7 @@ struct urdev {
size_t reclen;  /* Record length for *write* CCWs */
int class;  /* VM device class */
int io_request_rc;  /* return code from I/O request */
-   atomic_t ref_count; /* reference counter */
+   refcount_t ref_count;   /* reference counter */
wait_queue_head_t wait; /* wait queue to serialize open */
int open_flag;  /* "urdev is open" flag */
spinlock_t open_lock;   /* serialize critical sections */
-- 
2.7.4

[PATCH 25/29] drivers, usb: convert ffs_data.ref from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/usb/gadget/function/f_fs.c | 8 
 drivers/usb/gadget/function/u_fs.h | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c 
b/drivers/usb/gadget/function/f_fs.c
index 87fccf6..3cdeb91 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1570,14 +1570,14 @@ static void ffs_data_get(struct ffs_data *ffs)
 {
ENTER();
 
-   atomic_inc(>ref);
+   refcount_inc(>ref);
 }
 
 static void ffs_data_opened(struct ffs_data *ffs)
 {
ENTER();
 
-   atomic_inc(>ref);
+   refcount_inc(>ref);
if (atomic_add_return(1, >opened) == 1 &&
ffs->state == FFS_DEACTIVATED) {
ffs->state = FFS_CLOSING;
@@ -1589,7 +1589,7 @@ static void ffs_data_put(struct ffs_data *ffs)
 {
ENTER();
 
-   if (unlikely(atomic_dec_and_test(>ref))) {
+   if (unlikely(refcount_dec_and_test(>ref))) {
pr_info("%s(): freeing\n", __func__);
ffs_data_clear(ffs);
BUG_ON(waitqueue_active(>ev.waitq) ||
@@ -1634,7 +1634,7 @@ static struct ffs_data *ffs_data_new(void)
 
ENTER();
 
-   atomic_set(>ref, 1);
+   refcount_set(>ref, 1);
atomic_set(>opened, 0);
ffs->state = FFS_READ_DESCRIPTORS;
mutex_init(>mutex);
diff --git a/drivers/usb/gadget/function/u_fs.h 
b/drivers/usb/gadget/function/u_fs.h
index 4b69694..abfca48 100644
--- a/drivers/usb/gadget/function/u_fs.h
+++ b/drivers/usb/gadget/function/u_fs.h
@@ -20,6 +20,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #ifdef VERBOSE_DEBUG
 #ifndef pr_vdebug
@@ -177,7 +178,7 @@ struct ffs_data {
struct completion   ep0req_completion;  /* P: mutex */
 
/* reference counter */
-   atomic_tref;
+   refcount_t  ref;
/* how many files are opened (EP0 and others) */
atomic_topened;
 
-- 
2.7.4

[PATCH 29/29] drivers, xen: convert grant_map.users from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/xen/gntdev.c | 11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 2ef2b61..b183cb2 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -35,6 +35,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -85,7 +86,7 @@ struct grant_map {
int index;
int count;
int flags;
-   atomic_t users;
+   refcount_t users;
struct unmap_notify notify;
struct ioctl_gntdev_grant_ref *grants;
struct gnttab_map_grant_ref   *map_ops;
@@ -165,7 +166,7 @@ static struct grant_map *gntdev_alloc_map(struct 
gntdev_priv *priv, int count)
 
add->index = 0;
add->count = count;
-   atomic_set(>users, 1);
+   refcount_set(>users, 1);
 
return add;
 
@@ -211,7 +212,7 @@ static void gntdev_put_map(struct gntdev_priv *priv, struct 
grant_map *map)
if (!map)
return;
 
-   if (!atomic_dec_and_test(>users))
+   if (!refcount_dec_and_test(>users))
return;
 
atomic_sub(map->count, _mapped);
@@ -399,7 +400,7 @@ static void gntdev_vma_open(struct vm_area_struct *vma)
struct grant_map *map = vma->vm_private_data;
 
pr_debug("gntdev_vma_open %p\n", vma);
-   atomic_inc(>users);
+   refcount_inc(>users);
 }
 
 static void gntdev_vma_close(struct vm_area_struct *vma)
@@ -1003,7 +1004,7 @@ static int gntdev_mmap(struct file *flip, struct 
vm_area_struct *vma)
goto unlock_out;
}
 
-   atomic_inc(>users);
+   refcount_inc(>users);
 
vma->vm_ops = _vmops;
 
-- 
2.7.4

[PATCH 27/29] drivers, usb: convert ep_data.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/usb/gadget/legacy/inode.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/legacy/inode.c 
b/drivers/usb/gadget/legacy/inode.c
index 81d76f3..d21a5f8 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -191,7 +191,7 @@ enum ep_state {
 struct ep_data {
struct mutexlock;
enum ep_state   state;
-   atomic_tcount;
+   refcount_t  count;
struct dev_data *dev;
/* must hold dev->lock before accessing ep or req */
struct usb_ep   *ep;
@@ -206,12 +206,12 @@ struct ep_data {
 
 static inline void get_ep (struct ep_data *data)
 {
-   atomic_inc (>count);
+   refcount_inc (>count);
 }
 
 static void put_ep (struct ep_data *data)
 {
-   if (likely (!atomic_dec_and_test (>count)))
+   if (likely (!refcount_dec_and_test (>count)))
return;
put_dev (data->dev);
/* needs no more cleanup */
@@ -1562,7 +1562,7 @@ static int activate_ep_files (struct dev_data *dev)
init_waitqueue_head (>wait);
 
strncpy (data->name, ep->name, sizeof (data->name) - 1);
-   atomic_set (>count, 1);
+   refcount_set (>count, 1);
data->dev = dev;
get_dev (dev);
 
-- 
2.7.4

[PATCH 01/29] drivers, block: convert xen_blkif.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/block/xen-blkback/common.h | 7 ---
 drivers/block/xen-blkback/xenbus.c | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/block/xen-blkback/common.h 
b/drivers/block/xen-blkback/common.h
index dea61f6..2ccfd62 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -35,6 +35,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -333,7 +334,7 @@ struct xen_blkif {
struct xen_vbd  vbd;
/* Back pointer to the backend_info. */
struct backend_info *be;
-   atomic_trefcnt;
+   refcount_t  refcnt;
/* for barrier (drain) requests */
struct completion   drain_complete;
atomic_tdrain;
@@ -386,10 +387,10 @@ struct pending_req {
 (_v)->bdev->bd_part->nr_sects : \
  get_capacity((_v)->bdev->bd_disk))
 
-#define xen_blkif_get(_b) (atomic_inc(&(_b)->refcnt))
+#define xen_blkif_get(_b) (refcount_inc(&(_b)->refcnt))
 #define xen_blkif_put(_b)  \
do {\
-   if (atomic_dec_and_test(&(_b)->refcnt)) \
+   if (refcount_dec_and_test(&(_b)->refcnt))   \
schedule_work(&(_b)->free_work);\
} while (0)
 
diff --git a/drivers/block/xen-blkback/xenbus.c 
b/drivers/block/xen-blkback/xenbus.c
index 8fe61b5..9f89be3 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -176,7 +176,7 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
return ERR_PTR(-ENOMEM);
 
blkif->domid = domid;
-   atomic_set(>refcnt, 1);
+   refcount_set(>refcnt, 1);
init_completion(>drain_complete);
INIT_WORK(>free_work, xen_blkif_deferred_free);
 
-- 
2.7.4

[PATCH 09/29] drivers, md: convert table_device.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/md/dm.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9f37d7f..cba91c3 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -21,6 +21,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #define DM_MSG_PREFIX "core"
 
@@ -96,7 +97,7 @@ struct dm_md_mempools {
 
 struct table_device {
struct list_head list;
-   atomic_t count;
+   refcount_t count;
struct dm_dev dm_dev;
 };
 
@@ -680,10 +681,11 @@ int dm_get_table_device(struct mapped_device *md, dev_t 
dev, fmode_t mode,
 
format_dev_t(td->dm_dev.name, dev);
 
-   atomic_set(>count, 0);
+   refcount_set(>count, 1);
list_add(>list, >table_devices);
+   } else {
+   refcount_inc(>count);
}
-   atomic_inc(>count);
mutex_unlock(>table_devices_lock);
 
*result = >dm_dev;
@@ -696,7 +698,7 @@ void dm_put_table_device(struct mapped_device *md, struct 
dm_dev *d)
struct table_device *td = container_of(d, struct table_device, dm_dev);
 
mutex_lock(>table_devices_lock);
-   if (atomic_dec_and_test(>count)) {
+   if (refcount_dec_and_test(>count)) {
close_table_device(td, md);
list_del(>list);
kfree(td);
@@ -713,7 +715,7 @@ static void free_table_devices(struct list_head *devices)
struct table_device *td = list_entry(tmp, struct table_device, 
list);
 
DMWARN("dm_destroy: %s still exists with %d references",
-  td->dm_dev.name, atomic_read(>count));
+  td->dm_dev.name, refcount_read(>count));
kfree(td);
}
 }
-- 
2.7.4

[PATCH 15/29] drivers, media: convert vb2_dma_sg_buf.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/media/v4l2-core/videobuf2-dma-sg.c | 11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c 
b/drivers/media/v4l2-core/videobuf2-dma-sg.c
index ecff8f4..29fde1a 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
@@ -12,6 +12,7 @@
 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -46,7 +47,7 @@ struct vb2_dma_sg_buf {
struct sg_table *dma_sgt;
size_t  size;
unsigned intnum_pages;
-   atomic_trefcount;
+   refcount_t  refcount;
struct vb2_vmarea_handler   handler;
 
struct dma_buf_attachment   *db_attach;
@@ -150,7 +151,7 @@ static void *vb2_dma_sg_alloc(struct device *dev, unsigned 
long dma_attrs,
buf->handler.put = vb2_dma_sg_put;
buf->handler.arg = buf;
 
-   atomic_inc(>refcount);
+   refcount_set(>refcount, 1);
 
dprintk(1, "%s: Allocated buffer of %d pages\n",
__func__, buf->num_pages);
@@ -176,7 +177,7 @@ static void vb2_dma_sg_put(void *buf_priv)
struct sg_table *sgt = >sg_table;
int i = buf->num_pages;
 
-   if (atomic_dec_and_test(>refcount)) {
+   if (refcount_dec_and_test(>refcount)) {
dprintk(1, "%s: Freeing buffer of %d pages\n", __func__,
buf->num_pages);
dma_unmap_sg_attrs(buf->dev, sgt->sgl, sgt->orig_nents,
@@ -320,7 +321,7 @@ static unsigned int vb2_dma_sg_num_users(void *buf_priv)
 {
struct vb2_dma_sg_buf *buf = buf_priv;
 
-   return atomic_read(>refcount);
+   return refcount_read(>refcount);
 }
 
 static int vb2_dma_sg_mmap(void *buf_priv, struct vm_area_struct *vma)
@@ -530,7 +531,7 @@ static struct dma_buf *vb2_dma_sg_get_dmabuf(void 
*buf_priv, unsigned long flags
return NULL;
 
/* dmabuf keeps reference to vb2 buffer */
-   atomic_inc(>refcount);
+   refcount_inc(>refcount);
 
return dbuf;
 }
-- 
2.7.4

[PATCH 19/29] drivers, s390: convert lcs_reply.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/s390/net/lcs.c | 8 +++-
 drivers/s390/net/lcs.h | 3 ++-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 211b31d..18dc787 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -774,15 +774,13 @@ lcs_get_lancmd(struct lcs_card *card, int count)
 static void
 lcs_get_reply(struct lcs_reply *reply)
 {
-   WARN_ON(atomic_read(>refcnt) <= 0);
-   atomic_inc(>refcnt);
+   refcount_inc(>refcnt);
 }
 
 static void
 lcs_put_reply(struct lcs_reply *reply)
 {
-WARN_ON(atomic_read(>refcnt) <= 0);
-if (atomic_dec_and_test(>refcnt)) {
+if (refcount_dec_and_test(>refcnt)) {
kfree(reply);
}
 
@@ -798,7 +796,7 @@ lcs_alloc_reply(struct lcs_cmd *cmd)
reply = kzalloc(sizeof(struct lcs_reply), GFP_ATOMIC);
if (!reply)
return NULL;
-   atomic_set(>refcnt,1);
+   refcount_set(>refcnt,1);
reply->sequence_no = cmd->sequence_no;
reply->received = 0;
reply->rc = 0;
diff --git a/drivers/s390/net/lcs.h b/drivers/s390/net/lcs.h
index 150fcb4..3802f4f 100644
--- a/drivers/s390/net/lcs.h
+++ b/drivers/s390/net/lcs.h
@@ -4,6 +4,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 #define LCS_DBF_TEXT(level, name, text) \
@@ -270,7 +271,7 @@ struct lcs_buffer {
 struct lcs_reply {
struct list_head list;
__u16 sequence_no;
-   atomic_t refcnt;
+   refcount_t refcnt;
/* Callback for completion notification. */
void (*callback)(struct lcs_card *, struct lcs_cmd *);
wait_queue_head_t wait_q;
-- 
2.7.4

[PATCH 17/29] drivers, pci: convert hv_pci_dev.refs from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/pci/host/pci-hyperv.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
index cd114c6..870deed 100644
--- a/drivers/pci/host/pci-hyperv.c
+++ b/drivers/pci/host/pci-hyperv.c
@@ -56,6 +56,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 
 /*
@@ -421,7 +422,7 @@ enum hv_pcidev_ref_reason {
 struct hv_pci_dev {
/* List protected by pci_rescan_remove_lock */
struct list_head list_entry;
-   atomic_t refs;
+   refcount_t refs;
enum hv_pcichild_state state;
struct pci_function_description desc;
bool reported_missing;
@@ -1254,13 +1255,13 @@ static void q_resource_requirements(void *context, 
struct pci_response *resp,
 static void get_pcichild(struct hv_pci_dev *hpdev,
enum hv_pcidev_ref_reason reason)
 {
-   atomic_inc(>refs);
+   refcount_inc(>refs);
 }
 
 static void put_pcichild(struct hv_pci_dev *hpdev,
enum hv_pcidev_ref_reason reason)
 {
-   if (atomic_dec_and_test(>refs))
+   if (refcount_dec_and_test(>refs))
kfree(hpdev);
 }
 
@@ -1314,7 +1315,7 @@ static struct hv_pci_dev *new_pcichild_device(struct 
hv_pcibus_device *hbus,
wait_for_completion(_pkt.host_event);
 
hpdev->desc = *desc;
-   get_pcichild(hpdev, hv_pcidev_ref_initial);
+   refcount_set(>refs, 1);
get_pcichild(hpdev, hv_pcidev_ref_childlist);
spin_lock_irqsave(>device_list_lock, flags);
list_add_tail(>list_entry, >children);
-- 
2.7.4

[PATCH 07/29] drivers, md: convert dm_dev_internal.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/md/dm-table.c | 6 +++---
 drivers/md/dm.h   | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 3ad16d9..d2e2741 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -416,15 +416,15 @@ int dm_get_device(struct dm_target *ti, const char *path, 
fmode_t mode,
return r;
}
 
-   atomic_set(>count, 0);
+   refcount_set(>count, 1);
list_add(>list, >devices);
 
} else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
r = upgrade_mode(dd, mode, t->md);
if (r)
return r;
+   refcount_inc(>count);
}
-   atomic_inc(>count);
 
*result = dd->dm_dev;
return 0;
@@ -478,7 +478,7 @@ void dm_put_device(struct dm_target *ti, struct dm_dev *d)
   dm_device_name(ti->table->md), d->name);
return;
}
-   if (atomic_dec_and_test(>count)) {
+   if (refcount_dec_and_test(>count)) {
dm_put_table_device(ti->table->md, d);
list_del(>list);
kfree(dd);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index f298b01..63b8142 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -19,6 +19,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include "dm-stats.h"
 
@@ -38,7 +39,7 @@
  */
 struct dm_dev_internal {
struct list_head list;
-   atomic_t count;
+   refcount_t count;
struct dm_dev *dm_dev;
 };
 
-- 
2.7.4

[PATCH 23/29] drivers: convert vme_user_vma_priv.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/staging/vme/devices/vme_user.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vme/devices/vme_user.c 
b/drivers/staging/vme/devices/vme_user.c
index 69e9a770..a3d4610 100644
--- a/drivers/staging/vme/devices/vme_user.c
+++ b/drivers/staging/vme/devices/vme_user.c
@@ -17,7 +17,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
-#include 
+#include 
 #include 
 #include 
 #include 
@@ -118,7 +118,7 @@ static const int type[VME_DEVS] = { MASTER_MINOR,   
MASTER_MINOR,
 
 struct vme_user_vma_priv {
unsigned int minor;
-   atomic_t refcnt;
+   refcount_t refcnt;
 };
 
 static ssize_t resource_to_user(int minor, char __user *buf, size_t count,
@@ -430,7 +430,7 @@ static void vme_user_vm_open(struct vm_area_struct *vma)
 {
struct vme_user_vma_priv *vma_priv = vma->vm_private_data;
 
-   atomic_inc(_priv->refcnt);
+   refcount_inc(_priv->refcnt);
 }
 
 static void vme_user_vm_close(struct vm_area_struct *vma)
@@ -438,7 +438,7 @@ static void vme_user_vm_close(struct vm_area_struct *vma)
struct vme_user_vma_priv *vma_priv = vma->vm_private_data;
unsigned int minor = vma_priv->minor;
 
-   if (!atomic_dec_and_test(_priv->refcnt))
+   if (!refcount_dec_and_test(_priv->refcnt))
return;
 
mutex_lock([minor].mutex);
@@ -473,7 +473,7 @@ static int vme_user_master_mmap(unsigned int minor, struct 
vm_area_struct *vma)
}
 
vma_priv->minor = minor;
-   atomic_set(_priv->refcnt, 1);
+   refcount_set(_priv->refcnt, 1);
vma->vm_ops = _user_vm_ops;
vma->vm_private_data = vma_priv;
 
-- 
2.7.4

[PATCH 13/29] drivers, media: convert vb2_vmarea_handler.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/media/v4l2-core/videobuf2-memops.c | 6 +++---
 include/media/videobuf2-memops.h   | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/v4l2-core/videobuf2-memops.c 
b/drivers/media/v4l2-core/videobuf2-memops.c
index 1cd322e..4bb8424 100644
--- a/drivers/media/v4l2-core/videobuf2-memops.c
+++ b/drivers/media/v4l2-core/videobuf2-memops.c
@@ -96,10 +96,10 @@ static void vb2_common_vm_open(struct vm_area_struct *vma)
struct vb2_vmarea_handler *h = vma->vm_private_data;
 
pr_debug("%s: %p, refcount: %d, vma: %08lx-%08lx\n",
-  __func__, h, atomic_read(h->refcount), vma->vm_start,
+  __func__, h, refcount_read(h->refcount), vma->vm_start,
   vma->vm_end);
 
-   atomic_inc(h->refcount);
+   refcount_inc(h->refcount);
 }
 
 /**
@@ -114,7 +114,7 @@ static void vb2_common_vm_close(struct vm_area_struct *vma)
struct vb2_vmarea_handler *h = vma->vm_private_data;
 
pr_debug("%s: %p, refcount: %d, vma: %08lx-%08lx\n",
-  __func__, h, atomic_read(h->refcount), vma->vm_start,
+  __func__, h, refcount_read(h->refcount), vma->vm_start,
   vma->vm_end);
 
h->put(h->arg);
diff --git a/include/media/videobuf2-memops.h b/include/media/videobuf2-memops.h
index 36565c7a..a6ed091 100644
--- a/include/media/videobuf2-memops.h
+++ b/include/media/videobuf2-memops.h
@@ -16,6 +16,7 @@
 
 #include 
 #include 
+#include 
 
 /**
  * struct vb2_vmarea_handler - common vma refcount tracking handler
@@ -25,7 +26,7 @@
  * @arg:   argument for @put callback
  */
 struct vb2_vmarea_handler {
-   atomic_t*refcount;
+   refcount_t  *refcount;
void(*put)(void *arg);
void*arg;
 };
-- 
2.7.4

[PATCH 16/29] drivers, media: convert vb2_vmalloc_buf.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/media/v4l2-core/videobuf2-vmalloc.c | 11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/media/v4l2-core/videobuf2-vmalloc.c 
b/drivers/media/v4l2-core/videobuf2-vmalloc.c
index 3f77814..f83253a 100644
--- a/drivers/media/v4l2-core/videobuf2-vmalloc.c
+++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c
@@ -13,6 +13,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -26,7 +27,7 @@ struct vb2_vmalloc_buf {
struct frame_vector *vec;
enum dma_data_direction dma_dir;
unsigned long   size;
-   atomic_trefcount;
+   refcount_t  refcount;
struct vb2_vmarea_handler   handler;
struct dma_buf  *dbuf;
 };
@@ -56,7 +57,7 @@ static void *vb2_vmalloc_alloc(struct device *dev, unsigned 
long attrs,
return ERR_PTR(-ENOMEM);
}
 
-   atomic_inc(>refcount);
+   refcount_set(>refcount, 1);
return buf;
 }
 
@@ -64,7 +65,7 @@ static void vb2_vmalloc_put(void *buf_priv)
 {
struct vb2_vmalloc_buf *buf = buf_priv;
 
-   if (atomic_dec_and_test(>refcount)) {
+   if (refcount_dec_and_test(>refcount)) {
vfree(buf->vaddr);
kfree(buf);
}
@@ -161,7 +162,7 @@ static void *vb2_vmalloc_vaddr(void *buf_priv)
 static unsigned int vb2_vmalloc_num_users(void *buf_priv)
 {
struct vb2_vmalloc_buf *buf = buf_priv;
-   return atomic_read(>refcount);
+   return refcount_read(>refcount);
 }
 
 static int vb2_vmalloc_mmap(void *buf_priv, struct vm_area_struct *vma)
@@ -368,7 +369,7 @@ static struct dma_buf *vb2_vmalloc_get_dmabuf(void 
*buf_priv, unsigned long flag
return NULL;
 
/* dmabuf keeps reference to vb2 buffer */
-   atomic_inc(>refcount);
+   refcount_inc(>refcount);
 
return dbuf;
 }
-- 
2.7.4

[PATCH 14/29] drivers, media: convert vb2_dc_buf.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/media/v4l2-core/videobuf2-dma-contig.c | 11 ++-
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c 
b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index fb6a177..d29a07f 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -12,6 +12,7 @@
 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -34,7 +35,7 @@ struct vb2_dc_buf {
 
/* MMAP related */
struct vb2_vmarea_handler   handler;
-   atomic_trefcount;
+   refcount_t  refcount;
struct sg_table *sgt_base;
 
/* DMABUF related */
@@ -86,7 +87,7 @@ static unsigned int vb2_dc_num_users(void *buf_priv)
 {
struct vb2_dc_buf *buf = buf_priv;
 
-   return atomic_read(>refcount);
+   return refcount_read(>refcount);
 }
 
 static void vb2_dc_prepare(void *buf_priv)
@@ -122,7 +123,7 @@ static void vb2_dc_put(void *buf_priv)
 {
struct vb2_dc_buf *buf = buf_priv;
 
-   if (!atomic_dec_and_test(>refcount))
+   if (!refcount_dec_and_test(>refcount))
return;
 
if (buf->sgt_base) {
@@ -170,7 +171,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned long 
attrs,
buf->handler.put = vb2_dc_put;
buf->handler.arg = buf;
 
-   atomic_inc(>refcount);
+   refcount_set(>refcount, 1);
 
return buf;
 }
@@ -407,7 +408,7 @@ static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv, 
unsigned long flags)
return NULL;
 
/* dmabuf keeps reference to vb2 buffer */
-   atomic_inc(>refcount);
+   refcount_inc(>refcount);
 
return dbuf;
 }
-- 
2.7.4

[PATCH 28/29] drivers: convert sbd_duart.map_guard from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/tty/serial/sb1250-duart.c | 18 +++---
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/drivers/tty/serial/sb1250-duart.c 
b/drivers/tty/serial/sb1250-duart.c
index 771f361..041625c 100644
--- a/drivers/tty/serial/sb1250-duart.c
+++ b/drivers/tty/serial/sb1250-duart.c
@@ -41,7 +41,7 @@
 #include 
 #include 
 
-#include 
+#include 
 #include 
 #include 
 
@@ -103,7 +103,7 @@ struct sbd_port {
 struct sbd_duart {
struct sbd_port sport[2];
unsigned long   mapctrl;
-   atomic_tmap_guard;
+   refcount_t  map_guard;
 };
 
 #define to_sport(uport) container_of(uport, struct sbd_port, port)
@@ -654,15 +654,13 @@ static void sbd_release_port(struct uart_port *uport)
 {
struct sbd_port *sport = to_sport(uport);
struct sbd_duart *duart = sport->duart;
-   int map_guard;
 
iounmap(sport->memctrl);
sport->memctrl = NULL;
iounmap(uport->membase);
uport->membase = NULL;
 
-   map_guard = atomic_add_return(-1, >map_guard);
-   if (!map_guard)
+   if(refcount_dec_and_test(>map_guard))
release_mem_region(duart->mapctrl, DUART_CHANREG_SPACING);
release_mem_region(uport->mapbase, DUART_CHANREG_SPACING);
 }
@@ -698,7 +696,6 @@ static int sbd_request_port(struct uart_port *uport)
 {
const char *err = KERN_ERR "sbd: Unable to reserve MMIO resource\n";
struct sbd_duart *duart = to_sport(uport)->duart;
-   int map_guard;
int ret = 0;
 
if (!request_mem_region(uport->mapbase, DUART_CHANREG_SPACING,
@@ -706,11 +703,11 @@ static int sbd_request_port(struct uart_port *uport)
printk(err);
return -EBUSY;
}
-   map_guard = atomic_add_return(1, >map_guard);
-   if (map_guard == 1) {
+   refcount_inc(>map_guard);
+   if (refcount_read(>map_guard) == 1) {
if (!request_mem_region(duart->mapctrl, DUART_CHANREG_SPACING,
"sb1250-duart")) {
-   atomic_add(-1, >map_guard);
+   refcount_dec(>map_guard);
printk(err);
ret = -EBUSY;
}
@@ -718,8 +715,7 @@ static int sbd_request_port(struct uart_port *uport)
if (!ret) {
ret = sbd_map_port(uport);
if (ret) {
-   map_guard = atomic_add_return(-1, >map_guard);
-   if (!map_guard)
+   if (refcount_dec_and_test(>map_guard))
release_mem_region(duart->mapctrl,
   DUART_CHANREG_SPACING);
}
-- 
2.7.4

[PATCH 22/29] drivers, scsi: convert iscsi_task.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/scsi/libiscsi.c| 8 
 drivers/scsi/qedi/qedi_iscsi.c | 2 +-
 include/scsi/libiscsi.h| 3 ++-
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 834d121..7eb1d2c 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -516,13 +516,13 @@ static void iscsi_free_task(struct iscsi_task *task)
 
 void __iscsi_get_task(struct iscsi_task *task)
 {
-   atomic_inc(>refcount);
+   refcount_inc(>refcount);
 }
 EXPORT_SYMBOL_GPL(__iscsi_get_task);
 
 void __iscsi_put_task(struct iscsi_task *task)
 {
-   if (atomic_dec_and_test(>refcount))
+   if (refcount_dec_and_test(>refcount))
iscsi_free_task(task);
 }
 EXPORT_SYMBOL_GPL(__iscsi_put_task);
@@ -744,7 +744,7 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct 
iscsi_hdr *hdr,
 * released by the lld when it has transmitted the task for
 * pdus we do not expect a response for.
 */
-   atomic_set(>refcount, 1);
+   refcount_set(>refcount, 1);
task->conn = conn;
task->sc = NULL;
INIT_LIST_HEAD(>running);
@@ -1616,7 +1616,7 @@ static inline struct iscsi_task *iscsi_alloc_task(struct 
iscsi_conn *conn,
sc->SCp.phase = conn->session->age;
sc->SCp.ptr = (char *) task;
 
-   atomic_set(>refcount, 1);
+   refcount_set(>refcount, 1);
task->state = ISCSI_TASK_PENDING;
task->conn = conn;
task->sc = sc;
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index b9f79d3..3895bd5 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -1372,7 +1372,7 @@ static void qedi_cleanup_task(struct iscsi_task *task)
 {
if (!task->sc || task->state == ISCSI_TASK_PENDING) {
QEDI_INFO(NULL, QEDI_LOG_IO, "Returning ref_cnt=%d\n",
- atomic_read(>refcount));
+ refcount_read(>refcount));
return;
}
 
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index b0e275d..24d74b5 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -29,6 +29,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -139,7 +140,7 @@ struct iscsi_task {
 
/* state set/tested under session->lock */
int state;
-   atomic_trefcount;
+   refcount_t  refcount;
struct list_headrunning;/* running cmd list */
void*dd_data;   /* driver/transport data */
 };
-- 
2.7.4

[PATCH 04/29] drivers, connector: convert cn_callback_entry.refcnt from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/connector/cn_queue.c  | 4 ++--
 drivers/connector/connector.c | 2 +-
 include/linux/connector.h | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c
index 1f8bf05..9c54fdf 100644
--- a/drivers/connector/cn_queue.c
+++ b/drivers/connector/cn_queue.c
@@ -45,7 +45,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const 
char *name,
return NULL;
}
 
-   atomic_set(>refcnt, 1);
+   refcount_set(>refcnt, 1);
 
atomic_inc(>refcnt);
cbq->pdev = dev;
@@ -58,7 +58,7 @@ cn_queue_alloc_callback_entry(struct cn_queue_dev *dev, const 
char *name,
 
 void cn_queue_release_callback(struct cn_callback_entry *cbq)
 {
-   if (!atomic_dec_and_test(>refcnt))
+   if (!refcount_dec_and_test(>refcnt))
return;
 
atomic_dec(>pdev->refcnt);
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 25693b0..8615594b 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -157,7 +157,7 @@ static int cn_call_callback(struct sk_buff *skb)
spin_lock_bh(>cbdev->queue_lock);
list_for_each_entry(i, >cbdev->queue_list, callback_entry) {
if (cn_cb_equal(>id.id, >id)) {
-   atomic_inc(>refcnt);
+   refcount_inc(>refcnt);
cbq = i;
break;
}
diff --git a/include/linux/connector.h b/include/linux/connector.h
index f8fe863..032102b 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -22,7 +22,7 @@
 #define __CONNECTOR_H
 
 
-#include 
+#include 
 
 #include 
 #include 
@@ -49,7 +49,7 @@ struct cn_callback_id {
 
 struct cn_callback_entry {
struct list_head callback_entry;
-   atomic_t refcnt;
+   refcount_t refcnt;
struct cn_queue_dev *pdev;
 
struct cn_callback_id id;
-- 
2.7.4

[PATCH 05/29] drivers, md, bcache: convert cached_dev.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/md/bcache/bcache.h| 7 ---
 drivers/md/bcache/super.c | 6 +++---
 drivers/md/bcache/writeback.h | 2 +-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index c3ea03c..de2be28 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -184,6 +184,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 
@@ -299,7 +300,7 @@ struct cached_dev {
struct semaphoresb_write_mutex;
 
/* Refcount on the cache set. Always nonzero when we're caching. */
-   atomic_tcount;
+   refcount_t  count;
struct work_struct  detach;
 
/*
@@ -805,13 +806,13 @@ do {  
\
 
 static inline void cached_dev_put(struct cached_dev *dc)
 {
-   if (atomic_dec_and_test(>count))
+   if (refcount_dec_and_test(>count))
schedule_work(>detach);
 }
 
 static inline bool cached_dev_get(struct cached_dev *dc)
 {
-   if (!atomic_inc_not_zero(>count))
+   if (!refcount_inc_not_zero(>count))
return false;
 
/* Paired with the mb in cached_dev_attach */
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 85e3f21..cc36ce4 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -891,7 +891,7 @@ static void cached_dev_detach_finish(struct work_struct *w)
closure_init_stack();
 
BUG_ON(!test_bit(BCACHE_DEV_DETACHING, >disk.flags));
-   BUG_ON(atomic_read(>count));
+   BUG_ON(refcount_read(>count));
 
mutex_lock(_register_lock);
 
@@ -1018,7 +1018,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct 
cache_set *c)
 * dc->c must be set before dc->count != 0 - paired with the mb in
 * cached_dev_get()
 */
-   atomic_set(>count, 1);
+   refcount_set(>count, 1);
 
/* Block writeback thread, but spawn it */
down_write(>writeback_lock);
@@ -1030,7 +1030,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct 
cache_set *c)
if (BDEV_STATE(>sb) == BDEV_STATE_DIRTY) {
bch_sectors_dirty_init(dc);
atomic_set(>has_dirty, 1);
-   atomic_inc(>count);
+   refcount_inc(>count);
bch_writeback_queue(dc);
}
 
diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h
index 629bd1a..5bac1b0 100644
--- a/drivers/md/bcache/writeback.h
+++ b/drivers/md/bcache/writeback.h
@@ -70,7 +70,7 @@ static inline void bch_writeback_add(struct cached_dev *dc)
 {
if (!atomic_read(>has_dirty) &&
!atomic_xchg(>has_dirty, 1)) {
-   atomic_inc(>count);
+   refcount_inc(>count);
 
if (BDEV_STATE(>sb) != BDEV_STATE_DIRTY) {
SET_BDEV_STATE(>sb, BDEV_STATE_DIRTY);
-- 
2.7.4

[PATCH 06/29] drivers, md: convert dm_cache_metadata.ref_count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/md/dm-cache-metadata.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index e4c2c1a..6d26e71 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -13,6 +13,7 @@
 #include "persistent-data/dm-transaction-manager.h"
 
 #include 
+#include 
 
 /**/
 
@@ -102,7 +103,7 @@ struct cache_disk_superblock {
 } __packed;
 
 struct dm_cache_metadata {
-   atomic_t ref_count;
+   refcount_t ref_count;
struct list_head list;
 
unsigned version;
@@ -756,7 +757,7 @@ static struct dm_cache_metadata *metadata_open(struct 
block_device *bdev,
}
 
cmd->version = metadata_version;
-   atomic_set(>ref_count, 1);
+   refcount_set(>ref_count, 1);
init_rwsem(>root_lock);
cmd->bdev = bdev;
cmd->data_block_size = data_block_size;
@@ -794,7 +795,7 @@ static struct dm_cache_metadata *lookup(struct block_device 
*bdev)
 
list_for_each_entry(cmd, , list)
if (cmd->bdev == bdev) {
-   atomic_inc(>ref_count);
+   refcount_inc(>ref_count);
return cmd;
}
 
@@ -865,7 +866,7 @@ struct dm_cache_metadata *dm_cache_metadata_open(struct 
block_device *bdev,
 
 void dm_cache_metadata_close(struct dm_cache_metadata *cmd)
 {
-   if (atomic_dec_and_test(>ref_count)) {
+   if (refcount_dec_and_test(>ref_count)) {
mutex_lock(_lock);
list_del(>list);
mutex_unlock(_lock);
-- 
2.7.4

[PATCH 24/29] drivers: convert iblock_req.pending from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/target/target_core_iblock.c | 12 ++--
 drivers/target/target_core_iblock.h |  3 ++-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/target/target_core_iblock.c 
b/drivers/target/target_core_iblock.c
index d316ed5..bb069eb 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -279,7 +279,7 @@ static void iblock_complete_cmd(struct se_cmd *cmd)
struct iblock_req *ibr = cmd->priv;
u8 status;
 
-   if (!atomic_dec_and_test(>pending))
+   if (!refcount_dec_and_test(>pending))
return;
 
if (atomic_read(>ib_bio_err_cnt))
@@ -487,7 +487,7 @@ iblock_execute_write_same(struct se_cmd *cmd)
bio_list_init();
bio_list_add(, bio);
 
-   atomic_set(>pending, 1);
+   refcount_set(>pending, 1);
 
while (sectors) {
while (bio_add_page(bio, sg_page(sg), sg->length, sg->offset)
@@ -498,7 +498,7 @@ iblock_execute_write_same(struct se_cmd *cmd)
if (!bio)
goto fail_put_bios;
 
-   atomic_inc(>pending);
+   refcount_inc(>pending);
bio_list_add(, bio);
}
 
@@ -706,7 +706,7 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist 
*sgl, u32 sgl_nents,
cmd->priv = ibr;
 
if (!sgl_nents) {
-   atomic_set(>pending, 1);
+   refcount_set(>pending, 1);
iblock_complete_cmd(cmd);
return 0;
}
@@ -719,7 +719,7 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist 
*sgl, u32 sgl_nents,
bio_list_init();
bio_list_add(, bio);
 
-   atomic_set(>pending, 2);
+   refcount_set(>pending, 2);
bio_cnt = 1;
 
for_each_sg(sgl, sg, sgl_nents, i) {
@@ -740,7 +740,7 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist 
*sgl, u32 sgl_nents,
if (!bio)
goto fail_put_bios;
 
-   atomic_inc(>pending);
+   refcount_inc(>pending);
bio_list_add(, bio);
bio_cnt++;
}
diff --git a/drivers/target/target_core_iblock.h 
b/drivers/target/target_core_iblock.h
index 718d3fc..f2a5797 100644
--- a/drivers/target/target_core_iblock.h
+++ b/drivers/target/target_core_iblock.h
@@ -2,6 +2,7 @@
 #define TARGET_CORE_IBLOCK_H
 
 #include 
+#include 
 #include 
 
 #define IBLOCK_VERSION "4.0"
@@ -10,7 +11,7 @@
 #define IBLOCK_LBA_SHIFT   9
 
 struct iblock_req {
-   atomic_t pending;
+   refcount_t pending;
atomic_t ib_bio_err_cnt;
 } cacheline_aligned;
 
-- 
2.7.4

[PATCH 11/29] drivers, media: convert cx88_core.refcount from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/media/pci/cx88/cx88-cards.c | 2 +-
 drivers/media/pci/cx88/cx88-core.c  | 4 ++--
 drivers/media/pci/cx88/cx88.h   | 3 ++-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/media/pci/cx88/cx88-cards.c 
b/drivers/media/pci/cx88/cx88-cards.c
index cdfbde2..7fc5f5f 100644
--- a/drivers/media/pci/cx88/cx88-cards.c
+++ b/drivers/media/pci/cx88/cx88-cards.c
@@ -3670,7 +3670,7 @@ struct cx88_core *cx88_core_create(struct pci_dev *pci, 
int nr)
if (!core)
return NULL;
 
-   atomic_inc(>refcount);
+   refcount_set(>refcount, 1);
core->pci_bus  = pci->bus->number;
core->pci_slot = PCI_SLOT(pci->devfn);
core->pci_irqmask = PCI_INT_RISC_RD_BERRINT | PCI_INT_RISC_WR_BERRINT |
diff --git a/drivers/media/pci/cx88/cx88-core.c 
b/drivers/media/pci/cx88/cx88-core.c
index 973a9cd4..8bfa5b7 100644
--- a/drivers/media/pci/cx88/cx88-core.c
+++ b/drivers/media/pci/cx88/cx88-core.c
@@ -1052,7 +1052,7 @@ struct cx88_core *cx88_core_get(struct pci_dev *pci)
mutex_unlock();
return NULL;
}
-   atomic_inc(>refcount);
+   refcount_inc(>refcount);
mutex_unlock();
return core;
}
@@ -1073,7 +1073,7 @@ void cx88_core_put(struct cx88_core *core, struct pci_dev 
*pci)
release_mem_region(pci_resource_start(pci, 0),
   pci_resource_len(pci, 0));
 
-   if (!atomic_dec_and_test(>refcount))
+   if (!refcount_dec_and_test(>refcount))
return;
 
mutex_lock();
diff --git a/drivers/media/pci/cx88/cx88.h b/drivers/media/pci/cx88/cx88.h
index 115414c..16c1313 100644
--- a/drivers/media/pci/cx88/cx88.h
+++ b/drivers/media/pci/cx88/cx88.h
@@ -24,6 +24,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -339,7 +340,7 @@ struct cx8802_dev;
 
 struct cx88_core {
struct list_head   devlist;
-   atomic_t   refcount;
+   refcount_t   refcount;
 
/* board name */
intnr;
-- 
2.7.4

[PATCH 12/29] drivers, media: convert s2255_dev.num_channels from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/media/usb/s2255/s2255drv.c | 21 +++--
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/media/usb/s2255/s2255drv.c 
b/drivers/media/usb/s2255/s2255drv.c
index a9d4484..2b4b009 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -36,6 +36,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -256,7 +257,7 @@ struct s2255_vc {
 struct s2255_dev {
struct s2255_vc vc[MAX_CHANNELS];
struct v4l2_device  v4l2_dev;
-   atomic_tnum_channels;
+   refcount_tnum_channels;
int frames;
struct mutexlock;   /* channels[].vdev.lock */
struct mutexcmdlock; /* protects cmdbuf */
@@ -1581,11 +1582,11 @@ static void s2255_video_device_release(struct 
video_device *vdev)
container_of(vdev, struct s2255_vc, vdev);
 
dprintk(dev, 4, "%s, chnls: %d\n", __func__,
-   atomic_read(>num_channels));
+   refcount_read(>num_channels));
 
v4l2_ctrl_handler_free(>hdl);
 
-   if (atomic_dec_and_test(>num_channels))
+   if (refcount_dec_and_test(>num_channels))
s2255_destroy(dev);
return;
 }
@@ -1688,7 +1689,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
"failed to register video device!\n");
break;
}
-   atomic_inc(>num_channels);
+   refcount_set(>num_channels, 1);
v4l2_info(>v4l2_dev, "V4L2 device registered as %s\n",
  video_device_node_name(>vdev));
 
@@ -1696,11 +1697,11 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
pr_info("Sensoray 2255 V4L driver Revision: %s\n",
S2255_VERSION);
/* if no channels registered, return error and probe will fail*/
-   if (atomic_read(>num_channels) == 0) {
+   if (refcount_read(>num_channels) == 0) {
v4l2_device_unregister(>v4l2_dev);
return ret;
}
-   if (atomic_read(>num_channels) != MAX_CHANNELS)
+   if (refcount_read(>num_channels) != MAX_CHANNELS)
pr_warn("s2255: Not all channels available.\n");
return 0;
 }
@@ -2248,7 +2249,7 @@ static int s2255_probe(struct usb_interface *interface,
goto errorFWDATA1;
}
 
-   atomic_set(>num_channels, 0);
+   refcount_set(>num_channels, 0);
dev->pid = id->idProduct;
dev->fw_data = kzalloc(sizeof(struct s2255_fw), GFP_KERNEL);
if (!dev->fw_data)
@@ -2368,12 +2369,12 @@ static void s2255_disconnect(struct usb_interface 
*interface)
 {
struct s2255_dev *dev = to_s2255_dev(usb_get_intfdata(interface));
int i;
-   int channels = atomic_read(>num_channels);
+   int channels = refcount_read(>num_channels);
mutex_lock(>lock);
v4l2_device_disconnect(>v4l2_dev);
mutex_unlock(>lock);
/*see comments in the uvc_driver.c usb disconnect function */
-   atomic_inc(>num_channels);
+   refcount_inc(>num_channels);
/* unregister each video device. */
for (i = 0; i < channels; i++)
video_unregister_device(>vc[i].vdev);
@@ -2386,7 +2387,7 @@ static void s2255_disconnect(struct usb_interface 
*interface)
dev->vc[i].vidstatus_ready = 1;
wake_up(>vc[i].wait_vidstatus);
}
-   if (atomic_dec_and_test(>num_channels))
+   if (refcount_dec_and_test(>num_channels))
s2255_destroy(dev);
dev_info(>dev, "%s\n", __func__);
 }
-- 
2.7.4

[PATCH 00/29] drivers, mics refcount conversions

[Elena Reshetova]

This series, for various different drivers, replaces atomic_t reference
counters with the new refcount_t type and API (see include/linux/refcount.h).
By doing this we prevent intentional or accidental
underflows or overflows that can led to use-after-free vulnerabilities.

The below patches are fully independent and can be cherry-picked separately*.
Since we convert all kernel subsystems in the same fashion, resulting
in about 300 patches, we have to group them for sending at least in some
fashion to be manageable. Please excuse the long cc list.

*with the exception of the media/vb2-related patches that depend on
vb2_vmarea_handler.refcount conversions.

Not run-time tested beyond booting and using kernel with refcount conversions
for my daily work.

If there are no objections to these patches,
I think they can go via Greg's drivers tree, as he suggested before.

Elena Reshetova (29):
  drivers, block: convert xen_blkif.refcnt from atomic_t to refcount_t
  drivers, firewire: convert fw_node.ref_count from atomic_t to
refcount_t
  drivers, char: convert vma_data.refcnt from atomic_t to refcount_t
  drivers, connector: convert cn_callback_entry.refcnt from atomic_t to
refcount_t
  drivers, md, bcache: convert cached_dev.count from atomic_t to
refcount_t
  drivers, md: convert dm_cache_metadata.ref_count from atomic_t to
refcount_t
  drivers, md: convert dm_dev_internal.count from atomic_t to refcount_t
  drivers, md: convert mddev.active from atomic_t to refcount_t
  drivers, md: convert table_device.count from atomic_t to refcount_t
  drivers, md: convert stripe_head.count from atomic_t to refcount_t
  drivers, media: convert cx88_core.refcount from atomic_t to refcount_t
  drivers, media: convert s2255_dev.num_channels from atomic_t to
refcount_t
  drivers, media: convert vb2_vmarea_handler.refcount from atomic_t to
refcount_t
  drivers, media: convert vb2_dc_buf.refcount from atomic_t to
refcount_t
  drivers, media: convert vb2_dma_sg_buf.refcount from atomic_t to
refcount_t
  drivers, media: convert vb2_vmalloc_buf.refcount from atomic_t to
refcount_t
  drivers, pci: convert hv_pci_dev.refs from atomic_t to refcount_t
  drivers, s390: convert urdev.ref_count from atomic_t to refcount_t
  drivers, s390: convert lcs_reply.refcnt from atomic_t to refcount_t
  drivers, s390: convert qeth_reply.refcnt from atomic_t to refcount_t
  drivers, s390: convert fc_fcp_pkt.ref_cnt from atomic_t to refcount_t
  drivers, scsi: convert iscsi_task.refcount from atomic_t to refcount_t
  drivers: convert vme_user_vma_priv.refcnt from atomic_t to refcount_t
  drivers: convert iblock_req.pending from atomic_t to refcount_t
  drivers, usb: convert ffs_data.ref from atomic_t to refcount_t
  drivers, usb: convert dev_data.count from atomic_t to refcount_t
  drivers, usb: convert ep_data.count from atomic_t to refcount_t
  drivers: convert sbd_duart.map_guard from atomic_t to refcount_t
  drivers, xen: convert grant_map.users from atomic_t to refcount_t

 drivers/block/xen-blkback/common.h |  7 +--
 drivers/block/xen-blkback/xenbus.c |  2 +-
 drivers/char/mspec.c   |  9 ++--
 drivers/connector/cn_queue.c   |  4 +-
 drivers/connector/connector.c  |  2 +-
 drivers/firewire/core-topology.c   |  2 +-
 drivers/firewire/core.h|  8 ++--
 drivers/md/bcache/bcache.h |  7 +--
 drivers/md/bcache/super.c  |  6 +--
 drivers/md/bcache/writeback.h  |  2 +-
 drivers/md/dm-cache-metadata.c |  9 ++--
 drivers/md/dm-table.c  |  6 +--
 drivers/md/dm.c| 12 +++--
 drivers/md/dm.h|  3 +-
 drivers/md/md.c|  6 +--
 drivers/md/md.h|  3 +-
 drivers/md/raid5-cache.c   |  8 ++--
 drivers/md/raid5.c | 66 +-
 drivers/md/raid5.h |  3 +-
 drivers/media/pci/cx88/cx88-cards.c|  2 +-
 drivers/media/pci/cx88/cx88-core.c |  4 +-
 drivers/media/pci/cx88/cx88.h  |  3 +-
 drivers/media/usb/s2255/s2255drv.c | 21 
 drivers/media/v4l2-core/videobuf2-dma-contig.c | 11 +++--
 drivers/media/v4l2-core/videobuf2-dma-sg.c | 11 +++--
 drivers/media/v4l2-core/videobuf2-memops.c |  6 +--
 drivers/media/v4l2-core/videobuf2-vmalloc.c| 11 +++--
 drivers/pci/host/pci-hyperv.c  |  9 ++--
 drivers/s390/char/vmur.c   |  8 ++--
 drivers/s390/char/vmur.h   |  4 +-
 drivers/s390/net/lcs.c |  8 ++--
 drivers/s390/net/lcs.h |  3 +-
 drivers/s390/net/qeth_core.h   |  3 +-
 drivers/s390/net/qeth_core_main.c  |  8 ++--
 

[PATCH 10/29] drivers, md: convert stripe_head.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/md/raid5-cache.c |  8 +++---
 drivers/md/raid5.c   | 66 
 drivers/md/raid5.h   |  3 ++-
 3 files changed, 39 insertions(+), 38 deletions(-)

diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 3f307be..6c05e12 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -979,7 +979,7 @@ int r5l_write_stripe(struct r5l_log *log, struct 
stripe_head *sh)
 * don't delay.
 */
clear_bit(STRIPE_DELAYED, >state);
-   atomic_inc(>count);
+   refcount_inc(>count);
 
mutex_lock(>io_mutex);
/* meta + data */
@@ -1321,7 +1321,7 @@ static void r5c_flush_stripe(struct r5conf *conf, struct 
stripe_head *sh)
assert_spin_locked(>device_lock);
 
list_del_init(>lru);
-   atomic_inc(>count);
+   refcount_inc(>count);
 
set_bit(STRIPE_HANDLE, >state);
atomic_inc(>active_stripes);
@@ -1424,7 +1424,7 @@ static void r5c_do_reclaim(struct r5conf *conf)
 */
if (!list_empty(>lru) &&
!test_bit(STRIPE_HANDLE, >state) &&
-   atomic_read(>count) == 0) {
+   refcount_read(>count) == 0) {
r5c_flush_stripe(conf, sh);
if (count++ >= R5C_RECLAIM_STRIPE_GROUP)
break;
@@ -2650,7 +2650,7 @@ r5c_cache_data(struct r5l_log *log, struct stripe_head 
*sh,
 * don't delay.
 */
clear_bit(STRIPE_DELAYED, >state);
-   atomic_inc(>count);
+   refcount_inc(>count);
 
mutex_lock(>io_mutex);
/* meta + data */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2ce23b0..30c96a8 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -296,7 +296,7 @@ static void do_release_stripe(struct r5conf *conf, struct 
stripe_head *sh,
 static void __release_stripe(struct r5conf *conf, struct stripe_head *sh,
 struct list_head *temp_inactive_list)
 {
-   if (atomic_dec_and_test(>count))
+   if (refcount_dec_and_test(>count))
do_release_stripe(conf, sh, temp_inactive_list);
 }
 
@@ -388,7 +388,7 @@ void raid5_release_stripe(struct stripe_head *sh)
 
/* Avoid release_list until the last reference.
 */
-   if (atomic_add_unless(>count, -1, 1))
+   if (refcount_dec_not_one(>count))
return;
 
if (unlikely(!conf->mddev->thread) ||
@@ -401,7 +401,7 @@ void raid5_release_stripe(struct stripe_head *sh)
 slow_path:
local_irq_save(flags);
/* we are ok here if STRIPE_ON_RELEASE_LIST is set or not */
-   if (atomic_dec_and_lock(>count, >device_lock)) {
+   if (refcount_dec_and_lock(>count, >device_lock)) {
INIT_LIST_HEAD();
hash = sh->hash_lock_index;
do_release_stripe(conf, sh, );
@@ -491,7 +491,7 @@ static void init_stripe(struct stripe_head *sh, sector_t 
sector, int previous)
struct r5conf *conf = sh->raid_conf;
int i, seq;
 
-   BUG_ON(atomic_read(>count) != 0);
+   BUG_ON(refcount_read(>count) != 0);
BUG_ON(test_bit(STRIPE_HANDLE, >state));
BUG_ON(stripe_operations_active(sh));
BUG_ON(sh->batch_head);
@@ -668,11 +668,11 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t 
sector,
  >cache_state);
} else {
init_stripe(sh, sector, previous);
-   atomic_inc(>count);
+   refcount_inc(>count);
}
-   } else if (!atomic_inc_not_zero(>count)) {
+   } else if (!refcount_inc_not_zero(>count)) {
spin_lock(>device_lock);
-   if (!atomic_read(>count)) {
+   if (!refcount_read(>count)) {
if (!test_bit(STRIPE_HANDLE, >state))
atomic_inc(>active_stripes);
BUG_ON(list_empty(>lru) &&
@@ -688,7 +688,7 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t 
sector,
sh->group = NULL;
}
}
-   atomic_inc(>count);
+   refcount_inc(>count);
spin_unlock(>device_lock);
   

[PATCH 08/29] drivers, md: convert mddev.active from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/md/md.c | 6 +++---
 drivers/md/md.h | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 985374f..94c8ebf 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -449,7 +449,7 @@ EXPORT_SYMBOL(md_unplug);
 
 static inline struct mddev *mddev_get(struct mddev *mddev)
 {
-   atomic_inc(>active);
+   refcount_inc(>active);
return mddev;
 }
 
@@ -459,7 +459,7 @@ static void mddev_put(struct mddev *mddev)
 {
struct bio_set *bs = NULL;
 
-   if (!atomic_dec_and_lock(>active, _mddevs_lock))
+   if (!refcount_dec_and_lock(>active, _mddevs_lock))
return;
if (!mddev->raid_disks && list_empty(>disks) &&
mddev->ctime == 0 && !mddev->hold_active) {
@@ -495,7 +495,7 @@ void mddev_init(struct mddev *mddev)
INIT_LIST_HEAD(>all_mddevs);
setup_timer(>safemode_timer, md_safemode_timeout,
(unsigned long) mddev);
-   atomic_set(>active, 1);
+   refcount_set(>active, 1);
atomic_set(>openers, 0);
atomic_set(>active_io, 0);
spin_lock_init(>lock);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index b8859cb..4811663 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -22,6 +22,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -360,7 +361,7 @@ struct mddev {
 */
struct mutexopen_mutex;
struct mutexreconfig_mutex;
-   atomic_tactive; /* general refcount */
+   refcount_t  active; /* general refcount */
atomic_topeners;/* number of active 
opens */
 
int changed;/* True if we might 
need to
-- 
2.7.4

[PATCH 02/29] drivers, firewire: convert fw_node.ref_count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/firewire/core-topology.c | 2 +-
 drivers/firewire/core.h  | 8 
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/firewire/core-topology.c b/drivers/firewire/core-topology.c
index 0de8350..939d259 100644
--- a/drivers/firewire/core-topology.c
+++ b/drivers/firewire/core-topology.c
@@ -124,7 +124,7 @@ static struct fw_node *fw_node_create(u32 sid, int 
port_count, int color)
node->initiated_reset = SELF_ID_PHY_INITIATOR(sid);
node->port_count = port_count;
 
-   atomic_set(>ref_count, 1);
+   refcount_set(>ref_count, 1);
INIT_LIST_HEAD(>link);
 
return node;
diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
index e1480ff6..c07962e 100644
--- a/drivers/firewire/core.h
+++ b/drivers/firewire/core.h
@@ -12,7 +12,7 @@
 #include 
 #include 
 
-#include 
+#include 
 
 struct device;
 struct fw_card;
@@ -184,7 +184,7 @@ struct fw_node {
 * local node to this node. */
u8 max_depth:4; /* Maximum depth to any leaf node */
u8 max_hops:4;  /* Max hops in this sub tree */
-   atomic_t ref_count;
+   refcount_t ref_count;
 
/* For serializing node topology into a list. */
struct list_head link;
@@ -197,14 +197,14 @@ struct fw_node {
 
 static inline struct fw_node *fw_node_get(struct fw_node *node)
 {
-   atomic_inc(>ref_count);
+   refcount_inc(>ref_count);
 
return node;
 }
 
 static inline void fw_node_put(struct fw_node *node)
 {
-   if (atomic_dec_and_test(>ref_count))
+   if (refcount_dec_and_test(>ref_count))
kfree(node);
 }
 
-- 
2.7.4

[PATCH 26/29] drivers, usb: convert dev_data.count from atomic_t to refcount_t

[Elena Reshetova]

refcount_t type and corresponding API should be
used instead of atomic_t when the variable is used as
a reference counter. This allows to avoid accidental
refcounter overflows that might lead to use-after-free
situations.

Signed-off-by: Elena Reshetova 
Signed-off-by: Hans Liljestrand 
Signed-off-by: Kees Cook 
Signed-off-by: David Windsor 
---
 drivers/usb/gadget/legacy/inode.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/legacy/inode.c 
b/drivers/usb/gadget/legacy/inode.c
index 79a2d8f..81d76f3 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -27,6 +27,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -114,7 +115,7 @@ enum ep0_state {
 
 struct dev_data {
spinlock_t  lock;
-   atomic_tcount;
+   refcount_t  count;
enum ep0_state  state;  /* P: lock */
struct usb_gadgetfs_event   event [N_EVENT];
unsignedev_next;
@@ -150,12 +151,12 @@ struct dev_data {
 
 static inline void get_dev (struct dev_data *data)
 {
-   atomic_inc (>count);
+   refcount_inc (>count);
 }
 
 static void put_dev (struct dev_data *data)
 {
-   if (likely (!atomic_dec_and_test (>count)))
+   if (likely (!refcount_dec_and_test (>count)))
return;
/* needs no more cleanup */
BUG_ON (waitqueue_active (>wait));
@@ -170,7 +171,7 @@ static struct dev_data *dev_new (void)
if (!dev)
return NULL;
dev->state = STATE_DEV_DISABLED;
-   atomic_set (>count, 1);
+   refcount_set (>count, 1);
spin_lock_init (>lock);
INIT_LIST_HEAD (>epfiles);
init_waitqueue_head (>wait);
-- 
2.7.4

Re: [PATCH v5 02/11] phy: exynos-ufs: add UFS PHY driver for EXYNOS SoC

[Kishon Vijay Abraham I]

Hi,

On Monday 06 March 2017 05:12 PM, Alim Akhtar wrote:
> Hi Kishon
> 
> On 03/01/2017 10:07 AM, Kishon Vijay Abraham I wrote:
>> Hi,
>>
>> On Tuesday 28 February 2017 01:51 PM, Alim Akhtar wrote:
>>> Hi Kishon,
>>>
>>> On 02/28/2017 09:04 AM, Kishon Vijay Abraham I wrote:
 Hi,

 On Monday 27 February 2017 07:40 PM, Alim Akhtar wrote:
> Hi Kishon,
>
> On 02/27/2017 10:56 AM, Kishon Vijay Abraham I wrote:
>> Hi,
>>
>> On Thursday 23 February 2017 12:20 AM, Alim Akhtar wrote:
>>> On Fri, Feb 3, 2017 at 2:49 PM, Alim Akhtar  
>>> wrote:
 Hi Kishon,


 On 11/19/2015 07:09 PM, Kishon Vijay Abraham I wrote:
>
> Hi,
>
> On Tuesday 17 November 2015 01:41 PM, Alim Akhtar wrote:
>>
>> Hi
>> Thanks again for looking into this.
>>
>> On 11/17/2015 11:46 AM, Kishon Vijay Abraham I wrote:
>>>
>>> Hi,
>>>
>>> On Monday 09 November 2015 10:56 AM, Alim Akhtar wrote:

 From: Seungwon Jeon 

 This patch introduces Exynos UFS PHY driver. This driver
 supports to deal with phy calibration and power control
 according to UFS host driver's behavior.

 Signed-off-by: Seungwon Jeon 
 Signed-off-by: Alim Akhtar 
 Cc: Kishon Vijay Abraham I 
 ---
   drivers/phy/Kconfig|7 ++
   drivers/phy/Makefile   |1 +
   drivers/phy/phy-exynos-ufs.c   |  241
 
   drivers/phy/phy-exynos-ufs.h   |   85 +
   drivers/phy/phy-exynos7-ufs.h  |   89 +
   include/linux/phy/phy-exynos-ufs.h |   85 +
   6 files changed, 508 insertions(+)
   create mode 100644 drivers/phy/phy-exynos-ufs.c
   create mode 100644 drivers/phy/phy-exynos-ufs.h
   create mode 100644 drivers/phy/phy-exynos7-ufs.h
   create mode 100644 include/linux/phy/phy-exynos-ufs.h

 diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
 index 7eb5859dd035..7d38a92e0297 100644
 --- a/drivers/phy/Kconfig
 +++ b/drivers/phy/Kconfig
 @@ -389,4 +389,11 @@ config PHY_CYGNUS_PCIE
 Enable this to support the Broadcom Cygnus PCIe PHY.
 If unsure, say N.

 +config PHY_EXYNOS_UFS
 +tristate "EXYNOS SoC series UFS PHY driver"
 +depends on OF && ARCH_EXYNOS || COMPILE_TEST
 +select GENERIC_PHY
 +help
 +  Support for UFS PHY on Samsung EXYNOS chipsets.
 +
   endmenu
 diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
 index 075db1a81aa5..9bec4d1a89e1 100644
 --- a/drivers/phy/Makefile
 +++ b/drivers/phy/Makefile
 @@ -10,6 +10,7 @@ obj-$(CONFIG_ARMADA375_USBCLUSTER_PHY)+=
 phy-armada375-usb2.o
   obj-$(CONFIG_BCM_KONA_USB2_PHY)+= phy-bcm-kona-usb2.o
   obj-$(CONFIG_PHY_EXYNOS_DP_VIDEO)+= phy-exynos-dp-video.o
   obj-$(CONFIG_PHY_EXYNOS_MIPI_VIDEO)+= phy-exynos-mipi-video.o
 +obj-$(CONFIG_PHY_EXYNOS_UFS)+= phy-exynos-ufs.o
   obj-$(CONFIG_PHY_LPC18XX_USB_OTG)+= phy-lpc18xx-usb-otg.o
   obj-$(CONFIG_PHY_PXA_28NM_USB2)+= phy-pxa-28nm-usb2.o
   obj-$(CONFIG_PHY_PXA_28NM_HSIC)+= phy-pxa-28nm-hsic.o
 diff --git a/drivers/phy/phy-exynos-ufs.c
 b/drivers/phy/phy-exynos-ufs.c
 new file mode 100644
 index ..cb1aeaa3d4eb
 --- /dev/null
 +++ b/drivers/phy/phy-exynos-ufs.c
 @@ -0,0 +1,241 @@
 +/*
 + * UFS PHY driver for Samsung EXYNOS SoC
 + *
 + * Copyright (C) 2015 Samsung Electronics Co., Ltd.
 + * Author: Seungwon Jeon 
 + *
 + * This program is free software; you can redistribute it and/or
 modify
 + * it under the terms of the GNU General Public License as 
 published
 by
 + * the Free Software Foundation; either version 2 of the License, 
 or
 + * (at your option) any later version.
 + */
 +#include 
 +#include 
 +#include 
 +#include 
 +#include 
 +#include 
 +#include 
 +#include 
 +#include 
 

Re: [PATCH v5 02/11] phy: exynos-ufs: add UFS PHY driver for EXYNOS SoC

[Alim Akhtar]

Hi Kishon

On 03/01/2017 10:07 AM, Kishon Vijay Abraham I wrote:
> Hi,
>
> On Tuesday 28 February 2017 01:51 PM, Alim Akhtar wrote:
>> Hi Kishon,
>>
>> On 02/28/2017 09:04 AM, Kishon Vijay Abraham I wrote:
>>> Hi,
>>>
>>> On Monday 27 February 2017 07:40 PM, Alim Akhtar wrote:
 Hi Kishon,

 On 02/27/2017 10:56 AM, Kishon Vijay Abraham I wrote:
> Hi,
>
> On Thursday 23 February 2017 12:20 AM, Alim Akhtar wrote:
>> On Fri, Feb 3, 2017 at 2:49 PM, Alim Akhtar  
>> wrote:
>>> Hi Kishon,
>>>
>>>
>>> On 11/19/2015 07:09 PM, Kishon Vijay Abraham I wrote:

 Hi,

 On Tuesday 17 November 2015 01:41 PM, Alim Akhtar wrote:
>
> Hi
> Thanks again for looking into this.
>
> On 11/17/2015 11:46 AM, Kishon Vijay Abraham I wrote:
>>
>> Hi,
>>
>> On Monday 09 November 2015 10:56 AM, Alim Akhtar wrote:
>>>
>>> From: Seungwon Jeon 
>>>
>>> This patch introduces Exynos UFS PHY driver. This driver
>>> supports to deal with phy calibration and power control
>>> according to UFS host driver's behavior.
>>>
>>> Signed-off-by: Seungwon Jeon 
>>> Signed-off-by: Alim Akhtar 
>>> Cc: Kishon Vijay Abraham I 
>>> ---
>>>   drivers/phy/Kconfig|7 ++
>>>   drivers/phy/Makefile   |1 +
>>>   drivers/phy/phy-exynos-ufs.c   |  241
>>> 
>>>   drivers/phy/phy-exynos-ufs.h   |   85 +
>>>   drivers/phy/phy-exynos7-ufs.h  |   89 +
>>>   include/linux/phy/phy-exynos-ufs.h |   85 +
>>>   6 files changed, 508 insertions(+)
>>>   create mode 100644 drivers/phy/phy-exynos-ufs.c
>>>   create mode 100644 drivers/phy/phy-exynos-ufs.h
>>>   create mode 100644 drivers/phy/phy-exynos7-ufs.h
>>>   create mode 100644 include/linux/phy/phy-exynos-ufs.h
>>>
>>> diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
>>> index 7eb5859dd035..7d38a92e0297 100644
>>> --- a/drivers/phy/Kconfig
>>> +++ b/drivers/phy/Kconfig
>>> @@ -389,4 +389,11 @@ config PHY_CYGNUS_PCIE
>>> Enable this to support the Broadcom Cygnus PCIe PHY.
>>> If unsure, say N.
>>>
>>> +config PHY_EXYNOS_UFS
>>> +tristate "EXYNOS SoC series UFS PHY driver"
>>> +depends on OF && ARCH_EXYNOS || COMPILE_TEST
>>> +select GENERIC_PHY
>>> +help
>>> +  Support for UFS PHY on Samsung EXYNOS chipsets.
>>> +
>>>   endmenu
>>> diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
>>> index 075db1a81aa5..9bec4d1a89e1 100644
>>> --- a/drivers/phy/Makefile
>>> +++ b/drivers/phy/Makefile
>>> @@ -10,6 +10,7 @@ obj-$(CONFIG_ARMADA375_USBCLUSTER_PHY)+=
>>> phy-armada375-usb2.o
>>>   obj-$(CONFIG_BCM_KONA_USB2_PHY)+= phy-bcm-kona-usb2.o
>>>   obj-$(CONFIG_PHY_EXYNOS_DP_VIDEO)+= phy-exynos-dp-video.o
>>>   obj-$(CONFIG_PHY_EXYNOS_MIPI_VIDEO)+= phy-exynos-mipi-video.o
>>> +obj-$(CONFIG_PHY_EXYNOS_UFS)+= phy-exynos-ufs.o
>>>   obj-$(CONFIG_PHY_LPC18XX_USB_OTG)+= phy-lpc18xx-usb-otg.o
>>>   obj-$(CONFIG_PHY_PXA_28NM_USB2)+= phy-pxa-28nm-usb2.o
>>>   obj-$(CONFIG_PHY_PXA_28NM_HSIC)+= phy-pxa-28nm-hsic.o
>>> diff --git a/drivers/phy/phy-exynos-ufs.c
>>> b/drivers/phy/phy-exynos-ufs.c
>>> new file mode 100644
>>> index ..cb1aeaa3d4eb
>>> --- /dev/null
>>> +++ b/drivers/phy/phy-exynos-ufs.c
>>> @@ -0,0 +1,241 @@
>>> +/*
>>> + * UFS PHY driver for Samsung EXYNOS SoC
>>> + *
>>> + * Copyright (C) 2015 Samsung Electronics Co., Ltd.
>>> + * Author: Seungwon Jeon 
>>> + *
>>> + * This program is free software; you can redistribute it and/or
>>> modify
>>> + * it under the terms of the GNU General Public License as 
>>> published
>>> by
>>> + * the Free Software Foundation; either version 2 of the License, 
>>> or
>>> + * (at your option) any later version.
>>> + */
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +#include 
>>> +
>>> +#include "phy-exynos-ufs.h"
>>> +
>>> +#define for_each_phy_lane(phy, i) \
>>> +