[PATCH V2 2/5] ARM: BCM5301X: Specify USB controllers in DT

[Rafał Miłecki]

From: Rafał Miłecki 

There are 3 separated controllers, one per USB /standard/. With PHY
drivers in place they can be simply supported with generic drivers.

Signed-off-by: Rafał Miłecki 
---
V2: Fix node names and reorder ehci with ohci. Thanks Ray!
---
 arch/arm/boot/dts/bcm5301x.dtsi | 33 -
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index f09a2bb..a4614c9 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -248,8 +248,26 @@
 
#address-cells = <1>;
#size-cells = <1>;
+   ranges;
 
-   phys = <_phy>;
+   interrupt-parent = <>;
+
+   ehci: ehci@21000 {
+   #usb-cells = <0>;
+
+   compatible = "generic-ehci";
+   reg = <0x00021000 0x1000>;
+   interrupts = ;
+   phys = <_phy>;
+   };
+
+   ohci: ohci@22000 {
+   #usb-cells = <0>;
+
+   compatible = "generic-ohci";
+   reg = <0x00022000 0x1000>;
+   interrupts = ;
+   };
};
 
usb3: usb3@23000 {
@@ -257,6 +275,19 @@
 
#address-cells = <1>;
#size-cells = <1>;
+   ranges;
+
+   interrupt-parent = <>;
+
+   xhci: xhci@23000 {
+   #usb-cells = <0>;
+
+   compatible = "generic-xhci";
+   reg = <0x00023000 0x1000>;
+   interrupts = ;
+   phys = <_phy>;
+   phy-names = "usb";
+   };
};
 
spi@29000 {
-- 
2.10.1

[PATCH V2 2/5] ARM: BCM5301X: Specify USB controllers in DT

[Rafał Miłecki]

From: Rafał Miłecki 

There are 3 separated controllers, one per USB /standard/. With PHY
drivers in place they can be simply supported with generic drivers.

Signed-off-by: Rafał Miłecki 
---
V2: Fix node names and reorder ehci with ohci. Thanks Ray!
---
 arch/arm/boot/dts/bcm5301x.dtsi | 33 -
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index f09a2bb..a4614c9 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -248,8 +248,26 @@
 
#address-cells = <1>;
#size-cells = <1>;
+   ranges;
 
-   phys = <_phy>;
+   interrupt-parent = <>;
+
+   ehci: ehci@21000 {
+   #usb-cells = <0>;
+
+   compatible = "generic-ehci";
+   reg = <0x00021000 0x1000>;
+   interrupts = ;
+   phys = <_phy>;
+   };
+
+   ohci: ohci@22000 {
+   #usb-cells = <0>;
+
+   compatible = "generic-ohci";
+   reg = <0x00022000 0x1000>;
+   interrupts = ;
+   };
};
 
usb3: usb3@23000 {
@@ -257,6 +275,19 @@
 
#address-cells = <1>;
#size-cells = <1>;
+   ranges;
+
+   interrupt-parent = <>;
+
+   xhci: xhci@23000 {
+   #usb-cells = <0>;
+
+   compatible = "generic-xhci";
+   reg = <0x00023000 0x1000>;
+   interrupts = ;
+   phys = <_phy>;
+   phy-names = "usb";
+   };
};
 
spi@29000 {
-- 
2.10.1

[PATCH V2 4/5] ARM: BCM5301X: Specify all RAM by including an extra block

[Rafał Miłecki]

From: Rafał Miłecki 

The first 128 MiB of RAM can be accessed using an alias at address 0x0.

In theory we could access whole RAM using 0x8000 - 0xbfff range
(up to 1 GiB) but it doesn't seem to work on Northstar. For some reason
(hardware setup left by the bootloader maybe?) 0x8000 - 0x87ff
range can't be used. I reproduced this problem on:
1) Buffalo WZR-600DHP2 (BCM47081)
2) Netgear R6250 (BCM4708)
3) D-Link DIR-885L (BCM47094)

So it seems we're forced to access first 128 MiB using alias at 0x0 and
the rest using real base address + 128 MiB offset which is 0x8800.

Signed-off-by: Rafał Miłecki 
---
V2: Updated commit message, thanks Jon!
Included XWR-3100
---
 arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts| 3 ++-
 arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts| 3 ++-
 arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts  | 3 ++-
 arch/arm/boot/dts/bcm4708-netgear-r6250.dts| 3 ++-
 arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts | 3 ++-
 arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts  | 3 ++-
 arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts| 3 ++-
 arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts | 3 ++-
 arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts  | 3 ++-
 arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts| 3 ++-
 arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts  | 3 ++-
 arch/arm/boot/dts/bcm4709-netgear-r7000.dts| 3 ++-
 arch/arm/boot/dts/bcm4709-netgear-r8000.dts| 3 ++-
 arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts  | 3 ++-
 arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts  | 3 ++-
 arch/arm/boot/dts/bcm47094-netgear-r8500.dts   | 3 ++-
 16 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts 
b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
index 112a5a8..d241cee 100644
--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
+++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts 
b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
index 3600f56..b0e6204 100644
--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
+++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts 
b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
index d49afec0..c9ba6b9 100644
--- a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
+++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x1800>;
};
 
spi {
diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts 
b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
index 8519548..b9f66c0 100644
--- a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
+++ b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts 
b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
index 6229ef2..ae0199f 100644
--- a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
+++ b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts 
b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
index 74cfcd3..36b628b1 100644
--- a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
+++ b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts 
b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
index 71b98cf..db8608b 100644
--- a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
+++ b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts 

[PATCH V2 1/5] ARM: BCM5301X: Fix LAN LED labels for Luxul XWR-3100

[Rafał Miłecki]

From: Rafał Miłecki 

They were named incorrectly most likely due to copy & paste mistake.

Signed-off-by: Rafał Miłecki 
---
 arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts 
b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
index 2f4a651..93cc91d 100644
--- a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
+++ b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
@@ -31,13 +31,13 @@
};
 
lan3{
-   label = "bcm53xx:green:lan1";
+   label = "bcm53xx:green:lan3";
gpios = < 1 GPIO_ACTIVE_LOW>;
linux,default-trigger = "default-off";
};
 
lan4{
-   label = "bcm53xx:green:lan0";
+   label = "bcm53xx:green:lan4";
gpios = < 2 GPIO_ACTIVE_LOW>;
linux,default-trigger = "default-off";
};
@@ -49,7 +49,7 @@
};
 
lan1{
-   label = "bcm53xx:green:lan3";
+   label = "bcm53xx:green:lan1";
gpios = < 4 GPIO_ACTIVE_LOW>;
linux,default-trigger = "default-off";
};
-- 
2.10.1

[PATCH V2 4/5] ARM: BCM5301X: Specify all RAM by including an extra block

[Rafał Miłecki]

From: Rafał Miłecki 

The first 128 MiB of RAM can be accessed using an alias at address 0x0.

In theory we could access whole RAM using 0x8000 - 0xbfff range
(up to 1 GiB) but it doesn't seem to work on Northstar. For some reason
(hardware setup left by the bootloader maybe?) 0x8000 - 0x87ff
range can't be used. I reproduced this problem on:
1) Buffalo WZR-600DHP2 (BCM47081)
2) Netgear R6250 (BCM4708)
3) D-Link DIR-885L (BCM47094)

So it seems we're forced to access first 128 MiB using alias at 0x0 and
the rest using real base address + 128 MiB offset which is 0x8800.

Signed-off-by: Rafał Miłecki 
---
V2: Updated commit message, thanks Jon!
Included XWR-3100
---
 arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts| 3 ++-
 arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts| 3 ++-
 arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts  | 3 ++-
 arch/arm/boot/dts/bcm4708-netgear-r6250.dts| 3 ++-
 arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts | 3 ++-
 arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts  | 3 ++-
 arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts| 3 ++-
 arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts | 3 ++-
 arch/arm/boot/dts/bcm47081-buffalo-wzr-900dhp.dts  | 3 ++-
 arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts| 3 ++-
 arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts  | 3 ++-
 arch/arm/boot/dts/bcm4709-netgear-r7000.dts| 3 ++-
 arch/arm/boot/dts/bcm4709-netgear-r8000.dts| 3 ++-
 arch/arm/boot/dts/bcm47094-dlink-dir-885l.dts  | 3 ++-
 arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts  | 3 ++-
 arch/arm/boot/dts/bcm47094-netgear-r8500.dts   | 3 ++-
 16 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts 
b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
index 112a5a8..d241cee 100644
--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
+++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts 
b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
index 3600f56..b0e6204 100644
--- a/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
+++ b/arch/arm/boot/dts/bcm4708-asus-rt-ac68u.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts 
b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
index d49afec0..c9ba6b9 100644
--- a/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
+++ b/arch/arm/boot/dts/bcm4708-buffalo-wzr-1750dhp.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x1800>;
};
 
spi {
diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts 
b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
index 8519548..b9f66c0 100644
--- a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
+++ b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts 
b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
index 6229ef2..ae0199f 100644
--- a/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
+++ b/arch/arm/boot/dts/bcm4708-netgear-r6300-v2.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts 
b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
index 74cfcd3..36b628b1 100644
--- a/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
+++ b/arch/arm/boot/dts/bcm4708-smartrg-sr400ac.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts 
b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
index 71b98cf..db8608b 100644
--- a/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
+++ b/arch/arm/boot/dts/bcm47081-asus-rt-n18u.dts
@@ -21,7 +21,8 @@
};
 
memory {
-   reg = <0x 0x0800>;
+   reg = <0x 0x0800
+  0x8800 0x0800>;
};
 
leds {
diff --git a/arch/arm/boot/dts/bcm47081-buffalo-wzr-600dhp2.dts 

[PATCH V2 1/5] ARM: BCM5301X: Fix LAN LED labels for Luxul XWR-3100

[Rafał Miłecki]

From: Rafał Miłecki 

They were named incorrectly most likely due to copy & paste mistake.

Signed-off-by: Rafał Miłecki 
---
 arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts 
b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
index 2f4a651..93cc91d 100644
--- a/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
+++ b/arch/arm/boot/dts/bcm47094-luxul-xwr-3100.dts
@@ -31,13 +31,13 @@
};
 
lan3{
-   label = "bcm53xx:green:lan1";
+   label = "bcm53xx:green:lan3";
gpios = < 1 GPIO_ACTIVE_LOW>;
linux,default-trigger = "default-off";
};
 
lan4{
-   label = "bcm53xx:green:lan0";
+   label = "bcm53xx:green:lan4";
gpios = < 2 GPIO_ACTIVE_LOW>;
linux,default-trigger = "default-off";
};
@@ -49,7 +49,7 @@
};
 
lan1{
-   label = "bcm53xx:green:lan3";
+   label = "bcm53xx:green:lan1";
gpios = < 4 GPIO_ACTIVE_LOW>;
linux,default-trigger = "default-off";
};
-- 
2.10.1

[PATCH V2 5/5] ARM: BCM53573: Specify USB ports of on-SoC controllers

[Rafał Miłecki]

From: Rafał Miłecki 

Broadcom OHCI and EHCI controllers always have 2 ports each on the root
hub. Describe them in DT to allow specifying extra info or referencing
port nodes.

Signed-off-by: Rafał Miłecki 
---
 arch/arm/boot/dts/bcm53573.dtsi | 22 ++
 1 file changed, 22 insertions(+)

diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index e2c496a..2da04d0 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -124,6 +124,17 @@
reg = <0x4000 0x1000>;
interrupt-parent = <>;
interrupts = ;
+
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   ehci_port1: port@1 {
+   reg = <1>;
+   };
+
+   ehci_port2: port@2 {
+   reg = <2>;
+   };
};
 
ohci: ohci@d000 {
@@ -133,6 +144,17 @@
reg = <0xd000 0x1000>;
interrupt-parent = <>;
interrupts = ;
+
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   ohci_port1: port@1 {
+   reg = <1>;
+   };
+
+   ohci_port2: port@2 {
+   reg = <2>;
+   };
};
};
 
-- 
2.10.1

[PATCH V2 5/5] ARM: BCM53573: Specify USB ports of on-SoC controllers

[Rafał Miłecki]

From: Rafał Miłecki 

Broadcom OHCI and EHCI controllers always have 2 ports each on the root
hub. Describe them in DT to allow specifying extra info or referencing
port nodes.

Signed-off-by: Rafał Miłecki 
---
 arch/arm/boot/dts/bcm53573.dtsi | 22 ++
 1 file changed, 22 insertions(+)

diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index e2c496a..2da04d0 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -124,6 +124,17 @@
reg = <0x4000 0x1000>;
interrupt-parent = <>;
interrupts = ;
+
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   ehci_port1: port@1 {
+   reg = <1>;
+   };
+
+   ehci_port2: port@2 {
+   reg = <2>;
+   };
};
 
ohci: ohci@d000 {
@@ -133,6 +144,17 @@
reg = <0xd000 0x1000>;
interrupt-parent = <>;
interrupts = ;
+
+   #address-cells = <1>;
+   #size-cells = <0>;
+
+   ohci_port1: port@1 {
+   reg = <1>;
+   };
+
+   ohci_port2: port@2 {
+   reg = <2>;
+   };
};
};
 
-- 
2.10.1

[PATCH V2 3/5] ARM: BCM5301X: Set GPIO enabling USB power on Netgear R7000

[Rafał Miłecki]

From: Rafał Miłecki 

There is one GPIO controlling power for both USB ports.

Signed-off-by: Rafał Miłecki 
---
V2: Avoid double Signed-off-by due to different e-mail address
---
 arch/arm/boot/dts/bcm4709-netgear-r7000.dts | 8 
 1 file changed, 8 insertions(+)

diff --git a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts 
b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
index 0225d82..7ab1176 100644
--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
+++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
@@ -100,3 +100,11 @@
};
};
 };
+
+ {
+   vcc-gpio = < 0 GPIO_ACTIVE_HIGH>;
+};
+
+ {
+   vcc-gpio = < 0 GPIO_ACTIVE_HIGH>;
+};
-- 
2.10.1

[PATCH V2 3/5] ARM: BCM5301X: Set GPIO enabling USB power on Netgear R7000

[Rafał Miłecki]

From: Rafał Miłecki 

There is one GPIO controlling power for both USB ports.

Signed-off-by: Rafał Miłecki 
---
V2: Avoid double Signed-off-by due to different e-mail address
---
 arch/arm/boot/dts/bcm4709-netgear-r7000.dts | 8 
 1 file changed, 8 insertions(+)

diff --git a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts 
b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
index 0225d82..7ab1176 100644
--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
+++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
@@ -100,3 +100,11 @@
};
};
 };
+
+ {
+   vcc-gpio = < 0 GPIO_ACTIVE_HIGH>;
+};
+
+ {
+   vcc-gpio = < 0 GPIO_ACTIVE_HIGH>;
+};
-- 
2.10.1

Re: [PATCH V4 00/11] megaraid_sas: Updates for scsi-next

[Christoph Hellwig]

This seems to be missing the pci_alloc_irq_vectors conversion from
Hannes?

Re: [PATCH V4 00/11] megaraid_sas: Updates for scsi-next

[Christoph Hellwig]

This seems to be missing the pci_alloc_irq_vectors conversion from
Hannes?

[PATCH v4 3/3] powerpc/8xx: Implement support of hugepages

[Christophe Leroy]

8xx uses a two level page table with two different linux page size
support (4k and 16k). 8xx also support two different hugepage sizes
512k and 8M. In order to support them on linux we define two different
page table layout.

The size of pages is in the PGD entry, using PS field (bits 28-29):
00 : Small pages (4k or 16k)
01 : 512k pages
10 : reserved
11 : 8M pages

For 512K hugepage size a pgd entry have the below format
[0101] . The hugepte table allocated will contain 8
entries pointing to 512K huge pte in 4k pages mode and 64 entries in
16k pages mode.

For 8M in 16k mode, a pgd entry have the below format
[1101] . The hugepte table allocated will contain 8
entries pointing to 8M huge pte.

For 8M in 4k mode, multiple pgd entries point to the same hugepte
address and pgd entry will have the below format
[1101]. The hugepte table allocated will only have one
entry.

For the time being, we do not support CPU15 ERRATA when HUGETLB is
selected

Signed-off-by: Christophe Leroy 
Reviewed-by: Aneesh Kumar K.V  (v3, for the 
generic bits)
---
v2: This v1 was split in two parts. This part focuses on adding the
support on 8xx. It also fixes an error in TLBmiss handlers in the
case of 8M hugepages in 16k pages mode.

v3: No change

v4: No change

 arch/powerpc/include/asm/hugetlb.h   |  19 -
 arch/powerpc/include/asm/mmu-8xx.h   |  35 
 arch/powerpc/include/asm/mmu.h   |  23 +++---
 arch/powerpc/include/asm/nohash/32/pte-8xx.h |   1 +
 arch/powerpc/include/asm/nohash/pgtable.h|   4 +
 arch/powerpc/include/asm/reg_8xx.h   |   2 +-
 arch/powerpc/kernel/head_8xx.S   | 119 +--
 arch/powerpc/mm/hugetlbpage.c|  29 ---
 arch/powerpc/mm/tlb_nohash.c |  21 -
 arch/powerpc/platforms/8xx/Kconfig   |   1 +
 arch/powerpc/platforms/Kconfig.cputype   |   1 +
 11 files changed, 225 insertions(+), 30 deletions(-)

diff --git a/arch/powerpc/include/asm/hugetlb.h 
b/arch/powerpc/include/asm/hugetlb.h
index c03e0a3..ede2151 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -51,12 +51,20 @@ static inline void __local_flush_hugetlb_page(struct 
vm_area_struct *vma,
 static inline pte_t *hugepd_page(hugepd_t hpd)
 {
BUG_ON(!hugepd_ok(hpd));
+#ifdef CONFIG_PPC_8xx
+   return (pte_t *)__va(hpd.pd & ~(_PMD_PAGE_MASK | _PMD_PRESENT_MASK));
+#else
return (pte_t *)((hpd.pd & ~HUGEPD_SHIFT_MASK) | PD_HUGE);
+#endif
 }
 
 static inline unsigned int hugepd_shift(hugepd_t hpd)
 {
+#ifdef CONFIG_PPC_8xx
+   return ((hpd.pd & _PMD_PAGE_MASK) >> 1) + 17;
+#else
return hpd.pd & HUGEPD_SHIFT_MASK;
+#endif
 }
 
 #endif /* CONFIG_PPC_BOOK3S_64 */
@@ -99,7 +107,15 @@ static inline int is_hugepage_only_range(struct mm_struct 
*mm,
 
 void book3e_hugetlb_preload(struct vm_area_struct *vma, unsigned long ea,
pte_t pte);
+#ifdef CONFIG_PPC_8xx
+static inline void flush_hugetlb_page(struct vm_area_struct *vma,
+ unsigned long vmaddr)
+{
+   flush_tlb_page(vma, vmaddr);
+}
+#else
 void flush_hugetlb_page(struct vm_area_struct *vma, unsigned long vmaddr);
+#endif
 
 void hugetlb_free_pgd_range(struct mmu_gather *tlb, unsigned long addr,
unsigned long end, unsigned long floor,
@@ -205,7 +221,8 @@ static inline pte_t *hugepte_offset(hugepd_t hpd, unsigned 
long addr,
  * are reserved early in the boot process by memblock instead of via
  * the .dts as on IBM platforms.
  */
-#if defined(CONFIG_HUGETLB_PAGE) && defined(CONFIG_PPC_FSL_BOOK3E)
+#if defined(CONFIG_HUGETLB_PAGE) && (defined(CONFIG_PPC_FSL_BOOK3E) || \
+defined(CONFIG_PPC_8xx))
 extern void __init reserve_hugetlb_gpages(void);
 #else
 static inline void reserve_hugetlb_gpages(void)
diff --git a/arch/powerpc/include/asm/mmu-8xx.h 
b/arch/powerpc/include/asm/mmu-8xx.h
index 3e0e492..798b5bf 100644
--- a/arch/powerpc/include/asm/mmu-8xx.h
+++ b/arch/powerpc/include/asm/mmu-8xx.h
@@ -172,6 +172,41 @@ typedef struct {
 
 #define PHYS_IMMR_BASE (mfspr(SPRN_IMMR) & 0xfff8)
 #define VIRT_IMMR_BASE (__fix_to_virt(FIX_IMMR_BASE))
+
+/* Page size definitions, common between 32 and 64-bit
+ *
+ *shift : is the "PAGE_SHIFT" value for that page size
+ *penc  : is the pte encoding mask
+ *
+ */
+struct mmu_psize_def {
+   unsigned intshift;  /* number of bits */
+   unsigned intenc;/* PTE encoding */
+   unsigned intind;/* Corresponding indirect page size shift */
+   unsigned intflags;
+#define MMU_PAGE_SIZE_DIRECT   0x1 /* Supported as a direct size */
+#define MMU_PAGE_SIZE_INDIRECT 0x2 /* Supported as an indirect size */
+};
+
+extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
+
+static inline int shift_to_mmu_psize(unsigned int shift)
+{
+   int psize;
+
+   for (psize 

[PATCH v4 3/3] powerpc/8xx: Implement support of hugepages

[Christophe Leroy]

8xx uses a two level page table with two different linux page size
support (4k and 16k). 8xx also support two different hugepage sizes
512k and 8M. In order to support them on linux we define two different
page table layout.

The size of pages is in the PGD entry, using PS field (bits 28-29):
00 : Small pages (4k or 16k)
01 : 512k pages
10 : reserved
11 : 8M pages

For 512K hugepage size a pgd entry have the below format
[0101] . The hugepte table allocated will contain 8
entries pointing to 512K huge pte in 4k pages mode and 64 entries in
16k pages mode.

For 8M in 16k mode, a pgd entry have the below format
[1101] . The hugepte table allocated will contain 8
entries pointing to 8M huge pte.

For 8M in 4k mode, multiple pgd entries point to the same hugepte
address and pgd entry will have the below format
[1101]. The hugepte table allocated will only have one
entry.

For the time being, we do not support CPU15 ERRATA when HUGETLB is
selected

Signed-off-by: Christophe Leroy 
Reviewed-by: Aneesh Kumar K.V  (v3, for the 
generic bits)
---
v2: This v1 was split in two parts. This part focuses on adding the
support on 8xx. It also fixes an error in TLBmiss handlers in the
case of 8M hugepages in 16k pages mode.

v3: No change

v4: No change

 arch/powerpc/include/asm/hugetlb.h   |  19 -
 arch/powerpc/include/asm/mmu-8xx.h   |  35 
 arch/powerpc/include/asm/mmu.h   |  23 +++---
 arch/powerpc/include/asm/nohash/32/pte-8xx.h |   1 +
 arch/powerpc/include/asm/nohash/pgtable.h|   4 +
 arch/powerpc/include/asm/reg_8xx.h   |   2 +-
 arch/powerpc/kernel/head_8xx.S   | 119 +--
 arch/powerpc/mm/hugetlbpage.c|  29 ---
 arch/powerpc/mm/tlb_nohash.c |  21 -
 arch/powerpc/platforms/8xx/Kconfig   |   1 +
 arch/powerpc/platforms/Kconfig.cputype   |   1 +
 11 files changed, 225 insertions(+), 30 deletions(-)

diff --git a/arch/powerpc/include/asm/hugetlb.h 
b/arch/powerpc/include/asm/hugetlb.h
index c03e0a3..ede2151 100644
--- a/arch/powerpc/include/asm/hugetlb.h
+++ b/arch/powerpc/include/asm/hugetlb.h
@@ -51,12 +51,20 @@ static inline void __local_flush_hugetlb_page(struct 
vm_area_struct *vma,
 static inline pte_t *hugepd_page(hugepd_t hpd)
 {
BUG_ON(!hugepd_ok(hpd));
+#ifdef CONFIG_PPC_8xx
+   return (pte_t *)__va(hpd.pd & ~(_PMD_PAGE_MASK | _PMD_PRESENT_MASK));
+#else
return (pte_t *)((hpd.pd & ~HUGEPD_SHIFT_MASK) | PD_HUGE);
+#endif
 }
 
 static inline unsigned int hugepd_shift(hugepd_t hpd)
 {
+#ifdef CONFIG_PPC_8xx
+   return ((hpd.pd & _PMD_PAGE_MASK) >> 1) + 17;
+#else
return hpd.pd & HUGEPD_SHIFT_MASK;
+#endif
 }
 
 #endif /* CONFIG_PPC_BOOK3S_64 */
@@ -99,7 +107,15 @@ static inline int is_hugepage_only_range(struct mm_struct 
*mm,
 
 void book3e_hugetlb_preload(struct vm_area_struct *vma, unsigned long ea,
pte_t pte);
+#ifdef CONFIG_PPC_8xx
+static inline void flush_hugetlb_page(struct vm_area_struct *vma,
+ unsigned long vmaddr)
+{
+   flush_tlb_page(vma, vmaddr);
+}
+#else
 void flush_hugetlb_page(struct vm_area_struct *vma, unsigned long vmaddr);
+#endif
 
 void hugetlb_free_pgd_range(struct mmu_gather *tlb, unsigned long addr,
unsigned long end, unsigned long floor,
@@ -205,7 +221,8 @@ static inline pte_t *hugepte_offset(hugepd_t hpd, unsigned 
long addr,
  * are reserved early in the boot process by memblock instead of via
  * the .dts as on IBM platforms.
  */
-#if defined(CONFIG_HUGETLB_PAGE) && defined(CONFIG_PPC_FSL_BOOK3E)
+#if defined(CONFIG_HUGETLB_PAGE) && (defined(CONFIG_PPC_FSL_BOOK3E) || \
+defined(CONFIG_PPC_8xx))
 extern void __init reserve_hugetlb_gpages(void);
 #else
 static inline void reserve_hugetlb_gpages(void)
diff --git a/arch/powerpc/include/asm/mmu-8xx.h 
b/arch/powerpc/include/asm/mmu-8xx.h
index 3e0e492..798b5bf 100644
--- a/arch/powerpc/include/asm/mmu-8xx.h
+++ b/arch/powerpc/include/asm/mmu-8xx.h
@@ -172,6 +172,41 @@ typedef struct {
 
 #define PHYS_IMMR_BASE (mfspr(SPRN_IMMR) & 0xfff8)
 #define VIRT_IMMR_BASE (__fix_to_virt(FIX_IMMR_BASE))
+
+/* Page size definitions, common between 32 and 64-bit
+ *
+ *shift : is the "PAGE_SHIFT" value for that page size
+ *penc  : is the pte encoding mask
+ *
+ */
+struct mmu_psize_def {
+   unsigned intshift;  /* number of bits */
+   unsigned intenc;/* PTE encoding */
+   unsigned intind;/* Corresponding indirect page size shift */
+   unsigned intflags;
+#define MMU_PAGE_SIZE_DIRECT   0x1 /* Supported as a direct size */
+#define MMU_PAGE_SIZE_INDIRECT 0x2 /* Supported as an indirect size */
+};
+
+extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
+
+static inline int shift_to_mmu_psize(unsigned int shift)
+{
+   int psize;
+
+   for (psize = 0; psize < MMU_PAGE_COUNT; ++psize)
+   if 

[PATCH v4 0/3] powerpc: implementation of huge pages for 8xx

[Christophe Leroy]

This is v4 of patch serie is the implementation of support of
hugepages for the 8xx.

v2: the last patch has been split in two parts.
v3: Taking into account comments from aneesh
v4: Fixing pdshift calculation on FSL_BOOK3E in hugetlbpage_init()
Fixing default hugepage size selection on FSL_BOOK3E



Christophe Leroy (3):
  powerpc: port 64 bits pgtable_cache to 32 bits
  powerpc: get hugetlbpage handling more generic
  powerpc/8xx: Implement support of hugepages

 arch/powerpc/include/asm/book3s/32/pgalloc.h |  44 +-
 arch/powerpc/include/asm/book3s/32/pgtable.h |  40 ++---
 arch/powerpc/include/asm/book3s/64/pgtable.h |   3 -
 arch/powerpc/include/asm/hugetlb.h   |  19 ++-
 arch/powerpc/include/asm/mmu-8xx.h   |  35 +
 arch/powerpc/include/asm/mmu.h   |  23 +--
 arch/powerpc/include/asm/nohash/32/pgalloc.h |  44 +-
 arch/powerpc/include/asm/nohash/32/pgtable.h |  42 +++---
 arch/powerpc/include/asm/nohash/32/pte-8xx.h |   1 +
 arch/powerpc/include/asm/nohash/64/pgtable.h |   2 -
 arch/powerpc/include/asm/nohash/pgtable.h|   4 +
 arch/powerpc/include/asm/pgtable.h   |   2 +
 arch/powerpc/include/asm/reg_8xx.h   |   2 +-
 arch/powerpc/kernel/head_8xx.S   | 119 ++-
 arch/powerpc/mm/Makefile |   3 +-
 arch/powerpc/mm/hugetlbpage.c| 216 ---
 arch/powerpc/mm/init-common.c| 107 +
 arch/powerpc/mm/init_64.c|  77 --
 arch/powerpc/mm/pgtable_32.c |  37 -
 arch/powerpc/mm/tlb_nohash.c |  21 ++-
 arch/powerpc/platforms/8xx/Kconfig   |   1 +
 arch/powerpc/platforms/Kconfig.cputype   |   1 +
 22 files changed, 529 insertions(+), 314 deletions(-)
 create mode 100644 arch/powerpc/mm/init-common.c

-- 
2.10.1

[PATCH v4 1/3] powerpc: port 64 bits pgtable_cache to 32 bits

[Christophe Leroy]

Today powerpc64 uses a set of pgtable_caches while powerpc32 uses
standard pages when using 4k pages and a single pgtable_cache
if using other size pages.

In preparation of implementing huge pages on the 8xx, this patch
replaces the specific powerpc32 handling by the 64 bits approach.

This is done by:
* moving 64 bits pgtable_cache_add() and pgtable_cache_init()
in a new file called init-common.c
* modifying pgtable_cache_init() to also handle the case
without PMD
* removing the 32 bits version of pgtable_cache_add() and
pgtable_cache_init()
* copying related header contents from 64 bits into both the
book3s/32 and nohash/32 header files

On the 8xx, the following cache sizes will be used:
* 4k pages mode:
- PGT_CACHE(10) for PGD
- PGT_CACHE(3) for 512k hugepage tables
* 16k pages mode:
- PGT_CACHE(6) for PGD
- PGT_CACHE(7) for 512k hugepage tables
- PGT_CACHE(3) for 8M hugepage tables

Signed-off-by: Christophe Leroy 
Reviewed-by: Aneesh Kumar K.V 
---
v2: in v1, hugepte_cache was wrongly replaced by PGT_CACHE(1).
This modification has been removed from v2.

v3:
- Not adding anymore MIN_HUGEPTE_SHIFT to 32 bits headers as
this constant was last used on kernel 2.6.32.
- Fixed PMD_TABLE_SIZE and PUD_TABLE_SIZE
- Removed unneccessary includes from init-common.c

v4: No change

 arch/powerpc/include/asm/book3s/32/pgalloc.h |  44 +--
 arch/powerpc/include/asm/book3s/32/pgtable.h |  40 +-
 arch/powerpc/include/asm/book3s/64/pgtable.h |   3 -
 arch/powerpc/include/asm/nohash/32/pgalloc.h |  44 +--
 arch/powerpc/include/asm/nohash/32/pgtable.h |  42 +--
 arch/powerpc/include/asm/nohash/64/pgtable.h |   2 -
 arch/powerpc/include/asm/pgtable.h   |   2 +
 arch/powerpc/mm/Makefile |   3 +-
 arch/powerpc/mm/init-common.c| 107 +++
 arch/powerpc/mm/init_64.c|  77 ---
 arch/powerpc/mm/pgtable_32.c |  37 -
 11 files changed, 227 insertions(+), 174 deletions(-)
 create mode 100644 arch/powerpc/mm/init-common.c

diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h 
b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index 8e21bb4..d310546 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -2,14 +2,42 @@
 #define _ASM_POWERPC_BOOK3S_32_PGALLOC_H
 
 #include 
+#include 
 
-/* For 32-bit, all levels of page tables are just drawn from get_free_page() */
-#define MAX_PGTABLE_INDEX_SIZE 0
+/*
+ * Functions that deal with pagetables that could be at any level of
+ * the table need to be passed an "index_size" so they know how to
+ * handle allocation.  For PTE pages (which are linked to a struct
+ * page for now, and drawn from the main get_free_pages() pool), the
+ * allocation size will be (2^index_size * sizeof(pointer)) and
+ * allocations are drawn from the kmem_cache in PGT_CACHE(index_size).
+ *
+ * The maximum index size needs to be big enough to allow any
+ * pagetable sizes we need, but small enough to fit in the low bits of
+ * any page table pointer.  In other words all pagetables, even tiny
+ * ones, must be aligned to allow at least enough low 0 bits to
+ * contain this value.  This value is also used as a mask, so it must
+ * be one less than a power of two.
+ */
+#define MAX_PGTABLE_INDEX_SIZE 0xf
 
 extern void __bad_pte(pmd_t *pmd);
 
-extern pgd_t *pgd_alloc(struct mm_struct *mm);
-extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+extern struct kmem_cache *pgtable_cache[];
+#define PGT_CACHE(shift) ({\
+   BUG_ON(!(shift));   \
+   pgtable_cache[(shift) - 1]; \
+   })
+
+static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+{
+   return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), GFP_KERNEL);
+}
+
+static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+   kmem_cache_free(PGT_CACHE(PGD_INDEX_SIZE), pgd);
+}
 
 /*
  * We don't have any real pmd's, and this code never triggers because
@@ -68,8 +96,12 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t 
ptepage)
 
 static inline void pgtable_free(void *table, unsigned index_size)
 {
-   BUG_ON(index_size); /* 32-bit doesn't use this */
-   free_page((unsigned long)table);
+   if (!index_size) {
+   free_page((unsigned long)table);
+   } else {
+   BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
+   kmem_cache_free(PGT_CACHE(index_size), table);
+   }
 }
 
 #define check_pgt_cache()  do { } while (0)
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h 
b/arch/powerpc/include/asm/book3s/32/pgtable.h
index dc58980..0122236 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -8,6 +8,23 @@
 /* And here we include common definitions */
 

[PATCH v4 2/3] powerpc: get hugetlbpage handling more generic

[Christophe Leroy]

Today there are two implementations of hugetlbpages which are managed
by exclusive #ifdefs:
* FSL_BOOKE: several directory entries points to the same single hugepage
* BOOK3S: one upper level directory entry points to a table of hugepages

In preparation of implementation of hugepage support on the 8xx, we
need a mix of the two above solutions, because the 8xx needs both cases
depending on the size of pages:
* In 4k page size mode, each PGD entry covers a 4M bytes area. It means
that 2 PGD entries will be necessary to cover an 8M hugepage while a
single PGD entry will cover 8x 512k hugepages.
* In 16 page size mode, each PGD entry covers a 64M bytes area. It means
that 8x 8M hugepages will be covered by one PGD entry and 64x 512k
hugepages will be covers by one PGD entry.

This patch:
* removes #ifdefs in favor of if/else based on the range sizes
* merges the two huge_pte_alloc() functions as they are pretty similar
* merges the two hugetlbpage_init() functions as they are pretty similar

Signed-off-by: Christophe Leroy 
Reviewed-by: Aneesh Kumar K.V  (v3)
---
v2: This part is new and results from a split of last patch of v1 serie in
two parts

v3:
- Only allocate hugepte_cache on FSL_BOOKE. Not needed on BOOK3S_64
- Removed the BUG in the unused hugepd_free(), made it
static inline {} instead.

v4:
- Fixing pdshift calculation on FSL_BOOK3E in hugetlbpage_init() by 
   using HUGEPD_PxD_SHIFT instead of PyD_SHIFT.
- Fixing default hugepage size selection on FSL_BOOK3E by spliting decision
   based on #ifdefs in order to keep previous behaviour.

 arch/powerpc/mm/hugetlbpage.c | 195 ++
 1 file changed, 81 insertions(+), 114 deletions(-)

diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index a5d3ecd..53245aa 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -64,14 +64,16 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
 {
struct kmem_cache *cachep;
pte_t *new;
-
-#ifdef CONFIG_PPC_FSL_BOOK3E
int i;
-   int num_hugepd = 1 << (pshift - pdshift);
-   cachep = hugepte_cache;
-#else
-   cachep = PGT_CACHE(pdshift - pshift);
-#endif
+   int num_hugepd;
+
+   if (pshift >= pdshift) {
+   cachep = hugepte_cache;
+   num_hugepd = 1 << (pshift - pdshift);
+   } else {
+   cachep = PGT_CACHE(pdshift - pshift);
+   num_hugepd = 1;
+   }
 
new = kmem_cache_zalloc(cachep, GFP_KERNEL);
 
@@ -89,7 +91,7 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
smp_wmb();
 
spin_lock(>page_table_lock);
-#ifdef CONFIG_PPC_FSL_BOOK3E
+
/*
 * We have multiple higher-level entries that point to the same
 * actual pte location.  Fill in each as we go and backtrack on error.
@@ -100,8 +102,13 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
if (unlikely(!hugepd_none(*hpdp)))
break;
else
+#ifdef CONFIG_PPC_BOOK3S_64
+   hpdp->pd = __pa(new) |
+  (shift_to_mmu_psize(pshift) << 2);
+#else
/* We use the old format for PPC_FSL_BOOK3E */
hpdp->pd = ((unsigned long)new & ~PD_HUGE) | pshift;
+#endif
}
/* If we bailed from the for loop early, an error occurred, clean up */
if (i < num_hugepd) {
@@ -109,17 +116,6 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
hpdp->pd = 0;
kmem_cache_free(cachep, new);
}
-#else
-   if (!hugepd_none(*hpdp))
-   kmem_cache_free(cachep, new);
-   else {
-#ifdef CONFIG_PPC_BOOK3S_64
-   hpdp->pd = __pa(new) | (shift_to_mmu_psize(pshift) << 2);
-#else
-   hpdp->pd = ((unsigned long)new & ~PD_HUGE) | pshift;
-#endif
-   }
-#endif
spin_unlock(>page_table_lock);
return 0;
 }
@@ -136,7 +132,6 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
 #define HUGEPD_PUD_SHIFT PMD_SHIFT
 #endif
 
-#ifdef CONFIG_PPC_BOOK3S_64
 /*
  * At this point we do the placement change only for BOOK3S 64. This would
  * possibly work on other subarchs.
@@ -153,6 +148,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long 
addr, unsigned long sz
addr &= ~(sz-1);
pg = pgd_offset(mm, addr);
 
+#ifdef CONFIG_PPC_BOOK3S_64
if (pshift == PGDIR_SHIFT)
/* 16GB huge page */
return (pte_t *) pg;
@@ -178,32 +174,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long 
addr, unsigned long sz
hpdp = (hugepd_t *)pm;
}
}
-   if (!hpdp)
-   return NULL;
-
-   BUG_ON(!hugepd_none(*hpdp) && !hugepd_ok(*hpdp));
-
-   if 

[PATCH v4 1/3] powerpc: port 64 bits pgtable_cache to 32 bits

[Christophe Leroy]

Today powerpc64 uses a set of pgtable_caches while powerpc32 uses
standard pages when using 4k pages and a single pgtable_cache
if using other size pages.

In preparation of implementing huge pages on the 8xx, this patch
replaces the specific powerpc32 handling by the 64 bits approach.

This is done by:
* moving 64 bits pgtable_cache_add() and pgtable_cache_init()
in a new file called init-common.c
* modifying pgtable_cache_init() to also handle the case
without PMD
* removing the 32 bits version of pgtable_cache_add() and
pgtable_cache_init()
* copying related header contents from 64 bits into both the
book3s/32 and nohash/32 header files

On the 8xx, the following cache sizes will be used:
* 4k pages mode:
- PGT_CACHE(10) for PGD
- PGT_CACHE(3) for 512k hugepage tables
* 16k pages mode:
- PGT_CACHE(6) for PGD
- PGT_CACHE(7) for 512k hugepage tables
- PGT_CACHE(3) for 8M hugepage tables

Signed-off-by: Christophe Leroy 
Reviewed-by: Aneesh Kumar K.V 
---
v2: in v1, hugepte_cache was wrongly replaced by PGT_CACHE(1).
This modification has been removed from v2.

v3:
- Not adding anymore MIN_HUGEPTE_SHIFT to 32 bits headers as
this constant was last used on kernel 2.6.32.
- Fixed PMD_TABLE_SIZE and PUD_TABLE_SIZE
- Removed unneccessary includes from init-common.c

v4: No change

 arch/powerpc/include/asm/book3s/32/pgalloc.h |  44 +--
 arch/powerpc/include/asm/book3s/32/pgtable.h |  40 +-
 arch/powerpc/include/asm/book3s/64/pgtable.h |   3 -
 arch/powerpc/include/asm/nohash/32/pgalloc.h |  44 +--
 arch/powerpc/include/asm/nohash/32/pgtable.h |  42 +--
 arch/powerpc/include/asm/nohash/64/pgtable.h |   2 -
 arch/powerpc/include/asm/pgtable.h   |   2 +
 arch/powerpc/mm/Makefile |   3 +-
 arch/powerpc/mm/init-common.c| 107 +++
 arch/powerpc/mm/init_64.c|  77 ---
 arch/powerpc/mm/pgtable_32.c |  37 -
 11 files changed, 227 insertions(+), 174 deletions(-)
 create mode 100644 arch/powerpc/mm/init-common.c

diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h 
b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index 8e21bb4..d310546 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -2,14 +2,42 @@
 #define _ASM_POWERPC_BOOK3S_32_PGALLOC_H
 
 #include 
+#include 
 
-/* For 32-bit, all levels of page tables are just drawn from get_free_page() */
-#define MAX_PGTABLE_INDEX_SIZE 0
+/*
+ * Functions that deal with pagetables that could be at any level of
+ * the table need to be passed an "index_size" so they know how to
+ * handle allocation.  For PTE pages (which are linked to a struct
+ * page for now, and drawn from the main get_free_pages() pool), the
+ * allocation size will be (2^index_size * sizeof(pointer)) and
+ * allocations are drawn from the kmem_cache in PGT_CACHE(index_size).
+ *
+ * The maximum index size needs to be big enough to allow any
+ * pagetable sizes we need, but small enough to fit in the low bits of
+ * any page table pointer.  In other words all pagetables, even tiny
+ * ones, must be aligned to allow at least enough low 0 bits to
+ * contain this value.  This value is also used as a mask, so it must
+ * be one less than a power of two.
+ */
+#define MAX_PGTABLE_INDEX_SIZE 0xf
 
 extern void __bad_pte(pmd_t *pmd);
 
-extern pgd_t *pgd_alloc(struct mm_struct *mm);
-extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+extern struct kmem_cache *pgtable_cache[];
+#define PGT_CACHE(shift) ({\
+   BUG_ON(!(shift));   \
+   pgtable_cache[(shift) - 1]; \
+   })
+
+static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+{
+   return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), GFP_KERNEL);
+}
+
+static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+   kmem_cache_free(PGT_CACHE(PGD_INDEX_SIZE), pgd);
+}
 
 /*
  * We don't have any real pmd's, and this code never triggers because
@@ -68,8 +96,12 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t 
ptepage)
 
 static inline void pgtable_free(void *table, unsigned index_size)
 {
-   BUG_ON(index_size); /* 32-bit doesn't use this */
-   free_page((unsigned long)table);
+   if (!index_size) {
+   free_page((unsigned long)table);
+   } else {
+   BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
+   kmem_cache_free(PGT_CACHE(index_size), table);
+   }
 }
 
 #define check_pgt_cache()  do { } while (0)
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h 
b/arch/powerpc/include/asm/book3s/32/pgtable.h
index dc58980..0122236 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -8,6 +8,23 @@
 /* And here we include common definitions */
 #include 
 
+#define PTE_INDEX_SIZE PTE_SHIFT
+#define 

[PATCH v4 2/3] powerpc: get hugetlbpage handling more generic

[Christophe Leroy]

Today there are two implementations of hugetlbpages which are managed
by exclusive #ifdefs:
* FSL_BOOKE: several directory entries points to the same single hugepage
* BOOK3S: one upper level directory entry points to a table of hugepages

In preparation of implementation of hugepage support on the 8xx, we
need a mix of the two above solutions, because the 8xx needs both cases
depending on the size of pages:
* In 4k page size mode, each PGD entry covers a 4M bytes area. It means
that 2 PGD entries will be necessary to cover an 8M hugepage while a
single PGD entry will cover 8x 512k hugepages.
* In 16 page size mode, each PGD entry covers a 64M bytes area. It means
that 8x 8M hugepages will be covered by one PGD entry and 64x 512k
hugepages will be covers by one PGD entry.

This patch:
* removes #ifdefs in favor of if/else based on the range sizes
* merges the two huge_pte_alloc() functions as they are pretty similar
* merges the two hugetlbpage_init() functions as they are pretty similar

Signed-off-by: Christophe Leroy 
Reviewed-by: Aneesh Kumar K.V  (v3)
---
v2: This part is new and results from a split of last patch of v1 serie in
two parts

v3:
- Only allocate hugepte_cache on FSL_BOOKE. Not needed on BOOK3S_64
- Removed the BUG in the unused hugepd_free(), made it
static inline {} instead.

v4:
- Fixing pdshift calculation on FSL_BOOK3E in hugetlbpage_init() by 
   using HUGEPD_PxD_SHIFT instead of PyD_SHIFT.
- Fixing default hugepage size selection on FSL_BOOK3E by spliting decision
   based on #ifdefs in order to keep previous behaviour.

 arch/powerpc/mm/hugetlbpage.c | 195 ++
 1 file changed, 81 insertions(+), 114 deletions(-)

diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index a5d3ecd..53245aa 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -64,14 +64,16 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
 {
struct kmem_cache *cachep;
pte_t *new;
-
-#ifdef CONFIG_PPC_FSL_BOOK3E
int i;
-   int num_hugepd = 1 << (pshift - pdshift);
-   cachep = hugepte_cache;
-#else
-   cachep = PGT_CACHE(pdshift - pshift);
-#endif
+   int num_hugepd;
+
+   if (pshift >= pdshift) {
+   cachep = hugepte_cache;
+   num_hugepd = 1 << (pshift - pdshift);
+   } else {
+   cachep = PGT_CACHE(pdshift - pshift);
+   num_hugepd = 1;
+   }
 
new = kmem_cache_zalloc(cachep, GFP_KERNEL);
 
@@ -89,7 +91,7 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
smp_wmb();
 
spin_lock(>page_table_lock);
-#ifdef CONFIG_PPC_FSL_BOOK3E
+
/*
 * We have multiple higher-level entries that point to the same
 * actual pte location.  Fill in each as we go and backtrack on error.
@@ -100,8 +102,13 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
if (unlikely(!hugepd_none(*hpdp)))
break;
else
+#ifdef CONFIG_PPC_BOOK3S_64
+   hpdp->pd = __pa(new) |
+  (shift_to_mmu_psize(pshift) << 2);
+#else
/* We use the old format for PPC_FSL_BOOK3E */
hpdp->pd = ((unsigned long)new & ~PD_HUGE) | pshift;
+#endif
}
/* If we bailed from the for loop early, an error occurred, clean up */
if (i < num_hugepd) {
@@ -109,17 +116,6 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
hpdp->pd = 0;
kmem_cache_free(cachep, new);
}
-#else
-   if (!hugepd_none(*hpdp))
-   kmem_cache_free(cachep, new);
-   else {
-#ifdef CONFIG_PPC_BOOK3S_64
-   hpdp->pd = __pa(new) | (shift_to_mmu_psize(pshift) << 2);
-#else
-   hpdp->pd = ((unsigned long)new & ~PD_HUGE) | pshift;
-#endif
-   }
-#endif
spin_unlock(>page_table_lock);
return 0;
 }
@@ -136,7 +132,6 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t 
*hpdp,
 #define HUGEPD_PUD_SHIFT PMD_SHIFT
 #endif
 
-#ifdef CONFIG_PPC_BOOK3S_64
 /*
  * At this point we do the placement change only for BOOK3S 64. This would
  * possibly work on other subarchs.
@@ -153,6 +148,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long 
addr, unsigned long sz
addr &= ~(sz-1);
pg = pgd_offset(mm, addr);
 
+#ifdef CONFIG_PPC_BOOK3S_64
if (pshift == PGDIR_SHIFT)
/* 16GB huge page */
return (pte_t *) pg;
@@ -178,32 +174,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long 
addr, unsigned long sz
hpdp = (hugepd_t *)pm;
}
}
-   if (!hpdp)
-   return NULL;
-
-   BUG_ON(!hugepd_none(*hpdp) && !hugepd_ok(*hpdp));
-
-   if (hugepd_none(*hpdp) && __hugepte_alloc(mm, hpdp, addr, pdshift, 

[PATCH v4 0/3] powerpc: implementation of huge pages for 8xx

[Christophe Leroy]

This is v4 of patch serie is the implementation of support of
hugepages for the 8xx.

v2: the last patch has been split in two parts.
v3: Taking into account comments from aneesh
v4: Fixing pdshift calculation on FSL_BOOK3E in hugetlbpage_init()
Fixing default hugepage size selection on FSL_BOOK3E



Christophe Leroy (3):
  powerpc: port 64 bits pgtable_cache to 32 bits
  powerpc: get hugetlbpage handling more generic
  powerpc/8xx: Implement support of hugepages

 arch/powerpc/include/asm/book3s/32/pgalloc.h |  44 +-
 arch/powerpc/include/asm/book3s/32/pgtable.h |  40 ++---
 arch/powerpc/include/asm/book3s/64/pgtable.h |   3 -
 arch/powerpc/include/asm/hugetlb.h   |  19 ++-
 arch/powerpc/include/asm/mmu-8xx.h   |  35 +
 arch/powerpc/include/asm/mmu.h   |  23 +--
 arch/powerpc/include/asm/nohash/32/pgalloc.h |  44 +-
 arch/powerpc/include/asm/nohash/32/pgtable.h |  42 +++---
 arch/powerpc/include/asm/nohash/32/pte-8xx.h |   1 +
 arch/powerpc/include/asm/nohash/64/pgtable.h |   2 -
 arch/powerpc/include/asm/nohash/pgtable.h|   4 +
 arch/powerpc/include/asm/pgtable.h   |   2 +
 arch/powerpc/include/asm/reg_8xx.h   |   2 +-
 arch/powerpc/kernel/head_8xx.S   | 119 ++-
 arch/powerpc/mm/Makefile |   3 +-
 arch/powerpc/mm/hugetlbpage.c| 216 ---
 arch/powerpc/mm/init-common.c| 107 +
 arch/powerpc/mm/init_64.c|  77 --
 arch/powerpc/mm/pgtable_32.c |  37 -
 arch/powerpc/mm/tlb_nohash.c |  21 ++-
 arch/powerpc/platforms/8xx/Kconfig   |   1 +
 arch/powerpc/platforms/Kconfig.cputype   |   1 +
 22 files changed, 529 insertions(+), 314 deletions(-)
 create mode 100644 arch/powerpc/mm/init-common.c

-- 
2.10.1

Re: linux-next: build failure after merge of the tip tree

[Ingo Molnar]

Cc:-ing Arnaldo, Jiri, Wang Nan and Peter Foley - bug report quoted below.

This bug/race might have been introduced in the latest tooling bits:

  34c4a42791bb Merge tag 'perf-core-for-mingo-20161205' of 
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core

Which included these build system changes:

triton:~/tip> gll 78987584de42..perf/core
34c4a42791bb Merge tag 'perf-core-for-mingo-20161205' of 
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core
bec60e50af83 perf annotate: Show raw form for jump instruction with indirect 
target
d4dcadec43de perf tools: Add non config targets
207da4739e3e perf tools: Cleanup build directory before each test
0b4d4b076251 perf tools: Move python/perf.so target into rules area
5c319a67b13d perf tools: Move install-gtk target into rules area
2fedf79b69cf tools build: Move tabs to spaces where suitable
a5ba0a1a5af3 tools build: Make the .cmd file more readable
edd695b032ba perf clang: Compile BPF script using builtin clang support
5e08a76525b8 perf clang: Support compile IR to BPF object and add testcase
e67d52d411c3 perf clang: Update test case to use real BPF script
a9495fe9dc63 perf clang: Allow passing CFLAGS to builtin clang
77dfa84a843c perf clang: Use real file system for #include
00b86691c77c perf clang: Add builtin clang support ant test case
d58ac0bf8d1e perf build: Add clang and llvm compile and linking support
c7fb4f62e2a9 tools build: Add feature detection for clang
cb40d55b595c tools build: Add feature detection for LLVM
2bd42de0e196 perf llvm: Extract helpers in llvm-utils.c
8ad85e9e6fda perf tools: Pass context to perf hook functions
baa1973ebcf6 tools build: Fix objtool build with clang
1cd6472e3f8d tools build: Make fixdep parsing wait for last target

Thanks,

Ingo


* Stephen Rothwell  wrote:

> Hi all,
> 
> After merging the tip tree, today's linux-next build (powerpc64le perf)
> failed like this:
> 
>   LINK /home/sfr/next/perf/fixdep
> /bin/sh: 1: /home/sfr/next/perf//fixdep: Permission denied
> tools/build/Makefile.build:91: recipe for target 
> '/home/sfr/next/perf/pmu-events/jevents.o' failed
> 
> $ ls -l /home/sfr/next/perf/fixdep
> -rwxr-xr-x 1 sfr users 71104 Dec  7 12:26 /home/sfr/next/perf/fixdep
> 
> I am not sure what caused this, but redoing the build succeeded, so I
> have just filed this report and left it for today.

RE: [PATCH] btusb: fix zero BD address problem during stress test

[Amitkumar Karwar]

Hi Marcel,

> From: Amitkumar Karwar
> Sent: Friday, November 25, 2016 4:51 PM
> To: 'Marcel Holtmann'
> Cc: 'linux-blueto...@vger.kernel.org'; 'linux-kernel@vger.kernel.org';
> Cathy Luo; Nishant Sarmukadam; Ganapathi Bhat
> Subject: RE: [PATCH] btusb: fix zero BD address problem during stress
> test
> 
> Hi Marcel,
> 
> > From: Amitkumar Karwar
> > Sent: Wednesday, November 23, 2016 3:14 PM
> > To: 'Marcel Holtmann'
> > Cc: linux-blueto...@vger.kernel.org; linux-kernel@vger.kernel.org;
> > Cathy Luo; Nishant Sarmukadam; Ganapathi Bhat
> > Subject: RE: [PATCH] btusb: fix zero BD address problem during stress
> > test
> >
> > Hi Marcel,
> >
> > > From: Marcel Holtmann [mailto:mar...@holtmann.org]
> > > Sent: Wednesday, November 23, 2016 1:46 PM
> > > To: Amitkumar Karwar
> > > Cc: linux-blueto...@vger.kernel.org; linux-kernel@vger.kernel.org;
> > > Cathy Luo; Nishant Sarmukadam; Ganapathi Bhat
> > > Subject: Re: [PATCH] btusb: fix zero BD address problem during
> > > stress test
> > >
> > > Hi Amitkumar,
> > >
> > >  From: Amitkumar Karwar [mailto:akar...@marvell.com]
> > >  Sent: Tuesday, October 18, 2016 6:27 PM
> > >  To: linux-blueto...@vger.kernel.org
> > >  Cc: mar...@holtmann.org; linux-kernel@vger.kernel.org; Cathy
> > Luo;
> > >  Nishant Sarmukadam; Ganapathi Bhat; Amitkumar Karwar
> > >  Subject: [PATCH] btusb: fix zero BD address problem during
> > stress
> > >  test
> > > 
> > >  From: Ganapathi Bhat 
> > > 
> > >  We came across a corner case issue during reboot stress test
> in
> > > >> which
> > >  hciconfig shows BD address is all zero. Reason is we don't get
> > >  response for HCI RESET command during initialization
> > > 
> > >  The issue is tracked to a race where USB subsystem calls
> > >  btusb_intr_complete() to deliver a data(NOOP frame) received
> on
> > >  interrupt endpoint. HCI_RUNNING flag is not yet set by
> > >  bluetooth subsystem. So we ignore that frame and return.
> > > 
> > >  As we missed to resubmit the buffer to interrupt endpoint in
> > this
> > >  case, we don't get response for BT reset command downloaded
> > after
> > > >> this.
> > > 
> > >  This patch handles the corner case to resolve zero BD address
> > > >> problem.
> > > 
> > >  Signed-off-by: Ganapathi Bhat 
> > >  Signed-off-by: Amitkumar Karwar 
> > >  ---
> > >  drivers/bluetooth/btusb.c | 5 +
> > >  1 file changed, 1 insertion(+), 4 deletions(-)
> > > 
> > >  diff --git a/drivers/bluetooth/btusb.c
> > >  b/drivers/bluetooth/btusb.c index 811f9b9..b5596ac 100644
> > >  --- a/drivers/bluetooth/btusb.c
> > >  +++ b/drivers/bluetooth/btusb.c
> > >  @@ -607,10 +607,7 @@ static void btusb_intr_complete(struct
> urb
> > > >> *urb)
> > >   BT_DBG("%s urb %p status %d count %d", hdev->name, urb,
> > urb-
> > > > status,
> > >  urb->actual_length);
> > > 
> > >  -if (!test_bit(HCI_RUNNING, >flags))
> > >  -return;
> > >  -
> > >  -if (urb->status == 0) {
> > >  +if (urb->status == 0 && test_bit(HCI_RUNNING, 
> > > >flags)) {
> > >   hdev->stat.byte_rx += urb->actual_length;
> > > 
> > >   if (btusb_recv_intr(data, urb->transfer_buffer,
> > > >>>
> > > >>> Did you get a chance to check this?
> > > >>> Please let us know if you have any review comments.
> > > >>
> > > >> can you explain how this is correct and show me the HCI traces
> > > >> for this.
> > > >>
> > > >
> > > > I suppose HCI trace means hcidump logs here. As device hasn't yet
> > > initialized, hcidump won't show anything.
> > > > We had added debug info in btusb driver to trace the data
> received
> > > > on
> > > all USB endpoints and also checked usbmon logs.
> > >
> > > use btmon and it will show it.
> > >
> > > > Here is the sequence of events we observed in a corner case while
> > > running stress test.
> > > > 1) Inside btusb_open() call -- Thread 1
> > > > 2) btusb_submit_intr_urb() submits the URB for receiving data on
> > > > interrupt endpoint  Thread 1
> > > > 3) btusb_intr_complete() gets called to deliver NOP frame from
> HCI
> > > > controller  Thread 2
> > > > 4) HCI_RUNNING isn't set yet. So we return from
> > > > btusb_intr_complete() without resubmitting the buffer --- Thread
> 2
> > > > 5) Exit btusb_open()  Thread 1
> > > > 6) "set_bit(HCI_RUNNING, >flags)" done by bluetooth core
> > > >  Thread 1
> > > >
> > > > Later HCI_RESET command gets timedout, as we haven't re-submitted
> > > buffer for interrupt endpoint in step (4) above.
> > > >
> > > > Please find attached logs. usbmon log shows first frame received
> > > > on
> > > interrupt endpoint is NOP(Search for Marvell in log).
> > > >
> > > > Here is what bluetooth spec says about NOP frame.
> > > >
> > > > "To indicate to the Host that the 

Re: linux-next: build failure after merge of the tip tree

[Ingo Molnar]

Cc:-ing Arnaldo, Jiri, Wang Nan and Peter Foley - bug report quoted below.

This bug/race might have been introduced in the latest tooling bits:

  34c4a42791bb Merge tag 'perf-core-for-mingo-20161205' of 
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core

Which included these build system changes:

triton:~/tip> gll 78987584de42..perf/core
34c4a42791bb Merge tag 'perf-core-for-mingo-20161205' of 
git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core
bec60e50af83 perf annotate: Show raw form for jump instruction with indirect 
target
d4dcadec43de perf tools: Add non config targets
207da4739e3e perf tools: Cleanup build directory before each test
0b4d4b076251 perf tools: Move python/perf.so target into rules area
5c319a67b13d perf tools: Move install-gtk target into rules area
2fedf79b69cf tools build: Move tabs to spaces where suitable
a5ba0a1a5af3 tools build: Make the .cmd file more readable
edd695b032ba perf clang: Compile BPF script using builtin clang support
5e08a76525b8 perf clang: Support compile IR to BPF object and add testcase
e67d52d411c3 perf clang: Update test case to use real BPF script
a9495fe9dc63 perf clang: Allow passing CFLAGS to builtin clang
77dfa84a843c perf clang: Use real file system for #include
00b86691c77c perf clang: Add builtin clang support ant test case
d58ac0bf8d1e perf build: Add clang and llvm compile and linking support
c7fb4f62e2a9 tools build: Add feature detection for clang
cb40d55b595c tools build: Add feature detection for LLVM
2bd42de0e196 perf llvm: Extract helpers in llvm-utils.c
8ad85e9e6fda perf tools: Pass context to perf hook functions
baa1973ebcf6 tools build: Fix objtool build with clang
1cd6472e3f8d tools build: Make fixdep parsing wait for last target

Thanks,

Ingo


* Stephen Rothwell  wrote:

> Hi all,
> 
> After merging the tip tree, today's linux-next build (powerpc64le perf)
> failed like this:
> 
>   LINK /home/sfr/next/perf/fixdep
> /bin/sh: 1: /home/sfr/next/perf//fixdep: Permission denied
> tools/build/Makefile.build:91: recipe for target 
> '/home/sfr/next/perf/pmu-events/jevents.o' failed
> 
> $ ls -l /home/sfr/next/perf/fixdep
> -rwxr-xr-x 1 sfr users 71104 Dec  7 12:26 /home/sfr/next/perf/fixdep
> 
> I am not sure what caused this, but redoing the build succeeded, so I
> have just filed this report and left it for today.

RE: [PATCH] btusb: fix zero BD address problem during stress test

[Amitkumar Karwar]

Hi Marcel,

> From: Amitkumar Karwar
> Sent: Friday, November 25, 2016 4:51 PM
> To: 'Marcel Holtmann'
> Cc: 'linux-blueto...@vger.kernel.org'; 'linux-kernel@vger.kernel.org';
> Cathy Luo; Nishant Sarmukadam; Ganapathi Bhat
> Subject: RE: [PATCH] btusb: fix zero BD address problem during stress
> test
> 
> Hi Marcel,
> 
> > From: Amitkumar Karwar
> > Sent: Wednesday, November 23, 2016 3:14 PM
> > To: 'Marcel Holtmann'
> > Cc: linux-blueto...@vger.kernel.org; linux-kernel@vger.kernel.org;
> > Cathy Luo; Nishant Sarmukadam; Ganapathi Bhat
> > Subject: RE: [PATCH] btusb: fix zero BD address problem during stress
> > test
> >
> > Hi Marcel,
> >
> > > From: Marcel Holtmann [mailto:mar...@holtmann.org]
> > > Sent: Wednesday, November 23, 2016 1:46 PM
> > > To: Amitkumar Karwar
> > > Cc: linux-blueto...@vger.kernel.org; linux-kernel@vger.kernel.org;
> > > Cathy Luo; Nishant Sarmukadam; Ganapathi Bhat
> > > Subject: Re: [PATCH] btusb: fix zero BD address problem during
> > > stress test
> > >
> > > Hi Amitkumar,
> > >
> > >  From: Amitkumar Karwar [mailto:akar...@marvell.com]
> > >  Sent: Tuesday, October 18, 2016 6:27 PM
> > >  To: linux-blueto...@vger.kernel.org
> > >  Cc: mar...@holtmann.org; linux-kernel@vger.kernel.org; Cathy
> > Luo;
> > >  Nishant Sarmukadam; Ganapathi Bhat; Amitkumar Karwar
> > >  Subject: [PATCH] btusb: fix zero BD address problem during
> > stress
> > >  test
> > > 
> > >  From: Ganapathi Bhat 
> > > 
> > >  We came across a corner case issue during reboot stress test
> in
> > > >> which
> > >  hciconfig shows BD address is all zero. Reason is we don't get
> > >  response for HCI RESET command during initialization
> > > 
> > >  The issue is tracked to a race where USB subsystem calls
> > >  btusb_intr_complete() to deliver a data(NOOP frame) received
> on
> > >  interrupt endpoint. HCI_RUNNING flag is not yet set by
> > >  bluetooth subsystem. So we ignore that frame and return.
> > > 
> > >  As we missed to resubmit the buffer to interrupt endpoint in
> > this
> > >  case, we don't get response for BT reset command downloaded
> > after
> > > >> this.
> > > 
> > >  This patch handles the corner case to resolve zero BD address
> > > >> problem.
> > > 
> > >  Signed-off-by: Ganapathi Bhat 
> > >  Signed-off-by: Amitkumar Karwar 
> > >  ---
> > >  drivers/bluetooth/btusb.c | 5 +
> > >  1 file changed, 1 insertion(+), 4 deletions(-)
> > > 
> > >  diff --git a/drivers/bluetooth/btusb.c
> > >  b/drivers/bluetooth/btusb.c index 811f9b9..b5596ac 100644
> > >  --- a/drivers/bluetooth/btusb.c
> > >  +++ b/drivers/bluetooth/btusb.c
> > >  @@ -607,10 +607,7 @@ static void btusb_intr_complete(struct
> urb
> > > >> *urb)
> > >   BT_DBG("%s urb %p status %d count %d", hdev->name, urb,
> > urb-
> > > > status,
> > >  urb->actual_length);
> > > 
> > >  -if (!test_bit(HCI_RUNNING, >flags))
> > >  -return;
> > >  -
> > >  -if (urb->status == 0) {
> > >  +if (urb->status == 0 && test_bit(HCI_RUNNING, 
> > > >flags)) {
> > >   hdev->stat.byte_rx += urb->actual_length;
> > > 
> > >   if (btusb_recv_intr(data, urb->transfer_buffer,
> > > >>>
> > > >>> Did you get a chance to check this?
> > > >>> Please let us know if you have any review comments.
> > > >>
> > > >> can you explain how this is correct and show me the HCI traces
> > > >> for this.
> > > >>
> > > >
> > > > I suppose HCI trace means hcidump logs here. As device hasn't yet
> > > initialized, hcidump won't show anything.
> > > > We had added debug info in btusb driver to trace the data
> received
> > > > on
> > > all USB endpoints and also checked usbmon logs.
> > >
> > > use btmon and it will show it.
> > >
> > > > Here is the sequence of events we observed in a corner case while
> > > running stress test.
> > > > 1) Inside btusb_open() call -- Thread 1
> > > > 2) btusb_submit_intr_urb() submits the URB for receiving data on
> > > > interrupt endpoint  Thread 1
> > > > 3) btusb_intr_complete() gets called to deliver NOP frame from
> HCI
> > > > controller  Thread 2
> > > > 4) HCI_RUNNING isn't set yet. So we return from
> > > > btusb_intr_complete() without resubmitting the buffer --- Thread
> 2
> > > > 5) Exit btusb_open()  Thread 1
> > > > 6) "set_bit(HCI_RUNNING, >flags)" done by bluetooth core
> > > >  Thread 1
> > > >
> > > > Later HCI_RESET command gets timedout, as we haven't re-submitted
> > > buffer for interrupt endpoint in step (4) above.
> > > >
> > > > Please find attached logs. usbmon log shows first frame received
> > > > on
> > > interrupt endpoint is NOP(Search for Marvell in log).
> > > >
> > > > Here is what bluetooth spec says about NOP frame.
> > > >
> > > > "To indicate to the Host that the Controller is ready to receive
> > HCI
> > > > command packets, 

[PATCH 1/1] ixgbe: fcoe: return value of skb_linearize should be handled

[Zhouyi Zhou]

Signed-off-by: Zhouyi Zhou 
Reviewed-by: Cong Wang 
Reviewed-by: Yuval Shaia  
Reviewed-by: Eric Dumazet 
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 6 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c 
b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 2a653ec..7b6bdb7 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -490,7 +490,11 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
 */
if ((fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA) &&
(fctl & FC_FC_END_SEQ)) {
-   skb_linearize(skb);
+   int err;
+
+   err = skb_linearize(skb);
+   if (err)
+   return err;
crc = (struct fcoe_crc_eof *)skb_put(skb, sizeof(*crc));
crc->fcoe_eof = FC_EOF_T;
}
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 
b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index fee1f29..4926d48 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2173,8 +2173,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector 
*q_vector,
total_rx_bytes += ddp_bytes;
total_rx_packets += DIV_ROUND_UP(ddp_bytes,
 mss);
-   }
-   if (!ddp_bytes) {
+   } else {
dev_kfree_skb_any(skb);
continue;
}
-- 
1.9.1

[PATCH 1/1] ixgbe: fcoe: return value of skb_linearize should be handled

[Zhouyi Zhou]

Signed-off-by: Zhouyi Zhou 
Reviewed-by: Cong Wang 
Reviewed-by: Yuval Shaia  
Reviewed-by: Eric Dumazet 
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 6 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 +--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c 
b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 2a653ec..7b6bdb7 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -490,7 +490,11 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
 */
if ((fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA) &&
(fctl & FC_FC_END_SEQ)) {
-   skb_linearize(skb);
+   int err;
+
+   err = skb_linearize(skb);
+   if (err)
+   return err;
crc = (struct fcoe_crc_eof *)skb_put(skb, sizeof(*crc));
crc->fcoe_eof = FC_EOF_T;
}
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 
b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index fee1f29..4926d48 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2173,8 +2173,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector 
*q_vector,
total_rx_bytes += ddp_bytes;
total_rx_packets += DIV_ROUND_UP(ddp_bytes,
 mss);
-   }
-   if (!ddp_bytes) {
+   } else {
dev_kfree_skb_any(skb);
continue;
}
-- 
1.9.1

Re: [PATCH 1/1] mtd: spi-nor: remove WARN_ONCE() message in spi_nor_write()

[Boris Brezillon]

On Wed, 7 Dec 2016 04:07:05 +0100
Marek Vasut  wrote:

> On 12/07/2016 12:38 AM, Cyrille Pitchen wrote:
> > Le 06/12/2016 à 20:00, Marek Vasut a écrit :  
> >> On 12/06/2016 06:14 PM, Cyrille Pitchen wrote:  
> >>> This patch removes the WARN_ONCE() test in spi_nor_write().
> >>> This macro triggers the display of a warning message almost every time we
> >>> use a UBI file-system because a write operation is performed at offset 64,
> >>> which is in the middle of the SPI NOR memory page. This is a valid
> >>> operation for ubifs.  
> >>
> >> Is that a valid operation for all spi nors ?
> >>  
> > 
> > AFAIK, yes, it is. First we need to erase a sector or a block, then we
> > can send page program commands to write data into the memory. We cannot
> > write more than a page size within a single page program command but you
> > can write less and start in the middle of a page if you want.  
> 
> I wasn't aware this partial and even unaligned programming was available
> on all chips, OK.
> 
> > I don't know whether we could cross the page boundary if we start
> > writing from the middle of a page as long as we write less data than a
> > single page size. However spi_nor_write() don't do so, this is why it
> > computes
> > page_remain = min_t(size_t, nor->page_size - page_offset, len - i)  
> 
> No, I don't think we can, I believe the PP would wrap around and program
> the same page from the beginning.
> 
> > Well, now looking at the Spansion S25FL127S datasheet, the address is
> > wrapped if we cross the page boundary:  
> 
> Yeah, this matches my mental model.
> 
> > "Depending on the device configuration, the page size can either be 256
> > or 512 bytes. Up to a page can be provided on SI after the 3-byte
> > address with instruction 02h or 4-byte address with instruction 12h has
> > been provided. If the 9 least significant address bits (A8-A0) are not
> > all 0, all transmitted data that goes beyond the end of the current page
> > are programmed from the start address of the same page (from the address
> > whose 9 least significant bits (A8-A0) are all 0) i.e. the address wraps
> > within the page aligned address boundaries. This is a result of only
> > requiring the user to enter one single page address to cover the entire
> > page boundary."
> > 
> > Then from Adesto AT25DF321A datasheet:
> > "If the starting memory address denoted by A23-A0 does not fall on an
> > even 256-byte page boundary (A7-A0 are not all 0), then special
> > circumstances regarding which memory locations to be programmed will
> > apply. In this situation, any data that is sent to the device that goes
> > beyond the end of the page will wrap around back to the beginning of the
> > same page. For example, if the starting address denoted by A23-A0 is
> > FEh, and three bytes of data are sent to the device, then the first
> > two bytes of data will be programmed at addresses FEh and FFh
> > while the last byte of data will be programmed at address 00h. The
> > remaining bytes in the page (addresses 01h through FDh) will not
> > be programmed and will remain in the erased state (FFh). In addition, if
> > more than 256-bytes of data are sent to the device, then only the last
> > 256-bytes sent will be latched into the internal buffer."
> > 
> > 
> > Besides, the wear leveling is handled by the ubi layer I guess, at the
> > spi-nor level we write raw data. Maybe Richard and Boris could tell us
> > more but talking with them I've understood that's it is normal for the
> > ubi layer to write at offset 64.  
> 
> I'd understand RMW, but pure write seems a bit odd.
> 
> 

Well, UBI trusts what the MTD framwork says, and here [1] you say that
the minimum write unit is a byte, so UBI tries to optimize flash usage
by putting the EC and VID headers next to each other.
Now, if you want UBI to act differently, customize ->writesize on a,
but, by doing that, you may introduce regressions because some users
are already using UBI with this layout (ECH @0, VIDH @64).

[1]http://lxr.free-electrons.com/source/drivers/mtd/spi-nor/spi-nor.c#L1368

Re: [PATCH 1/1] mtd: spi-nor: remove WARN_ONCE() message in spi_nor_write()

[Boris Brezillon]

On Wed, 7 Dec 2016 04:07:05 +0100
Marek Vasut  wrote:

> On 12/07/2016 12:38 AM, Cyrille Pitchen wrote:
> > Le 06/12/2016 à 20:00, Marek Vasut a écrit :  
> >> On 12/06/2016 06:14 PM, Cyrille Pitchen wrote:  
> >>> This patch removes the WARN_ONCE() test in spi_nor_write().
> >>> This macro triggers the display of a warning message almost every time we
> >>> use a UBI file-system because a write operation is performed at offset 64,
> >>> which is in the middle of the SPI NOR memory page. This is a valid
> >>> operation for ubifs.  
> >>
> >> Is that a valid operation for all spi nors ?
> >>  
> > 
> > AFAIK, yes, it is. First we need to erase a sector or a block, then we
> > can send page program commands to write data into the memory. We cannot
> > write more than a page size within a single page program command but you
> > can write less and start in the middle of a page if you want.  
> 
> I wasn't aware this partial and even unaligned programming was available
> on all chips, OK.
> 
> > I don't know whether we could cross the page boundary if we start
> > writing from the middle of a page as long as we write less data than a
> > single page size. However spi_nor_write() don't do so, this is why it
> > computes
> > page_remain = min_t(size_t, nor->page_size - page_offset, len - i)  
> 
> No, I don't think we can, I believe the PP would wrap around and program
> the same page from the beginning.
> 
> > Well, now looking at the Spansion S25FL127S datasheet, the address is
> > wrapped if we cross the page boundary:  
> 
> Yeah, this matches my mental model.
> 
> > "Depending on the device configuration, the page size can either be 256
> > or 512 bytes. Up to a page can be provided on SI after the 3-byte
> > address with instruction 02h or 4-byte address with instruction 12h has
> > been provided. If the 9 least significant address bits (A8-A0) are not
> > all 0, all transmitted data that goes beyond the end of the current page
> > are programmed from the start address of the same page (from the address
> > whose 9 least significant bits (A8-A0) are all 0) i.e. the address wraps
> > within the page aligned address boundaries. This is a result of only
> > requiring the user to enter one single page address to cover the entire
> > page boundary."
> > 
> > Then from Adesto AT25DF321A datasheet:
> > "If the starting memory address denoted by A23-A0 does not fall on an
> > even 256-byte page boundary (A7-A0 are not all 0), then special
> > circumstances regarding which memory locations to be programmed will
> > apply. In this situation, any data that is sent to the device that goes
> > beyond the end of the page will wrap around back to the beginning of the
> > same page. For example, if the starting address denoted by A23-A0 is
> > FEh, and three bytes of data are sent to the device, then the first
> > two bytes of data will be programmed at addresses FEh and FFh
> > while the last byte of data will be programmed at address 00h. The
> > remaining bytes in the page (addresses 01h through FDh) will not
> > be programmed and will remain in the erased state (FFh). In addition, if
> > more than 256-bytes of data are sent to the device, then only the last
> > 256-bytes sent will be latched into the internal buffer."
> > 
> > 
> > Besides, the wear leveling is handled by the ubi layer I guess, at the
> > spi-nor level we write raw data. Maybe Richard and Boris could tell us
> > more but talking with them I've understood that's it is normal for the
> > ubi layer to write at offset 64.  
> 
> I'd understand RMW, but pure write seems a bit odd.
> 
> 

Well, UBI trusts what the MTD framwork says, and here [1] you say that
the minimum write unit is a byte, so UBI tries to optimize flash usage
by putting the EC and VID headers next to each other.
Now, if you want UBI to act differently, customize ->writesize on a,
but, by doing that, you may introduce regressions because some users
are already using UBI with this layout (ECH @0, VIDH @64).

[1]http://lxr.free-electrons.com/source/drivers/mtd/spi-nor/spi-nor.c#L1368

[PATCH 1/1 linux-next] ASoC: samsung: include gpio consumer.h

[Fabian Frederick]

Fix the following build errors
sound/soc/samsung/tm2_wm5110.c:220:3: error: implicit declaration
of function 'gpiod_set_value_cansleep' [-Werror=implicit-function-declaration]
sound/soc/samsung/tm2_wm5110.c:438:24: error: implicit declaration
of function 'devm_gpiod_get' [-Werror=implicit-function-declaration]

Signed-off-by: Fabian Frederick 
---
 sound/soc/samsung/tm2_wm5110.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/samsung/tm2_wm5110.c b/sound/soc/samsung/tm2_wm5110.c
index 5cdf7d1..24cc9d6 100644
--- a/sound/soc/samsung/tm2_wm5110.c
+++ b/sound/soc/samsung/tm2_wm5110.c
@@ -12,6 +12,7 @@
 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
-- 
2.7.4

[PATCH 1/1 linux-next] ASoC: samsung: include gpio consumer.h

[Fabian Frederick]

Fix the following build errors
sound/soc/samsung/tm2_wm5110.c:220:3: error: implicit declaration
of function 'gpiod_set_value_cansleep' [-Werror=implicit-function-declaration]
sound/soc/samsung/tm2_wm5110.c:438:24: error: implicit declaration
of function 'devm_gpiod_get' [-Werror=implicit-function-declaration]

Signed-off-by: Fabian Frederick 
---
 sound/soc/samsung/tm2_wm5110.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/samsung/tm2_wm5110.c b/sound/soc/samsung/tm2_wm5110.c
index 5cdf7d1..24cc9d6 100644
--- a/sound/soc/samsung/tm2_wm5110.c
+++ b/sound/soc/samsung/tm2_wm5110.c
@@ -12,6 +12,7 @@
 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
-- 
2.7.4

[PATCH 3/5] hv: init percpu_list in hv_synic_alloc()

[kys]

From: Vitaly Kuznetsov 

Initializing hv_context.percpu_list in hv_synic_alloc() helps to prevent a
crash in percpu_channel_enq() when not all CPUs were online during
initialization and it naturally belongs there.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/hv.c |4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index c326c67..c11393c 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -457,6 +457,8 @@ int hv_synic_alloc(void)
pr_err("Unable to allocate post msg page\n");
goto err;
}
+
+   INIT_LIST_HEAD(_context.percpu_list[cpu]);
}
 
return 0;
@@ -552,8 +554,6 @@ void hv_synic_init(void *arg)
rdmsrl(HV_X64_MSR_VP_INDEX, vp_index);
hv_context.vp_index[cpu] = (u32)vp_index;
 
-   INIT_LIST_HEAD(_context.percpu_list[cpu]);
-
/*
 * Register the per-cpu clockevent source.
 */
-- 
1.7.4.1

[PATCH 2/5] hv: allocate synic pages for all present CPUs

[kys]

From: Vitaly Kuznetsov 

It may happen that not all CPUs are online when we do hv_synic_alloc() and
in case more CPUs come online later we may try accessing these allocated
structures.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/hv.c |4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 446802a..c326c67 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -411,7 +411,7 @@ int hv_synic_alloc(void)
goto err;
}
 
-   for_each_online_cpu(cpu) {
+   for_each_present_cpu(cpu) {
hv_context.event_dpc[cpu] = kmalloc(size, GFP_ATOMIC);
if (hv_context.event_dpc[cpu] == NULL) {
pr_err("Unable to allocate event dpc\n");
@@ -482,7 +482,7 @@ void hv_synic_free(void)
int cpu;
 
kfree(hv_context.hv_numa_map);
-   for_each_online_cpu(cpu)
+   for_each_present_cpu(cpu)
hv_synic_free_cpu(cpu);
 }
 
-- 
1.7.4.1

[PATCH 3/5] hv: init percpu_list in hv_synic_alloc()

[kys]

From: Vitaly Kuznetsov 

Initializing hv_context.percpu_list in hv_synic_alloc() helps to prevent a
crash in percpu_channel_enq() when not all CPUs were online during
initialization and it naturally belongs there.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/hv.c |4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index c326c67..c11393c 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -457,6 +457,8 @@ int hv_synic_alloc(void)
pr_err("Unable to allocate post msg page\n");
goto err;
}
+
+   INIT_LIST_HEAD(_context.percpu_list[cpu]);
}
 
return 0;
@@ -552,8 +554,6 @@ void hv_synic_init(void *arg)
rdmsrl(HV_X64_MSR_VP_INDEX, vp_index);
hv_context.vp_index[cpu] = (u32)vp_index;
 
-   INIT_LIST_HEAD(_context.percpu_list[cpu]);
-
/*
 * Register the per-cpu clockevent source.
 */
-- 
1.7.4.1

[PATCH 2/5] hv: allocate synic pages for all present CPUs

[kys]

From: Vitaly Kuznetsov 

It may happen that not all CPUs are online when we do hv_synic_alloc() and
in case more CPUs come online later we may try accessing these allocated
structures.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/hv.c |4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 446802a..c326c67 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -411,7 +411,7 @@ int hv_synic_alloc(void)
goto err;
}
 
-   for_each_online_cpu(cpu) {
+   for_each_present_cpu(cpu) {
hv_context.event_dpc[cpu] = kmalloc(size, GFP_ATOMIC);
if (hv_context.event_dpc[cpu] == NULL) {
pr_err("Unable to allocate event dpc\n");
@@ -482,7 +482,7 @@ void hv_synic_free(void)
int cpu;
 
kfree(hv_context.hv_numa_map);
-   for_each_online_cpu(cpu)
+   for_each_present_cpu(cpu)
hv_synic_free_cpu(cpu);
 }
 
-- 
1.7.4.1

[PATCH 1/5] Drivers: hv: vmbus: Raise retry/wait limits in vmbus_post_msg()

[kys]

From: Vitaly Kuznetsov 

DoS protection conditions were altered in WS2016 and now it's easy to get
-EAGAIN returned from vmbus_post_msg() (e.g. when we try changing MTU on a
netvsc device in a loop). All vmbus_post_msg() callers don't retry the
operation and we usually end up with a non-functional device or crash.

While host's DoS protection conditions are unknown to me my tests show that
it can take up to 10 seconds before the message is sent so doing udelay()
is not an option, we really need to sleep. Almost all vmbus_post_msg()
callers are ready to sleep but there is one special case:
vmbus_initiate_unload() which can be called from interrupt/NMI context and
we can't sleep there. I'm also not sure about the lonely
vmbus_send_tl_connect_request() which has no in-tree users but its external
users are most likely waiting for the host to reply so sleeping there is
also appropriate.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/channel.c  |   17 +
 drivers/hv/channel_mgmt.c |   10 ++
 drivers/hv/connection.c   |   17 -
 drivers/hv/hyperv_vmbus.h |2 +-
 4 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 5fb4c6d..d5b8d9f 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -181,7 +181,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 
send_ringbuffer_size,
spin_unlock_irqrestore(_connection.channelmsg_lock, flags);
 
ret = vmbus_post_msg(open_msg,
-  sizeof(struct vmbus_channel_open_channel));
+sizeof(struct vmbus_channel_open_channel), true);
 
if (ret != 0) {
err = ret;
@@ -233,7 +233,7 @@ int vmbus_send_tl_connect_request(const uuid_le 
*shv_guest_servie_id,
conn_msg.guest_endpoint_id = *shv_guest_servie_id;
conn_msg.host_service_id = *shv_host_servie_id;
 
-   return vmbus_post_msg(_msg, sizeof(conn_msg));
+   return vmbus_post_msg(_msg, sizeof(conn_msg), true);
 }
 EXPORT_SYMBOL_GPL(vmbus_send_tl_connect_request);
 
@@ -419,7 +419,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, 
void *kbuffer,
spin_unlock_irqrestore(_connection.channelmsg_lock, flags);
 
ret = vmbus_post_msg(gpadlmsg, msginfo->msgsize -
-  sizeof(*msginfo));
+sizeof(*msginfo), true);
if (ret != 0)
goto cleanup;
 
@@ -433,8 +433,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, 
void *kbuffer,
gpadl_body->gpadl = next_gpadl_handle;
 
ret = vmbus_post_msg(gpadl_body,
-submsginfo->msgsize -
-sizeof(*submsginfo));
+submsginfo->msgsize - sizeof(*submsginfo),
+true);
if (ret != 0)
goto cleanup;
 
@@ -485,8 +485,8 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 
gpadl_handle)
list_add_tail(>msglistentry,
  _connection.chn_msg_list);
spin_unlock_irqrestore(_connection.channelmsg_lock, flags);
-   ret = vmbus_post_msg(msg,
-  sizeof(struct vmbus_channel_gpadl_teardown));
+   ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_gpadl_teardown),
+true);
 
if (ret)
goto post_msg_err;
@@ -557,7 +557,8 @@ static int vmbus_close_internal(struct vmbus_channel 
*channel)
msg->header.msgtype = CHANNELMSG_CLOSECHANNEL;
msg->child_relid = channel->offermsg.child_relid;
 
-   ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel));
+   ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel),
+true);
 
if (ret) {
pr_err("Close failed: close post msg return is %d\n", ret);
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 26b4192..b1e85d2 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -321,7 +321,8 @@ static void vmbus_release_relid(u32 relid)
memset(, 0, sizeof(struct vmbus_channel_relid_released));
msg.child_relid = relid;
msg.header.msgtype = CHANNELMSG_RELID_RELEASED;
-   vmbus_post_msg(, sizeof(struct vmbus_channel_relid_released));
+   vmbus_post_msg(, sizeof(struct vmbus_channel_relid_released),
+  true);
 }
 
 void hv_event_tasklet_disable(struct vmbus_channel *channel)
@@ -728,7 +729,8 @@ void vmbus_initiate_unload(bool crash)
init_completion(_connection.unload_event);
memset(, 0, sizeof(struct vmbus_channel_message_header));
hdr.msgtype = CHANNELMSG_UNLOAD;
-   vmbus_post_msg(, 

[PATCH 4/5] hv: don't reset hv_context.tsc_page on crash

[kys]

From: Vitaly Kuznetsov 

It may happen that secondary CPUs are still alive and resetting
hv_context.tsc_page will cause a consequent crash in read_hv_clock_tsc()
as we don't check for it being not NULL there. It is safe as we're not
freeing this page anyways.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/hv.c |5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index c11393c..60f14c4 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -309,9 +309,10 @@ void hv_cleanup(bool crash)
 
hypercall_msr.as_uint64 = 0;
wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64);
-   if (!crash)
+   if (!crash) {
vfree(hv_context.tsc_page);
-   hv_context.tsc_page = NULL;
+   hv_context.tsc_page = NULL;
+   }
}
 #endif
 }
-- 
1.7.4.1

[PATCH 5/5] Drivers: hv: vmbus: Prevent sending data on a rescinded channel

[kys]

From: K. Y. Srinivasan 

After the channel is rescinded, the host does not read from the rescinded 
channel.
Fail writes to a channel that has already been rescinded. If we permit writes 
on a
rescinded channel, since the host will not respond we will have situations where
we will be unable to unload vmbus drivers that cannot have any outstanding 
requests
to the host at the point they are unoaded.

Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/ring_buffer.c |7 +++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index cd49cb1..2cd4029 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -298,6 +298,9 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
unsigned long flags = 0;
struct hv_ring_buffer_info *outring_info = >outbound;
 
+   if (channel->rescind)
+   return -ENODEV;
+
for (i = 0; i < kv_count; i++)
totalbytes_towrite += kv_list[i].iov_len;
 
@@ -350,6 +353,10 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
spin_unlock_irqrestore(_info->ring_lock, flags);
 
hv_signal_on_write(old_write, channel, kick_q);
+
+   if (channel->rescind)
+   return -ENODEV;
+
return 0;
 }
 
-- 
1.7.4.1

[PATCH 1/5] Drivers: hv: vmbus: Raise retry/wait limits in vmbus_post_msg()

[kys]

From: Vitaly Kuznetsov 

DoS protection conditions were altered in WS2016 and now it's easy to get
-EAGAIN returned from vmbus_post_msg() (e.g. when we try changing MTU on a
netvsc device in a loop). All vmbus_post_msg() callers don't retry the
operation and we usually end up with a non-functional device or crash.

While host's DoS protection conditions are unknown to me my tests show that
it can take up to 10 seconds before the message is sent so doing udelay()
is not an option, we really need to sleep. Almost all vmbus_post_msg()
callers are ready to sleep but there is one special case:
vmbus_initiate_unload() which can be called from interrupt/NMI context and
we can't sleep there. I'm also not sure about the lonely
vmbus_send_tl_connect_request() which has no in-tree users but its external
users are most likely waiting for the host to reply so sleeping there is
also appropriate.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/channel.c  |   17 +
 drivers/hv/channel_mgmt.c |   10 ++
 drivers/hv/connection.c   |   17 -
 drivers/hv/hyperv_vmbus.h |2 +-
 4 files changed, 28 insertions(+), 18 deletions(-)

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 5fb4c6d..d5b8d9f 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -181,7 +181,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 
send_ringbuffer_size,
spin_unlock_irqrestore(_connection.channelmsg_lock, flags);
 
ret = vmbus_post_msg(open_msg,
-  sizeof(struct vmbus_channel_open_channel));
+sizeof(struct vmbus_channel_open_channel), true);
 
if (ret != 0) {
err = ret;
@@ -233,7 +233,7 @@ int vmbus_send_tl_connect_request(const uuid_le 
*shv_guest_servie_id,
conn_msg.guest_endpoint_id = *shv_guest_servie_id;
conn_msg.host_service_id = *shv_host_servie_id;
 
-   return vmbus_post_msg(_msg, sizeof(conn_msg));
+   return vmbus_post_msg(_msg, sizeof(conn_msg), true);
 }
 EXPORT_SYMBOL_GPL(vmbus_send_tl_connect_request);
 
@@ -419,7 +419,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, 
void *kbuffer,
spin_unlock_irqrestore(_connection.channelmsg_lock, flags);
 
ret = vmbus_post_msg(gpadlmsg, msginfo->msgsize -
-  sizeof(*msginfo));
+sizeof(*msginfo), true);
if (ret != 0)
goto cleanup;
 
@@ -433,8 +433,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, 
void *kbuffer,
gpadl_body->gpadl = next_gpadl_handle;
 
ret = vmbus_post_msg(gpadl_body,
-submsginfo->msgsize -
-sizeof(*submsginfo));
+submsginfo->msgsize - sizeof(*submsginfo),
+true);
if (ret != 0)
goto cleanup;
 
@@ -485,8 +485,8 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 
gpadl_handle)
list_add_tail(>msglistentry,
  _connection.chn_msg_list);
spin_unlock_irqrestore(_connection.channelmsg_lock, flags);
-   ret = vmbus_post_msg(msg,
-  sizeof(struct vmbus_channel_gpadl_teardown));
+   ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_gpadl_teardown),
+true);
 
if (ret)
goto post_msg_err;
@@ -557,7 +557,8 @@ static int vmbus_close_internal(struct vmbus_channel 
*channel)
msg->header.msgtype = CHANNELMSG_CLOSECHANNEL;
msg->child_relid = channel->offermsg.child_relid;
 
-   ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel));
+   ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel),
+true);
 
if (ret) {
pr_err("Close failed: close post msg return is %d\n", ret);
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 26b4192..b1e85d2 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -321,7 +321,8 @@ static void vmbus_release_relid(u32 relid)
memset(, 0, sizeof(struct vmbus_channel_relid_released));
msg.child_relid = relid;
msg.header.msgtype = CHANNELMSG_RELID_RELEASED;
-   vmbus_post_msg(, sizeof(struct vmbus_channel_relid_released));
+   vmbus_post_msg(, sizeof(struct vmbus_channel_relid_released),
+  true);
 }
 
 void hv_event_tasklet_disable(struct vmbus_channel *channel)
@@ -728,7 +729,8 @@ void vmbus_initiate_unload(bool crash)
init_completion(_connection.unload_event);
memset(, 0, sizeof(struct vmbus_channel_message_header));
hdr.msgtype = CHANNELMSG_UNLOAD;
-   vmbus_post_msg(, sizeof(struct vmbus_channel_message_header));
+   vmbus_post_msg(, sizeof(struct 

[PATCH 4/5] hv: don't reset hv_context.tsc_page on crash

[kys]

From: Vitaly Kuznetsov 

It may happen that secondary CPUs are still alive and resetting
hv_context.tsc_page will cause a consequent crash in read_hv_clock_tsc()
as we don't check for it being not NULL there. It is safe as we're not
freeing this page anyways.

Signed-off-by: Vitaly Kuznetsov 
Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/hv.c |5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index c11393c..60f14c4 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -309,9 +309,10 @@ void hv_cleanup(bool crash)
 
hypercall_msr.as_uint64 = 0;
wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64);
-   if (!crash)
+   if (!crash) {
vfree(hv_context.tsc_page);
-   hv_context.tsc_page = NULL;
+   hv_context.tsc_page = NULL;
+   }
}
 #endif
 }
-- 
1.7.4.1

[PATCH 5/5] Drivers: hv: vmbus: Prevent sending data on a rescinded channel

[kys]

From: K. Y. Srinivasan 

After the channel is rescinded, the host does not read from the rescinded 
channel.
Fail writes to a channel that has already been rescinded. If we permit writes 
on a
rescinded channel, since the host will not respond we will have situations where
we will be unable to unload vmbus drivers that cannot have any outstanding 
requests
to the host at the point they are unoaded.

Signed-off-by: K. Y. Srinivasan 
Cc: 
---
 drivers/hv/ring_buffer.c |7 +++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index cd49cb1..2cd4029 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -298,6 +298,9 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
unsigned long flags = 0;
struct hv_ring_buffer_info *outring_info = >outbound;
 
+   if (channel->rescind)
+   return -ENODEV;
+
for (i = 0; i < kv_count; i++)
totalbytes_towrite += kv_list[i].iov_len;
 
@@ -350,6 +353,10 @@ int hv_ringbuffer_write(struct vmbus_channel *channel,
spin_unlock_irqrestore(_info->ring_lock, flags);
 
hv_signal_on_write(old_write, channel, kick_q);
+
+   if (channel->rescind)
+   return -ENODEV;
+
return 0;
 }
 
-- 
1.7.4.1

Re: [PATCH 4.4 00/13] 4.4.37-stable review

[Philip Müller]

Hi Greg,

I'd recommend also to queue 84ac726[1] (packet: fix race condition in
packet_set_ring) from Philip Pettersson into 4.4 and 4.8 series, as some
news pages[2] already post about this local security, which was
introduced in 2011 to all kernels.

greez, Phil

[1]
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
[2]
http://phoronix.com/scan.php?page=news_item=Linux-Kernel-CVE-2016-8655

Re: [PATCH 4.4 00/13] 4.4.37-stable review

[Philip Müller]

Hi Greg,

I'd recommend also to queue 84ac726[1] (packet: fix race condition in
packet_set_ring) from Philip Pettersson into 4.4 and 4.8 series, as some
news pages[2] already post about this local security, which was
introduced in 2011 to all kernels.

greez, Phil

[1]
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
[2]
http://phoronix.com/scan.php?page=news_item=Linux-Kernel-CVE-2016-8655

[PATCH 1/1] infiniband: nes: return value of skb_linearize should be handled

[Zhouyi Zhou]

Return value of skb_linearize should be handled in function 
nes_netdev_start_xmit.

Compiled in x86_64
Signed-off-by: Zhouyi Zhou 
Reviewed-by: Yuval Shaia  
Reviewed-by: Eric Dumazet 

---
 drivers/infiniband/hw/nes/nes_nic.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/nes/nes_nic.c 
b/drivers/infiniband/hw/nes/nes_nic.c
index 2b27d13..dfd1f57 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -662,10 +662,14 @@ static int nes_netdev_start_xmit(struct sk_buff *skb, 
struct net_device *netdev)
nesnic->sq_head &= nesnic->sq_size-1;
}
} else {
-   nesvnic->linearized_skbs++;
hoffset = skb_transport_header(skb) - skb->data;
nhoffset = skb_network_header(skb) - skb->data;
-   skb_linearize(skb);
+   if (skb_linearize(skb)) {
+   nesvnic->tx_sw_dropped++;
+   kfree_skb(skb);
+   return NETDEV_TX_OK;
+   }
+   nesvnic->linearized_skbs++;
skb_set_transport_header(skb, hoffset);
skb_set_network_header(skb, nhoffset);
if (!nes_nic_send(skb, netdev))
-- 
1.9.1

Re: [PATCH 10/10] virtio: enable endian checks for sparse builds

[Christoph Hellwig]

On Tue, Dec 06, 2016 at 05:41:05PM +0200, Michael S. Tsirkin wrote:
> __CHECK_ENDIAN__ isn't on by default presumably because
> it triggers too many sparse warnings for correct code.
> But virtio is now clean of these warnings, and
> we want to keep it this way - enable this for
> sparse builds.
> 
> Signed-off-by: Michael S. Tsirkin 

Nah.  Please just enable it globally when using sparse.  I actually
had a chat with Linus about that a while ago and he seemed generally
fine with it, I just didn't manage to actually do it..

[PATCH 1/1] infiniband: nes: return value of skb_linearize should be handled

[Zhouyi Zhou]

Return value of skb_linearize should be handled in function 
nes_netdev_start_xmit.

Compiled in x86_64
Signed-off-by: Zhouyi Zhou 
Reviewed-by: Yuval Shaia  
Reviewed-by: Eric Dumazet 

---
 drivers/infiniband/hw/nes/nes_nic.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/nes/nes_nic.c 
b/drivers/infiniband/hw/nes/nes_nic.c
index 2b27d13..dfd1f57 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -662,10 +662,14 @@ static int nes_netdev_start_xmit(struct sk_buff *skb, 
struct net_device *netdev)
nesnic->sq_head &= nesnic->sq_size-1;
}
} else {
-   nesvnic->linearized_skbs++;
hoffset = skb_transport_header(skb) - skb->data;
nhoffset = skb_network_header(skb) - skb->data;
-   skb_linearize(skb);
+   if (skb_linearize(skb)) {
+   nesvnic->tx_sw_dropped++;
+   kfree_skb(skb);
+   return NETDEV_TX_OK;
+   }
+   nesvnic->linearized_skbs++;
skb_set_transport_header(skb, hoffset);
skb_set_network_header(skb, nhoffset);
if (!nes_nic_send(skb, netdev))
-- 
1.9.1

Re: [PATCH 10/10] virtio: enable endian checks for sparse builds

[Christoph Hellwig]

On Tue, Dec 06, 2016 at 05:41:05PM +0200, Michael S. Tsirkin wrote:
> __CHECK_ENDIAN__ isn't on by default presumably because
> it triggers too many sparse warnings for correct code.
> But virtio is now clean of these warnings, and
> we want to keep it this way - enable this for
> sparse builds.
> 
> Signed-off-by: Michael S. Tsirkin 

Nah.  Please just enable it globally when using sparse.  I actually
had a chat with Linus about that a while ago and he seemed generally
fine with it, I just didn't manage to actually do it..

[PATCH] usb: mtu3: enable auto switch from U3 to U2

[Chunfeng Yun]

inform mac2 to build U2 link automatically after U3 detect
fail without software setting soft_connect.

Signed-off-by: Chunfeng Yun 
---
 drivers/usb/mtu3/mtu3_core.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index af3e531..ca05021 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -568,6 +568,8 @@ static void mtu3_regs_init(struct mtu3 *mtu)
SW_U1_REQUEST_ENABLE | SW_U2_REQUEST_ENABLE);
/* device responses to u3_exit from host automatically */
mtu3_clrbits(mbase, U3D_LTSSM_CTRL, SOFT_U3_EXIT_EN);
+   /* automatically build U2 link when U3 detect fail */
+   mtu3_setbits(mbase, U3D_USB2_TEST_MODE, U2U3_AUTO_SWITCH);
}
 
mtu3_set_speed(mtu);
-- 
1.7.9.5

[PATCH] usb: mtu3: enable auto switch from U3 to U2

[Chunfeng Yun]

inform mac2 to build U2 link automatically after U3 detect
fail without software setting soft_connect.

Signed-off-by: Chunfeng Yun 
---
 drivers/usb/mtu3/mtu3_core.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index af3e531..ca05021 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -568,6 +568,8 @@ static void mtu3_regs_init(struct mtu3 *mtu)
SW_U1_REQUEST_ENABLE | SW_U2_REQUEST_ENABLE);
/* device responses to u3_exit from host automatically */
mtu3_clrbits(mbase, U3D_LTSSM_CTRL, SOFT_U3_EXIT_EN);
+   /* automatically build U2 link when U3 detect fail */
+   mtu3_setbits(mbase, U3D_USB2_TEST_MODE, U2U3_AUTO_SWITCH);
}
 
mtu3_set_speed(mtu);
-- 
1.7.9.5

[PATCH] usb: mtu3: fix U3 port link issue

[Chunfeng Yun]

the issue is introduced when @is_u3_ip is used in mtu3_device_enabe()
before initialized in mtu3_mem_alloc(), so get global IP information
at first before used by following functins.

Signed-off-by: Chunfeng Yun 
---
 drivers/usb/mtu3/mtu3_core.c |   18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index 520e55a..af3e531 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -481,21 +481,14 @@ static int mtu3_mem_alloc(struct mtu3 *mtu)
void __iomem *mbase = mtu->mac_base;
struct mtu3_ep *ep_array;
int in_ep_num, out_ep_num;
-   u32 cap_epinfo, cap_dev;
+   u32 cap_epinfo;
int ret;
int i;
 
-   mtu->hw_version = mtu3_readl(mtu->ippc_base, U3D_SSUSB_HW_ID);
-
-   cap_dev = mtu3_readl(mtu->ippc_base, U3D_SSUSB_IP_DEV_CAP);
-   mtu->is_u3_ip = !!SSUSB_IP_DEV_U3_PORT_NUM(cap_dev);
-
cap_epinfo = mtu3_readl(mbase, U3D_CAP_EPINFO);
in_ep_num = CAP_TX_EP_NUM(cap_epinfo);
out_ep_num = CAP_RX_EP_NUM(cap_epinfo);
 
-   dev_info(mtu->dev, "IP version 0x%x(%s IP)\n", mtu->hw_version,
-   mtu->is_u3_ip ? "U3" : "U2");
dev_info(mtu->dev, "fifosz/epnum: Tx=%#x/%d, Rx=%#x/%d\n",
 mtu3_readl(mbase, U3D_CAP_EPNTXFFSZ), in_ep_num,
 mtu3_readl(mbase, U3D_CAP_EPNRXFFSZ), out_ep_num);
@@ -730,8 +723,17 @@ irqreturn_t mtu3_irq(int irq, void *data)
 
 static int mtu3_hw_init(struct mtu3 *mtu)
 {
+   u32 cap_dev;
int ret;
 
+   mtu->hw_version = mtu3_readl(mtu->ippc_base, U3D_SSUSB_HW_ID);
+
+   cap_dev = mtu3_readl(mtu->ippc_base, U3D_SSUSB_IP_DEV_CAP);
+   mtu->is_u3_ip = !!SSUSB_IP_DEV_U3_PORT_NUM(cap_dev);
+
+   dev_info(mtu->dev, "IP version 0x%x(%s IP)\n", mtu->hw_version,
+   mtu->is_u3_ip ? "U3" : "U2");
+
mtu3_device_reset(mtu);
 
ret = mtu3_device_enable(mtu);
-- 
1.7.9.5

[PATCH] usb: mtu3: fix U3 port link issue

[Chunfeng Yun]

the issue is introduced when @is_u3_ip is used in mtu3_device_enabe()
before initialized in mtu3_mem_alloc(), so get global IP information
at first before used by following functins.

Signed-off-by: Chunfeng Yun 
---
 drivers/usb/mtu3/mtu3_core.c |   18 ++
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
index 520e55a..af3e531 100644
--- a/drivers/usb/mtu3/mtu3_core.c
+++ b/drivers/usb/mtu3/mtu3_core.c
@@ -481,21 +481,14 @@ static int mtu3_mem_alloc(struct mtu3 *mtu)
void __iomem *mbase = mtu->mac_base;
struct mtu3_ep *ep_array;
int in_ep_num, out_ep_num;
-   u32 cap_epinfo, cap_dev;
+   u32 cap_epinfo;
int ret;
int i;
 
-   mtu->hw_version = mtu3_readl(mtu->ippc_base, U3D_SSUSB_HW_ID);
-
-   cap_dev = mtu3_readl(mtu->ippc_base, U3D_SSUSB_IP_DEV_CAP);
-   mtu->is_u3_ip = !!SSUSB_IP_DEV_U3_PORT_NUM(cap_dev);
-
cap_epinfo = mtu3_readl(mbase, U3D_CAP_EPINFO);
in_ep_num = CAP_TX_EP_NUM(cap_epinfo);
out_ep_num = CAP_RX_EP_NUM(cap_epinfo);
 
-   dev_info(mtu->dev, "IP version 0x%x(%s IP)\n", mtu->hw_version,
-   mtu->is_u3_ip ? "U3" : "U2");
dev_info(mtu->dev, "fifosz/epnum: Tx=%#x/%d, Rx=%#x/%d\n",
 mtu3_readl(mbase, U3D_CAP_EPNTXFFSZ), in_ep_num,
 mtu3_readl(mbase, U3D_CAP_EPNRXFFSZ), out_ep_num);
@@ -730,8 +723,17 @@ irqreturn_t mtu3_irq(int irq, void *data)
 
 static int mtu3_hw_init(struct mtu3 *mtu)
 {
+   u32 cap_dev;
int ret;
 
+   mtu->hw_version = mtu3_readl(mtu->ippc_base, U3D_SSUSB_HW_ID);
+
+   cap_dev = mtu3_readl(mtu->ippc_base, U3D_SSUSB_IP_DEV_CAP);
+   mtu->is_u3_ip = !!SSUSB_IP_DEV_U3_PORT_NUM(cap_dev);
+
+   dev_info(mtu->dev, "IP version 0x%x(%s IP)\n", mtu->hw_version,
+   mtu->is_u3_ip ? "U3" : "U2");
+
mtu3_device_reset(mtu);
 
ret = mtu3_device_enable(mtu);
-- 
1.7.9.5

[PATCH 0/5] Drivers: hv: vmbus: Some miscellaneous fixes

[kys]

From: K. Y. Srinivasan 

Some miscellaneous fixes.

K. Y. Srinivasan (1):
  Drivers: hv: vmbus: Prevent sending data on a rescinded channel

Vitaly Kuznetsov (4):
  Drivers: hv: vmbus: Raise retry/wait limits in vmbus_post_msg()
  hv: allocate synic pages for all present CPUs
  hv: init percpu_list in hv_synic_alloc()
  hv: don't reset hv_context.tsc_page on crash

 drivers/hv/channel.c  |   17 +
 drivers/hv/channel_mgmt.c |   10 ++
 drivers/hv/connection.c   |   17 -
 drivers/hv/hv.c   |   13 +++--
 drivers/hv/hyperv_vmbus.h |2 +-
 drivers/hv/ring_buffer.c  |7 +++
 6 files changed, 42 insertions(+), 24 deletions(-)

-- 
1.7.4.1

[PATCH 0/5] Drivers: hv: vmbus: Some miscellaneous fixes

[kys]

From: K. Y. Srinivasan 

Some miscellaneous fixes.

K. Y. Srinivasan (1):
  Drivers: hv: vmbus: Prevent sending data on a rescinded channel

Vitaly Kuznetsov (4):
  Drivers: hv: vmbus: Raise retry/wait limits in vmbus_post_msg()
  hv: allocate synic pages for all present CPUs
  hv: init percpu_list in hv_synic_alloc()
  hv: don't reset hv_context.tsc_page on crash

 drivers/hv/channel.c  |   17 +
 drivers/hv/channel_mgmt.c |   10 ++
 drivers/hv/connection.c   |   17 -
 drivers/hv/hv.c   |   13 +++--
 drivers/hv/hyperv_vmbus.h |2 +-
 drivers/hv/ring_buffer.c  |7 +++
 6 files changed, 42 insertions(+), 24 deletions(-)

-- 
1.7.4.1

[PATCH 4.4 01/13] ARC: Dont use "+l" inline asm constraint

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Vineet Gupta 

commit 3c7c7a2fc8811bc7097479f69acf2527693d7562 upstream.

Apparenty this is coming in the way of gcc fix which inhibits the usage
of LP_COUNT as a gpr.

Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/include/asm/delay.h |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -22,10 +22,11 @@
 static inline void __delay(unsigned long loops)
 {
__asm__ __volatile__(
-   "   lp  1f  \n"
-   "   nop \n"
-   "1: \n"
-   : "+l"(loops));
+   "   mov lp_count, %0\n"
+   "   lp  1f  \n"
+   "   nop \n"
+   "1: \n"
+   : : "r"(loops));
 }
 
 extern void __bad_udelay(void);

[PATCH 4.4 13/13] arm64: suspend: Reconfigure PSTATE after resume from idle

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: James Morse 

commit d08544127d9fb4505635e3cb6871fd50a42947bd upstream.

The suspend/resume path in kernel/sleep.S, as used by cpu-idle, does not
save/restore PSTATE. As a result of this cpufeatures that were detected
and have bits in PSTATE get lost when we resume from idle.

UAO gets set appropriately on the next context switch. PAN will be
re-enabled next time we return from user-space, but on a preemptible
kernel we may run work accessing user space before this point.

Add code to re-enable theses two features in __cpu_suspend_exit().
We re-use uao_thread_switch() passing current.

Signed-off-by: James Morse 
Cc: Lorenzo Pieralisi 
Signed-off-by: Will Deacon 
[Removed UAO hooks and commit-message references: this feature is not
 present in v4.4]
Signed-off-by: James Morse 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kernel/suspend.c |9 +
 1 file changed, 9 insertions(+)

--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -1,7 +1,9 @@
 #include 
 #include 
 #include 
+#include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -111,6 +113,13 @@ int cpu_suspend(unsigned long arg, int (
set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
 
/*
+* PSTATE was not saved over suspend/resume, re-enable any
+* detected features that might not have been set correctly.
+*/
+   asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN,
+   CONFIG_ARM64_PAN));
+
+   /*
 * Restore HW breakpoint registers to sane values
 * before debug exceptions are possibly reenabled
 * through local_dbg_restore.

[PATCH 4.4 01/13] ARC: Dont use "+l" inline asm constraint

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Vineet Gupta 

commit 3c7c7a2fc8811bc7097479f69acf2527693d7562 upstream.

Apparenty this is coming in the way of gcc fix which inhibits the usage
of LP_COUNT as a gpr.

Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/include/asm/delay.h |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -22,10 +22,11 @@
 static inline void __delay(unsigned long loops)
 {
__asm__ __volatile__(
-   "   lp  1f  \n"
-   "   nop \n"
-   "1: \n"
-   : "+l"(loops));
+   "   mov lp_count, %0\n"
+   "   lp  1f  \n"
+   "   nop \n"
+   "1: \n"
+   : : "r"(loops));
 }
 
 extern void __bad_udelay(void);

[PATCH 4.4 13/13] arm64: suspend: Reconfigure PSTATE after resume from idle

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: James Morse 

commit d08544127d9fb4505635e3cb6871fd50a42947bd upstream.

The suspend/resume path in kernel/sleep.S, as used by cpu-idle, does not
save/restore PSTATE. As a result of this cpufeatures that were detected
and have bits in PSTATE get lost when we resume from idle.

UAO gets set appropriately on the next context switch. PAN will be
re-enabled next time we return from user-space, but on a preemptible
kernel we may run work accessing user space before this point.

Add code to re-enable theses two features in __cpu_suspend_exit().
We re-use uao_thread_switch() passing current.

Signed-off-by: James Morse 
Cc: Lorenzo Pieralisi 
Signed-off-by: Will Deacon 
[Removed UAO hooks and commit-message references: this feature is not
 present in v4.4]
Signed-off-by: James Morse 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/kernel/suspend.c |9 +
 1 file changed, 9 insertions(+)

--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -1,7 +1,9 @@
 #include 
 #include 
 #include 
+#include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -111,6 +113,13 @@ int cpu_suspend(unsigned long arg, int (
set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
 
/*
+* PSTATE was not saved over suspend/resume, re-enable any
+* detected features that might not have been set correctly.
+*/
+   asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN,
+   CONFIG_ARM64_PAN));
+
+   /*
 * Restore HW breakpoint registers to sane values
 * before debug exceptions are possibly reenabled
 * through local_dbg_restore.

[PATCH 4.4 07/13] PCI: Export pcie_find_root_port

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Johannes Thumshirn 

commit e784930bd645e7df78c66e7872fec282b0620075 upstream.

Export pcie_find_root_port() so we can use it outside of PCIe-AER error
injection.

Signed-off-by: Johannes Thumshirn 
Signed-off-by: Bjorn Helgaas 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pci/pcie/aer/aer_inject.c |   14 --
 include/linux/pci.h   |   14 ++
 2 files changed, 14 insertions(+), 14 deletions(-)

--- a/drivers/pci/pcie/aer/aer_inject.c
+++ b/drivers/pci/pcie/aer/aer_inject.c
@@ -283,20 +283,6 @@ out:
return 0;
 }
 
-static struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
-{
-   while (1) {
-   if (!pci_is_pcie(dev))
-   break;
-   if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-   return dev;
-   if (!dev->bus->self)
-   break;
-   dev = dev->bus->self;
-   }
-   return NULL;
-}
-
 static int find_aer_device_iter(struct device *device, void *data)
 {
struct pcie_device **result = data;
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1802,6 +1802,20 @@ static inline int pci_pcie_type(const st
return (pcie_caps_reg(dev) & PCI_EXP_FLAGS_TYPE) >> 4;
 }
 
+static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
+{
+   while (1) {
+   if (!pci_is_pcie(dev))
+   break;
+   if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
+   return dev;
+   if (!dev->bus->self)
+   break;
+   dev = dev->bus->self;
+   }
+   return NULL;
+}
+
 void pci_request_acs(void);
 bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
 bool pci_acs_path_enabled(struct pci_dev *start,

[PATCH 4.4 03/13] kasan: update kasan_global for gcc 7

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Vyukov 

commit 045d599a286bc01daa3510d59272440a17b23c2e upstream.

kasan_global struct is part of compiler/runtime ABI.  gcc revision
241983 has added a new field to kasan_global struct.  Update kernel
definition of kasan_global struct to include the new field.

Without this patch KASAN is broken with gcc 7.

Link: 
http://lkml.kernel.org/r/1479219743-28682-1-git-send-email-dvyu...@google.com
Signed-off-by: Dmitry Vyukov 
Acked-by: Andrey Ryabinin 
Cc: Alexander Potapenko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/compiler-gcc.h |4 +++-
 mm/kasan/kasan.h |3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -251,7 +251,9 @@
 #endif
 #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
 
-#if GCC_VERSION >= 5
+#if GCC_VERSION >= 7
+#define KASAN_ABI_VERSION 5
+#elif GCC_VERSION >= 5
 #define KASAN_ABI_VERSION 4
 #elif GCC_VERSION >= 40902
 #define KASAN_ABI_VERSION 3
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -52,6 +52,9 @@ struct kasan_global {
 #if KASAN_ABI_VERSION >= 4
struct kasan_source_location *location;
 #endif
+#if KASAN_ABI_VERSION >= 5
+   char *odr_indicator;
+#endif
 };
 
 static inline const void *kasan_shadow_to_mem(const void *shadow_addr)

[PATCH 4.4 07/13] PCI: Export pcie_find_root_port

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Johannes Thumshirn 

commit e784930bd645e7df78c66e7872fec282b0620075 upstream.

Export pcie_find_root_port() so we can use it outside of PCIe-AER error
injection.

Signed-off-by: Johannes Thumshirn 
Signed-off-by: Bjorn Helgaas 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pci/pcie/aer/aer_inject.c |   14 --
 include/linux/pci.h   |   14 ++
 2 files changed, 14 insertions(+), 14 deletions(-)

--- a/drivers/pci/pcie/aer/aer_inject.c
+++ b/drivers/pci/pcie/aer/aer_inject.c
@@ -283,20 +283,6 @@ out:
return 0;
 }
 
-static struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
-{
-   while (1) {
-   if (!pci_is_pcie(dev))
-   break;
-   if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-   return dev;
-   if (!dev->bus->self)
-   break;
-   dev = dev->bus->self;
-   }
-   return NULL;
-}
-
 static int find_aer_device_iter(struct device *device, void *data)
 {
struct pcie_device **result = data;
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1802,6 +1802,20 @@ static inline int pci_pcie_type(const st
return (pcie_caps_reg(dev) & PCI_EXP_FLAGS_TYPE) >> 4;
 }
 
+static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
+{
+   while (1) {
+   if (!pci_is_pcie(dev))
+   break;
+   if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
+   return dev;
+   if (!dev->bus->self)
+   break;
+   dev = dev->bus->self;
+   }
+   return NULL;
+}
+
 void pci_request_acs(void);
 bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
 bool pci_acs_path_enabled(struct pci_dev *start,

[PATCH 4.4 03/13] kasan: update kasan_global for gcc 7

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Vyukov 

commit 045d599a286bc01daa3510d59272440a17b23c2e upstream.

kasan_global struct is part of compiler/runtime ABI.  gcc revision
241983 has added a new field to kasan_global struct.  Update kernel
definition of kasan_global struct to include the new field.

Without this patch KASAN is broken with gcc 7.

Link: 
http://lkml.kernel.org/r/1479219743-28682-1-git-send-email-dvyu...@google.com
Signed-off-by: Dmitry Vyukov 
Acked-by: Andrey Ryabinin 
Cc: Alexander Potapenko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/compiler-gcc.h |4 +++-
 mm/kasan/kasan.h |3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -251,7 +251,9 @@
 #endif
 #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
 
-#if GCC_VERSION >= 5
+#if GCC_VERSION >= 7
+#define KASAN_ABI_VERSION 5
+#elif GCC_VERSION >= 5
 #define KASAN_ABI_VERSION 4
 #elif GCC_VERSION >= 40902
 #define KASAN_ABI_VERSION 3
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -52,6 +52,9 @@ struct kasan_global {
 #if KASAN_ABI_VERSION >= 4
struct kasan_source_location *location;
 #endif
+#if KASAN_ABI_VERSION >= 5
+   char *odr_indicator;
+#endif
 };
 
 static inline const void *kasan_shadow_to_mem(const void *shadow_addr)

[PATCH 4.8 12/35] Input: change KEY_DATA from 0x275 to 0x277

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ping Cheng 

commit 2425f1808123bf69a8f66d4ec90e0d0e302c2613 upstream.

0x275 is used by KEY_FASTREVERSE.

Fixes: 488326947cd1 ("Input: add HDMI CEC specific keycodes")
Signed-off-by: Ping Cheng 
Acked-by: Hans Verkuil 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman 

---
 include/uapi/linux/input-event-codes.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -640,7 +640,7 @@
  * Control a data application associated with the currently viewed channel,
  * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.)
  */
-#define KEY_DATA   0x275
+#define KEY_DATA   0x277
 
 #define BTN_TRIGGER_HAPPY  0x2c0
 #define BTN_TRIGGER_HAPPY1 0x2c0

[PATCH 4.8 10/35] mm: fix false-positive WARN_ON() in truncate/invalidate for hugetlb

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Kirill A. Shutemov 

commit 5cbc198ae08d84bd416b672ad8bd1222acd0855c upstream.

Hugetlb pages have ->index in size of the huge pages (PMD_SIZE or
PUD_SIZE), not in PAGE_SIZE as other types of pages.  This means we
cannot user page_to_pgoff() to check whether we've got the right page
for the radix-tree index.

Let's introduce page_to_index() which would return radix-tree index for
given page.

We will be able to get rid of this once hugetlb will be switched to
multi-order entries.

Fixes: fc127da085c2 ("truncate: handle file thp")
Link: 
http://lkml.kernel.org/r/20161123093053.mjbnvn5zwxw5e...@black.fi.intel.com
Signed-off-by: Kirill A. Shutemov 
Reported-by: Doug Nelson 
Tested-by: Doug Nelson 
Reviewed-by: Naoya Horiguchi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/pagemap.h |   21 +++--
 mm/truncate.c   |8 
 2 files changed, 19 insertions(+), 10 deletions(-)

--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -364,16 +364,13 @@ static inline struct page *read_mapping_
 }
 
 /*
- * Get the offset in PAGE_SIZE.
- * (TODO: hugepage should have ->index in PAGE_SIZE)
+ * Get index of the page with in radix-tree
+ * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE)
  */
-static inline pgoff_t page_to_pgoff(struct page *page)
+static inline pgoff_t page_to_index(struct page *page)
 {
pgoff_t pgoff;
 
-   if (unlikely(PageHeadHuge(page)))
-   return page->index << compound_order(page);
-
if (likely(!PageTransTail(page)))
return page->index;
 
@@ -387,6 +384,18 @@ static inline pgoff_t page_to_pgoff(stru
 }
 
 /*
+ * Get the offset in PAGE_SIZE.
+ * (TODO: hugepage should have ->index in PAGE_SIZE)
+ */
+static inline pgoff_t page_to_pgoff(struct page *page)
+{
+   if (unlikely(PageHeadHuge(page)))
+   return page->index << compound_order(page);
+
+   return page_to_index(page);
+}
+
+/*
  * Return byte-offset into filesystem object for page.
  */
 static inline loff_t page_offset(struct page *page)
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -283,7 +283,7 @@ void truncate_inode_pages_range(struct a
 
if (!trylock_page(page))
continue;
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
if (PageWriteback(page)) {
unlock_page(page);
continue;
@@ -371,7 +371,7 @@ void truncate_inode_pages_range(struct a
}
 
lock_page(page);
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
wait_on_page_writeback(page);
truncate_inode_page(mapping, page);
unlock_page(page);
@@ -492,7 +492,7 @@ unsigned long invalidate_mapping_pages(s
if (!trylock_page(page))
continue;
 
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
 
/* Middle of THP: skip */
if (PageTransTail(page)) {
@@ -612,7 +612,7 @@ int invalidate_inode_pages2_range(struct
}
 
lock_page(page);
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
if (page->mapping != mapping) {
unlock_page(page);
continue;

[PATCH 4.8 12/35] Input: change KEY_DATA from 0x275 to 0x277

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ping Cheng 

commit 2425f1808123bf69a8f66d4ec90e0d0e302c2613 upstream.

0x275 is used by KEY_FASTREVERSE.

Fixes: 488326947cd1 ("Input: add HDMI CEC specific keycodes")
Signed-off-by: Ping Cheng 
Acked-by: Hans Verkuil 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman 

---
 include/uapi/linux/input-event-codes.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -640,7 +640,7 @@
  * Control a data application associated with the currently viewed channel,
  * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.)
  */
-#define KEY_DATA   0x275
+#define KEY_DATA   0x277
 
 #define BTN_TRIGGER_HAPPY  0x2c0
 #define BTN_TRIGGER_HAPPY1 0x2c0

[PATCH 4.8 10/35] mm: fix false-positive WARN_ON() in truncate/invalidate for hugetlb

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Kirill A. Shutemov 

commit 5cbc198ae08d84bd416b672ad8bd1222acd0855c upstream.

Hugetlb pages have ->index in size of the huge pages (PMD_SIZE or
PUD_SIZE), not in PAGE_SIZE as other types of pages.  This means we
cannot user page_to_pgoff() to check whether we've got the right page
for the radix-tree index.

Let's introduce page_to_index() which would return radix-tree index for
given page.

We will be able to get rid of this once hugetlb will be switched to
multi-order entries.

Fixes: fc127da085c2 ("truncate: handle file thp")
Link: 
http://lkml.kernel.org/r/20161123093053.mjbnvn5zwxw5e...@black.fi.intel.com
Signed-off-by: Kirill A. Shutemov 
Reported-by: Doug Nelson 
Tested-by: Doug Nelson 
Reviewed-by: Naoya Horiguchi 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/pagemap.h |   21 +++--
 mm/truncate.c   |8 
 2 files changed, 19 insertions(+), 10 deletions(-)

--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -364,16 +364,13 @@ static inline struct page *read_mapping_
 }
 
 /*
- * Get the offset in PAGE_SIZE.
- * (TODO: hugepage should have ->index in PAGE_SIZE)
+ * Get index of the page with in radix-tree
+ * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE)
  */
-static inline pgoff_t page_to_pgoff(struct page *page)
+static inline pgoff_t page_to_index(struct page *page)
 {
pgoff_t pgoff;
 
-   if (unlikely(PageHeadHuge(page)))
-   return page->index << compound_order(page);
-
if (likely(!PageTransTail(page)))
return page->index;
 
@@ -387,6 +384,18 @@ static inline pgoff_t page_to_pgoff(stru
 }
 
 /*
+ * Get the offset in PAGE_SIZE.
+ * (TODO: hugepage should have ->index in PAGE_SIZE)
+ */
+static inline pgoff_t page_to_pgoff(struct page *page)
+{
+   if (unlikely(PageHeadHuge(page)))
+   return page->index << compound_order(page);
+
+   return page_to_index(page);
+}
+
+/*
  * Return byte-offset into filesystem object for page.
  */
 static inline loff_t page_offset(struct page *page)
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -283,7 +283,7 @@ void truncate_inode_pages_range(struct a
 
if (!trylock_page(page))
continue;
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
if (PageWriteback(page)) {
unlock_page(page);
continue;
@@ -371,7 +371,7 @@ void truncate_inode_pages_range(struct a
}
 
lock_page(page);
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
wait_on_page_writeback(page);
truncate_inode_page(mapping, page);
unlock_page(page);
@@ -492,7 +492,7 @@ unsigned long invalidate_mapping_pages(s
if (!trylock_page(page))
continue;
 
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
 
/* Middle of THP: skip */
if (PageTransTail(page)) {
@@ -612,7 +612,7 @@ int invalidate_inode_pages2_range(struct
}
 
lock_page(page);
-   WARN_ON(page_to_pgoff(page) != index);
+   WARN_ON(page_to_index(page) != index);
if (page->mapping != mapping) {
unlock_page(page);
continue;

[PATCH 4.8 14/35] rcu: Fix soft lockup for rcu_nocb_kthread

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ding Tianhong 

commit bedc1969150d480c462cdac320fa944b694a7162 upstream.

Carrying out the following steps results in a softlockup in the
RCU callback-offload (rcuo) kthreads:

1. Connect to ixgbevf, and set the speed to 10Gb/s.
2. Use ifconfig to bring the nic up and down repeatedly.

[  317.005148] IPv6: ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready
[  368.106005] BUG: soft lockup - CPU#1 stuck for 22s! [rcuos/1:15]
[  368.106005] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  368.106005] task: 88057dd8a220 ti: 88057dd9c000 task.ti: 
88057dd9c000
[  368.106005] RIP: 0010:[]  [] 
fib_table_lookup+0x14/0x390
[  368.106005] RSP: 0018:88061fc83ce8  EFLAGS: 0286
[  368.106005] RAX: 0001 RBX: 020155c0 RCX: 0001
[  368.106005] RDX: 88061fc83d50 RSI: 88061fc83d70 RDI: 880036d11a00
[  368.106005] RBP: 88061fc83d08 R08: 0001 R09: 
[  368.106005] R10: 880036d11a00 R11: 819e0900 R12: 88061fc83c58
[  368.106005] R13: 816154dd R14: 88061fc83d08 R15: 020155c0
[  368.106005] FS:  () GS:88061fc8() 
knlGS:
[  368.106005] CS:  0010 DS:  ES:  CR0: 80050033
[  368.106005] CR2: 7f8c2aee9c40 CR3: 00057b222000 CR4: 000407e0
[  368.106005] DR0:  DR1:  DR2: 
[  368.106005] DR3:  DR6: 0ff0 DR7: 0400
[  368.106005] Stack:
[  368.106005]  01c0 88057b766000 8802e380b000 
88057af03e00
[  368.106005]  88061fc83dc0 815349a6 88061fc83d40 
814ee146
[  368.106005]  8802e380af00 e380af00 819e0900 
020155c001c0
[  368.106005] Call Trace:
[  368.106005]  
[  368.106005]
[  368.106005]  [] ip_route_input_noref+0x516/0xbd0
[  368.106005]  [] ? skb_release_data+0xd6/0x110
[  368.106005]  [] ? kfree_skb+0x3a/0xa0
[  368.106005]  [] ip_rcv_finish+0x29f/0x350
[  368.106005]  [] ip_rcv+0x234/0x380
[  368.106005]  [] __netif_receive_skb_core+0x676/0x870
[  368.106005]  [] __netif_receive_skb+0x18/0x60
[  368.106005]  [] process_backlog+0xae/0x180
[  368.106005]  [] net_rx_action+0x152/0x240
[  368.106005]  [] __do_softirq+0xef/0x280
[  368.106005]  [] call_softirq+0x1c/0x30
[  368.106005]  
[  368.106005]
[  368.106005]  [] do_softirq+0x65/0xa0
[  368.106005]  [] local_bh_enable+0x94/0xa0
[  368.106005]  [] rcu_nocb_kthread+0x232/0x370
[  368.106005]  [] ? wake_up_bit+0x30/0x30
[  368.106005]  [] ? rcu_start_gp+0x40/0x40
[  368.106005]  [] kthread+0xcf/0xe0
[  368.106005]  [] ? kthread_create_on_node+0x140/0x140
[  368.106005]  [] ret_from_fork+0x58/0x90
[  368.106005]  [] ? kthread_create_on_node+0x140/0x140

==cut here==

It turns out that the rcuos callback-offload kthread is busy processing
a very large quantity of RCU callbacks, and it is not reliquishing the
CPU while doing so.  This commit therefore adds an cond_resched_rcu_qs()
within the loop to allow other tasks to run.

Signed-off-by: Ding Tianhong 
[ paulmck: Substituted cond_resched_rcu_qs for cond_resched. ]
Signed-off-by: Paul E. McKenney 
Cc: Dhaval Giani 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/rcu/tree_plugin.h |1 +
 1 file changed, 1 insertion(+)

--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2173,6 +2173,7 @@ static int rcu_nocb_kthread(void *arg)
cl++;
c++;
local_bh_enable();
+   cond_resched_rcu_qs();
list = next;
}
trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1);

[PATCH 4.8 18/35] mwifiex: printk() overflow with 32-byte SSIDs

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Brian Norris 

commit fcd2042e8d36cf644bd2d69c26378d17158b17df upstream.

SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
when we print them out.

This can be easily noticed by connecting to a network with a 32-octet
SSID:

[ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
'0123456789abcdef0123456789abcdef ' bssid
xx:xx:xx:xx:xx:xx

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex 
driver")
Signed-off-by: Brian Norris 
Acked-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c |   13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2203,8 +2203,9 @@ done:
is_scanning_required = 1;
} else {
mwifiex_dbg(priv->adapter, MSG,
-   "info: trying to associate to '%s' bssid 
%pM\n",
-   (char *)req_ssid.ssid, bss->bssid);
+   "info: trying to associate to '%.*s' bssid 
%pM\n",
+   req_ssid.ssid_len, (char *)req_ssid.ssid,
+   bss->bssid);
memcpy(>cfg_bssid, bss->bssid, ETH_ALEN);
break;
}
@@ -2264,8 +2265,8 @@ mwifiex_cfg80211_connect(struct wiphy *w
}
 
mwifiex_dbg(adapter, INFO,
-   "info: Trying to associate to %s and bssid %pM\n",
-   (char *)sme->ssid, sme->bssid);
+   "info: Trying to associate to %.*s and bssid %pM\n",
+   (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
if (!mwifiex_stop_bg_scan(priv))
cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2398,8 +2399,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy
}
 
mwifiex_dbg(priv->adapter, MSG,
-   "info: trying to join to %s and bssid %pM\n",
-   (char *)params->ssid, params->bssid);
+   "info: trying to join to %.*s and bssid %pM\n",
+   params->ssid_len, (char *)params->ssid, params->bssid);
 
mwifiex_set_ibss_params(priv, params);
 

[PATCH 4.8 14/35] rcu: Fix soft lockup for rcu_nocb_kthread

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ding Tianhong 

commit bedc1969150d480c462cdac320fa944b694a7162 upstream.

Carrying out the following steps results in a softlockup in the
RCU callback-offload (rcuo) kthreads:

1. Connect to ixgbevf, and set the speed to 10Gb/s.
2. Use ifconfig to bring the nic up and down repeatedly.

[  317.005148] IPv6: ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready
[  368.106005] BUG: soft lockup - CPU#1 stuck for 22s! [rcuos/1:15]
[  368.106005] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  368.106005] task: 88057dd8a220 ti: 88057dd9c000 task.ti: 
88057dd9c000
[  368.106005] RIP: 0010:[]  [] 
fib_table_lookup+0x14/0x390
[  368.106005] RSP: 0018:88061fc83ce8  EFLAGS: 0286
[  368.106005] RAX: 0001 RBX: 020155c0 RCX: 0001
[  368.106005] RDX: 88061fc83d50 RSI: 88061fc83d70 RDI: 880036d11a00
[  368.106005] RBP: 88061fc83d08 R08: 0001 R09: 
[  368.106005] R10: 880036d11a00 R11: 819e0900 R12: 88061fc83c58
[  368.106005] R13: 816154dd R14: 88061fc83d08 R15: 020155c0
[  368.106005] FS:  () GS:88061fc8() 
knlGS:
[  368.106005] CS:  0010 DS:  ES:  CR0: 80050033
[  368.106005] CR2: 7f8c2aee9c40 CR3: 00057b222000 CR4: 000407e0
[  368.106005] DR0:  DR1:  DR2: 
[  368.106005] DR3:  DR6: 0ff0 DR7: 0400
[  368.106005] Stack:
[  368.106005]  01c0 88057b766000 8802e380b000 
88057af03e00
[  368.106005]  88061fc83dc0 815349a6 88061fc83d40 
814ee146
[  368.106005]  8802e380af00 e380af00 819e0900 
020155c001c0
[  368.106005] Call Trace:
[  368.106005]  
[  368.106005]
[  368.106005]  [] ip_route_input_noref+0x516/0xbd0
[  368.106005]  [] ? skb_release_data+0xd6/0x110
[  368.106005]  [] ? kfree_skb+0x3a/0xa0
[  368.106005]  [] ip_rcv_finish+0x29f/0x350
[  368.106005]  [] ip_rcv+0x234/0x380
[  368.106005]  [] __netif_receive_skb_core+0x676/0x870
[  368.106005]  [] __netif_receive_skb+0x18/0x60
[  368.106005]  [] process_backlog+0xae/0x180
[  368.106005]  [] net_rx_action+0x152/0x240
[  368.106005]  [] __do_softirq+0xef/0x280
[  368.106005]  [] call_softirq+0x1c/0x30
[  368.106005]  
[  368.106005]
[  368.106005]  [] do_softirq+0x65/0xa0
[  368.106005]  [] local_bh_enable+0x94/0xa0
[  368.106005]  [] rcu_nocb_kthread+0x232/0x370
[  368.106005]  [] ? wake_up_bit+0x30/0x30
[  368.106005]  [] ? rcu_start_gp+0x40/0x40
[  368.106005]  [] kthread+0xcf/0xe0
[  368.106005]  [] ? kthread_create_on_node+0x140/0x140
[  368.106005]  [] ret_from_fork+0x58/0x90
[  368.106005]  [] ? kthread_create_on_node+0x140/0x140

==cut here==

It turns out that the rcuos callback-offload kthread is busy processing
a very large quantity of RCU callbacks, and it is not reliquishing the
CPU while doing so.  This commit therefore adds an cond_resched_rcu_qs()
within the loop to allow other tasks to run.

Signed-off-by: Ding Tianhong 
[ paulmck: Substituted cond_resched_rcu_qs for cond_resched. ]
Signed-off-by: Paul E. McKenney 
Cc: Dhaval Giani 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/rcu/tree_plugin.h |1 +
 1 file changed, 1 insertion(+)

--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2173,6 +2173,7 @@ static int rcu_nocb_kthread(void *arg)
cl++;
c++;
local_bh_enable();
+   cond_resched_rcu_qs();
list = next;
}
trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1);

[PATCH 4.8 18/35] mwifiex: printk() overflow with 32-byte SSIDs

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Brian Norris 

commit fcd2042e8d36cf644bd2d69c26378d17158b17df upstream.

SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
when we print them out.

This can be easily noticed by connecting to a network with a 32-octet
SSID:

[ 3903.502925] mwifiex_pcie :01:00.0: info: trying to associate to
'0123456789abcdef0123456789abcdef ' bssid
xx:xx:xx:xx:xx:xx

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex 
driver")
Signed-off-by: Brian Norris 
Acked-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c |   13 +++--
 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2203,8 +2203,9 @@ done:
is_scanning_required = 1;
} else {
mwifiex_dbg(priv->adapter, MSG,
-   "info: trying to associate to '%s' bssid 
%pM\n",
-   (char *)req_ssid.ssid, bss->bssid);
+   "info: trying to associate to '%.*s' bssid 
%pM\n",
+   req_ssid.ssid_len, (char *)req_ssid.ssid,
+   bss->bssid);
memcpy(>cfg_bssid, bss->bssid, ETH_ALEN);
break;
}
@@ -2264,8 +2265,8 @@ mwifiex_cfg80211_connect(struct wiphy *w
}
 
mwifiex_dbg(adapter, INFO,
-   "info: Trying to associate to %s and bssid %pM\n",
-   (char *)sme->ssid, sme->bssid);
+   "info: Trying to associate to %.*s and bssid %pM\n",
+   (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
if (!mwifiex_stop_bg_scan(priv))
cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2398,8 +2399,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy
}
 
mwifiex_dbg(priv->adapter, MSG,
-   "info: trying to join to %s and bssid %pM\n",
-   (char *)params->ssid, params->bssid);
+   "info: trying to join to %.*s and bssid %pM\n",
+   params->ssid_len, (char *)params->ssid, params->bssid);
 
mwifiex_set_ibss_params(priv, params);
 

[PATCH 4.8 24/35] drm/amdgpu: fix check for port PM availability

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Wu 

commit 7ac33e47d5769632010e537964c7e45498f8dc26 upstream.

The ATPX method does not always exist on the dGPU, it may be located at
the iGPU. The parent device of the iGPU is the root port for which
bridge_d3 is false. This accidentally enables the legacy PM method which
conflicts with port PM and prevented the dGPU from powering on.

Fixes: 1db4496f167b ("drm/amdgpu: fix power state when port pm is unavailable")

Reported-and-tested-by: Mike Lothian 
Signed-off-by: Peter Wu 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c |   11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -476,7 +476,6 @@ static int amdgpu_atpx_power_state(enum
  */
 static bool amdgpu_atpx_pci_probe_handle(struct pci_dev *pdev)
 {
-   struct pci_dev *parent_pdev = pci_upstream_bridge(pdev);
acpi_handle dhandle, atpx_handle;
acpi_status status;
 
@@ -491,7 +490,6 @@ static bool amdgpu_atpx_pci_probe_handle
}
amdgpu_atpx_priv.dhandle = dhandle;
amdgpu_atpx_priv.atpx.handle = atpx_handle;
-   amdgpu_atpx_priv.bridge_pm_usable = parent_pdev && 
parent_pdev->bridge_d3;
return true;
 }
 
@@ -553,17 +551,25 @@ static bool amdgpu_atpx_detect(void)
struct pci_dev *pdev = NULL;
bool has_atpx = false;
int vga_count = 0;
+   bool d3_supported = false;
+   struct pci_dev *parent_pdev;
 
while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != 
NULL) {
vga_count++;
 
has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+
+   parent_pdev = pci_upstream_bridge(pdev);
+   d3_supported |= parent_pdev && parent_pdev->bridge_d3;
}
 
while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != 
NULL) {
vga_count++;
 
has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+
+   parent_pdev = pci_upstream_bridge(pdev);
+   d3_supported |= parent_pdev && parent_pdev->bridge_d3;
}
 
if (has_atpx && vga_count == 2) {
@@ -571,6 +577,7 @@ static bool amdgpu_atpx_detect(void)
printk(KERN_INFO "vga_switcheroo: detected switching method %s 
handle\n",
   acpi_method_name);
amdgpu_atpx_priv.atpx_detected = true;
+   amdgpu_atpx_priv.bridge_pm_usable = d3_supported;
amdgpu_atpx_init();
return true;
}

[PATCH 4.8 20/35] drm/i915: Dont touch NULL sg on i915_gem_object_get_pages_gtt() error

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Chris Wilson 

commit 2420489bcb8910188578acc0c11c75445c2e4b92 upstream.

On the DMA mapping error path, sg may be NULL (it has already been
marked as the last scatterlist entry), and we should avoid dereferencing
it again.

Reported-by: Dan Carpenter 
Fixes: e227330223a7 ("drm/i915: avoid leaking DMA mappings")
Signed-off-by: Chris Wilson 
Cc: Imre Deak 
Link: 
http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-ch...@chris-wilson.co.uk
Reviewed-by: Matthew Auld 
(cherry picked from commit b17993b7b29612369270567643bcff814f4b3d7f)
Signed-off-by: Jani Nikula 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/i915/i915_gem.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm
page = shmem_read_mapping_page(mapping, i);
if (IS_ERR(page)) {
ret = PTR_ERR(page);
-   goto err_pages;
+   goto err_sg;
}
}
 #ifdef CONFIG_SWIOTLB
@@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm
 
return 0;
 
-err_pages:
+err_sg:
sg_mark_end(sg);
+err_pages:
for_each_sgt_page(page, sgt_iter, st)
put_page(page);
sg_free_table(st);

[PATCH 4.8 24/35] drm/amdgpu: fix check for port PM availability

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Wu 

commit 7ac33e47d5769632010e537964c7e45498f8dc26 upstream.

The ATPX method does not always exist on the dGPU, it may be located at
the iGPU. The parent device of the iGPU is the root port for which
bridge_d3 is false. This accidentally enables the legacy PM method which
conflicts with port PM and prevented the dGPU from powering on.

Fixes: 1db4496f167b ("drm/amdgpu: fix power state when port pm is unavailable")

Reported-and-tested-by: Mike Lothian 
Signed-off-by: Peter Wu 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c |   11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -476,7 +476,6 @@ static int amdgpu_atpx_power_state(enum
  */
 static bool amdgpu_atpx_pci_probe_handle(struct pci_dev *pdev)
 {
-   struct pci_dev *parent_pdev = pci_upstream_bridge(pdev);
acpi_handle dhandle, atpx_handle;
acpi_status status;
 
@@ -491,7 +490,6 @@ static bool amdgpu_atpx_pci_probe_handle
}
amdgpu_atpx_priv.dhandle = dhandle;
amdgpu_atpx_priv.atpx.handle = atpx_handle;
-   amdgpu_atpx_priv.bridge_pm_usable = parent_pdev && 
parent_pdev->bridge_d3;
return true;
 }
 
@@ -553,17 +551,25 @@ static bool amdgpu_atpx_detect(void)
struct pci_dev *pdev = NULL;
bool has_atpx = false;
int vga_count = 0;
+   bool d3_supported = false;
+   struct pci_dev *parent_pdev;
 
while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != 
NULL) {
vga_count++;
 
has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+
+   parent_pdev = pci_upstream_bridge(pdev);
+   d3_supported |= parent_pdev && parent_pdev->bridge_d3;
}
 
while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != 
NULL) {
vga_count++;
 
has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
+
+   parent_pdev = pci_upstream_bridge(pdev);
+   d3_supported |= parent_pdev && parent_pdev->bridge_d3;
}
 
if (has_atpx && vga_count == 2) {
@@ -571,6 +577,7 @@ static bool amdgpu_atpx_detect(void)
printk(KERN_INFO "vga_switcheroo: detected switching method %s 
handle\n",
   acpi_method_name);
amdgpu_atpx_priv.atpx_detected = true;
+   amdgpu_atpx_priv.bridge_pm_usable = d3_supported;
amdgpu_atpx_init();
return true;
}

[PATCH 4.8 20/35] drm/i915: Dont touch NULL sg on i915_gem_object_get_pages_gtt() error

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Chris Wilson 

commit 2420489bcb8910188578acc0c11c75445c2e4b92 upstream.

On the DMA mapping error path, sg may be NULL (it has already been
marked as the last scatterlist entry), and we should avoid dereferencing
it again.

Reported-by: Dan Carpenter 
Fixes: e227330223a7 ("drm/i915: avoid leaking DMA mappings")
Signed-off-by: Chris Wilson 
Cc: Imre Deak 
Link: 
http://patchwork.freedesktop.org/patch/msgid/20161114112930.2033-1-ch...@chris-wilson.co.uk
Reviewed-by: Matthew Auld 
(cherry picked from commit b17993b7b29612369270567643bcff814f4b3d7f)
Signed-off-by: Jani Nikula 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/i915/i915_gem.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm
page = shmem_read_mapping_page(mapping, i);
if (IS_ERR(page)) {
ret = PTR_ERR(page);
-   goto err_pages;
+   goto err_sg;
}
}
 #ifdef CONFIG_SWIOTLB
@@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm
 
return 0;
 
-err_pages:
+err_sg:
sg_mark_end(sg);
+err_pages:
for_each_sgt_page(page, sgt_iter, st)
put_page(page);
sg_free_table(st);

[PATCH 4.8 04/35] ARC: mm: PAE40: Fix crash at munmap

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Yuriy Kolerov 

commit 6a8b2ca702b279bea0e8f0363056439352e2081c upstream.

commit 1c3c90930392 broke PAE40. Macro pfn_pte(pfn, prot) creates paddr
from pfn, but the page shift was getting truncated to 32 bits since we lost
the proper cast to 64 bits (for PAE400

Instead of reverting that commit, use a better helper which is 32/64 bits
safe just like ARM implementation.

Fixes: 1c3c90930392 ("ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS")
Signed-off-by: Yuriy Kolerov 
[vgupta: massaged changelog]
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/include/asm/pgtable.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp,
 
 #define pte_page(pte)  pfn_to_page(pte_pfn(pte))
 #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot)
-#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
+#define pfn_pte(pfn, prot) __pte(__pfn_to_phys(pfn) | pgprot_val(prot))
 
 /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
 #define pte_pfn(pte)   (pte_val(pte) >> PAGE_SHIFT)

[PATCH 4.8 35/35] arm64: suspend: Reconfigure PSTATE after resume from idle

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: James Morse 

commit d08544127d9fb4505635e3cb6871fd50a42947bd upstream.

The suspend/resume path in kernel/sleep.S, as used by cpu-idle, does not
save/restore PSTATE. As a result of this cpufeatures that were detected
and have bits in PSTATE get lost when we resume from idle.

UAO gets set appropriately on the next context switch. PAN will be
re-enabled next time we return from user-space, but on a preemptible
kernel we may run work accessing user space before this point.

Add code to re-enable theses two features in __cpu_suspend_exit().
We re-use uao_thread_switch() passing current.

Signed-off-by: James Morse 
Cc: Lorenzo Pieralisi 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/include/asm/exec.h |3 +++
 arch/arm64/kernel/process.c   |3 ++-
 arch/arm64/kernel/suspend.c   |   11 +++
 3 files changed, 16 insertions(+), 1 deletion(-)

--- a/arch/arm64/include/asm/exec.h
+++ b/arch/arm64/include/asm/exec.h
@@ -18,6 +18,9 @@
 #ifndef __ASM_EXEC_H
 #define __ASM_EXEC_H
 
+#include 
+
 extern unsigned long arch_align_stack(unsigned long sp);
+void uao_thread_switch(struct task_struct *next);
 
 #endif /* __ASM_EXEC_H */
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -49,6 +49,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -303,7 +304,7 @@ static void tls_thread_switch(struct tas
 }
 
 /* Restore the UAO state depending on next's addr_limit */
-static void uao_thread_switch(struct task_struct *next)
+void uao_thread_switch(struct task_struct *next)
 {
if (IS_ENABLED(CONFIG_ARM64_UAO)) {
if (task_thread_info(next)->addr_limit == KERNEL_DS)
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -1,8 +1,11 @@
 #include 
 #include 
 #include 
+#include 
 #include 
+#include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -48,6 +51,14 @@ void notrace __cpu_suspend_exit(void)
set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
 
/*
+* PSTATE was not saved over suspend/resume, re-enable any detected
+* features that might not have been set correctly.
+*/
+   asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN,
+   CONFIG_ARM64_PAN));
+   uao_thread_switch(current);
+
+   /*
 * Restore HW breakpoint registers to sane values
 * before debug exceptions are possibly reenabled
 * through local_dbg_restore.

[PATCH 4.8 04/35] ARC: mm: PAE40: Fix crash at munmap

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Yuriy Kolerov 

commit 6a8b2ca702b279bea0e8f0363056439352e2081c upstream.

commit 1c3c90930392 broke PAE40. Macro pfn_pte(pfn, prot) creates paddr
from pfn, but the page shift was getting truncated to 32 bits since we lost
the proper cast to 64 bits (for PAE400

Instead of reverting that commit, use a better helper which is 32/64 bits
safe just like ARM implementation.

Fixes: 1c3c90930392 ("ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS")
Signed-off-by: Yuriy Kolerov 
[vgupta: massaged changelog]
Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/include/asm/pgtable.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp,
 
 #define pte_page(pte)  pfn_to_page(pte_pfn(pte))
 #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot)
-#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
+#define pfn_pte(pfn, prot) __pte(__pfn_to_phys(pfn) | pgprot_val(prot))
 
 /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
 #define pte_pfn(pte)   (pte_val(pte) >> PAGE_SHIFT)

[PATCH 4.8 35/35] arm64: suspend: Reconfigure PSTATE after resume from idle

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: James Morse 

commit d08544127d9fb4505635e3cb6871fd50a42947bd upstream.

The suspend/resume path in kernel/sleep.S, as used by cpu-idle, does not
save/restore PSTATE. As a result of this cpufeatures that were detected
and have bits in PSTATE get lost when we resume from idle.

UAO gets set appropriately on the next context switch. PAN will be
re-enabled next time we return from user-space, but on a preemptible
kernel we may run work accessing user space before this point.

Add code to re-enable theses two features in __cpu_suspend_exit().
We re-use uao_thread_switch() passing current.

Signed-off-by: James Morse 
Cc: Lorenzo Pieralisi 
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/include/asm/exec.h |3 +++
 arch/arm64/kernel/process.c   |3 ++-
 arch/arm64/kernel/suspend.c   |   11 +++
 3 files changed, 16 insertions(+), 1 deletion(-)

--- a/arch/arm64/include/asm/exec.h
+++ b/arch/arm64/include/asm/exec.h
@@ -18,6 +18,9 @@
 #ifndef __ASM_EXEC_H
 #define __ASM_EXEC_H
 
+#include 
+
 extern unsigned long arch_align_stack(unsigned long sp);
+void uao_thread_switch(struct task_struct *next);
 
 #endif /* __ASM_EXEC_H */
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -49,6 +49,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -303,7 +304,7 @@ static void tls_thread_switch(struct tas
 }
 
 /* Restore the UAO state depending on next's addr_limit */
-static void uao_thread_switch(struct task_struct *next)
+void uao_thread_switch(struct task_struct *next)
 {
if (IS_ENABLED(CONFIG_ARM64_UAO)) {
if (task_thread_info(next)->addr_limit == KERNEL_DS)
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -1,8 +1,11 @@
 #include 
 #include 
 #include 
+#include 
 #include 
+#include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -48,6 +51,14 @@ void notrace __cpu_suspend_exit(void)
set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
 
/*
+* PSTATE was not saved over suspend/resume, re-enable any detected
+* features that might not have been set correctly.
+*/
+   asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN,
+   CONFIG_ARM64_PAN));
+   uao_thread_switch(current);
+
+   /*
 * Restore HW breakpoint registers to sane values
 * before debug exceptions are possibly reenabled
 * through local_dbg_restore.

[tip:sched/core]: Assigning high priority to Foreground process group (occupied in the current screen) .

[Lakshmanan Sundaram]

tip:sched/core: Assigning high priority to Foreground process group
(occupied in the current screen) .

What You See (in screen) Should Always Execute Faster .

In the multitasking environment, though all the cpu bound processes
are running,The foreground process group should be assigned with high
priority.
User will always feel what they see in the current screen.

Please let me know if more explanation is required on this.

Regards
S.Lakshmanan.

[PATCH 4.8 32/35] batman-adv: Detect missing primaryif during tp_send as error

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Eckelmann 

commit e13258f38e927b61cdb5f4ad25309450d3b127d1 upstream.

The throughput meter detects different situations as problems for the
current test. It stops the test after these and reports it to userspace.
This also has to be done when the primary interface disappeared during the
test.

Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation")
Reported-by: Joe Perches 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich 
Signed-off-by: Greg Kroah-Hartman 

---
 net/batman-adv/tp_meter.c |1 +
 1 file changed, 1 insertion(+)

--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -837,6 +837,7 @@ static int batadv_tp_send(void *arg)
primary_if = batadv_primary_if_get_selected(bat_priv);
if (unlikely(!primary_if)) {
err = BATADV_TP_REASON_DST_UNREACHABLE;
+   tp_vars->reason = err;
goto out;
}
 

[PATCH 4.8 07/35] thp: fix corner case of munlock() of PTE-mapped THPs

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Kirill A. Shutemov 

commit 655548bf6271b212cd1e4c259da9dbe616348d38 upstream.

The following program triggers BUG() in munlock_vma_pages_range():

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include 

int main()
{
  mmap((void*)0x20105000ul, 0xc0ul, 0x2ul, 0x2172ul, -1, 0);
  mremap((void*)0x201fd000ul, 0x4000ul, 0xc0ul, 0x3ul, 
0x203ful);
  return 0;
}

The test-case constructs the situation when munlock_vma_pages_range()
finds PTE-mapped THP-head in the middle of page table and, by mistake,
skips HPAGE_PMD_NR pages after that.

As result, on the next iteration it hits the middle of PMD-mapped THP
and gets upset seeing mlocked tail page.

The solution is only skip HPAGE_PMD_NR pages if the THP was mlocked
during munlock_vma_page().  It would guarantee that the page is
PMD-mapped as we never mlock PTE-mapeed THPs.

Fixes: e90309c9f772 ("thp: allow mlocked THP again")
Link: 
http://lkml.kernel.org/r/20161115132703.7s7rrgmwttegc...@black.fi.intel.com
Signed-off-by: Kirill A. Shutemov 
Reported-by: Dmitry Vyukov 
Cc: Konstantin Khlebnikov 
Cc: Andrey Ryabinin 
Cc: syzkaller 
Cc: Andrea Arcangeli 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/mlock.c |7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -190,10 +190,13 @@ unsigned int munlock_vma_page(struct pag
 */
spin_lock_irq(zone_lru_lock(zone));
 
-   nr_pages = hpage_nr_pages(page);
-   if (!TestClearPageMlocked(page))
+   if (!TestClearPageMlocked(page)) {
+   /* Potentially, PTE-mapped THP: do not skip the rest PTEs */
+   nr_pages = 1;
goto unlock_out;
+   }
 
+   nr_pages = hpage_nr_pages(page);
__mod_zone_page_state(zone, NR_MLOCK, -nr_pages);
 
if (__munlock_isolate_lru_page(page, true)) {

[tip:sched/core]: Assigning high priority to Foreground process group (occupied in the current screen) .

[Lakshmanan Sundaram]

tip:sched/core: Assigning high priority to Foreground process group
(occupied in the current screen) .

What You See (in screen) Should Always Execute Faster .

In the multitasking environment, though all the cpu bound processes
are running,The foreground process group should be assigned with high
priority.
User will always feel what they see in the current screen.

Please let me know if more explanation is required on this.

Regards
S.Lakshmanan.

[PATCH 4.8 32/35] batman-adv: Detect missing primaryif during tp_send as error

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sven Eckelmann 

commit e13258f38e927b61cdb5f4ad25309450d3b127d1 upstream.

The throughput meter detects different situations as problems for the
current test. It stops the test after these and reports it to userspace.
This also has to be done when the primary interface disappeared during the
test.

Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation")
Reported-by: Joe Perches 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich 
Signed-off-by: Greg Kroah-Hartman 

---
 net/batman-adv/tp_meter.c |1 +
 1 file changed, 1 insertion(+)

--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -837,6 +837,7 @@ static int batadv_tp_send(void *arg)
primary_if = batadv_primary_if_get_selected(bat_priv);
if (unlikely(!primary_if)) {
err = BATADV_TP_REASON_DST_UNREACHABLE;
+   tp_vars->reason = err;
goto out;
}
 

[PATCH 4.8 07/35] thp: fix corner case of munlock() of PTE-mapped THPs

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Kirill A. Shutemov 

commit 655548bf6271b212cd1e4c259da9dbe616348d38 upstream.

The following program triggers BUG() in munlock_vma_pages_range():

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include 

int main()
{
  mmap((void*)0x20105000ul, 0xc0ul, 0x2ul, 0x2172ul, -1, 0);
  mremap((void*)0x201fd000ul, 0x4000ul, 0xc0ul, 0x3ul, 
0x203ful);
  return 0;
}

The test-case constructs the situation when munlock_vma_pages_range()
finds PTE-mapped THP-head in the middle of page table and, by mistake,
skips HPAGE_PMD_NR pages after that.

As result, on the next iteration it hits the middle of PMD-mapped THP
and gets upset seeing mlocked tail page.

The solution is only skip HPAGE_PMD_NR pages if the THP was mlocked
during munlock_vma_page().  It would guarantee that the page is
PMD-mapped as we never mlock PTE-mapeed THPs.

Fixes: e90309c9f772 ("thp: allow mlocked THP again")
Link: 
http://lkml.kernel.org/r/20161115132703.7s7rrgmwttegc...@black.fi.intel.com
Signed-off-by: Kirill A. Shutemov 
Reported-by: Dmitry Vyukov 
Cc: Konstantin Khlebnikov 
Cc: Andrey Ryabinin 
Cc: syzkaller 
Cc: Andrea Arcangeli 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/mlock.c |7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -190,10 +190,13 @@ unsigned int munlock_vma_page(struct pag
 */
spin_lock_irq(zone_lru_lock(zone));
 
-   nr_pages = hpage_nr_pages(page);
-   if (!TestClearPageMlocked(page))
+   if (!TestClearPageMlocked(page)) {
+   /* Potentially, PTE-mapped THP: do not skip the rest PTEs */
+   nr_pages = 1;
goto unlock_out;
+   }
 
+   nr_pages = hpage_nr_pages(page);
__mod_zone_page_state(zone, NR_MLOCK, -nr_pages);
 
if (__munlock_isolate_lru_page(page, true)) {

[PATCH 4.8 03/35] scsi: libfc: fix seconds_since_last_reset miscalculation

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Johannes Thumshirn 

commit 208da78e8ec8b6d6ce3747ab0e5c120458e08ae6 upstream.

Commit 540eb1eef0ab ("scsi: libfc: fix seconds_since_last_reset calculation")
removed the use of 'struct timespec' from fc_get_host_stats(). This broke the
output of 'fcoeadm -s' after kernel 4.8-rc1.

Signed-off-by: Johannes Thumshirn 
Fixes: 540eb1eef0ab ("scsi: libfc: fix seconds_since_last_reset calculation")
Acked-by: Arnd Bergmann 
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/libfc/fc_lport.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -308,7 +308,7 @@ struct fc_host_statistics *fc_get_host_s
fc_stats = >host_stats;
memset(fc_stats, 0, sizeof(struct fc_host_statistics));
 
-   fc_stats->seconds_since_last_reset = (lport->boot_time - jiffies) / HZ;
+   fc_stats->seconds_since_last_reset = (jiffies - lport->boot_time) / HZ;
 
for_each_possible_cpu(cpu) {
struct fc_stats *stats;

[PATCH 4.8 02/35] scsi: hpsa: use bus 3 for legacy HBA devices

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Hannes Reinecke 

commit 7630b3a599e2c6d1c042945d32ff2debc855ad29 upstream.

Older controllers use SCSI target id '0' for the first internal disk. As
the controllers are now placed on the same bus as the internal disks
this leads to a clash with the SCSI target id of controller.  This patch
checks the SCSI revision, and moves older controller to bus '3' to be
compatible with older releases and avoid this problem.

[mkp: fixed uninitialized variable]

Fixes: 09371d623c9 ("hpsa: Change SAS transport devices to bus 0.")
Signed-off-by: Hannes Reinecke 
Acked-by: Don Brace 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/hpsa.c |   16 +++-
 drivers/scsi/hpsa.h |2 ++
 2 files changed, 13 insertions(+), 5 deletions(-)

--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2007,7 +2007,7 @@ static struct hpsa_scsi_dev_t *lookup_hp
 
 static int hpsa_slave_alloc(struct scsi_device *sdev)
 {
-   struct hpsa_scsi_dev_t *sd;
+   struct hpsa_scsi_dev_t *sd = NULL;
unsigned long flags;
struct ctlr_info *h;
 
@@ -2024,7 +2024,8 @@ static int hpsa_slave_alloc(struct scsi_
sd->target = sdev_id(sdev);
sd->lun = sdev->lun;
}
-   } else
+   }
+   if (!sd)
sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev),
sdev_id(sdev), sdev->lun);
 
@@ -3805,6 +3806,7 @@ static int hpsa_update_device_info(struc
sizeof(this_device->vendor));
memcpy(this_device->model, _buff[16],
sizeof(this_device->model));
+   this_device->rev = inq_buff[2];
memset(this_device->device_id, 0,
sizeof(this_device->device_id));
hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8,
@@ -3887,10 +3889,14 @@ static void figure_bus_target_lun(struct
 
if (!is_logical_dev_addr_mode(lunaddrbytes)) {
/* physical device, target and lun filled in later */
-   if (is_hba_lunid(lunaddrbytes))
+   if (is_hba_lunid(lunaddrbytes)) {
+   int bus = HPSA_HBA_BUS;
+
+   if (!device->rev)
+   bus = HPSA_LEGACY_HBA_BUS;
hpsa_set_bus_target_lun(device,
-   HPSA_HBA_BUS, 0, lunid & 0x3fff);
-   else
+   bus, 0, lunid & 0x3fff);
+   } else
/* defer target, lun assignment for physical devices */
hpsa_set_bus_target_lun(device,
HPSA_PHYSICAL_DEVICE_BUS, -1, -1);
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -69,6 +69,7 @@ struct hpsa_scsi_dev_t {
u64 sas_address;
unsigned char vendor[8];/* bytes 8-15 of inquiry data */
unsigned char model[16];/* bytes 16-31 of inquiry data */
+   unsigned char rev;  /* byte 2 of inquiry data */
unsigned char raid_level;   /* from inquiry page 0xC1 */
unsigned char volume_offline;   /* discovered via TUR or VPD */
u16 queue_depth;/* max queue_depth for this device */
@@ -403,6 +404,7 @@ struct offline_device_entry {
 #define HPSA_RAID_VOLUME_BUS   1
 #define HPSA_EXTERNAL_RAID_VOLUME_BUS  2
 #define HPSA_HBA_BUS   0
+#define HPSA_LEGACY_HBA_BUS3
 
 /*
Send the command to the hardware

[PATCH 4.8 03/35] scsi: libfc: fix seconds_since_last_reset miscalculation

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Johannes Thumshirn 

commit 208da78e8ec8b6d6ce3747ab0e5c120458e08ae6 upstream.

Commit 540eb1eef0ab ("scsi: libfc: fix seconds_since_last_reset calculation")
removed the use of 'struct timespec' from fc_get_host_stats(). This broke the
output of 'fcoeadm -s' after kernel 4.8-rc1.

Signed-off-by: Johannes Thumshirn 
Fixes: 540eb1eef0ab ("scsi: libfc: fix seconds_since_last_reset calculation")
Acked-by: Arnd Bergmann 
Reviewed-by: Bart Van Assche 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/libfc/fc_lport.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -308,7 +308,7 @@ struct fc_host_statistics *fc_get_host_s
fc_stats = >host_stats;
memset(fc_stats, 0, sizeof(struct fc_host_statistics));
 
-   fc_stats->seconds_since_last_reset = (lport->boot_time - jiffies) / HZ;
+   fc_stats->seconds_since_last_reset = (jiffies - lport->boot_time) / HZ;
 
for_each_possible_cpu(cpu) {
struct fc_stats *stats;

[PATCH 4.8 02/35] scsi: hpsa: use bus 3 for legacy HBA devices

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Hannes Reinecke 

commit 7630b3a599e2c6d1c042945d32ff2debc855ad29 upstream.

Older controllers use SCSI target id '0' for the first internal disk. As
the controllers are now placed on the same bus as the internal disks
this leads to a clash with the SCSI target id of controller.  This patch
checks the SCSI revision, and moves older controller to bus '3' to be
compatible with older releases and avoid this problem.

[mkp: fixed uninitialized variable]

Fixes: 09371d623c9 ("hpsa: Change SAS transport devices to bus 0.")
Signed-off-by: Hannes Reinecke 
Acked-by: Don Brace 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/hpsa.c |   16 +++-
 drivers/scsi/hpsa.h |2 ++
 2 files changed, 13 insertions(+), 5 deletions(-)

--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2007,7 +2007,7 @@ static struct hpsa_scsi_dev_t *lookup_hp
 
 static int hpsa_slave_alloc(struct scsi_device *sdev)
 {
-   struct hpsa_scsi_dev_t *sd;
+   struct hpsa_scsi_dev_t *sd = NULL;
unsigned long flags;
struct ctlr_info *h;
 
@@ -2024,7 +2024,8 @@ static int hpsa_slave_alloc(struct scsi_
sd->target = sdev_id(sdev);
sd->lun = sdev->lun;
}
-   } else
+   }
+   if (!sd)
sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev),
sdev_id(sdev), sdev->lun);
 
@@ -3805,6 +3806,7 @@ static int hpsa_update_device_info(struc
sizeof(this_device->vendor));
memcpy(this_device->model, _buff[16],
sizeof(this_device->model));
+   this_device->rev = inq_buff[2];
memset(this_device->device_id, 0,
sizeof(this_device->device_id));
hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8,
@@ -3887,10 +3889,14 @@ static void figure_bus_target_lun(struct
 
if (!is_logical_dev_addr_mode(lunaddrbytes)) {
/* physical device, target and lun filled in later */
-   if (is_hba_lunid(lunaddrbytes))
+   if (is_hba_lunid(lunaddrbytes)) {
+   int bus = HPSA_HBA_BUS;
+
+   if (!device->rev)
+   bus = HPSA_LEGACY_HBA_BUS;
hpsa_set_bus_target_lun(device,
-   HPSA_HBA_BUS, 0, lunid & 0x3fff);
-   else
+   bus, 0, lunid & 0x3fff);
+   } else
/* defer target, lun assignment for physical devices */
hpsa_set_bus_target_lun(device,
HPSA_PHYSICAL_DEVICE_BUS, -1, -1);
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -69,6 +69,7 @@ struct hpsa_scsi_dev_t {
u64 sas_address;
unsigned char vendor[8];/* bytes 8-15 of inquiry data */
unsigned char model[16];/* bytes 16-31 of inquiry data */
+   unsigned char rev;  /* byte 2 of inquiry data */
unsigned char raid_level;   /* from inquiry page 0xC1 */
unsigned char volume_offline;   /* discovered via TUR or VPD */
u16 queue_depth;/* max queue_depth for this device */
@@ -403,6 +404,7 @@ struct offline_device_entry {
 #define HPSA_RAID_VOLUME_BUS   1
 #define HPSA_EXTERNAL_RAID_VOLUME_BUS  2
 #define HPSA_HBA_BUS   0
+#define HPSA_LEGACY_HBA_BUS3
 
 /*
Send the command to the hardware

[PATCH 4.8 09/35] kasan: update kasan_global for gcc 7

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Vyukov 

commit 045d599a286bc01daa3510d59272440a17b23c2e upstream.

kasan_global struct is part of compiler/runtime ABI.  gcc revision
241983 has added a new field to kasan_global struct.  Update kernel
definition of kasan_global struct to include the new field.

Without this patch KASAN is broken with gcc 7.

Link: 
http://lkml.kernel.org/r/1479219743-28682-1-git-send-email-dvyu...@google.com
Signed-off-by: Dmitry Vyukov 
Acked-by: Andrey Ryabinin 
Cc: Alexander Potapenko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/compiler-gcc.h |4 +++-
 mm/kasan/kasan.h |3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -256,7 +256,9 @@
 #endif
 #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
 
-#if GCC_VERSION >= 5
+#if GCC_VERSION >= 7
+#define KASAN_ABI_VERSION 5
+#elif GCC_VERSION >= 5
 #define KASAN_ABI_VERSION 4
 #elif GCC_VERSION >= 40902
 #define KASAN_ABI_VERSION 3
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -53,6 +53,9 @@ struct kasan_global {
 #if KASAN_ABI_VERSION >= 4
struct kasan_source_location *location;
 #endif
+#if KASAN_ABI_VERSION >= 5
+   char *odr_indicator;
+#endif
 };
 
 /**

[PATCH 4.8 28/35] pwm: Fix device reference leak

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 0e1614ac84f1719d87bed577963bb8140d0c9ce8 upstream.

Make sure to drop the reference to the parent device taken by
class_find_device() after "unexporting" any children when deregistering
a PWM chip.

Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal")
Signed-off-by: Johan Hovold 
Signed-off-by: Thierry Reding 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pwm/sysfs.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -425,6 +425,8 @@ void pwmchip_sysfs_unexport_children(str
if (test_bit(PWMF_EXPORTED, >flags))
pwm_unexport_child(parent, pwm);
}
+
+   put_device(parent);
 }
 
 static int __init pwm_sysfs_init(void)

[PATCH 4.8 34/35] arm64: mm: Set PSTATE.PAN from the cpu_enable_pan() call

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: James Morse 

commit 7209c868600bd8926e37c10b9aae83124ccc1dd8 upstream.

Commit 338d4f49d6f7 ("arm64: kernel: Add support for Privileged Access
Never") enabled PAN by enabling the 'SPAN' feature-bit in SCTLR_EL1.
This means the PSTATE.PAN bit won't be set until the next return to the
kernel from userspace. On a preemptible kernel we may schedule work that
accesses userspace on a CPU before it has done this.

Now that cpufeature enable() calls are scheduled via stop_machine(), we
can set PSTATE.PAN from the cpu_enable_pan() call.

Add WARN_ON_ONCE(in_interrupt()) to check the PSTATE value we updated
is not immediately discarded.

Reported-by: Tony Thompson 
Reported-by: Vladimir Murzin 
Signed-off-by: James Morse 
[will: fixed typo in comment]
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/mm/fault.c |9 +
 1 file changed, 9 insertions(+)

--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -29,7 +29,9 @@
 #include 
 #include 
 #include 
+#include 
 
+#include 
 #include 
 #include 
 #include 
@@ -673,7 +675,14 @@ NOKPROBE_SYMBOL(do_debug_exception);
 #ifdef CONFIG_ARM64_PAN
 int cpu_enable_pan(void *__unused)
 {
+   /*
+* We modify PSTATE. This won't work from irq context as the PSTATE
+* is discarded once we return from the exception.
+*/
+   WARN_ON_ONCE(in_interrupt());
+
config_sctlr_el1(SCTLR_EL1_SPAN, 0);
+   asm(SET_PSTATE_PAN(1));
return 0;
 }
 #endif /* CONFIG_ARM64_PAN */

[PATCH 4.8 08/35] zram: fix unbalanced idr management at hot removal

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 529e71e16403830ae0d737a66c55c5f360f3576b upstream.

The zram hot removal code calls idr_remove() even when zram_remove()
returns an error (typically -EBUSY).  This results in a leftover at the
device release, eventually leading to a crash when the module is
reloaded.

As described in the bug report below, the following procedure would
cause an Oops with zram:

 - provision three zram devices via modprobe zram num_devices=3
 - configure a size for each device
   + echo "1G" > /sys/block/$zram_name/disksize
 - mkfs and mount zram0 only
 - attempt to hot remove all three devices
   + echo 2 > /sys/class/zram-control/hot_remove
   + echo 1 > /sys/class/zram-control/hot_remove
   + echo 0 > /sys/class/zram-control/hot_remove
 - zram0 removal fails with EBUSY, as expected
 - unmount zram0
 - try zram0 hot remove again
   + echo 0 > /sys/class/zram-control/hot_remove
 - fails with ENODEV (unexpected)
 - unload zram kernel module
   + completes successfully
 - zram0 device node still exists
 - attempt to mount /dev/zram0
   + mount command is killed
   + following BUG is encountered

 BUG: unable to handle kernel paging request at a0002ba0
 IP: get_disk+0x16/0x50
 Oops:  [#1] SMP
 CPU: 0 PID: 252 Comm: mount Not tainted 4.9.0-rc6 #176
 Call Trace:
   exact_lock+0xc/0x20
   kobj_lookup+0xdc/0x160
   get_gendisk+0x2f/0x110
   __blkdev_get+0x10c/0x3c0
   blkdev_get+0x19d/0x2e0
   blkdev_open+0x56/0x70
   do_dentry_open.isra.19+0x1ff/0x310
   vfs_open+0x43/0x60
   path_openat+0x2c9/0xf30
   do_filp_open+0x79/0xd0
   do_sys_open+0x114/0x1e0
   SyS_open+0x19/0x20
   entry_SYSCALL_64_fastpath+0x13/0x94

This patch adds the proper error check in hot_remove_store() not to call
idr_remove() unconditionally.

Fixes: 17ec4cd98578 ("zram: don't call idr_remove() from zram_remove()")
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1010970
Link: http://lkml.kernel.org/r/20161121132140.12683-1-ti...@suse.de
Signed-off-by: Takashi Iwai 
Reviewed-by: David Disseldorp 
Reported-by: David Disseldorp 
Tested-by: David Disseldorp 
Acked-by: Minchan Kim 
Acked-by: Sergey Senozhatsky 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/block/zram/zram_drv.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct c
zram = idr_find(_index_idr, dev_id);
if (zram) {
ret = zram_remove(zram);
-   idr_remove(_index_idr, dev_id);
+   if (!ret)
+   idr_remove(_index_idr, dev_id);
} else {
ret = -ENODEV;
}

[PATCH 4.8 30/35] perf/x86: Restore TASK_SIZE check on frame pointer

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Johannes Weiner 

commit ae31fe51a3cceaa0cabdb3058f69669ecb47f12e upstream.

The following commit:

  75925e1ad7f5 ("perf/x86: Optimize stack walk user accesses")

... switched from copy_from_user_nmi() to __copy_from_user_nmi() with a manual
access_ok() check.

Unfortunately, copy_from_user_nmi() does an explicit check against TASK_SIZE,
whereas the access_ok() uses whatever the current address limit of the task is.

We are getting NMIs when __probe_kernel_read() has switched to KERNEL_DS, and
then see vmalloc faults when we access what looks like pointers into vmalloc
space:

  [] WARNING: CPU: 3 PID: 3685731 at arch/x86/mm/fault.c:435 
vmalloc_fault+0x289/0x290
  [] CPU: 3 PID: 3685731 Comm: sh Tainted: GW   
4.6.0-5_fbk1_223_gdbf0f40 #1
  [] Call Trace:
  [][] dump_stack+0x4d/0x6c
  []  [] __warn+0xd3/0xf0
  []  [] warn_slowpath_null+0x1d/0x20
  []  [] vmalloc_fault+0x289/0x290
  []  [] __do_page_fault+0x330/0x490
  []  [] do_page_fault+0xc/0x10
  []  [] page_fault+0x22/0x30
  []  [] ? perf_callchain_user+0x100/0x2a0
  []  [] get_perf_callchain+0x17f/0x190
  []  [] perf_callchain+0x67/0x80
  []  [] perf_prepare_sample+0x2a0/0x370
  []  [] perf_event_output+0x20/0x60
  []  [] ? perf_event_update_userpage+0xc7/0x130
  []  [] __perf_event_overflow+0x181/0x1d0
  []  [] perf_event_overflow+0x14/0x20
  []  [] intel_pmu_handle_irq+0x1d3/0x490
  []  [] ? copy_user_enhanced_fast_string+0x7/0x10
  []  [] ? vunmap_page_range+0x1a1/0x2f0
  []  [] ? unmap_kernel_range_noflush+0x11/0x20
  []  [] ? ghes_copy_tofrom_phys+0x116/0x1f0
  []  [] ? x2apic_send_IPI_self+0x1d/0x20
  []  [] perf_event_nmi_handler+0x2d/0x50
  []  [] nmi_handle+0x61/0x110
  []  [] default_do_nmi+0x44/0x110
  []  [] do_nmi+0xdb/0x150
  []  [] end_repeat_nmi+0x1a/0x1e
  []  [] ? copy_user_enhanced_fast_string+0x7/0x10
  []  [] ? copy_user_enhanced_fast_string+0x7/0x10
  []  [] ? copy_user_enhanced_fast_string+0x7/0x10
  []  <>[] ? __probe_kernel_read+0x3e/0xa0

Fix this by moving the valid_user_frame() check to before the uaccess
that loads the return address and the pointer to the next frame.

Signed-off-by: Johannes Weiner 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Alexander Shishkin 
Cc: Arnaldo Carvalho de Melo 
Cc: Jiri Olsa 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Stephane Eranian 
Cc: Thomas Gleixner 
Cc: Vince Weaver 
Cc: linux-kernel@vger.kernel.org
Fixes: 75925e1ad7f5 ("perf/x86: Optimize stack walk user accesses")
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/x86/events/core.c |   10 ++
 1 file changed, 2 insertions(+), 8 deletions(-)

--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2344,7 +2344,7 @@ perf_callchain_user32(struct pt_regs *re
frame.next_frame = 0;
frame.return_address = 0;
 
-   if (!access_ok(VERIFY_READ, fp, 8))
+   if (!valid_user_frame(fp, sizeof(frame)))
break;
 
bytes = __copy_from_user_nmi(_frame, fp, 4);
@@ -2354,9 +2354,6 @@ perf_callchain_user32(struct pt_regs *re
if (bytes != 0)
break;
 
-   if (!valid_user_frame(fp, sizeof(frame)))
-   break;
-
perf_callchain_store(entry, cs_base + frame.return_address);
fp = compat_ptr(ss_base + frame.next_frame);
}
@@ -2405,7 +2402,7 @@ perf_callchain_user(struct perf_callchai
frame.next_frame = NULL;
frame.return_address = 0;
 
-   if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2))
+   if (!valid_user_frame(fp, sizeof(frame)))
break;
 
bytes = __copy_from_user_nmi(_frame, fp, 
sizeof(*fp));
@@ -2415,9 +2412,6 @@ perf_callchain_user(struct perf_callchai
if (bytes != 0)
break;
 
-   if (!valid_user_frame(fp, sizeof(frame)))
-   break;
-
perf_callchain_store(entry, frame.return_address);
fp = (void __user *)frame.next_frame;
}

[PATCH 4.8 05/35] ARC: Dont use "+l" inline asm constraint

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Vineet Gupta 

commit 3c7c7a2fc8811bc7097479f69acf2527693d7562 upstream.

Apparenty this is coming in the way of gcc fix which inhibits the usage
of LP_COUNT as a gpr.

Signed-off-by: Vineet Gupta 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arc/include/asm/delay.h |9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -22,10 +22,11 @@
 static inline void __delay(unsigned long loops)
 {
__asm__ __volatile__(
-   "   lp  1f  \n"
-   "   nop \n"
-   "1: \n"
-   : "+l"(loops));
+   "   mov lp_count, %0\n"
+   "   lp  1f  \n"
+   "   nop \n"
+   "1: \n"
+   : : "r"(loops));
 }
 
 extern void __bad_udelay(void);

[PATCH 4.8 21/35] drm/i915: drop the struct_mutex when wedged or trying to reset

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Matthew Auld 

commit e411072d5740a49cdc9d0713798c30440757e451 upstream.

We grab the struct_mutex in intel_crtc_page_flip, but if we are wedged
or a reset is in progress we bail early but never seem to actually
release the lock.

Fixes: 7f1847ebf48b ("drm/i915: Simplify checking of GPU reset_counter in 
display pageflips")
Cc: Chris Wilson 
Signed-off-by: Matthew Auld 
Link: 
http://patchwork.freedesktop.org/patch/msgid/20161128103648.9235-1-matthew.a...@intel.com
Reviewed-by: Joonas Lahtinen 
Reviewed-by: Chris Wilson 
Signed-off-by: Chris Wilson 
(cherry picked from commit ddbb271aea87fc6004d3c8bcdb0710e980c7ec85)
Signed-off-by: Jani Nikula 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/i915/intel_display.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11791,7 +11791,7 @@ static int intel_crtc_page_flip(struct d
intel_crtc->reset_counter = i915_reset_counter(_priv->gpu_error);
if (__i915_reset_in_progress_or_wedged(intel_crtc->reset_counter)) {
ret = -EIO;
-   goto cleanup;
+   goto unlock;
}
 
atomic_inc(_crtc->unpin_work_count);
@@ -11877,6 +11877,7 @@ cleanup_pending:
if (!IS_ERR_OR_NULL(request))
i915_add_request_no_flush(request);
atomic_dec(_crtc->unpin_work_count);
+unlock:
mutex_unlock(>struct_mutex);
 cleanup:
crtc->primary->fb = old_fb;

[PATCH 4.8 23/35] drm/radeon: fix power state when port pm is unavailable (v2)

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Peter Wu 

commit d3ac31f3b4bf9fade93d69770cb9c34912e017be upstream.

When PCIe port PM is not enabled (system BIOS is pre-2015 or the
pcie_port_pm=off parameter is set), legacy ATPX PM should still be
marked as supported. Otherwise the GPU can fail to power on after
runtime suspend. This affected a Dell Inspiron 5548.

Ideally the BIOS date in the PCI core is lowered to 2013 (the first year
where hybrid graphics platforms using power resources was introduced),
but that seems more risky at this point and would not solve the
pcie_port_pm=off issue.

v2: agd: fix typo

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98505
Signed-off-by: Peter Wu 
Signed-off-by: Alex Deucher 
Reviewed-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/radeon/radeon_atpx_handler.c |9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -33,6 +33,7 @@ struct radeon_atpx {
 
 static struct radeon_atpx_priv {
bool atpx_detected;
+   bool bridge_pm_usable;
/* handle for device - and atpx */
acpi_handle dhandle;
struct radeon_atpx atpx;
@@ -198,7 +199,11 @@ static int radeon_atpx_validate(struct r
atpx->is_hybrid = false;
if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
printk("ATPX Hybrid Graphics\n");
-   atpx->functions.power_cntl = false;
+   /*
+* Disable legacy PM methods only when pcie port PM is usable,
+* otherwise the device might fail to power off or power on.
+*/
+   atpx->functions.power_cntl = !radeon_atpx_priv.bridge_pm_usable;
atpx->is_hybrid = true;
}
 
@@ -469,6 +474,7 @@ static int radeon_atpx_power_state(enum
  */
 static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
 {
+   struct pci_dev *parent_pdev = pci_upstream_bridge(pdev);
acpi_handle dhandle, atpx_handle;
acpi_status status;
 
@@ -482,6 +488,7 @@ static bool radeon_atpx_pci_probe_handle
 
radeon_atpx_priv.dhandle = dhandle;
radeon_atpx_priv.atpx.handle = atpx_handle;
+   radeon_atpx_priv.bridge_pm_usable = parent_pdev && 
parent_pdev->bridge_d3;
return true;
 }
 

[PATCH 4.8 19/35] KVM: arm/arm64: vgic: Dont notify EOI for non-SPIs

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Marc Zyngier 

commit 8ca18eec2b2276b449c1dc86b98bf083c5fe4e09 upstream.

When we inject a level triggerered interrupt (and unless it
is backed by the physical distributor - timer style), we request
a maintenance interrupt. Part of the processing for that interrupt
is to feed to the rest of KVM (and to the eventfd subsystem) the
information that the interrupt has been EOIed.

But that notification only makes sense for SPIs, and not PPIs
(such as the PMU interrupt). Skip over the notification if
the interrupt is not an SPI.

Fixes: 140b086dd197 ("KVM: arm/arm64: vgic-new: Add GICv2 world switch backend")
Fixes: 59529f69f504 ("KVM: arm/arm64: vgic-new: Add GICv3 world switch backend")
Reported-by: Catalin Marinas 
Tested-by: Catalin Marinas 
Acked-by: Christoffer Dall 
Signed-off-by: Marc Zyngier 
Signed-off-by: Greg Kroah-Hartman 

---
 virt/kvm/arm/vgic/vgic-v2.c |6 --
 virt/kvm/arm/vgic/vgic-v3.c |6 --
 2 files changed, 8 insertions(+), 4 deletions(-)

--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -50,8 +50,10 @@ void vgic_v2_process_maintenance(struct
 
WARN_ON(cpuif->vgic_lr[lr] & GICH_LR_STATE);
 
-   kvm_notify_acked_irq(vcpu->kvm, 0,
-intid - VGIC_NR_PRIVATE_IRQS);
+   /* Only SPIs require notification */
+   if (vgic_valid_spi(vcpu->kvm, intid))
+   kvm_notify_acked_irq(vcpu->kvm, 0,
+intid - 
VGIC_NR_PRIVATE_IRQS);
}
}
 
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -41,8 +41,10 @@ void vgic_v3_process_maintenance(struct
 
WARN_ON(cpuif->vgic_lr[lr] & ICH_LR_STATE);
 
-   kvm_notify_acked_irq(vcpu->kvm, 0,
-intid - VGIC_NR_PRIVATE_IRQS);
+   /* Only SPIs require notification */
+   if (vgic_valid_spi(vcpu->kvm, intid))
+   kvm_notify_acked_irq(vcpu->kvm, 0,
+intid - 
VGIC_NR_PRIVATE_IRQS);
}
 
/*

[PATCH 4.8 29/35] drm/mediatek: fix null pointer dereference

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Matthias Brugger 

commit 5ad45307d990020b25a8f7486178b6e033790f70 upstream.

The probe function requests the interrupt before initializing
the ddp component. Which leads to a null pointer dereference at boot.
Fix this by requesting the interrput after all components got
initialized properly.

Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Matthias Brugger 
Signed-off-by: Greg Kroah-Hartman 

Change-Id: I57193a7ab554dfb37c35a455900689333adf511c

---
 drivers/gpu/drm/mediatek/mtk_disp_ovl.c |   14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -249,13 +249,6 @@ static int mtk_disp_ovl_probe(struct pla
if (irq < 0)
return irq;
 
-   ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
-  IRQF_TRIGGER_NONE, dev_name(dev), priv);
-   if (ret < 0) {
-   dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
-   return ret;
-   }
-
comp_id = mtk_ddp_comp_get_id(dev->of_node, MTK_DISP_OVL);
if (comp_id < 0) {
dev_err(dev, "Failed to identify by alias: %d\n", comp_id);
@@ -271,6 +264,13 @@ static int mtk_disp_ovl_probe(struct pla
 
platform_set_drvdata(pdev, priv);
 
+   ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
+  IRQF_TRIGGER_NONE, dev_name(dev), priv);
+   if (ret < 0) {
+   dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
+   return ret;
+   }
+
ret = component_add(dev, _disp_ovl_component_ops);
if (ret)
dev_err(dev, "Failed to add component: %d\n", ret);

[PATCH 4.8 09/35] kasan: update kasan_global for gcc 7

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dmitry Vyukov 

commit 045d599a286bc01daa3510d59272440a17b23c2e upstream.

kasan_global struct is part of compiler/runtime ABI.  gcc revision
241983 has added a new field to kasan_global struct.  Update kernel
definition of kasan_global struct to include the new field.

Without this patch KASAN is broken with gcc 7.

Link: 
http://lkml.kernel.org/r/1479219743-28682-1-git-send-email-dvyu...@google.com
Signed-off-by: Dmitry Vyukov 
Acked-by: Andrey Ryabinin 
Cc: Alexander Potapenko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/compiler-gcc.h |4 +++-
 mm/kasan/kasan.h |3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -256,7 +256,9 @@
 #endif
 #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
 
-#if GCC_VERSION >= 5
+#if GCC_VERSION >= 7
+#define KASAN_ABI_VERSION 5
+#elif GCC_VERSION >= 5
 #define KASAN_ABI_VERSION 4
 #elif GCC_VERSION >= 40902
 #define KASAN_ABI_VERSION 3
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -53,6 +53,9 @@ struct kasan_global {
 #if KASAN_ABI_VERSION >= 4
struct kasan_source_location *location;
 #endif
+#if KASAN_ABI_VERSION >= 5
+   char *odr_indicator;
+#endif
 };
 
 /**

[PATCH 4.8 28/35] pwm: Fix device reference leak

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 0e1614ac84f1719d87bed577963bb8140d0c9ce8 upstream.

Make sure to drop the reference to the parent device taken by
class_find_device() after "unexporting" any children when deregistering
a PWM chip.

Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal")
Signed-off-by: Johan Hovold 
Signed-off-by: Thierry Reding 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/pwm/sysfs.c |2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -425,6 +425,8 @@ void pwmchip_sysfs_unexport_children(str
if (test_bit(PWMF_EXPORTED, >flags))
pwm_unexport_child(parent, pwm);
}
+
+   put_device(parent);
 }
 
 static int __init pwm_sysfs_init(void)

[PATCH 4.8 34/35] arm64: mm: Set PSTATE.PAN from the cpu_enable_pan() call

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: James Morse 

commit 7209c868600bd8926e37c10b9aae83124ccc1dd8 upstream.

Commit 338d4f49d6f7 ("arm64: kernel: Add support for Privileged Access
Never") enabled PAN by enabling the 'SPAN' feature-bit in SCTLR_EL1.
This means the PSTATE.PAN bit won't be set until the next return to the
kernel from userspace. On a preemptible kernel we may schedule work that
accesses userspace on a CPU before it has done this.

Now that cpufeature enable() calls are scheduled via stop_machine(), we
can set PSTATE.PAN from the cpu_enable_pan() call.

Add WARN_ON_ONCE(in_interrupt()) to check the PSTATE value we updated
is not immediately discarded.

Reported-by: Tony Thompson 
Reported-by: Vladimir Murzin 
Signed-off-by: James Morse 
[will: fixed typo in comment]
Signed-off-by: Will Deacon 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm64/mm/fault.c |9 +
 1 file changed, 9 insertions(+)

--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -29,7 +29,9 @@
 #include 
 #include 
 #include 
+#include 
 
+#include 
 #include 
 #include 
 #include 
@@ -673,7 +675,14 @@ NOKPROBE_SYMBOL(do_debug_exception);
 #ifdef CONFIG_ARM64_PAN
 int cpu_enable_pan(void *__unused)
 {
+   /*
+* We modify PSTATE. This won't work from irq context as the PSTATE
+* is discarded once we return from the exception.
+*/
+   WARN_ON_ONCE(in_interrupt());
+
config_sctlr_el1(SCTLR_EL1_SPAN, 0);
+   asm(SET_PSTATE_PAN(1));
return 0;
 }
 #endif /* CONFIG_ARM64_PAN */

[PATCH 4.8 08/35] zram: fix unbalanced idr management at hot removal

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Iwai 

commit 529e71e16403830ae0d737a66c55c5f360f3576b upstream.

The zram hot removal code calls idr_remove() even when zram_remove()
returns an error (typically -EBUSY).  This results in a leftover at the
device release, eventually leading to a crash when the module is
reloaded.

As described in the bug report below, the following procedure would
cause an Oops with zram:

 - provision three zram devices via modprobe zram num_devices=3
 - configure a size for each device
   + echo "1G" > /sys/block/$zram_name/disksize
 - mkfs and mount zram0 only
 - attempt to hot remove all three devices
   + echo 2 > /sys/class/zram-control/hot_remove
   + echo 1 > /sys/class/zram-control/hot_remove
   + echo 0 > /sys/class/zram-control/hot_remove
 - zram0 removal fails with EBUSY, as expected
 - unmount zram0
 - try zram0 hot remove again
   + echo 0 > /sys/class/zram-control/hot_remove
 - fails with ENODEV (unexpected)
 - unload zram kernel module
   + completes successfully
 - zram0 device node still exists
 - attempt to mount /dev/zram0
   + mount command is killed
   + following BUG is encountered

 BUG: unable to handle kernel paging request at a0002ba0
 IP: get_disk+0x16/0x50
 Oops:  [#1] SMP
 CPU: 0 PID: 252 Comm: mount Not tainted 4.9.0-rc6 #176
 Call Trace:
   exact_lock+0xc/0x20
   kobj_lookup+0xdc/0x160
   get_gendisk+0x2f/0x110
   __blkdev_get+0x10c/0x3c0
   blkdev_get+0x19d/0x2e0
   blkdev_open+0x56/0x70
   do_dentry_open.isra.19+0x1ff/0x310
   vfs_open+0x43/0x60
   path_openat+0x2c9/0xf30
   do_filp_open+0x79/0xd0
   do_sys_open+0x114/0x1e0
   SyS_open+0x19/0x20
   entry_SYSCALL_64_fastpath+0x13/0x94

This patch adds the proper error check in hot_remove_store() not to call
idr_remove() unconditionally.

Fixes: 17ec4cd98578 ("zram: don't call idr_remove() from zram_remove()")
Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1010970
Link: http://lkml.kernel.org/r/20161121132140.12683-1-ti...@suse.de
Signed-off-by: Takashi Iwai 
Reviewed-by: David Disseldorp 
Reported-by: David Disseldorp 
Tested-by: David Disseldorp 
Acked-by: Minchan Kim 
Acked-by: Sergey Senozhatsky 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/block/zram/zram_drv.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct c
zram = idr_find(_index_idr, dev_id);
if (zram) {
ret = zram_remove(zram);
-   idr_remove(_index_idr, dev_id);
+   if (!ret)
+   idr_remove(_index_idr, dev_id);
} else {
ret = -ENODEV;
}