[PATCH v4 0/4] Make input drivers y2038 safe

[PATCH v4 0/4] Make input drivers y2038 safe

[Deepa Dinamani]

The series is aimed at making input events y2038 safe.
It extends the lifetime of the realtime timestamps in the
events to year 2106.
The series is also a necessary update as glibc is set to provide
64 bit time_t support for 32 bit binaries. glibc plan is detailed
at https://sourceware.org/glibc/wiki/Y2038ProofnessDesign .

The series is a result of discussions with Arnd Bergmann and
Dmitry Torokhov at last Plumbers.

The plan is to deprecate realtime timestamps anyway as they
are not appropriate for these timestamps as noted in the patch
a80b83b7b8 by John Stultz.

The design also updates the format of the input events read/ written
to the device nodes. This breaks 32 bit interface to the input
events at compile time as preferred by the maintainer.

The userspace library changes to libevdev, libuinput and mtdev
will be posted to the respective mailing groups for review.

Changes from v3:
* Updated uinput to support monotonic time only
* Addressed review comments
Changes from v2:
* Updated the design to break 32 bit interfaces at compile time.
Changes from v1:
* Updated changes according to review comments.
* Posted userspace library changes that go along with the series.

Deepa Dinamani (4):
  uinput: Use monotonic times for uinput timestamps.
  input: evdev: Replace timeval with timespec64
  input: Deprecate real timestamps beyond year 2106
  input: serio: Replace timeval by timespec64

 drivers/input/evdev.c            | 43 +++++++++++++++++++++++++---------------
 drivers/input/input-compat.c     | 11 +++++-----
 drivers/input/input-compat.h     |  3 ++-
 drivers/input/misc/uinput.c      |  5 ++++-
 drivers/input/serio/hil_mlc.c    | 37 +++++++++++++++++-----------------
 drivers/input/serio/hp_sdc.c     | 17 ++++++++--------
 drivers/input/serio/hp_sdc_mlc.c | 10 +++++-----
 include/linux/hil_mlc.h          |  6 +++---
 include/linux/hp_sdc.h           |  6 +++---
 include/uapi/linux/input.h       | 12 ++++++++++-
 10 files changed, 88 insertions(+), 62 deletions(-)


base-commit: b0a84f19a5161418d4360cd57603e94ed489915e
-- 
2.14.1

[PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Deepa Dinamani]

struct timeval which is part of struct input_event to
maintain the event times is not y2038 safe.

Real time timestamps are also not ideal for input_event
as this time can go backwards as noted in the patch
a80b83b7b8 by John Stultz.

The patch switches the timestamps to use monotonic time
from realtime time. This is assuming no one is using
absolute times from these timestamps.

The structure to maintain input events will be changed
in a different patch.

Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
---
 drivers/input/misc/uinput.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 39ddd9a73feb..d521aecbc078 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -84,11 +84,14 @@ static int uinput_dev_event(struct input_dev *dev,
 			    unsigned int type, unsigned int code, int value)
 {
 	struct uinput_device	*udev = input_get_drvdata(dev);
+	struct timespec64	ts;
 
 	udev->buff[udev->head].type = type;
 	udev->buff[udev->head].code = code;
 	udev->buff[udev->head].value = value;
-	do_gettimeofday(&udev->buff[udev->head].time);
+	ktime_get_ts64(&ts);
+	udev->buff[udev->head].time.tv_sec = ts.tv_sec;
+	udev->buff[udev->head].time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
 	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
 
 	wake_up_interruptible(&udev->waitq);
-- 
2.14.1

[PATCH v4 2/4] input: evdev: Replace timeval with timespec64

[Deepa Dinamani]

struct timeval is not y2038 safe.

All references to timeval in the kernel will be replaced
by y2038 safe structures.
Replace all references to timeval with y2038 safe
struct timespec64 here.

struct input_event will be changed in a different patch.

Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/input/evdev.c | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 925571475005..e5dbfc5ff1b0 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -156,15 +156,22 @@ static void __evdev_flush_queue(struct evdev_client *client, unsigned int type)
 static void __evdev_queue_syn_dropped(struct evdev_client *client)
 {
 	struct input_event ev;
-	ktime_t time;
+	struct timespec64 ts;
 
-	time = client->clk_type == EV_CLK_REAL ?
-			ktime_get_real() :
-			client->clk_type == EV_CLK_MONO ?
-				ktime_get() :
-				ktime_get_boottime();
+	switch (client->clk_type) {
+	case EV_CLK_REAL:
+		ktime_get_real_ts64(&ts);
+		break;
+	case EV_CLK_MONO:
+		ktime_get_ts64(&ts);
+		break;
+	case EV_CLK_BOOT:
+		get_monotonic_boottime64(&ts);
+		break;
+	}
 
-	ev.time = ktime_to_timeval(time);
+	ev.time.tv_sec = ts.tv_sec;
+	ev.time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
 	ev.type = EV_SYN;
 	ev.code = SYN_DROPPED;
 	ev.value = 0;
@@ -257,17 +264,20 @@ static void __pass_event(struct evdev_client *client,
 
 static void evdev_pass_values(struct evdev_client *client,
 			const struct input_value *vals, unsigned int count,
-			ktime_t *ev_time)
+			struct timespec64 *ev_time)
 {
 	struct evdev *evdev = client->evdev;
 	const struct input_value *v;
 	struct input_event event;
+	struct timespec64 ts;
 	bool wakeup = false;
 
 	if (client->revoked)
 		return;
 
-	event.time = ktime_to_timeval(ev_time[client->clk_type]);
+	ts = ev_time[client->clk_type];
+	event.time.tv_sec = ts.tv_sec;
+	event.time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
 
 	/* Interrupts are disabled, just acquire the lock. */
 	spin_lock(&client->buffer_lock);
@@ -304,12 +314,11 @@ static void evdev_events(struct input_handle *handle,
 {
 	struct evdev *evdev = handle->private;
 	struct evdev_client *client;
-	ktime_t ev_time[EV_CLK_MAX];
+	struct timespec64 ev_time[EV_CLK_MAX];
 
-	ev_time[EV_CLK_MONO] = ktime_get();
-	ev_time[EV_CLK_REAL] = ktime_mono_to_real(ev_time[EV_CLK_MONO]);
-	ev_time[EV_CLK_BOOT] = ktime_mono_to_any(ev_time[EV_CLK_MONO],
-						 TK_OFFS_BOOT);
+	ktime_get_ts64(&ev_time[EV_CLK_MONO]);
+	ktime_get_real_ts64(&ev_time[EV_CLK_REAL]);
+	get_monotonic_boottime64(&ev_time[EV_CLK_BOOT]);
 
 	rcu_read_lock();
 
-- 
2.14.1

[PATCH v4 3/4] input: Deprecate real timestamps beyond year 2106

[Deepa Dinamani]

struct timeval is not y2038 safe.
All usage of timeval in the kernel will be replaced by
y2038 safe structures.
The change is also necessary as glibc is introducing support
for 32 bit applications to use 64 bit time_t. Without this
change, many applications would incorrectly interpret values
in the struct input_event.
More details about glibc at
https://sourceware.org/glibc/wiki/Y2038ProofnessDesign .

struct input_event maintains time for each input event.
Real time timestamps are not ideal for input as this
time can go backwards as noted in the patch a80b83b7b8
by John Stultz. Hence, having the input_event.time fields
only big enough for monotonic and boot times are
sufficient.

The change leaves the representation of struct input_event as is
on 64 bit architectures. But uses 2 unsigned long values on 32 bit
machines to support real timestamps until year 2106.
This intentionally breaks the ABI on 32 bit architectures and
compat handling on 64 bit architectures.
This is as per maintainer's preference to introduce compile time errors
rather than run into runtime incompatibilities.

The change requires any 32 bit userspace utilities reading or writing
from event nodes to update their reading format to match the new
input_event. The changes to the popular libraries will be posted once
we agree on the kernel change.

Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
---
 drivers/input/evdev.c        | 14 ++++++++------
 drivers/input/input-compat.c | 11 ++++++-----
 drivers/input/input-compat.h |  3 ++-
 drivers/input/misc/uinput.c  |  4 ++--
 include/uapi/linux/input.h   | 12 +++++++++++-
 5 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index e5dbfc5ff1b0..6172af6476c0 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -135,7 +135,8 @@ static void __evdev_flush_queue(struct evdev_client *client, unsigned int type)
 			continue;
 		} else if (head != i) {
 			/* move entry to fill the gap */
-			client->buffer[head].time = ev->time;
+			client->buffer[head].input_event_sec = ev->input_event_sec;
+			client->buffer[head].input_event_usec = ev->input_event_usec;
 			client->buffer[head].type = ev->type;
 			client->buffer[head].code = ev->code;
 			client->buffer[head].value = ev->value;
@@ -170,8 +171,8 @@ static void __evdev_queue_syn_dropped(struct evdev_client *client)
 		break;
 	}
 
-	ev.time.tv_sec = ts.tv_sec;
-	ev.time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+	ev.input_event_sec = ts.tv_sec;
+	ev.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
 	ev.type = EV_SYN;
 	ev.code = SYN_DROPPED;
 	ev.value = 0;
@@ -248,7 +249,8 @@ static void __pass_event(struct evdev_client *client,
 		 */
 		client->tail = (client->head - 2) & (client->bufsize - 1);
 
-		client->buffer[client->tail].time = event->time;
+		client->buffer[client->tail].input_event_sec = event->input_event_sec;
+		client->buffer[client->tail].input_event_usec = event->input_event_usec;
 		client->buffer[client->tail].type = EV_SYN;
 		client->buffer[client->tail].code = SYN_DROPPED;
 		client->buffer[client->tail].value = 0;
@@ -276,8 +278,8 @@ static void evdev_pass_values(struct evdev_client *client,
 		return;
 
 	ts = ev_time[client->clk_type];
-	event.time.tv_sec = ts.tv_sec;
-	event.time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+	event.input_event_sec = ts.tv_sec;
+	event.input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
 
 	/* Interrupts are disabled, just acquire the lock. */
 	spin_lock(&client->buffer_lock);
diff --git a/drivers/input/input-compat.c b/drivers/input/input-compat.c
index 2186f71c9fe5..419e40b68486 100644
--- a/drivers/input/input-compat.c
+++ b/drivers/input/input-compat.c
@@ -24,14 +24,15 @@ int input_event_from_user(const char __user *buffer,
 				   sizeof(struct input_event_compat)))
 			return -EFAULT;
 
-		event->time.tv_sec = compat_event.time.tv_sec;
-		event->time.tv_usec = compat_event.time.tv_usec;
+		event->input_event_sec = compat_event.sec;
+		event->input_event_usec = compat_event.usec;
 		event->type = compat_event.type;
 		event->code = compat_event.code;
 		event->value = compat_event.value;
 
 	} else {
-		if (copy_from_user(event, buffer, sizeof(struct input_event)))
+		if (copy_from_user(event, buffer,
+				   sizeof(struct input_event)))
 			return -EFAULT;
 	}
 
@@ -44,8 +45,8 @@ int input_event_to_user(char __user *buffer,
 	if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
 		struct input_event_compat compat_event;
 
-		compat_event.time.tv_sec = event->time.tv_sec;
-		compat_event.time.tv_usec = event->time.tv_usec;
+		compat_event.sec = event->input_event_sec;
+		compat_event.usec = event->input_event_usec;
 		compat_event.type = event->type;
 		compat_event.code = event->code;
 		compat_event.value = event->value;
diff --git a/drivers/input/input-compat.h b/drivers/input/input-compat.h
index 1563160a7af3..08cd755e73fd 100644
--- a/drivers/input/input-compat.h
+++ b/drivers/input/input-compat.h
@@ -18,7 +18,8 @@
 #ifdef CONFIG_COMPAT
 
 struct input_event_compat {
-	struct compat_timeval time;
+	compat_ulong_t sec;
+	compat_ulong_t usec;
 	__u16 type;
 	__u16 code;
 	__s32 value;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index d521aecbc078..cb4bdbd3e9e2 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -90,8 +90,8 @@ static int uinput_dev_event(struct input_dev *dev,
 	udev->buff[udev->head].code = code;
 	udev->buff[udev->head].value = value;
 	ktime_get_ts64(&ts);
-	udev->buff[udev->head].time.tv_sec = ts.tv_sec;
-	udev->buff[udev->head].time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+	udev->buff[udev->head].input_event_sec = ts.tv_sec;
+	udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
 	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
 
 	wake_up_interruptible(&udev->waitq);
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index 8c5a0bf6ee35..9c5105ff5cc6 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -21,10 +21,20 @@
 
 /*
  * The event structure itself
+ * Note that __USE_TIME_BITS64 is defined by libc based on
+ * application's request to use 64 bit time_t.
  */
-
 struct input_event {
+#if	(__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL)
 	struct timeval time;
+#define input_event_sec time.tv_sec
+#define input_event_usec time.tv_usec
+#else
+	__kernel_ulong_t __sec;
+	__kernel_ulong_t __usec;
+#define input_event_sec  __sec
+#define input_event_usec __usec
+#endif
 	__u16 type;
 	__u16 code;
 	__s32 value;
-- 
2.14.1

[PATCH v4 4/4] input: serio: Replace timeval by timespec64

[Deepa Dinamani]

struct timeval is not y2038 safe.
All references to timeval will be deleted from the
kernel to make it y2038 safe.
Replace its uses by y2038 safe struct timespec64.

The timestamps changed here only keep track of delta
times. These timestamps are also internal to kernel.
Hence, monotonic times are sufficient here.
The unit of the delta times is also changed in certain
cases to nanoseconds rather than microseconds. This is
in line with timespec64 which keeps time in nanoseconds.

Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/input/serio/hil_mlc.c    | 37 ++++++++++++++++++-------------------
 drivers/input/serio/hp_sdc.c     | 17 +++++++++--------
 drivers/input/serio/hp_sdc_mlc.c | 10 +++++-----
 include/linux/hil_mlc.h          |  6 +++---
 include/linux/hp_sdc.h           |  6 +++---
 5 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index d66d01c5373b..b5856b4d3717 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -274,14 +274,14 @@ static int hilse_match(hil_mlc *mlc, int unused)
 /* An LCV used to prevent runaway loops, forces 5 second sleep when reset. */
 static int hilse_init_lcv(hil_mlc *mlc, int unused)
 {
-	struct timeval tv;
+	time64_t time;
 
-	do_gettimeofday(&tv);
+	time = ktime_get_seconds();
 
-	if (mlc->lcv && (tv.tv_sec - mlc->lcv_tv.tv_sec) < 5)
+	if (mlc->lcv && (time - mlc->lcv_tv.tv_sec) < 5)
 		return -1;
 
-	mlc->lcv_tv = tv;
+	mlc->lcv_tv.tv_sec = time;
 	mlc->lcv = 0;
 
 	return 0;
@@ -466,7 +466,7 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
 	FUNC(hilse_init_lcv, 0,	HILSEN_NEXT,	HILSEN_SLEEP,	0)
 
 	/* 1  HILSEN_RESTART */
-	FUNC(hilse_inc_lcv, 10,	HILSEN_NEXT,	HILSEN_START,  0)
+	FUNC(hilse_inc_lcv, 10000,	HILSEN_NEXT,	HILSEN_START,  0)
 	OUT(HIL_CTRL_ONLY)			/* Disable APE */
 	CTS
 
@@ -485,7 +485,7 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
 	FUNC(hilse_init_lcv, 0,	HILSEN_NEXT,	HILSEN_SLEEP,	0)
 
 	/* 10 HILSEN_DHR2 */
-	FUNC(hilse_inc_lcv, 10,	HILSEN_NEXT,	HILSEN_START,	0)
+	FUNC(hilse_inc_lcv, 10000,	HILSEN_NEXT,	HILSEN_START,	0)
 	FUNC(hilse_set_ddi, -1,	HILSEN_NEXT,	0,		0)
 	OUT(HIL_PKT_CMD | HIL_CMD_DHR)
 	IN(300000,		HILSEN_DHR2,	HILSEN_DHR2,	HILSEN_NEXT)
@@ -515,7 +515,7 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
 	FUNC(hilse_init_lcv, 0,	HILSEN_NEXT,	HILSEN_DOZE,	0)
 
 	/* 22 HILSEN_ACF2 */
-	FUNC(hilse_inc_lcv, 10,	HILSEN_NEXT,	HILSEN_START,	0)
+	FUNC(hilse_inc_lcv, 10000,	HILSEN_NEXT,	HILSEN_START,	0)
 	OUT(HIL_PKT_CMD | HIL_CMD_ACF | 1)
 	IN(20000,		HILSEN_NEXT,	HILSEN_DSR,	HILSEN_NEXT)
 
@@ -572,7 +572,7 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
 	OUT(HIL_PKT_CMD | HIL_CMD_RPL)
 	EXPECT(HIL_PKT_CMD | HIL_CMD_RPL | HIL_ERR_INT,
 	       20000,		HILSEN_NEXT,	HILSEN_DSR,	HILSEN_NEXT)
-	FUNC(hilse_operate, 1,	HILSEN_OPERATE,	HILSEN_IFC,	HILSEN_PROBE)
+	FUNC(hilse_operate, 1000, HILSEN_OPERATE, HILSEN_IFC,	HILSEN_PROBE)
 
 	/* 58 HILSEN_IFCACF */
 	OUT(HIL_PKT_CMD | HIL_CMD_IFC)
@@ -584,7 +584,6 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
 
 static inline void hilse_setup_input(hil_mlc *mlc, const struct hilse_node *node)
 {
-
 	switch (node->act) {
 	case HILSE_EXPECT_DISC:
 		mlc->imatch = node->object.packet;
@@ -605,7 +604,7 @@ static inline void hilse_setup_input(hil_mlc *mlc, const struct hilse_node *node
 	}
 	mlc->istarted = 1;
 	mlc->intimeout = node->arg;
-	do_gettimeofday(&(mlc->instart));
+	ktime_get_ts64(&(mlc->instart));
 	mlc->icount = 15;
 	memset(mlc->ipacket, 0, 16 * sizeof(hil_packet));
 	BUG_ON(down_trylock(&mlc->isem));
@@ -710,7 +709,7 @@ static int hilse_donode(hil_mlc *mlc)
 			break;
 		}
 		mlc->ostarted = 0;
-		do_gettimeofday(&(mlc->instart));
+		ktime_get_ts64(&(mlc->instart));
 		write_unlock_irqrestore(&mlc->lock, flags);
 		nextidx = HILSEN_NEXT;
 		break;
@@ -731,18 +730,18 @@ static int hilse_donode(hil_mlc *mlc)
 #endif
 
 	while (nextidx & HILSEN_SCHED) {
-		struct timeval tv;
+		struct timespec64 ts;
 
 		if (!sched_long)
 			goto sched;
 
-		do_gettimeofday(&tv);
-		tv.tv_usec += USEC_PER_SEC * (tv.tv_sec - mlc->instart.tv_sec);
-		tv.tv_usec -= mlc->instart.tv_usec;
-		if (tv.tv_usec >= mlc->intimeout) goto sched;
-		tv.tv_usec = (mlc->intimeout - tv.tv_usec) * HZ / USEC_PER_SEC;
-		if (!tv.tv_usec) goto sched;
-		mod_timer(&hil_mlcs_kicker, jiffies + tv.tv_usec);
+		ktime_get_ts64(&ts);
+		ts.tv_nsec += NSEC_PER_SEC * (ts.tv_sec - mlc->instart.tv_sec);
+		ts.tv_nsec -= mlc->instart.tv_nsec;
+		if (ts.tv_nsec >= mlc->intimeout) goto sched;
+		ts.tv_nsec = (mlc->intimeout - ts.tv_nsec) * HZ / NSEC_PER_SEC;
+		if (!ts.tv_nsec) goto sched;
+		mod_timer(&hil_mlcs_kicker, jiffies + ts.tv_nsec);
 		break;
 	sched:
 		tasklet_schedule(&hil_mlcs_tasklet);
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index 1d7c7d81a5ef..c8e3eb1c98c0 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -193,7 +193,7 @@ static void hp_sdc_take(int irq, void *dev_id, uint8_t status, uint8_t data)
 	curr->seq[curr->idx++] = status;
 	curr->seq[curr->idx++] = data;
 	hp_sdc.rqty -= 2;
-	do_gettimeofday(&hp_sdc.rtv);
+	ktime_get_ts64(&hp_sdc.rtv);
 
 	if (hp_sdc.rqty <= 0) {
 		/* All data has been gathered. */
@@ -306,13 +306,13 @@ static void hp_sdc_tasklet(unsigned long foo)
 	write_lock_irq(&hp_sdc.rtq_lock);
 
 	if (hp_sdc.rcurr >= 0) {
-		struct timeval tv;
+		struct timespec64 ts;
 
-		do_gettimeofday(&tv);
-		if (tv.tv_sec > hp_sdc.rtv.tv_sec)
-			tv.tv_usec += USEC_PER_SEC;
+		ktime_get_ts64(&ts);
+		if (ts.tv_sec > hp_sdc.rtv.tv_sec)
+			ts.tv_nsec += NSEC_PER_SEC;
 
-		if (tv.tv_usec - hp_sdc.rtv.tv_usec > HP_SDC_MAX_REG_DELAY) {
+		if (ts.tv_nsec - hp_sdc.rtv.tv_nsec > HP_SDC_MAX_REG_DELAY) {
 			hp_sdc_transaction *curr;
 			uint8_t tmp;
 
@@ -322,7 +322,8 @@ static void hp_sdc_tasklet(unsigned long foo)
 			 * it back to the application. and be less verbose.
 			 */
 			printk(KERN_WARNING PREFIX "read timeout (%ius)!\n",
-			       (int)(tv.tv_usec - hp_sdc.rtv.tv_usec));
+			       (int)(ts.tv_nsec - hp_sdc.rtv.tv_nsec) /
+				     (int)NSEC_PER_USEC);
 			curr->idx += hp_sdc.rqty;
 			hp_sdc.rqty = 0;
 			tmp = curr->seq[curr->actidx];
@@ -551,7 +552,7 @@ unsigned long hp_sdc_put(void)
 
 			/* Start a new read */
 			hp_sdc.rqty = curr->seq[curr->idx];
-			do_gettimeofday(&hp_sdc.rtv);
+			ktime_get_ts64(&hp_sdc.rtv);
 			curr->idx++;
 			/* Still need to lock here in case of spurious irq. */
 			write_lock_irq(&hp_sdc.rtq_lock);
diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
index d50f0678bf47..66020cd931be 100644
--- a/drivers/input/serio/hp_sdc_mlc.c
+++ b/drivers/input/serio/hp_sdc_mlc.c
@@ -149,7 +149,7 @@ static int hp_sdc_mlc_in(hil_mlc *mlc, suseconds_t timeout)
 
 	/* Try to down the semaphore */
 	if (down_trylock(&mlc->isem)) {
-		struct timeval tv;
+		struct timespec64 ts;
 		if (priv->emtestmode) {
 			mlc->ipacket[0] =
 				HIL_ERR_INT | (mlc->opacket &
@@ -160,11 +160,11 @@ static int hp_sdc_mlc_in(hil_mlc *mlc, suseconds_t timeout)
 			/* printk(KERN_DEBUG PREFIX ">[%x]\n", mlc->ipacket[0]); */
 			goto wasup;
 		}
-		do_gettimeofday(&tv);
-		tv.tv_usec += USEC_PER_SEC * (tv.tv_sec - mlc->instart.tv_sec);
-		if (tv.tv_usec - mlc->instart.tv_usec > mlc->intimeout) {
+		ktime_get_ts64(&ts);
+		ts.tv_nsec += NSEC_PER_SEC * (ts.tv_sec - mlc->instart.tv_sec);
+		if (ts.tv_nsec - mlc->instart.tv_nsec > mlc->intimeout) {
 			/*	printk("!%i %i",
-				tv.tv_usec - mlc->instart.tv_usec,
+				tv.tv_nsec - mlc->instart.tv_nsec,
 				mlc->intimeout);
 			 */
 			rc = 1;
diff --git a/include/linux/hil_mlc.h b/include/linux/hil_mlc.h
index 394a8405dd74..f846730d6595 100644
--- a/include/linux/hil_mlc.h
+++ b/include/linux/hil_mlc.h
@@ -32,7 +32,7 @@
  */
 
 #include <linux/hil.h>
-#include <linux/time.h>
+#include <linux/time64.h>
 #include <linux/interrupt.h>
 #include <linux/semaphore.h>
 #include <linux/serio.h>
@@ -144,12 +144,12 @@ struct hil_mlc {
 	hil_packet		ipacket[16];
 	hil_packet		imatch;
 	int			icount;
-	struct timeval		instart;
+	struct timespec64	instart;
 	suseconds_t		intimeout;
 
 	int			ddi;	/* Last operational device id */
 	int			lcv;	/* LCV to throttle loops */
-	struct timeval		lcv_tv; /* Time loop was started */
+	struct timespec64	lcv_tv; /* Time loop was started */
 
 	int			di_map[7]; /* Maps below items to live devs */
 	struct hil_mlc_devinfo	di[HIL_MLC_DEVMEM];
diff --git a/include/linux/hp_sdc.h b/include/linux/hp_sdc.h
index d392975d8887..d863944f5c0c 100644
--- a/include/linux/hp_sdc.h
+++ b/include/linux/hp_sdc.h
@@ -47,9 +47,9 @@
 #endif
 
 
-/* No 4X status reads take longer than this (in usec).
+/* No 4X status reads take longer than this (in nsec).
  */
-#define HP_SDC_MAX_REG_DELAY 20000
+#define HP_SDC_MAX_REG_DELAY 20000000
 
 typedef void (hp_sdc_irqhook) (int irq, void *dev_id, 
 			       uint8_t status, uint8_t data);
@@ -281,7 +281,7 @@ typedef struct {
 	hp_sdc_transaction *tq[HP_SDC_QUEUE_LEN]; /* All pending read/writes */
 
 	int		rcurr, rqty;	/* Current read transact in process */
-	struct timeval	rtv;		/* Time when current read started */
+	struct timespec64 rtv;		/* Monotonic time when current read started */
 	int		wcurr;		/* Current write transact in process */
 
 	int		dev_err;	/* carries status from registration */
-- 
2.14.1

Re: [PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Arnd Bergmann]

On Thu, Dec 7, 2017 at 7:13 PM, Deepa Dinamani <deepa.kernel@gmail.com> wrote:
> struct timeval which is part of struct input_event to
> maintain the event times is not y2038 safe.
>
> Real time timestamps are also not ideal for input_event
> as this time can go backwards as noted in the patch
> a80b83b7b8 by John Stultz.
>
> The patch switches the timestamps to use monotonic time
> from realtime time. This is assuming no one is using
> absolute times from these timestamps.
>
> The structure to maintain input events will be changed
> in a different patch.
>
> Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

Re: [PATCH v4 0/4] Make input drivers y2038 safe

[Peter Hutterer]

On Thu, Dec 07, 2017 at 10:13:02AM -0800, Deepa Dinamani wrote:
> The series is aimed at making input events y2038 safe.
> It extends the lifetime of the realtime timestamps in the
> events to year 2106.
> The series is also a necessary update as glibc is set to provide
> 64 bit time_t support for 32 bit binaries. glibc plan is detailed
> at https://sourceware.org/glibc/wiki/Y2038ProofnessDesign .
> 
> The series is a result of discussions with Arnd Bergmann and
> Dmitry Torokhov at last Plumbers.
> 
> The plan is to deprecate realtime timestamps anyway as they
> are not appropriate for these timestamps as noted in the patch
> a80b83b7b8 by John Stultz.
> 
> The design also updates the format of the input events read/ written
> to the device nodes. This breaks 32 bit interface to the input
> events at compile time as preferred by the maintainer.
> 
> The userspace library changes to libevdev, libuinput and mtdev
> will be posted to the respective mailing groups for review.

Acked-by: Peter Hutterer <peter.hutterer@who-t.net>

Cheers,
   Peter

> Changes from v3:
> * Updated uinput to support monotonic time only
> * Addressed review comments
> Changes from v2:
> * Updated the design to break 32 bit interfaces at compile time.
> Changes from v1:
> * Updated changes according to review comments.
> * Posted userspace library changes that go along with the series.
> 
> Deepa Dinamani (4):
>   uinput: Use monotonic times for uinput timestamps.
>   input: evdev: Replace timeval with timespec64
>   input: Deprecate real timestamps beyond year 2106
>   input: serio: Replace timeval by timespec64
> 
>  drivers/input/evdev.c            | 43 +++++++++++++++++++++++++---------------
>  drivers/input/input-compat.c     | 11 +++++-----
>  drivers/input/input-compat.h     |  3 ++-
>  drivers/input/misc/uinput.c      |  5 ++++-
>  drivers/input/serio/hil_mlc.c    | 37 +++++++++++++++++-----------------
>  drivers/input/serio/hp_sdc.c     | 17 ++++++++--------
>  drivers/input/serio/hp_sdc_mlc.c | 10 +++++-----
>  include/linux/hil_mlc.h          |  6 +++---
>  include/linux/hp_sdc.h           |  6 +++---
>  include/uapi/linux/input.h       | 12 ++++++++++-
>  10 files changed, 88 insertions(+), 62 deletions(-)
> 
> 
> base-commit: b0a84f19a5161418d4360cd57603e94ed489915e
> -- 
> 2.14.1
> 

Re: [Y2038] [PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Ben Hutchings]

On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
> struct timeval which is part of struct input_event to
> maintain the event times is not y2038 safe.
> 
> Real time timestamps are also not ideal for input_event
> as this time can go backwards as noted in the patch
> a80b83b7b8 by John Stultz.
> 
> The patch switches the timestamps to use monotonic time
> from realtime time. This is assuming no one is using
> absolute times from these timestamps.

Why is this change not opt-in, as for evdev?  I assume there were
compatibility reasons for not changing evdev's clock by default, so I
would expect them to apply to uinput as well.  (But I'm also prepared
to believe that user-space is now generally compatible with and would
prefer monotonic time from all input devices.)

Ben.

> The structure to maintain input events will be changed
> in a different patch.
> 
> Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
> ---
>  drivers/input/misc/uinput.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
> index 39ddd9a73feb..d521aecbc078 100644
> --- a/drivers/input/misc/uinput.c
> +++ b/drivers/input/misc/uinput.c
> @@ -84,11 +84,14 @@ static int uinput_dev_event(struct input_dev *dev,
> >  			    unsigned int type, unsigned int code, int value)
>  {
>  	struct uinput_device	*udev = input_get_drvdata(dev);
> +	struct timespec64	ts;
>  
>  	udev->buff[udev->head].type = type;
>  	udev->buff[udev->head].code = code;
>  	udev->buff[udev->head].value = value;
> -	do_gettimeofday(&udev->buff[udev->head].time);
> +	ktime_get_ts64(&ts);
> +	udev->buff[udev->head].time.tv_sec = ts.tv_sec;
> +	udev->buff[udev->head].time.tv_usec = ts.tv_nsec / NSEC_PER_USEC;
>  	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
>  
>  	wake_up_interruptible(&udev->waitq);
-- 
Ben Hutchings
Software Developer, Codethink Ltd.

Re: [Y2038] [PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Ben Hutchings]

On Thu, 2017-12-14 at 21:17 +0000, Ben Hutchings wrote:
> On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
> > struct timeval which is part of struct input_event to
> > maintain the event times is not y2038 safe.
> > 
> > Real time timestamps are also not ideal for input_event
> > as this time can go backwards as noted in the patch
> > a80b83b7b8 by John Stultz.
> > 
> > The patch switches the timestamps to use monotonic time
> > from realtime time. This is assuming no one is using
> > absolute times from these timestamps.
> 
> Why is this change not opt-in, as for evdev?  I assume there were
> compatibility reasons for not changing evdev's clock by default, so I
> would expect them to apply to uinput as well.  (But I'm also prepared
> to believe that user-space is now generally compatible with and would
> prefer monotonic time from all input devices.)

Never mind, I've gone back and seen Arnd's comments about compatibility
on v3.  It might be worth copying those into the commit message though.

Ben.

> Ben.
> 
> > The structure to maintain input events will be changed
> > in a different patch.
> > 
> > Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
> > ---
> >  drivers/input/misc/uinput.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/input/misc/uinput.c
> > b/drivers/input/misc/uinput.c
> > index 39ddd9a73feb..d521aecbc078 100644
> > --- a/drivers/input/misc/uinput.c
> > +++ b/drivers/input/misc/uinput.c
> > @@ -84,11 +84,14 @@ static int uinput_dev_event(struct input_dev
> > *dev,
> > >  			    unsigned int type, unsigned int
> > > code, int value)
> > 
> >  {
> >  	struct uinput_device	*udev =
> > input_get_drvdata(dev);
> > +	struct timespec64	ts;
> >  
> >  	udev->buff[udev->head].type = type;
> >  	udev->buff[udev->head].code = code;
> >  	udev->buff[udev->head].value = value;
> > -	do_gettimeofday(&udev->buff[udev->head].time);
> > +	ktime_get_ts64(&ts);
> > +	udev->buff[udev->head].time.tv_sec = ts.tv_sec;
> > +	udev->buff[udev->head].time.tv_usec = ts.tv_nsec /
> > NSEC_PER_USEC;
> >  	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
> >  
> >  	wake_up_interruptible(&udev->waitq);
-- 
Ben Hutchings
Software Developer, Codethink Ltd.

Re: [Y2038] [PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Deepa Dinamani]

On Thu, Dec 14, 2017 at 1:18 PM, Ben Hutchings
<ben.hutchings@codethink.co.uk> wrote:
> On Thu, 2017-12-14 at 21:17 +0000, Ben Hutchings wrote:
>> On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
>> > struct timeval which is part of struct input_event to
>> > maintain the event times is not y2038 safe.
>> >
>> > Real time timestamps are also not ideal for input_event
>> > as this time can go backwards as noted in the patch
>> > a80b83b7b8 by John Stultz.
>> >
>> > The patch switches the timestamps to use monotonic time
>> > from realtime time. This is assuming no one is using
>> > absolute times from these timestamps.
>>
>> Why is this change not opt-in, as for evdev?  I assume there were
>> compatibility reasons for not changing evdev's clock by default, so I
>> would expect them to apply to uinput as well.  (But I'm also prepared
>> to believe that user-space is now generally compatible with and would
>> prefer monotonic time from all input devices.)
>
> Never mind, I've gone back and seen Arnd's comments about compatibility
> on v3.  It might be worth copying those into the commit message though.

Commit message already talks about this assumption?:

The patch switches the timestamps to use monotonic time
from realtime time. This is assuming no one is using
absolute times from these timestamps.

-Deepa

Re: [Y2038] [PATCH v4 4/4] input: serio: Replace timeval by timespec64

[Ben Hutchings]

On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
> struct timeval is not y2038 safe.
> All references to timeval will be deleted from the
> kernel to make it y2038 safe.
> Replace its uses by y2038 safe struct timespec64.
> 
> The timestamps changed here only keep track of delta
> times. These timestamps are also internal to kernel.
> Hence, monotonic times are sufficient here.
> The unit of the delta times is also changed in certain
> cases to nanoseconds rather than microseconds. This is
> in line with timespec64 which keeps time in nanoseconds.
[...]
> --- a/drivers/input/serio/hil_mlc.c
> +++ b/drivers/input/serio/hil_mlc.c
[...]
> @@ -466,7 +466,7 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
>  	FUNC(hilse_init_lcv, 0,	HILSEN_NEXT,	HILSEN_SLEEP,	0)
>  
>  	/* 1  HILSEN_RESTART */
> -	FUNC(hilse_inc_lcv, 10,	HILSEN_NEXT,	HILSEN_START,  0)
> +	FUNC(hilse_inc_lcv, 10000,	HILSEN_NEXT,	HILSEN_START,  0)
[...]

The second macro argument here ends up as the second argument to
hilse_inc_lcv() which appears to limit the number of retries, not a
time limit.  So I don't think the value here (or wherever else
hilse_inc_lcv is referenced) should be changed.

The EXPECT, EXPECT_LAST etc. macros take a timeout ('to' parameter)
which is then assigned to hil_mlc::intimeout, so it seems that those
*should* be scaled up, but this patch doesn't do that.  It also doesn't
change the type of hil_mlc::intimeout (suseconds_t implying units of
microseconds) or the comment on hilse_node::arg.

Alternately, it might be safer to keep all the timeouts in units of
microseconds.

Ben.

-- 
Ben Hutchings
Software Developer, Codethink Ltd.

Re: [Y2038] [PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Ben Hutchings]

On Thu, 2017-12-14 at 13:44 -0800, Deepa Dinamani wrote:
> On Thu, Dec 14, 2017 at 1:18 PM, Ben Hutchings
> > <ben.hutchings@codethink.co.uk> wrote:
> > On Thu, 2017-12-14 at 21:17 +0000, Ben Hutchings wrote:
> > > On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
> > > > struct timeval which is part of struct input_event to
> > > > maintain the event times is not y2038 safe.
> > > > 
> > > > Real time timestamps are also not ideal for input_event
> > > > as this time can go backwards as noted in the patch
> > > > a80b83b7b8 by John Stultz.
> > > > 
> > > > The patch switches the timestamps to use monotonic time
> > > > from realtime time. This is assuming no one is using
> > > > absolute times from these timestamps.
> > > 
> > > Why is this change not opt-in, as for evdev?  I assume there were
> > > compatibility reasons for not changing evdev's clock by default, so I
> > > would expect them to apply to uinput as well.  (But I'm also prepared
> > > to believe that user-space is now generally compatible with and would
> > > prefer monotonic time from all input devices.)
> > 
> > Never mind, I've gone back and seen Arnd's comments about compatibility
> > on v3.  It might be worth copying those into the commit message though.
> 
> Commit message already talks about this assumption?:
> 
> The patch switches the timestamps to use monotonic time
> from realtime time. This is assuming no one is using
> absolute times from these timestamps.

Yes, but Arnd did a bit of code research to check that assumption.
A commit message that says "we checked and it appears that no user-
space depends on this" looks better than "I assume that no user-space
depends on this".

Ben.

-- 
Ben Hutchings
Software Developer, Codethink Ltd.

Re: [Y2038] [PATCH v4 1/4] uinput: Use monotonic times for uinput timestamps.

[Deepa Dinamani]

On Thu, Dec 14, 2017 at 1:53 PM, Ben Hutchings
<ben.hutchings@codethink.co.uk> wrote:
> On Thu, 2017-12-14 at 13:44 -0800, Deepa Dinamani wrote:
>> On Thu, Dec 14, 2017 at 1:18 PM, Ben Hutchings
>> > <ben.hutchings@codethink.co.uk> wrote:
>> > On Thu, 2017-12-14 at 21:17 +0000, Ben Hutchings wrote:
>> > > On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
>> > > > struct timeval which is part of struct input_event to
>> > > > maintain the event times is not y2038 safe.
>> > > >
>> > > > Real time timestamps are also not ideal for input_event
>> > > > as this time can go backwards as noted in the patch
>> > > > a80b83b7b8 by John Stultz.
>> > > >
>> > > > The patch switches the timestamps to use monotonic time
>> > > > from realtime time. This is assuming no one is using
>> > > > absolute times from these timestamps.
>> > >
>> > > Why is this change not opt-in, as for evdev?  I assume there were
>> > > compatibility reasons for not changing evdev's clock by default, so I
>> > > would expect them to apply to uinput as well.  (But I'm also prepared
>> > > to believe that user-space is now generally compatible with and would
>> > > prefer monotonic time from all input devices.)
>> >
>> > Never mind, I've gone back and seen Arnd's comments about compatibility
>> > on v3.  It might be worth copying those into the commit message though.
>>
>> Commit message already talks about this assumption?:
>>
>> The patch switches the timestamps to use monotonic time
>> from realtime time. This is assuming no one is using
>> absolute times from these timestamps.
>
> Yes, but Arnd did a bit of code research to check that assumption.
> A commit message that says "we checked and it appears that no user-
> space depends on this" looks better than "I assume that no user-space
> depends on this".

The fact is we do not know all the places this is used. Arnd happened
to find an instance. This is why Dmitry suggested that we will provide
a ioctl or something if someone complains.
It is not my assumption. It is the assumption that the patch is based
on. This is to call people's attention to the fact that this is
controversial. And, if they do not agree with the assumption, they
should complain.
So it does not matter we found an instance where the assumption is true.

-Deepa

Re: [Y2038] [PATCH v4 4/4] input: serio: Replace timeval by timespec64

[Deepa Dinamani]

On Thu, Dec 14, 2017 at 1:45 PM, Ben Hutchings
<ben.hutchings@codethink.co.uk> wrote:
> On Thu, 2017-12-07 at 10:13 -0800, Deepa Dinamani wrote:
>> struct timeval is not y2038 safe.
>> All references to timeval will be deleted from the
>> kernel to make it y2038 safe.
>> Replace its uses by y2038 safe struct timespec64.
>>
>> The timestamps changed here only keep track of delta
>> times. These timestamps are also internal to kernel.
>> Hence, monotonic times are sufficient here.
>> The unit of the delta times is also changed in certain
>> cases to nanoseconds rather than microseconds. This is
>> in line with timespec64 which keeps time in nanoseconds.
> [...]
>> --- a/drivers/input/serio/hil_mlc.c
>> +++ b/drivers/input/serio/hil_mlc.c
> [...]
>> @@ -466,7 +466,7 @@ static const struct hilse_node hil_mlc_se[HILSEN_END] = {
>>       FUNC(hilse_init_lcv, 0, HILSEN_NEXT,    HILSEN_SLEEP,   0)
>>
>>       /* 1  HILSEN_RESTART */
>> -     FUNC(hilse_inc_lcv, 10, HILSEN_NEXT,    HILSEN_START,  0)
>> +     FUNC(hilse_inc_lcv, 10000,      HILSEN_NEXT,    HILSEN_START,  0)
> [...]
>
> The second macro argument here ends up as the second argument to
> hilse_inc_lcv() which appears to limit the number of retries, not a
> time limit.  So I don't think the value here (or wherever else
> hilse_inc_lcv is referenced) should be changed.

I think I misread the code here.

> The EXPECT, EXPECT_LAST etc. macros take a timeout ('to' parameter)
> which is then assigned to hil_mlc::intimeout, so it seems that those
> *should* be scaled up, but this patch doesn't do that.  It also doesn't
> change the type of hil_mlc::intimeout (suseconds_t implying units of
> microseconds) or the comment on hilse_node::arg.

Yes, I have overlooked the suseconds_t here. So apart from what you
point out IN() and a few other things should also be fixed.

I will drop this patch and repost the series as Arnd mentioned he
already posted a version of this patch. The series can go in without
it and if we prefer my version here, I can submit the patch alone.

Thanks,
-Deepa