1. 06 Jun, 2017 1 commit
  2. 05 May, 2017 2 commits
    • Rafael J. Wysocki's avatar
      ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle · eed4d47e
      Rafael J. Wysocki authored
      
      The ACPI SCI (System Control Interrupt) is set up as a wakeup IRQ
      during suspend-to-idle transitions and, consequently, any events
      signaled through it wake up the system from that state.  However,
      on some systems some of the events signaled via the ACPI SCI while
      suspended to idle should not cause the system to wake up.  In fact,
      quite often they should just be discarded.
      
      Arguably, systems should not resume entirely on such events, but in
      order to decide which events really should cause the system to resume
      and which are spurious, it is necessary to resume up to the point
      when ACPI SCIs are actually handled and processed, which is after
      executing dpm_resume_noirq() in the system resume path.
      
      For this reasons, add a loop around freeze_enter() in which the
      platforms can process events signaled via multiplexed IRQ lines
      like the ACPI SCI and add suspend-to-idle hooks that can be
      used for this purpose to struct platform_freeze_ops.
      
      In the ACPI case, the ->wake hook is used for checking if the SCI
      has triggered while suspended and deferring the interrupt-induced
      system wakeup until the events signaled through it are actually
      processed sufficiently to decide whether or not the system should
      resume.  In turn, the ->sync hook allows all of the relevant event
      queues to be flushed so as to prevent events from being missed due
      to race conditions.
      
      In addition to that, some ACPI code processing wakeup events needs
      to be modified to use the "hard" version of wakeup triggers, so that
      it will cause a system resume to happen on device-induced wakeup
      events even if the "soft" mechanism to prevent the system from
      suspending is not enabled (that also helps to catch device-induced
      wakeup events occurring during suspend transitions in progress).
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      eed4d47e
    • Rafael J. Wysocki's avatar
      PM / wakeup: Integrate mechanism to abort transitions in progress · 8a537ece
      Rafael J. Wysocki authored
      
      The system wakeup framework is not very consistent with respect to
      the way it handles suspend-to-idle and generally wakeup events
      occurring during transitions to system low-power states.
      
      First off, system transitions in progress are aborted by the event
      reporting helpers like pm_wakeup_event() only if the wakeup_count
      sysfs attribute is in use (as documented), but there are cases in
      which system-wide transitions should be aborted even if that is
      not the case.  For example, a wakeup signal from a designated
      wakeup device during system-wide PM transition, it should cause
      the transition to be aborted right away.
      
      Moreover, there is a freeze_wake() call in wakeup_source_activate(),
      but that really is only effective after suspend_freeze_state has
      been set to FREEZE_STATE_ENTER by freeze_enter().  However, it
      is very unlikely that wakeup_source_activate() will ever be called
      at that time, as it could only be triggered by a IRQF_NO_SUSPEND
      interrupt handler, so wakeups from suspend-to-idle don't really
      occur in wakeup_source_activate().
      
      At the same time there is a way to abort a system suspend in
      progress (or wake up the system from suspend-to-idle), which is by
      calling pm_system_wakeup(), but in turn that doesn't cause any
      wakeup source objects to be activated, so it will not be covered
      by wakeup source statistics and will not prevent the system from
      suspending again immediately (in case autosleep is used, for
      example).  Consequently, if anyone wants to abort system transitions
      in progress and allow the wakeup_count mechanism to work, they need
      to use both pm_system_wakeup() and pm_wakeup_event(), say, at the
      same time which is awkward.
      
      For the above reasons, make it possible to trigger
      pm_system_wakeup() from within wakeup_source_activate() and
      provide a new pm_wakeup_hard_event() helper to do so within the
      wakeup framework.
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      8a537ece
  3. 27 Apr, 2017 1 commit
    • Dmitry V. Levin's avatar
      uapi: change the type of struct statx_timestamp.tv_nsec to unsigned · 1741937d
      Dmitry V. Levin authored
      The comment asserting that the value of struct statx_timestamp.tv_nsec
      must be negative when statx_timestamp.tv_sec is negative, is wrong, as
      could be seen from the following example:
      
      	#define _FILE_OFFSET_BITS 64
      	#include <assert.h>
      	#include <fcntl.h>
      	#include <stdio.h>
      	#include <sys/stat.h>
      	#include <unistd.h>
      	#include <asm/unistd.h>
      	#include <linux/stat.h>
      
      	int main(void)
      	{
      		static const struct timespec ts[2] = {
      			{ .tv_nsec = UTIME_OMIT },
      			{ .tv_sec = -2, .tv_nsec = 42 }
      		};
      		assert(utimensat(AT_FDCWD, ".", ts, 0) == 0);
      
      		struct stat st;
      		assert(stat(".", &st) == 0);
      		printf("st_mtim.tv_sec = %lld, st_mtim.tv_nsec = %lu\n",
      		       (long long) st.st_mtim.tv_sec,
      		       (unsigned long) st.st_mtim.tv_nsec);
      
      		struct statx stx;
      		assert(syscall(__NR_statx, AT_FDCWD, ".", 0, 0, &stx) == 0);
      		printf("stx_mtime.tv_sec = %lld, stx_mtime.tv_nsec = %lu\n",
      		       (long long) stx.stx_mtime.tv_sec,
      		       (unsigned long) stx.stx_mtime.tv_nsec);
      
      		return 0;
      	}
      
      It expectedly prints:
      st_mtim.tv_sec = -2, st_mtim.tv_nsec = 42
      stx_mtime.tv_sec = -2, stx_mtime.tv_nsec = 42
      
      The more generic comment asserting that the value of struct
      statx_timestamp.tv_nsec might be negative is confusing to say the least.
      
      It contradicts both the struct stat.st_[acm]time_nsec tradition and
      struct timespec.tv_nsec requirements in utimensat syscall.
      If statx syscall ever returns a stx_[acm]time containing a negative
      tv_nsec that cannot be passed unmodified to utimensat syscall,
      it will cause an immense confusion.
      
      Fix this source of confusion by changing the type of struct
      statx_timestamp.tv_nsec from __s32 to __u32.
      
      Fixes: a528d35e
      
       ("statx: Add a system call to make enhanced file info available")
      Signed-off-by: default avatarDmitry V. Levin <ldv@altlinux.org>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      cc: linux-api@vger.kernel.org
      cc: mtk.manpages@gmail.com
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      1741937d
  4. 26 Apr, 2017 1 commit
    • Alexander Kochetkov's avatar
      net: phy: fix auto-negotiation stall due to unavailable interrupt · f555f34f
      Alexander Kochetkov authored
      The Ethernet link on an interrupt driven PHY was not coming up if the Ethernet
      cable was plugged before the Ethernet interface was brought up.
      
      The patch trigger PHY state machine to update link state if PHY was requested to
      do auto-negotiation and auto-negotiation complete flag already set.
      
      During power-up cycle the PHY do auto-negotiation, generate interrupt and set
      auto-negotiation complete flag. Interrupt is handled by PHY state machine but
      doesn't update link state because PHY is in PHY_READY state. After some time
      MAC bring up, start and request PHY to do auto-negotiation. If there are no new
      settings to advertise genphy_config_aneg() doesn't start PHY auto-negotiation.
      PHY continue to stay in auto-negotiation complete state and doesn't fire
      interrupt. At the same time PHY state machine expect that PHY started
      auto-negotiation and is waiting for interrupt from PHY and it won't get it.
      
      Fixes: 321beec5
      
       ("net: phy: Use interrupts when available in NOLINK state")
      Signed-off-by: default avatarAlexander Kochetkov <al.kochet@gmail.com>
      Cc: stable <stable@vger.kernel.org> # v4.9+
      Tested-by: default avatarRoger Quadros <rogerq@ti.com>
      Tested-by: default avatarAlexandre Belloni <alexandre.belloni@free-electrons.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f555f34f
  5. 21 Apr, 2017 1 commit
    • David Ahern's avatar
      net: ipv6: RTF_PCPU should not be settable from userspace · 557c44be
      David Ahern authored
      Andrey reported a fault in the IPv6 route code:
      
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] SMP KASAN
      Modules linked in:
      CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
      task: ffff880069809600 task.stack: ffff880062dc8000
      RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975
      RSP: 0018:ffff880062dced30 EFLAGS: 00010206
      RAX: dffffc0000000000 RBX: ffff8800670561c0 RCX: 0000000000000006
      RDX: 0000000000000003 RSI: ffff880062dcfb28 RDI: 0000000000000018
      RBP: ffff880062dced68 R08: 0000000000000001 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
      R13: ffff880062dcfb28 R14: dffffc0000000000 R15: 0000000000000000
      FS:  00007feebe37e7c0(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000205a0fe4 CR3: 000000006b5c9000 CR4: 00000000000006e0
      Call Trace:
       ip6_pol_route+0x1512/0x1f20 net/ipv6/route.c:1128
       ip6_pol_route_output+0x4c/0x60 net/ipv6/route.c:1212
      ...
      
      Andrey's syzkaller program passes rtmsg.rtmsg_flags with the RTF_PCPU bit
      set. Flags passed to the kernel are blindly copied to the allocated
      rt6_info by ip6_route_info_create making a newly inserted route appear
      as though it is a per-cpu route. ip6_rt_cache_alloc sees the flag set
      and expects rt->dst.from to be set - which it is not since it is not
      really a per-cpu copy. The subsequent call to __ip6_dst_alloc then
      generates the fault.
      
      Fix by checking for the flag and failing with EINVAL.
      
      Fixes: d52d3997
      
       ("ipv6: Create percpu rt6_info")
      Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
      Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      557c44be
  6. 18 Apr, 2017 1 commit
  7. 14 Apr, 2017 2 commits
  8. 10 Apr, 2017 2 commits
  9. 08 Apr, 2017 1 commit
  10. 07 Apr, 2017 4 commits
  11. 06 Apr, 2017 1 commit
    • Tony Lindgren's avatar
      pinctrl: core: Fix pinctrl_register_and_init() with pinctrl_enable() · 61187142
      Tony Lindgren authored
      Recent pinctrl changes to allow dynamic allocation of pins exposed one
      more issue with the pinctrl pins claimed early by the controller itself.
      This caused a regression for IMX6 pinctrl hogs.
      
      Before enabling the pin controller driver we need to wait until it has
      been properly initialized, then claim the hogs, and only then enable it.
      
      To fix the regression, split the code into pinctrl_claim_hogs() and
      pinctrl_enable(). And then let's require that pinctrl_enable() is always
      called by the pin controller driver when ready after calling
      pinctrl_register_and_init().
      
      Depends-on: 950b0d91 ("pinctrl: core: Fix regression caused by delayed
      work for hogs")
      Fixes: df61b366af26 ("pinctrl: core: Use delayed work for hogs")
      Fixes: e566fc11
      
       ("pinctrl: imx: use generic pinctrl helpers for
      managing groups")
      Cc: Haojian Zhuang <haojian.zhuang@linaro.org>
      Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
      Cc: Mika Penttilä <mika.penttila@nextfour.com>
      Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
      Cc: Nishanth Menon <nm@ti.com>
      Cc: Shawn Guo <shawnguo@kernel.org>
      Cc: Stefan Agner <stefan@agner.ch>
      Tested-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
      Tested-by: default avatarGary Bisson <gary.bisson@boundarydevices.com>
      Tested-by: default avatarFabio Estevam <fabio.estevam@nxp.com>
      Signed-off-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      61187142
  12. 05 Apr, 2017 2 commits
  13. 04 Apr, 2017 3 commits
  14. 03 Apr, 2017 3 commits
  15. 02 Apr, 2017 2 commits
  16. 01 Apr, 2017 4 commits
  17. 31 Mar, 2017 2 commits
    • Mike Christie's avatar
      target: Fix ALUA transition state race between multiple initiators · d19c4643
      Mike Christie authored
      
      Multiple threads could be writing to alua_access_state at
      the same time, or there could be multiple STPGs in flight
      (different initiators sending them or one initiator sending
      them to different ports), or a combo of both and the
      core_alua_do_transition_tg_pt calls will race with each other.
      
      Because from the last patches we no longer delay running
      core_alua_do_transition_tg_pt_work, there does not seem to be
      any point in running that in a workqueue. And, we always
      wait for it to complete one way or another, so we can sleep
      in this code path. So, this patch made over target-pending just adds a
      mutex and does the work core_alua_do_transition_tg_pt_work was doing in
      core_alua_do_transition_tg_pt.
      
      There is also no need to use an atomic for the
      tg_pt_gp_alua_access_state. In core_alua_do_transition_tg_pt we will
      test and set it under the transition mutex. And, it is a int/32 bits
      so in the other places where it is read, we will never see it partially
      updated.
      Signed-off-by: default avatarMike Christie <mchristi@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      d19c4643
    • Nicholas Bellinger's avatar
      target: Fix unknown fabric callback queue-full errors · fa7e25cf
      Nicholas Bellinger authored
      
      This patch fixes a set of queue-full response handling
      bugs, where outgoing responses are leaked when a fabric
      driver is propagating non -EAGAIN or -ENOMEM errors
      to target-core.
      
      It introduces TRANSPORT_COMPLETE_QF_ERR state used to
      signal when CHECK_CONDITION status should be generated,
      when fabric driver ->write_pending(), ->queue_data_in(),
      or ->queue_status() callbacks fail with non -EAGAIN or
      -ENOMEM errors, and data-transfer should not be retried.
      
      Note all fabric driver -EAGAIN and -ENOMEM errors are
      still retried indefinately with associated data-transfer
      callbacks, following existing queue-full logic.
      
      Also fix two missing ->queue_status() queue-full cases
      related to CMD_T_ABORTED w/ TAS status handling.
      Reported-by: default avatarPotnuri Bharat Teja <bharat@chelsio.com>
      Reviewed-by: default avatarPotnuri Bharat Teja <bharat@chelsio.com>
      Tested-by: default avatarPotnuri Bharat Teja <bharat@chelsio.com>
      Cc: Potnuri Bharat Teja <bharat@chelsio.com>
      Reported-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Cc: Steve Wise <swise@opengridcomputing.com>
      Cc: Sagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      fa7e25cf
  18. 30 Mar, 2017 3 commits
    • Xin Long's avatar
      sctp: alloc stream info when initializing asoc · 3dbcc105
      Xin Long authored
      
      When sending a msg without asoc established, sctp will send INIT packet
      first and then enqueue chunks.
      
      Before receiving INIT_ACK, stream info is not yet alloced. But enqueuing
      chunks needs to access stream info, like out stream state and out stream
      cnt.
      
      This patch is to fix it by allocing out stream info when initializing an
      asoc, allocing in stream and re-allocing out stream when processing init.
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      3dbcc105
    • Thomas Hellstrom's avatar
      drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces · fe25deb7
      Thomas Hellstrom authored
      
      Previously, when a surface was opened using a legacy (non prime) handle,
      it was verified to have been created by a client in the same master realm.
      Relax this so that opening is also allowed recursively if the client
      already has the surface open.
      
      This works around a regression in svga mesa where opening of a shared
      surface is used recursively to obtain surface information.
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
      Reviewed-by: default avatarSinclair Yeh <syeh@vmware.com>
      fe25deb7
    • Nicholas Bellinger's avatar
      target: Avoid mappedlun symlink creation during lun shutdown · 49cb77e2
      Nicholas Bellinger authored
      
      This patch closes a race between se_lun deletion during configfs
      unlink in target_fabric_port_unlink() -> core_dev_del_lun()
      -> core_tpg_remove_lun(), when transport_clear_lun_ref() blocks
      waiting for percpu_ref RCU grace period to finish, but a new
      NodeACL mappedlun is added before the RCU grace period has
      completed.
      
      This can happen in target_fabric_mappedlun_link() because it
      only checks for se_lun->lun_se_dev, which is not cleared until
      after transport_clear_lun_ref() percpu_ref RCU grace period
      finishes.
      
      This bug originally manifested as NULL pointer dereference
      OOPsen in target_stat_scsi_att_intr_port_show_attr_dev() on
      v4.1.y code, because it dereferences lun->lun_se_dev without
      a explicit NULL pointer check.
      
      In post v4.1 code with target-core RCU conversion, the code
      in target_stat_scsi_att_intr_port_show_attr_dev() no longer
      uses se_lun->lun_se_dev, but the same race still exists.
      
      To address the bug, go ahead and set se_lun>lun_shutdown as
      early as possible in core_tpg_remove_lun(), and ensure new
      NodeACL mappedlun creation in target_fabric_mappedlun_link()
      fails during se_lun shutdown.
      Reported-by: default avatarJames Shen <jcs@datera.io>
      Cc: James Shen <jcs@datera.io>
      Tested-by: default avatarJames Shen <jcs@datera.io>
      Cc: stable@vger.kernel.org # 3.10+
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      49cb77e2
  19. 29 Mar, 2017 1 commit
    • Xin Long's avatar
      sctp: change to save MSG_MORE flag into assoc · f9ba3501
      Xin Long authored
      David Laight noticed the support for MSG_MORE with datamsg->force_delay
      didn't really work as we expected, as the first msg with MSG_MORE set
      would always block the following chunks' dequeuing.
      
      This Patch is to rewrite it by saving the MSG_MORE flag into assoc as
      David Laight suggested.
      
      asoc->force_delay is used to save MSG_MORE flag before a msg is sent.
      All chunks in queue would not be sent out if asoc->force_delay is set
      by the msg with MSG_MORE flag, until a new msg without MSG_MORE flag
      clears asoc->force_delay.
      
      Note that this change would not affect the flush is generated by other
      triggers, like asoc->state != ESTABLISHED, queue size > pmtu etc.
      
      v1->v2:
        Not clear asoc->force_delay after sending the msg with MSG_MORE flag.
      
      Fixes: 4ea0c32f
      
       ("sctp: add support for MSG_MORE")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarDavid Laight <david.laight@aculab.com>
      Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f9ba3501
  20. 28 Mar, 2017 2 commits
  21. 25 Mar, 2017 1 commit