linux-stable.git/drivers/char/ipmi, branch linux-4.6.y

ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()

2016-07-27T15:42:15+00:00

commit ae4ea9a2460c7fee2ae8feeb4dfe96f5f6c3e562 upstream.

Commit 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for
SMI interfaces") changed handle_new_recv_msgs() to call handle_one_recv_msg()
for a smi_msg while the smi_msg is still connected to waiting_rcv_msgs list.
That could lead to following list corruption problems:

1) low-level function treats smi_msg as not connected to list

  handle_one_recv_msg() could end up calling smi_send(), which
  assumes the msg is not connected to list.

  For example, the following sequence could corrupt list by
  doing list_add_tail() for the entry still connected to other list.

    handle_new_recv_msgs()
      msg = list_entry(waiting_rcv_msgs)
      handle_one_recv_msg(msg)
        handle_ipmb_get_msg_cmd(msg)
          smi_send(msg)
            spin_lock(xmit_msgs_lock)
            list_add_tail(msg)
            spin_unlock(xmit_msgs_lock)

2) race between multiple handle_new_recv_msgs() instances

  handle_new_recv_msgs() once releases waiting_rcv_msgs_lock before calling
  handle_one_recv_msg() then retakes the lock and list_del() it.

  If others call handle_new_recv_msgs() during the window shown below
  list_del() will be done twice for the same smi_msg.

  handle_new_recv_msgs()
    spin_lock(waiting_rcv_msgs_lock)
    msg = list_entry(waiting_rcv_msgs)
    spin_unlock(waiting_rcv_msgs_lock)
  |
  | handle_one_recv_msg(msg)
  |
    spin_lock(waiting_rcv_msgs_lock)
    list_del(msg)
    spin_unlock(waiting_rcv_msgs_lock)

Fixes: 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for SMI interfaces")
Signed-off-by: Jun'ichi Nomura 
[Added a comment to describe why this works.]
Signed-off-by: Corey Minyard 
Tested-by: Ye Feng 
Signed-off-by: Greg Kroah-Hartman

ipmi/watchdog: use nmi_panic() when kernel panics in NMI handler

2016-03-22T22:36:02+00:00

Commit 1717f2096b54 ("panic, x86: Fix re-entrance problem due to panic
on NMI") introduced nmi_panic() which prevents concurrent and recursive
execution of panic().  It also saves registers for the crash dump on x86
by later commit 58c5661f2144 ("panic, x86: Allow CPUs to save registers
even if looping in NMI context").

ipmi_watchdog driver can call panic() from NMI handler, so replace it
with nmi_panic().

Signed-off-by: Hidehiro Kawai 
Acked-by: Corey Minyard 
Acked-by: Guenter Roeck 
Reviewed-by: Michal Hocko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipmi: do not probe ACPI devices if si_tryacpi is unset

2016-03-18T12:01:24+00:00

Extend the tryacpi module parameter to turn off acpi_ipmi_probe such
that hard-coded options (type, ports, address, etc.) have complete
control over the smi_info data structures setup by the driver.

Signed-off-by: Joe Lawrence 
Signed-off-by: Corey Minyard

ipmi_si: Avoid a wrong long timeout on transaction done

2016-03-18T12:01:23+00:00

Under some circumstances, the IPMI state machine could return
a call without delay option but the driver would still do a long
delay because the result wasn't checked.  Instead of calling
the state machine after transaction done, just go back to the
top of the processing to start over.

Signed-off-by: Corey Minyard

ipmi_si: Fix module parameter doc names

2016-03-18T12:01:23+00:00

Several were tryacpi instead of their actual values.

Signed-off-by: Corey Minyard

ipmi_ssif: Fix logic around alert handling

2016-03-18T12:01:23+00:00

There was a mistake in the logic, if an alert came in very quickly
it would hang the driver.

Signed-off-by: Corey Minyard

ipmi: put acpi.h with the other headers

2016-02-03T16:35:52+00:00

Enclosing '#include ' within '#ifdef CONFIG_ACPI' is
unnecessary, since it has its own conditional compile for CONFIG_ACPI.

Commit 0fbcf4af7c83 ("ipmi: Convert the IPMI SI ACPI handling to a
platform device") exposed this as a problem for platforms that do not
support ACPI when it introduced a call to ACPI_PTR() macro outside of
the CONFIG_ACPI conditional compile. This would have been perfectly
acceptable if acpi.h were not conditionally excluded for the non-acpi
platform, because the conditional compile within acpi.h defines
ACPI_PTR() to return NULL when compiled for non acpi platforms.

Signed-off-by: Tony Camuso 

Fixed commit reference in header to conform to standard.

Signed-off-by: Corey Minyard

ipmi: Remove unnecessary pci_disable_device.

2016-01-12T21:08:49+00:00

We call cleanup_one_si from ipmi_pci_remove, which calls ->addr_source_cleanup,
 which gets set to point to ipmi_pci_cleanup, which does a pci_disable_device.

On return from this, we do a second pci_disable_device, which
results in the trace below.

ipmi_si 0000:00:16.0: disabling already-disabled device
Call Trace:
 [] dump_stack+0x45/0x57
 [] warn_slowpath_common+0x97/0xe0
 [] warn_slowpath_fmt+0x46/0x50
 [] pci_disable_device+0xb1/0xc0
 [] ipmi_pci_remove+0x25/0x30 [ipmi_si]
 [] pci_device_remove+0x46/0xc0
 [] __device_release_driver+0x7f/0xf0
 [] driver_detach+0xb8/0xc0
 [] bus_remove_driver+0x50/0xa0
 [] driver_unregister+0x2e/0x60
 [] pci_unregister_driver+0x25/0x90
 [] cleanup_ipmi_si+0xd4/0xf0 [ipmi_si]
 [] SyS_delete_module+0x12a/0x200
 [] system_call_fastpath+0x12/0x17

Signed-off-by: Dave Jones

char: ipmi: Drop owner assignment from i2c_driver

2016-01-12T21:08:49+00:00

i2c_driver does not need to set an owner because i2c_register_driver()
will set it.

Signed-off-by: Krzysztof Kozlowski

ipmi: constify some struct and char arrays

2016-01-12T21:08:49+00:00

Lots of char arrays could be set as const since they contain only literal
char arrays.
We could in the same time make const some struct members who are pointer
to those const char arrays.

Signed-off-by: LABBE Corentin 
Signed-off-by: Corey Minyard