summaryrefslogtreecommitdiff
path: root/drivers/char/ipmi/ipmi_msghandler.c
AgeCommit message (Collapse)Author
2017-11-21treewide: setup_timer() -> timer_setup()Kees Cook
This converts all remaining cases of the old setup_timer() API into using timer_setup(), where the callback argument is the structure already holding the struct timer_list. These should have no behavioral changes, since they just change which pointer is passed into the callback with the same available pointers after conversion. It handles the following examples, in addition to some other variations. Casting from unsigned long: void my_callback(unsigned long data) { struct something *ptr = (struct something *)data; ... } ... setup_timer(&ptr->my_timer, my_callback, ptr); and forced object casts: void my_callback(struct something *ptr) { ... } ... setup_timer(&ptr->my_timer, my_callback, (unsigned long)ptr); become: void my_callback(struct timer_list *t) { struct something *ptr = from_timer(ptr, t, my_timer); ... } ... timer_setup(&ptr->my_timer, my_callback, 0); Direct function assignments: void my_callback(unsigned long data) { struct something *ptr = (struct something *)data; ... } ... ptr->my_timer.function = my_callback; have a temporary cast added, along with converting the args: void my_callback(struct timer_list *t) { struct something *ptr = from_timer(ptr, t, my_timer); ... } ... ptr->my_timer.function = (TIMER_FUNC_TYPE)my_callback; And finally, callbacks without a data assignment: void my_callback(unsigned long data) { ... } ... setup_timer(&ptr->my_timer, my_callback, 0); have their argument renamed to verify they're unused during conversion: void my_callback(struct timer_list *unused) { ... } ... timer_setup(&ptr->my_timer, my_callback, 0); The conversion is done with the following Coccinelle script: spatch --very-quiet --all-includes --include-headers \ -I ./arch/x86/include -I ./arch/x86/include/generated \ -I ./include -I ./arch/x86/include/uapi \ -I ./arch/x86/include/generated/uapi -I ./include/uapi \ -I ./include/generated/uapi --include ./include/linux/kconfig.h \ --dir . \ --cocci-file ~/src/data/timer_setup.cocci @fix_address_of@ expression e; @@ setup_timer( -&(e) +&e , ...) // Update any raw setup_timer() usages that have a NULL callback, but // would otherwise match change_timer_function_usage, since the latter // will update all function assignments done in the face of a NULL // function initialization in setup_timer(). @change_timer_function_usage_NULL@ expression _E; identifier _timer; type _cast_data; @@ ( -setup_timer(&_E->_timer, NULL, _E); +timer_setup(&_E->_timer, NULL, 0); | -setup_timer(&_E->_timer, NULL, (_cast_data)_E); +timer_setup(&_E->_timer, NULL, 0); | -setup_timer(&_E._timer, NULL, &_E); +timer_setup(&_E._timer, NULL, 0); | -setup_timer(&_E._timer, NULL, (_cast_data)&_E); +timer_setup(&_E._timer, NULL, 0); ) @change_timer_function_usage@ expression _E; identifier _timer; struct timer_list _stl; identifier _callback; type _cast_func, _cast_data; @@ ( -setup_timer(&_E->_timer, _callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, &_callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, _callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, &_callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)_callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)&_callback, _E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)_callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, (_cast_func)&_callback, (_cast_data)_E); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E._timer, _callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, _callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, &_callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, &_callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)_callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)_callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)&_callback, (_cast_data)_E); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, (_cast_func)&_callback, (_cast_data)&_E); +timer_setup(&_E._timer, _callback, 0); | _E->_timer@_stl.function = _callback; | _E->_timer@_stl.function = &_callback; | _E->_timer@_stl.function = (_cast_func)_callback; | _E->_timer@_stl.function = (_cast_func)&_callback; | _E._timer@_stl.function = _callback; | _E._timer@_stl.function = &_callback; | _E._timer@_stl.function = (_cast_func)_callback; | _E._timer@_stl.function = (_cast_func)&_callback; ) // callback(unsigned long arg) @change_callback_handle_cast depends on change_timer_function_usage@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _origtype; identifier _origarg; type _handletype; identifier _handle; @@ void _callback( -_origtype _origarg +struct timer_list *t ) { ( ... when != _origarg _handletype *_handle = -(_handletype *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg | ... when != _origarg _handletype *_handle = -(void *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg | ... when != _origarg _handletype *_handle; ... when != _handle _handle = -(_handletype *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg | ... when != _origarg _handletype *_handle; ... when != _handle _handle = -(void *)_origarg; +from_timer(_handle, t, _timer); ... when != _origarg ) } // callback(unsigned long arg) without existing variable @change_callback_handle_cast_no_arg depends on change_timer_function_usage && !change_callback_handle_cast@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _origtype; identifier _origarg; type _handletype; @@ void _callback( -_origtype _origarg +struct timer_list *t ) { + _handletype *_origarg = from_timer(_origarg, t, _timer); + ... when != _origarg - (_handletype *)_origarg + _origarg ... when != _origarg } // Avoid already converted callbacks. @match_callback_converted depends on change_timer_function_usage && !change_callback_handle_cast && !change_callback_handle_cast_no_arg@ identifier change_timer_function_usage._callback; identifier t; @@ void _callback(struct timer_list *t) { ... } // callback(struct something *handle) @change_callback_handle_arg depends on change_timer_function_usage && !match_callback_converted && !change_callback_handle_cast && !change_callback_handle_cast_no_arg@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _handletype; identifier _handle; @@ void _callback( -_handletype *_handle +struct timer_list *t ) { + _handletype *_handle = from_timer(_handle, t, _timer); ... } // If change_callback_handle_arg ran on an empty function, remove // the added handler. @unchange_callback_handle_arg depends on change_timer_function_usage && change_callback_handle_arg@ identifier change_timer_function_usage._callback; identifier change_timer_function_usage._timer; type _handletype; identifier _handle; identifier t; @@ void _callback(struct timer_list *t) { - _handletype *_handle = from_timer(_handle, t, _timer); } // We only want to refactor the setup_timer() data argument if we've found // the matching callback. This undoes changes in change_timer_function_usage. @unchange_timer_function_usage depends on change_timer_function_usage && !change_callback_handle_cast && !change_callback_handle_cast_no_arg && !change_callback_handle_arg@ expression change_timer_function_usage._E; identifier change_timer_function_usage._timer; identifier change_timer_function_usage._callback; type change_timer_function_usage._cast_data; @@ ( -timer_setup(&_E->_timer, _callback, 0); +setup_timer(&_E->_timer, _callback, (_cast_data)_E); | -timer_setup(&_E._timer, _callback, 0); +setup_timer(&_E._timer, _callback, (_cast_data)&_E); ) // If we fixed a callback from a .function assignment, fix the // assignment cast now. @change_timer_function_assignment depends on change_timer_function_usage && (change_callback_handle_cast || change_callback_handle_cast_no_arg || change_callback_handle_arg)@ expression change_timer_function_usage._E; identifier change_timer_function_usage._timer; identifier change_timer_function_usage._callback; type _cast_func; typedef TIMER_FUNC_TYPE; @@ ( _E->_timer.function = -_callback +(TIMER_FUNC_TYPE)_callback ; | _E->_timer.function = -&_callback +(TIMER_FUNC_TYPE)_callback ; | _E->_timer.function = -(_cast_func)_callback; +(TIMER_FUNC_TYPE)_callback ; | _E->_timer.function = -(_cast_func)&_callback +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -_callback +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -&_callback; +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -(_cast_func)_callback +(TIMER_FUNC_TYPE)_callback ; | _E._timer.function = -(_cast_func)&_callback +(TIMER_FUNC_TYPE)_callback ; ) // Sometimes timer functions are called directly. Replace matched args. @change_timer_function_calls depends on change_timer_function_usage && (change_callback_handle_cast || change_callback_handle_cast_no_arg || change_callback_handle_arg)@ expression _E; identifier change_timer_function_usage._timer; identifier change_timer_function_usage._callback; type _cast_data; @@ _callback( ( -(_cast_data)_E +&_E->_timer | -(_cast_data)&_E +&_E._timer | -_E +&_E->_timer ) ) // If a timer has been configured without a data argument, it can be // converted without regard to the callback argument, since it is unused. @match_timer_function_unused_data@ expression _E; identifier _timer; identifier _callback; @@ ( -setup_timer(&_E->_timer, _callback, 0); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, _callback, 0L); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E->_timer, _callback, 0UL); +timer_setup(&_E->_timer, _callback, 0); | -setup_timer(&_E._timer, _callback, 0); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, _callback, 0L); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_E._timer, _callback, 0UL); +timer_setup(&_E._timer, _callback, 0); | -setup_timer(&_timer, _callback, 0); +timer_setup(&_timer, _callback, 0); | -setup_timer(&_timer, _callback, 0L); +timer_setup(&_timer, _callback, 0); | -setup_timer(&_timer, _callback, 0UL); +timer_setup(&_timer, _callback, 0); | -setup_timer(_timer, _callback, 0); +timer_setup(_timer, _callback, 0); | -setup_timer(_timer, _callback, 0L); +timer_setup(_timer, _callback, 0); | -setup_timer(_timer, _callback, 0UL); +timer_setup(_timer, _callback, 0); ) @change_callback_unused_data depends on match_timer_function_unused_data@ identifier match_timer_function_unused_data._callback; type _origtype; identifier _origarg; @@ void _callback( -_origtype _origarg +struct timer_list *unused ) { ... when != _origarg } Signed-off-by: Kees Cook <keescook@chromium.org>
2017-09-28ipmi: remove redundant initialization of bmcColin Ian King
The pointer bmc is being initialized and this initialized value is never being read, so this is assignment redundant and can be removed. Cleans up clang warning: warning: Value stored to 'bmc' during its initialization is never read Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-28ipmi: Clean up some print operationsCorey Minyard
Get rid of all printfs, using dev_xxx() if a device is available, pr_xxx() otherwise, and format long strings properly. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-28ipmi: Make the DMI probe into a generic platform probeCorey Minyard
Rework the DMI probe function to be a generic platform probe, and then rework the DMI code (and a few other things) to use the more generic information. This is so other things can declare platform IPMI devices. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-28ipmi: Make the IPMI proc interface configurableCorey Minyard
So we can remove it later. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Convert IPMI GUID over to Linux guid_tCorey Minyard
Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Rescan channel list on BMC changesCorey Minyard
If the BMC changes versions or a change is otherwise detected, rescan the channels on the BMC. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Move lun and address out of channel structCorey Minyard
Put it in it's own struct, getting ready for channel information being dynamically changed. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Retry BMC registration on a failureCorey Minyard
If the BMC fails to register, just set up to retry periodically. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Rework device id and guid handling to catch changing BMCsCorey Minyard
A BMC's guid or device id info may change dynamically, this could result in a different configuration that needs to be done. Adjust the BMCs dynamically. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Use a temporary BMC for an interfaceCorey Minyard
This is getting ready for the ability to redo the BMC if it's information changes, we need a fallback mechanism. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Dynamically fetch GUID periodicallyCorey Minyard
This will catch if the GUID changes. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Always fetch the guid through ipmi_get_device_id()Corey Minyard
This is in preparation for making ipmi_get_device_id() dynamically return the guid and device id. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Remove the device id from ipmi_register_smi()Corey Minyard
It's no longer used, dynamic device id handling is in place now. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: allow dynamic BMC version informationJeremy Kerr
Currently, it's up to the IPMI SMIs to provide the product & version details of BMCs behind registered IPMI SMI interfaces. This device ID is provided on SMI regsitration, and kept around for all future queries. However, this version information isn't always static. For example, a BMC may be upgraded at runtime, making the old version information stale. This change allows querying the BMC device ID & version information dynamically. If no static device_id argument is provided to ipmi_register_smi, then the IPMI core code will perform a Get Device ID IPMI command to query the version information when needed. We keep a short-term cache of this information so we don't need to re-query for every attribute access. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> I basically rewrote this, I fixed some locking issues and simplified things. Same functional change, though. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Don't use BMC product/dev ids in the BMC nameCorey Minyard
There are a lot of bad things that a set of BMCs could do that would really confuse the IPMI driver; it's possible for BMCs with different GUIDs to have the same product/devid (though that's not technically legal), which would result in platform device namespace collisions. Fixing it would involve either using the GUID in the BMC name, which resulted in huge names, or just using an ida for numbering the BMCs. The latter approach was chosen to avoid the huge names. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Add a reference from BMC devices to their interfacesJeremy Kerr
In an upcoming change, we'll want to grab a reference to the ipmi_smi_t from a struct bmc_device. This change adds a pointer to allow this. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Reworked to support multiple interfaces on a BMC. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Get the device id through a functionCorey Minyard
This makes getting the device id consistent, and make it possible to add a function to fetch it dynamically later. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Fix printing the BMC guidCorey Minyard
It was just wrong. Make it print according to the guid spec. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Rework BMC registrationCorey Minyard
There was a certain error case where the BMC wouldn't be deregistered like it should be. Rework the BMC registration to make calling ipmi_bmc_unregister() ok even if it's not registered and to clean up the error handling for ipmi_bmc_register(). Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Fix issues with BMC refcountsCorey Minyard
BMC device refcounts were not being decremented after fetching from driver_find_device(). Also, document the use of ipmidriver_mutex and tighten it's span some by incrementing the BMC's usecount in the BMC find routines and not later. This will be important for future changes where a long mutex hold area will complicate things. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Check that the device type is BMC when scanning deviceCorey Minyard
Just an added safety check. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Move bmc find routing to below bmc device typeCorey Minyard
No functional change, this is for a later change that uses the bmc device type. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Fix getting the GUID dataCorey Minyard
It was off by one. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: Make IPMI panic strings always availableCorey Minyard
They were set by config items, but people complained that they were never turned on. So have them always available and enabled by a module parameter. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-09-27ipmi: fix unsigned long underflowCorey Minyard
When I set the timeout to a specific value such as 500ms, the timeout event will not happen in time due to the overflow in function check_msg_timeout: ... ent->timeout -= timeout_period; if (ent->timeout > 0) return; ... The type of timeout_period is long, but ent->timeout is unsigned long. This patch makes the type consistent. Reported-by: Weilong Chen <chenweilong@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Tested-by: Weilong Chen <chenweilong@huawei.com> Cc: <stable@vger.kernel.org> # 3.16.x
2017-06-28char: ipmi: constify bmc_dev_attr_group and bmc_device_typeArvind Yadav
File size before: text data bss dec hex filename 25678 1024 92 26794 68aa drivers/char/ipmi/ipmi_msghandler.o File size After adding 'const': text data bss dec hex filename 25806 896 92 26794 68aa drivers/char/ipmi/ipmi_msghandler.o Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-06-19ipmi: use rcu lock around call to intf->handlers->sender()Tony Camuso
A vendor with a system having more than 128 CPUs occasionally encounters the following crash during shutdown. This is not an easily reproduceable event, but the vendor was able to provide the following analysis of the crash, which exhibits the same footprint each time. crash> bt PID: 0 TASK: ffff88017c70ce70 CPU: 5 COMMAND: "swapper/5" #0 [ffff88085c143ac8] machine_kexec at ffffffff81059c8b #1 [ffff88085c143b28] __crash_kexec at ffffffff811052e2 #2 [ffff88085c143bf8] crash_kexec at ffffffff811053d0 #3 [ffff88085c143c10] oops_end at ffffffff8168ef88 #4 [ffff88085c143c38] no_context at ffffffff8167ebb3 #5 [ffff88085c143c88] __bad_area_nosemaphore at ffffffff8167ec49 #6 [ffff88085c143cd0] bad_area_nosemaphore at ffffffff8167edb3 #7 [ffff88085c143ce0] __do_page_fault at ffffffff81691d1e #8 [ffff88085c143d40] do_page_fault at ffffffff81691ec5 #9 [ffff88085c143d70] page_fault at ffffffff8168e188 [exception RIP: unknown or invalid address] RIP: ffffffffa053c800 RSP: ffff88085c143e28 RFLAGS: 00010206 RAX: ffff88017c72bfd8 RBX: ffff88017a8dc000 RCX: ffff8810588b5ac8 RDX: ffff8810588b5a00 RSI: ffffffffa053c800 RDI: ffff8810588b5a00 RBP: ffff88085c143e58 R8: ffff88017c70d408 R9: ffff88017a8dc000 R10: 0000000000000002 R11: ffff88085c143da0 R12: ffff8810588b5ac8 R13: 0000000000000100 R14: ffffffffa053c800 R15: ffff8810588b5a00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 <IRQ stack> [exception RIP: cpuidle_enter_state+82] RIP: ffffffff81514192 RSP: ffff88017c72be50 RFLAGS: 00000202 RAX: 0000001e4c3c6f16 RBX: 000000000000f8a0 RCX: 0000000000000018 RDX: 0000000225c17d03 RSI: ffff88017c72bfd8 RDI: 0000001e4c3c6f16 RBP: ffff88017c72be78 R8: 000000000000237e R9: 0000000000000018 R10: 0000000000002494 R11: 0000000000000001 R12: ffff88017c72be20 R13: ffff88085c14f8e0 R14: 0000000000000082 R15: 0000001e4c3bb400 ORIG_RAX: ffffffffffffff10 CS: 0010 SS: 0018 This is the corresponding stack trace It has crashed because the area pointed with RIP extracted from timer element is already removed during a shutdown process. The function is smi_timeout(). And we think ffff8810588b5a00 in RDX is a parameter struct smi_info crash> rd ffff8810588b5a00 20 ffff8810588b5a00: ffff8810588b6000 0000000000000000 .`.X............ ffff8810588b5a10: ffff880853264400 ffffffffa05417e0 .D&S......T..... ffff8810588b5a20: 24a024a000000000 0000000000000000 .....$.$........ ffff8810588b5a30: 0000000000000000 0000000000000000 ................ ffff8810588b5a30: 0000000000000000 0000000000000000 ................ ffff8810588b5a40: ffffffffa053a040 ffffffffa053a060 @.S.....`.S..... ffff8810588b5a50: 0000000000000000 0000000100000001 ................ ffff8810588b5a60: 0000000000000000 0000000000000e00 ................ ffff8810588b5a70: ffffffffa053a580 ffffffffa053a6e0 ..S.......S..... ffff8810588b5a80: ffffffffa053a4a0 ffffffffa053a250 ..S.....P.S..... ffff8810588b5a90: 0000000500000002 0000000000000000 ................ Unfortunately the top of this area is already detroyed by someone. But because of two reasonns we think this is struct smi_info 1) The address included in between ffff8810588b5a70 and ffff8810588b5a80: are inside of ipmi_si_intf.c see crash> module ffff88085779d2c0 2) We've found the area which point this. It is offset 0x68 of ffff880859df4000 crash> rd ffff880859df4000 100 ffff880859df4000: 0000000000000000 0000000000000001 ................ ffff880859df4010: ffffffffa0535290 dead000000000200 .RS............. ffff880859df4020: ffff880859df4020 ffff880859df4020 @.Y.... @.Y.... ffff880859df4030: 0000000000000002 0000000000100010 ................ ffff880859df4040: ffff880859df4040 ffff880859df4040 @@.Y....@@.Y.... ffff880859df4050: 0000000000000000 0000000000000000 ................ ffff880859df4060: 0000000000000000 ffff8810588b5a00 .........Z.X.... ffff880859df4070: 0000000000000001 ffff880859df4078 ........x@.Y.... If we regards it as struct ipmi_smi in shutdown process it looks consistent. The remedy for this apparent race is affixed below. Signed-off-by: Tony Camuso <tcamuso@redhat.com> Cc: stable@vger.kernel.org # 3.19 This was first introduced in 7ea0ed2b5be817 ipmi: Make the message handler easier to use for SMI interfaces where some code was moved outside of the rcu_read_lock() and the lock was not added. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2017-01-05ipmi: make ipmi_usr_hndl constCorey Minyard
It's only function pointers. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2016-12-12ipmi: create hardware-independent softdep for ipmi_devintfMartin Wilck
When a computer has an IPMI system interface, the device interface is most probably also desired. Autoloading of ipmi_devintf currently works only if ipmi_si has allocated a platform device. That doesn't happen if the SI interface was detected e.g. via ACPI. But ACPI detection is preferred these days, see e.g. kernel.org bug 46741. This patch introduces a softdep in place of the existing modalias for ipmi_devintf. Signed-off-by: Martin Wilck <mwilck@suse.com> Suggested-by: Takashi Iwai <tiwai@suse.com> I moved this to ipmi_msghandler.c, so it works for all IPMI interfaces. Retested by Martin. Tested-by: Martin Wilck <mwilck@suse.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2016-11-24ipmi: Fix sequence number handlingCorey Minyard
The IPMI message handler uses a message id that the lower-layer preserved to track the sequence number of the message. The macros that handled these sequence numbers were somewhat broken as they could result in sequence number truncation and they were not doing an "and" of the proper number of bits. I think this actually is not a problem, because the truncation should be harmless and the improper "and" didn't hurt anything because sequence number generation used the same improper "and" and wouldn't generate a sequence number that would get truncated wrong. However, it should be fixed. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2016-10-03ipmi: fix crash on reading version from proc after unregisted bmcXie XiuQi
I meet a crash, which could be reproduce: 1) while true; do cat /proc/ipmi/0/version; done 2) modprobe -rv ipmi_si ipmi_msghandler ipmi_devintf [82761.021137] IPMI BT: req2rsp=5 secs retries=2 [82761.034524] ipmi device interface [82761.222218] ipmi_si ipmi_si.0: Found new BMC (man_id: 0x0007db, prod_id: 0x0001, dev_id: 0x01) [82761.222230] ipmi_si ipmi_si.0: IPMI bt interface initialized [82903.922740] BUG: unable to handle kernel NULL pointer dereference at 00000000000002d4 [82903.930952] IP: [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler] [82903.939220] PGD 86693a067 PUD 865304067 PMD 0 [82903.943893] Thread overran stack, or stack corrupted [82903.949034] Oops: 0000 [#1] SMP [82903.983091] Modules linked in: ipmi_si(-) ipmi_msghandler binfmt_misc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ... [82904.057285] pps_core scsi_transport_sas dm_mod vfio_iommu_type1 vfio xt_sctp nf_conntrack_proto_sctp nf_nat_proto_sctp nf_nat nf_conntrack sctp libcrc32c [last unloaded: ipmi_devintf] [82904.073169] CPU: 37 PID: 28089 Comm: cat Tainted: GF O ---- ------- 3.10.0-327.28.3.el7.x86_64 #1 [82904.083373] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 3.22 05/16/2016 [82904.090592] task: ffff880101cc2e00 ti: ffff880369c54000 task.ti: ffff880369c54000 [82904.098414] RIP: 0010:[<ffffffffa030d9e8>] [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler] [82904.109124] RSP: 0018:ffff880369c57e70 EFLAGS: 00010203 [82904.114608] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000024688470 [82904.121912] RDX: fffffffffffffff4 RSI: ffffffffa0313404 RDI: ffff8808670ce200 [82904.129218] RBP: ffff880369c57e70 R08: 0000000000019720 R09: ffffffff81204a27 [82904.136521] R10: ffff88046f803300 R11: 0000000000000246 R12: ffff880662399700 [82904.143828] R13: 0000000000000001 R14: ffff880369c57f48 R15: ffff8808670ce200 [82904.151128] FS: 00007fb70c9ca740(0000) GS:ffff88086e340000(0000) knlGS:0000000000000000 [82904.159557] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [82904.165473] CR2: 00000000000002d4 CR3: 0000000864c0c000 CR4: 00000000003407e0 [82904.172778] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [82904.180084] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [82904.187385] Stack: [82904.189573] ffff880369c57ee0 ffffffff81204f1a 00000000122a2427 0000000001426000 [82904.197392] ffff8808670ce238 0000000000010000 0000000000000000 0000000000000fff [82904.205198] 00000000122a2427 ffff880862079600 0000000001426000 ffff880369c57f48 [82904.212962] Call Trace: [82904.219667] [<ffffffff81204f1a>] seq_read+0xfa/0x3a0 [82904.224893] [<ffffffff8124ce2d>] proc_reg_read+0x3d/0x80 [82904.230468] [<ffffffff811e102c>] vfs_read+0x9c/0x170 [82904.235689] [<ffffffff811e1b7f>] SyS_read+0x7f/0xe0 [82904.240816] [<ffffffff81649209>] system_call_fastpath+0x16/0x1b [82904.246991] Code: 30 a0 e8 0c 6f ef e0 5b 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 47 78 55 48 c7 c6 04 34 31 a0 48 89 e5 48 8b 40 50 <0f> b6 90 d4 02 00 00 31 c0 89 d1 83 e2 0f c0 e9 04 0f b6 c9 e8 [82904.267710] RIP [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler] [82904.276079] RSP <ffff880369c57e70> [82904.279734] CR2: 00000000000002d4 [82904.283731] ---[ end trace a69e4328b49dd7c4 ]--- [82904.328118] Kernel panic - not syncing: Fatal exception Reading versin from /proc need bmc device struct available. So in this patch we move add/remove_proc_entries between ipmi_bmc_register and ipmi_bmc_unregister. Cc: Kefeng Wang <wangkefeng.wang@huawei.com> Signed-off-by: Xie XiuQi <xiexiuqi@huawei.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2016-07-27ipmi: remove trydefaults parameter and default initTony Camuso
Parameter trydefaults=1 causes the ipmi_init to initialize ipmi through the legacy port io space that was designated for ipmi. Architectures that do not map legacy port io can panic when trydefaults=1. Rather than implement build-time conditional exceptions for each architecture that does not map legacy port io, we have removed legacy port io from the driver. Parameter 'trydefaults' has been removed. Attempts to use it hereafter will evoke the "Unknown symbol in module, or unknown parameter" message. The patch was built against a number of architectures and tested for regressions and functionality on x86_64 and ARM64. Signed-off-by: Tony Camuso <tcamuso@redhat.com> Removed the config entry and the address source entry for default, since neither were used any more. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2016-06-13ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()Junichi Nomura
Commit 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for SMI interfaces") changed handle_new_recv_msgs() to call handle_one_recv_msg() for a smi_msg while the smi_msg is still connected to waiting_rcv_msgs list. That could lead to following list corruption problems: 1) low-level function treats smi_msg as not connected to list handle_one_recv_msg() could end up calling smi_send(), which assumes the msg is not connected to list. For example, the following sequence could corrupt list by doing list_add_tail() for the entry still connected to other list. handle_new_recv_msgs() msg = list_entry(waiting_rcv_msgs) handle_one_recv_msg(msg) handle_ipmb_get_msg_cmd(msg) smi_send(msg) spin_lock(xmit_msgs_lock) list_add_tail(msg) spin_unlock(xmit_msgs_lock) 2) race between multiple handle_new_recv_msgs() instances handle_new_recv_msgs() once releases waiting_rcv_msgs_lock before calling handle_one_recv_msg() then retakes the lock and list_del() it. If others call handle_new_recv_msgs() during the window shown below list_del() will be done twice for the same smi_msg. handle_new_recv_msgs() spin_lock(waiting_rcv_msgs_lock) msg = list_entry(waiting_rcv_msgs) spin_unlock(waiting_rcv_msgs_lock) | | handle_one_recv_msg(msg) | spin_lock(waiting_rcv_msgs_lock) list_del(msg) spin_unlock(waiting_rcv_msgs_lock) Fixes: 7ea0ed2b5be8 ("ipmi: Make the message handler easier to use for SMI interfaces") Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> [Added a comment to describe why this works.] Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: stable@vger.kernel.org # 3.19 Tested-by: Ye Feng <yefeng.yl@alibaba-inc.com>
2016-01-12ipmi: constify some struct and char arraysLABBE Corentin
Lots of char arrays could be set as const since they contain only literal char arrays. We could in the same time make const some struct members who are pointer to those const char arrays. Signed-off-by: LABBE Corentin <clabbe.montjoie@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-09-03ipmi: Don't call receive handler in the panic contextHidehiro Kawai
Received handlers defined as ipmi_recv_hndl member of struct ipmi_user_hndl can take a spinlock. This means that if the kernel panics while holding the lock, a deadlock may happen on the lock while flushing queued messages in the panic context. Calling the receive handler doesn't make much meanings in the panic context, simply skip it to avoid possible deadlocks. Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-09-03ipmi: Avoid touching possible corrupted lists in the panic contextHidehiro Kawai
When processing queued messages in the panic context, IPMI driver tries to do it without any locking to avoid deadlocks. However, this means we can touch a corrupted list if the kernel panicked while manipulating the list. Fortunately, current `add-tail and del-from-head' style implementation won't touch the corrupted part, but it is inherently risky. To get rid of the risk, this patch re-initializes the message lists on panic if the related spinlock has already been acquired. As the result, we may lose queued messages, but it's not so painful. Dropping messages on the received message list is also less problematic because no one can respond the received messages. Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com> Fixed a comment typo. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-09-03ipmi: Don't flush messages in sender() in run-to-completion modeHidehiro Kawai
When flushing queued messages in run-to-completion mode, smi_event_handler() is recursively called. flush_messages() smi_event_handler() handle_transaction_done() deliver_recv_msg() ipmi_smi_msg_received() smi_recv_tasklet() sender() flush_messages() smi_event_handler() ... The depth of the recursive call depends on the number of queued messages, so it can cause a stack overflow if many messages have been queued. To solve this problem, this patch removes flush_messages() from sender()@ipmi_si_intf.c. Instead, add flush_messages() to caller side of sender() if needed. Additionally, to implement this, add new handler flush_messages to struct ipmi_smi_handlers. Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com> Fixed up a comment and some spacing issues. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-09-03ipmi: Remove unneeded set_run_to_completion callHidehiro Kawai
send_panic_events() calls intf->handlers->set_run_to_completion(), but it has already been done in the caller function panic_event(). Remove it from send_panic_events(). Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-09-03ipmi: Make some data const that was only readCorey Minyard
Several data structures were only used for reading, so make them const. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-09-03ipmi: Add a comment in how messages are delivered from the lower layerCorey Minyard
To avoid confusion in the future. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-05-05ipmi: Remove incorrect use of seq_has_overflowedJoe Perches
commit d6c5dc18d863 ("ipmi: Remove uses of return value of seq_printf") incorrectly changed the return value of various proc_show functions to use seq_has_overflowed(). These functions should return 0 on completion rather than 1/true on overflow. 1 is the same as #define SEQ_SKIP which would cause the output to not be emitted (skipped) instead. This is a logical defect only as the length of these outputs are all smaller than the initial allocation done by the seq filesystem. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-02-19ipmi: Remove uses of return value of seq_printfJoe Perches
The seq_printf like functions will soon be changed to return void. Convert these uses to check seq_has_overflowed instead. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-02-19ipmi: Use is_visible callback for conditional sysfs entriesTakashi Iwai
Instead of manual calls of device_create_file() and device_remove_file(), implement the condition in is_visible callback for the attribute group and put these entries to the group, too. This simplifies the code and avoids the possible races. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-02-19ipmi: avoid gcc warningArnd Bergmann
A new harmless warning has come up on ARM builds with gcc-4.9: drivers/char/ipmi/ipmi_msghandler.c: In function 'smi_send.isra.11': include/linux/spinlock.h:372:95: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized] raw_spin_unlock_irqrestore(&lock->rlock, flags); ^ drivers/char/ipmi/ipmi_msghandler.c:1490:16: note: 'flags' was declared here unsigned long flags; ^ This could be worked around by initializing the 'flags' variable, but it seems better to rework the code to avoid this. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes: 7ea0ed2b5be81 ("ipmi: Make the message handler easier to use for SMI interfaces") Signed-off-by: Corey Minyard <cminyard@mvista.com>
2015-02-19ipmi: Remove a FIXME for slab conversionCorey Minyard
There can't be more than a few IPMI messages allocated at any one time, so converting the messages to slabs would be a waste. So just remove the FIXME. Suggested-by: Nicholas Krause <xerofoify@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2014-12-21ipmi: Finish cleanup of BMC attributesCorey Minyard
The previous cleanup of BMC attributes left a few holes, and if you run with lockdep debugging with a BMC with the proper attributes, you could get a warning. This patch removes all the unused attributes from the BMC structure, since they are all declared in the .data section now. It makes the attributes all static. It fixes the referencing of the attributes in a couple of cases that dynamically added the files depending on BMC information. Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: Huang Ying <ying.huang@intel.com> Tested-by: Alexei Starovoitov <ast@plumgrid.com>
2014-12-11ipmi: Remove the now unused priority from SMI senderCorey Minyard
Since the queue was moved into the message handler, the priority field is now irrelevant. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2014-12-11ipmi: Make the message handler easier to use for SMI interfacesCorey Minyard
The message handler expected the SMI interface to keep a queue of messages, but that was kind of silly, the queue would be easier to manage in the message handler itself. As part of that, fix the message cleanup to make sure no messages are outstanding when an SMI interface is unregistered. This makes it easier for an SMI interface to unregister, it just has to call ipmi_unregister_smi() first and all processing from the message handler will be cleaned up. Signed-off-by: Corey Minyard <cminyard@mvista.com>
2014-12-11ipmi: Move message sending into its own functionCorey Minyard
Getting ready for a transmit queue. Signed-off-by: Corey Minyard <cminyard@mvista.com>
generated by cgit (git 2.34.1) at 2024-06-13 11:21:59 +0000