1. 26 1月, 2016 1 次提交
    • S
      PCI/AER: Flush workqueue on device remove to avoid use-after-free · 4ae2182b
      Sebastian Andrzej Siewior 提交于
      A Root Port's AER structure (rpc) contains a queue of events.  aer_irq()
      enqueues AER status information and schedules aer_isr() to dequeue and
      process it.  When we remove a device, aer_remove() waits for the queue to
      be empty, then frees the rpc struct.
      
      But aer_isr() references the rpc struct after dequeueing and possibly
      emptying the queue, which can cause a use-after-free error as in the
      following scenario with two threads, aer_isr() on the left and a
      concurrent aer_remove() on the right:
      
        Thread A                      Thread B
        --------                      --------
        aer_irq():
          rpc->prod_idx++
                                      aer_remove():
                                        wait_event(rpc->prod_idx == rpc->cons_idx)
                                        # now blocked until queue becomes empty
        aer_isr():                      # ...
          rpc->cons_idx++               # unblocked because queue is now empty
          ...                           kfree(rpc)
          mutex_unlock(&rpc->rpc_mutex)
      
      To prevent this problem, use flush_work() to wait until the last scheduled
      instance of aer_isr() has completed before freeing the rpc struct in
      aer_remove().
      
      I reproduced this use-after-free by flashing a device FPGA and
      re-enumerating the bus to find the new device.  With SLUB debug, this
      crashes with 0x6b bytes (POISON_FREE, the use-after-free magic number) in
      GPR25:
      
        pcieport 0000:00:00.0: AER: Multiple Corrected error received: id=0000
        Unable to handle kernel paging request for data at address 0x27ef9e3e
        Workqueue: events aer_isr
        GPR24: dd6aa000 6b6b6b6b 605f8378 605f8360 d99b12c0 604fc674 606b1704 d99b12c0
        NIP [602f5328] pci_walk_bus+0xd4/0x104
      
      [bhelgaas: changelog, stable tag]
      Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      CC: stable@vger.kernel.org
      4ae2182b
  2. 15 8月, 2013 1 次提交
  3. 07 6月, 2013 1 次提交
  4. 18 4月, 2013 1 次提交
  5. 27 11月, 2012 1 次提交
    • V
      PCI/AER: Report success only when every device has AER-aware driver · 918b4053
      Vijay Mohan Pandarathil 提交于
      When an error is detected on a PCIe device which does not have an
      AER-aware driver, prevent AER infrastructure from reporting
      successful error recovery.
      
      This is because the report_error_detected() function that gets
      called in the first phase of recovery process allows forward
      progress even when the driver for the device does not have AER
      capabilities. It seems that all callbacks (in pci_error_handlers
      structure) registered by drivers that gets called during error
      recovery are not mandatory. So the intention of the infrastructure
      design seems to be to allow forward progress even when a specific
      callback has not been registered by a driver. However, if error
      handler structure itself has not been registered, it doesn't make
      sense to allow forward progress.
      
      As a result of the current design, in the case of a single device
      having an AER-unaware driver or in the case of any function in a
      multi-function card having an AER-unaware driver, a successful
      recovery is reported.
      
      Typical scenario this happens is when a PCI device is detached
      from a KVM host and the pci-stub driver on the host claims the
      device. The pci-stub driver does not have error handling capabilities
      but the AER infrastructure still reports that the device recovered
      successfully.
      
      The changes proposed here leaves the device(s)in an unrecovered state
      if the driver for the device or for any device in the subtree
      does not have error handler structure registered. This reflects
      the true state of the device and prevents any partial recovery (or no
      recovery at all) reported as successful.
      
      [bhelgaas: changelog]
      Signed-off-by: NVijay Mohan Pandarathil <vijaymohan.pandarathil@hp.com>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: NLinas Vepstas <linasvepstas@gmail.com>
      Reviewed-by: NMyron Stowe <myron.stowe@redhat.com>
      918b4053
  6. 22 5月, 2011 1 次提交
  7. 22 3月, 2011 1 次提交
    • H
      ACPI, APEI, Add PCIe AER error information printing support · c413d768
      Huang Ying 提交于
      The AER error information printing support is implemented in
      drivers/pci/pcie/aer/aer_print.c.  So some string constants, functions
      and macros definitions can be re-used without being exported.
      
      The original PCIe AER error information printing function is not
      re-used directly because the overall format is quite different.  And
      changing the original printing format may make some original users'
      scripts broken.
      Signed-off-by: NHuang Ying <ying.huang@intel.com>
      CC: Jesse Barnes <jbarnes@virtuousgeek.org>
      CC: Zhang Yanmin <yanmin.zhang@intel.com>
      Signed-off-by: NLen Brown <len.brown@intel.com>
      c413d768
  8. 15 1月, 2011 1 次提交
  9. 16 10月, 2010 1 次提交
    • R
      PCI/PCIe/AER: Disable native AER service if BIOS has precedence · b22c3d82
      Rafael J. Wysocki 提交于
      There is a design issue related to PCIe AER and _OSC that the BIOS
      may be asked to grant control of the AER service even if some
      Hardware Error Source Table (HEST) entries contain information
      meaning that the BIOS really should control it.  Namely,
      pcie_port_acpi_setup() calls pcie_aer_get_firmware_first() that
      determines whether or not the AER service should be controlled by
      the BIOS on the basis of the HEST information for the given PCIe
      port.  The BIOS is asked to grant control of the AER service for
      a PCIe Root Complex if pcie_aer_get_firmware_first() returns 'false'
      for at least one root port in that complex, even if all of the other
      root ports' HEST entries have the FIRMWARE_FIRST flag set (and none
      of them has the GLOBAL flag set).  However, if the AER service is
      controlled by the kernel, that may interfere with the BIOS' handling
      of the error sources having the FIRMWARE_FIRST flag.  Moreover,
      there may be PCIe endpoints that have the FIRMWARE_FIRST flag set in
      HEST and are attached to the root ports in question, in which case it
      also may be unsafe to ask the BIOS for control of the AER service.
      
      For this reason, introduce a function checking if there's at least
      one PCIe-related HEST entry with the FIRMWARE_FIRST flag set and
      disable the native AER service altogether if this function returns
      'true'.
      Signed-off-by: NRafael J. Wysocki <rjw@sisk.pl>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      b22c3d82
  10. 20 5月, 2010 1 次提交
  11. 12 5月, 2010 4 次提交
  12. 10 9月, 2009 7 次提交
    • H
      PCI: pcie, aer: report all error before recovery · b1c089b7
      Hidetoshi Seto 提交于
      This patch is required not to lost error records by action invoked on
      error recovery, such as slot reset etc.
      
      Following sample (real machine + dummy record injected by aer-inject)
      shows that record of 28:00.1 could not be retrieved by recovery of 28:00.0:
      
      - Before:
      
      pcieport-driver 0000:00:02.0: AER: Multiple Uncorrected (Non-Fatal) error received: id=2801
      e1000e 0000:28:00.0: PCIE Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=2800(Receiver ID)
      e1000e 0000:28:00.0:   device [8086:1096] error status/mask=00001000/00100000
      e1000e 0000:28:00.0:    [12] Poisoned TLP           (First)
      e1000e 0000:28:00.0:   TLP Header: 00000000 00000001 00000002 00000003
      e1000e 0000:28:00.0: broadcast error_detected message
      e1000e 0000:28:00.0: broadcast slot_reset message
      e1000e 0000:28:00.0: setting latency timer to 64
      e1000e 0000:28:00.0: restoring config space at offset 0x1 (was 0x100547, writing 0x100147)
      e1000e 0000:28:00.0: PME# disabled
      e1000e 0000:28:00.0: PME# disabled
      e1000e 0000:28:00.1: setting latency timer to 64
      e1000e 0000:28:00.1: restoring config space at offset 0x1 (was 0x100547, writing 0x100147)
      e1000e 0000:28:00.1: PME# disabled
      e1000e 0000:28:00.1: PME# disabled
      e1000e 0000:28:00.0: broadcast resume message
      e1000e 0000:28:00.0: AER driver successfully recovered
      e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
      
      - After:
      
      pcieport-driver 0000:00:02.0: AER: Multiple Uncorrected (Non-Fatal) error received: id=2801
      e1000e 0000:28:00.0: PCIE Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=2800(Receiver ID)
      e1000e 0000:28:00.0:   device [8086:1096] error status/mask=00001000/00100000
      e1000e 0000:28:00.0:    [12] Poisoned TLP           (First)
      e1000e 0000:28:00.0:   TLP Header: 00000000 00000001 00000002 00000003
      e1000e 0000:28:00.1: PCIE Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, id=2801(Receiver ID)
      e1000e 0000:28:00.1:   device [8086:1096] error status/mask=00081000/00100000
      e1000e 0000:28:00.1:    [12] Poisoned TLP           (First)
      e1000e 0000:28:00.1:    [19] ECRC
      e1000e 0000:28:00.1:   TLP Header: 00000000 00000001 00000002 00000003
      e1000e 0000:28:00.1:   Error of this Agent(2801) is reported first
      e1000e 0000:28:00.0: broadcast error_detected message
      e1000e 0000:28:00.0: broadcast slot_reset message
      e1000e 0000:28:00.0: setting latency timer to 64
      e1000e 0000:28:00.0: restoring config space at offset 0x1 (was 0x100547, writing 0x100147)
      e1000e 0000:28:00.0: PME# disabled
      e1000e 0000:28:00.0: PME# disabled
      e1000e 0000:28:00.1: setting latency timer to 64
      e1000e 0000:28:00.1: restoring config space at offset 0x1 (was 0x100547, writing 0x100147)
      e1000e 0000:28:00.1: PME# disabled
      e1000e 0000:28:00.1: PME# disabled
      e1000e 0000:28:00.0: broadcast resume message
      e1000e 0000:28:00.0: AER driver successfully recovered
      e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      b1c089b7
    • H
      PCI: pcie, aer: change error print format · 79e4b89b
      Hidetoshi Seto 提交于
      Use dev_printk like format.
      
      Sample (real machine + dummy error injected by aer-inject):
      
      - Before:
      
      +------ PCI-Express Device Error ------+
      Error Severity          : Corrected
      PCIE Bus Error type     : Data Link Layer
      Bad TLP                 :
      Receiver ID             : 2800
      VendorID=8086h, DeviceID=1096h, Bus=28h, Device=00h, Function=00h
      +------ PCI-Express Device Error ------+
      Error Severity          : Corrected
      PCIE Bus Error type     : Data Link Layer
      Bad TLP                 :
      Bad DLLP                :
      Receiver ID             : 2801
      VendorID=8086h, DeviceID=1096h, Bus=28h, Device=00h, Function=01h
      Error of this Agent(2801) is reported first
      
      - After:
      
      pcieport-driver 0000:00:02.0: AER: Multiple Corrected error received: id=2801
      e1000e 0000:28:00.0: PCIE Bus Error: severity=Corrected, type=Data Link Layer, id=2800(Receiver ID)
      e1000e 0000:28:00.0:   device [8086:1096] error status/mask=00000040/00000000
      e1000e 0000:28:00.0:    [ 6] Bad TLP
      e1000e 0000:28:00.1: PCIE Bus Error: severity=Corrected, type=Data Link Layer, id=2801(Receiver ID)
      e1000e 0000:28:00.1:   device [8086:1096] error status/mask=000000c0/00000000
      e1000e 0000:28:00.1:    [ 6] Bad TLP
      e1000e 0000:28:00.1:    [ 7] Bad DLLP
      e1000e 0000:28:00.1:   Error of this Agent(2801) is reported first
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      79e4b89b
    • H
      PCI: pcie, aer: flags to bits · 273024de
      Hidetoshi Seto 提交于
      Compact struct and codes.
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      273024de
    • H
      PCI: pcie, aer: remove unused macros · 3472a187
      Hidetoshi Seto 提交于
      Cleanup.
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      3472a187
    • H
      PCI: pcie, aer: report multiple/first error on a device · e7a0d92b
      Hidetoshi Seto 提交于
      Multiple bits might be set in the Uncorrectable Error Status
      register.  But aer_print_error_source() only report a error of
      the lowest bit set in the error status register.
      
      So print strings for all bits unmasked and set.
      
      And check First Error Pointer to mark the error occured first.
      This FEP is not valid when the corresponing bit of the Uncorrectable
      Error Status register is not set, or unimplemented or undefined.
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      e7a0d92b
    • H
      PCI: pcie, aer: refer mask state in mask register properly · 0d90c3ac
      Hidetoshi Seto 提交于
      ERR_{,UN}CORRECTABLE_ERROR_MASK are set of error bits which linux know,
      set of PCI_ERR_COR_* and PCI_ERR_UNC_* defined in linux/pci_regs.h.
      This masks make aerdrv not to report errors of unknown bit, while aerdrv
      have ability to report such undefined errors as "Unknown Error Bit %2d".
      
      OTOH aerdrv_errprint does not have any check of setting in mask register.
      So it could report masked wrong error by finding bit in status without
      knowing that the bit is masked in the mask register.
      
      This patch changes aerdrv to use mask state in mask register propely
      instead of defined/hardcoded ERR_{,UN}CORRECTABLE_ERROR_MASK.
      This change prevents aerdrv from reporting masked error, and also enable
      reporting unknown errors.
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Reviewed-by: NAndrew Patterson <andrew.patterson@hp.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      0d90c3ac
    • H
      PCI: pcie, aer: checkpatch style cleanup in pcie/aer/* · c9a91883
      Hidetoshi Seto 提交于
      Before:
       drivers/pci/pcie/aer/aer_inject.c
        total: 4 errors, 4 warnings, 473 lines checked
       drivers/pci/pcie/aer/aerdrv.c
        total: 5 errors, 2 warnings, 333 lines checked
       drivers/pci/pcie/aer/aerdrv.h
        total: 1 errors, 0 warnings, 139 lines checked
       drivers/pci/pcie/aer/aerdrv_core.c
        total: 4 errors, 3 warnings, 872 lines checked
       drivers/pci/pcie/aer/aerdrv_errprint.c
        total: 12 errors, 11 warnings, 248 lines checked
      
      After:
       drivers/pci/pcie/aer/aer_inject.c
        total: 0 errors, 0 warnings, 466 lines checked
       drivers/pci/pcie/aer/aerdrv.c
        total: 0 errors, 0 warnings, 335 lines checked
       drivers/pci/pcie/aer/aerdrv.h
        total: 0 errors, 0 warnings, 139 lines checked
       drivers/pci/pcie/aer/aerdrv_core.c
        total: 0 errors, 0 warnings, 869 lines checked
       drivers/pci/pcie/aer/aerdrv_errprint.c
        total: 0 errors, 10 warnings, 247 lines checked
      Signed-off-by: NHidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
      Reviewed-by: NAndrew Patterson <andrew.patterson@hp.com>
      Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
      c9a91883
  13. 17 6月, 2009 3 次提交
  14. 06 5月, 2009 1 次提交
  15. 12 7月, 2007 1 次提交
  16. 22 5月, 2007 1 次提交
    • A
      Detach sched.h from mm.h · e8edc6e0
      Alexey Dobriyan 提交于
      First thing mm.h does is including sched.h solely for can_do_mlock() inline
      function which has "current" dereference inside. By dealing with can_do_mlock()
      mm.h can be detached from sched.h which is good. See below, why.
      
      This patch
      a) removes unconditional inclusion of sched.h from mm.h
      b) makes can_do_mlock() normal function in mm/mlock.c
      c) exports can_do_mlock() to not break compilation
      d) adds sched.h inclusions back to files that were getting it indirectly.
      e) adds less bloated headers to some files (asm/signal.h, jiffies.h) that were
         getting them indirectly
      
      Net result is:
      a) mm.h users would get less code to open, read, preprocess, parse, ... if
         they don't need sched.h
      b) sched.h stops being dependency for significant number of files:
         on x86_64 allmodconfig touching sched.h results in recompile of 4083 files,
         after patch it's only 3744 (-8.3%).
      
      Cross-compile tested on
      
      	all arm defconfigs, all mips defconfigs, all powerpc defconfigs,
      	alpha alpha-up
      	arm
      	i386 i386-up i386-defconfig i386-allnoconfig
      	ia64 ia64-up
      	m68k
      	mips
      	parisc parisc-up
      	powerpc powerpc-up
      	s390 s390-up
      	sparc sparc-up
      	sparc64 sparc64-up
      	um-x86_64
      	x86_64 x86_64-up x86_64-defconfig x86_64-allnoconfig
      
      as well as my two usual configs.
      Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      e8edc6e0
  17. 18 2月, 2007 1 次提交
  18. 22 11月, 2006 1 次提交
    • D
      WorkStruct: Pass the work_struct pointer instead of context data · 65f27f38
      David Howells 提交于
      Pass the work_struct pointer to the work function rather than context data.
      The work function can use container_of() to work out the data.
      
      For the cases where the container of the work_struct may go away the moment the
      pending bit is cleared, it is made possible to defer the release of the
      structure by deferring the clearing of the pending bit.
      
      To make this work, an extra flag is introduced into the management side of the
      work_struct.  This governs auto-release of the structure upon execution.
      
      Ordinarily, the work queue executor would release the work_struct for further
      scheduling or deallocation by clearing the pending bit prior to jumping to the
      work function.  This means that, unless the driver makes some guarantee itself
      that the work_struct won't go away, the work function may not access anything
      else in the work_struct or its container lest they be deallocated..  This is a
      problem if the auxiliary data is taken away (as done by the last patch).
      
      However, if the pending bit is *not* cleared before jumping to the work
      function, then the work function *may* access the work_struct and its container
      with no problems.  But then the work function must itself release the
      work_struct by calling work_release().
      
      In most cases, automatic release is fine, so this is the default.  Special
      initiators exist for the non-auto-release case (ending in _NAR).
      Signed-Off-By: NDavid Howells <dhowells@redhat.com>
      65f27f38
  19. 27 9月, 2006 1 次提交
    • Z
      PCI-Express AER implemetation: AER core and aerdriver · 6c2b374d
      Zhang, Yanmin 提交于
      Patch 3 implements the core part of PCI-Express AER and aerdrv
      port service driver.
      
      When a root port service device is probed, the aerdrv will call
      request_irq to register irq handler for AER error interrupt.
      
      When a device sends an PCI-Express error message to the root port,
      the root port will trigger an interrupt, by either MSI or IO-APIC,
      then kernel would run the irq handler. The handler collects root
      error status register and schedules a work. The work will call
      the core part to process the error based on its type
      (Correctable/non-fatal/fatal).
      
      As for Correctable errors, the patch chooses to just clear the correctable
      error status register of the device.
      
      As for the non-fatal error, the patch follows generic PCI error handler
      rules to call the error callback functions of the endpoint's driver. If
      the device is a bridge, the patch chooses to broadcast the error to
      downstream devices.
      
      As for the fatal error, the patch resets the pci-express link and
      follows generic PCI error handler rules to call the error callback
      functions of the endpoint's driver. If the device is a bridge, the patch
      chooses to broadcast the error to downstream devices.
      Signed-off-by: NZhang Yanmin <yanmin.zhang@intel.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      6c2b374d