1. 01 10月, 2013 7 次提交
    • L
      ACPI / IPMI: Cleanup several acpi_ipmi_device members · 2fb037b8
      Lv Zheng 提交于
      This (trivial) patch:
       1. Deletes a member of the acpi_ipmi_device, smi_data, which is not
          actually used.
       2. Updates a member of the acpi_ipmi_device, pnp_dev, which is only used
          by dev_warn() invocations, so changes it to a struct device.
      Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      2fb037b8
    • L
      ACPI / IPMI: Add reference counting for ACPI IPMI transfers · 7b984477
      Lv Zheng 提交于
      This patch adds reference counting for ACPI IPMI transfers to tune the
      locking granularity of tx_msg_lock.
      
      This patch also makes the whole acpi_ipmi module's coding style consistent
      by using reference counting for all its objects (i.e., acpi_ipmi_device and
      acpi_ipmi_msg).
      
      The acpi_ipmi_msg handling is re-designed using referece counting.
       1. tx_msg is always unlinked before complete(), so that it is safe to put
          complete() out side of tx_msg_lock.
       2. tx_msg reference counters are incremented before calling
          ipmi_request_settime() and tx_msg_lock protection is added to
          ipmi_cancel_tx_msg() so that a complete() can be safely called in
          parellel with tx_msg unlinking in failure cases.
       3. tx_msg holds a reference to acpi_ipmi_device so that it can be flushed
          and freed in the contexts other than acpi_ipmi_space_handler().
      
      The lockdep_chains shows all acpi_ipmi locks are leaf locks after the
      tuning:
       1. ipmi_lock is always leaf:
          irq_context: 0
          [ffffffff81a943f8] smi_watchers_mutex
          [ffffffffa06eca60] driver_data.ipmi_lock
          irq_context: 0
          [ffffffff82767b40] &buffer->mutex
          [ffffffffa00a6678] s_active#103
          [ffffffffa06eca60] driver_data.ipmi_lock
       2. without this patch applied, lock used by complete() is held after
          holding tx_msg_lock:
          irq_context: 0
          [ffffffff82767b40] &buffer->mutex
          [ffffffffa00a6678] s_active#103
          [ffffffffa06ecce8] &(&ipmi_device->tx_msg_lock)->rlock
          irq_context: 1
          [ffffffffa06ecce8] &(&ipmi_device->tx_msg_lock)->rlock
          irq_context: 1
          [ffffffffa06ecce8] &(&ipmi_device->tx_msg_lock)->rlock
          [ffffffffa06eccf0] &x->wait#25
          irq_context: 1
          [ffffffffa06ecce8] &(&ipmi_device->tx_msg_lock)->rlock
          [ffffffffa06eccf0] &x->wait#25
          [ffffffff81e36620] &p->pi_lock
          irq_context: 1
          [ffffffffa06ecce8] &(&ipmi_device->tx_msg_lock)->rlock
          [ffffffffa06eccf0] &x->wait#25
          [ffffffff81e36620] &p->pi_lock
          [ffffffff81e5d0a8] &rq->lock
       3. with this patch applied, tx_msg_lock is always leaf:
          irq_context: 0
          [ffffffff82767b40] &buffer->mutex
          [ffffffffa00a66d8] s_active#107
          [ffffffffa07ecdc8] &(&ipmi_device->tx_msg_lock)->rlock
          irq_context: 1
          [ffffffffa07ecdc8] &(&ipmi_device->tx_msg_lock)->rlock
      Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      7b984477
    • L
      ACPI / IPMI: Use global IPMI operation region handler · e96a94ed
      Lv Zheng 提交于
      It is found on a real machine, in its ACPI namespace, the IPMI
      OperationRegions (in the ACPI000D - ACPI power meter) are not defined under
      the IPMI system interface device (the IPI0001 with KCS type returned from
      _IFT control method):
        Device (PMI0)
        {
            Name (_HID, "ACPI000D")  // _HID: Hardware ID
            OperationRegion (SYSI, IPMI, 0x0600, 0x0100)
            Field (SYSI, BufferAcc, Lock, Preserve)
            {
                AccessAs (BufferAcc, 0x01),
                Offset (0x58),
                SCMD,   8,
                GCMD,   8
            }
      
            OperationRegion (POWR, IPMI, 0x3000, 0x0100)
            Field (POWR, BufferAcc, Lock, Preserve)
            {
                AccessAs (BufferAcc, 0x01),
                Offset (0xB3),
                GPMM,   8
            }
        }
      
        Device (PCI0)
        {
            Device (ISA)
            {
                Device (NIPM)
                {
                    Name (_HID, EisaId ("IPI0001"))  // _HID: Hardware ID
                    Method (_IFT, 0, NotSerialized)  // _IFT: IPMI Interface Type
                    {
                        Return (0x01)
                    }
                }
            }
        }
      
      Current ACPI_IPMI code registers IPMI operation region handler on a
      per-device basis, so for the above namespace the IPMI operation region
      handler is registered only under the scope of \_SB.PCI0.ISA.NIPM.  Thus
      when an IPMI operation region field of \PMI0 is accessed, there are errors
      reported on such platform:
        ACPI Error: No handlers for Region [IPMI]
        ACPI Error: Region IPMI(7) has no handler
      The solution is to install an IPMI operation region handler from root node
      so that every object that defines IPMI OperationRegion can get an address
      space handler registered.
      
      When an IPMI operation region field is accessed, the Network Function
      (0x06 for SYSI and 0x30 for POWR) and the Command (SCMD, GCMD, GPMM) are
      passed to the operation region handler, there is no system interface
      specified by the BIOS.  The patch tries to select one system interface by
      monitoring the system interface notification.  IPMI messages passed from
      the ACPI codes are sent to this selected global IPMI system interface.
      
      The ACPI_IPMI will always select the first registered IPMI interface
      with an ACPI handle (i.e., defined in the ACPI namespace).  It's hard to
      determine the selection when there are multiple IPMI system interfaces
      defined in the ACPI namespace. According to the IPMI specification:
      
        A BMC device may make available multiple system interfaces, but only one
        management controller is allowed to be 'active' BMC that provides BMC
        functionality for the system (in case of a 'partitioned' system, there
        can be only one active BMC per partition).  Only the system interface(s)
        for the active BMC allowed to respond to the 'Get Device Id' command.
      
      According to the ipmi_si desigin:
      
        The ipmi_si registeration notifications can only happen after a
        successful "Get Device ID" command.
      
      Thus it should be OK for non-partitioned systems to do such selection.
      However, we do not have much knowledge on 'partitioned' systems.
      
      References: https://bugzilla.kernel.org/show_bug.cgi?id=46741Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      e96a94ed
    • L
      ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI user · a1a69b29
      Lv Zheng 提交于
      This patch uses reference counting to fix the race caused by the
      unprotected ACPI IPMI user.
      
      There are two rules for using the ipmi_si APIs:
       1. In ipmi_si, ipmi_destroy_user() can ensure that no ipmi_recv_msg will
          be passed to ipmi_msg_handler(), but ipmi_request_settime() can not
          use an invalid ipmi_user_t.  This means the ipmi_si users must ensure
          that there won't be any local references on ipmi_user_t before invoking
          ipmi_destroy_user().
       2. In ipmi_si, the smi_gone()/new_smi() callbacks are protected by
          smi_watchers_mutex, so their execution is serialized.  But as a
          new smi can re-use a freed intf_num, it requires that the callback
          implementation must not use intf_num as an identification mean or it
          must ensure all references to the previous smi are all dropped before
          exiting smi_gone() callback.
      
      As the acpi_ipmi_device->user_interface check in acpi_ipmi_space_handler()
      can happen before setting user_interface to NULL and codes after the check
      in acpi_ipmi_space_handler() can happen after user_interface becomes NULL,
      the on-going acpi_ipmi_space_handler() still can pass an invalid
      acpi_ipmi_device->user_interface to ipmi_request_settime().  Such race
      conditions are not allowed by the IPMI layer's API design as a crash will
      happen in ipmi_request_settime() if something like that happens.
      
      This patch follows the ipmi_devintf.c design:
       1. Invoke ipmi_destroy_user() after the reference count of
          acpi_ipmi_device drops to 0.  References of acpi_ipmi_device dropping
          to 0 also means tx_msg related to this acpi_ipmi_device are all freed.
          This matches the IPMI layer's API calling rule on ipmi_destroy_user()
          and ipmi_request_settime().
       2. ipmi_flush_tx_msg() is performed so that no on-going tx_msg can still be
          running in acpi_ipmi_space_handler().  And it is invoked after invoking
          __ipmi_dev_kill() where acpi_ipmi_device is deleted from the list with a
          "dead" flag set, and the "dead" flag check is also introduced to the
          point where a tx_msg is going to be added to the tx_msg_list so that no
          new tx_msg can be created after returning from the __ipmi_dev_kill().
       3. The waiting codes in ipmi_flush_tx_msg() is deleted because it is not
          required since this patch ensures no acpi_ipmi reference is still held
          for ipmi_user_t before calling ipmi_destroy_user() and
          ipmi_destroy_user() can ensure no more ipmi_msg_handler() can happen
          after returning from ipmi_destroy_user().
       4. The flushing of tx_msg is also moved out of ipmi_lock in this patch.
      
      The forthcoming IPMI operation region handler installation changes also
      requires acpi_ipmi_device be handled in this style.
      
      The header comment of the file is also updated due to this design change.
      Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      a1a69b29
    • L
      ACPI / IPMI: Fix race caused by the timed out ACPI IPMI transfers · 8584ec6a
      Lv Zheng 提交于
      This patch fixes races caused by timed out ACPI IPMI transfers.
      
      This patch uses timeout mechanism provided by ipmi_si to avoid the race
      that the msg_done flag is set but without any protection, its content can
      be invalid.  Thanks for the suggestion of Corey Minyard.
      Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      8584ec6a
    • L
      ACPI / IPMI: Fix race caused by the unprotected ACPI IPMI transfers · 5ac557ef
      Lv Zheng 提交于
      This patch fixes races caused by unprotected ACPI IPMI transfers.
      
      We can see that the following crashes may occur:
       1. There is no tx_msg_lock held for iterating tx_msg_list in
          ipmi_flush_tx_msg() while it may be unlinked on failure in
          parallel in acpi_ipmi_space_handler() under tx_msg_lock.
       2. There is no lock held for freeing tx_msg in acpi_ipmi_space_handler()
          while it may be accessed in parallel in ipmi_flush_tx_msg() and
          ipmi_msg_handler().
      
      This patch enhances tx_msg_lock to protect all tx_msg accesses to solve
      this issue.  Then tx_msg_lock is always held around complete() and tx_msg
      accesses.
      Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      5ac557ef
    • L
      ACPI / IPMI: Fix potential response buffer overflow · 6b68f03f
      Lv Zheng 提交于
      This patch enhances sanity checks on message size to avoid potential buffer
      overflow.
      
      The kernel IPMI message size is IPMI_MAX_MSG_LENGTH(272 bytes) while the
      ACPI specification defined IPMI message size is 64 bytes.  The difference
      is not handled by the original codes.  This may cause crash in the response
      handling codes.
      
      This patch closes this gap and also combines rx_data/tx_data to use single
      data/len pair since they need not be seperate.
      Signed-off-by: NLv Zheng <lv.zheng@intel.com>
      Reviewed-by: NHuang Ying <ying.huang@intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      6b68f03f
  2. 30 9月, 2013 8 次提交
    • L
      Linux 3.12-rc3 · 15c03dd4
      Linus Torvalds 提交于
      15c03dd4
    • L
      Merge tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 30ceb4ec
      Linus Torvalds 提交于
      Pull USB fixes from Greg KH:
       "Here are a number of USB driver fixes for 3.12-rc3.
      
        These are all for host controller issues that have been reported, and
        there's a fix for an annoying error message that gets printed every
        time you remove a USB 3 device from the system that's been bugging me
        for a while"
      
      * tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: dwc3: add support for Merrifield
        USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitialization
        USB: Fix breakage in ffs_fs_mount()
        fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phy
        usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit
        usb: chipidea: USB_CHIPIDEA should depend on HAS_DMA
        usb: chipidea: udc: free pending TD at removal procedure
        usb: chipidea: imx: Add usb_phy_shutdown at probe's error path
        usb: chipidea: Fix memleak for ci->hw_bank.regmap when removal
        usb: chipidea: udc: fix the oops after rmmod gadget
        USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd
        USB: OHCI: accept very late isochronous URBs
        USB: UHCI: accept very late isochronous URBs
        USB: iMX21: accept very late isochronous URBs
        usbcore: check usb device's state before sending a Set SEL control transfer
        xhci: Fix race between ep halt and URB cancellation
        usb: Fix xHCI host issues on remote wakeup.
        xhci: Ensure a command structure points to the correct trb on the command ring
        xhci: Fix oops happening after address device timeout
      30ceb4ec
    • L
      Merge tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 26c019fc
      Linus Torvalds 提交于
      Pull tty/serial fixes from Greg KH:
       "Here are some serial at tty driver fixes for 3.12-rc3
      
        The serial driver fixes some kref leaks, documentation is moved to the
        proper places, and the tty and n_tty fixes resolve some reported
        regressions.  There is still one outstanding tty regression fix that
        isn't in here yet, as I want to test it out some more, it will be sent
        for 3.12-rc4 if it checks out"
      
      * tag 'tty-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: ar933x_uart: move devicetree binding documentation
        tty: Fix SIGTTOU not sent with tcflush()
        n_tty: Fix EOF push index when termios changes
        serial: pch_uart: remove unnecessary tty_port_tty_get
        serial: pch_uart: fix tty-kref leak in dma-rx path
        serial: pch_uart: fix tty-kref leak in rx-error path
        serial: tegra: fix tty-kref leak
      26c019fc
    • L
      Merge tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 31795c40
      Linus Torvalds 提交于
      Pull staging fixes from Greg KH:
       "Here are some staging driver fixes, MAINTAINER updates, and a new
        device id.  All of these have been in the linux-next tree, and are
        pretty simple patches"
      
      * tag 'staging-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: r8188eu: Add new device ID
        staging: imx-drm: Fix probe failure
        staging: vt6656: [BUG] iwctl_siwencodeext return if device not open
        staging: vt6656: [BUG] main_usb.c oops on device_close move flag earlier.
        staging: vt6656: rxtx.c [BUG] s_vGetFreeContext dead lock on null apTD.
        Staging: rtl8192u: r819xU_cmdpkt: checking NULL value after doing dev_alloc_skb
        staging: usbip: Orphan usbip
        staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
        staging: r8188eu: Cocci spatch "noderef"
        staging: octeon-usb: Cocci spatch "noderef"
        staging: r8188eu: Add files for new drive: Cocci spatch "noderef"
        MAINTAINERS: staging: dgnc and dgap drivers: add maintainer
        staging: lustre: Cocci spatch "noderef"
      31795c40
    • L
      Merge tag 'driver-core-3.12-rc3' of... · 434ac47d
      Linus Torvalds 提交于
      Merge tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core / sysfs fixes from Greg KH:
       "Here are 2 fixes for 3.12-rc3.  One fixes a sysfs problem with
        mounting caused by 3.12-rc1, and the other is a bug reported by the
        chromeos developers with the driver core.
      
        Both have been in linux-next for a bit"
      
      * tag 'driver-core-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        driver core : Fix use after free of dev->parent in device_shutdown
        sysfs: Allow mounting without CONFIG_NET
      434ac47d
    • L
      Merge tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · c23c2234
      Linus Torvalds 提交于
      Pull char/misc driver fixes from Greg KH:
       "Here are some HyperV and MEI driver fixes for 3.12-rc3.  They resolve
        some issues that people have been reporting for them"
      
      * tag 'char-misc-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        Drivers: hv: vmbus: Terminate vmbus version negotiation on timeout
        Drivers: hv: util: Correctly support ws2008R2 and earlier
        mei: cancel stall timers in mei_reset
        mei: bus: stop wait for read during cl state transition
        mei: make me client counters less error prone
      c23c2234
    • L
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · cac66535
      Linus Torvalds 提交于
      Pull perf revert from Ingo Molnar:
       "This fixes the 'perf top' regression Markus Trippelsdorf reported"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        Revert "perf symbols: Demangle cloned functions"
      cac66535
    • L
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · b97b869a
      Linus Torvalds 提交于
      Pull drm fixes from Dave Airlie:
       "Nothing too major, radeon still has some dpm changes for off by
        default.
      
        Radeon, intel, msm:
         - radeon: a few more dpm fixes (still off by default), uvd fixes
         - i915: runtime warn backtrace and regression fix
         - msm: iommu changes fallout"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (27 commits)
        drm/msm: use drm_gem_dumb_destroy helper
        drm/msm: deal with mach/iommu.h removal
        drm/msm: Remove iommu include from mdp4_kms.c
        drm/msm: Odd PTR_ERR usage
        drm/i915: Fix up usage of SHRINK_STOP
        drm/radeon: fix hdmi audio on DCE3.0/3.1 asics
        drm/i915: preserve pipe A quirk in i9xx_set_pipeconf
        drm/i915/tv: clear adjusted_mode.flags
        drm/i915/dp: increase i2c-over-aux retry interval on AUX DEFER
        drm/radeon/cik: fix overflow in vram fetch
        drm/radeon: add missing hdmi callbacks for rv6xx
        drm/i915: Use a temporary va_list for two-pass string handling
        drm/radeon/uvd: lower msg&fb buffer requirements on UVD3
        drm/radeon: disable tests/benchmarks if accel is disabled
        drm/radeon: don't set default clocks for SI when DPM is disabled
        drm/radeon/dpm/ci: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/si: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/ni: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm/btc: filter clocks based on voltage/clk dep tables
        drm/radeon/dpm: fetch the max clk from voltage dep tables helper
        ...
      b97b869a
  3. 29 9月, 2013 12 次提交
  4. 28 9月, 2013 13 次提交