1. 25 11月, 2016 2 次提交
  2. 08 11月, 2016 2 次提交
  3. 03 10月, 2016 1 次提交
    • X
      ipmi: fix crash on reading version from proc after unregisted bmc · bd85f4b3
      Xie XiuQi 提交于
      I meet a crash, which could be reproduce:
      1) while true; do cat /proc/ipmi/0/version; done
      2) modprobe -rv ipmi_si ipmi_msghandler ipmi_devintf
      
      [82761.021137] IPMI BT: req2rsp=5 secs retries=2
      [82761.034524] ipmi device interface
      [82761.222218] ipmi_si ipmi_si.0: Found new BMC (man_id: 0x0007db, prod_id: 0x0001, dev_id: 0x01)
      [82761.222230] ipmi_si ipmi_si.0: IPMI bt interface initialized
      [82903.922740] BUG: unable to handle kernel NULL pointer dereference at 00000000000002d4
      [82903.930952] IP: [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler]
      [82903.939220] PGD 86693a067 PUD 865304067 PMD 0
      [82903.943893] Thread overran stack, or stack corrupted
      [82903.949034] Oops: 0000 [#1] SMP
      [82903.983091] Modules linked in: ipmi_si(-) ipmi_msghandler binfmt_misc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter
      ...
      [82904.057285]  pps_core scsi_transport_sas dm_mod vfio_iommu_type1 vfio xt_sctp nf_conntrack_proto_sctp nf_nat_proto_sctp
                      nf_nat nf_conntrack sctp libcrc32c [last unloaded: ipmi_devintf]
      [82904.073169] CPU: 37 PID: 28089 Comm: cat Tainted: GF          O   ---- -------   3.10.0-327.28.3.el7.x86_64 #1
      [82904.083373] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 3.22 05/16/2016
      [82904.090592] task: ffff880101cc2e00 ti: ffff880369c54000 task.ti: ffff880369c54000
      [82904.098414] RIP: 0010:[<ffffffffa030d9e8>]  [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler]
      [82904.109124] RSP: 0018:ffff880369c57e70  EFLAGS: 00010203
      [82904.114608] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000024688470
      [82904.121912] RDX: fffffffffffffff4 RSI: ffffffffa0313404 RDI: ffff8808670ce200
      [82904.129218] RBP: ffff880369c57e70 R08: 0000000000019720 R09: ffffffff81204a27
      [82904.136521] R10: ffff88046f803300 R11: 0000000000000246 R12: ffff880662399700
      [82904.143828] R13: 0000000000000001 R14: ffff880369c57f48 R15: ffff8808670ce200
      [82904.151128] FS:  00007fb70c9ca740(0000) GS:ffff88086e340000(0000) knlGS:0000000000000000
      [82904.159557] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [82904.165473] CR2: 00000000000002d4 CR3: 0000000864c0c000 CR4: 00000000003407e0
      [82904.172778] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [82904.180084] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [82904.187385] Stack:
      [82904.189573]  ffff880369c57ee0 ffffffff81204f1a 00000000122a2427 0000000001426000
      [82904.197392]  ffff8808670ce238 0000000000010000 0000000000000000 0000000000000fff
      [82904.205198]  00000000122a2427 ffff880862079600 0000000001426000 ffff880369c57f48
      [82904.212962] Call Trace:
      [82904.219667]  [<ffffffff81204f1a>] seq_read+0xfa/0x3a0
      [82904.224893]  [<ffffffff8124ce2d>] proc_reg_read+0x3d/0x80
      [82904.230468]  [<ffffffff811e102c>] vfs_read+0x9c/0x170
      [82904.235689]  [<ffffffff811e1b7f>] SyS_read+0x7f/0xe0
      [82904.240816]  [<ffffffff81649209>] system_call_fastpath+0x16/0x1b
      [82904.246991] Code: 30 a0 e8 0c 6f ef e0 5b 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f
                     44 00 00 48 8b 47 78 55 48 c7 c6 04 34 31 a0 48 89 e5 48 8b 40 50 <0f>
      	       b6 90 d4 02 00 00 31 c0 89 d1 83 e2 0f c0 e9 04 0f b6 c9 e8
      [82904.267710] RIP  [<ffffffffa030d9e8>] smi_version_proc_show+0x18/0x40 [ipmi_msghandler]
      [82904.276079]  RSP <ffff880369c57e70>
      [82904.279734] CR2: 00000000000002d4
      [82904.283731] ---[ end trace a69e4328b49dd7c4 ]---
      [82904.328118] Kernel panic - not syncing: Fatal exception
      
      Reading versin from /proc need bmc device struct available. So in this patch
      we move add/remove_proc_entries between ipmi_bmc_register and ipmi_bmc_unregister.
      
      Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
      Signed-off-by: NXie XiuQi <xiexiuqi@huawei.com>
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      bd85f4b3
  4. 30 9月, 2016 4 次提交
  5. 27 7月, 2016 1 次提交
    • T
      ipmi: remove trydefaults parameter and default init · b07b58a3
      Tony Camuso 提交于
      Parameter trydefaults=1 causes the ipmi_init to initialize ipmi through
      the legacy port io space that was designated for ipmi. Architectures
      that do not map legacy port io can panic when trydefaults=1.
      
      Rather than implement build-time conditional exceptions for each
      architecture that does not map legacy port io, we have removed legacy
      port io from the driver.
      
      Parameter 'trydefaults' has been removed. Attempts to use it hereafter
      will evoke the "Unknown symbol in module, or unknown parameter" message.
      
      The patch was built against a number of architectures and tested for
      regressions and functionality on x86_64 and ARM64.
      Signed-off-by: NTony Camuso <tcamuso@redhat.com>
      
      Removed the config entry and the address source entry for default,
      since neither were used any more.
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      b07b58a3
  6. 17 6月, 2016 1 次提交
  7. 13 6月, 2016 1 次提交
    • J
      ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() · ae4ea9a2
      Junichi Nomura 提交于
      Commit 7ea0ed2b ("ipmi: Make the message handler easier to use for
      SMI interfaces") changed handle_new_recv_msgs() to call handle_one_recv_msg()
      for a smi_msg while the smi_msg is still connected to waiting_rcv_msgs list.
      That could lead to following list corruption problems:
      
      1) low-level function treats smi_msg as not connected to list
      
        handle_one_recv_msg() could end up calling smi_send(), which
        assumes the msg is not connected to list.
      
        For example, the following sequence could corrupt list by
        doing list_add_tail() for the entry still connected to other list.
      
          handle_new_recv_msgs()
            msg = list_entry(waiting_rcv_msgs)
            handle_one_recv_msg(msg)
              handle_ipmb_get_msg_cmd(msg)
                smi_send(msg)
                  spin_lock(xmit_msgs_lock)
                  list_add_tail(msg)
                  spin_unlock(xmit_msgs_lock)
      
      2) race between multiple handle_new_recv_msgs() instances
      
        handle_new_recv_msgs() once releases waiting_rcv_msgs_lock before calling
        handle_one_recv_msg() then retakes the lock and list_del() it.
      
        If others call handle_new_recv_msgs() during the window shown below
        list_del() will be done twice for the same smi_msg.
      
        handle_new_recv_msgs()
          spin_lock(waiting_rcv_msgs_lock)
          msg = list_entry(waiting_rcv_msgs)
          spin_unlock(waiting_rcv_msgs_lock)
        |
        | handle_one_recv_msg(msg)
        |
          spin_lock(waiting_rcv_msgs_lock)
          list_del(msg)
          spin_unlock(waiting_rcv_msgs_lock)
      
      Fixes: 7ea0ed2b ("ipmi: Make the message handler easier to use for SMI interfaces")
      Signed-off-by: NJun'ichi Nomura <j-nomura@ce.jp.nec.com>
      [Added a comment to describe why this works.]
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      Cc: stable@vger.kernel.org # 3.19
      Tested-by: NYe Feng <yefeng.yl@alibaba-inc.com>
      ae4ea9a2
  8. 17 5月, 2016 3 次提交
    • C
      ipmi: Fix the I2C address extraction from SPMI tables · 70f95b76
      Corey Minyard 提交于
      Unlike everywhere else in the IPMI specification, the I2C address
      specified in the SPMI table is not shifted to the left one bit with
      the LSB zero.  Instead it is not shifted with the MSB zero.
      Reported-by: NSanjeev <singhsan@codeaurora.org>
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      70f95b76
    • C
      IPMI: reserve memio regions separately · 57a38f13
      Corey Minyard 提交于
      Commit d61a3ead ("[PATCH] IPMI: reserve I/O ports separately")
      changed the way I/O ports were reserved and includes this comment in
      log:
      
       Some BIOSes reserve disjoint I/O regions in their ACPI tables for the IPMI
       controller.  This causes problems when trying to register the entire I/O
       region.  Therefore we must register each I/O port separately.
      
      There is a similar problem with memio regions on an arm64 platform
      (AMD Seattle). Where I see:
      
       ipmi message handler version 39.2
       ipmi_si AMDI0300:00: probing via device tree
       ipmi_si AMDI0300:00: ipmi_si: probing via ACPI
       ipmi_si AMDI0300:00: [mem 0xe0010000] regsize 1 spacing 4 irq 23
       ipmi_si: Adding ACPI-specified kcs state machine
       IPMI System Interface driver.
       ipmi_si: Trying ACPI-specified kcs state machine at mem \
                address 0xe0010000, slave address 0x0, irq 23
       ipmi_si: Could not set up I/O space
      
      The problem is that the ACPI core registers disjoint regions for the
      platform device:
      
      e0010000-e0010000 : AMDI0300:00
      e0010004-e0010004 : AMDI0300:00
      
      and the ipmi_si driver tries to register one region e0010000-e0010004.
      
      Based on a patch from Mark Salter <msalter@redhat.com>, who also wrote
      all the above text.
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      Tested-by: NMark Salter <msalter@redhat.com>
      57a38f13
    • C
      ipmi: Fix some minor coding style issues · 76824852
      Corey Minyard 提交于
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      76824852
  9. 23 3月, 2016 1 次提交
  10. 18 3月, 2016 4 次提交
  11. 04 2月, 2016 1 次提交
    • T
      ipmi: put acpi.h with the other headers · 58c9d61f
      Tony Camuso 提交于
      Enclosing '#include <linux/acpi.h>' within '#ifdef CONFIG_ACPI' is
      unnecessary, since it has its own conditional compile for CONFIG_ACPI.
      
      Commit 0fbcf4af ("ipmi: Convert the IPMI SI ACPI handling to a
      platform device") exposed this as a problem for platforms that do not
      support ACPI when it introduced a call to ACPI_PTR() macro outside of
      the CONFIG_ACPI conditional compile. This would have been perfectly
      acceptable if acpi.h were not conditionally excluded for the non-acpi
      platform, because the conditional compile within acpi.h defines
      ACPI_PTR() to return NULL when compiled for non acpi platforms.
      Signed-off-by: NTony Camuso <tcamuso@redhat.com>
      
      Fixed commit reference in header to conform to standard.
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      58c9d61f
  12. 13 1月, 2016 3 次提交
    • D
      ipmi: Remove unnecessary pci_disable_device. · bb0dcebe
      Dave Jones 提交于
      We call cleanup_one_si from ipmi_pci_remove, which calls ->addr_source_cleanup,
       which gets set to point to ipmi_pci_cleanup, which does a pci_disable_device.
      
      On return from this, we do a second pci_disable_device, which
      results in the trace below.
      
      ipmi_si 0000:00:16.0: disabling already-disabled device
      Call Trace:
       [<ffffffff818ce54c>] dump_stack+0x45/0x57
       [<ffffffff810525f7>] warn_slowpath_common+0x97/0xe0
       [<ffffffff810526f6>] warn_slowpath_fmt+0x46/0x50
       [<ffffffff81497ca1>] pci_disable_device+0xb1/0xc0
       [<ffffffffa00851a5>] ipmi_pci_remove+0x25/0x30 [ipmi_si]
       [<ffffffff8149a696>] pci_device_remove+0x46/0xc0
       [<ffffffff8156801f>] __device_release_driver+0x7f/0xf0
       [<ffffffff81568978>] driver_detach+0xb8/0xc0
       [<ffffffff81567e50>] bus_remove_driver+0x50/0xa0
       [<ffffffff8156914e>] driver_unregister+0x2e/0x60
       [<ffffffff8149a3e5>] pci_unregister_driver+0x25/0x90
       [<ffffffffa0085804>] cleanup_ipmi_si+0xd4/0xf0 [ipmi_si]
       [<ffffffff810c727a>] SyS_delete_module+0x12a/0x200
       [<ffffffff818d4d72>] system_call_fastpath+0x12/0x17
      Signed-off-by: NDave Jones <dsj@fb.com>
      bb0dcebe
    • K
      char: ipmi: Drop owner assignment from i2c_driver · aad756f8
      Krzysztof Kozlowski 提交于
      i2c_driver does not need to set an owner because i2c_register_driver()
      will set it.
      Signed-off-by: NKrzysztof Kozlowski <k.kozlowski@samsung.com>
      aad756f8
    • L
      ipmi: constify some struct and char arrays · 99ee6735
      LABBE Corentin 提交于
      Lots of char arrays could be set as const since they contain only literal
      char arrays.
      We could in the same time make const some struct members who are pointer
      to those const char arrays.
      Signed-off-by: NLABBE Corentin <clabbe.montjoie@gmail.com>
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      99ee6735
  13. 10 12月, 2015 1 次提交
    • J
      ipmi: move timer init to before irq is setup · 27f972d3
      Jan Stancek 提交于
      We encountered a panic on boot in ipmi_si on a dell per320 due to an
      uninitialized timer as follows.
      
      static int smi_start_processing(void       *send_info,
                                      ipmi_smi_t intf)
      {
              /* Try to claim any interrupts. */
              if (new_smi->irq_setup)
                      new_smi->irq_setup(new_smi);
      
       --> IRQ arrives here and irq handler tries to modify uninitialized timer
      
          which triggers BUG_ON(!timer->function) in __mod_timer().
      
       Call Trace:
         <IRQ>
         [<ffffffffa0532617>] start_new_msg+0x47/0x80 [ipmi_si]
         [<ffffffffa053269e>] start_check_enables+0x4e/0x60 [ipmi_si]
         [<ffffffffa0532bd8>] smi_event_handler+0x1e8/0x640 [ipmi_si]
         [<ffffffff810f5584>] ? __rcu_process_callbacks+0x54/0x350
         [<ffffffffa053327c>] si_irq_handler+0x3c/0x60 [ipmi_si]
         [<ffffffff810efaf0>] handle_IRQ_event+0x60/0x170
         [<ffffffff810f245e>] handle_edge_irq+0xde/0x180
         [<ffffffff8100fc59>] handle_irq+0x49/0xa0
         [<ffffffff8154643c>] do_IRQ+0x6c/0xf0
         [<ffffffff8100ba53>] ret_from_intr+0x0/0x11
      
              /* Set up the timer that drives the interface. */
              setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
      
      The following patch fixes the problem.
      
      To: Openipmi-developer@lists.sourceforge.net
      To: Corey Minyard <minyard@acm.org>
      CC: linux-kernel@vger.kernel.org
      Signed-off-by: NJan Stancek <jstancek@redhat.com>
      Signed-off-by: NTony Camuso <tcamuso@redhat.com>
      Signed-off-by: NCorey Minyard <cminyard@mvista.com>
      Cc: stable@vger.kernel.org # Applies cleanly to 3.10-, needs small rework before
      27f972d3
  14. 16 11月, 2015 4 次提交
  15. 25 10月, 2015 1 次提交
  16. 04 9月, 2015 10 次提交