1. 16 2月, 2014 2 次提交
    • R
      ACPI / hotplug / PCI: Add ACPIPHP contexts to devices handled by PCIeHP · cc6254e0
      Rafael J. Wysocki 提交于
      Currently, ACPIPHP does not add hotplug context to devices that
      should be handled by the native PCI hotplug (PCIeHP) code.  The
      reason why was because PCIeHP didn't know about the devices'
      connections with ACPI and would not clean up things properly
      during an eject of an ACPI-backed device, for example.
      
      However, after recent changes that made the ACPI core create struct
      acpi_device objects for all namespace nodes regardless of the
      underlying devices' status and added PCI rescan-remove locking to
      both ACPIPHP and PCIeHP, that concern is not valid any more.
      Namely, after those changes PCIeHP need not care about the ACPI
      side of things any more and it should be serialized with respect to
      ACPIPHP and they won't be running concurrently with each other in
      any case.
      
      For this reason, make ACPIPHP to add its hotplug context to
      all devices with ACPI companions, even the ones that should be
      handled by PCIeHP in principle.  That may work around hotplug
      issues on some systems where PCIeHP is supposed to work, but it
      doesn't and the ACPI hotplug signaling works instead.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      cc6254e0
    • R
      ACPI / hotplug / PCI: Rename register_slot() to acpiphp_add_context() · 3799c5a0
      Rafael J. Wysocki 提交于
      The name of register_slot() doesn't really reflect what the function
      is does, so rename it to acpiphp_add_context() and add a proper
      kerneldoc comment to it.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      3799c5a0
  2. 12 2月, 2014 1 次提交
    • M
      ACPI / hotplug / PCI: Relax the checking of _STA return values · 72820594
      Mika Westerberg 提交于
      The ACPI specification (ACPI 5.0A, Section 6.3.7) says:
      
       _STA may return bit 0 clear (not present) with bit 3 set (device is
       functional). This case is used to indicate a valid device for which
       no device driver should be loaded (for example, a bridge device.)
       Children of this device may be present and valid. OSPM should
       continue enumeration below a device whose _STA returns this bit
       combination.
      
      Evidently, some BIOSes follow that and return 0x0A from _STA, which
      causes problems to happen when they trigger bus check or device check
      notifications for those devices too.  Namely, ACPIPHP thinks that they
      are gone and may drop them, for example, if such a notification is
      triggered during a resume from system suspend.
      
      To fix that, modify ACPICA to regard devies as present and
      functioning if _STA returns both the ACPI_STA_DEVICE_ENABLED
      and ACPI_STA_DEVICE_FUNCTIONING bits set for them.
      Reported-and-tested-by: NPeter Wu <lekensteyn@gmail.com>
      Cc: 3.12+ <stable@vger.kernel.org> # 3.12+
      [rjw: Subject and changelog, minor code modifications]
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      72820594
  3. 10 2月, 2014 1 次提交
  4. 07 2月, 2014 4 次提交
    • R
      ACPI / hotplug / PCI: Rework acpiphp_check_host_bridge() · 1f7c164b
      Rafael J. Wysocki 提交于
      Since the only existing caller of acpiphp_check_host_bridge(),
      which is acpi_pci_root_scan_dependent(), already has a struct
      acpi_device pointer needed to obtain the ACPIPHP context, it
      doesn't make sense to execute acpi_bus_get_device() on its
      handle in acpiphp_handle_to_bridge() just in order to get that
      pointer back.
      
      For this reason, modify acpiphp_check_host_bridge() to take
      a struct acpi_device pointer as its argument and rearrange the
      code accordingly.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Tested-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      1f7c164b
    • R
      ACPI / hotplug / PCI: Hotplug notifications from acpi_bus_notify() · 1a699476
      Rafael J. Wysocki 提交于
      Since acpi_bus_notify() is executed on all notifications for all
      devices anyway, make it execute acpi_device_hotplug() for all
      hotplug events instead of installing notify handlers pointing to
      the same function for all hotplug devices.
      
      This change reduces both the size and complexity of ACPI-based device
      hotplug code.  Moreover, since acpi_device_hotplug() only does
      significant things for devices that have either an ACPI scan handler,
      or a hotplug context with .eject() defined, and those devices
      had notify handlers pointing to acpi_hotplug_notify_cb() installed
      before anyway, this modification shouldn't change functionality.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      1a699476
    • R
      ACPI / hotplug / PCI: Simplify acpi_install_hotplug_notify_handler() · 5e6f236c
      Rafael J. Wysocki 提交于
      Since acpi_hotplug_notify_cb() does not use its data argument any
      more, the second argument of acpi_install_hotplug_notify_handler()
      can be dropped, so do that and update its callers accordingly.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      5e6f236c
    • R
      ACPI / hotplug / PCI: Consolidate ACPIPHP with ACPI core hotplug · 3c2cc7ff
      Rafael J. Wysocki 提交于
      The ACPI-based PCI hotplug (ACPIPHP) code currently attaches its
      hotplug context objects directly to ACPI namespace nodes representing
      hotplug devices.  However, after recent changes causing struct
      acpi_device to be created for every namespace node representing a
      device (regardless of its status), that is not necessary any more.
      Moreover, it's vulnerable to the theoretical issue that the ACPI
      handle passed in the context between handle_hotplug_event() and
      hotplug_event_work() may become invalid in the meantime (as a
      result of a concurrent table unload).
      
      In principle, this issue might be addressed by adding a non-empty
      release handler for ACPIPHP hotplug context objects analogous to
      acpi_scan_drop_device(), but that would duplicate the code in that
      function and in acpi_device_del_work_fn().  For this reason, it's
      better to modify ACPIPHP to attach its device hotplug contexts to
      struct device objects representing hotplug devices and make it
      use acpi_hotplug_notify_cb() as its notify handler.  At the same
      time, acpi_device_hotplug() can be modified to dispatch the new
      .hp.event() callback pointing to acpiphp_hotplug_event() from ACPI
      device objects associated with PCI devices or use the generic
      ACPI device hotplug code for device objects with matching scan
      handlers.
      
      This allows the existing code duplication between ACPIPHP and the
      ACPI core to be reduced too and makes further ACPI-based device
      hotplug consolidation possible.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      3c2cc7ff
  5. 06 2月, 2014 12 次提交
  6. 04 2月, 2014 5 次提交
    • R
      ACPI / hotplug / PCI: Fix bridge removal race vs dock events · af9d8adc
      Rafael J. Wysocki 提交于
      If a PCI bridge with an ACPIPHP context attached is removed via
      sysfs, the code path executed as a result is the following:
      
      pci_stop_and_remove_bus_device_locked
       pci_remove_bus
        pcibios_remove_bus
         acpi_pci_remove_bus
          acpiphp_remove_slots
           cleanup_bridge
            unregister_hotplug_dock_device (drops dock references to the bridge)
           put_bridge
            free_bridge
             acpiphp_put_context (for each child, under context lock)
              kfree (context)
      
      Now, if a dock event affecting one of the bridge's child devices
      occurs (roughly at the same time), it will lead to the following code
      path:
      
      acpi_dock_deferred_cb
       dock_notify
        handle_eject_request
         hot_remove_dock_devices
          dock_hotplug_event
           hotplug_event (dereferences context)
      
      That may lead to a kernel crash in hotplug_event() if it is executed
      after the last kfree() in the bridge removal code path.
      
      To prevent that from happening, add a wrapper around hotplug_event()
      called dock_event() and point the .handler pointer in acpiphp_dock_ops
      to it.  Make that wrapper retrieve the device's ACPIPHP context using
      acpiphp_get_context() (instead of taking it from the data argument)
      under acpiphp_context_lock and check if the parent bridge's
      is_going_away flag is set.  If that flag is set, it will return
      immediately and if it is not set it will grab a reference to the
      device's parent bridge before executing hotplug_event().
      
      Then, in the above scenario, the reference to the parent bridge
      held by dock_event() will prevent free_bridge() from being executed
      for it until hotplug_event() returns.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      af9d8adc
    • R
      ACPI / hotplug / PCI: Fix bridge removal race in handle_hotplug_event() · 1b360f44
      Rafael J. Wysocki 提交于
      If a PCI bridge with an ACPIPHP context attached is removed via
      sysfs, the code path executed as a result is the following:
      
      pci_stop_and_remove_bus_device_locked
       pci_remove_bus
        pcibios_remove_bus
         acpi_pci_remove_bus
          acpiphp_remove_slots
           cleanup_bridge
           put_bridge
            free_bridge
             acpiphp_put_context (for each child, under context lock)
              kfree (child context)
      
      Now, if a hotplug notify is dispatched for one of the bridge's
      children and the timing is such that handle_hotplug_event() for
      that notify is executed while free_bridge() above is running,
      the get_bridge(context->func.parent) in handle_hotplug_event()
      will not really help, because it is too late to prevent the bridge
      from going away and the child's context may be freed before
      hotplug_event_work() scheduled from handle_hotplug_event()
      dereferences the pointer to it passed via the data argument.
      That will cause a kernel crash to happpen in hotplug_event_work().
      
      To prevent that from happening, make handle_hotplug_event()
      check the is_going_away flag of the function's parent bridge
      (under acpiphp_context_lock) and bail out if it's set.  Also,
      make cleanup_bridge() set the bridge's is_going_away flag under
      acpiphp_context_lock so that it cannot be changed between the
      check and the subsequent get_bridge(context->func.parent) in
      handle_hotplug_event().
      
      Then, in the above scenario, handle_hotplug_event() will notice
      that context->func.parent->is_going_away is already set and it
      will exit immediately preventing the crash from happening.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      1b360f44
    • R
      ACPI / hotplug / PCI: Scan root bus under the PCI rescan-remove lock · d42f5da2
      Rafael J. Wysocki 提交于
      Since acpiphp_check_bridge() called by acpiphp_check_host_bridge()
      does things that require PCI rescan-remove locking around it,
      make acpiphp_check_host_bridge() use that locking.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Tested-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      d42f5da2
    • R
      ACPI / hotplug / PCI: Move PCI rescan-remove locking to hotplug_event() · f41b3261
      Rafael J. Wysocki 提交于
      Commit 9217a984 (ACPI / hotplug / PCI: Use global PCI rescan-remove
      locking) modified ACPIPHP to protect its PCI device removal and addition
      code paths from races against sysfs-driven rescan and remove operations
      with the help of PCI rescan-remove locking.  However, it overlooked the
      fact that hotplug_event_work() is not the only caller of hotplug_event()
      which may also be called by dock_hotplug_event() and that code path
      is missing the PCI rescan-remove locking.  This means that, although
      the PCI rescan-remove lock is held as appropriate during the handling
      of events originating from handle_hotplug_event(), the ACPIPHP's
      operations resulting from dock events may still suffer the race
      conditions that commit 9217a984 was supposed to eliminate.
      
      To address that problem, move the PCI rescan-remove locking from
      hotplug_event_work() to hotplug_event() so that it is used regardless
      of the way that function is invoked.
      
      Revamps: 9217a984 (ACPI / hotplug / PCI: Use global PCI rescan-remove locking)
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Tested-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      f41b3261
    • R
      ACPI / hotplug / PCI: Remove entries from bus->devices in reverse order · 2d7c1b77
      Rafael J. Wysocki 提交于
      According to the changelog of commit 29ed1f29 (PCI: pciehp: Fix null
      pointer deref when hot-removing SR-IOV device) it is unsafe to walk the
      bus->devices list of a PCI bus and remove devices from it in direct order,
      because that may lead to NULL pointer dereferences related to virtual
      functions.
      
      For this reason, change all of the bus->devices list walks in
      acpiphp_glue.c during which devices may be removed to be carried out in
      reverse order.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Tested-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      2d7c1b77
  7. 02 2月, 2014 1 次提交
    • R
      Revert "PCI: Remove from bus_list and release resources in pci_release_dev()" · 04480094
      Rafael J. Wysocki 提交于
      Revert commit ef83b078 "PCI: Remove from bus_list and release
      resources in pci_release_dev()" that made some nasty race conditions
      become possible.  For example, if a Thunderbolt link is unplugged
      and then replugged immediately, the pci_release_dev() resulting from
      the hot-remove code path may be racing with the hot-add code path
      which after that commit causes various kinds of breakage to happen
      (up to and including a hard crash of the whole system).
      
      Moreover, the problem that commit ef83b078 attempted to address
      cannot happen any more after commit 8a4c5c32 "PCI: Check parent
      kobject in pci_destroy_dev()", because pci_destroy_dev() will now
      return immediately if it has already been executed for the given
      device.
      
      Note, however, that the invocation of msi_remove_pci_irq_vectors()
      removed by commit ef83b078 from pci_free_resources() along with
      the other changes made by it is not added back because of subsequent
      code changes depending on that modification.
      
      Fixes: ef83b078 (PCI: Remove from bus_list and release resources in pci_release_dev())
      Reported-by: NMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      04480094
  8. 16 1月, 2014 2 次提交
    • R
      PCI: Check parent kobject in pci_destroy_dev() · 8a4c5c32
      Rafael J. Wysocki 提交于
      If pci_stop_and_remove_bus_device() is run concurrently for a device and
      its parent bridge via remove_callback(), both code paths attempt to acquire
      pci_rescan_remove_lock.  If the child device removal acquires it first,
      there will be no problems.  However, if the parent bridge removal acquires
      it first, it will eventually execute pci_destroy_dev() for the child
      device, but that device object will not be freed yet due to the reference
      held by the concurrent child removal.  Consequently, both
      pci_stop_bus_device() and pci_remove_bus_device() will be executed for that
      device unnecessarily and pci_destroy_dev() will see a corrupted list head
      in that object.  Moreover, an excess put_device() will be executed for that
      device in that case which may lead to a use-after-free in the final
      kobject_put() done by sysfs_schedule_callback_work().
      
      To avoid that problem, make pci_destroy_dev() check if the device's parent
      kobject is NULL, which only happens after device_del() has already run for
      it.  Make pci_destroy_dev() return immediately whithout doing anything in
      that case.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      8a4c5c32
    • R
      xen/pcifront: Use global PCI rescan-remove locking · a83919e0
      Rafael J. Wysocki 提交于
      Multiple race conditions are possible between the Xen pcifront device
      addition and removal and the generic PCI device addition and removal that
      can be triggered via sysfs.
      
      To avoid those race conditions make the Xen pcifront code use global PCI
      rescan-remove locking.
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      a83919e0
  9. 15 1月, 2014 4 次提交
  10. 14 1月, 2014 8 次提交