5516e21a1e
Currently a crash can be seen if we reach the "err" label in dmi_add_platform_ipmi(), calling platform_device_put(), like here: [ 7.270584] (null): ipmi:dmi: Unable to add resources: -16 [ 7.330229] ------------[ cut here ]------------ [ 7.334889] kernel BUG at mm/slub.c:3894! [ 7.338936] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 7.344475] Modules linked in: [ 7.347556] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-00004-gbe9cb7b-dirty #114 [ 7.355907] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT17 Nemo 2.0 RC0 11/29/2017 [ 7.365137] task: 00000000c211f6d3 task.stack: 00000000f276e9af [ 7.371116] pstate: 60000005 (nZCv daif -PAN -UAO) [ 7.375957] pc : kfree+0x194/0x1b4 [ 7.379389] lr : platform_device_release+0xcc/0xd8 [ 7.384225] sp : ffff0000092dba90 [ 7.387567] x29: ffff0000092dba90 x28: ffff000008a83000 [ 7.392933] x27: ffff0000092dbc10 x26: 00000000000000e6 [ 7.398297] x25: 0000000000000003 x24: ffff0000085b51e8 [ 7.403662] x23: 0000000000000100 x22: ffff7e0000234cc0 [ 7.409027] x21: ffff000008af3660 x20: ffff8017d21acc10 [ 7.414392] x19: ffff8017d21acc00 x18: 0000000000000002 [ 7.419757] x17: 0000000000000001 x16: 0000000000000008 [ 7.425121] x15: 0000000000000001 x14: 6666666678303d65 [ 7.430486] x13: 6469727265766f5f x12: 7265766972642e76 [ 7.435850] x11: 6564703e2d617020 x10: 6530326435373638 [ 7.441215] x9 : 3030303030303030 x8 : 3d76656420657361 [ 7.446580] x7 : ffff000008f59df8 x6 : ffff8017fbe0ea50 [ 7.451945] x5 : 0000000000000000 x4 : 0000000000000000 [ 7.457309] x3 : ffffffffffffffff x2 : 0000000000000000 [ 7.462674] x1 : 0fffc00000000800 x0 : ffff7e0000234ce0 [ 7.468039] Process swapper/0 (pid: 1, stack limit = 0x00000000f276e9af) [ 7.474809] Call trace: [ 7.477272] kfree+0x194/0x1b4 [ 7.480351] platform_device_release+0xcc/0xd8 [ 7.484837] device_release+0x34/0x90 [ 7.488531] kobject_put+0x70/0xcc [ 7.491961] put_device+0x14/0x1c [ 7.495304] platform_device_put+0x14/0x1c [ 7.499439] dmi_add_platform_ipmi+0x348/0x3ac [ 7.503923] scan_for_dmi_ipmi+0xfc/0x10c [ 7.507970] do_one_initcall+0x38/0x124 [ 7.511840] kernel_init_freeable+0x188/0x228 [ 7.516238] kernel_init+0x10/0x100 [ 7.519756] ret_from_fork+0x10/0x18 [ 7.523362] Code: f94002c0 37780080 f94012c0 37000040 (d4210000) [ 7.529552] ---[ end trace 11750e4787deef9e ]--- [ 7.534228] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 7.534228] This is because when the device is released in platform_device_release(), we try to free pdev.driver_override. This is a const string, hence the crash. Fix by using dynamic memory for pdev->driver_override. Signed-off-by: John Garry <john.garry@huawei.com> [Removed the free of driver_override from ipmi_si_remove_by_dev(). The free is done in platform_device_release(), and would result in a double free, and ipmi_si_remove_by_dev() is called by non-platform devices.] Signed-off-by: Corey Minyard <cminyard@mvista.com> Cc: <stable@vger.kernel.org> # 4.14+
306 lines
6.9 KiB
C
306 lines
6.9 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* A hack to create a platform device from a DMI entry. This will
|
|
* allow autoloading of the IPMI drive based on SMBIOS entries.
|
|
*/
|
|
|
|
#include <linux/ipmi.h>
|
|
#include <linux/init.h>
|
|
#include <linux/dmi.h>
|
|
#include <linux/platform_device.h>
|
|
#include <linux/property.h>
|
|
#include "ipmi_si_sm.h"
|
|
#include "ipmi_dmi.h"
|
|
|
|
#define IPMI_DMI_TYPE_KCS 0x01
|
|
#define IPMI_DMI_TYPE_SMIC 0x02
|
|
#define IPMI_DMI_TYPE_BT 0x03
|
|
#define IPMI_DMI_TYPE_SSIF 0x04
|
|
|
|
struct ipmi_dmi_info {
|
|
enum si_type si_type;
|
|
u32 flags;
|
|
unsigned long addr;
|
|
u8 slave_addr;
|
|
struct ipmi_dmi_info *next;
|
|
};
|
|
|
|
static struct ipmi_dmi_info *ipmi_dmi_infos;
|
|
|
|
static int ipmi_dmi_nr __initdata;
|
|
|
|
#define set_prop_entry(_p_, _name_, type, val) \
|
|
do { \
|
|
struct property_entry *_p = &_p_; \
|
|
_p->name = _name_; \
|
|
_p->length = sizeof(type); \
|
|
_p->is_string = false; \
|
|
_p->value.type##_data = val; \
|
|
} while(0)
|
|
|
|
static void __init dmi_add_platform_ipmi(unsigned long base_addr,
|
|
u32 flags,
|
|
u8 slave_addr,
|
|
int irq,
|
|
int offset,
|
|
int type)
|
|
{
|
|
struct platform_device *pdev;
|
|
struct resource r[4];
|
|
unsigned int num_r = 1, size;
|
|
struct property_entry p[5];
|
|
unsigned int pidx = 0;
|
|
char *name, *override;
|
|
int rv;
|
|
enum si_type si_type;
|
|
struct ipmi_dmi_info *info;
|
|
|
|
memset(p, 0, sizeof(p));
|
|
|
|
name = "dmi-ipmi-si";
|
|
override = "ipmi_si";
|
|
switch (type) {
|
|
case IPMI_DMI_TYPE_SSIF:
|
|
name = "dmi-ipmi-ssif";
|
|
override = "ipmi_ssif";
|
|
offset = 1;
|
|
size = 1;
|
|
si_type = SI_TYPE_INVALID;
|
|
break;
|
|
case IPMI_DMI_TYPE_BT:
|
|
size = 3;
|
|
si_type = SI_BT;
|
|
break;
|
|
case IPMI_DMI_TYPE_KCS:
|
|
size = 2;
|
|
si_type = SI_KCS;
|
|
break;
|
|
case IPMI_DMI_TYPE_SMIC:
|
|
size = 2;
|
|
si_type = SI_SMIC;
|
|
break;
|
|
default:
|
|
pr_err("ipmi:dmi: Invalid IPMI type: %d\n", type);
|
|
return;
|
|
}
|
|
|
|
if (si_type != SI_TYPE_INVALID)
|
|
set_prop_entry(p[pidx++], "ipmi-type", u8, si_type);
|
|
set_prop_entry(p[pidx++], "slave-addr", u8, slave_addr);
|
|
set_prop_entry(p[pidx++], "addr-source", u8, SI_SMBIOS);
|
|
|
|
info = kmalloc(sizeof(*info), GFP_KERNEL);
|
|
if (!info) {
|
|
pr_warn("ipmi:dmi: Could not allocate dmi info\n");
|
|
} else {
|
|
info->si_type = si_type;
|
|
info->flags = flags;
|
|
info->addr = base_addr;
|
|
info->slave_addr = slave_addr;
|
|
info->next = ipmi_dmi_infos;
|
|
ipmi_dmi_infos = info;
|
|
}
|
|
|
|
pdev = platform_device_alloc(name, ipmi_dmi_nr);
|
|
if (!pdev) {
|
|
pr_err("ipmi:dmi: Error allocation IPMI platform device\n");
|
|
return;
|
|
}
|
|
pdev->driver_override = kasprintf(GFP_KERNEL, "%s",
|
|
override);
|
|
if (!pdev->driver_override)
|
|
goto err;
|
|
|
|
if (type == IPMI_DMI_TYPE_SSIF) {
|
|
set_prop_entry(p[pidx++], "i2c-addr", u16, base_addr);
|
|
goto add_properties;
|
|
}
|
|
|
|
memset(r, 0, sizeof(r));
|
|
|
|
r[0].start = base_addr;
|
|
r[0].end = r[0].start + offset - 1;
|
|
r[0].name = "IPMI Address 1";
|
|
r[0].flags = flags;
|
|
|
|
if (size > 1) {
|
|
r[1].start = r[0].start + offset;
|
|
r[1].end = r[1].start + offset - 1;
|
|
r[1].name = "IPMI Address 2";
|
|
r[1].flags = flags;
|
|
num_r++;
|
|
}
|
|
|
|
if (size > 2) {
|
|
r[2].start = r[1].start + offset;
|
|
r[2].end = r[2].start + offset - 1;
|
|
r[2].name = "IPMI Address 3";
|
|
r[2].flags = flags;
|
|
num_r++;
|
|
}
|
|
|
|
if (irq) {
|
|
r[num_r].start = irq;
|
|
r[num_r].end = irq;
|
|
r[num_r].name = "IPMI IRQ";
|
|
r[num_r].flags = IORESOURCE_IRQ;
|
|
num_r++;
|
|
}
|
|
|
|
rv = platform_device_add_resources(pdev, r, num_r);
|
|
if (rv) {
|
|
dev_err(&pdev->dev,
|
|
"ipmi:dmi: Unable to add resources: %d\n", rv);
|
|
goto err;
|
|
}
|
|
|
|
add_properties:
|
|
rv = platform_device_add_properties(pdev, p);
|
|
if (rv) {
|
|
dev_err(&pdev->dev,
|
|
"ipmi:dmi: Unable to add properties: %d\n", rv);
|
|
goto err;
|
|
}
|
|
|
|
rv = platform_device_add(pdev);
|
|
if (rv) {
|
|
dev_err(&pdev->dev, "ipmi:dmi: Unable to add device: %d\n", rv);
|
|
goto err;
|
|
}
|
|
|
|
ipmi_dmi_nr++;
|
|
return;
|
|
|
|
err:
|
|
platform_device_put(pdev);
|
|
}
|
|
|
|
/*
|
|
* Look up the slave address for a given interface. This is here
|
|
* because ACPI doesn't have a slave address while SMBIOS does, but we
|
|
* prefer using ACPI so the ACPI code can use the IPMI namespace.
|
|
* This function allows an ACPI-specified IPMI device to look up the
|
|
* slave address from the DMI table.
|
|
*/
|
|
int ipmi_dmi_get_slave_addr(enum si_type si_type, u32 flags,
|
|
unsigned long base_addr)
|
|
{
|
|
struct ipmi_dmi_info *info = ipmi_dmi_infos;
|
|
|
|
while (info) {
|
|
if (info->si_type == si_type &&
|
|
info->flags == flags &&
|
|
info->addr == base_addr)
|
|
return info->slave_addr;
|
|
info = info->next;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL(ipmi_dmi_get_slave_addr);
|
|
|
|
#define DMI_IPMI_MIN_LENGTH 0x10
|
|
#define DMI_IPMI_VER2_LENGTH 0x12
|
|
#define DMI_IPMI_TYPE 4
|
|
#define DMI_IPMI_SLAVEADDR 6
|
|
#define DMI_IPMI_ADDR 8
|
|
#define DMI_IPMI_ACCESS 0x10
|
|
#define DMI_IPMI_IRQ 0x11
|
|
#define DMI_IPMI_IO_MASK 0xfffe
|
|
|
|
static void __init dmi_decode_ipmi(const struct dmi_header *dm)
|
|
{
|
|
const u8 *data = (const u8 *) dm;
|
|
u32 flags = IORESOURCE_IO;
|
|
unsigned long base_addr;
|
|
u8 len = dm->length;
|
|
u8 slave_addr;
|
|
int irq = 0, offset;
|
|
int type;
|
|
|
|
if (len < DMI_IPMI_MIN_LENGTH)
|
|
return;
|
|
|
|
type = data[DMI_IPMI_TYPE];
|
|
slave_addr = data[DMI_IPMI_SLAVEADDR];
|
|
|
|
memcpy(&base_addr, data + DMI_IPMI_ADDR, sizeof(unsigned long));
|
|
if (len >= DMI_IPMI_VER2_LENGTH) {
|
|
if (type == IPMI_DMI_TYPE_SSIF) {
|
|
offset = 0;
|
|
flags = 0;
|
|
base_addr = data[DMI_IPMI_ADDR] >> 1;
|
|
if (base_addr == 0) {
|
|
/*
|
|
* Some broken systems put the I2C address in
|
|
* the slave address field. We try to
|
|
* accommodate them here.
|
|
*/
|
|
base_addr = data[DMI_IPMI_SLAVEADDR] >> 1;
|
|
slave_addr = 0;
|
|
}
|
|
} else {
|
|
if (base_addr & 1) {
|
|
/* I/O */
|
|
base_addr &= DMI_IPMI_IO_MASK;
|
|
} else {
|
|
/* Memory */
|
|
flags = IORESOURCE_MEM;
|
|
}
|
|
|
|
/*
|
|
* If bit 4 of byte 0x10 is set, then the lsb
|
|
* for the address is odd.
|
|
*/
|
|
base_addr |= (data[DMI_IPMI_ACCESS] >> 4) & 1;
|
|
|
|
irq = data[DMI_IPMI_IRQ];
|
|
|
|
/*
|
|
* The top two bits of byte 0x10 hold the
|
|
* register spacing.
|
|
*/
|
|
switch ((data[DMI_IPMI_ACCESS] >> 6) & 3) {
|
|
case 0: /* Byte boundaries */
|
|
offset = 1;
|
|
break;
|
|
case 1: /* 32-bit boundaries */
|
|
offset = 4;
|
|
break;
|
|
case 2: /* 16-byte boundaries */
|
|
offset = 16;
|
|
break;
|
|
default:
|
|
pr_err("ipmi:dmi: Invalid offset: 0\n");
|
|
return;
|
|
}
|
|
}
|
|
} else {
|
|
/* Old DMI spec. */
|
|
/*
|
|
* Note that technically, the lower bit of the base
|
|
* address should be 1 if the address is I/O and 0 if
|
|
* the address is in memory. So many systems get that
|
|
* wrong (and all that I have seen are I/O) so we just
|
|
* ignore that bit and assume I/O. Systems that use
|
|
* memory should use the newer spec, anyway.
|
|
*/
|
|
base_addr = base_addr & DMI_IPMI_IO_MASK;
|
|
offset = 1;
|
|
}
|
|
|
|
dmi_add_platform_ipmi(base_addr, flags, slave_addr, irq,
|
|
offset, type);
|
|
}
|
|
|
|
static int __init scan_for_dmi_ipmi(void)
|
|
{
|
|
const struct dmi_device *dev = NULL;
|
|
|
|
while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))
|
|
dmi_decode_ipmi((const struct dmi_header *) dev->device_data);
|
|
|
|
return 0;
|
|
}
|
|
subsys_initcall(scan_for_dmi_ipmi);
|