1 files changed, 119 insertions, 30 deletions

diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 4a9e9de4d684..6b95a7581328 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -39,6 +39,7 @@
 #include <linux/rcupdate.h>
 #include <linux/ipmi.h>
 #include <linux/ipmi_smi.h>
+#include <linux/workqueue.h>
 #include "ipmi_si.h"
 #include "ipmi_si_sm.h"
 #include <linux/string.h>
@@ -168,6 +169,10 @@ struct smi_info {
 			     OEM2_DATA_AVAIL)
 	unsigned char       msg_flags;
 
+	/* When requesting events and messages, don't do it forever. */
+	unsigned int        num_requests_in_a_row;
+	bool		    last_was_flag_fetch;
+
 	/* Does the BMC have an event buffer? */
 	bool		    has_event_buffer;
 
@@ -248,6 +253,8 @@ struct smi_info {
 
 	struct task_struct *thread;
 
+	struct work_struct init_work;
+
 	struct list_head link;
 };
 
@@ -268,6 +275,7 @@ static bool unload_when_empty = true;
 static int try_smi_init(struct smi_info *smi);
 static void cleanup_one_si(struct smi_info *smi_info);
 static void cleanup_ipmi_si(void);
+static void smi_init_work_fn(struct work_struct *work);
 
 #ifdef DEBUG_TIMING
 void debug_timestamp(struct smi_info *smi_info, char *msg)
@@ -410,7 +418,10 @@ static void start_getting_msg_queue(struct smi_info *smi_info)
 
 	start_new_msg(smi_info, smi_info->curr_msg->data,
 		      smi_info->curr_msg->data_size);
-	smi_info->si_state = SI_GETTING_MESSAGES;
+	if (smi_info->si_state != SI_GETTING_MESSAGES) {
+		smi_info->num_requests_in_a_row = 0;
+		smi_info->si_state = SI_GETTING_MESSAGES;
+	}
 }
 
 static void start_getting_events(struct smi_info *smi_info)
@@ -421,7 +432,10 @@ static void start_getting_events(struct smi_info *smi_info)
 
 	start_new_msg(smi_info, smi_info->curr_msg->data,
 		      smi_info->curr_msg->data_size);
-	smi_info->si_state = SI_GETTING_EVENTS;
+	if (smi_info->si_state != SI_GETTING_EVENTS) {
+		smi_info->num_requests_in_a_row = 0;
+		smi_info->si_state = SI_GETTING_EVENTS;
+	}
 }
 
 /*
@@ -487,15 +501,19 @@ retry:
 	} else if (smi_info->msg_flags & RECEIVE_MSG_AVAIL) {
 		/* Messages available. */
 		smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
-		if (!smi_info->curr_msg)
+		if (!smi_info->curr_msg) {
+			smi_info->si_state = SI_NORMAL;
 			return;
+		}
 
 		start_getting_msg_queue(smi_info);
 	} else if (smi_info->msg_flags & EVENT_MSG_BUFFER_FULL) {
 		/* Events available. */
 		smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
-		if (!smi_info->curr_msg)
+		if (!smi_info->curr_msg) {
+			smi_info->si_state = SI_NORMAL;
 			return;
+		}
 
 		start_getting_events(smi_info);
 	} else if (smi_info->msg_flags & OEM_DATA_AVAIL &&
@@ -595,6 +613,7 @@ static void handle_transaction_done(struct smi_info *smi_info)
 			smi_info->si_state = SI_NORMAL;
 		} else {
 			smi_info->msg_flags = msg[3];
+			smi_info->last_was_flag_fetch = true;
 			handle_flags(smi_info);
 		}
 		break;
@@ -630,7 +649,13 @@ static void handle_transaction_done(struct smi_info *smi_info)
 		 */
 		msg = smi_info->curr_msg;
 		smi_info->curr_msg = NULL;
-		if (msg->rsp[2] != 0) {
+		/*
+		 * It appears some BMCs, with no event data, return no
+		 * data in the message and not a 0x80 error as the
+		 * spec says they should.  Shut down processing if
+		 * the data is not the right length.
+		 */
+		if (msg->rsp[2] != 0 || msg->rsp_size != 19) {
 			/* Error getting event, probably done. */
 			msg->done(msg);
 
@@ -640,6 +665,11 @@ static void handle_transaction_done(struct smi_info *smi_info)
 		} else {
 			smi_inc_stat(smi_info, events);
 
+			smi_info->num_requests_in_a_row++;
+			if (smi_info->num_requests_in_a_row > 10)
+				/* Stop if we do this too many times. */
+				smi_info->msg_flags &= ~EVENT_MSG_BUFFER_FULL;
+
 			/*
 			 * Do this before we deliver the message
 			 * because delivering the message releases the
@@ -678,6 +708,11 @@ static void handle_transaction_done(struct smi_info *smi_info)
 		} else {
 			smi_inc_stat(smi_info, incoming_messages);
 
+			smi_info->num_requests_in_a_row++;
+			if (smi_info->num_requests_in_a_row > 10)
+				/* Stop if we do this too many times. */
+				smi_info->msg_flags &= ~RECEIVE_MSG_AVAIL;
+
 			/*
 			 * Do this before we deliver the message
 			 * because delivering the message releases the
@@ -820,6 +855,26 @@ restart:
 	}
 
 	/*
+	 * If we are currently idle, or if the last thing that was
+	 * done was a flag fetch and there is a message pending, try
+	 * to start the next message.
+	 *
+	 * We do the waiting message check to avoid a stuck flag
+	 * completely wedging the driver.  Let a message through
+	 * in between flag operations if that happens.
+	 */
+	if (si_sm_result == SI_SM_IDLE ||
+	    (si_sm_result == SI_SM_ATTN && smi_info->waiting_msg &&
+	     smi_info->last_was_flag_fetch)) {
+		smi_info->last_was_flag_fetch = false;
+		smi_inc_stat(smi_info, idles);
+
+		si_sm_result = start_next_msg(smi_info);
+		if (si_sm_result != SI_SM_IDLE)
+			goto restart;
+	}
+
+	/*
 	 * We prefer handling attn over new messages.  But don't do
 	 * this if there is not yet an upper layer to handle anything.
 	 */
@@ -846,15 +901,6 @@ restart:
 		}
 	}
 
-	/* If we are currently idle, try to start the next message. */
-	if (si_sm_result == SI_SM_IDLE) {
-		smi_inc_stat(smi_info, idles);
-
-		si_sm_result = start_next_msg(smi_info);
-		if (si_sm_result != SI_SM_IDLE)
-			goto restart;
-	}
-
 	if ((si_sm_result == SI_SM_IDLE)
 	    && (atomic_read(&smi_info->req_events))) {
 		/*
@@ -1928,6 +1974,7 @@ int ipmi_si_add_smi(struct si_sm_io *io)
 	if (!new_smi)
 		return -ENOMEM;
 	spin_lock_init(&new_smi->si_lock);
+	INIT_WORK(&new_smi->init_work, smi_init_work_fn);
 
 	new_smi->io = *io;
 
@@ -1940,7 +1987,12 @@ int ipmi_si_add_smi(struct si_sm_io *io)
 			dev_info(dup->io.dev,
 				 "Removing SMBIOS-specified %s state machine in favor of ACPI\n",
 				 si_to_str[new_smi->io.si_info->type]);
+			list_del(&dup->link);
+			mutex_unlock(&smi_infos_lock);
+
 			cleanup_one_si(dup);
+
+			mutex_lock(&smi_infos_lock);
 		} else {
 			dev_info(new_smi->io.dev,
 				 "%s-specified %s state machine: duplicate\n",
@@ -1958,8 +2010,12 @@ int ipmi_si_add_smi(struct si_sm_io *io)
 
 	list_add_tail(&new_smi->link, &smi_infos);
 
-	if (initialized)
-		rv = try_smi_init(new_smi);
+	if (initialized) {
+		if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
+			queue_work(system_dfl_wq, &new_smi->init_work);
+		else
+			rv = try_smi_init(new_smi);
+	}
 out_err:
 	mutex_unlock(&smi_infos_lock);
 	return rv;
@@ -2132,6 +2188,15 @@ static bool __init ipmi_smi_info_same(struct smi_info *e1, struct smi_info *e2)
 		e1->io.addr_data == e2->io.addr_data);
 }
 
+static void smi_init_work_fn(struct work_struct *work)
+{
+	struct smi_info *smi = container_of(work, struct smi_info, init_work);
+
+	mutex_lock(&smi_infos_lock);
+	try_smi_init(smi);
+	mutex_unlock(&smi_infos_lock);
+}
+
 static int __init init_ipmi_si(void)
 {
 	struct smi_info *e, *e2;
@@ -2177,8 +2242,12 @@ static int __init init_ipmi_si(void)
 				break;
 			}
 		}
-		if (!dup)
-			try_smi_init(e);
+		if (!dup) {
+			if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
+				queue_work(system_unbound_wq, &e->init_work);
+			else
+				try_smi_init(e);
+		}
 	}
 
 	/*
@@ -2211,8 +2280,12 @@ static int __init init_ipmi_si(void)
 				break;
 			}
 		}
-		if (!dup)
-			try_smi_init(e);
+		if (!dup) {
+			if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
+				queue_work(system_unbound_wq, &e->init_work);
+			else
+				try_smi_init(e);
+		}
 	}
 
 	initialized = true;
@@ -2302,31 +2375,36 @@ static void shutdown_smi(void *send_info)
 }
 
 /*
- * Must be called with smi_infos_lock held, to serialize the
- * smi_info->intf check.
+ * Must be called with smi_info unlinked from smi_infos and smi_infos_lock released.
  */
 static void cleanup_one_si(struct smi_info *smi_info)
 {
 	if (!smi_info)
 		return;
 
-	list_del(&smi_info->link);
+	if (IS_ENABLED(CONFIG_IPMI_SI_ASYNC_INIT))
+		cancel_work_sync(&smi_info->init_work);
+
 	ipmi_unregister_smi(smi_info->intf);
 	kfree(smi_info);
 }
 
 void ipmi_si_remove_by_dev(struct device *dev)
 {
-	struct smi_info *e;
+	struct smi_info *e = NULL, *tmp;
 
 	mutex_lock(&smi_infos_lock);
-	list_for_each_entry(e, &smi_infos, link) {
-		if (e->io.dev == dev) {
-			cleanup_one_si(e);
+	list_for_each_entry(tmp, &smi_infos, link) {
+		if (tmp->io.dev == dev) {
+			e = tmp;
+			list_del(&e->link);
 			break;
 		}
 	}
 	mutex_unlock(&smi_infos_lock);
+
+	if (e)
+		cleanup_one_si(e);
 }
 
 struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type,
@@ -2335,6 +2413,7 @@ struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type,
 	/* remove */
 	struct smi_info *e, *tmp_e;
 	struct device *dev = NULL;
+	LIST_HEAD(to_clean);
 
 	mutex_lock(&smi_infos_lock);
 	list_for_each_entry_safe(e, tmp_e, &smi_infos, link) {
@@ -2344,17 +2423,23 @@ struct device *ipmi_si_remove_by_data(int addr_space, enum si_type si_type,
 			continue;
 		if (e->io.addr_data == addr) {
 			dev = get_device(e->io.dev);
-			cleanup_one_si(e);
+			list_move_tail(&e->link, &to_clean);
 		}
 	}
 	mutex_unlock(&smi_infos_lock);
 
+	list_for_each_entry_safe(e, tmp_e, &to_clean, link) {
+		list_del(&e->link);
+		cleanup_one_si(e);
+	}
+
 	return dev;
 }
 
 static void cleanup_ipmi_si(void)
 {
 	struct smi_info *e, *tmp_e;
+	LIST_HEAD(to_clean);
 
 	if (!initialized)
 		return;
@@ -2368,10 +2453,14 @@ static void cleanup_ipmi_si(void)
 	ipmi_si_platform_shutdown();
 
 	mutex_lock(&smi_infos_lock);
-	list_for_each_entry_safe(e, tmp_e, &smi_infos, link)
-		cleanup_one_si(e);
+	list_splice_init(&smi_infos, &to_clean);
 	mutex_unlock(&smi_infos_lock);
 
+	list_for_each_entry_safe(e, tmp_e, &to_clean, link) {
+		list_del(&e->link);
+		cleanup_one_si(e);
+	}
+
 	ipmi_si_hardcode_exit();
 	ipmi_si_hotmod_exit();
 }