mirror of
https://github.com/torvalds/linux.git
synced 2024-11-11 22:51:42 +00:00
29ed1f29b6
Hot-removing a device with SR-IOV enabled causes a null pointer dereference in v3.9 and v3.10. This is a regression caused byba518e3c17("PCI: pciehp: Iterate over all devices in slot, not functions 0-7"). When we iterate over the bus->devices list, we first remove the PF, which also removes all the VFs from the list. Then the list iterator blows up because more than just the current entry was removed from the list.ac205b7bb7("PCI: make sriov work with hotplug remove") works around a similar problem in pci_stop_bus_devices() by iterating over the list in reverse, so the VFs are stopped and removed from the list first, before the PF. This patch changes pciehp_unconfigure_device() to iterate over the list in reverse, too. [bhelgaas: bugzilla, changelog] Reference: https://bugzilla.kernel.org/show_bug.cgi?id=60604 Signed-off-by: Yinghai Lu <yinghai@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Yijing Wang <wangyijing@huawei.com> CC: stable@vger.kernel.org # v3.9+
131 lines
3.7 KiB
C
131 lines
3.7 KiB
C
/*
|
|
* PCI Express Hot Plug Controller Driver
|
|
*
|
|
* Copyright (C) 1995,2001 Compaq Computer Corporation
|
|
* Copyright (C) 2001 Greg Kroah-Hartman (greg@kroah.com)
|
|
* Copyright (C) 2001 IBM Corp.
|
|
* Copyright (C) 2003-2004 Intel Corporation
|
|
*
|
|
* All rights reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or (at
|
|
* your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
|
|
* NON INFRINGEMENT. See the GNU General Public License for more
|
|
* details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
*
|
|
* Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
|
|
*
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/types.h>
|
|
#include <linux/pci.h>
|
|
#include "../pci.h"
|
|
#include "pciehp.h"
|
|
|
|
int pciehp_configure_device(struct slot *p_slot)
|
|
{
|
|
struct pci_dev *dev;
|
|
struct pci_dev *bridge = p_slot->ctrl->pcie->port;
|
|
struct pci_bus *parent = bridge->subordinate;
|
|
int num;
|
|
struct controller *ctrl = p_slot->ctrl;
|
|
|
|
dev = pci_get_slot(parent, PCI_DEVFN(0, 0));
|
|
if (dev) {
|
|
ctrl_err(ctrl, "Device %s already exists "
|
|
"at %04x:%02x:00, cannot hot-add\n", pci_name(dev),
|
|
pci_domain_nr(parent), parent->number);
|
|
pci_dev_put(dev);
|
|
return -EINVAL;
|
|
}
|
|
|
|
num = pci_scan_slot(parent, PCI_DEVFN(0, 0));
|
|
if (num == 0) {
|
|
ctrl_err(ctrl, "No new device found\n");
|
|
return -ENODEV;
|
|
}
|
|
|
|
list_for_each_entry(dev, &parent->devices, bus_list)
|
|
if ((dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) ||
|
|
(dev->hdr_type == PCI_HEADER_TYPE_CARDBUS))
|
|
pci_hp_add_bridge(dev);
|
|
|
|
pci_assign_unassigned_bridge_resources(bridge);
|
|
|
|
list_for_each_entry(dev, &parent->devices, bus_list) {
|
|
if ((dev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
|
|
continue;
|
|
|
|
pci_configure_slot(dev);
|
|
}
|
|
|
|
pci_bus_add_devices(parent);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int pciehp_unconfigure_device(struct slot *p_slot)
|
|
{
|
|
int ret, rc = 0;
|
|
u8 bctl = 0;
|
|
u8 presence = 0;
|
|
struct pci_dev *dev, *temp;
|
|
struct pci_bus *parent = p_slot->ctrl->pcie->port->subordinate;
|
|
u16 command;
|
|
struct controller *ctrl = p_slot->ctrl;
|
|
|
|
ctrl_dbg(ctrl, "%s: domain:bus:dev = %04x:%02x:00\n",
|
|
__func__, pci_domain_nr(parent), parent->number);
|
|
ret = pciehp_get_adapter_status(p_slot, &presence);
|
|
if (ret)
|
|
presence = 0;
|
|
|
|
/*
|
|
* Stopping an SR-IOV PF device removes all the associated VFs,
|
|
* which will update the bus->devices list and confuse the
|
|
* iterator. Therefore, iterate in reverse so we remove the VFs
|
|
* first, then the PF. We do the same in pci_stop_bus_device().
|
|
*/
|
|
list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
|
|
bus_list) {
|
|
pci_dev_get(dev);
|
|
if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE && presence) {
|
|
pci_read_config_byte(dev, PCI_BRIDGE_CONTROL, &bctl);
|
|
if (bctl & PCI_BRIDGE_CTL_VGA) {
|
|
ctrl_err(ctrl,
|
|
"Cannot remove display device %s\n",
|
|
pci_name(dev));
|
|
pci_dev_put(dev);
|
|
rc = -EINVAL;
|
|
break;
|
|
}
|
|
}
|
|
pci_stop_and_remove_bus_device(dev);
|
|
/*
|
|
* Ensure that no new Requests will be generated from
|
|
* the device.
|
|
*/
|
|
if (presence) {
|
|
pci_read_config_word(dev, PCI_COMMAND, &command);
|
|
command &= ~(PCI_COMMAND_MASTER | PCI_COMMAND_SERR);
|
|
command |= PCI_COMMAND_INTX_DISABLE;
|
|
pci_write_config_word(dev, PCI_COMMAND, command);
|
|
}
|
|
pci_dev_put(dev);
|
|
}
|
|
|
|
return rc;
|
|
}
|