summaryrefslogtreecommitdiffstats
path: root/hw
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix possible buffer overflowAnanth N Mavinakayanahalli2015-06-191-1/+2
| | | | | | | NULL terminate and truncate size of copy into char buffer to the right size. Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* hw/bt: Fix bt_msg_del lockingAlistair Popple2015-06-191-1/+5
| | | | | | | | | | bt_msg_del() calls ipmi_cmd_done() to free the message and process any error callbacks. However it should drop the lock prior to calling ipmi_cmd_done() as some error callbacks may try to queue ipmi messages leading to a dead lock. Signed-off-by: Alistair Popple <alistair@popple.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* Use destination buffer size as bound for strncpyAnanth N Mavinakayanahalli2015-06-191-1/+1
| | | | | | | | ... instead of potentially unbounded src buffer size Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* Fix potential NULL pointer dereferenceAnanth N Mavinakayanahalli2015-06-191-0/+2
| | | | | | | | Safety check... Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* Fix potential NULL pointer dereferenceAnanth N Mavinakayanahalli2015-06-191-0/+2
| | | | | | | Safety check... Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* hw/prd: Fix handling of invlid message typesJeremy Kerr2015-06-191-2/+4
| | | | | | | | | | | | | | If we get a prd_message_consumed callback from the opal_msg interface, and it has an invalid message type, then we'll end up returning with the events_lock held. This really shouldn't happen (as we have handlers for all message types that we queue), but we should still handle this gracefully. This change fixes the error path to log and error and send any further queued messages. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* Fix lockingAnanth N Mavinakayanahalli2015-06-191-4/+2
| | | | | | | | | Release lock before bailing out. Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> V2: Handle the 2nd instance of the same issue in the file. Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* Merge branch 'stable'Stewart Smith2015-06-182-7/+8
|\
| * ipmi/sel: Fix use after freeAlistair Popple2015-06-181-3/+3
| | | | | | | | | | | | | | The message was sometimes re-queued and always freed. Hilarity ensues. Signed-off-by: Alistair Popple <alistair@popple.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
| * hw/bt.c: Fix message response searchAlistair Popple2015-06-181-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bt_get_resp() uses the sequence number to locate the outstanding message by searching the queue with list_for_each(...). The check to see if a message was found in the queue is: if (!bt_msg || (bt_msg->seq != seq)) However this check is incorrect. list_for_each(...) does not set bt_msg to NULL at the end of the loop, nor does it set it to the last element in the list. Rather it ends up pointing at an offset from the list_head. Therefore bt_msg is never equal to NULL and the first half of this condition is always false. However the second condition is almost always true as sequence numbers are constantly increasing and unlikely to match whatever bt_msg->seq ends up pointing to, but in rare circumstances it is possible for bt_msg->seq to equal seq and hence the overall expression can evaluate to false. This leads to bt_msg being used as a valid message pointer even though it points to an incorrect address, typically causing a xstop due to an invalid address access when ipmi_cmd_done(...) attempts to call the callbacks. Signed-off-by: Alistair Popple <alistair@popple.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | hw/phb3: Fix crash in phb3_init_hw()Gavin Shan2015-06-161-5/+5
| | | | | | | | | | | | | | | | | | | | | | phb3_init_hw() is called to do PHB reset in order to recover from fenced PHB. During the time, we shouldn't try to add duplicated property "ibm,32-bit-bypass-supported", which causes crash. Reported-by: Chad Larson <clarson@vnet.ibm.com> Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com> Tested-by: Chad Larson <clarson@vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Fix surveillance lockingAnanth N Mavinakayanahalli2015-06-161-0/+2
| | | | | | | | | | | | | | | | There is one instance of fsp_surv_state that is accessed without the surveillance lock. Fix it. Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Remove unused p5ioc2_set_sm_timeout from p5ioc2-phb.cStewart Smith2015-06-111-13/+0
| | | | | | | | Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Fix possible return garbage from xscom_read_cfam_chipid()Stewart Smith2015-06-111-1/+2
| | | | | | | | | | | | | | | | | | If we get an error from the xscom_read() call we could extract a garbage chip_id rather than just returning an error. Caught by LLVM scan-build Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Merge branch 'stable'Stewart Smith2015-06-051-3/+3
|\ \ | |/
| * core/mem_region: Create reservations of type REGION_HW_RESERVEDJeremy Kerr2015-06-051-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All current users of mem_reserve are actually wanting HW_RESERVED memory; these reservations are for memory initialised pre-skiboot. This change marks these regions as REGION_HW_RESERVED instead of REGION_RESERVED. We also rename mem_reserve to mem_reserve_hw to reflect this change. This fixes an issue where the PRD daemon cannot find reserved ranges (eg, the homer image) that have been created by skiboot itself. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/EPOW: OPAL EPOW driver cleanupVipin K Parashar2015-06-012-160/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch performs below cleanup: * Removes processing for SPCN bits as SPCN events don't cause any EPOW * Removes code to do a panel status query again after receiving mbox panel status notification which already has EPOW info present. * Edits some debug prints and comments. * Removes extra header files included. Current OPAL EPOW driver would be parsing mbox panel status notifications for EPOW info and sending OPAL_MSG_EPOW notification once EPOW is detected. System on UPS power, abnormal ambient or internal temp EPOW conditions are covered by driver. Signed-off-by: Vipin K Parashar <vipin@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Merge PRD rework from stableStewart Smith2015-05-211-8/+46
|\ \ | |/
| * prd: Don't expose full opal_prd_msg to kernelJeremy Kerr2015-05-211-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | The kernel is only accessing part of struct opal_prd_msg, and doesn't need to know about the rest. This change moves the "internal" parts of opal_prd_msg to a separate header. In order for the kernel to pass full messages between userspace and firmware, it needs the total size of the struct. We put this in the header for the kernel to access. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
| * hw/prd: Expose prd ranges via device treeJeremy Kerr2015-05-211-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the prd reserved ranges are present in the reserved-ranges nodes in the device tree. While this works, it's difficult to filter the actual PRD ranges from general reserved memory. This change links the prd ranges into the /reserved-memory nodes, by adding ibm,prd-label properties to those used for PRD. This change adds a prd node to the ibm,opal node too, to giver kernel & userspace information about the prd infrastructure provided by OPAL. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Add a couple more missing Naples referencesBenjamin Herrenschmidt2015-05-132-1/+4
| | | | | | | | | | | | | | | | The i2c and SLW code are testing for P8 chips by chip type and missing Naples. Fix this. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | bt: Remove B_BUSY stateAlistair Popple2015-05-131-18/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bt layer used to cache the value of B_BUSY in the state machine, assuming that once B_BUSY was cleared by the BMC that it would never be set by the BMC again unless a message was sent to the bt interface. This was mostly true for the AMI firmware except when the BMC reboots which causes B_BUSY to be set. There may also be additional circumstances which set B_BUSY. Therefore the bt layer must check B_BUSY is clear before sending a message making the B_BUSY state superfluous. Signed-off-by: Alistair Popple <alistair@popple.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | occ: Send self-interrupt to chip with active PSIJoel Stanley2015-05-132-3/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were previously asking the OCC of the current chip to generate the self interrupt. If Hostboot does not configure all the PSI Host Bridges, so if the current chip happens to have an unconfigured PSI HB, the chip will never see the interrupt. Instead grab a chip id from the list of configured PSIs, and ask the OCC on that chip to generate the self-interrupt. This adds a pointer to the chip's PSI in struct proc_chip so we can use the current chip's PSI if it is active without having to look through all of them. Signed-off-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | ipmi/wdt: Stop calling synchronous message functions from timersAlistair Popple2015-05-121-9/+24
| | | | | | | | | | | | | | | | | | | | | | The current watchdog code calls ipmi_queue_msg_sync from a timer which leads to calling a opal_poll_events() recursively and consequently an abort(). This patch ensures we don't send synchronous messages from a timer. Signed-off-by: Alistair Popple <alistair@popple.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Fix infinite loop in wait_for_resource if CAPP ucode load failsStewart Smith2015-05-121-11/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | On failing to load CAPP microcode, we would call wait_for_resource_loaded for the next PHB but without issuing a new request, thus making wait_for_resource spin forever waiting for something that will never complete. Fix is to just track result of load. Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com> Acked-by: Alistair Popple <alistair@popple.id.au>
* | Add pr_fmt to do printf/prlog prefixing automagicallyStewart Smith2015-05-125-172/+127
| | | | | | | | Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | hw/bt: Add netfn to BT_ERR messageJeremy Kerr2015-05-111-2/+3
| | | | | | | | | | | | | | | | | | It's not too useful to print the command without the netfn, so add this into the BT_ERR macro. Reported by: Nick Bofferding <bofferdn@us.ibm.com> Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Preload VPD LID and set up fsp_lid_load() for async queued loadingStewart Smith2015-05-075-5/+42
| | | | | | | | | | | | | | | | This means VPD LID is already loaded before we start preloading kernel and initramfs LIDs, thus ensuring VPD doesn't have to wait for them to finish being read from FSP. Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Add global CPU job queueStewart Smith2015-05-072-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we have multiple systems trying to start concurrent jobs on different CPUs, they typically pick the first available (operating) CPU to schedule the job on. This works fine when there's only one set of jobs or when we want to bind jobs to specific CPUs. When we have jobs such as asynchronously loading LIDs and scanning PHBs, we don't care which CPUs they run on, we care more that they are not scheduled on CPUs that have existing tasks. This patch adds a global queue of jobs which secondary CPUs will look at for work (if idle). This leads to simplified callers, which just need to queue jobs to NULL (no specific CPU) and then call a magic function that will run the CPU job queue if we don't have secondary CPUs. Additionally, we add a const char *name to cpu_job just to aid with debugging. Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Asynchronously preload CAPP microcodeStewart Smith2015-05-071-60/+78
| | | | | | | | | | | | | | | | | | | | | | | | Instead of synchronously waiting for CAPP microcode during PCI probe, start preload of CAPP microcode early in boot so that it's present when we need it during PCI probing. On some platforms (astbmc), flash access is serialized, and prior to this patch, the async preload of BOOTKERNEL would have to finish before loading CAPP ucode would start, needlessly slowing boot. Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP LID loading: always remove from lid_loaded listStewart Smith2015-05-071-4/+2
| | | | | | | | Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Fix FSP resource/LID loading for preloading LIDs.Stewart Smith2015-05-071-5/+9
| | | | | | | | Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | eeh: Fix eeh event handlingAlistair Popple2015-05-072-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The opal eeh interrupt handlers raise an opal event (OPAL_EVENT_PCI_ERROR) whenever there is some processing required from the OS. The OS then needs to call opal_pci_next_error(...) in a loop passing each phb in turn to clear the event. However opal_pci_next_error(...) clears the event unconditionally meaning it would be possible for eeh events to be cleared without processing them leading to missed events. This patch fixes the problem by keeping track of eeh events on a per-phb basis and only clearing the opal event once all phb eeh events have been cleared. Signed-off-by: Alistair Popple <alistair@popple.id.au> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/ELOG: Remove TCE mapping for host bufferVasant Hegde2015-05-071-3/+0
| | | | | | | | | | | | | | | | elog_write_to_host_buffer is used to pass error log to host. Hence we don't need TCE mapping for this buffer. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/ELOG: Reduce elog write buffer sizeVasant Hegde2015-05-071-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Present we are allocating 64K for emergency and host buffer. But we just need 16K (which is the max elog size). Hence reduce the variable size to 16K. Similarly we are allocating 256K for normal fsp write error log path. (elog_write_to_fsp_buffer). But in reality we just need 16K. Hence reduce this size as well. Note that we have top level elog pool with 64 entries of 16K to hold multiple errors. So we are fine here. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/ELOG: Free error log buffer in error pathVasant Hegde2015-05-071-1/+5
| | | | | | | | | | | | | | Also pass MBOX return state instead of sending "true" always. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/ELOG: Do not reject elog in acknowledgement pathVasant Hegde2015-05-071-2/+0
| | | | | | | | | | | | | | | | Remove useless elog_reject_head call in acknowledgement path. We can ACK elog in any order. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/ELOG: Use elog REJECT state properlyVasant Hegde2015-05-071-2/+7
| | | | | | | | | | | | | | | | Presently we continue to read error log even though elog state is "REJECTED". This patch fixes this by rearraning code. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/ELOG: Reduce elog read buffer sizeVasant Hegde2015-05-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | Presently we are allocating 256K for elog read buffer. But we just read one log at a time. Also maximum size of ELOG is 16KB. Effectively we are not using remaining 240K. This patch reduces the size of the buffer to 16K. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Handle SA indicator update notificationVasant Hegde2015-05-071-0/+30
| | | | | | | | | | | | | | | | FSP sends SA indicator update notification via sys param update. Use that info to update cached indicator state. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/SYSPARAM: Introduce update notify system parameter notifierVasant Hegde2015-05-071-0/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | FSP sends update system parameter notification asynchronously. Presently no one is using this notification. We just ACK this notification. This patch adds notifier chain so that if someone (like LED) is interested in this notification, they can register and get notification. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Add system attention indicator supportVasant Hegde2015-05-071-1/+176
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SAI is controlled by FSP. This patch adds support to get/set this indicator. Also update OPAL interface so that playload can read/set this indicator. During init, we read this indicator state using MBOX command. OPAL uses MBOX interface to update this SAI. FSP sends update notification whenever there is change in SAI state (except for OPAL initiates updates). We use the notification to update cached SAI state. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Get SAI location code from device treeVasant Hegde2015-05-071-11/+59
| | | | | | | | | | | | | | | | SAI information is available in device tree. This patch parses device tree to get SAI location code information. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Use LED mode informationVasant Hegde2015-05-071-2/+15
| | | | | | | | | | | | | | | | | | | | Lets use the LED mode information populated by previous patch. We don't support fault indicator in 'Guiding Light' mode. So don't expose fault indicator to playload in Guiding Light mode. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Validate before creating led nodeVasant Hegde2015-05-071-3/+4
| | | | | | | | | | | | | | | | | | | | | | We get SAI indicator via HDAT. So we have to create led node while parsing HDAT itself. Lets get led node from device tree. Note that LED DT creation fails until next commit...which creates LED device tree node. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Define macro instead of hardcoding led typeVasant Hegde2015-05-071-5/+8
| | | | | | | | | | | | | | | | Define macors for LED related device tree property and its values. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | FSP/LED: Move led header file to include directoryVasant Hegde2015-05-072-155/+1
| | | | | | | | | | | | | | | | | | | | We want to refer leds header file in hdata. Hence move header file to include directory. No functionality changes. Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
* | Merge branch 'stable', skiboot-5.0.1Stewart Smith2015-05-014-20/+36
|\ \ | |/
| * Add xscom_ok() and lpc_ok() to check XSCOM and LPC usabilityBenjamin Herrenschmidt2015-05-014-2/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | his primarily checks whether the caller already holds the corresponding locks to avoid re-entrancy in some of the deep error path such as when XSCOM itself triggers an error log. It will be extended in the case of LPC to also handle known HW error states. We use them to avoid queuing/polling in the BT driver and to discard characters in the UART driver. Note: This will not normally involve a loss of log to the UART as the UART driver is also protected by the console suspend mechanism. So this is a safety mechanism only. This fixes issues where the generation of error logs inside the LPC or XSCOM drivers could cause a re-entrancy (via the BT interface) causing deadlocks. Now, the error logs IPMI messages will be queued up and delivered later on the next poll handler. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
| * xscom: Remove recursive lockingBenjamin Herrenschmidt2015-05-011-18/+6
| | | | | | | | | | | | | | Nothing should be using it nowadays and it's dangerous. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
OpenPOWER on IntegriCloud