]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/pci/hotplug/pciehp_core.c
PCI: pciehp: Fix use-after-free on unplug
[mirror_ubuntu-bionic-kernel.git] / drivers / pci / hotplug / pciehp_core.c
CommitLineData
1da177e4
LT
1/*
2 * PCI Express Hot Plug Controller Driver
3 *
4 * Copyright (C) 1995,2001 Compaq Computer Corporation
5 * Copyright (C) 2001 Greg Kroah-Hartman (greg@kroah.com)
6 * Copyright (C) 2001 IBM Corp.
7 * Copyright (C) 2003-2004 Intel Corporation
8 *
9 * All rights reserved.
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or (at
14 * your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful, but
17 * WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
19 * NON INFRINGEMENT. See the GNU General Public License for more
20 * details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 *
8cf4c195 26 * Send feedback to <greg@kroah.com>, <kristen.c.accardi@intel.com>
1da177e4 27 *
5fbeef63
BH
28 * Authors:
29 * Dan Zink <dan.zink@compaq.com>
30 * Greg Kroah-Hartman <greg@kroah.com>
31 * Dely Sy <dely.l.sy@intel.com>"
1da177e4
LT
32 */
33
1da177e4
LT
34#include <linux/moduleparam.h>
35#include <linux/kernel.h>
5a0e3ad6 36#include <linux/slab.h>
1da177e4 37#include <linux/types.h>
1da177e4 38#include <linux/pci.h>
1da177e4 39#include "pciehp.h"
1da177e4 40#include <linux/interrupt.h>
34d03419 41#include <linux/time.h>
1da177e4
LT
42
43/* Global variables */
90ab5ee9
RR
44bool pciehp_debug;
45bool pciehp_poll_mode;
1da177e4 46int pciehp_poll_time;
0b950f0f 47static bool pciehp_force;
1da177e4 48
70626d88
PG
49/*
50 * not really modular, but the easiest way to keep compat with existing
51 * bootargs behaviour is to continue using module_param here.
52 */
1da177e4
LT
53module_param(pciehp_debug, bool, 0644);
54module_param(pciehp_poll_mode, bool, 0644);
55module_param(pciehp_poll_time, int, 0644);
a3a45ec8 56module_param(pciehp_force, bool, 0644);
1da177e4
LT
57MODULE_PARM_DESC(pciehp_debug, "Debugging mode enabled or not");
58MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
59MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");
28eb5f27 60MODULE_PARM_DESC(pciehp_force, "Force pciehp, even if OSHP is missing");
1da177e4
LT
61
62#define PCIE_MODULE_NAME "pciehp"
63
ff3ce480
BS
64static int set_attention_status(struct hotplug_slot *slot, u8 value);
65static int enable_slot(struct hotplug_slot *slot);
66static int disable_slot(struct hotplug_slot *slot);
67static int get_power_status(struct hotplug_slot *slot, u8 *value);
68static int get_attention_status(struct hotplug_slot *slot, u8 *value);
69static int get_latch_status(struct hotplug_slot *slot, u8 *value);
70static int get_adapter_status(struct hotplug_slot *slot, u8 *value);
71static int reset_slot(struct hotplug_slot *slot, int probe);
1da177e4 72
b308240b
DS
73/**
74 * release_slot - free up the memory used by a slot
75 * @hotplug_slot: slot to free
76 */
77static void release_slot(struct hotplug_slot *hotplug_slot)
78{
270a1039
LW
79 struct slot *slot = hotplug_slot->private;
80
81 /* queued work needs hotplug_slot name */
82 cancel_delayed_work(&slot->work);
83 drain_workqueue(slot->wq);
84
586f1d66 85 kfree(hotplug_slot->ops);
c4635eb0
KK
86 kfree(hotplug_slot->info);
87 kfree(hotplug_slot);
a0b17257
KK
88}
89
8720d27d 90static int init_slot(struct controller *ctrl)
1da177e4 91{
8720d27d
KK
92 struct slot *slot = ctrl->slot;
93 struct hotplug_slot *hotplug = NULL;
94 struct hotplug_slot_info *info = NULL;
586f1d66 95 struct hotplug_slot_ops *ops = NULL;
e1acb24f 96 char name[SLOT_NAME_SIZE];
a0b17257 97 int retval = -ENOMEM;
1da177e4 98
8720d27d
KK
99 hotplug = kzalloc(sizeof(*hotplug), GFP_KERNEL);
100 if (!hotplug)
101 goto out;
102
103 info = kzalloc(sizeof(*info), GFP_KERNEL);
104 if (!info)
105 goto out;
106
586f1d66
KK
107 /* Setup hotplug slot ops */
108 ops = kzalloc(sizeof(*ops), GFP_KERNEL);
109 if (!ops)
110 goto out;
9cad7f58 111
586f1d66
KK
112 ops->enable_slot = enable_slot;
113 ops->disable_slot = disable_slot;
114 ops->get_power_status = get_power_status;
115 ops->get_adapter_status = get_adapter_status;
2e35afae 116 ops->reset_slot = reset_slot;
586f1d66
KK
117 if (MRL_SENS(ctrl))
118 ops->get_latch_status = get_latch_status;
119 if (ATTN_LED(ctrl)) {
120 ops->get_attention_status = get_attention_status;
121 ops->set_attention_status = set_attention_status;
576243b3
KB
122 } else if (ctrl->pcie->port->hotplug_user_indicators) {
123 ops->get_attention_status = pciehp_get_raw_indicator_status;
124 ops->set_attention_status = pciehp_set_raw_indicator_status;
586f1d66
KK
125 }
126
8720d27d
KK
127 /* register this slot with the hotplug pci core */
128 hotplug->info = info;
129 hotplug->private = slot;
130 hotplug->release = &release_slot;
586f1d66 131 hotplug->ops = ops;
8720d27d 132 slot->hotplug_slot = hotplug;
07a09694 133 snprintf(name, SLOT_NAME_SIZE, "%u", PSN(ctrl));
8720d27d 134
8720d27d 135 retval = pci_hp_register(hotplug,
385e2491 136 ctrl->pcie->port->subordinate, 0, name);
445f7985 137 if (retval)
3784e0c6 138 ctrl_err(ctrl, "pci_hp_register failed: error %d\n", retval);
8720d27d
KK
139out:
140 if (retval) {
586f1d66 141 kfree(ops);
8720d27d
KK
142 kfree(info);
143 kfree(hotplug);
1da177e4 144 }
a0b17257 145 return retval;
1da177e4
LT
146}
147
8720d27d 148static void cleanup_slot(struct controller *ctrl)
1da177e4 149{
8720d27d 150 pci_hp_deregister(ctrl->slot->hotplug_slot);
1da177e4
LT
151}
152
1da177e4
LT
153/*
154 * set_attention_status - Turns the Amber LED for a slot on, off or blink
155 */
156static int set_attention_status(struct hotplug_slot *hotplug_slot, u8 status)
157{
158 struct slot *slot = hotplug_slot->private;
159
6dae6202
BH
160 pciehp_set_attention_status(slot, status);
161 return 0;
1da177e4
LT
162}
163
164
165static int enable_slot(struct hotplug_slot *hotplug_slot)
166{
167 struct slot *slot = hotplug_slot->private;
168
5d386e1a 169 return pciehp_sysfs_enable_slot(slot);
1da177e4
LT
170}
171
172
173static int disable_slot(struct hotplug_slot *hotplug_slot)
174{
175 struct slot *slot = hotplug_slot->private;
176
5d386e1a 177 return pciehp_sysfs_disable_slot(slot);
1da177e4
LT
178}
179
180static int get_power_status(struct hotplug_slot *hotplug_slot, u8 *value)
181{
182 struct slot *slot = hotplug_slot->private;
1da177e4 183
6dae6202
BH
184 pciehp_get_power_status(slot, value);
185 return 0;
1da177e4
LT
186}
187
188static int get_attention_status(struct hotplug_slot *hotplug_slot, u8 *value)
189{
190 struct slot *slot = hotplug_slot->private;
1da177e4 191
6dae6202
BH
192 pciehp_get_attention_status(slot, value);
193 return 0;
1da177e4
LT
194}
195
196static int get_latch_status(struct hotplug_slot *hotplug_slot, u8 *value)
197{
198 struct slot *slot = hotplug_slot->private;
1da177e4 199
6dae6202
BH
200 pciehp_get_latch_status(slot, value);
201 return 0;
1da177e4
LT
202}
203
204static int get_adapter_status(struct hotplug_slot *hotplug_slot, u8 *value)
205{
206 struct slot *slot = hotplug_slot->private;
1da177e4 207
6dae6202
BH
208 pciehp_get_adapter_status(slot, value);
209 return 0;
1da177e4
LT
210}
211
2e35afae
AW
212static int reset_slot(struct hotplug_slot *hotplug_slot, int probe)
213{
214 struct slot *slot = hotplug_slot->private;
215
2e35afae
AW
216 return pciehp_reset_slot(slot, probe);
217}
218
0516c8bc 219static int pciehp_probe(struct pcie_device *dev)
1da177e4
LT
220{
221 int rc;
222 struct controller *ctrl;
8720d27d 223 struct slot *slot;
8792e11f 224 u8 occupied, poweron;
125c39f7 225
e705c295
RW
226 /* If this is not a "hotplug" service, we have no business here. */
227 if (dev->service != PCIE_PORT_SERVICE_HP)
228 return -ENODEV;
a073a826 229
62e4492c
AN
230 if (!dev->port->subordinate) {
231 /* Can happen if we run out of bus numbers during probe */
232 dev_err(&dev->device,
233 "Hotplug bridge without secondary bus, ignoring\n");
2af31f41 234 return -ENODEV;
62e4492c
AN
235 }
236
c4635eb0 237 ctrl = pcie_init(dev);
1da177e4 238 if (!ctrl) {
18b341b7 239 dev_err(&dev->device, "Controller initialization failed\n");
2af31f41 240 return -ENODEV;
1da177e4 241 }
b9708940 242 set_service_data(dev, ctrl);
1da177e4 243
1da177e4 244 /* Setup the slot information structures */
8720d27d 245 rc = init_slot(ctrl);
1da177e4 246 if (rc) {
f46753c5 247 if (rc == -EBUSY)
227f0647 248 ctrl_warn(ctrl, "Slot already registered by another hotplug driver\n");
f46753c5 249 else
3784e0c6 250 ctrl_err(ctrl, "Slot initialization failed (%d)\n", rc);
a8c2b635 251 goto err_out_release_ctlr;
1da177e4
LT
252 }
253
dbc7e1e5
EB
254 /* Enable events after we have setup the data structures */
255 rc = pcie_init_notification(ctrl);
256 if (rc) {
3784e0c6 257 ctrl_err(ctrl, "Notification initialization failed (%d)\n", rc);
65b947bc 258 goto err_out_free_ctrl_slot;
dbc7e1e5
EB
259 }
260
db9aaf0b 261 /* Check if slot is occupied */
8720d27d 262 slot = ctrl->slot;
8792e11f
KK
263 pciehp_get_adapter_status(slot, &occupied);
264 pciehp_get_power_status(slot, &poweron);
50b52fde
RJ
265 if (occupied && pciehp_force) {
266 mutex_lock(&slot->hotplug_lock);
8792e11f 267 pciehp_enable_slot(slot);
50b52fde
RJ
268 mutex_unlock(&slot->hotplug_lock);
269 }
8792e11f
KK
270 /* If empty slot's power status is on, turn power off */
271 if (!occupied && poweron && POWER_CTRL(ctrl))
272 pciehp_power_off_slot(slot);
1da177e4 273
1da177e4
LT
274 return 0;
275
276err_out_free_ctrl_slot:
8720d27d 277 cleanup_slot(ctrl);
a8c2b635 278err_out_release_ctlr:
82a9e79e 279 pciehp_release_ctrl(ctrl);
1da177e4
LT
280 return -ENODEV;
281}
282
82a9e79e 283static void pciehp_remove(struct pcie_device *dev)
1da177e4 284{
b9708940 285 struct controller *ctrl = get_service_data(dev);
1da177e4 286
270a1039 287 pcie_shutdown_notification(ctrl);
8720d27d 288 cleanup_slot(ctrl);
82a9e79e 289 pciehp_release_ctrl(ctrl);
1da177e4
LT
290}
291
292#ifdef CONFIG_PM
3c78bc61 293static int pciehp_suspend(struct pcie_device *dev)
1da177e4 294{
1da177e4
LT
295 return 0;
296}
297
3c78bc61 298static int pciehp_resume(struct pcie_device *dev)
1da177e4 299{
87683e22
ON
300 struct controller *ctrl;
301 struct slot *slot;
302 u8 status;
303
87683e22 304 ctrl = get_service_data(dev);
cd2fe83a 305
87683e22 306 /* reinitialize the chipset's event detection logic */
83d19c06 307 pcie_reenable_notification(ctrl);
cd2fe83a 308
87683e22 309 slot = ctrl->slot;
cd2fe83a 310
87683e22
ON
311 /* Check if slot is occupied */
312 pciehp_get_adapter_status(slot, &status);
50b52fde 313 mutex_lock(&slot->hotplug_lock);
87683e22
ON
314 if (status)
315 pciehp_enable_slot(slot);
316 else
317 pciehp_disable_slot(slot);
50b52fde 318 mutex_unlock(&slot->hotplug_lock);
1da177e4
LT
319 return 0;
320}
3a3c244c 321#endif /* PM */
1da177e4 322
1da177e4 323static struct pcie_port_service_driver hpdriver_portdrv = {
83e9ad54 324 .name = PCIE_MODULE_NAME,
22106368
RW
325 .port_type = PCIE_ANY_PORT,
326 .service = PCIE_PORT_SERVICE_HP,
1da177e4
LT
327
328 .probe = pciehp_probe,
329 .remove = pciehp_remove,
330
331#ifdef CONFIG_PM
332 .suspend = pciehp_suspend,
333 .resume = pciehp_resume,
334#endif /* PM */
335};
336
337static int __init pcied_init(void)
338{
339 int retval = 0;
340
a8a2be94 341 retval = pcie_port_service_register(&hpdriver_portdrv);
f7625980 342 dbg("pcie_port_service_register = %d\n", retval);
c2be6f93 343 if (retval)
18b341b7 344 dbg("Failure to register service\n");
c2be6f93 345
1da177e4
LT
346 return retval;
347}
70626d88 348device_initcall(pcied_init);