On my Acer Travelmate 4002WLMi, the system locks up upon
suspend/shutdown. After a lot of research, it turned out
that the sbs module was the culprit. The driver would not
correctly mask out the value used to select a battery using
the "Smart Battery Selector" (subset of the "Smart Battery Manager").
This accidentally caused a invalid power source to be selected,
which was automatically corrected by the selector. Upon
notifing the host about the corrected power source, some batteries
would be selected for re-reading, causing a endless loop.
This would lead to some workqueues filling up, which caused the
lockup upon suspend/shutdown.
The first three patches fix a stacktrace on module removal caused
by some locking issues. The last patch finally fixes the
suspend/shutdown issues.
As a side note: This was the first machine on which i installed Linux,
to finally fixing this took ~5 years of tinkering.
Armin Wolf (4):
ACPI: EC: Add query notifier support
ACPI: sbshc: Use ec query notifier call chain
ACPI: EC: Make query handlers private
ACPI: SBS: Fix handling of Smart Battery Selectors
drivers/acpi/ec.c | 44 ++++++++++++++++++++--------------------
drivers/acpi/internal.h | 10 ++++-----
drivers/acpi/sbs.c | 27 ++++++++++++++++---------
drivers/acpi/sbshc.c | 45 ++++++++++++++++++++++++++---------------
4 files changed, 74 insertions(+), 52 deletions(-)
--
2.30.2
The "Smart Battery Selector" standard says that when writing
SelectorState (0x1), the nibbles which should not be modified
need to be masked with 0xff. This is necessary since in contrast
to a "Smart Battery Manager", the last three nibbles are writable.
Failing to do so might trigger the following cycle:
1. Host accidentally changes power source of the system (3rd nibble)
when selecting a battery.
2. Power source is invalid, Selector changes to another power source.
3. Selector notifies host that it changed the power source.
4. Host re-reads some batteries.
5. goto 1 for each re-read battery.
This loop might also be entered when a battery which is not present
is selected for SMBus access. In the end some workqueues fill up,
which causes the system to lockup upon suspend/shutdown.
Fix this by correctly masking the value to be written, and avoid
selecting batteries which are absent.
Tested on a Acer Travelmate 4002WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/sbs.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index e90752d4f488..94e3c000df2e 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -473,23 +473,32 @@ static const struct device_attribute alarm_attr = {
-------------------------------------------------------------------------- */
static int acpi_battery_read(struct acpi_battery *battery)
{
- int result = 0, saved_present = battery->present;
+ int result, saved_present = battery->present;
u16 state;
if (battery->sbs->manager_present) {
result = acpi_smbus_read(battery->sbs->hc, SMBUS_READ_WORD,
ACPI_SBS_MANAGER, 0x01, (u8 *)&state);
- if (!result)
- battery->present = state & (1 << battery->id);
- state &= 0x0fff;
+ if (result)
+ return result;
+
+ battery->present = state & (1 << battery->id);
+ if (!battery->present)
+ return 0;
+
+ /* Masking necessary for Smart Battery Selectors */
+ state = 0x0fff;
state |= 1 << (battery->id + 12);
acpi_smbus_write(battery->sbs->hc, SMBUS_WRITE_WORD,
ACPI_SBS_MANAGER, 0x01, (u8 *)&state, 2);
- } else if (battery->id == 0)
- battery->present = 1;
-
- if (result || !battery->present)
- return result;
+ } else {
+ if (battery->id == 0) {
+ battery->present = 1;
+ } else {
+ if (!battery->present)
+ return 0;
+ }
+ }
if (saved_present != battery->present) {
battery->update_time = 0;
--
2.30.2
The ability for external modules to register query handlers
was broken for a long time due to having only a single user.
With the only user (sbshc) having been converted to use the
more robust query notifier call chain, the query handler
functionality can be made private. This also allows for some
cleanups.
Tested on a Acer Travelmate 4000WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/ec.c | 36 ++++++++----------------------------
drivers/acpi/internal.h | 5 -----
2 files changed, 8 insertions(+), 33 deletions(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index dc7860a825a0..94391a62a44c 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -143,9 +143,7 @@ MODULE_PARM_DESC(ec_no_wakeup, "Do not wake up from suspend-to-idle");
struct acpi_ec_query_handler {
struct list_head node;
- acpi_ec_query_func func;
acpi_handle handle;
- void *data;
u8 query_bit;
struct kref kref;
};
@@ -1082,9 +1080,7 @@ static void acpi_ec_put_query_handler(struct acpi_ec_query_handler *handler)
kref_put(&handler->kref, acpi_ec_query_handler_release);
}
-int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
- acpi_handle handle, acpi_ec_query_func func,
- void *data)
+int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
{
struct acpi_ec_query_handler *handler =
kzalloc(sizeof(struct acpi_ec_query_handler), GFP_KERNEL);
@@ -1094,40 +1090,28 @@ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
handler->query_bit = query_bit;
handler->handle = handle;
- handler->func = func;
- handler->data = data;
mutex_lock(&ec->mutex);
kref_init(&handler->kref);
list_add(&handler->node, &ec->list);
mutex_unlock(&ec->mutex);
return 0;
}
-EXPORT_SYMBOL_GPL(acpi_ec_add_query_handler);
-static void acpi_ec_remove_query_handlers(struct acpi_ec *ec,
- bool remove_all, u8 query_bit)
+static void acpi_ec_remove_query_handlers(struct acpi_ec *ec)
{
struct acpi_ec_query_handler *handler, *tmp;
LIST_HEAD(free_list);
mutex_lock(&ec->mutex);
list_for_each_entry_safe(handler, tmp, &ec->list, node) {
- if (remove_all || query_bit == handler->query_bit) {
- list_del_init(&handler->node);
- list_add(&handler->node, &free_list);
- }
+ list_del_init(&handler->node);
+ list_add(&handler->node, &free_list);
}
mutex_unlock(&ec->mutex);
list_for_each_entry_safe(handler, tmp, &free_list, node)
acpi_ec_put_query_handler(handler);
}
-void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
-{
- acpi_ec_remove_query_handlers(ec, false, query_bit);
-}
-EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler);
-
int register_acpi_ec_query_notifier(struct notifier_block *nb)
{
return blocking_notifier_chain_register(&acpi_ec_chain_head, nb);
@@ -1151,12 +1135,8 @@ static void acpi_ec_event_processor(struct work_struct *work)
/* Allow notifier handlers to override query handlers */
ret = blocking_notifier_call_chain(&acpi_ec_chain_head, handler->query_bit, ec);
- if (ret != NOTIFY_BAD) {
- if (handler->func)
- handler->func(handler->data);
- else if (handler->handle)
- acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
- }
+ if (ret != NOTIFY_BAD && handler->handle)
+ acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
ec_dbg_evt("Query(0x%02x) stopped", handler->query_bit);
@@ -1402,7 +1382,7 @@ acpi_ec_register_query_methods(acpi_handle handle, u32 level,
status = acpi_get_name(handle, ACPI_SINGLE_NAME, &buffer);
if (ACPI_SUCCESS(status) && sscanf(node_name, "_Q%x", &value) == 1)
- acpi_ec_add_query_handler(ec, value, handle, NULL, NULL);
+ acpi_ec_add_query_handler(ec, value, handle);
return AE_OK;
}
@@ -1587,7 +1567,7 @@ static void ec_remove_handlers(struct acpi_ec *ec)
clear_bit(EC_FLAGS_EVENT_HANDLER_INSTALLED, &ec->flags);
}
if (test_bit(EC_FLAGS_QUERY_METHODS_INSTALLED, &ec->flags)) {
- acpi_ec_remove_query_handlers(ec, true, 0);
+ acpi_ec_remove_query_handlers(ec);
clear_bit(EC_FLAGS_QUERY_METHODS_INSTALLED, &ec->flags);
}
}
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 6f41d42375ab..72ce5a9ba57f 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -202,17 +202,12 @@ extern struct acpi_ec *first_ec;
/* If we find an EC via the ECDT, we need to keep a ptr to its context */
/* External interfaces use first EC only, so remember */
-typedef int (*acpi_ec_query_func) (void *data);
void acpi_ec_init(void);
void acpi_ec_ecdt_probe(void);
void acpi_ec_dsdt_probe(void);
void acpi_ec_block_transactions(void);
void acpi_ec_unblock_transactions(void);
-int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
- acpi_handle handle, acpi_ec_query_func func,
- void *data);
-void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
int register_acpi_ec_query_notifier(struct notifier_block *nb);
int unregister_acpi_ec_query_notifier(struct notifier_block *nb);
--
2.30.2
When using acpi_ec_add_query_handler(), a kernel oops
can occur when unloading the sbshc module, since the
handler callback might still be used by a work item
inside the ec workqueue.
Use the new ec query notifier call chain to register
the handler in a safe way. Return NOTIFY_BAD to override
the existing _Qxx handler in case the query was meant
for the EC SMBus controller.
Tested on a Acer Travelmate 4002WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/sbshc.c | 45 ++++++++++++++++++++++++++++----------------
1 file changed, 29 insertions(+), 16 deletions(-)
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index 16f2daaa2c45..e3280f646eb5 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -8,11 +8,14 @@
#define pr_fmt(fmt) "ACPI: " fmt
#include <linux/acpi.h>
+#include <linux/notifier.h>
#include <linux/wait.h>
#include <linux/slab.h>
#include <linux/delay.h>
#include <linux/module.h>
#include <linux/interrupt.h>
+
+#include "internal.h"
#include "sbshc.h"
#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
@@ -20,6 +23,7 @@
struct acpi_smb_hc {
struct acpi_ec *ec;
+ struct notifier_block nb;
struct mutex lock;
wait_queue_head_t wait;
u8 offset;
@@ -194,6 +198,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
hc->context = NULL;
mutex_unlock(&hc->lock);
acpi_os_wait_events_complete();
+
return 0;
}
@@ -206,20 +211,28 @@ static inline void acpi_smbus_callback(void *context)
hc->callback(hc->context);
}
-static int smbus_alarm(void *context)
+static int acpi_smbus_hc_notify(struct notifier_block *block, unsigned long action, void *data)
{
- struct acpi_smb_hc *hc = context;
+ struct acpi_smb_hc *hc = container_of(block, struct acpi_smb_hc, nb);
union acpi_smb_status status;
+ struct acpi_ec *ec = data;
u8 address;
+
+ if (ec != hc->ec || action != hc->query_bit)
+ return NOTIFY_DONE;
+
if (smb_hc_read(hc, ACPI_SMB_STATUS, &status.raw))
- return 0;
+ return NOTIFY_OK;
+
/* Check if it is only a completion notify */
if (status.fields.done && status.fields.status == SMBUS_OK) {
hc->done = true;
wake_up(&hc->wait);
}
+
if (!status.fields.alarm)
- return 0;
+ return NOTIFY_BAD;
+
mutex_lock(&hc->lock);
smb_hc_read(hc, ACPI_SMB_ALARM_ADDRESS, &address);
status.fields.alarm = 0;
@@ -233,20 +246,16 @@ static int smbus_alarm(void *context)
acpi_smbus_callback, hc);
}
mutex_unlock(&hc->lock);
- return 0;
-}
-typedef int (*acpi_ec_query_func) (void *data);
-
-extern int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
- acpi_handle handle, acpi_ec_query_func func,
- void *data);
+ /* We may need to override existing _Qxx handlers */
+ return NOTIFY_BAD;
+}
static int acpi_smbus_hc_add(struct acpi_device *device)
{
- int status;
unsigned long long val;
struct acpi_smb_hc *hc;
+ int status, ret;
if (!device)
return -EINVAL;
@@ -271,15 +280,19 @@ static int acpi_smbus_hc_add(struct acpi_device *device)
hc->query_bit = val & 0xff;
device->driver_data = hc;
- acpi_ec_add_query_handler(hc->ec, hc->query_bit, NULL, smbus_alarm, hc);
+ hc->nb.notifier_call = acpi_smbus_hc_notify;
+ ret = register_acpi_ec_query_notifier(&hc->nb);
+ if (ret < 0) {
+ kfree(hc);
+ return ret;
+ }
+
dev_info(&device->dev, "SBS HC: offset = 0x%0x, query_bit = 0x%0x\n",
hc->offset, hc->query_bit);
return 0;
}
-extern void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
-
static void acpi_smbus_hc_remove(struct acpi_device *device)
{
struct acpi_smb_hc *hc;
@@ -288,7 +301,7 @@ static void acpi_smbus_hc_remove(struct acpi_device *device)
return;
hc = acpi_driver_data(device);
- acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
+ unregister_acpi_ec_query_notifier(&hc->nb);
acpi_os_wait_events_complete();
kfree(hc);
device->driver_data = NULL;
--
2.30.2
Hi Armin,
I love your patch! Perhaps something to improve:
[auto build test WARNING on rafael-pm/linux-next]
[also build test WARNING on linus/master v6.2 next-20230225]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Armin-Wolf/ACPI-EC-Add-query-notifier-support/20230225-160641
base: https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git linux-next
patch link: https://lore.kernel.org/r/20230225080458.1342359-4-W_Armin%40gmx.de
patch subject: [PATCH 3/4] ACPI: EC: Make query handlers private
config: x86_64-randconfig-a013 (https://download.01.org/0day-ci/archive/20230225/[email protected]/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/a62cb9e29bf040af617070fa775758720d2de12e
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Armin-Wolf/ACPI-EC-Add-query-notifier-support/20230225-160641
git checkout a62cb9e29bf040af617070fa775758720d2de12e
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=x86_64 olddefconfig
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/acpi/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <[email protected]>
| Link: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All warnings (new ones prefixed by >>):
>> drivers/acpi/ec.c:1083:5: warning: no previous prototype for 'acpi_ec_add_query_handler' [-Wmissing-prototypes]
1083 | int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
vim +/acpi_ec_add_query_handler +1083 drivers/acpi/ec.c
1082
> 1083 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
1084 {
1085 struct acpi_ec_query_handler *handler =
1086 kzalloc(sizeof(struct acpi_ec_query_handler), GFP_KERNEL);
1087
1088 if (!handler)
1089 return -ENOMEM;
1090
1091 handler->query_bit = query_bit;
1092 handler->handle = handle;
1093 mutex_lock(&ec->mutex);
1094 kref_init(&handler->kref);
1095 list_add(&handler->node, &ec->list);
1096 mutex_unlock(&ec->mutex);
1097 return 0;
1098 }
1099
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
Hi Armin,
I love your patch! Perhaps something to improve:
[auto build test WARNING on rafael-pm/linux-next]
[also build test WARNING on linus/master v6.2 next-20230225]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Armin-Wolf/ACPI-EC-Add-query-notifier-support/20230225-160641
base: https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git linux-next
patch link: https://lore.kernel.org/r/20230225080458.1342359-4-W_Armin%40gmx.de
patch subject: [PATCH 3/4] ACPI: EC: Make query handlers private
config: x86_64-randconfig-a001 (https://download.01.org/0day-ci/archive/20230225/[email protected]/config)
compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/a62cb9e29bf040af617070fa775758720d2de12e
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Armin-Wolf/ACPI-EC-Add-query-notifier-support/20230225-160641
git checkout a62cb9e29bf040af617070fa775758720d2de12e
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/acpi/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <[email protected]>
| Link: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All warnings (new ones prefixed by >>):
>> drivers/acpi/ec.c:1083:5: warning: no previous prototype for function 'acpi_ec_add_query_handler' [-Wmissing-prototypes]
int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
^
drivers/acpi/ec.c:1083:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
^
static
1 warning generated.
vim +/acpi_ec_add_query_handler +1083 drivers/acpi/ec.c
1082
> 1083 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
1084 {
1085 struct acpi_ec_query_handler *handler =
1086 kzalloc(sizeof(struct acpi_ec_query_handler), GFP_KERNEL);
1087
1088 if (!handler)
1089 return -ENOMEM;
1090
1091 handler->query_bit = query_bit;
1092 handler->handle = handle;
1093 mutex_lock(&ec->mutex);
1094 kref_init(&handler->kref);
1095 list_add(&handler->node, &ec->list);
1096 mutex_unlock(&ec->mutex);
1097 return 0;
1098 }
1099
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
Hi Armin,
I love your patch! Perhaps something to improve:
[auto build test WARNING on rafael-pm/linux-next]
[also build test WARNING on linus/master v6.2 next-20230225]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Armin-Wolf/ACPI-EC-Add-query-notifier-support/20230225-160641
base: https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git linux-next
patch link: https://lore.kernel.org/r/20230225080458.1342359-4-W_Armin%40gmx.de
patch subject: [PATCH 3/4] ACPI: EC: Make query handlers private
config: x86_64-randconfig-a012 (https://download.01.org/0day-ci/archive/20230225/[email protected]/config)
compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/a62cb9e29bf040af617070fa775758720d2de12e
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Armin-Wolf/ACPI-EC-Add-query-notifier-support/20230225-160641
git checkout a62cb9e29bf040af617070fa775758720d2de12e
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/acpi/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <[email protected]>
| Link: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All warnings (new ones prefixed by >>):
>> drivers/acpi/ec.c:1083:5: warning: no previous prototype for function 'acpi_ec_add_query_handler' [-Wmissing-prototypes]
int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
^
drivers/acpi/ec.c:1083:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
^
static
1 warning generated.
vim +/acpi_ec_add_query_handler +1083 drivers/acpi/ec.c
1082
> 1083 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
1084 {
1085 struct acpi_ec_query_handler *handler =
1086 kzalloc(sizeof(struct acpi_ec_query_handler), GFP_KERNEL);
1087
1088 if (!handler)
1089 return -ENOMEM;
1090
1091 handler->query_bit = query_bit;
1092 handler->handle = handle;
1093 mutex_lock(&ec->mutex);
1094 kref_init(&handler->kref);
1095 list_add(&handler->node, &ec->list);
1096 mutex_unlock(&ec->mutex);
1097 return 0;
1098 }
1099
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests