On my Acer Travelmate 4002WLMi, the system locks up upon
suspend/shutdown. After a lot of research, it turned out
that the sbs module was the culprit. The driver would not
correctly mask out the value used to select a battery using
the "Smart Battery Selector" (subset of the "Smart Battery Manager").
This accidentally caused a invalid power source to be selected,
which was automatically corrected by the selector. Upon
notifing the host about the corrected power source, some batteries
would be selected for re-reading, causing a endless loop.
This would lead to some workqueues filling up, which caused the
lockup upon suspend/shutdown.
The first three patches fix a stacktrace on module removal caused
by some locking issues. The last patch finally fixes the
suspend/shutdown issues.
As a side note: This was the first machine on which i installed Linux,
to finally fixing this took ~5 years of tinkering.
---
Changes in v2:
- make acpi_ec_add_query_handler() static to fix warning
Armin Wolf (4):
ACPI: EC: Add query notifier support
ACPI: sbshc: Use ec query notifier call chain
ACPI: EC: Make query handlers private
ACPI: SBS: Fix handling of Smart Battery Selectors
drivers/acpi/ec.c | 44 ++++++++++++++++++++--------------------
drivers/acpi/internal.h | 10 ++++-----
drivers/acpi/sbs.c | 27 ++++++++++++++++---------
drivers/acpi/sbshc.c | 45 ++++++++++++++++++++++++++---------------
4 files changed, 74 insertions(+), 52 deletions(-)
--
2.30.2
Allow external drivers to register notifiers to act on
query events and possibly override the query handler.
Use the existing notifier infrastructure for this to
ensure correct locking.
Tested on a Acer Travelmate 4002WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/ec.c | 28 ++++++++++++++++++++++++----
drivers/acpi/internal.h | 5 +++++
2 files changed, 29 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 105d2e795afa..dc7860a825a0 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -18,6 +18,7 @@
#include <linux/kernel.h>
#include <linux/module.h>
+#include <linux/notifier.h>
#include <linux/init.h>
#include <linux/types.h>
#include <linux/delay.h>
@@ -184,6 +185,8 @@ static int EC_FLAGS_CORRECT_ECDT; /* Needs ECDT port address correction */
static int EC_FLAGS_TRUST_DSDT_GPE; /* Needs DSDT GPE as correction setting */
static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+static BLOCKING_NOTIFIER_HEAD(acpi_ec_chain_head);
+
/* --------------------------------------------------------------------------
* Logging/Debugging
* -------------------------------------------------------------------------- */
@@ -1125,18 +1128,35 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
}
EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler);
+int register_acpi_ec_query_notifier(struct notifier_block *nb)
+{
+ return blocking_notifier_chain_register(&acpi_ec_chain_head, nb);
+}
+EXPORT_SYMBOL_GPL(register_acpi_ec_query_notifier);
+
+int unregister_acpi_ec_query_notifier(struct notifier_block *nb)
+{
+ return blocking_notifier_chain_unregister(&acpi_ec_chain_head, nb);
+}
+EXPORT_SYMBOL_GPL(unregister_acpi_ec_query_notifier);
+
static void acpi_ec_event_processor(struct work_struct *work)
{
struct acpi_ec_query *q = container_of(work, struct acpi_ec_query, work);
struct acpi_ec_query_handler *handler = q->handler;
struct acpi_ec *ec = q->ec;
+ int ret;
ec_dbg_evt("Query(0x%02x) started", handler->query_bit);
- if (handler->func)
- handler->func(handler->data);
- else if (handler->handle)
- acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
+ /* Allow notifier handlers to override query handlers */
+ ret = blocking_notifier_call_chain(&acpi_ec_chain_head, handler->query_bit, ec);
+ if (ret != NOTIFY_BAD) {
+ if (handler->func)
+ handler->func(handler->data);
+ else if (handler->handle)
+ acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
+ }
ec_dbg_evt("Query(0x%02x) stopped", handler->query_bit);
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index ec584442fb29..6f41d42375ab 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -11,6 +11,8 @@
#include <linux/idr.h>
+struct notifier_block;
+
int early_acpi_osi_init(void);
int acpi_osi_init(void);
acpi_status acpi_os_initialize1(void);
@@ -212,6 +214,9 @@ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
void *data);
void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
+int register_acpi_ec_query_notifier(struct notifier_block *nb);
+int unregister_acpi_ec_query_notifier(struct notifier_block *nb);
+
#ifdef CONFIG_PM_SLEEP
void acpi_ec_flush_work(void);
bool acpi_ec_dispatch_gpe(void);
--
2.30.2
When using acpi_ec_add_query_handler(), a kernel oops
can occur when unloading the sbshc module, since the
handler callback might still be used by a work item
inside the ec workqueue.
Use the new ec query notifier call chain to register
the handler in a safe way. Return NOTIFY_BAD to override
the existing _Qxx handler in case the query was meant
for the EC SMBus controller.
Tested on a Acer Travelmate 4002WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/sbshc.c | 45 ++++++++++++++++++++++++++++----------------
1 file changed, 29 insertions(+), 16 deletions(-)
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index 16f2daaa2c45..e3280f646eb5 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -8,11 +8,14 @@
#define pr_fmt(fmt) "ACPI: " fmt
#include <linux/acpi.h>
+#include <linux/notifier.h>
#include <linux/wait.h>
#include <linux/slab.h>
#include <linux/delay.h>
#include <linux/module.h>
#include <linux/interrupt.h>
+
+#include "internal.h"
#include "sbshc.h"
#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
@@ -20,6 +23,7 @@
struct acpi_smb_hc {
struct acpi_ec *ec;
+ struct notifier_block nb;
struct mutex lock;
wait_queue_head_t wait;
u8 offset;
@@ -194,6 +198,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
hc->context = NULL;
mutex_unlock(&hc->lock);
acpi_os_wait_events_complete();
+
return 0;
}
@@ -206,20 +211,28 @@ static inline void acpi_smbus_callback(void *context)
hc->callback(hc->context);
}
-static int smbus_alarm(void *context)
+static int acpi_smbus_hc_notify(struct notifier_block *block, unsigned long action, void *data)
{
- struct acpi_smb_hc *hc = context;
+ struct acpi_smb_hc *hc = container_of(block, struct acpi_smb_hc, nb);
union acpi_smb_status status;
+ struct acpi_ec *ec = data;
u8 address;
+
+ if (ec != hc->ec || action != hc->query_bit)
+ return NOTIFY_DONE;
+
if (smb_hc_read(hc, ACPI_SMB_STATUS, &status.raw))
- return 0;
+ return NOTIFY_OK;
+
/* Check if it is only a completion notify */
if (status.fields.done && status.fields.status == SMBUS_OK) {
hc->done = true;
wake_up(&hc->wait);
}
+
if (!status.fields.alarm)
- return 0;
+ return NOTIFY_BAD;
+
mutex_lock(&hc->lock);
smb_hc_read(hc, ACPI_SMB_ALARM_ADDRESS, &address);
status.fields.alarm = 0;
@@ -233,20 +246,16 @@ static int smbus_alarm(void *context)
acpi_smbus_callback, hc);
}
mutex_unlock(&hc->lock);
- return 0;
-}
-typedef int (*acpi_ec_query_func) (void *data);
-
-extern int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
- acpi_handle handle, acpi_ec_query_func func,
- void *data);
+ /* We may need to override existing _Qxx handlers */
+ return NOTIFY_BAD;
+}
static int acpi_smbus_hc_add(struct acpi_device *device)
{
- int status;
unsigned long long val;
struct acpi_smb_hc *hc;
+ int status, ret;
if (!device)
return -EINVAL;
@@ -271,15 +280,19 @@ static int acpi_smbus_hc_add(struct acpi_device *device)
hc->query_bit = val & 0xff;
device->driver_data = hc;
- acpi_ec_add_query_handler(hc->ec, hc->query_bit, NULL, smbus_alarm, hc);
+ hc->nb.notifier_call = acpi_smbus_hc_notify;
+ ret = register_acpi_ec_query_notifier(&hc->nb);
+ if (ret < 0) {
+ kfree(hc);
+ return ret;
+ }
+
dev_info(&device->dev, "SBS HC: offset = 0x%0x, query_bit = 0x%0x\n",
hc->offset, hc->query_bit);
return 0;
}
-extern void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
-
static void acpi_smbus_hc_remove(struct acpi_device *device)
{
struct acpi_smb_hc *hc;
@@ -288,7 +301,7 @@ static void acpi_smbus_hc_remove(struct acpi_device *device)
return;
hc = acpi_driver_data(device);
- acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
+ unregister_acpi_ec_query_notifier(&hc->nb);
acpi_os_wait_events_complete();
kfree(hc);
device->driver_data = NULL;
--
2.30.2
The ability for external modules to register query handlers
was broken for a long time due to having only a single user.
With the only user (sbshc) having been converted to use the
more robust query notifier call chain, the query handler
functionality can be made private. This also allows for some
cleanups.
Tested on a Acer Travelmate 4000WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/ec.c | 36 ++++++++----------------------------
drivers/acpi/internal.h | 5 -----
2 files changed, 8 insertions(+), 33 deletions(-)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index dc7860a825a0..825493d38a4f 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -143,9 +143,7 @@ MODULE_PARM_DESC(ec_no_wakeup, "Do not wake up from suspend-to-idle");
struct acpi_ec_query_handler {
struct list_head node;
- acpi_ec_query_func func;
acpi_handle handle;
- void *data;
u8 query_bit;
struct kref kref;
};
@@ -1082,9 +1080,7 @@ static void acpi_ec_put_query_handler(struct acpi_ec_query_handler *handler)
kref_put(&handler->kref, acpi_ec_query_handler_release);
}
-int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
- acpi_handle handle, acpi_ec_query_func func,
- void *data)
+static int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit, acpi_handle handle)
{
struct acpi_ec_query_handler *handler =
kzalloc(sizeof(struct acpi_ec_query_handler), GFP_KERNEL);
@@ -1094,40 +1090,28 @@ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
handler->query_bit = query_bit;
handler->handle = handle;
- handler->func = func;
- handler->data = data;
mutex_lock(&ec->mutex);
kref_init(&handler->kref);
list_add(&handler->node, &ec->list);
mutex_unlock(&ec->mutex);
return 0;
}
-EXPORT_SYMBOL_GPL(acpi_ec_add_query_handler);
-static void acpi_ec_remove_query_handlers(struct acpi_ec *ec,
- bool remove_all, u8 query_bit)
+static void acpi_ec_remove_query_handlers(struct acpi_ec *ec)
{
struct acpi_ec_query_handler *handler, *tmp;
LIST_HEAD(free_list);
mutex_lock(&ec->mutex);
list_for_each_entry_safe(handler, tmp, &ec->list, node) {
- if (remove_all || query_bit == handler->query_bit) {
- list_del_init(&handler->node);
- list_add(&handler->node, &free_list);
- }
+ list_del_init(&handler->node);
+ list_add(&handler->node, &free_list);
}
mutex_unlock(&ec->mutex);
list_for_each_entry_safe(handler, tmp, &free_list, node)
acpi_ec_put_query_handler(handler);
}
-void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
-{
- acpi_ec_remove_query_handlers(ec, false, query_bit);
-}
-EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler);
-
int register_acpi_ec_query_notifier(struct notifier_block *nb)
{
return blocking_notifier_chain_register(&acpi_ec_chain_head, nb);
@@ -1151,12 +1135,8 @@ static void acpi_ec_event_processor(struct work_struct *work)
/* Allow notifier handlers to override query handlers */
ret = blocking_notifier_call_chain(&acpi_ec_chain_head, handler->query_bit, ec);
- if (ret != NOTIFY_BAD) {
- if (handler->func)
- handler->func(handler->data);
- else if (handler->handle)
- acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
- }
+ if (ret != NOTIFY_BAD && handler->handle)
+ acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
ec_dbg_evt("Query(0x%02x) stopped", handler->query_bit);
@@ -1402,7 +1382,7 @@ acpi_ec_register_query_methods(acpi_handle handle, u32 level,
status = acpi_get_name(handle, ACPI_SINGLE_NAME, &buffer);
if (ACPI_SUCCESS(status) && sscanf(node_name, "_Q%x", &value) == 1)
- acpi_ec_add_query_handler(ec, value, handle, NULL, NULL);
+ acpi_ec_add_query_handler(ec, value, handle);
return AE_OK;
}
@@ -1587,7 +1567,7 @@ static void ec_remove_handlers(struct acpi_ec *ec)
clear_bit(EC_FLAGS_EVENT_HANDLER_INSTALLED, &ec->flags);
}
if (test_bit(EC_FLAGS_QUERY_METHODS_INSTALLED, &ec->flags)) {
- acpi_ec_remove_query_handlers(ec, true, 0);
+ acpi_ec_remove_query_handlers(ec);
clear_bit(EC_FLAGS_QUERY_METHODS_INSTALLED, &ec->flags);
}
}
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 6f41d42375ab..72ce5a9ba57f 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -202,17 +202,12 @@ extern struct acpi_ec *first_ec;
/* If we find an EC via the ECDT, we need to keep a ptr to its context */
/* External interfaces use first EC only, so remember */
-typedef int (*acpi_ec_query_func) (void *data);
void acpi_ec_init(void);
void acpi_ec_ecdt_probe(void);
void acpi_ec_dsdt_probe(void);
void acpi_ec_block_transactions(void);
void acpi_ec_unblock_transactions(void);
-int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
- acpi_handle handle, acpi_ec_query_func func,
- void *data);
-void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit);
int register_acpi_ec_query_notifier(struct notifier_block *nb);
int unregister_acpi_ec_query_notifier(struct notifier_block *nb);
--
2.30.2
The "Smart Battery Selector" standard says that when writing
SelectorState (0x1), the nibbles which should not be modified
need to be masked with 0xff. This is necessary since in contrast
to a "Smart Battery Manager", the last three nibbles are writable.
Failing to do so might trigger the following cycle:
1. Host accidentally changes power source of the system (3rd nibble)
when selecting a battery.
2. Power source is invalid, Selector changes to another power source.
3. Selector notifies host that it changed the power source.
4. Host re-reads some batteries.
5. goto 1 for each re-read battery.
This loop might also be entered when a battery which is not present
is selected for SMBus access. In the end some workqueues fill up,
which causes the system to lockup upon suspend/shutdown.
Fix this by correctly masking the value to be written, and avoid
selecting batteries which are absent.
Tested on a Acer Travelmate 4002WLMi.
Signed-off-by: Armin Wolf <[email protected]>
---
drivers/acpi/sbs.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index e90752d4f488..94e3c000df2e 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -473,23 +473,32 @@ static const struct device_attribute alarm_attr = {
-------------------------------------------------------------------------- */
static int acpi_battery_read(struct acpi_battery *battery)
{
- int result = 0, saved_present = battery->present;
+ int result, saved_present = battery->present;
u16 state;
if (battery->sbs->manager_present) {
result = acpi_smbus_read(battery->sbs->hc, SMBUS_READ_WORD,
ACPI_SBS_MANAGER, 0x01, (u8 *)&state);
- if (!result)
- battery->present = state & (1 << battery->id);
- state &= 0x0fff;
+ if (result)
+ return result;
+
+ battery->present = state & (1 << battery->id);
+ if (!battery->present)
+ return 0;
+
+ /* Masking necessary for Smart Battery Selectors */
+ state = 0x0fff;
state |= 1 << (battery->id + 12);
acpi_smbus_write(battery->sbs->hc, SMBUS_WRITE_WORD,
ACPI_SBS_MANAGER, 0x01, (u8 *)&state, 2);
- } else if (battery->id == 0)
- battery->present = 1;
-
- if (result || !battery->present)
- return result;
+ } else {
+ if (battery->id == 0) {
+ battery->present = 1;
+ } else {
+ if (!battery->present)
+ return 0;
+ }
+ }
if (saved_present != battery->present) {
battery->update_time = 0;
--
2.30.2
Am 25.02.23 um 12:51 schrieb Armin Wolf:
> On my Acer Travelmate 4002WLMi, the system locks up upon
> suspend/shutdown. After a lot of research, it turned out
> that the sbs module was the culprit. The driver would not
> correctly mask out the value used to select a battery using
> the "Smart Battery Selector" (subset of the "Smart Battery Manager").
> This accidentally caused a invalid power source to be selected,
> which was automatically corrected by the selector. Upon
> notifing the host about the corrected power source, some batteries
> would be selected for re-reading, causing a endless loop.
> This would lead to some workqueues filling up, which caused the
> lockup upon suspend/shutdown.
>
> The first three patches fix a stacktrace on module removal caused
> by some locking issues. The last patch finally fixes the
> suspend/shutdown issues.
>
> As a side note: This was the first machine on which i installed Linux,
> to finally fixing this took ~5 years of tinkering.
What is the status of this patchset? Should i use a SRCU notifier chain
for the query notifiers? I would really like to see this getting fixed,
as it prevents me from using linux on this machine.
Armin Wolf
> ---
> Changes in v2:
> - make acpi_ec_add_query_handler() static to fix warning
>
> Armin Wolf (4):
> ACPI: EC: Add query notifier support
> ACPI: sbshc: Use ec query notifier call chain
> ACPI: EC: Make query handlers private
> ACPI: SBS: Fix handling of Smart Battery Selectors
>
> drivers/acpi/ec.c | 44 ++++++++++++++++++++--------------------
> drivers/acpi/internal.h | 10 ++++-----
> drivers/acpi/sbs.c | 27 ++++++++++++++++---------
> drivers/acpi/sbshc.c | 45 ++++++++++++++++++++++++++---------------
> 4 files changed, 74 insertions(+), 52 deletions(-)
>
> --
> 2.30.2
>
>
On Sun, Mar 12, 2023 at 6:15 PM Armin Wolf <[email protected]> wrote:
>
> Am 25.02.23 um 12:51 schrieb Armin Wolf:
>
> > On my Acer Travelmate 4002WLMi, the system locks up upon
> > suspend/shutdown. After a lot of research, it turned out
> > that the sbs module was the culprit. The driver would not
> > correctly mask out the value used to select a battery using
> > the "Smart Battery Selector" (subset of the "Smart Battery Manager").
> > This accidentally caused a invalid power source to be selected,
> > which was automatically corrected by the selector. Upon
> > notifing the host about the corrected power source, some batteries
> > would be selected for re-reading, causing a endless loop.
> > This would lead to some workqueues filling up, which caused the
> > lockup upon suspend/shutdown.
> >
> > The first three patches fix a stacktrace on module removal caused
> > by some locking issues. The last patch finally fixes the
> > suspend/shutdown issues.
> >
> > As a side note: This was the first machine on which i installed Linux,
> > to finally fixing this took ~5 years of tinkering.
>
> What is the status of this patchset? Should i use a SRCU notifier chain
> for the query notifiers? I would really like to see this getting fixed,
> as it prevents me from using linux on this machine.
I'm not entirely convinced about the query notifiers idea TBH.
Am 14.03.23 um 20:49 schrieb Rafael J. Wysocki:
> On Sun, Mar 12, 2023 at 6:15 PM Armin Wolf <[email protected]> wrote:
>> Am 25.02.23 um 12:51 schrieb Armin Wolf:
>>
>>> On my Acer Travelmate 4002WLMi, the system locks up upon
>>> suspend/shutdown. After a lot of research, it turned out
>>> that the sbs module was the culprit. The driver would not
>>> correctly mask out the value used to select a battery using
>>> the "Smart Battery Selector" (subset of the "Smart Battery Manager").
>>> This accidentally caused a invalid power source to be selected,
>>> which was automatically corrected by the selector. Upon
>>> notifing the host about the corrected power source, some batteries
>>> would be selected for re-reading, causing a endless loop.
>>> This would lead to some workqueues filling up, which caused the
>>> lockup upon suspend/shutdown.
>>>
>>> The first three patches fix a stacktrace on module removal caused
>>> by some locking issues. The last patch finally fixes the
>>> suspend/shutdown issues.
>>>
>>> As a side note: This was the first machine on which i installed Linux,
>>> to finally fixing this took ~5 years of tinkering.
>> What is the status of this patchset? Should i use a SRCU notifier chain
>> for the query notifiers? I would really like to see this getting fixed,
>> as it prevents me from using linux on this machine.
> I'm not entirely convinced about the query notifiers idea TBH.
I already thought about just flushing the query workqueue, but acpi_ec_remove_query_handler()
would still also remove query handlers installed to handle _Qxx methods. This might cause errors,
as for example on the Acer Travelmate 4002WLMI, the SMBUS query handler (_Q20) resets the SMBUS
alert bit in case no EC SMBus driver is overriding it.
Is there any specific reason for your dislike of the query notifiers? I could turn them into
SRCU call chains to avoid performance issues.
Armin Wolf