[illumos-gate merge]

commit b20613457c9cae13ad78e3ecace17563f4b65134
    4200 prctl(1): Duplicate information in the man page
commit cc944374608a39fb5622959cc9a210fb116539cb
    4282 Race between ipmi_close() and kcs_loop() could lead to panic
commit 28bf74a613770b649af5dd9c9b6b99625559d6ac
    4279 ipmi(7d): Invalid url specified
commit a67ac136365c88325c50c83d5b9b7891093cd1da
    4278 read-only lofi devices can never be removed if used

Conflicts:
	usr/src/uts/intel/io/ipmi/ipmivars.h

6 files changed, 37 insertions, 31 deletions

diff --git a/usr/src/man/man1/prctl.1 b/usr/src/man/man1/prctl.1
index 18c3fc5066..db13fb2448 100644
--- a/usr/src/man/man1/prctl.1
+++ b/usr/src/man/man1/prctl.1
@@ -3,7 +3,7 @@
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
 .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with
 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
-.TH PRCTL 1 "Aug 25, 2009"
+.TH PRCTL 1 "Oct 30, 2013"
 .SH NAME
 prctl \- get or set the resource controls of running processes, tasks, and
 projects
@@ -29,11 +29,6 @@ supported in the current release of the Solaris operating system.
 .SH OPTIONS
 .sp
 .LP
-If none of the \fB-s\fR, \fB-r\fR, \fB-x\fR, \fB-v\fR, \fB-d\fR, or \fB-e\fR
-options are specified, the invocation is considered a get operation. Otherwise,
-it is considered a modify operation.
-.sp
-.LP
 The following options are supported:
 .sp
 .ne 2
@@ -239,8 +234,9 @@ privilege. The matching criteria are discussed more fully in \fBsetrctl\fR(2).
 
 .sp
 .LP
-If none of the \fB-d\fR, \fB-e\fR, \fB-v\fR, or \fB-x\fR options is specified,
-the invocation is considered a get operation.
+If none of the \fB-s\fR, \fB-r\fR, \fB-x\fR, \fB-v\fR, \fB-d\fR, or \fB-e\fR
+options are specified, the invocation is considered a get operation. Otherwise,
+it is considered a modify operation.
 .SH OPERANDS
 .sp
 .LP
diff --git a/usr/src/man/man7d/ipmi.7d b/usr/src/man/man7d/ipmi.7d
index 50e80253de..be37b92ca7 100644
--- a/usr/src/man/man7d/ipmi.7d
+++ b/usr/src/man/man7d/ipmi.7d
@@ -19,8 +19,9 @@
 .\" CDDL HEADER END
 .\"
 .\" Copyright (c) 2012, Joyent, Inc. All Rights Reserved
+.\" Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
 .\"
-.TH IMPI 7D "Apr 21, 2012"
+.TH IPMI 7D "Oct 31, 2013"
 .SH NAME
 ipmi \- OpenIPMI compatible IPMI interface driver
 .SH SYNOPSIS
@@ -36,7 +37,7 @@ The \fBipmi\fR device is a character special file that provides access to the
 Intelligent Platform Management Interface for the system.  For more
 information on \fBIPMI\fR and to obtain a copy of the \fBIPMI\fR
 specification and implementation guidelines, refer to
-http://\fIhttp://www.intel.com/design/servers/ipmi/\fR.
+http://www.intel.com/design/servers/ipmi/.
 The driver is adapted from the FreeBSD driver which is in turn adapted from
 the Linux driver, however, not all features described in the standard are
 supported. The current implementation depends on the \fBsmbios\fR(7d) to
diff --git a/usr/src/uts/common/io/lofi.c b/usr/src/uts/common/io/lofi.c
index 5229e680ff..9f390dc939 100644
--- a/usr/src/uts/common/io/lofi.c
+++ b/usr/src/uts/common/io/lofi.c
@@ -475,14 +475,14 @@ lofi_open(dev_t *devp, int flag, int otyp, struct cred *credp)
 		return (ENXIO);
 	}
 
-	if (mark_opened(lsp, otyp) == -1) {
+	if (lsp->ls_readonly && (flag & FWRITE)) {
 		mutex_exit(&lofi_lock);
-		return (EINVAL);
+		return (EROFS);
 	}
 
-	if (lsp->ls_readonly && (flag & FWRITE)) {
+	if (mark_opened(lsp, otyp) == -1) {
 		mutex_exit(&lofi_lock);
-		return (EROFS);
+		return (EINVAL);
 	}
 
 	mutex_exit(&lofi_lock);
diff --git a/usr/src/uts/intel/io/ipmi/ipmi.c b/usr/src/uts/intel/io/ipmi/ipmi.c
index 8087d55db8..7fb5b757f6 100644
--- a/usr/src/uts/intel/io/ipmi/ipmi.c
+++ b/usr/src/uts/intel/io/ipmi/ipmi.c
@@ -103,22 +103,28 @@ ipmi_complete_request(struct ipmi_softc *sc, struct ipmi_request *req)
 
 	IPMI_LOCK_ASSERT(sc);
 
-	/*
-	 * Anonymous requests (from inside the driver) always have a
-	 * waiter that we awaken.
-	 */
 	if (req->ir_status == IRS_CANCELED) {
 		ASSERT(req->ir_owner == NULL);
 		ipmi_free_request(req);
 		return;
 	}
+
 	req->ir_status = IRS_COMPLETED;
-	cv_signal(&req->ir_cv);
 
-	if (req->ir_owner != NULL) {
+	/*
+	 * Anonymous requests (from inside the driver) always have a
+	 * waiter that we awaken.
+	 */
+	if (req->ir_owner == NULL) {
+		cv_signal(&req->ir_cv);
+	} else {
 		dev = req->ir_owner;
 		TAILQ_INSERT_TAIL(&dev->ipmi_completed_requests, req, ir_link);
 		pollwakeup(dev->ipmi_pollhead, POLLIN | POLLRDNORM);
+
+		dev->ipmi_status &= ~IPMI_BUSY;
+		if (dev->ipmi_status & IPMI_CLOSING)
+			cv_signal(&dev->ipmi_cv);
 	}
 }
 
@@ -193,6 +199,10 @@ ipmi_dequeue_request(struct ipmi_softc *sc)
 	req = TAILQ_FIRST(&sc->ipmi_pending_requests);
 	TAILQ_REMOVE(&sc->ipmi_pending_requests, req, ir_link);
 	req->ir_status = IRS_PROCESSED;
+
+	if (req->ir_owner != NULL)
+		req->ir_owner->ipmi_status |= IPMI_BUSY;
+
 	return (req);
 }
 
diff --git a/usr/src/uts/intel/io/ipmi/ipmi_main.c b/usr/src/uts/intel/io/ipmi/ipmi_main.c
index d691353613..857cd36fa0 100644
--- a/usr/src/uts/intel/io/ipmi/ipmi_main.c
+++ b/usr/src/uts/intel/io/ipmi/ipmi_main.c
@@ -175,6 +175,7 @@ ipmi_open(dev_t *devp, int flag, int otyp, cred_t *cred)
 	dev->ipmi_lun = IPMI_BMC_SMS_LUN;
 	*devp = makedevice(getmajor(*devp), minor);
 	dev->ipmi_dev = *devp;
+	cv_init(&dev->ipmi_cv, NULL, CV_DEFAULT, NULL);
 
 	mutex_enter(&dev_list_lock);
 	list_insert_head(&dev_list, dev);
@@ -205,6 +206,10 @@ ipmi_close(dev_t dev, int flag, int otyp, cred_t *cred)
 		}
 		req = next;
 	}
+
+	dp->ipmi_status |= IPMI_CLOSING;
+	while (dp->ipmi_status & IPMI_BUSY)
+		cv_wait(&dp->ipmi_cv, &sc->ipmi_lock);
 	IPMI_UNLOCK(sc);
 
 	/* remove any requests in queue of stuff completed */
@@ -217,6 +222,7 @@ ipmi_close(dev_t dev, int flag, int otyp, cred_t *cred)
 	list_remove(&dev_list, dp);
 	mutex_exit(&dev_list_lock);
 	id_free(minor_ids, getminor(dev));
+	cv_destroy(&dp->ipmi_cv);
 	kmem_free(dp->ipmi_pollhead, sizeof (pollhead_t));
 	kmem_free(dp, sizeof (ipmi_device_t));
 
@@ -296,17 +302,6 @@ ipmi_ioctl(dev_t dv, int cmd, intptr_t data, int flags, cred_t *cr, int *rvalp)
 
 	switch (cmd) {
 	case IPMICTL_SEND_COMMAND:
-		IPMI_LOCK(sc);
-		/* clear out old stuff in queue of stuff done */
-		while ((kreq = TAILQ_FIRST(&dev->ipmi_completed_requests))
-		    != NULL) {
-			TAILQ_REMOVE(&dev->ipmi_completed_requests, kreq,
-			    ir_link);
-			dev->ipmi_requests--;
-			ipmi_free_request(kreq);
-		}
-		IPMI_UNLOCK(sc);
-
 		/* Check that we didn't get a ridiculous length */
 		if (req.msg.data_len > IPMI_MAX_RX)
 			return (EINVAL);
diff --git a/usr/src/uts/intel/io/ipmi/ipmivars.h b/usr/src/uts/intel/io/ipmi/ipmivars.h
index 26fe7e8ebd..f547d6f043 100644
--- a/usr/src/uts/intel/io/ipmi/ipmivars.h
+++ b/usr/src/uts/intel/io/ipmi/ipmivars.h
@@ -79,6 +79,8 @@ struct ipmi_request {
 #define	SMIC_FLAGS			2
 
 struct ipmi_softc;
+#define	IPMI_BUSY	0x1
+#define	IPMI_CLOSING	0x2
 
 /* Per file descriptor data. */
 typedef struct ipmi_device {
@@ -89,6 +91,8 @@ typedef struct ipmi_device {
 	uchar_t			ipmi_lun;
 	dev_t			ipmi_dev;
 	list_node_t		ipmi_node;	/* list link for open devs */
+	int			ipmi_status;
+	kcondvar_t		ipmi_cv;
 } ipmi_device_t;
 
 struct ipmi_softc {