May 2023 - Linux-stable-mirror

[PATCH AUTOSEL 5.15 1/4] phy: st: miphy28lp: use _poll_timeout functions for waits

by Sasha Levin

From: Alain Volmat <avolmat(a)me.com> [ Upstream commit e3be4dd2c8d8aabfd2c3127d0e2e5754d3ae82d6 ] This commit introduces _poll_timeout functions usage instead of wait loops waiting for a status bit. Signed-off-by: Alain Volmat <avolmat(a)me.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20230210224309.98452-1-avolmat@me.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.… [View More]org> --- drivers/phy/st/phy-miphy28lp.c | 42 ++++++++-------------------------- 1 file changed, 10 insertions(+), 32 deletions(-) diff --git a/drivers/phy/st/phy-miphy28lp.c b/drivers/phy/st/phy-miphy28lp.c index 068160a34f5cc..e30305b77f0d1 100644 --- a/drivers/phy/st/phy-miphy28lp.c +++ b/drivers/phy/st/phy-miphy28lp.c @@ -9,6 +9,7 @@ #include <linux/platform_device.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/of.h> @@ -484,19 +485,11 @@ static inline void miphy28lp_pcie_config_gen(struct miphy28lp_phy *miphy_phy) static inline int miphy28lp_wait_compensation(struct miphy28lp_phy *miphy_phy) { - unsigned long finish = jiffies + 5 * HZ; u8 val; /* Waiting for Compensation to complete */ - do { - val = readb_relaxed(miphy_phy->base + MIPHY_COMP_FSM_6); - - if (time_after_eq(jiffies, finish)) - return -EBUSY; - cpu_relax(); - } while (!(val & COMP_DONE)); - - return 0; + return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_COMP_FSM_6, + val, val & COMP_DONE, 1, 5 * USEC_PER_SEC); } @@ -805,7 +798,6 @@ static inline void miphy28lp_configure_usb3(struct miphy28lp_phy *miphy_phy) static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy) { - unsigned long finish = jiffies + 5 * HZ; u8 mask = HFC_PLL | HFC_RDY; u8 val; @@ -816,21 +808,14 @@ static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy) if (miphy_phy->type == PHY_TYPE_SATA) mask |= PHY_RDY; - do { - val = readb_relaxed(miphy_phy->base + MIPHY_STATUS_1); - if ((val & mask) != mask) - cpu_relax(); - else - return 0; - } while (!time_after_eq(jiffies, finish)); - - return -EBUSY; + return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_STATUS_1, + val, (val & mask) == mask, 1, + 5 * USEC_PER_SEC); } static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy) { struct miphy28lp_dev *miphy_dev = miphy_phy->phydev; - unsigned long finish = jiffies + 5 * HZ; u32 val; if (!miphy_phy->osc_rdy) @@ -839,17 +824,10 @@ static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy) if (!miphy_phy->syscfg_reg[SYSCFG_STATUS]) return -EINVAL; - do { - regmap_read(miphy_dev->regmap, - miphy_phy->syscfg_reg[SYSCFG_STATUS], &val); - - if ((val & MIPHY_OSC_RDY) != MIPHY_OSC_RDY) - cpu_relax(); - else - return 0; - } while (!time_after_eq(jiffies, finish)); - - return -EBUSY; + return regmap_read_poll_timeout(miphy_dev->regmap, + miphy_phy->syscfg_reg[SYSCFG_STATUS], + val, val & MIPHY_OSC_RDY, 1, + 5 * USEC_PER_SEC); } static int miphy28lp_get_resource_byname(struct device_node *child, -- 2.39.2 [View Less]

1 year, 11 months

1
3
0 0

[PATCH AUTOSEL 6.1 1/8] soundwire: dmi-quirks: add remapping for Intel 'Rooks County' NUC M15

by Sasha Levin

From: Eugene Huang <eugene.huang99(a)gmail.com> [ Upstream commit 01b33e284ca28cc977bdcfb23be2c719f2139175 ] Same DSDT problem as the HP Omen 16-k0005TX, except rt1316 amp is on link2. Link: https://github.com/thesofproject/linux/issues/4088 Signed-off-by: Eugene Huang <eugene.huang99(a)gmail.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Signed-off-by: Bard Liao <yung-… [View More]

1 year, 11 months

1
7
0 0

[PATCH AUTOSEL 6.2 1/9] pinctrl: at91: use devm_kasprintf() to avoid potential leaks (part 2)

by Sasha Levin

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> [ Upstream commit f494c1913cbb34b9e2078b7b045c87c1ca6df791 ] Use devm_kasprintf() instead of kasprintf() to avoid any potential leaks. At the moment drivers have no remove functionality hence there is no need for fixes tag. While at it, switch to use devm_kasprintf_strarray(). Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Reviewed-by: Claudiu Beznea <claudiu.beznea(a)microchip.com> Tested-by:… [View More] Claudiu Beznea <claudiu.beznea(a)microchip.com> Link: https://lore.kernel.org/r/20230215134242.37618-2-andriy.shevchenko@linux.in… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/pinctrl-at91.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c index c405296e49896..2a081b13846e2 100644 --- a/drivers/pinctrl/pinctrl-at91.c +++ b/drivers/pinctrl/pinctrl-at91.c @@ -18,6 +18,7 @@ #include <linux/pm.h> #include <linux/seq_file.h> #include <linux/slab.h> +#include <linux/string_helpers.h> /* Since we request GPIOs from ourself */ #include <linux/pinctrl/consumer.h> @@ -1364,6 +1365,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev, static int at91_pinctrl_probe(struct platform_device *pdev) { + struct device *dev = &pdev->dev; struct at91_pinctrl *info; struct pinctrl_pin_desc *pdesc; int ret, i, j, k, ngpio_chips_enabled = 0; @@ -1404,9 +1406,19 @@ static int at91_pinctrl_probe(struct platform_device *pdev) return -ENOMEM; for (i = 0, k = 0; i < gpio_banks; i++) { + char **names; + + names = devm_kasprintf_strarray(dev, "pio", MAX_NB_GPIO_PER_BANK); + if (!names) + return -ENOMEM; + for (j = 0; j < MAX_NB_GPIO_PER_BANK; j++, k++) { + char *name = names[j]; + + strreplace(name, '-', i + 'A'); + pdesc->number = k; - pdesc->name = kasprintf(GFP_KERNEL, "pio%c%d", i + 'A', j); + pdesc->name = name; pdesc++; } } @@ -1807,7 +1819,8 @@ static const struct of_device_id at91_gpio_of_match[] = { static int at91_gpio_probe(struct platform_device *pdev) { - struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; struct at91_gpio_chip *at91_chip = NULL; struct gpio_chip *chip; struct pinctrl_gpio_range *range; @@ -1876,16 +1889,14 @@ static int at91_gpio_probe(struct platform_device *pdev) chip->ngpio = ngpio; } - names = devm_kcalloc(&pdev->dev, chip->ngpio, sizeof(char *), - GFP_KERNEL); - + names = devm_kasprintf_strarray(dev, "pio", chip->ngpio); if (!names) { ret = -ENOMEM; goto clk_enable_err; } for (i = 0; i < chip->ngpio; i++) - names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); + strreplace(names[i], '-', alias_idx + 'A'); chip->names = (const char *const *)names; -- 2.39.2 [View Less]

1 year, 11 months

1
8
0 0

[PATCH AUTOSEL 6.3 1/9] pinctrl: at91: use devm_kasprintf() to avoid potential leaks (part 2)

by Sasha Levin

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> [ Upstream commit f494c1913cbb34b9e2078b7b045c87c1ca6df791 ] Use devm_kasprintf() instead of kasprintf() to avoid any potential leaks. At the moment drivers have no remove functionality hence there is no need for fixes tag. While at it, switch to use devm_kasprintf_strarray(). Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Reviewed-by: Claudiu Beznea <claudiu.beznea(a)microchip.com> Tested-by:… [View More] Claudiu Beznea <claudiu.beznea(a)microchip.com> Link: https://lore.kernel.org/r/20230215134242.37618-2-andriy.shevchenko@linux.in… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/pinctrl/pinctrl-at91.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c index 735c501e7a06c..9fa68ca4a412d 100644 --- a/drivers/pinctrl/pinctrl-at91.c +++ b/drivers/pinctrl/pinctrl-at91.c @@ -18,6 +18,7 @@ #include <linux/pm.h> #include <linux/seq_file.h> #include <linux/slab.h> +#include <linux/string_helpers.h> /* Since we request GPIOs from ourself */ #include <linux/pinctrl/consumer.h> @@ -1371,6 +1372,7 @@ static int at91_pinctrl_probe_dt(struct platform_device *pdev, static int at91_pinctrl_probe(struct platform_device *pdev) { + struct device *dev = &pdev->dev; struct at91_pinctrl *info; struct pinctrl_pin_desc *pdesc; int ret, i, j, k; @@ -1394,9 +1396,19 @@ static int at91_pinctrl_probe(struct platform_device *pdev) return -ENOMEM; for (i = 0, k = 0; i < gpio_banks; i++) { + char **names; + + names = devm_kasprintf_strarray(dev, "pio", MAX_NB_GPIO_PER_BANK); + if (!names) + return -ENOMEM; + for (j = 0; j < MAX_NB_GPIO_PER_BANK; j++, k++) { + char *name = names[j]; + + strreplace(name, '-', i + 'A'); + pdesc->number = k; - pdesc->name = kasprintf(GFP_KERNEL, "pio%c%d", i + 'A', j); + pdesc->name = name; pdesc++; } } @@ -1797,7 +1809,8 @@ static const struct of_device_id at91_gpio_of_match[] = { static int at91_gpio_probe(struct platform_device *pdev) { - struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + struct device_node *np = dev->of_node; struct at91_gpio_chip *at91_chip = NULL; struct gpio_chip *chip; struct pinctrl_gpio_range *range; @@ -1866,16 +1879,14 @@ static int at91_gpio_probe(struct platform_device *pdev) chip->ngpio = ngpio; } - names = devm_kcalloc(&pdev->dev, chip->ngpio, sizeof(char *), - GFP_KERNEL); - + names = devm_kasprintf_strarray(dev, "pio", chip->ngpio); if (!names) { ret = -ENOMEM; goto clk_enable_err; } for (i = 0; i < chip->ngpio; i++) - names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); + strreplace(names[i], '-', alias_idx + 'A'); chip->names = (const char *const *)names; -- 2.39.2 [View Less]

1 year, 11 months

1
8
0 0

Re: [PATCH 6.1 v1] RISC-V: fix lock splat in riscv_cpufeature_patch_func()

by Guenter Roeck

On Tue, May 09, 2023 at 10:36:42PM +0100, Conor Dooley wrote: > From: Conor Dooley <conor.dooley(a)microchip.com> > > Guenter reported a lockdep splat that appears to have been present for a > while in v6.1.y & the backports of the riscv_patch_in_stop_machine dance > did nothing to help here, as the lock is not being taken when > patch_text_nosync() is called in riscv_cpufeature_patch_func(). > Add the lock/unlock; elide the splat. > > Fixes: c15ac4fd60d5 (… [View More]

1 year, 11 months

1
0
0 0

[PATCH 2/4] usb: usbfs: Use consistent mmap functions

by Ruihan Li

When hcd->localmem_pool is non-null, it is used to allocate DMA memory. In this case, the dma address will be properly returned (in dma_handle), and dma_mmap_coherent should be used to map this memory into the user space. However, the current implementation uses pfn_remap_range, which is supposed to map normal pages (instead of DMA pages). Instead of repeating the logic in the memory allocation function, this patch introduces a more robust solution. To address the previous issue, this patch … [View More]

1 year, 11 months

3
3
0 0

FAILED: patch "[PATCH] bus: mhi: host: Range check CHDBOFF and ERDBOFF" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 6a0c637bfee69a74c104468544d9f2a6579626d0 # <… [View More]resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023050609-foothold-turret-5465@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 6a0c637bfee6 ("bus: mhi: host: Range check CHDBOFF and ERDBOFF") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 6a0c637bfee69a74c104468544d9f2a6579626d0 Mon Sep 17 00:00:00 2001 From: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Date: Fri, 24 Mar 2023 10:13:04 -0600 Subject: [PATCH] bus: mhi: host: Range check CHDBOFF and ERDBOFF If the value read from the CHDBOFF and ERDBOFF registers is outside the range of the MHI register space then an invalid address might be computed which later causes a kernel panic. Range check the read value to prevent a crash due to bad data from the device. Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") Cc: stable(a)vger.kernel.org Signed-off-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <mani(a)kernel.org> Link: https://lore.kernel.org/r/1679674384-27209-1-git-send-email-quic_jhugo@quic… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> diff --git a/drivers/bus/mhi/host/init.c b/drivers/bus/mhi/host/init.c index 3d779ee6396d..b46a0821adf9 100644 --- a/drivers/bus/mhi/host/init.c +++ b/drivers/bus/mhi/host/init.c @@ -516,6 +516,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl) return -EIO; } + if (val >= mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)) { + dev_err(dev, "CHDB offset: 0x%x is out of range: 0x%zx\n", + val, mhi_cntrl->reg_len - (8 * MHI_DEV_WAKE_DB)); + return -ERANGE; + } + /* Setup wake db */ mhi_cntrl->wake_db = base + val + (8 * MHI_DEV_WAKE_DB); mhi_cntrl->wake_set = false; @@ -532,6 +538,12 @@ int mhi_init_mmio(struct mhi_controller *mhi_cntrl) return -EIO; } + if (val >= mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)) { + dev_err(dev, "ERDB offset: 0x%x is out of range: 0x%zx\n", + val, mhi_cntrl->reg_len - (8 * mhi_cntrl->total_ev_rings)); + return -ERANGE; + } + /* Setup event db address for each ev_ring */ mhi_event = mhi_cntrl->mhi_event; for (i = 0; i < mhi_cntrl->total_ev_rings; i++, val += 8, mhi_event++) { [View Less]

1 year, 11 months

2
1
0 0

[PATCH 1/4] usb: usbfs: Enforce page requirements for mmap

by Ruihan Li

The current implementation of usbdev_mmap uses usb_alloc_coherent to allocate memory pages that will later be mapped into the user space. Meanwhile, usb_alloc_coherent employs three different methods to allocate memory, as outlined below: * If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to allocate memory. * If DMA is not available, it uses kmalloc to allocate memory. * Otherwise, it uses dma_alloc_coherent. However, it should be noted that gen_pool_dma_alloc does not … [View More]guarantee that the resulting memory will be page-aligned. Furthermore, trying to map slab pages (i.e., memory allocated by kmalloc) into the user space is not resonable and can lead to problems, such as a type confusion bug when PAGE_TABLE_CHECK=y [1]. To address these issues, this patch introduces hcd_alloc_coherent_pages, which addresses the above two problems. Specifically, hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling __get_free_pages. Reported-by: syzbot+fcf1a817ceb50935ce99(a)syzkaller.appspotmail.comm Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1] Cc: stable(a)vger.kernel.org Signed-off-by: Ruihan Li <lrh2000(a)pku.edu.cn> --- drivers/usb/core/buffer.c | 41 +++++++++++++++++++++++++++++++++++++++ drivers/usb/core/devio.c | 9 +++++---- include/linux/usb/hcd.h | 5 +++++ 3 files changed, 51 insertions(+), 4 deletions(-) diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c index fbb087b72..6010ef9f5 100644 --- a/drivers/usb/core/buffer.c +++ b/drivers/usb/core/buffer.c @@ -172,3 +172,44 @@ void hcd_buffer_free( } dma_free_coherent(hcd->self.sysdev, size, addr, dma); } + +void *hcd_buffer_alloc_pages(struct usb_hcd *hcd, size_t size, + gfp_t mem_flags, dma_addr_t *dma) +{ + if (size == 0) + return NULL; + + if (hcd->localmem_pool) + return gen_pool_dma_alloc_align(hcd->localmem_pool, + size, dma, PAGE_SIZE); + + /* some USB hosts just use PIO */ + if (!hcd_uses_dma(hcd)) { + *dma = DMA_MAPPING_ERROR; + return (void *)__get_free_pages(mem_flags, + get_order(size)); + } + + return dma_alloc_coherent(hcd->self.sysdev, + size, dma, mem_flags); +} + +void hcd_buffer_free_pages(struct usb_hcd *hcd, size_t size, + void *addr, dma_addr_t dma) +{ + if (!addr) + return; + + if (hcd->localmem_pool) { + gen_pool_free(hcd->localmem_pool, + (unsigned long)addr, size); + return; + } + + if (!hcd_uses_dma(hcd)) { + free_pages((unsigned long)addr, get_order(size)); + return; + } + + dma_free_coherent(hcd->self.sysdev, size, addr, dma); +} diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index e501a03d6..b4cf9e860 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -186,6 +186,7 @@ static int connected(struct usb_dev_state *ps) static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count) { struct usb_dev_state *ps = usbm->ps; + struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus); unsigned long flags; spin_lock_irqsave(&ps->lock, flags); @@ -194,8 +195,8 @@ static void dec_usb_memory_use_count(struct usb_memory *usbm, int *count) list_del(&usbm->memlist); spin_unlock_irqrestore(&ps->lock, flags); - usb_free_coherent(ps->dev, usbm->size, usbm->mem, - usbm->dma_handle); + hcd_buffer_free_pages(hcd, usbm->size, usbm->mem, + usbm->dma_handle); usbfs_decrease_memory_usage( usbm->size + sizeof(struct usb_memory)); kfree(usbm); @@ -247,8 +248,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) goto error_decrease_mem; } - mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN, - &dma_handle); + mem = hcd_buffer_alloc_pages(hcd, size, GFP_USER | __GFP_NOWARN, + &dma_handle); if (!mem) { ret = -ENOMEM; goto error_free_usbm; diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h index 094c77eaf..79f89109e 100644 --- a/include/linux/usb/hcd.h +++ b/include/linux/usb/hcd.h @@ -501,6 +501,11 @@ void *hcd_buffer_alloc(struct usb_bus *bus, size_t size, void hcd_buffer_free(struct usb_bus *bus, size_t size, void *addr, dma_addr_t dma); +void *hcd_buffer_alloc_pages(struct usb_hcd *hcd, size_t size, + gfp_t mem_flags, dma_addr_t *dma); +void hcd_buffer_free_pages(struct usb_hcd *hcd, size_t size, + void *addr, dma_addr_t dma); + /* generic bus glue, needed for host controllers that don't use PCI */ extern irqreturn_t usb_hcd_irq(int irq, void *__hcd); -- 2.40.1 [View Less]

1 year, 11 months

2
2
0 0

FAILED: patch "[PATCH] bus: mhi: host: Use mhi_tryset_pm_state() for setting fw" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 1d1493bdc25f498468a606a4ece947d155cfa3a9 # <… [View More]resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023050652-balancing-evasive-6713@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: 1d1493bdc25f ("bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 1d1493bdc25f498468a606a4ece947d155cfa3a9 Mon Sep 17 00:00:00 2001 From: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Date: Mon, 10 Apr 2023 09:58:12 -0600 Subject: [PATCH] bus: mhi: host: Use mhi_tryset_pm_state() for setting fw error state If firmware loading fails, the controller's pm_state is updated to MHI_PM_FW_DL_ERR unconditionally. This can corrupt the pm_state as the update is not done under the proper lock, and also does not validate the state transition. The firmware loading can fail due to a detected syserr, but if MHI_PM_FW_DL_ERR is unconditionally set as the pm_state, the handling of the syserr can break when it attempts to transition from syserr detect, to syserr process. By grabbing the lock, we ensure we don't race with some other pm_state update. By using mhi_try_set_pm_state(), we check that the transition to MHI_PM_FW_DL_ERR is valid via the state machine logic. If it is not valid, then some other transition is occurring like syserr processing, and we assume that will resolve the firmware loading error. Fixes: 12e050c77be0 ("bus: mhi: core: Move to an error state on any firmware load failure") Cc: stable(a)vger.kernel.org Signed-off-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Carl Vanderlip <quic_carlv(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <mani(a)kernel.org> Link: https://lore.kernel.org/r/1681142292-27571-3-git-send-email-quic_jhugo@quic… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> diff --git a/drivers/bus/mhi/host/boot.c b/drivers/bus/mhi/host/boot.c index 1c69feee1703..d2a19b07ccb8 100644 --- a/drivers/bus/mhi/host/boot.c +++ b/drivers/bus/mhi/host/boot.c @@ -391,6 +391,7 @@ void mhi_fw_load_handler(struct mhi_controller *mhi_cntrl) { const struct firmware *firmware = NULL; struct device *dev = &mhi_cntrl->mhi_dev->dev; + enum mhi_pm_state new_state; const char *fw_name; void *buf; dma_addr_t dma_addr; @@ -508,14 +509,18 @@ void mhi_fw_load_handler(struct mhi_controller *mhi_cntrl) } error_fw_load: - mhi_cntrl->pm_state = MHI_PM_FW_DL_ERR; - wake_up_all(&mhi_cntrl->state_event); + write_lock_irq(&mhi_cntrl->pm_lock); + new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR); + write_unlock_irq(&mhi_cntrl->pm_lock); + if (new_state == MHI_PM_FW_DL_ERR) + wake_up_all(&mhi_cntrl->state_event); } int mhi_download_amss_image(struct mhi_controller *mhi_cntrl) { struct image_info *image_info = mhi_cntrl->fbc_image; struct device *dev = &mhi_cntrl->mhi_dev->dev; + enum mhi_pm_state new_state; int ret; if (!image_info) @@ -526,8 +531,11 @@ int mhi_download_amss_image(struct mhi_controller *mhi_cntrl) &image_info->mhi_buf[image_info->entries - 1]); if (ret) { dev_err(dev, "MHI did not load AMSS, ret:%d\n", ret); - mhi_cntrl->pm_state = MHI_PM_FW_DL_ERR; - wake_up_all(&mhi_cntrl->state_event); + write_lock_irq(&mhi_cntrl->pm_lock); + new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR); + write_unlock_irq(&mhi_cntrl->pm_lock); + if (new_state == MHI_PM_FW_DL_ERR) + wake_up_all(&mhi_cntrl->state_event); } return ret; [View Less]

1 year, 11 months

2
1
0 0

FAILED: patch "[PATCH] bus: mhi: host: Remove duplicate ee check for syserr" failed to apply to 5.15-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x d469d9448a0f1a33c175d3280b1542fa0158ad7a # <… [View More]resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023050638-murkiness-purple-0e97@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^.. Possible dependencies: d469d9448a0f ("bus: mhi: host: Remove duplicate ee check for syserr") thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From d469d9448a0f1a33c175d3280b1542fa0158ad7a Mon Sep 17 00:00:00 2001 From: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Date: Mon, 10 Apr 2023 09:58:11 -0600 Subject: [PATCH] bus: mhi: host: Remove duplicate ee check for syserr If we detect a system error via intvec, we only process the syserr if the current ee is different than the last observed ee. The reason for this check is to prevent bhie from running multiple times, but with the single queue handling syserr, that is not possible. The check can cause an issue with device recovery. If PBL loads a bad SBL via BHI, but that SBL hangs before notifying the host of an ee change, then issuing soc_reset to crash the device and retry (after supplying a fixed SBL) will not recover the device as the host will observe a PBL->PBL transition and not process the syserr. The device will be stuck until either the driver is reloaded, or the host is rebooted. Instead, remove the check so that we can attempt to recover the device. Fixes: ef2126c4e2ea ("bus: mhi: core: Process execution environment changes serially") Cc: stable(a)vger.kernel.org Signed-off-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Carl Vanderlip <quic_carlv(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <mani(a)kernel.org> Link: https://lore.kernel.org/r/1681142292-27571-2-git-send-email-quic_jhugo@quic… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index c7eb7b8be9d6..74a75439c713 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -503,7 +503,7 @@ irqreturn_t mhi_intvec_threaded_handler(int irq_number, void *priv) } write_unlock_irq(&mhi_cntrl->pm_lock); - if (pm_state != MHI_PM_SYS_ERR_DETECT || ee == mhi_cntrl->ee) + if (pm_state != MHI_PM_SYS_ERR_DETECT) goto exit_intvec; switch (ee) { [View Less]

1 year, 11 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror May 2023