user/sven/linux.git/drivers/mailbox, branch v4.19.261

mailbox: forward the hrtimer if not queued and under a lock

2022-06-14T14:59:25Z

[ Upstream commit bca1a1004615efe141fd78f360ecc48c60bc4ad5 ] This reverts commit c7dacf5b0f32957b24ef29df1207dc2cd8307743, "mailbox: avoid timer start from callback" The previous commit was reverted since it lead to a race that caused the hrtimer to not be started at all. The check for hrtimer_active() in msg_submit() will return true if the callback function txdone_hrtimer() is currently running. This function could return HRTIMER_NORESTART and then the timer will not be restarted, and also msg_submit() will not start the timer. This will lead to a message actually being submitted but no timer will start to check for its compleation. The original fix that added checking hrtimer_active() was added to avoid a warning with hrtimer_forward. Looking in the kernel another solution to avoid this warning is to check hrtimer_is_queued() before calling hrtimer_forward_now() instead. This however requires a lock so the timer is not started by msg_submit() inbetween this check and the hrtimer_forward() call. Fixes: c7dacf5b0f32 ("mailbox: avoid timer start from callback") Signed-off-by: Björn Ardö Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: avoid timer start from callback

2020-10-30T09:38:21Z

[ Upstream commit c7dacf5b0f32957b24ef29df1207dc2cd8307743 ] If the txdone is done by polling, it is possible for msg_submit() to start the timer while txdone_hrtimer() callback is running. If the timer needs recheduling, it could already be enqueued by the time hrtimer_forward_now() is called, leading hrtimer to loudly complain. WARNING: CPU: 3 PID: 74 at kernel/time/hrtimer.c:932 hrtimer_forward+0xc4/0x110 CPU: 3 PID: 74 Comm: kworker/u8:1 Not tainted 5.9.0-rc2-00236-gd3520067d01c-dirty #5 Hardware name: Libre Computer AML-S805X-AC (DT) Workqueue: events_freezable_power_ thermal_zone_device_check pstate: 20000085 (nzCv daIf -PAN -UAO BTYPE=--) pc : hrtimer_forward+0xc4/0x110 lr : txdone_hrtimer+0xf8/0x118 [...] This can be fixed by not starting the timer from the callback path. Which requires the timer reloading as long as any message is queued on the channel, and not just when current tx is not done yet. Fixes: 0cc67945ea59 ("mailbox: switch to hrtimer for tx_complete polling") Reported-by: Da Xue Reviewed-by: Sudeep Holla Tested-by: Sudeep Holla Acked-by: Jerome Brunet Tested-by: Jerome Brunet Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: qcom-apcs: fix max_register value

2020-01-27T13:51:14Z

[ Upstream commit 556a0964e28c4441dcdd50fb07596fd042246bd5 ] The mailbox length is 0x1000 hence the max_register value is 0xFFC. Fixes: c6a8b171ca8e ("mailbox: qcom: Convert APCS IPC driver to use regmap") Signed-off-by: Jorge Ramirez-Ortiz Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate()

2020-01-27T13:50:04Z

[ Upstream commit 78f3ff524fca63e7d2a57149a34ade23d2c12798 ] The > comparison should be >= or we access one element beyond the end of the array. (The inst->qinsts[] array is allocated in the ti_msgmgr_probe() function and it has ->num_valid_queues elements.) Fixes: a2b79838b891 ("mailbox: ti-msgmgr: Add support for Secure Proxy") Signed-off-by: Dan Carpenter Acked-by: Nishanth Menon Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: mediatek: Add check for possible failure of kzalloc

2020-01-27T13:49:56Z

[ Upstream commit 9f0a0a381c5db56e7922dbeea6831f27db58372f ] The patch 623a6143a845("mailbox: mediatek: Add Mediatek CMDQ driver") introduce the following static checker warning: drivers/mailbox/mtk-cmdq-mailbox.c:366 cmdq_mbox_send_data() error: potential null dereference 'task'. (kzalloc returns null) Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver") Reported-by: Dan Carpenter Signed-off-by: Houlong Wei Reviewed-by: Philipp Zabel Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: imx: Fix Tx doorbell shutdown path

2020-01-04T18:13:17Z

[ Upstream commit bf159d151a0b844be28882f39e316b5800acaa2b ] Tx doorbell is handled by txdb_tasklet and doesn't have an associated IRQ. Anyhow, imx_mu_shutdown ignores this and tries to free an IRQ that wasn't requested for Tx DB resulting in the following warning: [ 1.967644] Trying to free already-free IRQ 26 [ 1.972108] WARNING: CPU: 2 PID: 157 at kernel/irq/manage.c:1708 __free_irq+0xc0/0x358 [ 1.980024] Modules linked in: [ 1.983088] CPU: 2 PID: 157 Comm: kworker/2:1 Tainted: G [ 1.993524] Hardware name: Freescale i.MX8QXP MEK (DT) [ 1.998668] Workqueue: events deferred_probe_work_func [ 2.003812] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 2.008607] pc : __free_irq+0xc0/0x358 [ 2.012364] lr : __free_irq+0xc0/0x358 [ 2.016111] sp : ffff00001179b7e0 [ 2.019422] x29: ffff00001179b7e0 x28: 0000000000000018 [ 2.024736] x27: ffff000011233000 x26: 0000000000000004 [ 2.030053] x25: 000000000000001a x24: ffff80083bec74d4 [ 2.035369] x23: 0000000000000000 x22: ffff80083bec7588 [ 2.040686] x21: ffff80083b1fe8d8 x20: ffff80083bec7400 [ 2.046003] x19: 0000000000000000 x18: ffffffffffffffff [ 2.051320] x17: 0000000000000000 x16: 0000000000000000 [ 2.056637] x15: ffff0000111296c8 x14: ffff00009179b517 [ 2.061953] x13: ffff00001179b525 x12: ffff000011142000 [ 2.067270] x11: ffff000011129f20 x10: ffff0000105da970 [ 2.072587] x9 : 00000000ffffffd0 x8 : 0000000000000194 [ 2.077903] x7 : 612065657266206f x6 : ffff0000111e7b09 [ 2.083220] x5 : 0000000000000003 x4 : 0000000000000000 [ 2.088537] x3 : 0000000000000000 x2 : 00000000ffffffff [ 2.093854] x1 : 28b70f0a2b60a500 x0 : 0000000000000000 [ 2.099173] Call trace: [ 2.101618] __free_irq+0xc0/0x358 [ 2.105021] free_irq+0x38/0x98 [ 2.108170] imx_mu_shutdown+0x90/0xb0 [ 2.111921] mbox_free_channel.part.2+0x24/0xb8 [ 2.116453] mbox_free_channel+0x18/0x28 This bug is present from the beginning of times. Cc: Oleksij Rempel Signed-off-by: Daniel Baluta Signed-off-by: Richard Zhu Reviewed-by: Dong Aisheng Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: mailbox-test: fix null pointer if no mmio

2019-12-05T08:21:35Z

commit 6899b4f7c99c72968e58e502f96084f74f6e5e86 upstream. Fix null pointer issue if resource_size is called with no ioresource. Signed-off-by: Ludovic Barre Signed-off-by: Fabien Dessenne Signed-off-by: Jassi Brar Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

mailbox: stm32_ipcc: add spinlock to fix channels concurrent access

2019-12-05T08:21:34Z

commit dba9a3dfe912dc47c9dbc9ba1f5f65adbf9aea0f upstream. Add spinlock protection on IPCC register update to avoid race condition. Without this fix, stm32_ipcc_set_bits and stm32_ipcc_clr_bits can be called in parallel for different channels. This results in register corruptions. Signed-off-by: Arnaud Pouliquen Reviewed-by: Fabien Dessenne Signed-off-by: Jassi Brar Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

mbox: qcom: add APCS child device for QCS404

2019-10-07T16:57:02Z

[ Upstream commit 78c86458a440ff356073c21b568cb58ddb67b82b ] There is clock controller functionality in the APCS hardware block of qcs404 devices similar to msm8916. Co-developed-by: Niklas Cassel Signed-off-by: Niklas Cassel Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bjorn Andersson Reviewed-by: Stephen Boyd Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin

mailbox: handle failed named mailbox channel request

2019-07-31T05:27:07Z

[ Upstream commit 25777e5784a7b417967460d4fcf9660d05a0c320 ] Previously, if mbox_request_channel_byname was used with a name which did not exist in the "mbox-names" property of a mailbox client, the mailbox corresponding to the last entry in the "mbox-names" list would be incorrectly selected. With this patch, -EINVAL is returned if the named mailbox is not found. Signed-off-by: Morten Borup Petersen Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin