user/sven/linux.git/drivers/rpmsg, branch v5.16.19

rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev

2022-02-01T16:29:10Z

commit 7a534ae89e34e9b51acb5a63dd0f88308178b46a upstream. struct rpmsg_eptdev contains a struct cdev. The current code frees the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_eptdev could be freed before the cdev is entirely released. The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") Suggested-by: Bjorn Andersson Signed-off-by: Matthias Kaehlcke Reviewed-by: Mathieu Poirier Reviewed-by: Stephen Boyd Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid Signed-off-by: Greg Kroah-Hartman

rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev

2022-02-01T16:29:10Z

commit b7fb2dad571d1e21173c06cef0bced77b323990a upstream. struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v [ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26 [ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) [ 93.730055] Workqueue: events kobject_delayed_cleanup [ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO) [ 93.740216] pc : debug_print_object+0x13c/0x1b0 [ 93.744890] lr : debug_print_object+0x13c/0x1b0 [ 93.749555] sp : ffffffacf5bc7940 [ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000 [ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000 [ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000 [ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0 [ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0 [ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0 [ 93.785814] x17: 0000000000000000 x16: dfffffd000000000 [ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c [ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000 [ 93.802244] x11: 0000000000000001 x10: 0000000000000000 [ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900 [ 93.813200] x7 : 0000000000000000 x6 : 0000000000000000 [ 93.818676] x5 : 0000000000000080 x4 : 0000000000000000 [ 93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001 [ 93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061 [ 93.835104] Call trace: [ 93.837644] debug_print_object+0x13c/0x1b0 [ 93.841963] __debug_check_no_obj_freed+0x25c/0x3c0 [ 93.846987] debug_check_no_obj_freed+0x18/0x20 [ 93.851669] slab_free_freelist_hook+0xbc/0x1e4 [ 93.856346] kfree+0xfc/0x2f4 [ 93.859416] rpmsg_ctrldev_release_device+0x78/0xb8 [ 93.864445] device_release+0x84/0x168 [ 93.868310] kobject_cleanup+0x12c/0x298 [ 93.872356] kobject_delayed_cleanup+0x10/0x18 [ 93.876948] process_one_work+0x578/0x92c [ 93.881086] worker_thread+0x804/0xcf8 [ 93.884963] kthread+0x2a8/0x314 [ 93.888303] ret_from_fork+0x10/0x18 The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") Signed-off-by: Sujit Kautkar Signed-off-by: Matthias Kaehlcke Reviewed-by: Mathieu Poirier Reviewed-by: Bjorn Andersson Reviewed-by: Stephen Boyd Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220110104706.v6.1.Iaac908f3e3149a89190ce006ba166e2d3fd247a3@changeid Signed-off-by: Greg Kroah-Hartman

rpmsg: core: Clean up resources on announce_create failure.

2022-01-27T11:02:42Z

commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream. During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an error, the rpmsg device and default endpoint should be freed before exiting the function. Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend") Suggested-by: Bjorn Andersson Signed-off-by: Arnaud Pouliquen Reviewed-by: Bjorn Andersson Cc: stable Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@foss.st.com Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman

Merge tag 'rproc-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

2021-11-10T17:07:26Z

Pull remoteproc updates from Bjorn Andersson: "The remoteproc repo is moved to a new path on git.kernel.org, to allow Mathieu push access to the branches. Support for the Mediatek MT8195 SCP was added, the related DeviceTree binding was converted to YAML and MT8192 SCP was documented as well. Amlogic Meson6, Meson8, Meson8b and Meson8m2 has an ARC core to aid in resuming the system after suspend, a new remoteproc driver for booting this core is introduced. A new driver to support the DSP processor found on NXP i.MX8QM, i.MX8QXP, i.MX8MP and i.MX8ULP is added. The Qualcomm modem and TrustZone based remoteproc drivers gains support for the modem in SC7280 and MSM8996 gains support for a missing power-domain. Throughout the Qualcomm drivers, the support for informing the always-on power coprocessor about the state of each remoteproc is reworked to avoid complications related to our use of genpd and the system suspend state. Lastly a number of small fixes are found throughout the drivers and framework" * tag 'rproc-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (39 commits) remoteproc: Remove vdev_to_rvdev and vdev_to_rproc from remoteproc API remoteproc: omap_remoteproc: simplify getting .driver_data remoteproc: qcom_q6v5_mss: Use devm_platform_ioremap_resource_byname() to simplify code remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()' remoteproc: Fix spelling mistake "atleast" -> "at least" remoteproc: imx_dsp_rproc: mark PM functions as __maybe_unused remoteproc: imx_dsp_rproc: Correct the comment style of copyright dt-bindings: dsp: fsl: Update binding document for remote proc driver remoteproc: imx_dsp_rproc: Add remoteproc driver for DSP on i.MX remoteproc: imx_rproc: Add IMX_RPROC_SCU_API method remoteproc: imx_rproc: Move common structure to header file rpmsg: char: Remove useless include remoteproc: meson-mx-ao-arc: fix a bit test remoteproc: mss: q6v5-mss: Add modem support on SC7280 dt-bindings: remoteproc: qcom: Update Q6V5 Modem PIL binding remoteproc: qcom: pas: Add SC7280 Modem support dt-bindings: remoteproc: qcom: pas: Add SC7280 MPSS support remoteproc: qcom: pas: Use the same init resources for MSM8996 and MSM8998 MAINTAINERS: Update remoteproc repo url dt-bindings: remoteproc: k3-dsp: Cleanup SoC compatible from DT example ...

Merge tag 'rpmsg-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

2021-11-10T17:05:11Z

Pull rpmsg updates from Bjorn Andersson: "For the GLINK implementation this adds support for splitting outgoing messages that are too large to fit in the fifo, it introduces the use of "read notifications", to avoid polling in the case where the outgoing fifo is full and a few bugs are squashed. The return value of rpmsg_create_ept() for when RPMSG is disabled is corrected to return a valid error, the Mediatek rpmsg driver is updated to match the DT binding and a couple of cleanups are done in the virtio rpmsg driver" * tag 'rpmsg-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: glink: Send READ_NOTIFY command in FIFO full case rpmsg: glink: Remove channel decouple from rpdev release rpmsg: glink: Remove the rpmsg dev in close_ack rpmsg: glink: Add TX_DATA_CONT command while sending rpmsg: virtio_rpmsg_bus: use dev_warn_ratelimited for msg with no recipient rpmsg: virtio: Remove unused including rpmsg: Change naming of mediatek rpmsg property rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined rpmsg: glink: Replace strncpy() with strscpy_pad()

rpmsg: core: add API to get MTU

2021-10-21T10:35:35Z

Return the rpmsg buffer MTU for sending message, so rpmsg users can split a long message in several sub rpmsg buffers. Reviewed-by: Mathieu Poirier Reviewed-by: Bjorn Andersson Acked-by: Suman Anna Signed-off-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20211015094701.5732-2-arnaud.pouliquen@foss.st.com Signed-off-by: Greg Kroah-Hartman

rpmsg: glink: Send READ_NOTIFY command in FIFO full case

2021-10-15T16:02:11Z

The current design sleeps unconditionally in TX FIFO full case and wakeup only after sleep timer expires which adds random delays in clients TX path. Avoid sleep and use READ_NOTIFY command so that writer can be woken up when remote notifies about read completion by sending IRQ. Signed-off-by: Deepak Kumar Singh Signed-off-by: Arun Kumar Neelakantam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1596086296-28529-7-git-send-email-deesin@codeaurora.org

rpmsg: glink: Remove channel decouple from rpdev release

2021-10-15T16:01:14Z

If a channel is being rapidly restarting and the kobj release worker is busy, there is a chance the rpdev_release function will run after the channel struct itself has been released. There should not be a need to decouple the channel from rpdev in the rpdev release since that should only happen from the close commands. Signed-off-by: Chris Lew Signed-off-by: Deepak Kumar Singh Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1596086296-28529-6-git-send-email-deesin@codeaurora.org

rpmsg: glink: Remove the rpmsg dev in close_ack

2021-10-15T16:00:32Z

Un-register and register of rpmsg driver is sending invalid open_ack on closed channel. To avoid sending invalid open_ack case unregister the rpmsg device after receiving the local_close_ack from remote side. Signed-off-by: Deepak Kumar Singh Signed-off-by: Arun Kumar Neelakantam [bjorn: s/strlcpy/strscpy/] Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1596086296-28529-5-git-send-email-deesin@codeaurora.org

rpmsg: glink: Add TX_DATA_CONT command while sending

2021-10-15T15:35:20Z

With current design the transport can send packets of size upto FIFO_SIZE which is 16k and return failure for all packets above 16k. Add TX_DATA_CONT command to send packets greater than 16k by splitting into 8K chunks. Signed-off-by: Arun Kumar Neelakantam Signed-off-by: Deepak Kumar Singh Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1596086296-28529-4-git-send-email-deesin@codeaurora.org