Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db1267a0 authored by Lina Iyer's avatar Lina Iyer
Browse files

drivers: qcom: rpmh: Use spin_lock_irqX variants 



The spinlock in mbox_ctrlr may be accessed in an IRQ context when the
interrupt response tasklet calls tx_done callback while another process
is calling rpmh-write to send message to the controller.

BUG: spinlock recursion on CPU#0, kworker/u16:2/282
lock: mbox_ctrlr+0x18/0x90, .magic: dead4ead, .owner:
kworker/u16:2/282, .owner_cpu: 0
Causing a watchdog bite!
Call trace:
	dump_backtrace+0x0/0x200
	show_stack+0x20/0x28
	dump_stack+0xb0/0xec
	spin_bug+0x90/0xb4
	do_raw_spin_lock+0xcc/0x1bc
	_raw_spin_lock+0x28/0x34
	rpmh_tx_done+0xa0/0xf0
	tx_tick+0x64/0x88
	mbox_chan_txdone+0x30/0x5c
	tcs_notify_tx_done+0x68/0x114
	tasklet_action+0x70/0x104
	__do_softirq+0x114/0x3e8
	irq_exit+0xd0/0xfc
	__handle_domain_irq+0x70/0xbc
	gic_handle_irq+0xdc/0x1c0

when called from -

	el1_irq+0xb4/0x12c
	__slab_alloc.isra.69.constprop.71+0x58/0x80
	kmem_cache_alloc_trace+0x288/0x2b0
	__rpmh_write+0xcc/0x22c
	rpmh_write+0x138/0x1e4
	rpmh_regulator_send_aggregate_requests+0x238/0x510
	rpmh_regulator_vrm_set_mode_index+0x5c/0xc0
	rpmh_regulator_vrm_set_load+0x7c/0x88
	drms_uA_update+0xa4/0x308
	regulator_enable+0xec/0x19c
	regulator_enable+0x38/0x19c
	pdphy_enable_power.isra.2+0xe8/0x1d8
	pd_phy_open+0x84/0x1cc
	usbpd_set_state+0x340/0x9c0
	usbpd_sm+0x5d8/0x1690
	process_one_work+0x15c/0x440
	worker_thread+0x60/0x448
	kthread+0xec/0x100
	ret_from_fork+0x10/0x40

Change-Id: I4b1ddcb06cbd11675eab7e2c84635f3643d50dcd
Signed-off-by: default avatarLina Iyer <ilina@codeaurora.org>
parent 088ccec9

drivers/soc/qcom/rpmh.c

+18 −13
Original line number Diff line number Diff line
@@ -88,8 +88,9 @@ static struct rpmh_msg *get_msg_from_pool(struct rpmh_client *rc) 
	struct rpmh_mbox *rpm = rc->rpmh;

	struct rpmh_msg *msg = NULL;

	int pos;

	unsigned long flags;



	spin_lock(&rpm->lock);

	spin_lock_irqsave(&rpm->lock, flags);

	pos = find_first_zero_bit(rpm->fast_req, RPMH_MAX_FAST_RES);

	if (pos != RPMH_MAX_FAST_RES) {

		bitmap_set(rpm->fast_req, pos, 1);
@@ -98,7 +99,7 @@ static struct rpmh_msg *get_msg_from_pool(struct rpmh_client *rc) 
		msg->bit = pos;

		msg->rc = rc;

	}

	spin_unlock(&rpm->lock);

	spin_unlock_irqrestore(&rpm->lock, flags);



	return msg;

}
@@ -117,6 +118,7 @@ static void rpmh_tx_done(struct mbox_client *cl, void *msg, int r) 
	struct rpmh_mbox *rpm = rpm_msg->rc->rpmh;

	atomic_t *wc = rpm_msg->wait_count;

	wait_queue_head_t *waitq = rpm_msg->waitq;

	unsigned long flags;



	rpm_msg->err = r;
@@ -143,9 +145,9 @@ static void rpmh_tx_done(struct mbox_client *cl, void *msg, int r) 


	/* If we allocated the pool, set it as available */

	if (rpm_msg->bit >= 0 && rpm_msg->bit != RPMH_MAX_FAST_RES) {

		spin_lock(&rpm->lock);

		spin_lock_irqsave(&rpm->lock, flags);

		bitmap_clear(rpm->fast_req, rpm_msg->bit, 1);

		spin_unlock(&rpm->lock);

		spin_unlock_irqrestore(&rpm->lock, flags);

	}



	/* Signal the blocking thread we are done */
@@ -174,8 +176,9 @@ static struct rpmh_req *cache_rpm_request(struct rpmh_client *rc, 
{

	struct rpmh_req *req;

	struct rpmh_mbox *rpm = rc->rpmh;

	unsigned long flags;



	spin_lock(&rpm->lock);

	spin_lock_irqsave(&rpm->lock, flags);

	req = __find_req(rc, cmd->addr);

	if (req)

		goto existing;
@@ -210,7 +213,7 @@ static struct rpmh_req *cache_rpm_request(struct rpmh_client *rc, 


unlock:

	rpm->dirty = true;

	spin_unlock(&rpm->lock);

	spin_unlock_irqrestore(&rpm->lock, flags);



	return req;

}
@@ -566,6 +569,7 @@ int rpmh_invalidate(struct rpmh_client *rc) 
{

	DEFINE_RPMH_MSG_ONSTACK(rc, 0, NULL, NULL, rpm_msg);

	struct rpmh_mbox *rpm;

	unsigned long flags;



	if (IS_ERR_OR_NULL(rc))

		return -EINVAL;
@@ -577,9 +581,9 @@ int rpmh_invalidate(struct rpmh_client *rc) 
	rpm_msg.msg.invalidate = true;

	rpm_msg.msg.is_complete = false;



	spin_lock(&rpm->lock);

	spin_lock_irqsave(&rpm->lock, flags);

	rpm->dirty = true;

	spin_unlock(&rpm->lock);

	spin_unlock_irqrestore(&rpm->lock, flags);



	return mbox_send_controller_data(rc->chan, &rpm_msg.msg);

}
@@ -667,6 +671,7 @@ int rpmh_flush(struct rpmh_client *rc) 
	struct rpmh_req *p;

	struct rpmh_mbox *rpm = rc->rpmh;

	int ret;

	unsigned long flags;



	if (IS_ERR_OR_NULL(rc))

		return -EINVAL;
@@ -677,13 +682,13 @@ int rpmh_flush(struct rpmh_client *rc) 
	if (!mbox_controller_is_idle(rc->chan))

		return -EBUSY;



	spin_lock(&rpm->lock);

	spin_lock_irqsave(&rpm->lock, flags);

	if (!rpm->dirty) {

		pr_debug("Skipping flush, TCS has latest data.\n");

		spin_unlock(&rpm->lock);

		spin_unlock_irqrestore(&rpm->lock, flags);

		return 0;

	}

	spin_unlock(&rpm->lock);

	spin_unlock_irqrestore(&rpm->lock, flags);



	/*

	 * Nobody else should be calling this function other than sleep,
@@ -704,9 +709,9 @@ int rpmh_flush(struct rpmh_client *rc) 
			return ret;

	}



	spin_lock(&rpm->lock);

	spin_lock_irqsave(&rpm->lock, flags);

	rpm->dirty = false;

	spin_unlock(&rpm->lock);

	spin_unlock_irqrestore(&rpm->lock, flags);



	return 0;

}