Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 19f53169 authored by Rajkumar Raghupathy's avatar Rajkumar Raghupathy Committed by Matt Wagantall
Browse files

soc: qcom: pil-msa: Notify MBA about PIL loading failure 



If modem loading fails during pil_boot, the allocated mba region
is freed. But the region is still in locked state as the MBA does not
know about the modem loading failure. This leads to XPU violation,
when the locked mba region is accessed by other modules.

Hence, before freeing the MBA region, notify the MBA about the failure
so that MBA can remove memory protection.

Change-Id: Ib3489504f2aa49dc886ea9a5f2eae3da57fcf7d4
Signed-off-by: default avatarRajkumar Raghupathy <raghup@codeaurora.org>
parent 51a38bdc

drivers/soc/qcom/pil-msa.c

+22 −1
Original line number Diff line number Diff line
@@ -57,9 +57,11 @@ 


#define CMD_META_DATA_READY		0x1

#define CMD_LOAD_READY			0x2

#define CMD_PILFAIL_NFY_MBA		0xffffdead



#define STATUS_META_DATA_AUTH_SUCCESS	0x3

#define STATUS_AUTH_COMPLETE		0x4

#define STATUS_MBA_UNLOCKED		0x6



/* External BHS */

#define EXTERNAL_BHS_ON			BIT(0)
@@ -287,11 +289,25 @@ int pil_mss_shutdown(struct pil_desc *pil) 
	return ret;

}



int pil_mss_deinit_image(struct pil_desc *pil)

int __pil_mss_deinit_image(struct pil_desc *pil, bool err_path)

{

	struct modem_data *drv = dev_get_drvdata(pil->dev);

	struct q6v5_data *q6_drv = container_of(pil, struct q6v5_data, desc);

	int ret = 0;

	s32 status;



	if (err_path) {

		writel_relaxed(CMD_PILFAIL_NFY_MBA,

				drv->rmb_base + RMB_MBA_COMMAND);

		ret = readl_poll_timeout(drv->rmb_base + RMB_MBA_STATUS, status,

			status == STATUS_MBA_UNLOCKED || status < 0,

			POLL_INTERVAL_US, pbl_mba_boot_timeout_ms * 1000);

		if (ret)

			dev_err(pil->dev, "MBA region unlock timed out\n");

		else if (status < 0)

			dev_err(pil->dev, "MBA unlock returned err status: %d\n",

						status);

	}



	ret = pil_mss_shutdown(pil);
@@ -307,6 +323,11 @@ int pil_mss_deinit_image(struct pil_desc *pil) 
	return ret;

}



int pil_mss_deinit_image(struct pil_desc *pil)

{

	return __pil_mss_deinit_image(pil, true);

}



int pil_mss_make_proxy_votes(struct pil_desc *pil)

{

	int ret;

drivers/soc/qcom/pil-msa.h

+2 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -43,4 +43,5 @@ int pil_mss_make_proxy_votes(struct pil_desc *pil); 
void pil_mss_remove_proxy_votes(struct pil_desc *pil);

int pil_mss_shutdown(struct pil_desc *pil);

int pil_mss_deinit_image(struct pil_desc *pil);

int __pil_mss_deinit_image(struct pil_desc *pil, bool err_path);

#endif

drivers/soc/qcom/pil-q6v5-mss.c

+1 −1
Original line number Diff line number Diff line
@@ -174,7 +174,7 @@ static int modem_ramdump(int enable, const struct subsys_desc *subsys) 
	if (ret < 0)

		pr_err("Unable to dump modem fw memory (rc = %d).\n", ret);



	ret = pil_mss_deinit_image(&drv->q6->desc);

	ret = __pil_mss_deinit_image(&drv->q6->desc, false);

	if (ret < 0)

		pr_err("Unable to free up resources (rc = %d).\n", ret);