[5.15,030/277] ath11k: mhi: use mhi_sync_power_up()

From: Kalle Valo <quic_kvalo@quicinc.com>

From: Kalle Valo <quic_kvalo@quicinc.com>

[ Upstream commit 3df6d74aedfdca919cca475d15dfdbc8b05c9e5d ]

If amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The
reason for that was that we were using mhi_async_power_up() which does not
check any errors. But mhi_sync_power_up() on the other hand does check for
errors so let's use that to fix the crash.

I was not able to find a reason why an async version was used.
ath11k_mhi_start() (which enables state ATH11K_MHI_POWER_ON) is called from
ath11k_hif_power_up(), which can sleep. So sync version should be safe to use
here.

[  145.569731] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI
[  145.569789] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[  145.569843] CPU: 2 PID: 1628 Comm: rmmod Kdump: loaded Tainted: G        W         5.16.0-wt-ath+ #567
[  145.569898] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021
[  145.569956] RIP: 0010:ath11k_hal_srng_access_begin+0xb5/0x2b0 [ath11k]
[  145.570028] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ec 01 00 00 48 8b ab a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 <0f> b6 14 02 48 89 e8 83 e0 07 83 c0 03 45 85 ed 75 48 38 d0 7c 08
[  145.570089] RSP: 0018:ffffc900025d7ac0 EFLAGS: 00010246
[  145.570144] RAX: dffffc0000000000 RBX: ffff88814fca2dd8 RCX: 1ffffffff50cb455
[  145.570196] RDX: 0000000000000000 RSI: ffff88814fca2dd8 RDI: ffff88814fca2e80
[  145.570252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffa8659497
[  145.570329] R10: fffffbfff50cb292 R11: 0000000000000001 R12: ffff88814fca0000
[  145.570410] R13: 0000000000000000 R14: ffff88814fca2798 R15: ffff88814fca2dd8
[  145.570465] FS:  00007fa399988540(0000) GS:ffff888233e00000(0000) knlGS:0000000000000000
[  145.570519] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  145.570571] CR2: 00007fa399b51421 CR3: 0000000137898002 CR4: 00000000003706e0
[  145.570623] Call Trace:
[  145.570675]  <TASK>
[  145.570727]  ? ath11k_ce_tx_process_cb+0x34b/0x860 [ath11k]
[  145.570797]  ath11k_ce_tx_process_cb+0x356/0x860 [ath11k]
[  145.570864]  ? tasklet_init+0x150/0x150
[  145.570919]  ? ath11k_ce_alloc_pipes+0x280/0x280 [ath11k]
[  145.570986]  ? tasklet_clear_sched+0x42/0xe0
[  145.571042]  ? tasklet_kill+0xe9/0x1b0
[  145.571095]  ? tasklet_clear_sched+0xe0/0xe0
[  145.571148]  ? irq_has_action+0x120/0x120
[  145.571202]  ath11k_ce_cleanup_pipes+0x45a/0x580 [ath11k]
[  145.571270]  ? ath11k_pci_stop+0x10e/0x170 [ath11k_pci]
[  145.571345]  ath11k_core_stop+0x8a/0xc0 [ath11k]
[  145.571434]  ath11k_core_deinit+0x9e/0x150 [ath11k]
[  145.571499]  ath11k_pci_remove+0xd2/0x260 [ath11k_pci]
[  145.571553]  pci_device_remove+0x9a/0x1c0
[  145.571605]  __device_release_driver+0x332/0x660
[  145.571659]  driver_detach+0x1e7/0x2c0
[  145.571712]  bus_remove_driver+0xe2/0x2d0
[  145.571772]  pci_unregister_driver+0x21/0x250
[  145.571826]  __do_sys_delete_module+0x30a/0x4b0
[  145.571879]  ? free_module+0xac0/0xac0
[  145.571933]  ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370
[  145.571986]  ? syscall_enter_from_user_mode+0x1d/0x50
[  145.572039]  ? lockdep_hardirqs_on+0x79/0x100
[  145.572097]  do_syscall_64+0x3b/0x90
[  145.572153]  entry_SYSCALL_64_after_hwframe+0x44/0xae

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2

Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220127090117.2024-2-kvalo@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mhi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20220412062942.915396612@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Kalle Valo <quic_kvalo@quicinc.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.15 030/277] ath11k: mhi: use mhi_sync_power_up() Date: Tue, 12 Apr 2022 08:27:13 +0200 Message-Id: <20220412062942.915396612@linuxfoundation.org> In-Reply-To: <20220412062942.022903016@linuxfoundation.org> References: <20220412062942.022903016@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,003/277] rtc: wm8350: Handle error for wm8350_register_irq [5.15,005/277] nbd: Fix incorrect error handle when first_minor is illegal in nbd_dev_add [5.15,006/277] nbd: Fix hungtask when nbd_config_put [5.15,010/277] kfence: limit currently covered allocations when pool nearly full [5.15,013/277] KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs [5.15,014/277] KVM: x86/pmu: Fix and isolate TSX-specific performance event logic [5.15,015/277] KVM: x86/emulator: Emulate RDPID only if it is enabled in guest [5.15,016/277] drm: Add orientation quirk for GPD Win Max [5.15,017/277] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 [5.15,018/277] drm/amd/display: Add signal type check when verify stream backends same [5.15,019/277] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj [5.15,023/277] usb: gadget: tegra-xudc: Fix control endpoints definitions [5.15,024/277] usb: cdnsp: fix cdnsp_decode_trb function to properly handle ret value [5.15,025/277] ptp: replace snprintf with sysfs_emit [5.15,027/277] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 [5.15,030/277] ath11k: mhi: use mhi_sync_power_up() [5.15,031/277] net/smc: Send directly when TCP_CORK is cleared [5.15,032/277] drm/bridge: Add missing pm_runtime_put_sync [5.15,033/277] bpf: Make dst_port field in struct bpf_sock 16-bit wide [5.15,035/277] scsi: bfa: Replace snprintf() with sysfs_emit() [5.15,038/277] mt76: mt7921: fix crash when startup fails. [5.15,041/277] libbpf: Fix build issue with llvm-readelf [5.15,042/277] ipv6: make mc_forwarding atomic [5.15,046/277] scsi: smartpqi: Fix kdump issue when controller is locked up [5.15,047/277] PCI: aardvark: Fix support for MSI interrupts [5.15,048/277] iommu/arm-smmu-v3: fix event handling soft lockup [5.15,050/277] PCI: endpoint: Fix alignment fault error in copy tests [5.15,052/277] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum [5.15,053/277] scsi: mpi3mr: Fix reporting of actual data transfer size [5.15,056/277] power: supply: axp288-charger: Set Vhold to 4.4V [5.15,057/277] net/mlx5e: Disable TX queues before registering the netdev [5.15,058/277] usb: dwc3: pci: Set the swnode from inside dwc3_pci_quirks() [5.15,060/277] iwlwifi: mvm: move only to an enabled channel [5.15,063/277] dm ioctl: prevent potential spectre v1 gadget [5.15,067/277] scsi: pm8001: Fix pm80xx_pci_mem_copy() interface [5.15,068/277] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() [5.15,071/277] scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() [5.15,072/277] mt76: mt7915: fix injected MPDU transmission to not use HW A-MSDU [5.15,073/277] powerpc/64s/hash: Make hash faults work in NMI context [5.15,074/277] mt76: mt7615: Fix assigning negative values to unsigned variable [5.15,075/277] scsi: aha152x: Fix aha152x_setup() __setup handler return value [5.15,076/277] scsi: hisi_sas: Free irq vectors in order for v3 HW [5.15,077/277] scsi: hisi_sas: Limit users changing debugfs BIST count value [5.15,083/277] Bluetooth: use memset avoid memory leaks [5.15,084/277] bnxt_en: Eliminate unintended link toggle during FW reset [5.15,091/277] can: isotp: set default value for N_As to 50 micro seconds [5.15,092/277] can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before calling e... [5.15,093/277] riscv: Fixed misaligned memory access. Fixed pointer comparison. [5.15,094/277] net: account alternate interface name memory [5.15,095/277] net: limit altnames to 64k total [5.15,096/277] net/mlx5e: Remove overzealous validations in netlink EEPROM query [5.15,097/277] net: sfp: add 2500base-X quirk for Lantech SFP module [5.15,100/277] xtensa: fix DTC warning unit_address_format [5.15,106/277] ceph: fix memory leak in ceph_readdir when note_last_dentry returns error [5.15,108/277] init/main.c: return 1 from handled __setup() functions [5.15,110/277] clk: si5341: fix reported clk_rate when output divider is 2 [5.15,113/277] phy: amlogic: phy-meson-gxl-usb2: fix shared reset controller use [5.15,114/277] phy: amlogic: meson8b-usb2: Use dev_err_probe() [5.15,116/277] clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568 [5.15,119/277] staging: wfx: fix an error handling in wfx_init_common() [5.15,120/277] w1: w1_therm: fixes w1_seq for ds28ea00 sensors [5.15,124/277] xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 [5.15,126/277] clk: Enforce that disjoints limits are invalid [5.15,131/277] NFS: swap-out must always use STABLE writes. [5.15,133/277] x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy [5.15,134/277] serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() [5.15,137/277] SUNRPC: Fix socket waits for write buffer space [5.15,139/277] NFS: Avoid writeback threads getting stuck in mempool_alloc() [5.15,141/277] parisc: Fix CPU affinity for Lasi, WAX and Dino chips [5.15,142/277] parisc: Fix patch code locking and flushing [5.15,145/277] rtc: Check return value from mc146818_get_time() [5.15,147/277] drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() [5.15,148/277] Drivers: hv: vmbus: Fix potential crash on module unload [5.15,149/277] Revert "NFSv4: Handle the special Linux file open access mode" [5.15,150/277] NFSv4: fix open failure with O_ACCMODE flag [5.15,152/277] scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map() [5.15,156/277] vdpa: mlx5: prevent cvq work from hogging CPU [5.15,157/277] net: sfc: add missing xdp queue reinitialization [5.15,158/277] net/tls: fix slab-out-of-bounds bug in decrypt_internal [5.15,159/277] vrf: fix packet sniffing for traffic originating from ip tunnels [5.15,163/277] net: ipv4: fix route with nexthop object delete warning [5.15,164/277] net: stmmac: Fix unset max_speed difference between DT and non-DT platforms [5.15,167/277] drm/imx: dw_hdmi-imx: Fix bailout in error cases of probe [5.15,168/277] regulator: rtq2134: Fix missing active_discharge_on setting [5.15,170/277] arch/arm64: Fix topology initialization for core scheduling [5.15,171/277] bnxt_en: Synchronize tx when xdp redirects happen on same ring [5.15,172/277] bnxt_en: reserve space inside receive page for skb_shared_info [5.15,174/277] sfc: Do not free an empty page_ring [5.15,178/277] IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition [5.15,179/277] sctp: count singleton chunks in assoc user stats [5.15,180/277] dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe [5.15,182/277] ice: Do not skip not enabled queues in ice_vc_dis_qs_msg [5.15,183/277] ipv6: Fix stats accounting in ip6_pkt_drop [5.15,184/277] ice: synchronize_rcu() when terminating rings [5.15,186/277] net: openvswitch: dont send internal clone attribute to the userspace. [5.15,189/277] rxrpc: fix a race in rxrpc_exit_net() [5.15,191/277] net: phy: mscc-miim: reject clause 45 register accesses [5.15,192/277] qede: confirm skb is allocated before using [5.15,193/277] spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() [5.15,196/277] scsi: ufs: ufshpb: Fix a NULL check on list iterator [5.15,198/277] io_uring: dont touch scm_fp_list after queueing skb [5.15,201/277] SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() [5.15,203/277] perf: arm-spe: Fix perf report --mem-mode [5.15,205/277] perf session: Remap buf if there is no space for event [5.15,208/277] scsi: ufs: ufs-pci: Add support for Intel MTL [5.15,209/277] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" [5.15,210/277] mmc: block: Check for errors after write on SPI [5.15,212/277] mmc: renesas_sdhi: dont overwrite TAP settings when HS400 tuning is complete [5.15,217/277] mm/mempolicy: fix mpol_new leak in shared_policy_replace [5.15,218/277] io_uring: dont check req->file in io_fsync_prep() [5.15,219/277] io_uring: defer splice/tee file validity check until command issue [5.15,220/277] io_uring: implement compat handling for IORING_REGISTER_IOWQ_AFF [5.15,226/277] btrfs: prevent subvol with swapfile from being deleted [5.15,227/277] spi: core: add dma_map_dev for __spi_unmap_msg() [5.15,228/277] arm64: patch_text: Fixup last cpu should be master [5.15,230/277] gpio: Restrict usage of GPIO chip irq members before initialization [5.15,231/277] x86/msi: Fix msi message data shadow struct [5.15,232/277] x86/mm/tlb: Revert retpoline avoidance approach [5.15,233/277] perf/x86/intel: Dont extend the pseudo-encoding to GP counters [5.15,234/277] ata: sata_dwc_460ex: Fix crash due to OOB write [5.15,236/277] perf/core: Inherit event_caps [5.15,241/277] drm/panel: ili9341: fix optional regulator handling [5.15,242/277] drm/amdgpu/display: change pipe policy for DCN 2.1 [5.15,243/277] drm/amdgpu/smu10: fix SoC/fclk units in auto mode [5.15,245/277] drm/nouveau/pmu: Add missing callbacks for Tegra devices [5.15,246/277] drm/amdkfd: Create file descriptor after client is added to smi_clients list [5.15,249/277] net/smc: send directly on setting TCP_NODELAY [5.15,250/277] Revert "selftests: net: Add tls config dependency for tls selftests" [5.15,254/277] SUNRPC: Dont call connect() more than once on a TCP socket [5.15,255/277] Revert "nbd: fix possible overflow on first_minor in nbd_dev_add()" [5.15,256/277] perf build: Dont use -ffat-lto-objects in the python feature test when building wi... [5.15,257/277] perf python: Fix probing for some clang command line options [5.15,261/277] KVM: avoid NULL pointer dereference in kvm_dirty_ring_push [5.15,262/277] Revert "net/mlx5: Accept devlink user input after driver initialization complete" [5.15,263/277] ubsan: remove CONFIG_UBSAN_OBJECT_SIZE [5.15,266/277] selftests: cgroup: Test open-time cgroup namespace usage for migration checks [5.15,267/277] mm: dont skip swap entry even if zap_details specified [5.15,274/277] irqchip/gic, gic-v3: Prevent GSI to SGI translations [5.15,276/277] static_call: Dont make __static_call_return0 static [5.15,277/277] powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit

[5.15,030/277] ath11k: mhi: use mhi_sync_power_up()

Commit Message

Patch