mirror of
https://github.com/torvalds/linux.git
synced 2025-11-30 23:16:01 +07:00
Dismantle class device last in probe error flow to avoid accessing
freed memory like:
[ 87.926774] WARNING: CPU: 9 PID: 518 at kernel/workqueue.c:4234
__flush_work+0x340/0x390
...
[ 87.926912] Workqueue: async async_run_entry_fn
[ 87.926918] RIP: e030:__flush_work+0x340/0x390
[ 87.926923] Code: 26 9d 05 00 65 48 8b 15 26 3c ca 02 48 85 db 48 8b
04 24 48 89 54 24 58 0f 85 de fe ff ff e9 f6 fd ff ff 0f 0b e9 77 ff ff
ff <0f> 0b e9 70 ff ff ff 0f 0b e9 19 ff ff ff e8 7d 8b 0e 01 48 89 de
[ 87.926931] RSP: e02b:ffffc900412ebc00 EFLAGS: 00010246
[ 87.926936] RAX: 0000000000000000 RBX: ffff888103e55090 RCX: 0000000000000000
[ 87.926941] RDX: 000fffffffe00000 RSI: 0000000000000001 RDI: ffffc900412ebc60
[ 87.926945] RBP: ffff888103e55090 R08: ffffffffc1266ec8 R09: ffff8881109076e8
[ 87.926949] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000
[ 87.926953] R13: ffffc900412ebc18 R14: 0000000000000001 R15: 0000000000000000
[ 87.926962] FS: 0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000
[ 87.926967] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.926971] CR2: 00007e7923b32708 CR3: 00000001088df000 CR4: 0000000000050660
[ 87.926977] Call Trace:
[ 87.926981] <TASK>
[ 87.926987] ? __call_rcu_common.constprop.0+0x11e/0x310
[ 87.926993] cancel_work_sync+0x5e/0x80
[ 87.926999] mei_cancel_work+0x19/0x40 [mei]
[ 87.927051] mei_me_probe+0x273/0x2b0 [mei_me]
[ 87.927060] local_pci_probe+0x45/0x90
[ 87.927066] pci_call_probe+0x5b/0x180
[ 87.927070] pci_device_probe+0x95/0x140
[ 87.927074] ? driver_sysfs_add+0x57/0xc0
[ 87.927079] really_probe+0xde/0x340
[ 87.927083] ? pm_runtime_barrier+0x54/0x90
[ 87.927087] __driver_probe_device+0x78/0x110
[ 87.927092] driver_probe_device+0x1f/0xa0
[ 87.927095] __driver_attach_async_helper+0x5e/0xe0
[ 87.927100] async_run_entry_fn+0x34/0x130
[ 87.927104] process_one_work+0x18d/0x340
[ 87.927108] worker_thread+0x256/0x3a0
[ 87.927111] ? __pfx_worker_thread+0x10/0x10
[ 87.927115] kthread+0xfc/0x240
[ 87.927120] ? __pfx_kthread+0x10/0x10
[ 87.927124] ? __pfx_kthread+0x10/0x10
[ 87.927127] ret_from_fork+0xf5/0x110
[ 87.927132] ? __pfx_kthread+0x10/0x10
[ 87.927136] ret_from_fork_asm+0x1a/0x30
[ 87.927141] </TASK>
Tested-by: Guenter Roeck <groeck@google.com>
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Closes: https://lore.kernel.org/lkml/aQbYAXPADqfiXUYO@mail-itl/
Reported-by: Guenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/lkml/8deef7c4-ac75-4db8-91b7-02cf0e39e371@roeck-us.net/
Fixes: 7704e6be4e ("mei: hook mei_device on class device")
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Link: https://patch.msgid.link/20251102180836.1203314-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
378 lines
8.5 KiB
C
378 lines
8.5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (c) 2013-2020, Intel Corporation. All rights reserved.
|
|
* Intel Management Engine Interface (Intel MEI) Linux driver
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/device.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/types.h>
|
|
#include <linux/pci.h>
|
|
#include <linux/init.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/workqueue.h>
|
|
#include <linux/pm_domain.h>
|
|
#include <linux/pm_runtime.h>
|
|
|
|
#include <linux/mei.h>
|
|
|
|
|
|
#include "mei_dev.h"
|
|
#include "hw-txe.h"
|
|
|
|
static const struct pci_device_id mei_txe_pci_tbl[] = {
|
|
{PCI_VDEVICE(INTEL, 0x0F18)}, /* Baytrail */
|
|
{PCI_VDEVICE(INTEL, 0x2298)}, /* Cherrytrail */
|
|
|
|
{0, }
|
|
};
|
|
MODULE_DEVICE_TABLE(pci, mei_txe_pci_tbl);
|
|
|
|
#ifdef CONFIG_PM
|
|
static inline void mei_txe_set_pm_domain(struct mei_device *dev);
|
|
static inline void mei_txe_unset_pm_domain(struct mei_device *dev);
|
|
#else
|
|
static inline void mei_txe_set_pm_domain(struct mei_device *dev) {}
|
|
static inline void mei_txe_unset_pm_domain(struct mei_device *dev) {}
|
|
#endif /* CONFIG_PM */
|
|
|
|
/**
|
|
* mei_txe_probe - Device Initialization Routine
|
|
*
|
|
* @pdev: PCI device structure
|
|
* @ent: entry in mei_txe_pci_tbl
|
|
*
|
|
* Return: 0 on success, <0 on failure.
|
|
*/
|
|
static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
|
|
{
|
|
struct mei_device *dev;
|
|
struct mei_txe_hw *hw;
|
|
const int mask = BIT(SEC_BAR) | BIT(BRIDGE_BAR);
|
|
int err;
|
|
|
|
/* enable pci dev */
|
|
err = pcim_enable_device(pdev);
|
|
if (err) {
|
|
dev_err(&pdev->dev, "failed to enable pci device.\n");
|
|
goto end;
|
|
}
|
|
/* set PCI host mastering */
|
|
pci_set_master(pdev);
|
|
/* pci request regions and mapping IO device memory for mei driver */
|
|
err = pcim_iomap_regions(pdev, mask, KBUILD_MODNAME);
|
|
if (err) {
|
|
dev_err(&pdev->dev, "failed to get pci regions.\n");
|
|
goto end;
|
|
}
|
|
|
|
err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(36));
|
|
if (err) {
|
|
err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
|
|
if (err) {
|
|
dev_err(&pdev->dev, "No suitable DMA available.\n");
|
|
goto end;
|
|
}
|
|
}
|
|
|
|
/* allocates and initializes the mei dev structure */
|
|
dev = mei_txe_dev_init(pdev);
|
|
if (!dev) {
|
|
err = -ENOMEM;
|
|
goto end;
|
|
}
|
|
hw = to_txe_hw(dev);
|
|
hw->mem_addr = pcim_iomap_table(pdev);
|
|
|
|
err = mei_register(dev, &pdev->dev);
|
|
if (err)
|
|
goto end;
|
|
|
|
pci_enable_msi(pdev);
|
|
|
|
/* clear spurious interrupts */
|
|
mei_clear_interrupts(dev);
|
|
|
|
/* request and enable interrupt */
|
|
if (pci_dev_msi_enabled(pdev))
|
|
err = request_threaded_irq(pdev->irq,
|
|
NULL,
|
|
mei_txe_irq_thread_handler,
|
|
IRQF_ONESHOT, KBUILD_MODNAME, dev);
|
|
else
|
|
err = request_threaded_irq(pdev->irq,
|
|
mei_txe_irq_quick_handler,
|
|
mei_txe_irq_thread_handler,
|
|
IRQF_SHARED, KBUILD_MODNAME, dev);
|
|
if (err) {
|
|
dev_err(&pdev->dev, "mei: request_threaded_irq failure. irq = %d\n",
|
|
pdev->irq);
|
|
goto deregister;
|
|
}
|
|
|
|
if (mei_start(dev)) {
|
|
dev_err(&pdev->dev, "init hw failure.\n");
|
|
err = -ENODEV;
|
|
goto deregister;
|
|
}
|
|
|
|
pm_runtime_set_autosuspend_delay(&pdev->dev, MEI_TXI_RPM_TIMEOUT);
|
|
pm_runtime_use_autosuspend(&pdev->dev);
|
|
|
|
pci_set_drvdata(pdev, dev);
|
|
|
|
/*
|
|
* MEI requires to resume from runtime suspend mode
|
|
* in order to perform link reset flow upon system suspend.
|
|
*/
|
|
dev_pm_set_driver_flags(&pdev->dev, DPM_FLAG_NO_DIRECT_COMPLETE);
|
|
|
|
/*
|
|
* TXE maps runtime suspend/resume to own power gating states,
|
|
* hence we need to go around native PCI runtime service which
|
|
* eventually brings the device into D3cold/hot state.
|
|
* But the TXE device cannot wake up from D3 unlike from own
|
|
* power gating. To get around PCI device native runtime pm,
|
|
* TXE uses runtime pm domain handlers which take precedence.
|
|
*/
|
|
mei_txe_set_pm_domain(dev);
|
|
|
|
pm_runtime_put_noidle(&pdev->dev);
|
|
|
|
return 0;
|
|
|
|
deregister:
|
|
mei_cancel_work(dev);
|
|
mei_disable_interrupts(dev);
|
|
free_irq(pdev->irq, dev);
|
|
mei_deregister(dev);
|
|
end:
|
|
dev_err(&pdev->dev, "initialization failed.\n");
|
|
return err;
|
|
}
|
|
|
|
/**
|
|
* mei_txe_shutdown- Device Shutdown Routine
|
|
*
|
|
* @pdev: PCI device structure
|
|
*
|
|
* mei_txe_shutdown is called from the reboot notifier
|
|
* it's a simplified version of remove so we go down
|
|
* faster.
|
|
*/
|
|
static void mei_txe_shutdown(struct pci_dev *pdev)
|
|
{
|
|
struct mei_device *dev = pci_get_drvdata(pdev);
|
|
|
|
dev_dbg(&pdev->dev, "shutdown\n");
|
|
mei_stop(dev);
|
|
|
|
mei_txe_unset_pm_domain(dev);
|
|
|
|
mei_disable_interrupts(dev);
|
|
free_irq(pdev->irq, dev);
|
|
}
|
|
|
|
/**
|
|
* mei_txe_remove - Device Removal Routine
|
|
*
|
|
* @pdev: PCI device structure
|
|
*
|
|
* mei_remove is called by the PCI subsystem to alert the driver
|
|
* that it should release a PCI device.
|
|
*/
|
|
static void mei_txe_remove(struct pci_dev *pdev)
|
|
{
|
|
struct mei_device *dev = pci_get_drvdata(pdev);
|
|
|
|
pm_runtime_get_noresume(&pdev->dev);
|
|
|
|
mei_stop(dev);
|
|
|
|
mei_txe_unset_pm_domain(dev);
|
|
|
|
mei_disable_interrupts(dev);
|
|
free_irq(pdev->irq, dev);
|
|
|
|
mei_deregister(dev);
|
|
}
|
|
|
|
|
|
#ifdef CONFIG_PM_SLEEP
|
|
static int mei_txe_pci_suspend(struct device *device)
|
|
{
|
|
struct pci_dev *pdev = to_pci_dev(device);
|
|
struct mei_device *dev = pci_get_drvdata(pdev);
|
|
|
|
dev_dbg(&pdev->dev, "suspend\n");
|
|
|
|
mei_stop(dev);
|
|
|
|
mei_disable_interrupts(dev);
|
|
|
|
free_irq(pdev->irq, dev);
|
|
pci_disable_msi(pdev);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int mei_txe_pci_resume(struct device *device)
|
|
{
|
|
struct pci_dev *pdev = to_pci_dev(device);
|
|
struct mei_device *dev = pci_get_drvdata(pdev);
|
|
int err;
|
|
|
|
pci_enable_msi(pdev);
|
|
|
|
mei_clear_interrupts(dev);
|
|
|
|
/* request and enable interrupt */
|
|
if (pci_dev_msi_enabled(pdev))
|
|
err = request_threaded_irq(pdev->irq,
|
|
NULL,
|
|
mei_txe_irq_thread_handler,
|
|
IRQF_ONESHOT, KBUILD_MODNAME, dev);
|
|
else
|
|
err = request_threaded_irq(pdev->irq,
|
|
mei_txe_irq_quick_handler,
|
|
mei_txe_irq_thread_handler,
|
|
IRQF_SHARED, KBUILD_MODNAME, dev);
|
|
if (err) {
|
|
dev_err(&pdev->dev, "request_threaded_irq failed: irq = %d.\n",
|
|
pdev->irq);
|
|
return err;
|
|
}
|
|
|
|
err = mei_restart(dev);
|
|
|
|
return err;
|
|
}
|
|
#endif /* CONFIG_PM_SLEEP */
|
|
|
|
#ifdef CONFIG_PM
|
|
static int mei_txe_pm_runtime_idle(struct device *device)
|
|
{
|
|
struct mei_device *dev = dev_get_drvdata(device);
|
|
|
|
dev_dbg(device, "rpm: txe: runtime_idle\n");
|
|
|
|
if (mei_write_is_idle(dev))
|
|
pm_runtime_autosuspend(device);
|
|
|
|
return -EBUSY;
|
|
}
|
|
static int mei_txe_pm_runtime_suspend(struct device *device)
|
|
{
|
|
struct mei_device *dev = dev_get_drvdata(device);
|
|
int ret;
|
|
|
|
dev_dbg(device, "rpm: txe: runtime suspend\n");
|
|
|
|
mutex_lock(&dev->device_lock);
|
|
|
|
if (mei_write_is_idle(dev))
|
|
ret = mei_txe_aliveness_set_sync(dev, 0);
|
|
else
|
|
ret = -EAGAIN;
|
|
|
|
/* keep irq on we are staying in D0 */
|
|
|
|
dev_dbg(device, "rpm: txe: runtime suspend ret=%d\n", ret);
|
|
|
|
mutex_unlock(&dev->device_lock);
|
|
|
|
if (ret && ret != -EAGAIN)
|
|
schedule_work(&dev->reset_work);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int mei_txe_pm_runtime_resume(struct device *device)
|
|
{
|
|
struct mei_device *dev = dev_get_drvdata(device);
|
|
int ret;
|
|
|
|
dev_dbg(device, "rpm: txe: runtime resume\n");
|
|
|
|
mutex_lock(&dev->device_lock);
|
|
|
|
mei_enable_interrupts(dev);
|
|
|
|
ret = mei_txe_aliveness_set_sync(dev, 1);
|
|
|
|
mutex_unlock(&dev->device_lock);
|
|
|
|
dev_dbg(device, "rpm: txe: runtime resume ret = %d\n", ret);
|
|
|
|
if (ret)
|
|
schedule_work(&dev->reset_work);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/**
|
|
* mei_txe_set_pm_domain - fill and set pm domain structure for device
|
|
*
|
|
* @dev: mei_device
|
|
*/
|
|
static inline void mei_txe_set_pm_domain(struct mei_device *dev)
|
|
{
|
|
struct pci_dev *pdev = to_pci_dev(dev->parent);
|
|
|
|
if (pdev->dev.bus && pdev->dev.bus->pm) {
|
|
dev->pg_domain.ops = *pdev->dev.bus->pm;
|
|
|
|
dev->pg_domain.ops.runtime_suspend = mei_txe_pm_runtime_suspend;
|
|
dev->pg_domain.ops.runtime_resume = mei_txe_pm_runtime_resume;
|
|
dev->pg_domain.ops.runtime_idle = mei_txe_pm_runtime_idle;
|
|
|
|
dev_pm_domain_set(&pdev->dev, &dev->pg_domain);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* mei_txe_unset_pm_domain - clean pm domain structure for device
|
|
*
|
|
* @dev: mei_device
|
|
*/
|
|
static inline void mei_txe_unset_pm_domain(struct mei_device *dev)
|
|
{
|
|
/* stop using pm callbacks if any */
|
|
dev_pm_domain_set(dev->parent, NULL);
|
|
}
|
|
|
|
static const struct dev_pm_ops mei_txe_pm_ops = {
|
|
SET_SYSTEM_SLEEP_PM_OPS(mei_txe_pci_suspend,
|
|
mei_txe_pci_resume)
|
|
SET_RUNTIME_PM_OPS(
|
|
mei_txe_pm_runtime_suspend,
|
|
mei_txe_pm_runtime_resume,
|
|
mei_txe_pm_runtime_idle)
|
|
};
|
|
|
|
#define MEI_TXE_PM_OPS (&mei_txe_pm_ops)
|
|
#else
|
|
#define MEI_TXE_PM_OPS NULL
|
|
#endif /* CONFIG_PM */
|
|
|
|
/*
|
|
* PCI driver structure
|
|
*/
|
|
static struct pci_driver mei_txe_driver = {
|
|
.name = KBUILD_MODNAME,
|
|
.id_table = mei_txe_pci_tbl,
|
|
.probe = mei_txe_probe,
|
|
.remove = mei_txe_remove,
|
|
.shutdown = mei_txe_shutdown,
|
|
.driver.pm = MEI_TXE_PM_OPS,
|
|
};
|
|
|
|
module_pci_driver(mei_txe_driver);
|
|
|
|
MODULE_AUTHOR("Intel Corporation");
|
|
MODULE_DESCRIPTION("Intel(R) Trusted Execution Environment Interface");
|
|
MODULE_LICENSE("GPL v2");
|