summaryrefslogtreecommitdiff
path: root/drivers/bus/mhi
AgeCommit message (Collapse)Author
2026-02-22Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL usesKees Cook
Conversion performed via this Coccinelle script: // SPDX-License-Identifier: GPL-2.0-only // Options: --include-headers-for-types --all-includes --include-headers --keep-comments virtual patch @gfp depends on patch && !(file in "tools") && !(file in "samples")@ identifier ALLOC = {kmalloc_obj,kmalloc_objs,kmalloc_flex, kzalloc_obj,kzalloc_objs,kzalloc_flex, kvmalloc_obj,kvmalloc_objs,kvmalloc_flex, kvzalloc_obj,kvzalloc_objs,kvzalloc_flex}; @@ ALLOC(... - , GFP_KERNEL ) $ make coccicheck MODE=patch COCCI=gfp.cocci Build and boot tested x86_64 with Fedora 42's GCC and Clang: Linux version 6.19.0+ (user@host) (gcc (GCC) 15.2.1 20260123 (Red Hat 15.2.1-7), GNU ld version 2.44-12.fc42) #1 SMP PREEMPT_DYNAMIC 1970-01-01 Linux version 6.19.0+ (user@host) (clang version 20.1.8 (Fedora 20.1.8-4.fc42), LLD 20.1.8) #1 SMP PREEMPT_DYNAMIC 1970-01-01 Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21Convert more 'alloc_obj' cases to default GFP_KERNEL argumentsLinus Torvalds
This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21Convert 'alloc_obj' family to use the new default GFP_KERNEL argumentLinus Torvalds
This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2025-12-31bus: mhi: ep: Use bus callbacks for .probe() and .remove()Uwe Kleine-König
These are nearly identical to the driver callbacks, the only relevant difference is that the bus remove method returns void (instead of an int where the value is ignored). The objective is to get rid of users of struct device_driver callbacks .probe(), and .remove() to eventually remove these. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/2a79d99182a5171e83a07bf9f438ae31362f7e5d.1766090211.git.ukleinek@kernel.org
2025-12-31bus: mhi: host: Use bus callbacks for .probe() and .remove()Uwe Kleine-König
These are nearly identical to the driver callbacks, the only relevant difference is that the bus remove method returns void (instead of an int where the value is ignored). The objective is to get rid of users of struct device_driver callbacks .probe(), and .remove() to eventually remove these. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/e8032b3c2a8953a4a2b84dfa79a260c35f1d71b7.1766090211.git.ukleinek@kernel.org
2025-12-31bus: mhi: host: Drop the auto_queue supportManivannan Sadhasivam
Now that the only user of the 'auto_queue' feature, (QRTR) has been converted to manage the buffers on its own, drop the code related to it. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://patch.msgid.link/20251218-qrtr-fix-v2-2-c7499bfcfbe0@oss.qualcomm.com
2025-12-31net: qrtr: Drop the MHI auto_queue feature for IPCR DL channelsManivannan Sadhasivam
MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the dl_callback gets called, the client driver's structures might not be initialized, leading to NULL ptr dereference. Currently, the drivers have to workaround this issue by initializing the internal structures before calling mhi_prepare_for_transfer_autoqueue(). But even so, there is a chance that the client driver's internal code path may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is called, leading to similar NULL ptr dereference. This issue has been reported on the Qcom X1E80100 CRD machines affecting boot. So to properly fix all these races, drop the MHI 'auto_queue' feature altogether and let the client driver (QRTR) manage the RX buffers manually. In the QRTR driver, queue the RX buffers based on the ring length during probe and recycle the buffers in 'dl_callback' once they are consumed. This also warrants removing the setting of 'auto_queue' flag from controller drivers. Currently, this 'auto_queue' feature is only enabled for IPCR DL channel. So only the QRTR client driver requires the modification. Fixes: 227fee5fc99e ("bus: mhi: core: Add an API for auto queueing buffers for DL channel") Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation") Reported-by: Johan Hovold <johan@kernel.org> Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com Suggested-by: Chris Lew <quic_clew@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Acked-by: Jeff Johnson <jjohnson@kernel.org> # drivers/net/wireless/ath/... Acked-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Acked-by: Paolo Abeni <pabeni@redhat.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251218-qrtr-fix-v2-1-c7499bfcfbe0@oss.qualcomm.com
2025-12-24mhi: host: Add support for loading dual ELF image formatQiang Yu
Currently, the FBC image contains a single ELF header followed by segments for both SBL and WLAN FW. However, TME-L (Trust Management Engine Lite) supported devices (e.g., QCC2072) require separate ELF headers for SBL and WLAN FW segments due to TME-L image authentication requirements. Current image format contains two sections in a single binary: - First 512KB: ELF header + SBL segments - Remaining: WLAN FW segments (raw data) The TME-L supported image format contains two complete ELF files in a single binary: - First 512KB: Complete SBL ELF file (ELF header + SBL segments) - Remaining: Complete WLAN FW ELF file (ELF header + WLAN FW segments) Download behavior: - Legacy: 1. First 512KB via BHI (ELF header + SBL) 2. Full image via BHIe - TME-L: 1. First 512KB via BHI (SBL ELF file) 2. Remaining via BHIe (WLAN FW ELF file only) Add runtime detection to automatically identify the image format by checking for the presence of a second ELF header at the 512KB boundary. When detected, MHI skips the first 512KB during WLAN FW download over BHIe as it is loaded in BHI phase. Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20251223-wlan_image_load_skip_512k-v5-1-8d4459d720b5@oss.qualcomm.com
2025-11-20bus: mhi: host: pci_generic: Add Foxconn T99W760 modemSlark Xiao
T99W760 modem is based on Qualcomm SDX35 chipset. It uses the same channel configurations of Foxconn SDX61 modem. Hence, add support for it by reusing the 'modem_foxconn_sdx61_config' config structure. The EDL firmware for this modem has been pushed to linux-firmware. Signed-off-by: Slark Xiao <slark_xiao@163.com> [mani: reworded description] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20251119105615.48295-2-slark_xiao@163.com
2025-11-10bus: mhi: ep: add WQ_PERCPU to alloc_workqueue usersMarco Crivellari
Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo <tj@kernel.org> Signed-off-by: Marco Crivellari <marco.crivellari@suse.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20251106162430.328701-1-marco.crivellari@suse.com
2025-10-15bus: mhi: host: pci_generic: Add Telit FE990B40 modem supportDaniele Palmas
Add SDX72 based modem Telit FE990B40, reusing FN920C04 configuration. 01:00.0 Unassigned class [ff00]: Qualcomm Device 0309 Subsystem: Device 1c5d:2025 Signed-off-by: Daniele Palmas <dnlplm@gmail.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20251015102059.1781001-1-dnlplm@gmail.com
2025-10-15bus: mhi: ep: Make mhi_ep_bus_type constAdrian Barnaś
Because driver core can properly handle constant struct bus_type, move the mhi_ep_bus_type to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Signed-off-by: Adrian Barnaś <abarnas@google.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20250919074408.868220-1-abarnas@google.com
2025-09-19bus: mhi: host: pci_generic: Set DMA mask for VFsVivek Pernamitta
VFs in devices like QDU100 are capable of accessing host memory up to 40 bits, compared to 32 bits used by PFs and other non-SR-IOV capable MHI devices. To support this, configure `dma_mask` independently for PFs and VFs, by introducing a new 'vf_dma_data_width' member in 'mhi_pci_dev_info' struct and set it to 40 for QDU100. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-6-fa2f6ccd301b@quicinc.com
2025-09-19bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR stateVivek Pernamitta
Allow mhi_sync_power_up to handle SYS_ERR during power-up, reboot, or recovery. This is to avoid premature exit when MHI_PM_IN_ERROR_STATE is observed during above mentioned system states. To achieve this, treat SYS_ERR as a valid state and let its handler process the error and queue the next transition to Mission Mode instead of aborting early. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> [mani: reworded description] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-5-fa2f6ccd301b@quicinc.com
2025-09-19bus: mhi: host: pci_generic: Reset QDU100 while the MHI driver is removedVivek Pernamitta
So, When the MHI driver is removed from the host side, it is essential to ensure a clean and stable recovery of the device. This commit introduces the following steps to achieve that: 1. Disable SR-IOV for any SR-IOV-enabled devices on the Physical Function. 2. Perform a SOC_RESET on the PF to fully reset the device. Disabling SR-IOV ensures all Virtual Functions (VFs) are properly shutdown, preventing issues during the reset process. The SOC_RESET guarantees that the PF is restored to a known good state. If soc_reset is not performed device at driver remove, device will be stuck in mission mode state and subsequent driver insert/power_up will not proceed further. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> [mani: reworded subject] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-4-fa2f6ccd301b@quicinc.com
2025-09-19bus: mhi: host: pci_generic: Add SRIOV supportVivek Pernamitta
pci_sriov_configure_simple() will enable or disable SR-IOV for devices that don't require any specific PF setup before enabling SR-IOV. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-3-fa2f6ccd301b@quicinc.com
2025-09-19bus: mhi: host: pci_generic: Read SUBSYSTEM_VENDOR_ID for VF's to check statusVivek Pernamitta
In SR-IOV enabled devices, reading the VF DEVICE/VENDOR ID register returns `FFFFh`, as specified in section 3.4.1.1 of the PCIe SR-IOV spec. To accurately determine device activity, read the PCIe VENDOR_ID of the Physical Function (PF) instead. Health check monitoring for Virtual Functions (VFs) has been disabled, since VFs are not physical functions and lack direct hardware control. This change prevents unnecessary CPU cycles from being consumed by VF health checks, which are both unintended and non-functional. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-2-fa2f6ccd301b@quicinc.com
2025-09-19bus: mhi: host: Add support for separate controller configurations for VF and PFVivek Pernamitta
Implement support for separate controller configurations for both Virtual Functions (VF) and Physical Functions (PF). This enhancement allows for more flexible and efficient management of resources. The PF takes on a supervisory role and will have bootup information such as SAHARA, DIAG, and NDB (for file system sync data, etc.). VFs can handle resources associated with the main data movement of the Function are available to the SI (system image) as per PCIe SRIOV spec (rev 0.9 1.Architectural overview) Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-1-fa2f6ccd301b@quicinc.com
2025-09-12bus: mhi: ep: Fix chained transfer handling in read pathSumit Kumar
The mhi_ep_read_channel function incorrectly assumes the End of Transfer (EOT) bit is present for each packet in a chained transactions, causing it to advance mhi_chan->rd_offset beyond wr_offset during host-to-device transfers when EOT has not yet arrived. This leads to access of unmapped host memory, causing IOMMU faults and processing of stale TREs. Modify the loop condition to ensure mhi_queue is not empty, allowing the function to process only valid TREs up to the current write pointer to prevent premature reads and ensure safe traversal of chained TREs. Due to this change, buf_left needs to be removed from the while loop condition to avoid exiting prematurely before reading the ring completely, and also remove write_offset since it will always be zero because the new cache buffer is allocated every time. Fixes: 5301258899773 ("bus: mhi: ep: Add support for reading from the host") Co-developed-by: Akhil Vinod <akhil.vinod@oss.qualcomm.com> Signed-off-by: Akhil Vinod <akhil.vinod@oss.qualcomm.com> Signed-off-by: Sumit Kumar <sumit.kumar@oss.qualcomm.com> [mani: reworded description slightly] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250910-final_chained-v3-1-ec77c9d88ace@oss.qualcomm.com
2025-09-12bus: mhi: host: Notify EE change via ueventVivek Pernamitta
Notify the MHI device's Execution Environment (EE) state via uevent, enabling applications to receive real-time updates and take appropriate actions based on the current state of MHI. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> [mani: Reworded subject, removed error print, fixed indentation] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20250912-b4-uevent_vdev_next-20250911-v2-1-89440407bf7e@quicinc.com
2025-09-08bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()Adam Xue
In mhi_init_irq_setup, the device pointer used for dev_err() was not initialized. Use the pointer from mhi_cntrl instead. Fixes: b0fc0167f254 ("bus: mhi: core: Allow shared IRQ for event rings") Fixes: 3000f85b8f47 ("bus: mhi: core: Add support for basic PM operations") Signed-off-by: Adam Xue <zxue@semtech.com> [mani: reworded subject/description and CCed stable] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250905174118.38512-1-zxue@semtech.com
2025-09-05bus: mhi: host: pci_generic: Add support for all Foxconn T99W696 SKU variantsSlark Xiao
Since there are too many variants available for Foxconn T99W696 modem, and they all share the same configuration, use PCI_ANY_ID as the subsystem device ID to match each possible SKUs and support all of them. Signed-off-by: Slark Xiao <slark_xiao@163.com> [mani: reworded subject/description and dropped the fixes tag] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20250819020013.122162-1-slark_xiao@163.com
2025-07-19bus: mhi: host: pci_generic: Add Telit FN990B40 modem supportDaniele Palmas
Add SDX72 based modem Telit FN990B40, reusing FN920C04 configuration. 01:00.0 Unassigned class [ff00]: Qualcomm Device 0309 Subsystem: Device 1c5d:201a Signed-off-by: Daniele Palmas <dnlplm@gmail.com> [mani: added sdx72 in the comment to identify the chipset] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250716091836.999364-1-dnlplm@gmail.com
2025-07-19bus: mhi: host: Detect events pointing to unexpected TREsYoussef Samir
When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com> [mani: added stable tag and reworded commit message] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250714163039.3438985-1-quic_yabdulra@quicinc.com
2025-07-19bus: mhi: host: pci_generic: Add Foxconn T99W696 modemSlark Xiao
T99W696 modem is based on Qualcomm SDX61 chipset, which is an economic version compared to the baseline SDX62/SDX65 chipsets. Add support for it by introducing a new 'mhi_channel_config'. Since this modem supports the NMEA channel, a new config is needed. Signed-off-by: Slark Xiao <slark_xiao@163.com> [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250528092232.16111-1-slark_xiao@163.com
2025-07-19bus: mhi: host: Use str_true_false() helperYumeng Fang
Remove hard-coded strings by using the str_true_false() helper. Signed-off-by: Yumeng Fang <fang.yumeng@zte.com.cn> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250623202814633ukJqUDLU7BRlLLhvWkbD7@zte.com.cn
2025-07-19bus: mhi: host: pci_generic: Add support for EM929x and set MRU to 32768 for ↵Adam Xue
better performance. Add MHI controller config for EM929x. It uses the same configuration as EM919x. Also set the MRU to 32768 to improve downlink throughput. 02:00.0 Unassigned class [ff00]: Qualcomm Technologies, Inc Device 0308 Subsystem: Device 18d7:0301 Signed-off-by: Adam Xue <zxue@semtech.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250528175943.12739-1-zxue@semtech.com
2025-07-19bus: mhi: host: Fix endianness of BHI vector tableAlexander Wilhelm
On big endian platform like PowerPC, the MHI bus (which is little endian) does not start properly. The following example shows the error messages by using QCN9274 WLAN device with ath12k driver: ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit] ath12k_pci 0001:01:00.0: MSI vectors: 1 ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0 ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2) ath12k_pci 0001:01:00.0: failed to start mhi: -110 ath12k_pci 0001:01:00.0: failed to power up :-110 ath12k_pci 0001:01:00.0: failed to create soc core: -110 ath12k_pci 0001:01:00.0: failed to init core: -110 ath12k_pci: probe of 0001:01:00.0 failed with error -110 The issue seems to be with the incorrect DMA address/size used for transferring the firmware image over BHI. So fix it by converting the DMA address and size of the BHI vector table to little endian format before sending them to the device. Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") Signed-off-by: Alexander Wilhelm <alexander.wilhelm@westermo.com> [mani: added stable tag and reworded commit message] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com
2025-07-19bus: mhi: host: pci_generic: Disable runtime PM for QDU100Vivek Pernamitta
The QDU100 device does not support the MHI M3 state, necessitating the disabling of runtime PM for this device. It is essential to disable runtime PM if the device does not support M3 state. Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com> [mani: Fixed the kdoc comment for no_m3] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Link: https://patch.msgid.link/20250425-vdev_next-20250411_pm_disable-v4-1-d4870a73ebf9@quicinc.com
2025-07-19bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640Slark Xiao
T99W640 was mistakenly mentioned as T99W515. T99W515 is a LGA device, not a M.2 modem device. So correct it's name to avoid name mismatch issue. Fixes: bf30a75e6e00 ("bus: mhi: host: Add support for Foxconn SDX72 modems") Signed-off-by: Slark Xiao <slark_xiao@163.com> [mani: commit message fixup] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250606095019.383992-1-slark_xiao@163.com
2025-06-17bus: mhi: host: Make local functions staticManivannan Sadhasivam
These functions were not used outside of the file defining them. So make them static as they should be. Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20250617064906.14079-1-mani@kernel.org
2025-06-08treewide, timers: Rename from_timer() to timer_container_of()Ingo Molnar
Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com
2025-05-21Merge tag 'mhi-for-v6.16' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== - Fix conflict between MHI power up and SYSERR state transitions by issuing MHI reset only if the device is in SYSERR state while in SBL/PBL EEs. The device won't respond to reset if it is not in SYSERR state in SBL/PBL EEs. - Remove redundant call to pci_assign_resource() since PCI core calls this API internally. - Add Telit FN920C04 modem which is based on Qcom SDX35 chipset. * tag 'mhi-for-v6.16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: pci_generic: Add Telit FN920C04 modem support bus: mhi: host: pci_generic: Remove redundant assign resource usage bus: mhi: host: Fix conflict between power_up and SYSERR
2025-05-14bus: mhi: host: pci_generic: Add Telit FN920C04 modem supportDaniele Palmas
Add SDX35 based modem Telit FN920C04. $ lspci -vv 01:00.0 Unassigned class [ff00]: Qualcomm Device 011a Subsystem: Device 1c5d:2020 Signed-off-by: Daniele Palmas <dnlplm@gmail.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250401093458.2953872-1-dnlplm@gmail.com
2025-05-14bus: mhi: host: pci_generic: Remove redundant assign resource usageSubramanian Ananthanarayanan
Avoid redundant usage of pci_assign_resource for BAR allocation. This is already taken care by PCI framework. Invocation of this API leads to unnecessary relocation of BAR space to a new memory address. Signed-off-by: Subramanian Ananthanarayanan <quic_skananth@quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Link: https://patch.msgid.link/20250416-remove_assin_resource-v1-1-e92dd361fa0a@quicinc.com
2025-05-14bus: mhi: host: Fix conflict between power_up and SYSERRJeffrey Hugo
When mhi_async_power_up() enables IRQs, it is possible that we could receive a SYSERR notification from the device if the firmware has crashed for some reason. Then the SYSERR notification queues a work item that cannot execute until the pm_mutex is released by mhi_async_power_up(). So the SYSERR work item will be pending. If mhi_async_power_up() detects the SYSERR, it will handle it. If the device is in PBL, then the PBL state transition event will be queued, resulting in a work item after the pending SYSERR work item. Once mhi_async_power_up() releases the pm_mutex, the SYSERR work item can run. It will blindly attempt to reset the MHI state machine, which is the recovery action for SYSERR. PBL/SBL are not interrupt driven and will ignore the MHI Reset unless SYSERR is actively advertised. This will cause the SYSERR work item to timeout waiting for reset to be cleared, and will leave the host state in SYSERR processing. The PBL transition work item will then run, and immediately fail because SYSERR processing is not a valid state for PBL transition. This leaves the device uninitialized. This issue has a fairly unique signature in the kernel log: mhi mhi3: Requested to power ON Qualcomm Cloud AI 100 0000:36:00.0: Fatal error received from device. Attempting to recover mhi mhi3: Power on setup success mhi mhi3: Device failed to exit MHI Reset state mhi mhi3: Device MHI is not in valid state We cannot remove the SYSERR handling from mhi_async_power_up() because the device may be in the SYSERR state, but we missed the notification as the irq was fired before irqs were enabled. We also can't queue the SYSERR work item from mhi_async_power_up() if SYSERR is detected because that may result in a duplicate work item, and cause the same issue since the duplicate item will blindly issue MHI reset even if SYSERR is no longer active. Instead, add a check in the SYSERR work item to make sure that MHI reset is only issued if the device is in SYSERR state for PBL or SBL EEs. Fixes: a6e2e3522f29 ("bus: mhi: core: Add support for PM state transitions") Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Troy Hanson <quic_thanson@quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250328163526.3365497-1-jeff.hugo@oss.qualcomm.com
2025-04-24bus: mhi: ep: Update read pointer only after buffer is writtenSumit Kumar
Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated read pointer before the buffer is actually written. Updating rd_offset prematurely can lead to the host accessing an uninitialized or incomplete element, resulting in data corruption. Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability. Fixes: bbdcba57a1a2 ("bus: mhi: ep: Add support for ring management") cc: stable@vger.kernel.org Co-developed-by: Youssef Samir <quic_yabdulra@quicinc.com> Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com> Signed-off-by: Sumit Kumar <quic_sumk@quicinc.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patch.msgid.link/20250409-rp_fix-v1-1-8cf1fa22ed28@quicinc.com Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
2025-04-05treewide: Switch/rename to timer_delete[_sync]()Thomas Gleixner
timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2025-04-01Merge tag 'char-misc-6.15-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO driver updates from Greg KH: "Here is the big set of char, misc, iio, and other smaller driver subsystems for 6.15-rc1. Lots of stuff in here, including: - loads of IIO changes and driver updates - counter driver updates - w1 driver updates - faux conversions for some drivers that were abusing the platform bus interface - coresight driver updates - rust miscdevice binding updates based on real-world-use - other minor driver updates All of these have been in linux-next with no reported issues for quite a while" * tag 'char-misc-6.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (292 commits) samples: rust_misc_device: fix markup in top-level docs Coresight: Fix a NULL vs IS_ERR() bug in probe misc: lis3lv02d: convert to use faux_device tlclk: convert to use faux_device regulator: dummy: convert to use the faux device interface bus: mhi: host: Fix race between unprepare and queue_buf coresight: configfs: Constify struct config_item_type doc: iio: ad7380: describe offload support iio: ad7380: add support for SPI offload iio: light: Add check for array bounds in veml6075_read_int_time_ms iio: adc: ti-ads7924 Drop unnecessary function parameters staging: iio: ad9834: Use devm_regulator_get_enable() staging: iio: ad9832: Use devm_regulator_get_enable() iio: gyro: bmg160_spi: add of_match_table dt-bindings: iio: adc: Add i.MX94 and i.MX95 support iio: adc: ad7768-1: remove unnecessary locking Documentation: ABI: add wideband filter type to sysfs-bus-iio iio: adc: ad7768-1: set MOSI idle state to prevent accidental reset iio: adc: ad7768-1: Fix conversion result sign iio: adc: ad7124: Benefit of dev = indio_dev->dev.parent in ad7124_parse_channel_config() ...
2025-03-14Merge tag 'mhi-for-v6.15' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== - Remove unused mhi_device_get() and mhi_queue_dma() APIs. - Add support for SA8775p MHI endpoint device with IP_SW0 channel. - Fix the race between mhi_unprepare_from_transfer() and mhi_queue_buf(). * tag 'mhi-for-v6.15' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: Fix race between unprepare and queue_buf bus: mhi: host: pci_generic: Add support for SA8775P endpoint bus: mhi: host: Remove unused functions
2025-03-14bus: mhi: host: Fix race between unprepare and queue_bufJeffrey Hugo
A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. Cc: stable@vger.kernel.org # 6.8 Fixes: b89b6a863dd5 ("bus: mhi: host: Add spinlock to protect WP access when queueing TREs") Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Troy Hanson <quic_thanson@quicinc.com> Link: https://lore.kernel.org/r/20250306172913.856982-1-jeff.hugo@oss.qualcomm.com [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
2025-03-12Backmerge tag 'v6.14-rc6' into drm-nextDave Airlie
This is a backmerge from Linux 6.14-rc6, needed for the nova PR. Signed-off-by: Dave Airlie <airlied@redhat.com>
2025-02-22bus: mhi: host: pci_generic: Add support for SA8775P endpointMrinmay Sarkar
Add MHI controller config for SA8775P endpoint. SA8775P supports IP_SW usecase only. Hence use separate configuration to enable IP_SW channels. Signed-off-by: Mrinmay Sarkar <quic_msarkar@quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://lore.kernel.org/r/20241205065422.2515086-2-quic_msarkar@quicinc.com [mani: updated commit message and removed 'modem' reference in config] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
2025-02-21bus: mhi: host: Avoid possible uninitialized fw_load_typeJeffrey Hugo
If mhi_fw_load_handler() bails out early because the EE is not capable of loading firmware, we may reference fw_load_type in cleanup which is uninitialized at this point. The cleanup code checks fw_load_type as a proxy for knowing if fbc_image was allocated and needs to be freed, but we can directly test for that. This avoids the possible uninitialized access and appears to be clearer code. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/all/e3148ac4-7bb8-422d-ae0f-18a8eb15e269@stanley.mountain/ Fixes: f88f1d0998ea ("bus: mhi: host: Add a policy to enable image transfer via BHIe in PBL") Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Carl Vanderlip <quic_carlv@quicinc.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250214162109.3555300-1-quic_jhugo@quicinc.com
2025-02-19bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlockManivannan Sadhasivam
There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple places where the caller waits synchronously for the recovery to be completed. One such place is during the PM shutdown() callback. If the device is not alive during recovery_work, it will try to reset the device using pci_reset_function(). This function internally will take the device_lock() first before resetting the device. By this time, if the lock has already been acquired, then recovery_work will get stalled while waiting for the lock. And if the lock was already acquired by the caller which waits for the recovery_work to be completed, it will lead to deadlock. This is what happened on the X1E80100 CRD device when the device died before shutdown() callback. Driver core calls the driver's shutdown() callback while holding the device_lock() leading to deadlock. And this deadlock scenario can occur on other paths as well, like during the PM suspend() callback, where the driver core would hold the device_lock() before calling driver's suspend() callback. And if the recovery_work was already started, it could lead to deadlock. This is also observed on the X1E80100 CRD. So to fix both issues, use pci_try_reset_function() in recovery_work. This function first checks for the availability of the device_lock() before trying to reset the device. If the lock is available, it will acquire it and reset the device. Otherwise, it will return -EAGAIN. If that happens, recovery_work will fail with the error message "Recovery failed" as not much could be done. Cc: stable@vger.kernel.org # 5.12 Reported-by: Johan Hovold <johan@kernel.org> Closes: https://lore.kernel.org/mhi/Z1me8iaK7cwgjL92@hovoldconsulting.com Fixes: 7389337f0a78 ("mhi: pci_generic: Add suspend/resume/recovery procedure") Reviewed-by: Johan Hovold <johan+linaro@kernel.org> Tested-by: Johan Hovold <johan+linaro@kernel.org> Analyzed-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/mhi/Z2KKjWY2mPen6GPL@hovoldconsulting.com/ Reviewed-by: Loic Poulain <loic.poulain@linaro.org> Link: https://lore.kernel.org/r/20250108-mhi_recovery_fix-v1-1-a0a00a17da46@linaro.org Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
2025-02-07bus: mhi: host: Remove unused functionsDr. David Alan Gilbert
mhi_device_get() and mhi_queue_dma() haven't been used since 2020's commit 189ff97cca53 ("bus: mhi: core: Add support for data transfer") added them. Remove them. Note that mhi_queue_dma_sync() is used and has been left. Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://lore.kernel.org/r/20250127215859.261105-1-linux@treblig.org Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
2025-02-06Merge drm/drm-next into drm-misc-nextMaxime Ripard
Bring rc1 to start the new release dev. Signed-off-by: Maxime Ripard <mripard@kernel.org>
2025-01-31bus: mhi: host: Add a policy to enable image transfer via BHIe in PBLMatthew Leung
Currently, MHI host only performs firmware transfer via BHI in PBL and BHIe from SBL. To support BHIe transfer directly from PBL, a policy needs to be added. With this policy, BHIe will be used to transfer firmware in PBL if the MHI controller has BHIe regs, sets seg_len, and does not set fbc_download. The intention is to transfer firmware using BHIe in PBL without further BHIe transfers in SBL. Signed-off-by: Matthew Leung <quic_mattleun@quicinc.com> Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250117170943.2643280-3-quic_jhugo@quicinc.com
2025-01-31bus: mhi: host: Refactor BHI/BHIe based firmware loadingMatthew Leung
Refactor the firmware loading code to have distinct helper functions for BHI and BHIe operations. This lays the foundation for separating the firmware loading protocol from the firmware being loaded and the EE it is loaded in. Signed-off-by: Matthew Leung <quic_mattleun@quicinc.com> Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20250117170943.2643280-2-quic_jhugo@quicinc.com
generated by cgit v1.2.3 (git 2.0.4) at 2026-04-03 15:07:42 +0000