* Re: INFO: task hung in evdev_release
From: Mark Brown @ 2019-04-01 3:01 UTC (permalink / raw)
To: syzbot
Cc: alsa-devel, devicetree, dmitry.torokhov, jbrunet, lgirdwood,
linux-input, linux-kernel, mark.rutland, robh+dt, rydberg,
syzkaller-bugs
In-Reply-To: <000000000000bf3ccd05851d68a7@google.com>
[-- Attachment #1: Type: text/plain, Size: 374 bytes --]
On Wed, Mar 27, 2019 at 06:24:01PM -0700, syzbot wrote:
> syzbot has bisected this bug to:
This bug being...
> commit e32d99af6830c9a8f37b4f2637ef0cdc60fa79fb
> Author: Jerome Brunet <jbrunet@baylibre.com>
> Date: Tue Jul 17 15:42:50 2018 +0000
>
> ASoC: meson: add axg fifos DT binding documentation
This is fairly clearly a false bisection result.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply
* [PATCH] input: imx6ul_tsc: use devm_platform_ioremap_resource() to simplify code
From: Anson Huang @ 2019-04-01 5:19 UTC (permalink / raw)
To: dmitry.torokhov@gmail.com, shawnguo@kernel.org,
s.hauer@pengutronix.de, kernel@pengutronix.de, festevam@gmail.com,
linux-input@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
Cc: dl-linux-imx
Use the new helper devm_platform_ioremap_resource() which wraps the
platform_get_resource() and devm_ioremap_resource() together, to
simplify the code.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
---
drivers/input/touchscreen/imx6ul_tsc.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
index c10fc59..e04eecd 100644
--- a/drivers/input/touchscreen/imx6ul_tsc.c
+++ b/drivers/input/touchscreen/imx6ul_tsc.c
@@ -364,8 +364,6 @@ static int imx6ul_tsc_probe(struct platform_device *pdev)
struct device_node *np = pdev->dev.of_node;
struct imx6ul_tsc *tsc;
struct input_dev *input_dev;
- struct resource *tsc_mem;
- struct resource *adc_mem;
int err;
int tsc_irq;
int adc_irq;
@@ -403,16 +401,14 @@ static int imx6ul_tsc_probe(struct platform_device *pdev)
return err;
}
- tsc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- tsc->tsc_regs = devm_ioremap_resource(&pdev->dev, tsc_mem);
+ tsc->tsc_regs = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(tsc->tsc_regs)) {
err = PTR_ERR(tsc->tsc_regs);
dev_err(&pdev->dev, "failed to remap tsc memory: %d\n", err);
return err;
}
- adc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
- tsc->adc_regs = devm_ioremap_resource(&pdev->dev, adc_mem);
+ tsc->adc_regs = devm_platform_ioremap_resource(pdev, 1);
if (IS_ERR(tsc->adc_regs)) {
err = PTR_ERR(tsc->adc_regs);
dev_err(&pdev->dev, "failed to remap adc memory: %d\n", err);
--
2.7.4
^ permalink raw reply related
* [PATCH] input: keyboard: imx: use devm_platform_ioremap_resource() to simplify code
From: Anson Huang @ 2019-04-01 5:28 UTC (permalink / raw)
To: dmitry.torokhov@gmail.com, shawnguo@kernel.org,
s.hauer@pengutronix.de, kernel@pengutronix.de, festevam@gmail.com,
linux-input@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
Cc: dl-linux-imx
Use the new helper devm_platform_ioremap_resource() which wraps the
platform_get_resource() and devm_ioremap_resource() together, to
simplify the code.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
---
drivers/input/keyboard/imx_keypad.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index 539cb67..cf08f4a 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -422,7 +422,6 @@ static int imx_keypad_probe(struct platform_device *pdev)
dev_get_platdata(&pdev->dev);
struct imx_keypad *keypad;
struct input_dev *input_dev;
- struct resource *res;
int irq, error, i, row, col;
if (!keymap_data && !pdev->dev.of_node) {
@@ -455,8 +454,7 @@ static int imx_keypad_probe(struct platform_device *pdev)
timer_setup(&keypad->check_matrix_timer,
imx_keypad_check_for_events, 0);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- keypad->mmio_base = devm_ioremap_resource(&pdev->dev, res);
+ keypad->mmio_base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(keypad->mmio_base))
return PTR_ERR(keypad->mmio_base);
--
2.7.4
^ permalink raw reply related
* Re: [PATCH] input: keyboard: imx: use devm_platform_ioremap_resource() to simplify code
From: Mukesh Ojha @ 2019-04-01 7:59 UTC (permalink / raw)
To: Anson Huang, dmitry.torokhov@gmail.com, shawnguo@kernel.org,
s.hauer@pengutronix.de, kernel@pengutronix.de, festevam@gmail.com,
linux-input@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
Cc: dl-linux-imx
In-Reply-To: <1554096209-17870-1-git-send-email-Anson.Huang@nxp.com>
On 4/1/2019 10:58 AM, Anson Huang wrote:
> Use the new helper devm_platform_ioremap_resource() which wraps the
> platform_get_resource() and devm_ioremap_resource() together, to
> simplify the code.
>
> Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Cheers,
-Mukesh
> ---
> drivers/input/keyboard/imx_keypad.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
> index 539cb67..cf08f4a 100644
> --- a/drivers/input/keyboard/imx_keypad.c
> +++ b/drivers/input/keyboard/imx_keypad.c
> @@ -422,7 +422,6 @@ static int imx_keypad_probe(struct platform_device *pdev)
> dev_get_platdata(&pdev->dev);
> struct imx_keypad *keypad;
> struct input_dev *input_dev;
> - struct resource *res;
> int irq, error, i, row, col;
>
> if (!keymap_data && !pdev->dev.of_node) {
> @@ -455,8 +454,7 @@ static int imx_keypad_probe(struct platform_device *pdev)
> timer_setup(&keypad->check_matrix_timer,
> imx_keypad_check_for_events, 0);
>
> - res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> - keypad->mmio_base = devm_ioremap_resource(&pdev->dev, res);
> + keypad->mmio_base = devm_platform_ioremap_resource(pdev, 0);
> if (IS_ERR(keypad->mmio_base))
> return PTR_ERR(keypad->mmio_base);
>
^ permalink raw reply
* Re: [PATCH] input: imx6ul_tsc: use devm_platform_ioremap_resource() to simplify code
From: Mukesh Ojha @ 2019-04-01 8:02 UTC (permalink / raw)
To: Anson Huang, dmitry.torokhov@gmail.com, shawnguo@kernel.org,
s.hauer@pengutronix.de, kernel@pengutronix.de, festevam@gmail.com,
linux-input@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
Cc: dl-linux-imx
In-Reply-To: <1554095712-15413-1-git-send-email-Anson.Huang@nxp.com>
On 4/1/2019 10:49 AM, Anson Huang wrote:
> Use the new helper devm_platform_ioremap_resource() which wraps the
> platform_get_resource() and devm_ioremap_resource() together, to
> simplify the code.
>
> Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Cheers,
-Mukesh
> ---
> drivers/input/touchscreen/imx6ul_tsc.c | 8 ++------
> 1 file changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
> index c10fc59..e04eecd 100644
> --- a/drivers/input/touchscreen/imx6ul_tsc.c
> +++ b/drivers/input/touchscreen/imx6ul_tsc.c
> @@ -364,8 +364,6 @@ static int imx6ul_tsc_probe(struct platform_device *pdev)
> struct device_node *np = pdev->dev.of_node;
> struct imx6ul_tsc *tsc;
> struct input_dev *input_dev;
> - struct resource *tsc_mem;
> - struct resource *adc_mem;
> int err;
> int tsc_irq;
> int adc_irq;
> @@ -403,16 +401,14 @@ static int imx6ul_tsc_probe(struct platform_device *pdev)
> return err;
> }
>
> - tsc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> - tsc->tsc_regs = devm_ioremap_resource(&pdev->dev, tsc_mem);
> + tsc->tsc_regs = devm_platform_ioremap_resource(pdev, 0);
> if (IS_ERR(tsc->tsc_regs)) {
> err = PTR_ERR(tsc->tsc_regs);
> dev_err(&pdev->dev, "failed to remap tsc memory: %d\n", err);
> return err;
> }
>
> - adc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
> - tsc->adc_regs = devm_ioremap_resource(&pdev->dev, adc_mem);
> + tsc->adc_regs = devm_platform_ioremap_resource(pdev, 1);
> if (IS_ERR(tsc->adc_regs)) {
> err = PTR_ERR(tsc->adc_regs);
> dev_err(&pdev->dev, "failed to remap adc memory: %d\n", err);
^ permalink raw reply
* RE: [PATCH] ELAN touchpad i2c_hid bugs fix
From: 廖崇榮 @ 2019-04-01 12:26 UTC (permalink / raw)
To: 'Dmitry Torokhov', 'Hans de Goede'
Cc: 'Vladislav Dalechyn', 'Benjamin Tissoires',
'Jiri Kosina', kai.heng.feng, swboyd, bigeasy,
'open list:HID CORE LAYER', 'lkml', hotwater438
In-Reply-To: <CAE_wzQ8f6F7EvF-Jti=nPrUZw2bN1NGGCFJFohJv2m11GbMfGw@mail.gmail.com>
Hi Dmitry,
-----Original Message-----
From: Dmitry Torokhov [mailto:dtor@chromium.org]
Sent: Saturday, March 30, 2019 2:24 AM
To: Hans de Goede; 廖崇榮
Cc: Vladislav Dalechyn; Benjamin Tissoires; Jiri Kosina; kai.heng.feng@canonical.com; swboyd@chromium.org; bigeasy@linutronix.de; open list:HID CORE LAYER; lkml; hotwater438@tutanota.com
Subject: Re: [PATCH] ELAN touchpad i2c_hid bugs fix
On Fri, Mar 29, 2019 at 5:18 AM Hans de Goede <hdegoede@redhat.com> wrote:
>
> Hi,
>
> On 3/25/19 5:56 PM, Dmitry Torokhov wrote:
> > Hi Hans,
> >
> > On Mon, Mar 25, 2019 at 9:38 AM Hans de Goede <hdegoede@redhat.com> wrote:
> >>
> >> Hi Dmitry,
> >>
> >> On 25-03-19 17:02, Dmitry Torokhov wrote:
> >>> Hi Vladislav,
> >>>
> >>> On Mon, Mar 25, 2019 at 5:57 AM Vladislav Dalechyn
> >>> <vlad.dalechin@gmail.com> wrote:
> >>>>
> >>>> From: Vladislav Dalechyn <hotwater438@tutanota.com>
> >>>>
> >>>> Description: The ELAN1200:04F3:303E touchpad exposes several
> >>>> issues, all caused by an error setting the correct IRQ_TRIGGER flag:
> >>>> - i2c_hid incoplete error flood in journalctl;
> >>>> - Five finger tap kill's module so you have to restart it;
> >>>> - Two finger scoll is working incorrect and sometimes even when
> >>>> you raised one of two finger still thinks that you are scrolling.
> >>>>
> >>>> Fix all of these with a new quirk that corrects the trigger flag
> >>>> announced by the ACPI tables. (edge-falling).
> >>>
> >>> I do not believe this is right solution. The driver makes liberal
> >>> use of disable_irq() and enable_irq() which may lead to lost edges
> >>> and touchpad stopping working altogether.
> >>>
> >>> Usually the "extra" report is caused by GPIO controller clearing
> >>> interrupt condition at the wrong time (too early), or in unsafe or
> >>> racy fashion. You need to look there instead of adding quirk to
> >>> i2c-hid.
> >>
> >> The falling-edge solution was proposed by Elan themselves.
> >>
> >> Also if you look at:
> >> https://bugzilla.redhat.com/show_bug.cgi?id=1543769
> >>
> >> And esp. the "cat /proc/interrupts" output there, then you will see
> >> that the interrupt seems to be stuck at low level, which according
> >> to the ACPI tables is its active level.
> >
> > So how does it generate a new edge if it is stuck at low?
> >
> > Is it bad touchpad firmware that does not deassert interrupt quickly
> > enough?
>
> I do not believe it is not de-asserting it quick enough (I believe the
> amount of interrups is too high for that.
>
> It seems to simply be low most of the time, or it is really really
> slow with de-asserting.
>
> Vladislav can you check the output of /cat/interrupts on a kernel
> without the patch and while *not* using the touchpad; and check if the
> amount of touchpads-interrupts still keeps increasing in this case?
>
> Also I believe that you had contact with Elan about this and they told
> you to change the interrupt type to falling-edge as work-around,
> right? Can you ask them why?
KT, do you know anything about using edge interrupts with your hid-over-i2c products?
Ya, I sent the patch to Vladislav for testing his 5 finger-tap issue.
The patch is created by Dell/Intel for debugging Elan PTP's incomplete report message.
Host tried to get report again while touchpad finish report transmission.
I excerpt from Dell's mail
===========Begin=========================
We have worked with Intel for a while to revise Linux kernel driver code to prevent Touch I2C error message show up,
And Intel dig out there’re 2 issues to cause this i2c error on Linux kernel 4.18.
Therefore Intel suggested to revised SW code into “trigger falling edge + pm_disabled + IRQF_SHARED | IRQF_COND_SUSPEND(i2c-designware-master.c)”
and then we can get positive result that i2c error message disappeared when Touch Panel is working.
Since this issue only happened on ELAN touch pad + Intel GLK platform (Linux) and other Intel reference platform (Whisky lake) won’t, would you help check the solution (as patch attached) and let us know if any question/concern for this modification?
===========End=========================
I don't know the root cause of 5-finger issue with level trigger so far.
I will check it once I get the touchpad with the same issue.
>From previous issue list, it seems that some touchpad's crush issue will be fixed by edge trigger.
I have discussed with FW engineer, both level and edge trigger should be OK for our PTP(HID touchpad).
I summary the behavior of our HID touchpad's interrupt.
1. Assert for Every finger's report, which means 5 ISR for 5 finger operation.
2. We will de-assert INT pin after the last byte's NACK signal.
I checked LA scope, 2nd finger's assert will happen after 10us if two finger touch.
SYNAPTICS's touchpad will de-assert it after address byte sent.
I am not sure if SYNAPTICE's earlier de-asserting is a better way for level-trigger?
At least we never see issue happen on our PTP in Windows 10.
>
> This is quite unususal, I've collected quite a few DSDTs over time and
> I've just checked about 40 of them all with a PNP0C50 in some form
> (and in many cases multiple such devices) and NONE of them is using
> edged-interrupts in the ACPI config.
That is because MS spec for HID over I2C requires level interrupts:
"7.4 Interrupt Line Management
DEVICE is responsible to assert the interrupt line (level trigger interrupt required) when it has data.
DEVICE must keep the interrupt line asserted until the data has been fully read by the HOST. After this point, the DEVICE must de-assert the interrupt line if it has no more data to report to the HOST.
When the DEVICE has new data to report, it must repeat the process above."
See https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn642101(v=vs.85)
>
> <speculation>
>
> I think that the Elan touchpad firmware supports a mode to work on
> devices which only support edge interrupts and that this mode is
> accidentally enabled in this firmware.
>
> I think that the interrupt line is simply low all the time and gets
> pulsed high then low again when the touchpad detects a finger.
> Hopefully it does this pulsing on every event and not only when its
> event "fifo" is empty.
This behavior would violate HID-over-I2C spec though.
>
> </speculation>
>
> > I scrolled through the bug but I do not see if it had been confirmed
> > that original windows installation actually uses edge (it may very
> > well be using it; Elan engineers pushed us to use edge in a few
> > cases, but they all boiled down to an issue with pin control/GPIO
> > implementation).
>
> This has not been checked on Windows AFAIK.
>
> >> As for this being a GPIO chip driver problem, this is using
> >> standard Intel pinctrl stuff, which is not showing this same issue
> >> with many other i2c-hid touchpads.
> >
> > Well, there have been plenty of issues in intel drivers, coupled
> > with "interesting" things done by firmware and boards.
> >
> > If you want to keep on using edge you need to make sure that i2c-hid
> > never loses edge, as replaying of previously disabled interrupts in
> > not at all reliable. So you need to "kick" the device after
> > enable_irq() by initiating read from it and be ready to not get any
> > data or get valid data and process accordingly.
>
> That is a good point and I agree.
>
> Vladislav, let me explain this a bit. Normally the touchpad driver the
> IRQ line low when it has touch-data to respond, which means that if
> touch-data is reported before the driver loads (or while the driver
> has the irq disabled during e.g. suspend), it will immediately see an
> interrupt. If we use edge mode then the IRQ will only trigger when the
> IRQ line goes from high to low, if this happens when the driver is not
> listening then we do not see the edge. And since we never read the
> pending touch-data, the IRQ line never goes high again (which it does
> when we have read all available data), so we will never see a
> negative-edge and then things are stuck.
>
> It would be good, if running a kernel with your patch, you can try to
> trigger this by:
>
> 1) Suspending the machine by selecting suspend from a menu in your
> desktop environment, or by briefly pressing the power-button, do not
> close the lid
> 2) As soon as the system starts suspending and while it is suspended,
> move your finger around the touchpad
> 3) Wake the system up with the powerbutton while moving your finger
> around
> 4) Check if the touchpad still works after this
>
> Or by:
>
> 1) Using ctrl + alt + f3 to switch to a text console
> 2) Move finger around on touchpad, keep moving it around
> 3) Switch back to X11 with alt + f2 or alt + f7, while still moving
> the finger
> 4) Check if the touchpad still works after this
>
> If neither causes the touchpad to stop working, then at least the
> problem Dmitry fears is not easy to trigger, but we should probably
> still prepare to deal with it; and we really should try to better
> understand the problem here, so if you can answer my questions above, then that would be great.
Thanks.
--
Dmitry
^ permalink raw reply
* Re: [PATCH v3] HID: intel-ish-hid: ISH firmware loader client driver
From: Nick Crews @ 2019-04-01 21:17 UTC (permalink / raw)
To: Joe Perches
Cc: Rushikesh S Kadam, Srinivas Pandruvada, benjamin.tissoires, jikos,
jettrink, Gwendal Grignou, linux-kernel, linux-input
In-Reply-To: <e2d8ab93c97acf1254830e6f51edb8f19c8767d6.camel@perches.com>
I tried to send the last message from my phone, and surprise it wasn't
formatted correctly, so it may have been marked as spam. repeating
myself again...
Ah, I guess I was wrong about logging OOM. I hadn’t hear about the
recommendations against it, but they make sense. Thanks for the
clarifications!
On Sat, Mar 30, 2019 at 10:27 AM Joe Perches <joe@perches.com> wrote:
>
> On Sat, 2019-03-30 at 15:52 +0530, Rushikesh S Kadam wrote:
> > On Fri, Mar 29, 2019 at 04:30:18PM -0700, Nick Crews wrote:
> > > On Fri, Mar 29, 2019 at 1:03 PM Rushikesh S Kadam
> > > <rushikesh.s.kadam@intel.com> wrote:
> > > > + ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
> > > > + if (!ldr_xfer_ipc_frag) {
> > > Log error here.
> > The error code is logged in calling function
> > load_fw_from_host(). Is that good enough?
> >
> > I believe the checkpatch script too, would
> > recommend against adding debug print for ENOMEM
> > error.
>
> The generic kernel allocation functions already do
> a dump_stack() on OOM conditions when called without
> __GFP_NOWARN so any additional OOM message isn't
> particularly useful.
>
> > Again, I thought it was against practise to log
> > "out of memory" debug prints in probe()
>
> Or anywhere else given the generic OOM stack dump.
>
> > But will add if you tell me this is the right way.
> >
> > > > + return -ENOMEM;
> > > > +
> > > > + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> > > > + if (!loader_ishtp_cl)
> > >
> > > log error here
>
> The ishtp_cl_allocate function just calls kmalloc then
> initializes the struct so an additional OOM message
> isn't useful here either.
>
>
^ permalink raw reply
* RE: [PATCH] ELAN touchpad i2c_hid bugs fix
From: Mario.Limonciello @ 2019-04-01 21:37 UTC (permalink / raw)
To: andy.shevchenko, kai.heng.feng
Cc: hdegoede, benjamin.tissoires, hotwater438, jikos, swboyd, bigeasy,
dtor, linux-input, linux-kernel
In-Reply-To: <CAHp75VdTMn_v8ag11jo6aYtuiWL4bhvSzCnhaUBtuqSQxxnT_w@mail.gmail.com>
> -----Original Message-----
> From: Andy Shevchenko <andy.shevchenko@gmail.com>
> Sent: Thursday, March 21, 2019 4:48 AM
> To: Kai-Heng Feng; Limonciello, Mario
> Cc: Hans de Goede; Benjamin Tissoires; hotwater438@tutanota.com; Jiri Kosina;
> Stephen Boyd; Sebastian Andrzej Siewior; Dmitry Torokhov; open list:HID CORE
> LAYER; lkml
> Subject: Re: [PATCH] ELAN touchpad i2c_hid bugs fix
>
>
> [EXTERNAL EMAIL]
>
> +Cc: Mario
>
> Mario, do you have any insights about the issue with touchpad on Dell
> system described below?
My apologies, this got lost while I was on vacation.
>
> On Thu, Mar 21, 2019 at 6:08 AM Kai-Heng Feng
> <kai.heng.feng@canonical.com> wrote:
> >
> > at 01:18, Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
> >
> > > On Wed, Mar 20, 2019 at 6:55 PM Kai-Heng Feng
> > > <kai.heng.feng@canonical.com> wrote:
> > >> at 23:39, Hans de Goede <hdegoede@redhat.com> wrote:
> > >>> On 3/20/19 3:37 PM, Benjamin Tissoires wrote:
> > >
> > >>> Benjamin, what I find interesting here is that the BOGUS_IRQ quirk
> > >>> is also used on Elan devices, I suspect that these Elan devices
> > >>> likely also need the I2C_HID_QUIRK_FORCE_TRIGGER_FALLING quirk
> > >>> and then they probably will no longer need the bogus IRQ flag,
> > >>> if you know about bugreports with an acpidump for any of the devices
> > >>> needing the bogus IRQ quirk, then I (or you) can check how the IRQ is
> > >>> declared there, I suspect it will be declared as level-low, just like
> > >>> with the laptop this patch was written for. And it probably need to
> > >>> be edge-falling instead of level-low just like this case.
> > >>
> > >> First, I’ve already tried using IRQF_TRIGGER_FALLING, unfortunately it
> > >> doesn’t solve the issue for me.
> > >>
> > >> I talked to Elan once, and they confirm the correct IRQ trigger is level
> > >> low. So forcing falling trigger may break other platforms.
> > >
> > > As far as I understood Vladislav the quirk he got from Elan as well.
> >
> > Ok, then this is really weird.
> >
> > >
> > >> Recently we found that Elan touchpad doesn’t like GpioInt() from its _CRS.
> > >> Once the Interrupt() is used instead, the issue goes away.
> > >
> > > IIRC i2c core tries to get interrupt from Interrupt() resource and
> > > then falls back to GpioInt().
> > > See i2c_acpi_get_info() and i2c_device_probe().
> >
> > Here’s its ASL:
> >
> > Scope (\_SB.PCI0.I2C4)
> > {
> > Device (TPD0)
> > {
> > Name (_ADR, One) // _ADR: Address
> > Name (_HID, "DELL08AE") // _HID: Hardware ID
> > Name (_CID, "PNP0C50" /* HID Protocol Device (I2C bus) */) // _CID:
> Compatible ID
> > Name (_UID, One) // _UID: Unique ID
> > Name (_S0W, 0x04) // _S0W: S0 Device Wake State
> > Name (SBFB, ResourceTemplate ()
> > {
> > I2cSerialBusV2 (0x002C, ControllerInitiated, 0x00061A80,
> > AddressingMode7Bit, "\\_SB.PCI0.I2C4",
> > 0x00, ResourceConsumer, , Exclusive,
> > )
> > })
> > Name (SBFG, ResourceTemplate ()
> > {
> > GpioInt (Level, ActiveLow, ExclusiveAndWake, PullUp, 0x0000,
> > "\\_SB.GPO1", 0x00, ResourceConsumer, ,
> > )
> > { // Pin list
> > 0x0012
> > }
> > })
> > Name (SBFI, ResourceTemplate ()
> > {
> > Interrupt (ResourceConsumer, Level, ActiveLow, ExclusiveAndWake, ,, )
> > {
> > 0x0000003C,
> > }
> > })
> > Method (_INI, 0, NotSerialized) // _INI: Initialize
> > {
> > }
> > Method (_STA, 0, NotSerialized) // _STA: Status
> > {
> > If ((TCPD == One))
> > {
> > Return (0x0F)
> > }
> >
> > Return (Zero)
> > }
> > Method (_CRS, 0, NotSerialized) // _CRS: Current Resource Settings
> > {
> > If ((OSYS < 0x07DC))
> > {
> > Return (SBFI) /* \_SB_.PCI0.I2C4.TPD0.SBFI */
> > }
> >
> > Return (ConcatenateResTemplate (SBFB, SBFG))
> > }
> > Method (_DSM, 4, NotSerialized) // _DSM: Device-Specific Method
> > {
> > If ((Arg0 == ToUUID ("3cdff6f7-4267-4555-ad05-b30a3d8938de") /* HID
> I2C Device */))
> > {
> > If ((Arg2 == Zero))
> > {
> > If ((Arg1 == One))
> > {
> > Return (Buffer (One)
> > {
> > 0x03 // .
> > })
> > }
> > Else
> > {
> > Return (Buffer (One)
> > {
> > 0x00 // .
> > })
> > }
> > }
> > ElseIf ((Arg2 == One))
> > {
> > Return (0x20)
> > }
> > Else
> > {
> > Return (Buffer (One)
> > {
> > 0x00 // .
> > })
> > }
> > }
> > ElseIf ((Arg0 == ToUUID ("ef87eb82-f951-46da-84ec-14871ac6f84b")))
> > {
> > If ((Arg2 == Zero))
> > {
> > If ((Arg1 == One))
> > {
> > Return (Buffer (One)
> > {
> > 0x03 // .
> > })
> > }
> > }
> >
> > If ((Arg2 == One))
> > {
> > Return (ConcatenateResTemplate (SBFB, SBFG))
> > }
> >
> > Return (Buffer (One)
> > {
> > 0x00 // .
> > })
> > }
> > }
> > Else
> > {
> > Return (Buffer (One)
> > {
> > 0x00 // .
> > })
> > }
> > }
> > }
> > }
> >
> > Change SBFG to SBFI in its _CRS can workaround the issue.
> > Is ASL in this form possible to do the flow you described?
> >
> > Kai-Heng
> >
> > >
> > >> But I am not sure how to patch its DSDT/SSDT in i2c-hid.
Is this pre-production HW? If so, maybe this is a case that we should talk
about custom OSI string to run the ASL differently.
The other option would be to create a new ASL method in FW and from Linux
side a quirk that calls this new ASL method.
^ permalink raw reply
* Re: [PATCH v4] HID: intel-ish-hid: ISH firmware loader client driver
From: Nick Crews @ 2019-04-01 23:13 UTC (permalink / raw)
To: Rushikesh S Kadam
Cc: Srinivas Pandruvada, benjamin.tissoires, jikos, jettrink,
Gwendal Grignou, linux-kernel, linux-input
In-Reply-To: <1553945015-10919-1-git-send-email-rushikesh.s.kadam@intel.com>
Looks good to me! Thanks for the work!
On Sat, Mar 30, 2019 at 5:23 AM Rushikesh S Kadam
<rushikesh.s.kadam@intel.com> wrote:
>
> This driver adds support for loading Intel Integrated
> Sensor Hub (ISH) firmware from host file system to ISH
> SRAM and start execution.
>
> At power-on, the ISH subsystem shall boot to an interim
> Shim loader-firmware, which shall expose an ISHTP loader
> device.
>
> The driver implements an ISHTP client that communicates
> with the Shim ISHTP loader device over the intel-ish-hid
> stack, to download the main ISH firmware.
>
> Signed-off-by: Rushikesh S Kadam <rushikesh.s.kadam@intel.com>
> ---
> The patches are baselined to hid git tree, branch for-5.2/ish
> https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git/log/?h=for-5.2/ish
>
> v4
> - Changed process_recv() to wake the caller in case of
> error as well. Earlier caller would wait until timeout on
> an error.
> - Change sequence of few checks in process_recv().
>
> v3
> - Moved a couple of sanity checks from loader_cl_send() to
> process_recv().
> - Several minor changes to address review comments.
>
> v2
> - Change loader_cl_send() so that the calling function
> shall allocate and pass the buffer to be used for
> receiving firwmare response data. Corresponding changes
> in calling function and process_recv().
> - Introduced struct response_info to encapsulate and pass
> data between from the process_recv() callback to
> calling function loader_cl_send().
> - Keep count of host firmware load retries, and fail after
> 3 unsuccessful attempts.
> - Dropped report_bad_packets() function previously used for
> keeping count of bad packets.
> - Inlined loader_ish_hw_reset()'s functionality
>
> v1
> - Initial version.
>
> drivers/hid/Makefile | 1 +
> drivers/hid/intel-ish-hid/Kconfig | 15 +
> drivers/hid/intel-ish-hid/Makefile | 3 +
> drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 1085 +++++++++++++++++++++++++++
> 4 files changed, 1104 insertions(+)
> create mode 100644 drivers/hid/intel-ish-hid/ishtp-fw-loader.c
>
> diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
> index 170163b..d8d393e 100644
> --- a/drivers/hid/Makefile
> +++ b/drivers/hid/Makefile
> @@ -134,3 +134,4 @@ obj-$(CONFIG_USB_KBD) += usbhid/
> obj-$(CONFIG_I2C_HID) += i2c-hid/
>
> obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/
> +obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
> diff --git a/drivers/hid/intel-ish-hid/Kconfig b/drivers/hid/intel-ish-hid/Kconfig
> index 519e4c8..786adbc 100644
> --- a/drivers/hid/intel-ish-hid/Kconfig
> +++ b/drivers/hid/intel-ish-hid/Kconfig
> @@ -14,4 +14,19 @@ config INTEL_ISH_HID
> Broxton and Kaby Lake.
>
> Say Y here if you want to support Intel ISH. If unsure, say N.
> +
> +config INTEL_ISH_FIRMWARE_DOWNLOADER
> + tristate "Host Firmware Load feature for Intel ISH"
> + depends on INTEL_ISH_HID
> + depends on X86
> + help
> + The Integrated Sensor Hub (ISH) enables the kernel to offload
> + sensor polling and algorithm processing to a dedicated low power
> + processor in the chipset.
> +
> + The Host Firmware Load feature adds support to load the ISH
> + firmware from host file system at boot.
> +
> + Say M here if you want to support Host Firmware Loading feature
> + for Intel ISH. If unsure, say N.
> endmenu
> diff --git a/drivers/hid/intel-ish-hid/Makefile b/drivers/hid/intel-ish-hid/Makefile
> index 825b70a..2de97e4 100644
> --- a/drivers/hid/intel-ish-hid/Makefile
> +++ b/drivers/hid/intel-ish-hid/Makefile
> @@ -20,4 +20,7 @@ obj-$(CONFIG_INTEL_ISH_HID) += intel-ishtp-hid.o
> intel-ishtp-hid-objs := ishtp-hid.o
> intel-ishtp-hid-objs += ishtp-hid-client.o
>
> +obj-$(CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ishtp-loader.o
> +intel-ishtp-loader-objs += ishtp-fw-loader.o
> +
> ccflags-y += -Idrivers/hid/intel-ish-hid/ishtp
> diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> new file mode 100644
> index 0000000..e770e22
> --- /dev/null
> +++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> @@ -0,0 +1,1085 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * ISH-TP client driver for ISH firmware loading
> + *
> + * Copyright (c) 2019, Intel Corporation.
> + */
> +
> +#include <linux/firmware.h>
> +#include <linux/module.h>
> +#include <linux/pci.h>
> +#include <linux/intel-ish-client-if.h>
> +#include <linux/property.h>
> +#include <asm/cacheflush.h>
> +
> +/* Number of times we attempt to load the firmware before giving up */
> +#define MAX_LOAD_ATTEMPTS 3
> +
> +/* ISH TX/RX ring buffer pool size */
> +#define LOADER_CL_RX_RING_SIZE 1
> +#define LOADER_CL_TX_RING_SIZE 1
> +
> +/*
> + * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
> + * used to temporarily hold the data transferred from host to Shim
> + * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
> + * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
> + * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
> + * have a max payload of 3968 bytes (= 32 x 124 payload).
> + */
> +#define LOADER_SHIM_IPC_BUF_SIZE 3968
> +
> +/**
> + * enum ish_loader_commands - ISH loader host commands.
> + * LOADER_CMD_XFER_QUERY Query the Shim firmware loader for
> + * capabilities
> + * LOADER_CMD_XFER_FRAGMENT Transfer one firmware image fragment at a
> + * time. The command may be executed
> + * multiple times until the entire firmware
> + * image is downloaded to SRAM.
> + * LOADER_CMD_START Start executing the main firmware.
> + */
> +enum ish_loader_commands {
> + LOADER_CMD_XFER_QUERY = 0,
> + LOADER_CMD_XFER_FRAGMENT,
> + LOADER_CMD_START,
> +};
> +
> +/* Command bit mask */
> +#define CMD_MASK GENMASK(6, 0)
> +#define IS_RESPONSE BIT(7)
> +
> +/*
> + * ISH firmware max delay for one transmit failure is 1 Hz,
> + * and firmware will retry 2 times, so 3 Hz is used for timeout.
> + */
> +#define ISHTP_SEND_TIMEOUT (3 * HZ)
> +
> +/*
> + * Loader transfer modes:
> + *
> + * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
> + * transfer data. This may use IPC or DMA if supported in firmware.
> + * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
> + * both IPC & DMA (legacy).
> + *
> + * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
> + * from the sensor data streaming. Here we download a large (300+ Kb)
> + * image directly to ISH SRAM memory. There is limited benefit of
> + * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
> + * this "direct dma" mode, where we do not use ISH-TP for DMA, but
> + * instead manage the DMA directly in kernel driver and Shim firmware
> + * loader (allocate buffer, break in chucks and transfer). This allows
> + * to overcome 4 Kb limit, and optimize the data flow path in firmware.
> + */
> +#define LOADER_XFER_MODE_DIRECT_DMA BIT(0)
> +#define LOADER_XFER_MODE_ISHTP BIT(1)
> +
> +/* ISH Transport Loader client unique GUID */
> +static const guid_t loader_ishtp_guid =
> + GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
> + 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc);
> +
> +#define FILENAME_SIZE 256
> +
> +/*
> + * The firmware loading latency will be minimum if we can DMA the
> + * entire ISH firmware image in one go. This requires that we allocate
> + * a large DMA buffer in kernel, which could be problematic on some
> + * platforms. So here we limit the DMA buffer size via a module_param.
> + * We default to 4 pages, but a customer can set it to higher limit if
> + * deemed appropriate for his platform.
> + */
> +static int dma_buf_size_limit = 4 * PAGE_SIZE;
> +
> +/**
> + * struct loader_msg_hdr - Header for ISH Loader commands.
> + * @command: LOADER_CMD* commands. Bit 7 is the response.
> + * @status: Command response status. Non 0, is error
> + * condition.
> + *
> + * This structure is used as header for every command/data sent/received
> + * between Host driver and ISH Shim firmware loader.
> + */
> +struct loader_msg_hdr {
> + u8 command;
> + u8 reserved[2];
> + u8 status;
> +} __packed;
> +
> +struct loader_xfer_query {
> + struct loader_msg_hdr hdr;
> + u32 image_size;
> +} __packed;
> +
> +struct ish_fw_version {
> + u16 major;
> + u16 minor;
> + u16 hotfix;
> + u16 build;
> +} __packed;
> +
> +union loader_version {
> + u32 value;
> + struct {
> + u8 major;
> + u8 minor;
> + u8 hotfix;
> + u8 build;
> + };
> +} __packed;
> +
> +struct loader_capability {
> + u32 max_fw_image_size;
> + u32 xfer_mode;
> + u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
> +} __packed;
> +
> +struct shim_fw_info {
> + struct ish_fw_version ish_fw_version;
> + u32 protocol_version;
> + union loader_version ldr_version;
> + struct loader_capability ldr_capability;
> +} __packed;
> +
> +struct loader_xfer_query_response {
> + struct loader_msg_hdr hdr;
> + struct shim_fw_info fw_info;
> +} __packed;
> +
> +struct loader_xfer_fragment {
> + struct loader_msg_hdr hdr;
> + u32 xfer_mode;
> + u32 offset;
> + u32 size;
> + u32 is_last;
> +} __packed;
> +
> +struct loader_xfer_ipc_fragment {
> + struct loader_xfer_fragment fragment;
> + u8 data[] ____cacheline_aligned; /* variable length payload here */
> +} __packed;
> +
> +struct loader_xfer_dma_fragment {
> + struct loader_xfer_fragment fragment;
> + u64 ddr_phys_addr;
> +} __packed;
> +
> +struct loader_start {
> + struct loader_msg_hdr hdr;
> +} __packed;
> +
> +/**
> + * struct response_info - Encapsulate firmware response related
> + * information for passing between function
> + * loader_cl_send() and process_recv() callback.
> + * @data Copy the data received from firmware here.
> + * @max_size Max size allocated for the @data buffer. If the
> + * received data exceeds this value, we log an
> + * error.
> + * @size Actual size of data received from firmware.
> + * @error Returns 0 for success, negative error code for a
> + * failure in function process_recv().
> + * @received Set to true on receiving a valid firmware
> + * response to host command
> + * @wait_queue Wait queue for Host firmware loading where the
> + * client sends message to ISH firmware and waits
> + * for response
> + */
> +struct response_info {
> + void *data;
> + size_t max_size;
> + size_t size;
> + int error;
> + bool received;
> + wait_queue_head_t wait_queue;
> +};
> +
> +/**
> + * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
> + * @work_ishtp_reset: Work queue for reset handling.
> + * @work_fw_load: Work queue for host firmware loading.
> + * @flag_retry Flag for indicating host firmware loading should
> + * be retried.
> + * @retry_count Count the number of retries.
> + *
> + * This structure is used to store data per client.
> + */
> +struct ishtp_cl_data {
> + struct ishtp_cl *loader_ishtp_cl;
> + struct ishtp_cl_device *cl_device;
> +
> + /*
> + * Used for passing firmware response information between
> + * loader_cl_send() and process_recv() callback.
> + */
> + struct response_info response;
> +
> + struct work_struct work_ishtp_reset;
> + struct work_struct work_fw_load;
> +
> + /*
> + * In certain failure scenrios, it makes sense to reset the ISH
> + * subsystem and retry Host firmware loading (e.g. bad message
> + * packet, ENOMEM, etc.). On the other hand, failures due to
> + * protocol mismatch, etc., are not recoverable. We do not
> + * retry them.
> + *
> + * If set, the flag indicates that we should re-try the
> + * particular failure.
> + */
> + bool flag_retry;
> + int retry_count;
> +};
> +
> +#define IPC_FRAGMENT_DATA_PREAMBLE \
> + offsetof(struct loader_xfer_ipc_fragment, data)
> +
> +#define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
> +
> +/**
> + * get_firmware_variant() - Gets the filename of firmware image to be
> + * loaded based on platform variant.
> + * @client_data Client data instance.
> + * @filename Returns firmware filename.
> + *
> + * Queries the firmware-name device property string.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int get_firmware_variant(struct ishtp_cl_data *client_data,
> + char *filename)
> +{
> + int rv;
> + const char *val;
> + struct device *devc = ishtp_get_pci_device(client_data->cl_device);
> +
> + rv = device_property_read_string(devc, "firmware-name", &val);
> + if (rv < 0) {
> + dev_err(devc,
> + "Error: ISH firmware-name device property required\n");
> + return rv;
> + }
> + return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
> +}
> +
> +/**
> + * loader_cl_send() Send message from host to firmware
> + * @client_data: Client data instance
> + * @out_msg Message buffer to be sent to firmware
> + * @out_size Size of out going message
> + * @in_msg Message buffer where the incoming data copied.
> + * This buffer is allocated by calling
> + * @in_size Max size of incoming message
> + *
> + * Return: Number of bytes copied in the in_msg on success, negative
> + * error code on failure.
> + */
> +static int loader_cl_send(struct ishtp_cl_data *client_data,
> + u8 *out_msg, size_t out_size,
> + u8 *in_msg, size_t in_size)
> +{
> + int rv;
> + struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
> + struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "%s: command=%02lx is_response=%u status=%02x\n",
> + __func__,
> + out_hdr->command & CMD_MASK,
> + out_hdr->command & IS_RESPONSE ? 1 : 0,
> + out_hdr->status);
> +
> + /* Setup in coming buffer & size */
> + client_data->response.data = in_msg;
> + client_data->response.max_size = in_size;
> + client_data->response.error = 0;
> + client_data->response.received = false;
> +
> + rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
> + if (rv < 0) {
> + dev_err(cl_data_to_dev(client_data),
> + "ishtp_cl_send error %d\n", rv);
> + return rv;
> + }
> +
> + wait_event_interruptible_timeout(client_data->response.wait_queue,
> + client_data->response.received,
> + ISHTP_SEND_TIMEOUT);
> + if (!client_data->response.received) {
> + dev_err(cl_data_to_dev(client_data),
> + "Timed out for response to command=%02lx",
> + out_hdr->command & CMD_MASK);
> + return -ETIMEDOUT;
> + }
> +
> + if (client_data->response.error < 0)
> + return client_data->response.error;
> +
> + return client_data->response.size;
> +}
> +
> +/**
> + * process_recv() - Receive and parse incoming packet
> + * @loader_ishtp_cl: Client instance to get stats
> + * @rb_in_proc: ISH received message buffer
> + *
> + * Parse the incoming packet. If it is a response packet then it will
> + * update received and wake up the caller waiting to for the response.
> + */
> +static void process_recv(struct ishtp_cl *loader_ishtp_cl,
> + struct ishtp_cl_rb *rb_in_proc)
> +{
> + struct loader_msg_hdr *hdr;
> + size_t data_len = rb_in_proc->buf_idx;
> + struct ishtp_cl_data *client_data =
> + ishtp_get_client_data(loader_ishtp_cl);
> +
> + /* Sanity check */
> + if (!client_data->response.data) {
> + dev_err(cl_data_to_dev(client_data),
> + "Receiving buffer is null. Should be allocated by calling function\n");
> + client_data->response.error = -EINVAL;
> + goto end;
> + }
> +
> + if (client_data->response.received) {
> + dev_err(cl_data_to_dev(client_data),
> + "Previous firmware message not yet processed\n");
> + client_data->response.error = -EINVAL;
> + goto end;
> + }
> + /*
> + * All firmware messages have a header. Check buffer size
> + * before accessing elements inside.
> + */
> + if (!rb_in_proc->buffer.data) {
> + dev_warn(cl_data_to_dev(client_data),
> + "rb_in_proc->buffer.data returned null");
> + client_data->response.error = -EBADMSG;
> + goto end;
> + }
> +
> + if (data_len < sizeof(struct loader_msg_hdr)) {
> + dev_err(cl_data_to_dev(client_data),
> + "data size %zu is less than header %zu\n",
> + data_len, sizeof(struct loader_msg_hdr));
> + client_data->response.error = -EMSGSIZE;
> + goto end;
> + }
> +
> + hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "%s: command=%02lx is_response=%u status=%02x\n",
> + __func__,
> + hdr->command & CMD_MASK,
> + hdr->command & IS_RESPONSE ? 1 : 0,
> + hdr->status);
> +
> + if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
> + ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
> + ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
> + dev_err(cl_data_to_dev(client_data),
> + "Invalid command=%02lx\n",
> + hdr->command & CMD_MASK);
> + client_data->response.error = -EPROTO;
> + goto end;
> + }
> +
> + if (data_len > client_data->response.max_size) {
> + dev_err(cl_data_to_dev(client_data),
> + "Received buffer size %zu is larger than allocated buffer %zu\n",
> + data_len, client_data->response.max_size);
> + client_data->response.error = -EMSGSIZE;
> + goto end;
> + }
> +
> + /* We expect only "response" messages from firmware */
> + if (!(hdr->command & IS_RESPONSE)) {
> + dev_err(cl_data_to_dev(client_data),
> + "Invalid response to command\n");
> + client_data->response.error = -EIO;
> + goto end;
> + }
> +
> + if (hdr->status) {
> + dev_err(cl_data_to_dev(client_data),
> + "Loader returned status %d\n",
> + hdr->status);
> + client_data->response.error = -EIO;
> + goto end;
> + }
> +
> + /* Update the actual received buffer size */
> + client_data->response.size = data_len;
> +
> + /*
> + * Copy the buffer received in firmware response for the
> + * calling thread.
> + */
> + memcpy(client_data->response.data,
> + rb_in_proc->buffer.data, data_len);
> +
> + /* Set flag before waking up the caller */
> + client_data->response.received = true;
> +
> +end:
> + /* Free the buffer */
> + ishtp_cl_io_rb_recycle(rb_in_proc);
> + rb_in_proc = NULL;
> +
> + /* Wake the calling thread */
> + wake_up_interruptible(&client_data->response.wait_queue);
> +}
> +
> +/**
> + * loader_cl_event_cb() - bus driver callback for incoming message
> + * @device: Pointer to the ishtp client device for which this
> + * message is targeted
> + *
> + * Remove the packet from the list and process the message by calling
> + * process_recv
> + */
> +static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl_rb *rb_in_proc;
> + struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
> +
> + while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) {
> + /* Process the data packet from firmware */
> + process_recv(loader_ishtp_cl, rb_in_proc);
> + }
> +}
> +
> +/**
> + * ish_query_loader_prop() - Query ISH Shim firmware loader
> + * @client_data: Client data instance
> + * @fw: Poiner to firmware data struct in host memory
> + * @fw_info: Loader firmware properties
> + *
> + * This function queries the ISH Shim firmware loader for capabilities.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
> + const struct firmware *fw,
> + struct shim_fw_info *fw_info)
> +{
> + int rv;
> + struct loader_xfer_query ldr_xfer_query;
> + struct loader_xfer_query_response ldr_xfer_query_resp;
> +
> + memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
> + ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
> + ldr_xfer_query.image_size = fw->size;
> + rv = loader_cl_send(client_data,
> + (u8 *)&ldr_xfer_query,
> + sizeof(ldr_xfer_query),
> + (u8 *)&ldr_xfer_query_resp,
> + sizeof(ldr_xfer_query_resp));
> + if (rv < 0) {
> + client_data->flag_retry = true;
> + return rv;
> + }
> +
> + /* On success, the return value is the received buffer size */
> + if (rv != sizeof(struct loader_xfer_query_response)) {
> + dev_err(cl_data_to_dev(client_data),
> + "data size %d is not equal to size of loader_xfer_query_response %zu\n",
> + rv, sizeof(struct loader_xfer_query_response));
> + client_data->flag_retry = true;
> + return -EMSGSIZE;
> + }
> +
> + /* Save fw_info for use outside this function */
> + *fw_info = ldr_xfer_query_resp.fw_info;
> +
> + /* Loader firmware properties */
> + dev_dbg(cl_data_to_dev(client_data),
> + "ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
> + fw_info->ish_fw_version.major,
> + fw_info->ish_fw_version.minor,
> + fw_info->ish_fw_version.hotfix,
> + fw_info->ish_fw_version.build,
> + fw_info->protocol_version,
> + fw_info->ldr_version.value);
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
> + fw_info->ldr_capability.max_fw_image_size,
> + fw_info->ldr_capability.xfer_mode,
> + fw_info->ldr_capability.max_dma_buf_size,
> + dma_buf_size_limit);
> +
> + /* Sanity checks */
> + if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
> + dev_err(cl_data_to_dev(client_data),
> + "ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
> + fw->size,
> + fw_info->ldr_capability.max_fw_image_size);
> + return -ENOSPC;
> + }
> +
> + /* For DMA the buffer size should be multiple of cacheline size */
> + if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
> + (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
> + dev_err(cl_data_to_dev(client_data),
> + "Shim firmware loader buffer size %d should be multipe of cacheline\n",
> + fw_info->ldr_capability.max_dma_buf_size);
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +
> +/**
> + * ish_fw_xfer_ishtp() Loads ISH firmware using ishtp interface
> + * @client_data: Client data instance
> + * @fw: Pointer to firmware data struct in host memory
> + *
> + * This function uses ISH-TP to transfer ISH firmware from host to
> + * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
> + * support.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
> + const struct firmware *fw)
> +{
> + int rv;
> + u32 fragment_offset, fragment_size, payload_max_size;
> + struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
> + struct loader_msg_hdr ldr_xfer_ipc_ack;
> +
> + payload_max_size =
> + LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
> +
> + ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
> + if (!ldr_xfer_ipc_frag) {
> + client_data->flag_retry = true;
> + return -ENOMEM;
> + }
> +
> + ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
> + ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
> +
> + /* Break the firmware image into fragments and send as ISH-TP payload */
> + fragment_offset = 0;
> + while (fragment_offset < fw->size) {
> + if (fragment_offset + payload_max_size < fw->size) {
> + fragment_size = payload_max_size;
> + ldr_xfer_ipc_frag->fragment.is_last = 0;
> + } else {
> + fragment_size = fw->size - fragment_offset;
> + ldr_xfer_ipc_frag->fragment.is_last = 1;
> + }
> +
> + ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
> + ldr_xfer_ipc_frag->fragment.size = fragment_size;
> + memcpy(ldr_xfer_ipc_frag->data,
> + &fw->data[fragment_offset],
> + fragment_size);
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
> + ldr_xfer_ipc_frag->fragment.offset,
> + ldr_xfer_ipc_frag->fragment.size,
> + ldr_xfer_ipc_frag->fragment.is_last);
> +
> + rv = loader_cl_send(client_data,
> + (u8 *)ldr_xfer_ipc_frag,
> + IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
> + (u8 *)&ldr_xfer_ipc_ack,
> + sizeof(ldr_xfer_ipc_ack));
> + if (rv < 0) {
> + client_data->flag_retry = true;
> + goto end_err_resp_buf_release;
> + }
> +
> + fragment_offset += fragment_size;
> + }
> +
> + kfree(ldr_xfer_ipc_frag);
> + return 0;
> +
> +end_err_resp_buf_release:
> + /* Free ISH buffer if not done already, in error case */
> + kfree(ldr_xfer_ipc_frag);
> + return rv;
> +}
> +
> +/**
> + * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
> + * @client_data: Client data instance
> + * @fw: Pointer to firmware data struct in host memory
> + * @fw_info: Loader firmware properties
> + *
> + * Host firmware load is a unique case where we need to download
> + * a large firmware image (200+ Kb). This function implements
> + * direct DMA transfer in kernel and ISH firmware. This allows
> + * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
> + * directly to ISH UMA at location of choice.
> + * Function depends on corresponding support in ISH firmware.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
> + const struct firmware *fw,
> + const struct shim_fw_info fw_info)
> +{
> + int rv;
> + void *dma_buf;
> + dma_addr_t dma_buf_phy;
> + u32 fragment_offset, fragment_size, payload_max_size;
> + struct loader_msg_hdr ldr_xfer_dma_frag_ack;
> + struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
> + struct device *devc = ishtp_get_pci_device(client_data->cl_device);
> + u32 shim_fw_buf_size =
> + fw_info.ldr_capability.max_dma_buf_size;
> +
> + /*
> + * payload_max_size should be set to minimum of
> + * (1) Size of firmware to be loaded,
> + * (2) Max DMA buffer size supported by Shim firmware,
> + * (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
> + */
> + payload_max_size = min3(fw->size,
> + (size_t)shim_fw_buf_size,
> + (size_t)dma_buf_size_limit);
> +
> + /*
> + * Buffer size should be multiple of cacheline size
> + * if it's not, select the previous cacheline boundary.
> + */
> + payload_max_size &= ~(L1_CACHE_BYTES - 1);
> +
> + dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32);
> + if (!dma_buf) {
> + client_data->flag_retry = true;
> + return -ENOMEM;
> + }
> +
> + dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size,
> + DMA_TO_DEVICE);
> + if (dma_mapping_error(devc, dma_buf_phy)) {
> + dev_err(cl_data_to_dev(client_data), "DMA map failed\n");
> + client_data->flag_retry = true;
> + rv = -ENOMEM;
> + goto end_err_dma_buf_release;
> + }
> +
> + ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
> + ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
> + ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
> +
> + /* Send the firmware image in chucks of payload_max_size */
> + fragment_offset = 0;
> + while (fragment_offset < fw->size) {
> + if (fragment_offset + payload_max_size < fw->size) {
> + fragment_size = payload_max_size;
> + ldr_xfer_dma_frag.fragment.is_last = 0;
> + } else {
> + fragment_size = fw->size - fragment_offset;
> + ldr_xfer_dma_frag.fragment.is_last = 1;
> + }
> +
> + ldr_xfer_dma_frag.fragment.offset = fragment_offset;
> + ldr_xfer_dma_frag.fragment.size = fragment_size;
> + memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
> +
> + dma_sync_single_for_device(devc, dma_buf_phy,
> + payload_max_size,
> + DMA_TO_DEVICE);
> +
> + /*
> + * Flush cache here because the dma_sync_single_for_device()
> + * does not do for x86.
> + */
> + clflush_cache_range(dma_buf, payload_max_size);
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
> + ldr_xfer_dma_frag.fragment.offset,
> + ldr_xfer_dma_frag.fragment.size,
> + ldr_xfer_dma_frag.fragment.is_last,
> + ldr_xfer_dma_frag.ddr_phys_addr);
> +
> + rv = loader_cl_send(client_data,
> + (u8 *)&ldr_xfer_dma_frag,
> + sizeof(ldr_xfer_dma_frag),
> + (u8 *)&ldr_xfer_dma_frag_ack,
> + sizeof(ldr_xfer_dma_frag_ack));
> + if (rv < 0) {
> + client_data->flag_retry = true;
> + goto end_err_resp_buf_release;
> + }
> +
> + fragment_offset += fragment_size;
> + }
> +
> + dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
> + kfree(dma_buf);
> + return 0;
> +
> +end_err_resp_buf_release:
> + /* Free ISH buffer if not done already, in error case */
> + dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
> +end_err_dma_buf_release:
> + kfree(dma_buf);
> + return rv;
> +}
> +
> +/**
> + * ish_fw_start() Start executing ISH main firmware
> + * @client_data: client data instance
> + *
> + * This function sends message to Shim firmware loader to start
> + * the execution of ISH main firmware.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_fw_start(struct ishtp_cl_data *client_data)
> +{
> + struct loader_start ldr_start;
> + struct loader_msg_hdr ldr_start_ack;
> +
> + memset(&ldr_start, 0, sizeof(ldr_start));
> + ldr_start.hdr.command = LOADER_CMD_START;
> + return loader_cl_send(client_data,
> + (u8 *)&ldr_start,
> + sizeof(ldr_start),
> + (u8 *)&ldr_start_ack,
> + sizeof(ldr_start_ack));
> +}
> +
> +/**
> + * load_fw_from_host() Loads ISH firmware from host
> + * @client_data: Client data instance
> + *
> + * This function loads the ISH firmware to ISH SRAM and starts execution
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int load_fw_from_host(struct ishtp_cl_data *client_data)
> +{
> + int rv;
> + u32 xfer_mode;
> + char *filename;
> + const struct firmware *fw;
> + struct shim_fw_info fw_info;
> + struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
> +
> + client_data->flag_retry = false;
> +
> + filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
> + if (!filename) {
> + client_data->flag_retry = true;
> + rv = -ENOMEM;
> + goto end_error;
> + }
> +
> + /* Get filename of the ISH firmware to be loaded */
> + rv = get_firmware_variant(client_data, filename);
> + if (rv < 0)
> + goto end_err_filename_buf_release;
> +
> + rv = request_firmware(&fw, filename, cl_data_to_dev(client_data));
> + if (rv < 0)
> + goto end_err_filename_buf_release;
> +
> + /* Step 1: Query Shim firmware loader properties */
> +
> + rv = ish_query_loader_prop(client_data, fw, &fw_info);
> + if (rv < 0)
> + goto end_err_fw_release;
> +
> + /* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
> +
> + xfer_mode = fw_info.ldr_capability.xfer_mode;
> + if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
> + rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
> + } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
> + rv = ish_fw_xfer_ishtp(client_data, fw);
> + } else {
> + dev_err(cl_data_to_dev(client_data),
> + "No transfer mode selected in firmware\n");
> + rv = -EINVAL;
> + }
> + if (rv < 0)
> + goto end_err_fw_release;
> +
> + /* Step 3: Start ISH main firmware exeuction */
> +
> + rv = ish_fw_start(client_data);
> + if (rv < 0)
> + goto end_err_fw_release;
> +
> + release_firmware(fw);
> + kfree(filename);
> + dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
> + filename);
> + return 0;
> +
> +end_err_fw_release:
> + release_firmware(fw);
> +end_err_filename_buf_release:
> + kfree(filename);
> +end_error:
> + /* Keep a count of retries, and give up after 3 attempts */
> + if (client_data->flag_retry &&
> + client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
> + dev_warn(cl_data_to_dev(client_data),
> + "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
> + rv);
> + ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
> + } else {
> + dev_err(cl_data_to_dev(client_data),
> + "ISH host firmware load failed %d\n", rv);
> + }
> + return rv;
> +}
> +
> +static void load_fw_from_host_handler(struct work_struct *work)
> +{
> + struct ishtp_cl_data *client_data;
> +
> + client_data = container_of(work, struct ishtp_cl_data,
> + work_fw_load);
> + load_fw_from_host(client_data);
> +}
> +
> +/**
> + * loader_init() - Init function for ISH-TP client
> + * @loader_ishtp_cl: ISH-TP client instance
> + * @reset: true if called for init after reset
> + *
> + * Return: 0 for success, negative error code for failure
> + */
> +static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
> +{
> + int rv;
> + struct ishtp_fw_client *fw_client;
> + struct ishtp_cl_data *client_data =
> + ishtp_get_client_data(loader_ishtp_cl);
> +
> + dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
> +
> + rv = ishtp_cl_link(loader_ishtp_cl);
> + if (rv < 0) {
> + dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n");
> + return rv;
> + }
> +
> + /* Connect to firmware client */
> + ishtp_set_tx_ring_size(loader_ishtp_cl, LOADER_CL_TX_RING_SIZE);
> + ishtp_set_rx_ring_size(loader_ishtp_cl, LOADER_CL_RX_RING_SIZE);
> +
> + fw_client =
> + ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_ishtp_cl),
> + &loader_ishtp_guid);
> + if (!fw_client) {
> + dev_err(cl_data_to_dev(client_data),
> + "ISH client uuid not found\n");
> + rv = -ENOENT;
> + goto err_cl_unlink;
> + }
> +
> + ishtp_cl_set_fw_client_id(loader_ishtp_cl,
> + ishtp_get_fw_client_id(fw_client));
> + ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_CONNECTING);
> +
> + rv = ishtp_cl_connect(loader_ishtp_cl);
> + if (rv < 0) {
> + dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
> + goto err_cl_unlink;
> + }
> +
> + dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
> +
> + ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb);
> +
> + return 0;
> +
> +err_cl_unlink:
> + ishtp_cl_unlink(loader_ishtp_cl);
> + return rv;
> +}
> +
> +static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
> +{
> + ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_DISCONNECTING);
> + ishtp_cl_disconnect(loader_ishtp_cl);
> + ishtp_cl_unlink(loader_ishtp_cl);
> + ishtp_cl_flush_queues(loader_ishtp_cl);
> +
> + /* Disband and free all Tx and Rx client-level rings */
> + ishtp_cl_free(loader_ishtp_cl);
> +}
> +
> +static void reset_handler(struct work_struct *work)
> +{
> + int rv;
> + struct ishtp_cl_data *client_data;
> + struct ishtp_cl *loader_ishtp_cl;
> + struct ishtp_cl_device *cl_device;
> +
> + client_data = container_of(work, struct ishtp_cl_data,
> + work_ishtp_reset);
> +
> + loader_ishtp_cl = client_data->loader_ishtp_cl;
> + cl_device = client_data->cl_device;
> +
> + /* Unlink, flush queues & start again */
> + ishtp_cl_unlink(loader_ishtp_cl);
> + ishtp_cl_flush_queues(loader_ishtp_cl);
> + ishtp_cl_free(loader_ishtp_cl);
> +
> + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> + if (!loader_ishtp_cl)
> + return;
> +
> + ishtp_set_drvdata(cl_device, loader_ishtp_cl);
> + ishtp_set_client_data(loader_ishtp_cl, client_data);
> + client_data->loader_ishtp_cl = loader_ishtp_cl;
> + client_data->cl_device = cl_device;
> +
> + rv = loader_init(loader_ishtp_cl, 1);
> + if (rv < 0) {
> + dev_err(ishtp_device(cl_device), "Reset Failed\n");
> + return;
> + }
> +
> + /* ISH firmware loading from host */
> + load_fw_from_host(client_data);
> +}
> +
> +/**
> + * loader_ishtp_cl_probe() - ISH-TP client driver probe
> + * @cl_device: ISH-TP client device instance
> + *
> + * This function gets called on device create on ISH-TP bus
> + *
> + * Return: 0 for success, negative error code for failure
> + */
> +static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl *loader_ishtp_cl;
> + struct ishtp_cl_data *client_data;
> + int rv;
> +
> + client_data = devm_kzalloc(ishtp_device(cl_device),
> + sizeof(*client_data),
> + GFP_KERNEL);
> + if (!client_data)
> + return -ENOMEM;
> +
> + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> + if (!loader_ishtp_cl)
> + return -ENOMEM;
> +
> + ishtp_set_drvdata(cl_device, loader_ishtp_cl);
> + ishtp_set_client_data(loader_ishtp_cl, client_data);
> + client_data->loader_ishtp_cl = loader_ishtp_cl;
> + client_data->cl_device = cl_device;
> +
> + init_waitqueue_head(&client_data->response.wait_queue);
> +
> + INIT_WORK(&client_data->work_ishtp_reset,
> + reset_handler);
> + INIT_WORK(&client_data->work_fw_load,
> + load_fw_from_host_handler);
> +
> + rv = loader_init(loader_ishtp_cl, 0);
> + if (rv < 0) {
> + ishtp_cl_free(loader_ishtp_cl);
> + return rv;
> + }
> + ishtp_get_device(cl_device);
> +
> + client_data->retry_count = 0;
> +
> + /* ISH firmware loading from host */
> + schedule_work(&client_data->work_fw_load);
> +
> + return 0;
> +}
> +
> +/**
> + * loader_ishtp_cl_remove() - ISH-TP client driver remove
> + * @cl_device: ISH-TP client device instance
> + *
> + * This function gets called on device remove on ISH-TP bus
> + *
> + * Return: 0
> + */
> +static int loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl_data *client_data;
> + struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
> +
> + client_data = ishtp_get_client_data(loader_ishtp_cl);
> +
> + /*
> + * The sequence of the following two cancel_work_sync() is
> + * important. The work_fw_load can in turn schedue
> + * work_ishtp_reset, so first cancel work_fw_load then
> + * cancel work_ishtp_reset.
> + */
> + cancel_work_sync(&client_data->work_fw_load);
> + cancel_work_sync(&client_data->work_ishtp_reset);
> + loader_deinit(loader_ishtp_cl);
> + ishtp_put_device(cl_device);
> +
> + return 0;
> +}
> +
> +/**
> + * loader_ishtp_cl_reset() - ISH-TP client driver reset
> + * @cl_device: ISH-TP client device instance
> + *
> + * This function gets called on device reset on ISH-TP bus
> + *
> + * Return: 0
> + */
> +static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl_data *client_data;
> + struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
> +
> + client_data = ishtp_get_client_data(loader_ishtp_cl);
> +
> + schedule_work(&client_data->work_ishtp_reset);
> +
> + return 0;
> +}
> +
> +static struct ishtp_cl_driver loader_ishtp_cl_driver = {
> + .name = "ish-loader",
> + .guid = &loader_ishtp_guid,
> + .probe = loader_ishtp_cl_probe,
> + .remove = loader_ishtp_cl_remove,
> + .reset = loader_ishtp_cl_reset,
> +};
> +
> +static int __init ish_loader_init(void)
> +{
> + return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE);
> +}
> +
> +static void __exit ish_loader_exit(void)
> +{
> + ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
> +}
> +
> +late_initcall(ish_loader_init);
> +module_exit(ish_loader_exit);
> +
> +module_param(dma_buf_size_limit, int, 0644);
> +MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
> +
> +MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
> +MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
> +
> +MODULE_LICENSE("GPL v2");
> +MODULE_ALIAS("ishtp:*");
> --
> 1.9.1
>
Reviewed-by: Nick Crews <ncrews@chromium.org>
^ permalink raw reply
* Re: [PATCH v4] HID: intel-ish-hid: ISH firmware loader client driver
From: Srinivas Pandruvada @ 2019-04-02 0:37 UTC (permalink / raw)
To: Nick Crews, Rushikesh S Kadam
Cc: benjamin.tissoires, jikos, jettrink, Gwendal Grignou,
linux-kernel, linux-input
In-Reply-To: <CAHX4x87a4ZScNybtmBmQJUO=JCxPsdFL-QKeX6pviPGh9jD8uA@mail.gmail.com>
On Mon, 2019-04-01 at 17:13 -0600, Nick Crews wrote:
> Looks good to me! Thanks for the work!
>
So I assume, Rushikesh can add your Reviewed-by.
Thanks,
Srinivas
> On Sat, Mar 30, 2019 at 5:23 AM Rushikesh S Kadam
> <rushikesh.s.kadam@intel.com> wrote:
> >
> > This driver adds support for loading Intel Integrated
> > Sensor Hub (ISH) firmware from host file system to ISH
> > SRAM and start execution.
> >
> > At power-on, the ISH subsystem shall boot to an interim
> > Shim loader-firmware, which shall expose an ISHTP loader
> > device.
> >
> > The driver implements an ISHTP client that communicates
> > with the Shim ISHTP loader device over the intel-ish-hid
> > stack, to download the main ISH firmware.
> >
> > Signed-off-by: Rushikesh S Kadam <rushikesh.s.kadam@intel.com>
> > ---
> > The patches are baselined to hid git tree, branch for-5.2/ish
> >
https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git/log/?h=for-5.2/ish
> >
> > v4
> > - Changed process_recv() to wake the caller in case of
> > error as well. Earlier caller would wait until timeout on
> > an error.
> > - Change sequence of few checks in process_recv().
> >
> > v3
> > - Moved a couple of sanity checks from loader_cl_send() to
> > process_recv().
> > - Several minor changes to address review comments.
> >
> > v2
> > - Change loader_cl_send() so that the calling function
> > shall allocate and pass the buffer to be used for
> > receiving firwmare response data. Corresponding changes
> > in calling function and process_recv().
> > - Introduced struct response_info to encapsulate and pass
> > data between from the process_recv() callback to
> > calling function loader_cl_send().
> > - Keep count of host firmware load retries, and fail after
> > 3 unsuccessful attempts.
> > - Dropped report_bad_packets() function previously used for
> > keeping count of bad packets.
> > - Inlined loader_ish_hw_reset()'s functionality
> >
> > v1
> > - Initial version.
> >
> > drivers/hid/Makefile | 1 +
> > drivers/hid/intel-ish-hid/Kconfig | 15 +
> > drivers/hid/intel-ish-hid/Makefile | 3 +
> > drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 1085
> > +++++++++++++++++++++++++++
> > 4 files changed, 1104 insertions(+)
> > create mode 100644 drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> >
> > diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
> > index 170163b..d8d393e 100644
> > --- a/drivers/hid/Makefile
> > +++ b/drivers/hid/Makefile
> > @@ -134,3 +134,4 @@ obj-$(CONFIG_USB_KBD) += usbhid/
> > obj-$(CONFIG_I2C_HID) += i2c-hid/
> >
> > obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/
> > +obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
> > diff --git a/drivers/hid/intel-ish-hid/Kconfig b/drivers/hid/intel-
> > ish-hid/Kconfig
> > index 519e4c8..786adbc 100644
> > --- a/drivers/hid/intel-ish-hid/Kconfig
> > +++ b/drivers/hid/intel-ish-hid/Kconfig
> > @@ -14,4 +14,19 @@ config INTEL_ISH_HID
> > Broxton and Kaby Lake.
> >
> > Say Y here if you want to support Intel ISH. If unsure,
> > say N.
> > +
> > +config INTEL_ISH_FIRMWARE_DOWNLOADER
> > + tristate "Host Firmware Load feature for Intel ISH"
> > + depends on INTEL_ISH_HID
> > + depends on X86
> > + help
> > + The Integrated Sensor Hub (ISH) enables the kernel to
> > offload
> > + sensor polling and algorithm processing to a dedicated
> > low power
> > + processor in the chipset.
> > +
> > + The Host Firmware Load feature adds support to load the
> > ISH
> > + firmware from host file system at boot.
> > +
> > + Say M here if you want to support Host Firmware Loading
> > feature
> > + for Intel ISH. If unsure, say N.
> > endmenu
> > diff --git a/drivers/hid/intel-ish-hid/Makefile
> > b/drivers/hid/intel-ish-hid/Makefile
> > index 825b70a..2de97e4 100644
> > --- a/drivers/hid/intel-ish-hid/Makefile
> > +++ b/drivers/hid/intel-ish-hid/Makefile
> > @@ -20,4 +20,7 @@ obj-$(CONFIG_INTEL_ISH_HID) += intel-ishtp-hid.o
> > intel-ishtp-hid-objs := ishtp-hid.o
> > intel-ishtp-hid-objs += ishtp-hid-client.o
> >
> > +obj-$(CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ishtp-
> > loader.o
> > +intel-ishtp-loader-objs += ishtp-fw-loader.o
> > +
> > ccflags-y += -Idrivers/hid/intel-ish-hid/ishtp
> > diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> > b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> > new file mode 100644
> > index 0000000..e770e22
> > --- /dev/null
> > +++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> > @@ -0,0 +1,1085 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/*
> > + * ISH-TP client driver for ISH firmware loading
> > + *
> > + * Copyright (c) 2019, Intel Corporation.
> > + */
> > +
> > +#include <linux/firmware.h>
> > +#include <linux/module.h>
> > +#include <linux/pci.h>
> > +#include <linux/intel-ish-client-if.h>
> > +#include <linux/property.h>
> > +#include <asm/cacheflush.h>
> > +
> > +/* Number of times we attempt to load the firmware before giving
> > up */
> > +#define MAX_LOAD_ATTEMPTS 3
> > +
> > +/* ISH TX/RX ring buffer pool size */
> > +#define LOADER_CL_RX_RING_SIZE 1
> > +#define LOADER_CL_TX_RING_SIZE 1
> > +
> > +/*
> > + * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The
> > buffer is
> > + * used to temporarily hold the data transferred from host to Shim
> > + * firmware loader. Reason for the odd size of 3968 bytes? Each
> > IPC
> > + * transfer is 128 bytes (= 4 bytes header + 124 bytes payload).
> > So the
> > + * 4 Kb buffer can hold maximum of 32 IPC transfers, which means
> > we can
> > + * have a max payload of 3968 bytes (= 32 x 124 payload).
> > + */
> > +#define LOADER_SHIM_IPC_BUF_SIZE 3968
> > +
> > +/**
> > + * enum ish_loader_commands - ISH loader host commands.
> > + * LOADER_CMD_XFER_QUERY Query the Shim firmware loader for
> > + * capabilities
> > + * LOADER_CMD_XFER_FRAGMENT Transfer one firmware image
> > fragment at a
> > + * time. The command may be executed
> > + * multiple times until the entire
> > firmware
> > + * image is downloaded to SRAM.
> > + * LOADER_CMD_START Start executing the main firmware.
> > + */
> > +enum ish_loader_commands {
> > + LOADER_CMD_XFER_QUERY = 0,
> > + LOADER_CMD_XFER_FRAGMENT,
> > + LOADER_CMD_START,
> > +};
> > +
> > +/* Command bit mask */
> > +#define CMD_MASK GENMASK(6,
> > 0)
> > +#define IS_RESPONSE BIT(7)
> > +
> > +/*
> > + * ISH firmware max delay for one transmit failure is 1 Hz,
> > + * and firmware will retry 2 times, so 3 Hz is used for timeout.
> > + */
> > +#define ISHTP_SEND_TIMEOUT (3 * HZ)
> > +
> > +/*
> > + * Loader transfer modes:
> > + *
> > + * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism
> > to
> > + * transfer data. This may use IPC or DMA if supported in
> > firmware.
> > + * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol
> > for
> > + * both IPC & DMA (legacy).
> > + *
> > + * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit
> > different
> > + * from the sensor data streaming. Here we download a large (300+
> > Kb)
> > + * image directly to ISH SRAM memory. There is limited benefit of
> > + * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
> > + * this "direct dma" mode, where we do not use ISH-TP for DMA, but
> > + * instead manage the DMA directly in kernel driver and Shim
> > firmware
> > + * loader (allocate buffer, break in chucks and transfer). This
> > allows
> > + * to overcome 4 Kb limit, and optimize the data flow path in
> > firmware.
> > + */
> > +#define LOADER_XFER_MODE_DIRECT_DMA BIT(0)
> > +#define LOADER_XFER_MODE_ISHTP BIT(1)
> > +
> > +/* ISH Transport Loader client unique GUID */
> > +static const guid_t loader_ishtp_guid =
> > + GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
> > + 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc);
> > +
> > +#define FILENAME_SIZE 256
> > +
> > +/*
> > + * The firmware loading latency will be minimum if we can DMA the
> > + * entire ISH firmware image in one go. This requires that we
> > allocate
> > + * a large DMA buffer in kernel, which could be problematic on
> > some
> > + * platforms. So here we limit the DMA buffer size via a
> > module_param.
> > + * We default to 4 pages, but a customer can set it to higher
> > limit if
> > + * deemed appropriate for his platform.
> > + */
> > +static int dma_buf_size_limit = 4 * PAGE_SIZE;
> > +
> > +/**
> > + * struct loader_msg_hdr - Header for ISH Loader commands.
> > + * @command: LOADER_CMD* commands. Bit 7 is the
> > response.
> > + * @status: Command response status. Non 0, is error
> > + * condition.
> > + *
> > + * This structure is used as header for every command/data
> > sent/received
> > + * between Host driver and ISH Shim firmware loader.
> > + */
> > +struct loader_msg_hdr {
> > + u8 command;
> > + u8 reserved[2];
> > + u8 status;
> > +} __packed;
> > +
> > +struct loader_xfer_query {
> > + struct loader_msg_hdr hdr;
> > + u32 image_size;
> > +} __packed;
> > +
> > +struct ish_fw_version {
> > + u16 major;
> > + u16 minor;
> > + u16 hotfix;
> > + u16 build;
> > +} __packed;
> > +
> > +union loader_version {
> > + u32 value;
> > + struct {
> > + u8 major;
> > + u8 minor;
> > + u8 hotfix;
> > + u8 build;
> > + };
> > +} __packed;
> > +
> > +struct loader_capability {
> > + u32 max_fw_image_size;
> > + u32 xfer_mode;
> > + u32 max_dma_buf_size; /* only for dma mode, multiples of
> > cacheline */
> > +} __packed;
> > +
> > +struct shim_fw_info {
> > + struct ish_fw_version ish_fw_version;
> > + u32 protocol_version;
> > + union loader_version ldr_version;
> > + struct loader_capability ldr_capability;
> > +} __packed;
> > +
> > +struct loader_xfer_query_response {
> > + struct loader_msg_hdr hdr;
> > + struct shim_fw_info fw_info;
> > +} __packed;
> > +
> > +struct loader_xfer_fragment {
> > + struct loader_msg_hdr hdr;
> > + u32 xfer_mode;
> > + u32 offset;
> > + u32 size;
> > + u32 is_last;
> > +} __packed;
> > +
> > +struct loader_xfer_ipc_fragment {
> > + struct loader_xfer_fragment fragment;
> > + u8 data[] ____cacheline_aligned; /* variable length payload
> > here */
> > +} __packed;
> > +
> > +struct loader_xfer_dma_fragment {
> > + struct loader_xfer_fragment fragment;
> > + u64 ddr_phys_addr;
> > +} __packed;
> > +
> > +struct loader_start {
> > + struct loader_msg_hdr hdr;
> > +} __packed;
> > +
> > +/**
> > + * struct response_info - Encapsulate firmware response related
> > + * information for passing between function
> > + * loader_cl_send() and process_recv()
> > callback.
> > + * @data Copy the data received from firmware here.
> > + * @max_size Max size allocated for the @data buffer. If
> > the
> > + * received data exceeds this value, we log an
> > + * error.
> > + * @size Actual size of data received from firmware.
> > + * @error Returns 0 for success, negative error code
> > for a
> > + * failure in function process_recv().
> > + * @received Set to true on receiving a valid firmware
> > + * response to host command
> > + * @wait_queue Wait queue for Host firmware loading where
> > the
> > + * client sends message to ISH firmware and
> > waits
> > + * for response
> > + */
> > +struct response_info {
> > + void *data;
> > + size_t max_size;
> > + size_t size;
> > + int error;
> > + bool received;
> > + wait_queue_head_t wait_queue;
> > +};
> > +
> > +/**
> > + * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
> > + * @work_ishtp_reset: Work queue for reset handling.
> > + * @work_fw_load: Work queue for host firmware loading.
> > + * @flag_retry Flag for indicating host firmware loading
> > should
> > + * be retried.
> > + * @retry_count Count the number of retries.
> > + *
> > + * This structure is used to store data per client.
> > + */
> > +struct ishtp_cl_data {
> > + struct ishtp_cl *loader_ishtp_cl;
> > + struct ishtp_cl_device *cl_device;
> > +
> > + /*
> > + * Used for passing firmware response information between
> > + * loader_cl_send() and process_recv() callback.
> > + */
> > + struct response_info response;
> > +
> > + struct work_struct work_ishtp_reset;
> > + struct work_struct work_fw_load;
> > +
> > + /*
> > + * In certain failure scenrios, it makes sense to reset the
> > ISH
> > + * subsystem and retry Host firmware loading (e.g. bad
> > message
> > + * packet, ENOMEM, etc.). On the other hand, failures due
> > to
> > + * protocol mismatch, etc., are not recoverable. We do not
> > + * retry them.
> > + *
> > + * If set, the flag indicates that we should re-try the
> > + * particular failure.
> > + */
> > + bool flag_retry;
> > + int retry_count;
> > +};
> > +
> > +#define IPC_FRAGMENT_DATA_PREAMBLE \
> > + offsetof(struct loader_xfer_ipc_fragment, data)
> > +
> > +#define cl_data_to_dev(client_data) ishtp_device((client_data)-
> > >cl_device)
> > +
> > +/**
> > + * get_firmware_variant() - Gets the filename of firmware image to
> > be
> > + * loaded based on platform variant.
> > + * @client_data Client data instance.
> > + * @filename Returns firmware filename.
> > + *
> > + * Queries the firmware-name device property string.
> > + *
> > + * Return: 0 for success, negative error code for failure.
> > + */
> > +static int get_firmware_variant(struct ishtp_cl_data *client_data,
> > + char *filename)
> > +{
> > + int rv;
> > + const char *val;
> > + struct device *devc = ishtp_get_pci_device(client_data-
> > >cl_device);
> > +
> > + rv = device_property_read_string(devc, "firmware-name",
> > &val);
> > + if (rv < 0) {
> > + dev_err(devc,
> > + "Error: ISH firmware-name device property
> > required\n");
> > + return rv;
> > + }
> > + return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
> > +}
> > +
> > +/**
> > + * loader_cl_send() Send message from host to firmware
> > + * @client_data: Client data instance
> > + * @out_msg Message buffer to be sent to firmware
> > + * @out_size Size of out going message
> > + * @in_msg Message buffer where the incoming data
> > copied.
> > + * This buffer is allocated by calling
> > + * @in_size Max size of incoming message
> > + *
> > + * Return: Number of bytes copied in the in_msg on success,
> > negative
> > + * error code on failure.
> > + */
> > +static int loader_cl_send(struct ishtp_cl_data *client_data,
> > + u8 *out_msg, size_t out_size,
> > + u8 *in_msg, size_t in_size)
> > +{
> > + int rv;
> > + struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr
> > *)out_msg;
> > + struct ishtp_cl *loader_ishtp_cl = client_data-
> > >loader_ishtp_cl;
> > +
> > + dev_dbg(cl_data_to_dev(client_data),
> > + "%s: command=%02lx is_response=%u status=%02x\n",
> > + __func__,
> > + out_hdr->command & CMD_MASK,
> > + out_hdr->command & IS_RESPONSE ? 1 : 0,
> > + out_hdr->status);
> > +
> > + /* Setup in coming buffer & size */
> > + client_data->response.data = in_msg;
> > + client_data->response.max_size = in_size;
> > + client_data->response.error = 0;
> > + client_data->response.received = false;
> > +
> > + rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
> > + if (rv < 0) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "ishtp_cl_send error %d\n", rv);
> > + return rv;
> > + }
> > +
> > + wait_event_interruptible_timeout(client_data-
> > >response.wait_queue,
> > + client_data-
> > >response.received,
> > + ISHTP_SEND_TIMEOUT);
> > + if (!client_data->response.received) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Timed out for response to command=%02lx",
> > + out_hdr->command & CMD_MASK);
> > + return -ETIMEDOUT;
> > + }
> > +
> > + if (client_data->response.error < 0)
> > + return client_data->response.error;
> > +
> > + return client_data->response.size;
> > +}
> > +
> > +/**
> > + * process_recv() - Receive and parse incoming packet
> > + * @loader_ishtp_cl: Client instance to get stats
> > + * @rb_in_proc: ISH received message buffer
> > + *
> > + * Parse the incoming packet. If it is a response packet then it
> > will
> > + * update received and wake up the caller waiting to for the
> > response.
> > + */
> > +static void process_recv(struct ishtp_cl *loader_ishtp_cl,
> > + struct ishtp_cl_rb *rb_in_proc)
> > +{
> > + struct loader_msg_hdr *hdr;
> > + size_t data_len = rb_in_proc->buf_idx;
> > + struct ishtp_cl_data *client_data =
> > + ishtp_get_client_data(loader_ishtp_cl);
> > +
> > + /* Sanity check */
> > + if (!client_data->response.data) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Receiving buffer is null. Should be
> > allocated by calling function\n");
> > + client_data->response.error = -EINVAL;
> > + goto end;
> > + }
> > +
> > + if (client_data->response.received) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Previous firmware message not yet
> > processed\n");
> > + client_data->response.error = -EINVAL;
> > + goto end;
> > + }
> > + /*
> > + * All firmware messages have a header. Check buffer size
> > + * before accessing elements inside.
> > + */
> > + if (!rb_in_proc->buffer.data) {
> > + dev_warn(cl_data_to_dev(client_data),
> > + "rb_in_proc->buffer.data returned null");
> > + client_data->response.error = -EBADMSG;
> > + goto end;
> > + }
> > +
> > + if (data_len < sizeof(struct loader_msg_hdr)) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "data size %zu is less than header %zu\n",
> > + data_len, sizeof(struct loader_msg_hdr));
> > + client_data->response.error = -EMSGSIZE;
> > + goto end;
> > + }
> > +
> > + hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
> > +
> > + dev_dbg(cl_data_to_dev(client_data),
> > + "%s: command=%02lx is_response=%u status=%02x\n",
> > + __func__,
> > + hdr->command & CMD_MASK,
> > + hdr->command & IS_RESPONSE ? 1 : 0,
> > + hdr->status);
> > +
> > + if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
> > + ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT)
> > &&
> > + ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Invalid command=%02lx\n",
> > + hdr->command & CMD_MASK);
> > + client_data->response.error = -EPROTO;
> > + goto end;
> > + }
> > +
> > + if (data_len > client_data->response.max_size) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Received buffer size %zu is larger than
> > allocated buffer %zu\n",
> > + data_len, client_data->response.max_size);
> > + client_data->response.error = -EMSGSIZE;
> > + goto end;
> > + }
> > +
> > + /* We expect only "response" messages from firmware */
> > + if (!(hdr->command & IS_RESPONSE)) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Invalid response to command\n");
> > + client_data->response.error = -EIO;
> > + goto end;
> > + }
> > +
> > + if (hdr->status) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Loader returned status %d\n",
> > + hdr->status);
> > + client_data->response.error = -EIO;
> > + goto end;
> > + }
> > +
> > + /* Update the actual received buffer size */
> > + client_data->response.size = data_len;
> > +
> > + /*
> > + * Copy the buffer received in firmware response for the
> > + * calling thread.
> > + */
> > + memcpy(client_data->response.data,
> > + rb_in_proc->buffer.data, data_len);
> > +
> > + /* Set flag before waking up the caller */
> > + client_data->response.received = true;
> > +
> > +end:
> > + /* Free the buffer */
> > + ishtp_cl_io_rb_recycle(rb_in_proc);
> > + rb_in_proc = NULL;
> > +
> > + /* Wake the calling thread */
> > + wake_up_interruptible(&client_data->response.wait_queue);
> > +}
> > +
> > +/**
> > + * loader_cl_event_cb() - bus driver callback for incoming message
> > + * @device: Pointer to the ishtp client device for
> > which this
> > + * message is targeted
> > + *
> > + * Remove the packet from the list and process the message by
> > calling
> > + * process_recv
> > + */
> > +static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
> > +{
> > + struct ishtp_cl_rb *rb_in_proc;
> > + struct ishtp_cl *loader_ishtp_cl =
> > ishtp_get_drvdata(cl_device);
> > +
> > + while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl))
> > != NULL) {
> > + /* Process the data packet from firmware */
> > + process_recv(loader_ishtp_cl, rb_in_proc);
> > + }
> > +}
> > +
> > +/**
> > + * ish_query_loader_prop() - Query ISH Shim firmware loader
> > + * @client_data: Client data instance
> > + * @fw: Poiner to firmware data struct in
> > host memory
> > + * @fw_info: Loader firmware properties
> > + *
> > + * This function queries the ISH Shim firmware loader for
> > capabilities.
> > + *
> > + * Return: 0 for success, negative error code for failure.
> > + */
> > +static int ish_query_loader_prop(struct ishtp_cl_data
> > *client_data,
> > + const struct firmware *fw,
> > + struct shim_fw_info *fw_info)
> > +{
> > + int rv;
> > + struct loader_xfer_query ldr_xfer_query;
> > + struct loader_xfer_query_response ldr_xfer_query_resp;
> > +
> > + memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
> > + ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
> > + ldr_xfer_query.image_size = fw->size;
> > + rv = loader_cl_send(client_data,
> > + (u8 *)&ldr_xfer_query,
> > + sizeof(ldr_xfer_query),
> > + (u8 *)&ldr_xfer_query_resp,
> > + sizeof(ldr_xfer_query_resp));
> > + if (rv < 0) {
> > + client_data->flag_retry = true;
> > + return rv;
> > + }
> > +
> > + /* On success, the return value is the received buffer size
> > */
> > + if (rv != sizeof(struct loader_xfer_query_response)) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "data size %d is not equal to size of
> > loader_xfer_query_response %zu\n",
> > + rv, sizeof(struct
> > loader_xfer_query_response));
> > + client_data->flag_retry = true;
> > + return -EMSGSIZE;
> > + }
> > +
> > + /* Save fw_info for use outside this function */
> > + *fw_info = ldr_xfer_query_resp.fw_info;
> > +
> > + /* Loader firmware properties */
> > + dev_dbg(cl_data_to_dev(client_data),
> > + "ish_fw_version: major=%d minor=%d hotfix=%d
> > build=%d protocol_version=0x%x loader_version=%d\n",
> > + fw_info->ish_fw_version.major,
> > + fw_info->ish_fw_version.minor,
> > + fw_info->ish_fw_version.hotfix,
> > + fw_info->ish_fw_version.build,
> > + fw_info->protocol_version,
> > + fw_info->ldr_version.value);
> > +
> > + dev_dbg(cl_data_to_dev(client_data),
> > + "loader_capability: max_fw_image_size=0x%x
> > xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
> > + fw_info->ldr_capability.max_fw_image_size,
> > + fw_info->ldr_capability.xfer_mode,
> > + fw_info->ldr_capability.max_dma_buf_size,
> > + dma_buf_size_limit);
> > +
> > + /* Sanity checks */
> > + if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "ISH firmware size %zu is greater than Shim
> > firmware loader max supported %d\n",
> > + fw->size,
> > + fw_info->ldr_capability.max_fw_image_size);
> > + return -ENOSPC;
> > + }
> > +
> > + /* For DMA the buffer size should be multiple of cacheline
> > size */
> > + if ((fw_info->ldr_capability.xfer_mode &
> > LOADER_XFER_MODE_DIRECT_DMA) &&
> > + (fw_info->ldr_capability.max_dma_buf_size %
> > L1_CACHE_BYTES)) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "Shim firmware loader buffer size %d should
> > be multipe of cacheline\n",
> > + fw_info->ldr_capability.max_dma_buf_size);
> > + return -EINVAL;
> > + }
> > +
> > + return 0;
> > +}
> > +
> > +/**
> > + * ish_fw_xfer_ishtp() Loads ISH firmware using ishtp interface
> > + * @client_data: Client data instance
> > + * @fw: Pointer to firmware data struct in
> > host memory
> > + *
> > + * This function uses ISH-TP to transfer ISH firmware from host to
> > + * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
> > + * support.
> > + *
> > + * Return: 0 for success, negative error code for failure.
> > + */
> > +static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
> > + const struct firmware *fw)
> > +{
> > + int rv;
> > + u32 fragment_offset, fragment_size, payload_max_size;
> > + struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
> > + struct loader_msg_hdr ldr_xfer_ipc_ack;
> > +
> > + payload_max_size =
> > + LOADER_SHIM_IPC_BUF_SIZE -
> > IPC_FRAGMENT_DATA_PREAMBLE;
> > +
> > + ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE,
> > GFP_KERNEL);
> > + if (!ldr_xfer_ipc_frag) {
> > + client_data->flag_retry = true;
> > + return -ENOMEM;
> > + }
> > +
> > + ldr_xfer_ipc_frag->fragment.hdr.command =
> > LOADER_CMD_XFER_FRAGMENT;
> > + ldr_xfer_ipc_frag->fragment.xfer_mode =
> > LOADER_XFER_MODE_ISHTP;
> > +
> > + /* Break the firmware image into fragments and send as ISH-
> > TP payload */
> > + fragment_offset = 0;
> > + while (fragment_offset < fw->size) {
> > + if (fragment_offset + payload_max_size < fw->size)
> > {
> > + fragment_size = payload_max_size;
> > + ldr_xfer_ipc_frag->fragment.is_last = 0;
> > + } else {
> > + fragment_size = fw->size - fragment_offset;
> > + ldr_xfer_ipc_frag->fragment.is_last = 1;
> > + }
> > +
> > + ldr_xfer_ipc_frag->fragment.offset =
> > fragment_offset;
> > + ldr_xfer_ipc_frag->fragment.size = fragment_size;
> > + memcpy(ldr_xfer_ipc_frag->data,
> > + &fw->data[fragment_offset],
> > + fragment_size);
> > +
> > + dev_dbg(cl_data_to_dev(client_data),
> > + "xfer_mode=ipc offset=0x%08x size=0x%08x
> > is_last=%d\n",
> > + ldr_xfer_ipc_frag->fragment.offset,
> > + ldr_xfer_ipc_frag->fragment.size,
> > + ldr_xfer_ipc_frag->fragment.is_last);
> > +
> > + rv = loader_cl_send(client_data,
> > + (u8 *)ldr_xfer_ipc_frag,
> > + IPC_FRAGMENT_DATA_PREAMBLE +
> > fragment_size,
> > + (u8 *)&ldr_xfer_ipc_ack,
> > + sizeof(ldr_xfer_ipc_ack));
> > + if (rv < 0) {
> > + client_data->flag_retry = true;
> > + goto end_err_resp_buf_release;
> > + }
> > +
> > + fragment_offset += fragment_size;
> > + }
> > +
> > + kfree(ldr_xfer_ipc_frag);
> > + return 0;
> > +
> > +end_err_resp_buf_release:
> > + /* Free ISH buffer if not done already, in error case */
> > + kfree(ldr_xfer_ipc_frag);
> > + return rv;
> > +}
> > +
> > +/**
> > + * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
> > + * @client_data: Client data instance
> > + * @fw: Pointer to firmware data struct in
> > host memory
> > + * @fw_info: Loader firmware properties
> > + *
> > + * Host firmware load is a unique case where we need to download
> > + * a large firmware image (200+ Kb). This function implements
> > + * direct DMA transfer in kernel and ISH firmware. This allows
> > + * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
> > + * directly to ISH UMA at location of choice.
> > + * Function depends on corresponding support in ISH firmware.
> > + *
> > + * Return: 0 for success, negative error code for failure.
> > + */
> > +static int ish_fw_xfer_direct_dma(struct ishtp_cl_data
> > *client_data,
> > + const struct firmware *fw,
> > + const struct shim_fw_info
> > fw_info)
> > +{
> > + int rv;
> > + void *dma_buf;
> > + dma_addr_t dma_buf_phy;
> > + u32 fragment_offset, fragment_size, payload_max_size;
> > + struct loader_msg_hdr ldr_xfer_dma_frag_ack;
> > + struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
> > + struct device *devc = ishtp_get_pci_device(client_data-
> > >cl_device);
> > + u32 shim_fw_buf_size =
> > + fw_info.ldr_capability.max_dma_buf_size;
> > +
> > + /*
> > + * payload_max_size should be set to minimum of
> > + * (1) Size of firmware to be loaded,
> > + * (2) Max DMA buffer size supported by Shim firmware,
> > + * (3) DMA buffer size limit set by boot_param
> > dma_buf_size_limit.
> > + */
> > + payload_max_size = min3(fw->size,
> > + (size_t)shim_fw_buf_size,
> > + (size_t)dma_buf_size_limit);
> > +
> > + /*
> > + * Buffer size should be multiple of cacheline size
> > + * if it's not, select the previous cacheline boundary.
> > + */
> > + payload_max_size &= ~(L1_CACHE_BYTES - 1);
> > +
> > + dma_buf = kmalloc(payload_max_size, GFP_KERNEL |
> > GFP_DMA32);
> > + if (!dma_buf) {
> > + client_data->flag_retry = true;
> > + return -ENOMEM;
> > + }
> > +
> > + dma_buf_phy = dma_map_single(devc, dma_buf,
> > payload_max_size,
> > + DMA_TO_DEVICE);
> > + if (dma_mapping_error(devc, dma_buf_phy)) {
> > + dev_err(cl_data_to_dev(client_data), "DMA map
> > failed\n");
> > + client_data->flag_retry = true;
> > + rv = -ENOMEM;
> > + goto end_err_dma_buf_release;
> > + }
> > +
> > + ldr_xfer_dma_frag.fragment.hdr.command =
> > LOADER_CMD_XFER_FRAGMENT;
> > + ldr_xfer_dma_frag.fragment.xfer_mode =
> > LOADER_XFER_MODE_DIRECT_DMA;
> > + ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
> > +
> > + /* Send the firmware image in chucks of payload_max_size */
> > + fragment_offset = 0;
> > + while (fragment_offset < fw->size) {
> > + if (fragment_offset + payload_max_size < fw->size)
> > {
> > + fragment_size = payload_max_size;
> > + ldr_xfer_dma_frag.fragment.is_last = 0;
> > + } else {
> > + fragment_size = fw->size - fragment_offset;
> > + ldr_xfer_dma_frag.fragment.is_last = 1;
> > + }
> > +
> > + ldr_xfer_dma_frag.fragment.offset =
> > fragment_offset;
> > + ldr_xfer_dma_frag.fragment.size = fragment_size;
> > + memcpy(dma_buf, &fw->data[fragment_offset],
> > fragment_size);
> > +
> > + dma_sync_single_for_device(devc, dma_buf_phy,
> > + payload_max_size,
> > + DMA_TO_DEVICE);
> > +
> > + /*
> > + * Flush cache here because the
> > dma_sync_single_for_device()
> > + * does not do for x86.
> > + */
> > + clflush_cache_range(dma_buf, payload_max_size);
> > +
> > + dev_dbg(cl_data_to_dev(client_data),
> > + "xfer_mode=dma offset=0x%08x size=0x%x
> > is_last=%d ddr_phys_addr=0x%016llx\n",
> > + ldr_xfer_dma_frag.fragment.offset,
> > + ldr_xfer_dma_frag.fragment.size,
> > + ldr_xfer_dma_frag.fragment.is_last,
> > + ldr_xfer_dma_frag.ddr_phys_addr);
> > +
> > + rv = loader_cl_send(client_data,
> > + (u8 *)&ldr_xfer_dma_frag,
> > + sizeof(ldr_xfer_dma_frag),
> > + (u8 *)&ldr_xfer_dma_frag_ack,
> > + sizeof(ldr_xfer_dma_frag_ack));
> > + if (rv < 0) {
> > + client_data->flag_retry = true;
> > + goto end_err_resp_buf_release;
> > + }
> > +
> > + fragment_offset += fragment_size;
> > + }
> > +
> > + dma_unmap_single(devc, dma_buf_phy, payload_max_size,
> > DMA_TO_DEVICE);
> > + kfree(dma_buf);
> > + return 0;
> > +
> > +end_err_resp_buf_release:
> > + /* Free ISH buffer if not done already, in error case */
> > + dma_unmap_single(devc, dma_buf_phy, payload_max_size,
> > DMA_TO_DEVICE);
> > +end_err_dma_buf_release:
> > + kfree(dma_buf);
> > + return rv;
> > +}
> > +
> > +/**
> > + * ish_fw_start() Start executing ISH main firmware
> > + * @client_data: client data instance
> > + *
> > + * This function sends message to Shim firmware loader to start
> > + * the execution of ISH main firmware.
> > + *
> > + * Return: 0 for success, negative error code for failure.
> > + */
> > +static int ish_fw_start(struct ishtp_cl_data *client_data)
> > +{
> > + struct loader_start ldr_start;
> > + struct loader_msg_hdr ldr_start_ack;
> > +
> > + memset(&ldr_start, 0, sizeof(ldr_start));
> > + ldr_start.hdr.command = LOADER_CMD_START;
> > + return loader_cl_send(client_data,
> > + (u8 *)&ldr_start,
> > + sizeof(ldr_start),
> > + (u8 *)&ldr_start_ack,
> > + sizeof(ldr_start_ack));
> > +}
> > +
> > +/**
> > + * load_fw_from_host() Loads ISH firmware from host
> > + * @client_data: Client data instance
> > + *
> > + * This function loads the ISH firmware to ISH SRAM and starts
> > execution
> > + *
> > + * Return: 0 for success, negative error code for failure.
> > + */
> > +static int load_fw_from_host(struct ishtp_cl_data *client_data)
> > +{
> > + int rv;
> > + u32 xfer_mode;
> > + char *filename;
> > + const struct firmware *fw;
> > + struct shim_fw_info fw_info;
> > + struct ishtp_cl *loader_ishtp_cl = client_data-
> > >loader_ishtp_cl;
> > +
> > + client_data->flag_retry = false;
> > +
> > + filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
> > + if (!filename) {
> > + client_data->flag_retry = true;
> > + rv = -ENOMEM;
> > + goto end_error;
> > + }
> > +
> > + /* Get filename of the ISH firmware to be loaded */
> > + rv = get_firmware_variant(client_data, filename);
> > + if (rv < 0)
> > + goto end_err_filename_buf_release;
> > +
> > + rv = request_firmware(&fw, filename,
> > cl_data_to_dev(client_data));
> > + if (rv < 0)
> > + goto end_err_filename_buf_release;
> > +
> > + /* Step 1: Query Shim firmware loader properties */
> > +
> > + rv = ish_query_loader_prop(client_data, fw, &fw_info);
> > + if (rv < 0)
> > + goto end_err_fw_release;
> > +
> > + /* Step 2: Send the main firmware image to be loaded, to
> > ISH SRAM */
> > +
> > + xfer_mode = fw_info.ldr_capability.xfer_mode;
> > + if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
> > + rv = ish_fw_xfer_direct_dma(client_data, fw,
> > fw_info);
> > + } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
> > + rv = ish_fw_xfer_ishtp(client_data, fw);
> > + } else {
> > + dev_err(cl_data_to_dev(client_data),
> > + "No transfer mode selected in firmware\n");
> > + rv = -EINVAL;
> > + }
> > + if (rv < 0)
> > + goto end_err_fw_release;
> > +
> > + /* Step 3: Start ISH main firmware exeuction */
> > +
> > + rv = ish_fw_start(client_data);
> > + if (rv < 0)
> > + goto end_err_fw_release;
> > +
> > + release_firmware(fw);
> > + kfree(filename);
> > + dev_info(cl_data_to_dev(client_data), "ISH firmware %s
> > loaded\n",
> > + filename);
> > + return 0;
> > +
> > +end_err_fw_release:
> > + release_firmware(fw);
> > +end_err_filename_buf_release:
> > + kfree(filename);
> > +end_error:
> > + /* Keep a count of retries, and give up after 3 attempts */
> > + if (client_data->flag_retry &&
> > + client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
> > + dev_warn(cl_data_to_dev(client_data),
> > + "ISH host firmware load failed %d.
> > Resetting ISH, and trying again..\n",
> > + rv);
> > + ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl
> > ));
> > + } else {
> > + dev_err(cl_data_to_dev(client_data),
> > + "ISH host firmware load failed %d\n", rv);
> > + }
> > + return rv;
> > +}
> > +
> > +static void load_fw_from_host_handler(struct work_struct *work)
> > +{
> > + struct ishtp_cl_data *client_data;
> > +
> > + client_data = container_of(work, struct ishtp_cl_data,
> > + work_fw_load);
> > + load_fw_from_host(client_data);
> > +}
> > +
> > +/**
> > + * loader_init() - Init function for ISH-TP client
> > + * @loader_ishtp_cl: ISH-TP client instance
> > + * @reset: true if called for init after reset
> > + *
> > + * Return: 0 for success, negative error code for failure
> > + */
> > +static int loader_init(struct ishtp_cl *loader_ishtp_cl, int
> > reset)
> > +{
> > + int rv;
> > + struct ishtp_fw_client *fw_client;
> > + struct ishtp_cl_data *client_data =
> > + ishtp_get_client_data(loader_ishtp_cl);
> > +
> > + dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n",
> > reset);
> > +
> > + rv = ishtp_cl_link(loader_ishtp_cl);
> > + if (rv < 0) {
> > + dev_err(cl_data_to_dev(client_data), "ishtp_cl_link
> > failed\n");
> > + return rv;
> > + }
> > +
> > + /* Connect to firmware client */
> > + ishtp_set_tx_ring_size(loader_ishtp_cl,
> > LOADER_CL_TX_RING_SIZE);
> > + ishtp_set_rx_ring_size(loader_ishtp_cl,
> > LOADER_CL_RX_RING_SIZE);
> > +
> > + fw_client =
> > + ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loade
> > r_ishtp_cl),
> > + &loader_ishtp_guid);
> > + if (!fw_client) {
> > + dev_err(cl_data_to_dev(client_data),
> > + "ISH client uuid not found\n");
> > + rv = -ENOENT;
> > + goto err_cl_unlink;
> > + }
> > +
> > + ishtp_cl_set_fw_client_id(loader_ishtp_cl,
> > + ishtp_get_fw_client_id(fw_client)
> > );
> > + ishtp_set_connection_state(loader_ishtp_cl,
> > ISHTP_CL_CONNECTING);
> > +
> > + rv = ishtp_cl_connect(loader_ishtp_cl);
> > + if (rv < 0) {
> > + dev_err(cl_data_to_dev(client_data), "Client
> > connect fail\n");
> > + goto err_cl_unlink;
> > + }
> > +
> > + dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
> > +
> > + ishtp_register_event_cb(client_data->cl_device,
> > loader_cl_event_cb);
> > +
> > + return 0;
> > +
> > +err_cl_unlink:
> > + ishtp_cl_unlink(loader_ishtp_cl);
> > + return rv;
> > +}
> > +
> > +static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
> > +{
> > + ishtp_set_connection_state(loader_ishtp_cl,
> > ISHTP_CL_DISCONNECTING);
> > + ishtp_cl_disconnect(loader_ishtp_cl);
> > + ishtp_cl_unlink(loader_ishtp_cl);
> > + ishtp_cl_flush_queues(loader_ishtp_cl);
> > +
> > + /* Disband and free all Tx and Rx client-level rings */
> > + ishtp_cl_free(loader_ishtp_cl);
> > +}
> > +
> > +static void reset_handler(struct work_struct *work)
> > +{
> > + int rv;
> > + struct ishtp_cl_data *client_data;
> > + struct ishtp_cl *loader_ishtp_cl;
> > + struct ishtp_cl_device *cl_device;
> > +
> > + client_data = container_of(work, struct ishtp_cl_data,
> > + work_ishtp_reset);
> > +
> > + loader_ishtp_cl = client_data->loader_ishtp_cl;
> > + cl_device = client_data->cl_device;
> > +
> > + /* Unlink, flush queues & start again */
> > + ishtp_cl_unlink(loader_ishtp_cl);
> > + ishtp_cl_flush_queues(loader_ishtp_cl);
> > + ishtp_cl_free(loader_ishtp_cl);
> > +
> > + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> > + if (!loader_ishtp_cl)
> > + return;
> > +
> > + ishtp_set_drvdata(cl_device, loader_ishtp_cl);
> > + ishtp_set_client_data(loader_ishtp_cl, client_data);
> > + client_data->loader_ishtp_cl = loader_ishtp_cl;
> > + client_data->cl_device = cl_device;
> > +
> > + rv = loader_init(loader_ishtp_cl, 1);
> > + if (rv < 0) {
> > + dev_err(ishtp_device(cl_device), "Reset Failed\n");
> > + return;
> > + }
> > +
> > + /* ISH firmware loading from host */
> > + load_fw_from_host(client_data);
> > +}
> > +
> > +/**
> > + * loader_ishtp_cl_probe() - ISH-TP client driver probe
> > + * @cl_device: ISH-TP client device instance
> > + *
> > + * This function gets called on device create on ISH-TP bus
> > + *
> > + * Return: 0 for success, negative error code for failure
> > + */
> > +static int loader_ishtp_cl_probe(struct ishtp_cl_device
> > *cl_device)
> > +{
> > + struct ishtp_cl *loader_ishtp_cl;
> > + struct ishtp_cl_data *client_data;
> > + int rv;
> > +
> > + client_data = devm_kzalloc(ishtp_device(cl_device),
> > + sizeof(*client_data),
> > + GFP_KERNEL);
> > + if (!client_data)
> > + return -ENOMEM;
> > +
> > + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> > + if (!loader_ishtp_cl)
> > + return -ENOMEM;
> > +
> > + ishtp_set_drvdata(cl_device, loader_ishtp_cl);
> > + ishtp_set_client_data(loader_ishtp_cl, client_data);
> > + client_data->loader_ishtp_cl = loader_ishtp_cl;
> > + client_data->cl_device = cl_device;
> > +
> > + init_waitqueue_head(&client_data->response.wait_queue);
> > +
> > + INIT_WORK(&client_data->work_ishtp_reset,
> > + reset_handler);
> > + INIT_WORK(&client_data->work_fw_load,
> > + load_fw_from_host_handler);
> > +
> > + rv = loader_init(loader_ishtp_cl, 0);
> > + if (rv < 0) {
> > + ishtp_cl_free(loader_ishtp_cl);
> > + return rv;
> > + }
> > + ishtp_get_device(cl_device);
> > +
> > + client_data->retry_count = 0;
> > +
> > + /* ISH firmware loading from host */
> > + schedule_work(&client_data->work_fw_load);
> > +
> > + return 0;
> > +}
> > +
> > +/**
> > + * loader_ishtp_cl_remove() - ISH-TP client driver remove
> > + * @cl_device: ISH-TP client device instance
> > + *
> > + * This function gets called on device remove on ISH-TP bus
> > + *
> > + * Return: 0
> > + */
> > +static int loader_ishtp_cl_remove(struct ishtp_cl_device
> > *cl_device)
> > +{
> > + struct ishtp_cl_data *client_data;
> > + struct ishtp_cl *loader_ishtp_cl =
> > ishtp_get_drvdata(cl_device);
> > +
> > + client_data = ishtp_get_client_data(loader_ishtp_cl);
> > +
> > + /*
> > + * The sequence of the following two cancel_work_sync() is
> > + * important. The work_fw_load can in turn schedue
> > + * work_ishtp_reset, so first cancel work_fw_load then
> > + * cancel work_ishtp_reset.
> > + */
> > + cancel_work_sync(&client_data->work_fw_load);
> > + cancel_work_sync(&client_data->work_ishtp_reset);
> > + loader_deinit(loader_ishtp_cl);
> > + ishtp_put_device(cl_device);
> > +
> > + return 0;
> > +}
> > +
> > +/**
> > + * loader_ishtp_cl_reset() - ISH-TP client driver reset
> > + * @cl_device: ISH-TP client device instance
> > + *
> > + * This function gets called on device reset on ISH-TP bus
> > + *
> > + * Return: 0
> > + */
> > +static int loader_ishtp_cl_reset(struct ishtp_cl_device
> > *cl_device)
> > +{
> > + struct ishtp_cl_data *client_data;
> > + struct ishtp_cl *loader_ishtp_cl =
> > ishtp_get_drvdata(cl_device);
> > +
> > + client_data = ishtp_get_client_data(loader_ishtp_cl);
> > +
> > + schedule_work(&client_data->work_ishtp_reset);
> > +
> > + return 0;
> > +}
> > +
> > +static struct ishtp_cl_driver loader_ishtp_cl_driver = {
> > + .name = "ish-loader",
> > + .guid = &loader_ishtp_guid,
> > + .probe = loader_ishtp_cl_probe,
> > + .remove = loader_ishtp_cl_remove,
> > + .reset = loader_ishtp_cl_reset,
> > +};
> > +
> > +static int __init ish_loader_init(void)
> > +{
> > + return ishtp_cl_driver_register(&loader_ishtp_cl_driver,
> > THIS_MODULE);
> > +}
> > +
> > +static void __exit ish_loader_exit(void)
> > +{
> > + ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
> > +}
> > +
> > +late_initcall(ish_loader_init);
> > +module_exit(ish_loader_exit);
> > +
> > +module_param(dma_buf_size_limit, int, 0644);
> > +MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to
> > this value in bytes");
> > +
> > +MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client
> > Driver");
> > +MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
> > +
> > +MODULE_LICENSE("GPL v2");
> > +MODULE_ALIAS("ishtp:*");
> > --
> > 1.9.1
> >
>
> Reviewed-by: Nick Crews <ncrews@chromium.org>
^ permalink raw reply
* Re: [PATCH v4] HID: intel-ish-hid: ISH firmware loader client driver
From: Srinivas Pandruvada @ 2019-04-02 0:43 UTC (permalink / raw)
To: Rushikesh S Kadam, benjamin.tissoires, jikos
Cc: ncrews, jettrink, gwendal, linux-kernel, linux-input
In-Reply-To: <1553945015-10919-1-git-send-email-rushikesh.s.kadam@intel.com>
On Sat, 2019-03-30 at 16:53 +0530, Rushikesh S Kadam wrote:
> This driver adds support for loading Intel Integrated
> Sensor Hub (ISH) firmware from host file system to ISH
> SRAM and start execution.
>
> At power-on, the ISH subsystem shall boot to an interim
> Shim loader-firmware, which shall expose an ISHTP loader
> device.
>
> The driver implements an ISHTP client that communicates
> with the Shim ISHTP loader device over the intel-ish-hid
> stack, to download the main ISH firmware.
>
> Signed-off-by: Rushikesh S Kadam <rushikesh.s.kadam@intel.com>
Rushikesh,
You have one reviewed by and one Tested-by from Chrome developers.
Please add those.
Also you can also add
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> ---
> The patches are baselined to hid git tree, branch for-5.2/ish
>
https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git/log/?h=for-5.2/ish
>
> v4
> - Changed process_recv() to wake the caller in case of
> error as well. Earlier caller would wait until timeout on
> an error.
> - Change sequence of few checks in process_recv().
>
> v3
> - Moved a couple of sanity checks from loader_cl_send() to
> process_recv().
> - Several minor changes to address review comments.
>
> v2
> - Change loader_cl_send() so that the calling function
> shall allocate and pass the buffer to be used for
> receiving firwmare response data. Corresponding changes
> in calling function and process_recv().
> - Introduced struct response_info to encapsulate and pass
> data between from the process_recv() callback to
> calling function loader_cl_send().
> - Keep count of host firmware load retries, and fail after
> 3 unsuccessful attempts.
> - Dropped report_bad_packets() function previously used for
> keeping count of bad packets.
> - Inlined loader_ish_hw_reset()'s functionality
>
> v1
> - Initial version.
>
> drivers/hid/Makefile | 1 +
> drivers/hid/intel-ish-hid/Kconfig | 15 +
> drivers/hid/intel-ish-hid/Makefile | 3 +
> drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 1085
> +++++++++++++++++++++++++++
> 4 files changed, 1104 insertions(+)
> create mode 100644 drivers/hid/intel-ish-hid/ishtp-fw-loader.c
>
> diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
> index 170163b..d8d393e 100644
> --- a/drivers/hid/Makefile
> +++ b/drivers/hid/Makefile
> @@ -134,3 +134,4 @@ obj-$(CONFIG_USB_KBD) += usbhid/
> obj-$(CONFIG_I2C_HID) += i2c-hid/
>
> obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/
> +obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
> diff --git a/drivers/hid/intel-ish-hid/Kconfig b/drivers/hid/intel-
> ish-hid/Kconfig
> index 519e4c8..786adbc 100644
> --- a/drivers/hid/intel-ish-hid/Kconfig
> +++ b/drivers/hid/intel-ish-hid/Kconfig
> @@ -14,4 +14,19 @@ config INTEL_ISH_HID
> Broxton and Kaby Lake.
>
> Say Y here if you want to support Intel ISH. If unsure, say
> N.
> +
> +config INTEL_ISH_FIRMWARE_DOWNLOADER
> + tristate "Host Firmware Load feature for Intel ISH"
> + depends on INTEL_ISH_HID
> + depends on X86
> + help
> + The Integrated Sensor Hub (ISH) enables the kernel to offload
> + sensor polling and algorithm processing to a dedicated low
> power
> + processor in the chipset.
> +
> + The Host Firmware Load feature adds support to load the ISH
> + firmware from host file system at boot.
> +
> + Say M here if you want to support Host Firmware Loading
> feature
> + for Intel ISH. If unsure, say N.
> endmenu
> diff --git a/drivers/hid/intel-ish-hid/Makefile b/drivers/hid/intel-
> ish-hid/Makefile
> index 825b70a..2de97e4 100644
> --- a/drivers/hid/intel-ish-hid/Makefile
> +++ b/drivers/hid/intel-ish-hid/Makefile
> @@ -20,4 +20,7 @@ obj-$(CONFIG_INTEL_ISH_HID) += intel-ishtp-hid.o
> intel-ishtp-hid-objs := ishtp-hid.o
> intel-ishtp-hid-objs += ishtp-hid-client.o
>
> +obj-$(CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ishtp-loader.o
> +intel-ishtp-loader-objs += ishtp-fw-loader.o
> +
> ccflags-y += -Idrivers/hid/intel-ish-hid/ishtp
> diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> new file mode 100644
> index 0000000..e770e22
> --- /dev/null
> +++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> @@ -0,0 +1,1085 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * ISH-TP client driver for ISH firmware loading
> + *
> + * Copyright (c) 2019, Intel Corporation.
> + */
> +
> +#include <linux/firmware.h>
> +#include <linux/module.h>
> +#include <linux/pci.h>
> +#include <linux/intel-ish-client-if.h>
> +#include <linux/property.h>
> +#include <asm/cacheflush.h>
> +
> +/* Number of times we attempt to load the firmware before giving up
> */
> +#define MAX_LOAD_ATTEMPTS 3
> +
> +/* ISH TX/RX ring buffer pool size */
> +#define LOADER_CL_RX_RING_SIZE 1
> +#define LOADER_CL_TX_RING_SIZE 1
> +
> +/*
> + * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer
> is
> + * used to temporarily hold the data transferred from host to Shim
> + * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
> + * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So
> the
> + * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we
> can
> + * have a max payload of 3968 bytes (= 32 x 124 payload).
> + */
> +#define LOADER_SHIM_IPC_BUF_SIZE 3968
> +
> +/**
> + * enum ish_loader_commands - ISH loader host commands.
> + * LOADER_CMD_XFER_QUERY Query the Shim firmware loader for
> + * capabilities
> + * LOADER_CMD_XFER_FRAGMENT Transfer one firmware image fragment at
> a
> + * time. The command may be executed
> + * multiple times until the entire
> firmware
> + * image is downloaded to SRAM.
> + * LOADER_CMD_START Start executing the main firmware.
> + */
> +enum ish_loader_commands {
> + LOADER_CMD_XFER_QUERY = 0,
> + LOADER_CMD_XFER_FRAGMENT,
> + LOADER_CMD_START,
> +};
> +
> +/* Command bit mask */
> +#define CMD_MASK GENMASK(6, 0)
> +#define IS_RESPONSE BIT(7)
> +
> +/*
> + * ISH firmware max delay for one transmit failure is 1 Hz,
> + * and firmware will retry 2 times, so 3 Hz is used for timeout.
> + */
> +#define ISHTP_SEND_TIMEOUT (3 * HZ)
> +
> +/*
> + * Loader transfer modes:
> + *
> + * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
> + * transfer data. This may use IPC or DMA if supported in firmware.
> + * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
> + * both IPC & DMA (legacy).
> + *
> + * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
> + * from the sensor data streaming. Here we download a large (300+
> Kb)
> + * image directly to ISH SRAM memory. There is limited benefit of
> + * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
> + * this "direct dma" mode, where we do not use ISH-TP for DMA, but
> + * instead manage the DMA directly in kernel driver and Shim
> firmware
> + * loader (allocate buffer, break in chucks and transfer). This
> allows
> + * to overcome 4 Kb limit, and optimize the data flow path in
> firmware.
> + */
> +#define LOADER_XFER_MODE_DIRECT_DMA BIT(0)
> +#define LOADER_XFER_MODE_ISHTP BIT(1)
> +
> +/* ISH Transport Loader client unique GUID */
> +static const guid_t loader_ishtp_guid =
> + GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
> + 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc);
> +
> +#define FILENAME_SIZE 256
> +
> +/*
> + * The firmware loading latency will be minimum if we can DMA the
> + * entire ISH firmware image in one go. This requires that we
> allocate
> + * a large DMA buffer in kernel, which could be problematic on some
> + * platforms. So here we limit the DMA buffer size via a
> module_param.
> + * We default to 4 pages, but a customer can set it to higher limit
> if
> + * deemed appropriate for his platform.
> + */
> +static int dma_buf_size_limit = 4 * PAGE_SIZE;
> +
> +/**
> + * struct loader_msg_hdr - Header for ISH Loader commands.
> + * @command: LOADER_CMD* commands. Bit 7 is the response.
> + * @status: Command response status. Non 0, is error
> + * condition.
> + *
> + * This structure is used as header for every command/data
> sent/received
> + * between Host driver and ISH Shim firmware loader.
> + */
> +struct loader_msg_hdr {
> + u8 command;
> + u8 reserved[2];
> + u8 status;
> +} __packed;
> +
> +struct loader_xfer_query {
> + struct loader_msg_hdr hdr;
> + u32 image_size;
> +} __packed;
> +
> +struct ish_fw_version {
> + u16 major;
> + u16 minor;
> + u16 hotfix;
> + u16 build;
> +} __packed;
> +
> +union loader_version {
> + u32 value;
> + struct {
> + u8 major;
> + u8 minor;
> + u8 hotfix;
> + u8 build;
> + };
> +} __packed;
> +
> +struct loader_capability {
> + u32 max_fw_image_size;
> + u32 xfer_mode;
> + u32 max_dma_buf_size; /* only for dma mode, multiples of
> cacheline */
> +} __packed;
> +
> +struct shim_fw_info {
> + struct ish_fw_version ish_fw_version;
> + u32 protocol_version;
> + union loader_version ldr_version;
> + struct loader_capability ldr_capability;
> +} __packed;
> +
> +struct loader_xfer_query_response {
> + struct loader_msg_hdr hdr;
> + struct shim_fw_info fw_info;
> +} __packed;
> +
> +struct loader_xfer_fragment {
> + struct loader_msg_hdr hdr;
> + u32 xfer_mode;
> + u32 offset;
> + u32 size;
> + u32 is_last;
> +} __packed;
> +
> +struct loader_xfer_ipc_fragment {
> + struct loader_xfer_fragment fragment;
> + u8 data[] ____cacheline_aligned; /* variable length payload
> here */
> +} __packed;
> +
> +struct loader_xfer_dma_fragment {
> + struct loader_xfer_fragment fragment;
> + u64 ddr_phys_addr;
> +} __packed;
> +
> +struct loader_start {
> + struct loader_msg_hdr hdr;
> +} __packed;
> +
> +/**
> + * struct response_info - Encapsulate firmware response related
> + * information for passing between function
> + * loader_cl_send() and process_recv() callback.
> + * @data Copy the data received from firmware here.
> + * @max_size Max size allocated for the @data buffer. If the
> + * received data exceeds this value, we log an
> + * error.
> + * @size Actual size of data received from firmware.
> + * @error Returns 0 for success, negative error code for
> a
> + * failure in function process_recv().
> + * @received Set to true on receiving a valid firmware
> + * response to host command
> + * @wait_queue Wait queue for Host firmware loading
> where the
> + * client sends message to ISH firmware and waits
> + * for response
> + */
> +struct response_info {
> + void *data;
> + size_t max_size;
> + size_t size;
> + int error;
> + bool received;
> + wait_queue_head_t wait_queue;
> +};
> +
> +/**
> + * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
> + * @work_ishtp_reset: Work queue for reset handling.
> + * @work_fw_load: Work queue for host firmware loading.
> + * @flag_retry Flag for indicating host firmware
> loading should
> + * be retried.
> + * @retry_count Count the number of retries.
> + *
> + * This structure is used to store data per client.
> + */
> +struct ishtp_cl_data {
> + struct ishtp_cl *loader_ishtp_cl;
> + struct ishtp_cl_device *cl_device;
> +
> + /*
> + * Used for passing firmware response information between
> + * loader_cl_send() and process_recv() callback.
> + */
> + struct response_info response;
> +
> + struct work_struct work_ishtp_reset;
> + struct work_struct work_fw_load;
> +
> + /*
> + * In certain failure scenrios, it makes sense to reset the ISH
> + * subsystem and retry Host firmware loading (e.g. bad message
> + * packet, ENOMEM, etc.). On the other hand, failures due to
> + * protocol mismatch, etc., are not recoverable. We do not
> + * retry them.
> + *
> + * If set, the flag indicates that we should re-try the
> + * particular failure.
> + */
> + bool flag_retry;
> + int retry_count;
> +};
> +
> +#define IPC_FRAGMENT_DATA_PREAMBLE \
> + offsetof(struct loader_xfer_ipc_fragment, data)
> +
> +#define cl_data_to_dev(client_data) ishtp_device((client_data)-
> >cl_device)
> +
> +/**
> + * get_firmware_variant() - Gets the filename of firmware image to
> be
> + * loaded based on platform variant.
> + * @client_data Client data instance.
> + * @filename Returns firmware filename.
> + *
> + * Queries the firmware-name device property string.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int get_firmware_variant(struct ishtp_cl_data *client_data,
> + char *filename)
> +{
> + int rv;
> + const char *val;
> + struct device *devc = ishtp_get_pci_device(client_data-
> >cl_device);
> +
> + rv = device_property_read_string(devc, "firmware-name", &val);
> + if (rv < 0) {
> + dev_err(devc,
> + "Error: ISH firmware-name device property
> required\n");
> + return rv;
> + }
> + return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
> +}
> +
> +/**
> + * loader_cl_send() Send message from host to firmware
> + * @client_data: Client data instance
> + * @out_msg Message buffer to be sent to firmware
> + * @out_size Size of out going message
> + * @in_msg Message buffer where the incoming data copied.
> + * This buffer is allocated by calling
> + * @in_size Max size of incoming message
> + *
> + * Return: Number of bytes copied in the in_msg on success, negative
> + * error code on failure.
> + */
> +static int loader_cl_send(struct ishtp_cl_data *client_data,
> + u8 *out_msg, size_t out_size,
> + u8 *in_msg, size_t in_size)
> +{
> + int rv;
> + struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr
> *)out_msg;
> + struct ishtp_cl *loader_ishtp_cl = client_data-
> >loader_ishtp_cl;
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "%s: command=%02lx is_response=%u status=%02x\n",
> + __func__,
> + out_hdr->command & CMD_MASK,
> + out_hdr->command & IS_RESPONSE ? 1 : 0,
> + out_hdr->status);
> +
> + /* Setup in coming buffer & size */
> + client_data->response.data = in_msg;
> + client_data->response.max_size = in_size;
> + client_data->response.error = 0;
> + client_data->response.received = false;
> +
> + rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
> + if (rv < 0) {
> + dev_err(cl_data_to_dev(client_data),
> + "ishtp_cl_send error %d\n", rv);
> + return rv;
> + }
> +
> + wait_event_interruptible_timeout(client_data-
> >response.wait_queue,
> + client_data-
> >response.received,
> + ISHTP_SEND_TIMEOUT);
> + if (!client_data->response.received) {
> + dev_err(cl_data_to_dev(client_data),
> + "Timed out for response to command=%02lx",
> + out_hdr->command & CMD_MASK);
> + return -ETIMEDOUT;
> + }
> +
> + if (client_data->response.error < 0)
> + return client_data->response.error;
> +
> + return client_data->response.size;
> +}
> +
> +/**
> + * process_recv() - Receive and parse incoming packet
> + * @loader_ishtp_cl: Client instance to get stats
> + * @rb_in_proc: ISH received message buffer
> + *
> + * Parse the incoming packet. If it is a response packet then it
> will
> + * update received and wake up the caller waiting to for the
> response.
> + */
> +static void process_recv(struct ishtp_cl *loader_ishtp_cl,
> + struct ishtp_cl_rb *rb_in_proc)
> +{
> + struct loader_msg_hdr *hdr;
> + size_t data_len = rb_in_proc->buf_idx;
> + struct ishtp_cl_data *client_data =
> + ishtp_get_client_data(loader_ishtp_cl);
> +
> + /* Sanity check */
> + if (!client_data->response.data) {
> + dev_err(cl_data_to_dev(client_data),
> + "Receiving buffer is null. Should be allocated
> by calling function\n");
> + client_data->response.error = -EINVAL;
> + goto end;
> + }
> +
> + if (client_data->response.received) {
> + dev_err(cl_data_to_dev(client_data),
> + "Previous firmware message not yet
> processed\n");
> + client_data->response.error = -EINVAL;
> + goto end;
> + }
> + /*
> + * All firmware messages have a header. Check buffer size
> + * before accessing elements inside.
> + */
> + if (!rb_in_proc->buffer.data) {
> + dev_warn(cl_data_to_dev(client_data),
> + "rb_in_proc->buffer.data returned null");
> + client_data->response.error = -EBADMSG;
> + goto end;
> + }
> +
> + if (data_len < sizeof(struct loader_msg_hdr)) {
> + dev_err(cl_data_to_dev(client_data),
> + "data size %zu is less than header %zu\n",
> + data_len, sizeof(struct loader_msg_hdr));
> + client_data->response.error = -EMSGSIZE;
> + goto end;
> + }
> +
> + hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "%s: command=%02lx is_response=%u status=%02x\n",
> + __func__,
> + hdr->command & CMD_MASK,
> + hdr->command & IS_RESPONSE ? 1 : 0,
> + hdr->status);
> +
> + if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
> + ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
> + ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
> + dev_err(cl_data_to_dev(client_data),
> + "Invalid command=%02lx\n",
> + hdr->command & CMD_MASK);
> + client_data->response.error = -EPROTO;
> + goto end;
> + }
> +
> + if (data_len > client_data->response.max_size) {
> + dev_err(cl_data_to_dev(client_data),
> + "Received buffer size %zu is larger than
> allocated buffer %zu\n",
> + data_len, client_data->response.max_size);
> + client_data->response.error = -EMSGSIZE;
> + goto end;
> + }
> +
> + /* We expect only "response" messages from firmware */
> + if (!(hdr->command & IS_RESPONSE)) {
> + dev_err(cl_data_to_dev(client_data),
> + "Invalid response to command\n");
> + client_data->response.error = -EIO;
> + goto end;
> + }
> +
> + if (hdr->status) {
> + dev_err(cl_data_to_dev(client_data),
> + "Loader returned status %d\n",
> + hdr->status);
> + client_data->response.error = -EIO;
> + goto end;
> + }
> +
> + /* Update the actual received buffer size */
> + client_data->response.size = data_len;
> +
> + /*
> + * Copy the buffer received in firmware response for the
> + * calling thread.
> + */
> + memcpy(client_data->response.data,
> + rb_in_proc->buffer.data, data_len);
> +
> + /* Set flag before waking up the caller */
> + client_data->response.received = true;
> +
> +end:
> + /* Free the buffer */
> + ishtp_cl_io_rb_recycle(rb_in_proc);
> + rb_in_proc = NULL;
> +
> + /* Wake the calling thread */
> + wake_up_interruptible(&client_data->response.wait_queue);
> +}
> +
> +/**
> + * loader_cl_event_cb() - bus driver callback for incoming message
> + * @device: Pointer to the ishtp client device for which
> this
> + * message is targeted
> + *
> + * Remove the packet from the list and process the message by
> calling
> + * process_recv
> + */
> +static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl_rb *rb_in_proc;
> + struct ishtp_cl *loader_ishtp_cl =
> ishtp_get_drvdata(cl_device);
> +
> + while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) !=
> NULL) {
> + /* Process the data packet from firmware */
> + process_recv(loader_ishtp_cl, rb_in_proc);
> + }
> +}
> +
> +/**
> + * ish_query_loader_prop() - Query ISH Shim firmware loader
> + * @client_data: Client data instance
> + * @fw: Poiner to firmware data struct in host
> memory
> + * @fw_info: Loader firmware properties
> + *
> + * This function queries the ISH Shim firmware loader for
> capabilities.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
> + const struct firmware *fw,
> + struct shim_fw_info *fw_info)
> +{
> + int rv;
> + struct loader_xfer_query ldr_xfer_query;
> + struct loader_xfer_query_response ldr_xfer_query_resp;
> +
> + memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
> + ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
> + ldr_xfer_query.image_size = fw->size;
> + rv = loader_cl_send(client_data,
> + (u8 *)&ldr_xfer_query,
> + sizeof(ldr_xfer_query),
> + (u8 *)&ldr_xfer_query_resp,
> + sizeof(ldr_xfer_query_resp));
> + if (rv < 0) {
> + client_data->flag_retry = true;
> + return rv;
> + }
> +
> + /* On success, the return value is the received buffer size */
> + if (rv != sizeof(struct loader_xfer_query_response)) {
> + dev_err(cl_data_to_dev(client_data),
> + "data size %d is not equal to size of
> loader_xfer_query_response %zu\n",
> + rv, sizeof(struct loader_xfer_query_response));
> + client_data->flag_retry = true;
> + return -EMSGSIZE;
> + }
> +
> + /* Save fw_info for use outside this function */
> + *fw_info = ldr_xfer_query_resp.fw_info;
> +
> + /* Loader firmware properties */
> + dev_dbg(cl_data_to_dev(client_data),
> + "ish_fw_version: major=%d minor=%d hotfix=%d build=%d
> protocol_version=0x%x loader_version=%d\n",
> + fw_info->ish_fw_version.major,
> + fw_info->ish_fw_version.minor,
> + fw_info->ish_fw_version.hotfix,
> + fw_info->ish_fw_version.build,
> + fw_info->protocol_version,
> + fw_info->ldr_version.value);
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "loader_capability: max_fw_image_size=0x%x xfer_mode=%d
> max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
> + fw_info->ldr_capability.max_fw_image_size,
> + fw_info->ldr_capability.xfer_mode,
> + fw_info->ldr_capability.max_dma_buf_size,
> + dma_buf_size_limit);
> +
> + /* Sanity checks */
> + if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
> + dev_err(cl_data_to_dev(client_data),
> + "ISH firmware size %zu is greater than Shim
> firmware loader max supported %d\n",
> + fw->size,
> + fw_info->ldr_capability.max_fw_image_size);
> + return -ENOSPC;
> + }
> +
> + /* For DMA the buffer size should be multiple of cacheline size
> */
> + if ((fw_info->ldr_capability.xfer_mode &
> LOADER_XFER_MODE_DIRECT_DMA) &&
> + (fw_info->ldr_capability.max_dma_buf_size %
> L1_CACHE_BYTES)) {
> + dev_err(cl_data_to_dev(client_data),
> + "Shim firmware loader buffer size %d should be
> multipe of cacheline\n",
> + fw_info->ldr_capability.max_dma_buf_size);
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +
> +/**
> + * ish_fw_xfer_ishtp() Loads ISH firmware using ishtp
> interface
> + * @client_data: Client data instance
> + * @fw: Pointer to firmware data struct in host
> memory
> + *
> + * This function uses ISH-TP to transfer ISH firmware from host to
> + * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
> + * support.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
> + const struct firmware *fw)
> +{
> + int rv;
> + u32 fragment_offset, fragment_size, payload_max_size;
> + struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
> + struct loader_msg_hdr ldr_xfer_ipc_ack;
> +
> + payload_max_size =
> + LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
> +
> + ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE,
> GFP_KERNEL);
> + if (!ldr_xfer_ipc_frag) {
> + client_data->flag_retry = true;
> + return -ENOMEM;
> + }
> +
> + ldr_xfer_ipc_frag->fragment.hdr.command =
> LOADER_CMD_XFER_FRAGMENT;
> + ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
> +
> + /* Break the firmware image into fragments and send as ISH-TP
> payload */
> + fragment_offset = 0;
> + while (fragment_offset < fw->size) {
> + if (fragment_offset + payload_max_size < fw->size) {
> + fragment_size = payload_max_size;
> + ldr_xfer_ipc_frag->fragment.is_last = 0;
> + } else {
> + fragment_size = fw->size - fragment_offset;
> + ldr_xfer_ipc_frag->fragment.is_last = 1;
> + }
> +
> + ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
> + ldr_xfer_ipc_frag->fragment.size = fragment_size;
> + memcpy(ldr_xfer_ipc_frag->data,
> + &fw->data[fragment_offset],
> + fragment_size);
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "xfer_mode=ipc offset=0x%08x size=0x%08x
> is_last=%d\n",
> + ldr_xfer_ipc_frag->fragment.offset,
> + ldr_xfer_ipc_frag->fragment.size,
> + ldr_xfer_ipc_frag->fragment.is_last);
> +
> + rv = loader_cl_send(client_data,
> + (u8 *)ldr_xfer_ipc_frag,
> + IPC_FRAGMENT_DATA_PREAMBLE +
> fragment_size,
> + (u8 *)&ldr_xfer_ipc_ack,
> + sizeof(ldr_xfer_ipc_ack));
> + if (rv < 0) {
> + client_data->flag_retry = true;
> + goto end_err_resp_buf_release;
> + }
> +
> + fragment_offset += fragment_size;
> + }
> +
> + kfree(ldr_xfer_ipc_frag);
> + return 0;
> +
> +end_err_resp_buf_release:
> + /* Free ISH buffer if not done already, in error case */
> + kfree(ldr_xfer_ipc_frag);
> + return rv;
> +}
> +
> +/**
> + * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
> + * @client_data: Client data instance
> + * @fw: Pointer to firmware data struct in host
> memory
> + * @fw_info: Loader firmware properties
> + *
> + * Host firmware load is a unique case where we need to download
> + * a large firmware image (200+ Kb). This function implements
> + * direct DMA transfer in kernel and ISH firmware. This allows
> + * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
> + * directly to ISH UMA at location of choice.
> + * Function depends on corresponding support in ISH firmware.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
> + const struct firmware *fw,
> + const struct shim_fw_info fw_info)
> +{
> + int rv;
> + void *dma_buf;
> + dma_addr_t dma_buf_phy;
> + u32 fragment_offset, fragment_size, payload_max_size;
> + struct loader_msg_hdr ldr_xfer_dma_frag_ack;
> + struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
> + struct device *devc = ishtp_get_pci_device(client_data-
> >cl_device);
> + u32 shim_fw_buf_size =
> + fw_info.ldr_capability.max_dma_buf_size;
> +
> + /*
> + * payload_max_size should be set to minimum of
> + * (1) Size of firmware to be loaded,
> + * (2) Max DMA buffer size supported by Shim firmware,
> + * (3) DMA buffer size limit set by boot_param
> dma_buf_size_limit.
> + */
> + payload_max_size = min3(fw->size,
> + (size_t)shim_fw_buf_size,
> + (size_t)dma_buf_size_limit);
> +
> + /*
> + * Buffer size should be multiple of cacheline size
> + * if it's not, select the previous cacheline boundary.
> + */
> + payload_max_size &= ~(L1_CACHE_BYTES - 1);
> +
> + dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32);
> + if (!dma_buf) {
> + client_data->flag_retry = true;
> + return -ENOMEM;
> + }
> +
> + dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size,
> + DMA_TO_DEVICE);
> + if (dma_mapping_error(devc, dma_buf_phy)) {
> + dev_err(cl_data_to_dev(client_data), "DMA map
> failed\n");
> + client_data->flag_retry = true;
> + rv = -ENOMEM;
> + goto end_err_dma_buf_release;
> + }
> +
> + ldr_xfer_dma_frag.fragment.hdr.command =
> LOADER_CMD_XFER_FRAGMENT;
> + ldr_xfer_dma_frag.fragment.xfer_mode =
> LOADER_XFER_MODE_DIRECT_DMA;
> + ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
> +
> + /* Send the firmware image in chucks of payload_max_size */
> + fragment_offset = 0;
> + while (fragment_offset < fw->size) {
> + if (fragment_offset + payload_max_size < fw->size) {
> + fragment_size = payload_max_size;
> + ldr_xfer_dma_frag.fragment.is_last = 0;
> + } else {
> + fragment_size = fw->size - fragment_offset;
> + ldr_xfer_dma_frag.fragment.is_last = 1;
> + }
> +
> + ldr_xfer_dma_frag.fragment.offset = fragment_offset;
> + ldr_xfer_dma_frag.fragment.size = fragment_size;
> + memcpy(dma_buf, &fw->data[fragment_offset],
> fragment_size);
> +
> + dma_sync_single_for_device(devc, dma_buf_phy,
> + payload_max_size,
> + DMA_TO_DEVICE);
> +
> + /*
> + * Flush cache here because the
> dma_sync_single_for_device()
> + * does not do for x86.
> + */
> + clflush_cache_range(dma_buf, payload_max_size);
> +
> + dev_dbg(cl_data_to_dev(client_data),
> + "xfer_mode=dma offset=0x%08x size=0x%x
> is_last=%d ddr_phys_addr=0x%016llx\n",
> + ldr_xfer_dma_frag.fragment.offset,
> + ldr_xfer_dma_frag.fragment.size,
> + ldr_xfer_dma_frag.fragment.is_last,
> + ldr_xfer_dma_frag.ddr_phys_addr);
> +
> + rv = loader_cl_send(client_data,
> + (u8 *)&ldr_xfer_dma_frag,
> + sizeof(ldr_xfer_dma_frag),
> + (u8 *)&ldr_xfer_dma_frag_ack,
> + sizeof(ldr_xfer_dma_frag_ack));
> + if (rv < 0) {
> + client_data->flag_retry = true;
> + goto end_err_resp_buf_release;
> + }
> +
> + fragment_offset += fragment_size;
> + }
> +
> + dma_unmap_single(devc, dma_buf_phy, payload_max_size,
> DMA_TO_DEVICE);
> + kfree(dma_buf);
> + return 0;
> +
> +end_err_resp_buf_release:
> + /* Free ISH buffer if not done already, in error case */
> + dma_unmap_single(devc, dma_buf_phy, payload_max_size,
> DMA_TO_DEVICE);
> +end_err_dma_buf_release:
> + kfree(dma_buf);
> + return rv;
> +}
> +
> +/**
> + * ish_fw_start() Start executing ISH main firmware
> + * @client_data: client data instance
> + *
> + * This function sends message to Shim firmware loader to start
> + * the execution of ISH main firmware.
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int ish_fw_start(struct ishtp_cl_data *client_data)
> +{
> + struct loader_start ldr_start;
> + struct loader_msg_hdr ldr_start_ack;
> +
> + memset(&ldr_start, 0, sizeof(ldr_start));
> + ldr_start.hdr.command = LOADER_CMD_START;
> + return loader_cl_send(client_data,
> + (u8 *)&ldr_start,
> + sizeof(ldr_start),
> + (u8 *)&ldr_start_ack,
> + sizeof(ldr_start_ack));
> +}
> +
> +/**
> + * load_fw_from_host() Loads ISH firmware from host
> + * @client_data: Client data instance
> + *
> + * This function loads the ISH firmware to ISH SRAM and starts
> execution
> + *
> + * Return: 0 for success, negative error code for failure.
> + */
> +static int load_fw_from_host(struct ishtp_cl_data *client_data)
> +{
> + int rv;
> + u32 xfer_mode;
> + char *filename;
> + const struct firmware *fw;
> + struct shim_fw_info fw_info;
> + struct ishtp_cl *loader_ishtp_cl = client_data-
> >loader_ishtp_cl;
> +
> + client_data->flag_retry = false;
> +
> + filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
> + if (!filename) {
> + client_data->flag_retry = true;
> + rv = -ENOMEM;
> + goto end_error;
> + }
> +
> + /* Get filename of the ISH firmware to be loaded */
> + rv = get_firmware_variant(client_data, filename);
> + if (rv < 0)
> + goto end_err_filename_buf_release;
> +
> + rv = request_firmware(&fw, filename,
> cl_data_to_dev(client_data));
> + if (rv < 0)
> + goto end_err_filename_buf_release;
> +
> + /* Step 1: Query Shim firmware loader properties */
> +
> + rv = ish_query_loader_prop(client_data, fw, &fw_info);
> + if (rv < 0)
> + goto end_err_fw_release;
> +
> + /* Step 2: Send the main firmware image to be loaded, to ISH
> SRAM */
> +
> + xfer_mode = fw_info.ldr_capability.xfer_mode;
> + if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
> + rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
> + } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
> + rv = ish_fw_xfer_ishtp(client_data, fw);
> + } else {
> + dev_err(cl_data_to_dev(client_data),
> + "No transfer mode selected in firmware\n");
> + rv = -EINVAL;
> + }
> + if (rv < 0)
> + goto end_err_fw_release;
> +
> + /* Step 3: Start ISH main firmware exeuction */
> +
> + rv = ish_fw_start(client_data);
> + if (rv < 0)
> + goto end_err_fw_release;
> +
> + release_firmware(fw);
> + kfree(filename);
> + dev_info(cl_data_to_dev(client_data), "ISH firmware %s
> loaded\n",
> + filename);
> + return 0;
> +
> +end_err_fw_release:
> + release_firmware(fw);
> +end_err_filename_buf_release:
> + kfree(filename);
> +end_error:
> + /* Keep a count of retries, and give up after 3 attempts */
> + if (client_data->flag_retry &&
> + client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
> + dev_warn(cl_data_to_dev(client_data),
> + "ISH host firmware load failed %d. Resetting
> ISH, and trying again..\n",
> + rv);
> + ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
> + } else {
> + dev_err(cl_data_to_dev(client_data),
> + "ISH host firmware load failed %d\n", rv);
> + }
> + return rv;
> +}
> +
> +static void load_fw_from_host_handler(struct work_struct *work)
> +{
> + struct ishtp_cl_data *client_data;
> +
> + client_data = container_of(work, struct ishtp_cl_data,
> + work_fw_load);
> + load_fw_from_host(client_data);
> +}
> +
> +/**
> + * loader_init() - Init function for ISH-TP client
> + * @loader_ishtp_cl: ISH-TP client instance
> + * @reset: true if called for init after reset
> + *
> + * Return: 0 for success, negative error code for failure
> + */
> +static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
> +{
> + int rv;
> + struct ishtp_fw_client *fw_client;
> + struct ishtp_cl_data *client_data =
> + ishtp_get_client_data(loader_ishtp_cl);
> +
> + dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n",
> reset);
> +
> + rv = ishtp_cl_link(loader_ishtp_cl);
> + if (rv < 0) {
> + dev_err(cl_data_to_dev(client_data), "ishtp_cl_link
> failed\n");
> + return rv;
> + }
> +
> + /* Connect to firmware client */
> + ishtp_set_tx_ring_size(loader_ishtp_cl,
> LOADER_CL_TX_RING_SIZE);
> + ishtp_set_rx_ring_size(loader_ishtp_cl,
> LOADER_CL_RX_RING_SIZE);
> +
> + fw_client =
> + ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_is
> htp_cl),
> + &loader_ishtp_guid);
> + if (!fw_client) {
> + dev_err(cl_data_to_dev(client_data),
> + "ISH client uuid not found\n");
> + rv = -ENOENT;
> + goto err_cl_unlink;
> + }
> +
> + ishtp_cl_set_fw_client_id(loader_ishtp_cl,
> + ishtp_get_fw_client_id(fw_client));
> + ishtp_set_connection_state(loader_ishtp_cl,
> ISHTP_CL_CONNECTING);
> +
> + rv = ishtp_cl_connect(loader_ishtp_cl);
> + if (rv < 0) {
> + dev_err(cl_data_to_dev(client_data), "Client connect
> fail\n");
> + goto err_cl_unlink;
> + }
> +
> + dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
> +
> + ishtp_register_event_cb(client_data->cl_device,
> loader_cl_event_cb);
> +
> + return 0;
> +
> +err_cl_unlink:
> + ishtp_cl_unlink(loader_ishtp_cl);
> + return rv;
> +}
> +
> +static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
> +{
> + ishtp_set_connection_state(loader_ishtp_cl,
> ISHTP_CL_DISCONNECTING);
> + ishtp_cl_disconnect(loader_ishtp_cl);
> + ishtp_cl_unlink(loader_ishtp_cl);
> + ishtp_cl_flush_queues(loader_ishtp_cl);
> +
> + /* Disband and free all Tx and Rx client-level rings */
> + ishtp_cl_free(loader_ishtp_cl);
> +}
> +
> +static void reset_handler(struct work_struct *work)
> +{
> + int rv;
> + struct ishtp_cl_data *client_data;
> + struct ishtp_cl *loader_ishtp_cl;
> + struct ishtp_cl_device *cl_device;
> +
> + client_data = container_of(work, struct ishtp_cl_data,
> + work_ishtp_reset);
> +
> + loader_ishtp_cl = client_data->loader_ishtp_cl;
> + cl_device = client_data->cl_device;
> +
> + /* Unlink, flush queues & start again */
> + ishtp_cl_unlink(loader_ishtp_cl);
> + ishtp_cl_flush_queues(loader_ishtp_cl);
> + ishtp_cl_free(loader_ishtp_cl);
> +
> + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> + if (!loader_ishtp_cl)
> + return;
> +
> + ishtp_set_drvdata(cl_device, loader_ishtp_cl);
> + ishtp_set_client_data(loader_ishtp_cl, client_data);
> + client_data->loader_ishtp_cl = loader_ishtp_cl;
> + client_data->cl_device = cl_device;
> +
> + rv = loader_init(loader_ishtp_cl, 1);
> + if (rv < 0) {
> + dev_err(ishtp_device(cl_device), "Reset Failed\n");
> + return;
> + }
> +
> + /* ISH firmware loading from host */
> + load_fw_from_host(client_data);
> +}
> +
> +/**
> + * loader_ishtp_cl_probe() - ISH-TP client driver probe
> + * @cl_device: ISH-TP client device instance
> + *
> + * This function gets called on device create on ISH-TP bus
> + *
> + * Return: 0 for success, negative error code for failure
> + */
> +static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl *loader_ishtp_cl;
> + struct ishtp_cl_data *client_data;
> + int rv;
> +
> + client_data = devm_kzalloc(ishtp_device(cl_device),
> + sizeof(*client_data),
> + GFP_KERNEL);
> + if (!client_data)
> + return -ENOMEM;
> +
> + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> + if (!loader_ishtp_cl)
> + return -ENOMEM;
> +
> + ishtp_set_drvdata(cl_device, loader_ishtp_cl);
> + ishtp_set_client_data(loader_ishtp_cl, client_data);
> + client_data->loader_ishtp_cl = loader_ishtp_cl;
> + client_data->cl_device = cl_device;
> +
> + init_waitqueue_head(&client_data->response.wait_queue);
> +
> + INIT_WORK(&client_data->work_ishtp_reset,
> + reset_handler);
> + INIT_WORK(&client_data->work_fw_load,
> + load_fw_from_host_handler);
> +
> + rv = loader_init(loader_ishtp_cl, 0);
> + if (rv < 0) {
> + ishtp_cl_free(loader_ishtp_cl);
> + return rv;
> + }
> + ishtp_get_device(cl_device);
> +
> + client_data->retry_count = 0;
> +
> + /* ISH firmware loading from host */
> + schedule_work(&client_data->work_fw_load);
> +
> + return 0;
> +}
> +
> +/**
> + * loader_ishtp_cl_remove() - ISH-TP client driver remove
> + * @cl_device: ISH-TP client device instance
> + *
> + * This function gets called on device remove on ISH-TP bus
> + *
> + * Return: 0
> + */
> +static int loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl_data *client_data;
> + struct ishtp_cl *loader_ishtp_cl =
> ishtp_get_drvdata(cl_device);
> +
> + client_data = ishtp_get_client_data(loader_ishtp_cl);
> +
> + /*
> + * The sequence of the following two cancel_work_sync() is
> + * important. The work_fw_load can in turn schedue
> + * work_ishtp_reset, so first cancel work_fw_load then
> + * cancel work_ishtp_reset.
> + */
> + cancel_work_sync(&client_data->work_fw_load);
> + cancel_work_sync(&client_data->work_ishtp_reset);
> + loader_deinit(loader_ishtp_cl);
> + ishtp_put_device(cl_device);
> +
> + return 0;
> +}
> +
> +/**
> + * loader_ishtp_cl_reset() - ISH-TP client driver reset
> + * @cl_device: ISH-TP client device instance
> + *
> + * This function gets called on device reset on ISH-TP bus
> + *
> + * Return: 0
> + */
> +static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
> +{
> + struct ishtp_cl_data *client_data;
> + struct ishtp_cl *loader_ishtp_cl =
> ishtp_get_drvdata(cl_device);
> +
> + client_data = ishtp_get_client_data(loader_ishtp_cl);
> +
> + schedule_work(&client_data->work_ishtp_reset);
> +
> + return 0;
> +}
> +
> +static struct ishtp_cl_driver loader_ishtp_cl_driver = {
> + .name = "ish-loader",
> + .guid = &loader_ishtp_guid,
> + .probe = loader_ishtp_cl_probe,
> + .remove = loader_ishtp_cl_remove,
> + .reset = loader_ishtp_cl_reset,
> +};
> +
> +static int __init ish_loader_init(void)
> +{
> + return ishtp_cl_driver_register(&loader_ishtp_cl_driver,
> THIS_MODULE);
> +}
> +
> +static void __exit ish_loader_exit(void)
> +{
> + ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
> +}
> +
> +late_initcall(ish_loader_init);
> +module_exit(ish_loader_exit);
> +
> +module_param(dma_buf_size_limit, int, 0644);
> +MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this
> value in bytes");
> +
> +MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
> +MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
> +
> +MODULE_LICENSE("GPL v2");
> +MODULE_ALIAS("ishtp:*");
^ permalink raw reply
* Re: [PATCH v3 3/4] driver core: add dev_print_hex_dump() logging function.
From: Life is hard, and then you die @ 2019-04-02 2:47 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Dmitry Torokhov, Henrik Rydberg, Andy Shevchenko,
Sergey Senozhatsky, Steven Rostedt, Rafael J. Wysocki,
Lukas Wunner, Federico Lorenzi, linux-input, linux-kernel
In-Reply-To: <20190328112952.GA2232@kroah.com>
On Thu, Mar 28, 2019 at 12:29:52PM +0100, Greg Kroah-Hartman wrote:
> On Thu, Mar 28, 2019 at 03:27:55AM -0700, Life is hard, and then you die wrote:
> >
> > On Thu, Mar 28, 2019 at 06:29:17AM +0100, Greg Kroah-Hartman wrote:
> > > On Wed, Mar 27, 2019 at 05:28:17PM -0700, Life is hard, and then you die wrote:
> > > >
> > > > On Wed, Mar 27, 2019 at 11:37:57AM +0900, Greg Kroah-Hartman wrote:
> > > > > On Tue, Mar 26, 2019 at 06:48:06PM -0700, Ronald Tschalär wrote:
> > > > > > This is the dev_xxx() analog to print_hex_dump(), using dev_printk()
> > > > > > instead of straight printk() to match other dev_xxx() logging functions.
> > > > > > ---
> > > > > > drivers/base/core.c | 43 ++++++++++++++++++++++++++++++++++++++++++
> > > > > > include/linux/device.h | 15 +++++++++++++++
> > > > > > 2 files changed, 58 insertions(+)
[snip]
> > > > > Anyway, no, please do not do this. Please do not dump large hex values
> > > > > like this to the kernel log, it does not help anyone.
> > > > >
> > > > > You can do this while debugging, sure, but not for "real" kernel code.
> > > >
> > > > As used by this driver, it is definitely called for debugging only and
> > > > must be explicitly enabled via a module param. But having the ability
> > > > for folks to easily generate and print out debugging info has proven
> > > > quite valuable.
> > >
> > > We have dynamic debugging, no need for module parameters at all. This
> > > isn't the 1990's anymore :)
> >
> > I am aware of dynamic debugging, but there are several issues with it
> > from the perspective of the logging I'm doing here (I mentioned these
> > in response to an earlier review already):
> >
> > 1. Dynamic debugging can't be enabled at a function or line level on
> > the kernel command line, so this means that to debug issues
> > during boot you have to enable everything, which can be way too
> > verbose
>
> You can, and should enable it at a function or line level by writing to
> the proper kernel file in debugfs.
>
> You have read Documentation/admin-guide/dynamic-debug-howto.rst, right?
Yes, and I've played with the parameters quite a bit.
> No need to do anything on the command line, that's so old-school :)
Sorry if I'm being unduly dense, but then how to enable debugging
during early boot? The only other alternative I see is modifying the
initrd, and asking folks to do that is noticeably more complicated
than having them add something to the command line in grub. So from my
perspective I find kernel params far from old-school :-)
> > 2. The expressions to enable the individual logging statements are
> > quite brittle (in particular the line-based ones) since they
> > (may) change any time the code is changed - having stable
> > commands to give to users and put in documentation (e.g.
> > "echo 0x200 > /sys/module/applespi/parameters/debug") is
> > quite valuable.
> >
> > One way to work around this would be to put every single logging
> > statement in a function of its own, thereby ensuring a stable
> > name is associated with each one.
>
> Again, read the documentation, this works today as-is.
I have read it (we're talking about the dynamic debug docs here), but
I just don't see how it addresses this in any way.
> > 3. In at least two places we log different types of packets in the
> > same lines of code (protected by a "if (log_mask & PKT_TYPE)") -
> > dynamic-debug would only allow enabling or disabling logging of
> > all packets. This could be worked around by creating a separate
> > (but essentially duplicate) logging function for each packet type
> > and some lookup table to call the appropriate one. Not very
> > pretty IMO, though.
>
> True, but you can use tracepoints as well, that would probably be much
> easier when you are logging data streams. You can also use an ebpf
> program with the tracepoints to log just what you need/want to when you
> want to as well.
Thanks for the hint, I hadn't paid much attention to tracepoints till
now. They do solve most of these issues I've mentioned here, though.
So I've actually gone and implemented the tracing as tracepoints now.
Two issues I noticed though:
1. since filters can't be enabled on the command line (and yes, we
seem to disagree on the usefulness of the command line) it means
I had to essentially create tracepoints for every trace+filter
combo I may want to enable (in my case it's just one field, so I
ended up with 8 tracepoints instead of 1). Not a big deal in my
case, but could get ugly.
2. in cases where there is relevant log output too, folks have to be
told to provide both trace and dmesg output, the outputs have to
merged back together again. Though I note that with the use of the
tp_printk kernel param this inconvenience goes away again (but
we're back to logging the traces in the kernel log :-) ).
> > 4. In a couple places we log both the sent command and the received
> > response, with the log-mask determining for which types of
> > packets to do this. With a log mask there is one bit to set to
> > get both logged; with dynamic debugging you'd have to enable the
> > writing and receiving parts separately (not a huge deal, but yet
> > one place where things are a bit more complicated than
> > necessary).
> >
> > Except for the first, none of these are insurmountable, but together
> > they don't make dynamic debugging very attractive for this sort of
> > logging.
>
> Look into it some more, we have all of this covered today, no need for
> just a single driver to do something fancy on its own :)
The tracepoints do indeed cover this too.
Cheers,
Ronald
^ permalink raw reply
* Re: [PATCH] ELAN touchpad i2c_hid bugs fix
From: Kai Heng Feng @ 2019-04-02 4:18 UTC (permalink / raw)
To: Mario.Limonciello
Cc: Andy Shevchenko, hdegoede, benjamin.tissoires, hotwater438, jikos,
swboyd, bigeasy, dtor, linux-input, linux-kernel
In-Reply-To: <d813fe02035b481b8f3a55aa4dffbb22@ausx13mpc120.AMER.DELL.COM>
> On Apr 2, 2019, at 5:37 AM, <Mario.Limonciello@dell.com>
> <Mario.Limonciello@dell.com> wrote:
>
>> -----Original Message-----
>> From: Andy Shevchenko <andy.shevchenko@gmail.com>
>> Sent: Thursday, March 21, 2019 4:48 AM
>> To: Kai-Heng Feng; Limonciello, Mario
>> Cc: Hans de Goede; Benjamin Tissoires; hotwater438@tutanota.com; Jiri
>> Kosina;
>> Stephen Boyd; Sebastian Andrzej Siewior; Dmitry Torokhov; open list:HID
>> CORE
>> LAYER; lkml
>> Subject: Re: [PATCH] ELAN touchpad i2c_hid bugs fix
>>
>>
>> [EXTERNAL EMAIL]
>>
>> +Cc: Mario
>>
>> Mario, do you have any insights about the issue with touchpad on Dell
>> system described below?
>
> My apologies, this got lost while I was on vacation.
>
>>
>> On Thu, Mar 21, 2019 at 6:08 AM Kai-Heng Feng
>> <kai.heng.feng@canonical.com> wrote:
>>>
>>> at 01:18, Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
>>>
>>>> On Wed, Mar 20, 2019 at 6:55 PM Kai-Heng Feng
>>>> <kai.heng.feng@canonical.com> wrote:
>>>>> at 23:39, Hans de Goede <hdegoede@redhat.com> wrote:
>>>>>> On 3/20/19 3:37 PM, Benjamin Tissoires wrote:
>>>>
>>>>>> Benjamin, what I find interesting here is that the BOGUS_IRQ quirk
>>>>>> is also used on Elan devices, I suspect that these Elan devices
>>>>>> likely also need the I2C_HID_QUIRK_FORCE_TRIGGER_FALLING quirk
>>>>>> and then they probably will no longer need the bogus IRQ flag,
>>>>>> if you know about bugreports with an acpidump for any of the devices
>>>>>> needing the bogus IRQ quirk, then I (or you) can check how the IRQ is
>>>>>> declared there, I suspect it will be declared as level-low, just like
>>>>>> with the laptop this patch was written for. And it probably need to
>>>>>> be edge-falling instead of level-low just like this case.
>>>>>
>>>>> First, I’ve already tried using IRQF_TRIGGER_FALLING, unfortunately it
>>>>> doesn’t solve the issue for me.
>>>>>
>>>>> I talked to Elan once, and they confirm the correct IRQ trigger is
>>>>> level
>>>>> low. So forcing falling trigger may break other platforms.
>>>>
>>>> As far as I understood Vladislav the quirk he got from Elan as well.
>>>
>>> Ok, then this is really weird.
>>>
>>>>
>>>>> Recently we found that Elan touchpad doesn’t like GpioInt() from its
>>>>> _CRS.
>>>>> Once the Interrupt() is used instead, the issue goes away.
>>>>
>>>> IIRC i2c core tries to get interrupt from Interrupt() resource and
>>>> then falls back to GpioInt().
>>>> See i2c_acpi_get_info() and i2c_device_probe().
>>>
>>> Here’s its ASL:
>>>
>>> Scope (\_SB.PCI0.I2C4)
>>> {
>>> Device (TPD0)
>>> {
>>> Name (_ADR, One) // _ADR: Address
>>> Name (_HID, "DELL08AE") // _HID: Hardware ID
>>> Name (_CID, "PNP0C50" /* HID Protocol Device (I2C bus) */) // _CID:
>> Compatible ID
>>> Name (_UID, One) // _UID: Unique ID
>>> Name (_S0W, 0x04) // _S0W: S0 Device Wake State
>>> Name (SBFB, ResourceTemplate ()
>>> {
>>> I2cSerialBusV2 (0x002C, ControllerInitiated, 0x00061A80,
>>> AddressingMode7Bit, "\\_SB.PCI0.I2C4",
>>> 0x00, ResourceConsumer, , Exclusive,
>>> )
>>> })
>>> Name (SBFG, ResourceTemplate ()
>>> {
>>> GpioInt (Level, ActiveLow, ExclusiveAndWake, PullUp, 0x0000,
>>> "\\_SB.GPO1", 0x00, ResourceConsumer, ,
>>> )
>>> { // Pin list
>>> 0x0012
>>> }
>>> })
>>> Name (SBFI, ResourceTemplate ()
>>> {
>>> Interrupt (ResourceConsumer, Level, ActiveLow, ExclusiveAndWake, ,, )
>>> {
>>> 0x0000003C,
>>> }
>>> })
>>> Method (_INI, 0, NotSerialized) // _INI: Initialize
>>> {
>>> }
>>> Method (_STA, 0, NotSerialized) // _STA: Status
>>> {
>>> If ((TCPD == One))
>>> {
>>> Return (0x0F)
>>> }
>>>
>>> Return (Zero)
>>> }
>>> Method (_CRS, 0, NotSerialized) // _CRS: Current Resource Settings
>>> {
>>> If ((OSYS < 0x07DC))
>>> {
>>> Return (SBFI) /* \_SB_.PCI0.I2C4.TPD0.SBFI */
>>> }
>>>
>>> Return (ConcatenateResTemplate (SBFB, SBFG))
>>> }
>>> Method (_DSM, 4, NotSerialized) // _DSM: Device-Specific Method
>>> {
>>> If ((Arg0 == ToUUID ("3cdff6f7-4267-4555-ad05-b30a3d8938de") /* HID
>> I2C Device */))
>>> {
>>> If ((Arg2 == Zero))
>>> {
>>> If ((Arg1 == One))
>>> {
>>> Return (Buffer (One)
>>> {
>>> 0x03 // .
>>> })
>>> }
>>> Else
>>> {
>>> Return (Buffer (One)
>>> {
>>> 0x00 // .
>>> })
>>> }
>>> }
>>> ElseIf ((Arg2 == One))
>>> {
>>> Return (0x20)
>>> }
>>> Else
>>> {
>>> Return (Buffer (One)
>>> {
>>> 0x00 // .
>>> })
>>> }
>>> }
>>> ElseIf ((Arg0 == ToUUID ("ef87eb82-f951-46da-84ec-14871ac6f84b")))
>>> {
>>> If ((Arg2 == Zero))
>>> {
>>> If ((Arg1 == One))
>>> {
>>> Return (Buffer (One)
>>> {
>>> 0x03 // .
>>> })
>>> }
>>> }
>>>
>>> If ((Arg2 == One))
>>> {
>>> Return (ConcatenateResTemplate (SBFB, SBFG))
>>> }
>>>
>>> Return (Buffer (One)
>>> {
>>> 0x00 // .
>>> })
>>> }
>>> }
>>> Else
>>> {
>>> Return (Buffer (One)
>>> {
>>> 0x00 // .
>>> })
>>> }
>>> }
>>> }
>>> }
>>>
>>> Change SBFG to SBFI in its _CRS can workaround the issue.
>>> Is ASL in this form possible to do the flow you described?
>>>
>>> Kai-Heng
>>>
>>>>
>>>>> But I am not sure how to patch its DSDT/SSDT in i2c-hid.
>
> Is this pre-production HW? If so, maybe this is a case that we should talk
> about custom OSI string to run the ASL differently.
Some are already shipped.
>
> The other option would be to create a new ASL method in FW and from Linux
> side a quirk that calls this new ASL method.
>
Since this patch is for ASUS Laptop, I think a more generic solution from
driver layer is preferred.
Kai-Heng
^ permalink raw reply
* Re: [PATCH v3] HID: intel-ish-hid: ISH firmware loader client driver
From: Rushikesh S Kadam @ 2019-04-02 4:22 UTC (permalink / raw)
To: Nick Crews
Cc: Joe Perches, Srinivas Pandruvada, benjamin.tissoires, jikos,
jettrink, Gwendal Grignou, linux-kernel, linux-input
In-Reply-To: <CAHX4x85=Sot62T=DtGPLkyFhudyp=jvxcU_W-oShg8iKTach+Q@mail.gmail.com>
Hi Nick, Joe
thanks for your comments
Regards
Rushikesh
On Mon, Apr 01, 2019 at 03:17:13PM -0600, Nick Crews wrote:
> I tried to send the last message from my phone, and surprise it wasn't
> formatted correctly, so it may have been marked as spam. repeating
> myself again...
>
> Ah, I guess I was wrong about logging OOM. I hadn’t hear about the
> recommendations against it, but they make sense. Thanks for the
> clarifications!
>
> On Sat, Mar 30, 2019 at 10:27 AM Joe Perches <joe@perches.com> wrote:
> >
> > On Sat, 2019-03-30 at 15:52 +0530, Rushikesh S Kadam wrote:
> > > On Fri, Mar 29, 2019 at 04:30:18PM -0700, Nick Crews wrote:
> > > > On Fri, Mar 29, 2019 at 1:03 PM Rushikesh S Kadam
> > > > <rushikesh.s.kadam@intel.com> wrote:
> > > > > + ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
> > > > > + if (!ldr_xfer_ipc_frag) {
> > > > Log error here.
> > > The error code is logged in calling function
> > > load_fw_from_host(). Is that good enough?
> > >
> > > I believe the checkpatch script too, would
> > > recommend against adding debug print for ENOMEM
> > > error.
> >
> > The generic kernel allocation functions already do
> > a dump_stack() on OOM conditions when called without
> > __GFP_NOWARN so any additional OOM message isn't
> > particularly useful.
> >
> > > Again, I thought it was against practise to log
> > > "out of memory" debug prints in probe()
> >
> > Or anywhere else given the generic OOM stack dump.
> >
> > > But will add if you tell me this is the right way.
> > >
> > > > > + return -ENOMEM;
> > > > > +
> > > > > + loader_ishtp_cl = ishtp_cl_allocate(cl_device);
> > > > > + if (!loader_ishtp_cl)
> > > >
> > > > log error here
> >
> > The ishtp_cl_allocate function just calls kmalloc then
> > initializes the struct so an additional OOM message
> > isn't useful here either.
> >
> >
--
^ permalink raw reply
* [PATCH v5] HID: intel-ish-hid: ISH firmware loader client driver
From: Rushikesh S Kadam @ 2019-04-02 5:47 UTC (permalink / raw)
To: srinivas.pandruvada, benjamin.tissoires, jikos
Cc: ncrews, jettrink, gwendal, rushikesh.s.kadam, linux-kernel,
linux-input
This driver adds support for loading Intel Integrated
Sensor Hub (ISH) firmware from host file system to ISH
SRAM and start execution.
At power-on, the ISH subsystem shall boot to an interim
Shim loader-firmware, which shall expose an ISHTP loader
device.
The driver implements an ISHTP client that communicates
with the Shim ISHTP loader device over the intel-ish-hid
stack, to download the main ISH firmware.
Signed-off-by: Rushikesh S Kadam <rushikesh.s.kadam@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Nick Crews <ncrews@chromium.org>
Tested-by: Jett Rink <jettrink@chromium.org>
---
The patches are baselined to hid git tree, branch for-5.2/ish
https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git/log/?h=for-5.2/ish
v5
- Added the Acked-by & Tested-by to commit message. No other
change.
v4
- Changed process_recv() to wake the caller in case of
error as well. Earlier caller would wait until timeout on
an error.
- Change sequence of few checks in process_recv().
v3
- Moved a couple of sanity checks from loader_cl_send() to
process_recv().
- Several minor changes to address review comments.
v2
- Change loader_cl_send() so that the calling function
shall allocate and pass the buffer to be used for
receiving firwmare response data. Corresponding changes
in calling function and process_recv().
- Introduced struct response_info to encapsulate and pass
data between from the process_recv() callback to
calling function loader_cl_send().
- Keep count of host firmware load retries, and fail after
3 unsuccessful attempts.
- Dropped report_bad_packets() function previously used for
keeping count of bad packets.
- Inlined loader_ish_hw_reset()'s functionality
v1
- Initial version.
drivers/hid/Makefile | 1 +
drivers/hid/intel-ish-hid/Kconfig | 15 +
drivers/hid/intel-ish-hid/Makefile | 3 +
drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 1085 +++++++++++++++++++++++++++
4 files changed, 1104 insertions(+)
create mode 100644 drivers/hid/intel-ish-hid/ishtp-fw-loader.c
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index 170163b..d8d393e 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -134,3 +134,4 @@ obj-$(CONFIG_USB_KBD) += usbhid/
obj-$(CONFIG_I2C_HID) += i2c-hid/
obj-$(CONFIG_INTEL_ISH_HID) += intel-ish-hid/
+obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ish-hid/
diff --git a/drivers/hid/intel-ish-hid/Kconfig b/drivers/hid/intel-ish-hid/Kconfig
index 519e4c8..786adbc 100644
--- a/drivers/hid/intel-ish-hid/Kconfig
+++ b/drivers/hid/intel-ish-hid/Kconfig
@@ -14,4 +14,19 @@ config INTEL_ISH_HID
Broxton and Kaby Lake.
Say Y here if you want to support Intel ISH. If unsure, say N.
+
+config INTEL_ISH_FIRMWARE_DOWNLOADER
+ tristate "Host Firmware Load feature for Intel ISH"
+ depends on INTEL_ISH_HID
+ depends on X86
+ help
+ The Integrated Sensor Hub (ISH) enables the kernel to offload
+ sensor polling and algorithm processing to a dedicated low power
+ processor in the chipset.
+
+ The Host Firmware Load feature adds support to load the ISH
+ firmware from host file system at boot.
+
+ Say M here if you want to support Host Firmware Loading feature
+ for Intel ISH. If unsure, say N.
endmenu
diff --git a/drivers/hid/intel-ish-hid/Makefile b/drivers/hid/intel-ish-hid/Makefile
index 825b70a..2de97e4 100644
--- a/drivers/hid/intel-ish-hid/Makefile
+++ b/drivers/hid/intel-ish-hid/Makefile
@@ -20,4 +20,7 @@ obj-$(CONFIG_INTEL_ISH_HID) += intel-ishtp-hid.o
intel-ishtp-hid-objs := ishtp-hid.o
intel-ishtp-hid-objs += ishtp-hid-client.o
+obj-$(CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER) += intel-ishtp-loader.o
+intel-ishtp-loader-objs += ishtp-fw-loader.o
+
ccflags-y += -Idrivers/hid/intel-ish-hid/ishtp
diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
new file mode 100644
index 0000000..e770e22
--- /dev/null
+++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
@@ -0,0 +1,1085 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * ISH-TP client driver for ISH firmware loading
+ *
+ * Copyright (c) 2019, Intel Corporation.
+ */
+
+#include <linux/firmware.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/intel-ish-client-if.h>
+#include <linux/property.h>
+#include <asm/cacheflush.h>
+
+/* Number of times we attempt to load the firmware before giving up */
+#define MAX_LOAD_ATTEMPTS 3
+
+/* ISH TX/RX ring buffer pool size */
+#define LOADER_CL_RX_RING_SIZE 1
+#define LOADER_CL_TX_RING_SIZE 1
+
+/*
+ * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
+ * used to temporarily hold the data transferred from host to Shim
+ * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
+ * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
+ * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
+ * have a max payload of 3968 bytes (= 32 x 124 payload).
+ */
+#define LOADER_SHIM_IPC_BUF_SIZE 3968
+
+/**
+ * enum ish_loader_commands - ISH loader host commands.
+ * LOADER_CMD_XFER_QUERY Query the Shim firmware loader for
+ * capabilities
+ * LOADER_CMD_XFER_FRAGMENT Transfer one firmware image fragment at a
+ * time. The command may be executed
+ * multiple times until the entire firmware
+ * image is downloaded to SRAM.
+ * LOADER_CMD_START Start executing the main firmware.
+ */
+enum ish_loader_commands {
+ LOADER_CMD_XFER_QUERY = 0,
+ LOADER_CMD_XFER_FRAGMENT,
+ LOADER_CMD_START,
+};
+
+/* Command bit mask */
+#define CMD_MASK GENMASK(6, 0)
+#define IS_RESPONSE BIT(7)
+
+/*
+ * ISH firmware max delay for one transmit failure is 1 Hz,
+ * and firmware will retry 2 times, so 3 Hz is used for timeout.
+ */
+#define ISHTP_SEND_TIMEOUT (3 * HZ)
+
+/*
+ * Loader transfer modes:
+ *
+ * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
+ * transfer data. This may use IPC or DMA if supported in firmware.
+ * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
+ * both IPC & DMA (legacy).
+ *
+ * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
+ * from the sensor data streaming. Here we download a large (300+ Kb)
+ * image directly to ISH SRAM memory. There is limited benefit of
+ * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
+ * this "direct dma" mode, where we do not use ISH-TP for DMA, but
+ * instead manage the DMA directly in kernel driver and Shim firmware
+ * loader (allocate buffer, break in chucks and transfer). This allows
+ * to overcome 4 Kb limit, and optimize the data flow path in firmware.
+ */
+#define LOADER_XFER_MODE_DIRECT_DMA BIT(0)
+#define LOADER_XFER_MODE_ISHTP BIT(1)
+
+/* ISH Transport Loader client unique GUID */
+static const guid_t loader_ishtp_guid =
+ GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
+ 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc);
+
+#define FILENAME_SIZE 256
+
+/*
+ * The firmware loading latency will be minimum if we can DMA the
+ * entire ISH firmware image in one go. This requires that we allocate
+ * a large DMA buffer in kernel, which could be problematic on some
+ * platforms. So here we limit the DMA buffer size via a module_param.
+ * We default to 4 pages, but a customer can set it to higher limit if
+ * deemed appropriate for his platform.
+ */
+static int dma_buf_size_limit = 4 * PAGE_SIZE;
+
+/**
+ * struct loader_msg_hdr - Header for ISH Loader commands.
+ * @command: LOADER_CMD* commands. Bit 7 is the response.
+ * @status: Command response status. Non 0, is error
+ * condition.
+ *
+ * This structure is used as header for every command/data sent/received
+ * between Host driver and ISH Shim firmware loader.
+ */
+struct loader_msg_hdr {
+ u8 command;
+ u8 reserved[2];
+ u8 status;
+} __packed;
+
+struct loader_xfer_query {
+ struct loader_msg_hdr hdr;
+ u32 image_size;
+} __packed;
+
+struct ish_fw_version {
+ u16 major;
+ u16 minor;
+ u16 hotfix;
+ u16 build;
+} __packed;
+
+union loader_version {
+ u32 value;
+ struct {
+ u8 major;
+ u8 minor;
+ u8 hotfix;
+ u8 build;
+ };
+} __packed;
+
+struct loader_capability {
+ u32 max_fw_image_size;
+ u32 xfer_mode;
+ u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
+} __packed;
+
+struct shim_fw_info {
+ struct ish_fw_version ish_fw_version;
+ u32 protocol_version;
+ union loader_version ldr_version;
+ struct loader_capability ldr_capability;
+} __packed;
+
+struct loader_xfer_query_response {
+ struct loader_msg_hdr hdr;
+ struct shim_fw_info fw_info;
+} __packed;
+
+struct loader_xfer_fragment {
+ struct loader_msg_hdr hdr;
+ u32 xfer_mode;
+ u32 offset;
+ u32 size;
+ u32 is_last;
+} __packed;
+
+struct loader_xfer_ipc_fragment {
+ struct loader_xfer_fragment fragment;
+ u8 data[] ____cacheline_aligned; /* variable length payload here */
+} __packed;
+
+struct loader_xfer_dma_fragment {
+ struct loader_xfer_fragment fragment;
+ u64 ddr_phys_addr;
+} __packed;
+
+struct loader_start {
+ struct loader_msg_hdr hdr;
+} __packed;
+
+/**
+ * struct response_info - Encapsulate firmware response related
+ * information for passing between function
+ * loader_cl_send() and process_recv() callback.
+ * @data Copy the data received from firmware here.
+ * @max_size Max size allocated for the @data buffer. If the
+ * received data exceeds this value, we log an
+ * error.
+ * @size Actual size of data received from firmware.
+ * @error Returns 0 for success, negative error code for a
+ * failure in function process_recv().
+ * @received Set to true on receiving a valid firmware
+ * response to host command
+ * @wait_queue Wait queue for Host firmware loading where the
+ * client sends message to ISH firmware and waits
+ * for response
+ */
+struct response_info {
+ void *data;
+ size_t max_size;
+ size_t size;
+ int error;
+ bool received;
+ wait_queue_head_t wait_queue;
+};
+
+/**
+ * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
+ * @work_ishtp_reset: Work queue for reset handling.
+ * @work_fw_load: Work queue for host firmware loading.
+ * @flag_retry Flag for indicating host firmware loading should
+ * be retried.
+ * @retry_count Count the number of retries.
+ *
+ * This structure is used to store data per client.
+ */
+struct ishtp_cl_data {
+ struct ishtp_cl *loader_ishtp_cl;
+ struct ishtp_cl_device *cl_device;
+
+ /*
+ * Used for passing firmware response information between
+ * loader_cl_send() and process_recv() callback.
+ */
+ struct response_info response;
+
+ struct work_struct work_ishtp_reset;
+ struct work_struct work_fw_load;
+
+ /*
+ * In certain failure scenrios, it makes sense to reset the ISH
+ * subsystem and retry Host firmware loading (e.g. bad message
+ * packet, ENOMEM, etc.). On the other hand, failures due to
+ * protocol mismatch, etc., are not recoverable. We do not
+ * retry them.
+ *
+ * If set, the flag indicates that we should re-try the
+ * particular failure.
+ */
+ bool flag_retry;
+ int retry_count;
+};
+
+#define IPC_FRAGMENT_DATA_PREAMBLE \
+ offsetof(struct loader_xfer_ipc_fragment, data)
+
+#define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
+
+/**
+ * get_firmware_variant() - Gets the filename of firmware image to be
+ * loaded based on platform variant.
+ * @client_data Client data instance.
+ * @filename Returns firmware filename.
+ *
+ * Queries the firmware-name device property string.
+ *
+ * Return: 0 for success, negative error code for failure.
+ */
+static int get_firmware_variant(struct ishtp_cl_data *client_data,
+ char *filename)
+{
+ int rv;
+ const char *val;
+ struct device *devc = ishtp_get_pci_device(client_data->cl_device);
+
+ rv = device_property_read_string(devc, "firmware-name", &val);
+ if (rv < 0) {
+ dev_err(devc,
+ "Error: ISH firmware-name device property required\n");
+ return rv;
+ }
+ return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
+}
+
+/**
+ * loader_cl_send() Send message from host to firmware
+ * @client_data: Client data instance
+ * @out_msg Message buffer to be sent to firmware
+ * @out_size Size of out going message
+ * @in_msg Message buffer where the incoming data copied.
+ * This buffer is allocated by calling
+ * @in_size Max size of incoming message
+ *
+ * Return: Number of bytes copied in the in_msg on success, negative
+ * error code on failure.
+ */
+static int loader_cl_send(struct ishtp_cl_data *client_data,
+ u8 *out_msg, size_t out_size,
+ u8 *in_msg, size_t in_size)
+{
+ int rv;
+ struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
+ struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
+
+ dev_dbg(cl_data_to_dev(client_data),
+ "%s: command=%02lx is_response=%u status=%02x\n",
+ __func__,
+ out_hdr->command & CMD_MASK,
+ out_hdr->command & IS_RESPONSE ? 1 : 0,
+ out_hdr->status);
+
+ /* Setup in coming buffer & size */
+ client_data->response.data = in_msg;
+ client_data->response.max_size = in_size;
+ client_data->response.error = 0;
+ client_data->response.received = false;
+
+ rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
+ if (rv < 0) {
+ dev_err(cl_data_to_dev(client_data),
+ "ishtp_cl_send error %d\n", rv);
+ return rv;
+ }
+
+ wait_event_interruptible_timeout(client_data->response.wait_queue,
+ client_data->response.received,
+ ISHTP_SEND_TIMEOUT);
+ if (!client_data->response.received) {
+ dev_err(cl_data_to_dev(client_data),
+ "Timed out for response to command=%02lx",
+ out_hdr->command & CMD_MASK);
+ return -ETIMEDOUT;
+ }
+
+ if (client_data->response.error < 0)
+ return client_data->response.error;
+
+ return client_data->response.size;
+}
+
+/**
+ * process_recv() - Receive and parse incoming packet
+ * @loader_ishtp_cl: Client instance to get stats
+ * @rb_in_proc: ISH received message buffer
+ *
+ * Parse the incoming packet. If it is a response packet then it will
+ * update received and wake up the caller waiting to for the response.
+ */
+static void process_recv(struct ishtp_cl *loader_ishtp_cl,
+ struct ishtp_cl_rb *rb_in_proc)
+{
+ struct loader_msg_hdr *hdr;
+ size_t data_len = rb_in_proc->buf_idx;
+ struct ishtp_cl_data *client_data =
+ ishtp_get_client_data(loader_ishtp_cl);
+
+ /* Sanity check */
+ if (!client_data->response.data) {
+ dev_err(cl_data_to_dev(client_data),
+ "Receiving buffer is null. Should be allocated by calling function\n");
+ client_data->response.error = -EINVAL;
+ goto end;
+ }
+
+ if (client_data->response.received) {
+ dev_err(cl_data_to_dev(client_data),
+ "Previous firmware message not yet processed\n");
+ client_data->response.error = -EINVAL;
+ goto end;
+ }
+ /*
+ * All firmware messages have a header. Check buffer size
+ * before accessing elements inside.
+ */
+ if (!rb_in_proc->buffer.data) {
+ dev_warn(cl_data_to_dev(client_data),
+ "rb_in_proc->buffer.data returned null");
+ client_data->response.error = -EBADMSG;
+ goto end;
+ }
+
+ if (data_len < sizeof(struct loader_msg_hdr)) {
+ dev_err(cl_data_to_dev(client_data),
+ "data size %zu is less than header %zu\n",
+ data_len, sizeof(struct loader_msg_hdr));
+ client_data->response.error = -EMSGSIZE;
+ goto end;
+ }
+
+ hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
+
+ dev_dbg(cl_data_to_dev(client_data),
+ "%s: command=%02lx is_response=%u status=%02x\n",
+ __func__,
+ hdr->command & CMD_MASK,
+ hdr->command & IS_RESPONSE ? 1 : 0,
+ hdr->status);
+
+ if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
+ ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
+ ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
+ dev_err(cl_data_to_dev(client_data),
+ "Invalid command=%02lx\n",
+ hdr->command & CMD_MASK);
+ client_data->response.error = -EPROTO;
+ goto end;
+ }
+
+ if (data_len > client_data->response.max_size) {
+ dev_err(cl_data_to_dev(client_data),
+ "Received buffer size %zu is larger than allocated buffer %zu\n",
+ data_len, client_data->response.max_size);
+ client_data->response.error = -EMSGSIZE;
+ goto end;
+ }
+
+ /* We expect only "response" messages from firmware */
+ if (!(hdr->command & IS_RESPONSE)) {
+ dev_err(cl_data_to_dev(client_data),
+ "Invalid response to command\n");
+ client_data->response.error = -EIO;
+ goto end;
+ }
+
+ if (hdr->status) {
+ dev_err(cl_data_to_dev(client_data),
+ "Loader returned status %d\n",
+ hdr->status);
+ client_data->response.error = -EIO;
+ goto end;
+ }
+
+ /* Update the actual received buffer size */
+ client_data->response.size = data_len;
+
+ /*
+ * Copy the buffer received in firmware response for the
+ * calling thread.
+ */
+ memcpy(client_data->response.data,
+ rb_in_proc->buffer.data, data_len);
+
+ /* Set flag before waking up the caller */
+ client_data->response.received = true;
+
+end:
+ /* Free the buffer */
+ ishtp_cl_io_rb_recycle(rb_in_proc);
+ rb_in_proc = NULL;
+
+ /* Wake the calling thread */
+ wake_up_interruptible(&client_data->response.wait_queue);
+}
+
+/**
+ * loader_cl_event_cb() - bus driver callback for incoming message
+ * @device: Pointer to the ishtp client device for which this
+ * message is targeted
+ *
+ * Remove the packet from the list and process the message by calling
+ * process_recv
+ */
+static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
+{
+ struct ishtp_cl_rb *rb_in_proc;
+ struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
+
+ while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) {
+ /* Process the data packet from firmware */
+ process_recv(loader_ishtp_cl, rb_in_proc);
+ }
+}
+
+/**
+ * ish_query_loader_prop() - Query ISH Shim firmware loader
+ * @client_data: Client data instance
+ * @fw: Poiner to firmware data struct in host memory
+ * @fw_info: Loader firmware properties
+ *
+ * This function queries the ISH Shim firmware loader for capabilities.
+ *
+ * Return: 0 for success, negative error code for failure.
+ */
+static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
+ const struct firmware *fw,
+ struct shim_fw_info *fw_info)
+{
+ int rv;
+ struct loader_xfer_query ldr_xfer_query;
+ struct loader_xfer_query_response ldr_xfer_query_resp;
+
+ memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
+ ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
+ ldr_xfer_query.image_size = fw->size;
+ rv = loader_cl_send(client_data,
+ (u8 *)&ldr_xfer_query,
+ sizeof(ldr_xfer_query),
+ (u8 *)&ldr_xfer_query_resp,
+ sizeof(ldr_xfer_query_resp));
+ if (rv < 0) {
+ client_data->flag_retry = true;
+ return rv;
+ }
+
+ /* On success, the return value is the received buffer size */
+ if (rv != sizeof(struct loader_xfer_query_response)) {
+ dev_err(cl_data_to_dev(client_data),
+ "data size %d is not equal to size of loader_xfer_query_response %zu\n",
+ rv, sizeof(struct loader_xfer_query_response));
+ client_data->flag_retry = true;
+ return -EMSGSIZE;
+ }
+
+ /* Save fw_info for use outside this function */
+ *fw_info = ldr_xfer_query_resp.fw_info;
+
+ /* Loader firmware properties */
+ dev_dbg(cl_data_to_dev(client_data),
+ "ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
+ fw_info->ish_fw_version.major,
+ fw_info->ish_fw_version.minor,
+ fw_info->ish_fw_version.hotfix,
+ fw_info->ish_fw_version.build,
+ fw_info->protocol_version,
+ fw_info->ldr_version.value);
+
+ dev_dbg(cl_data_to_dev(client_data),
+ "loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
+ fw_info->ldr_capability.max_fw_image_size,
+ fw_info->ldr_capability.xfer_mode,
+ fw_info->ldr_capability.max_dma_buf_size,
+ dma_buf_size_limit);
+
+ /* Sanity checks */
+ if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
+ dev_err(cl_data_to_dev(client_data),
+ "ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
+ fw->size,
+ fw_info->ldr_capability.max_fw_image_size);
+ return -ENOSPC;
+ }
+
+ /* For DMA the buffer size should be multiple of cacheline size */
+ if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
+ (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
+ dev_err(cl_data_to_dev(client_data),
+ "Shim firmware loader buffer size %d should be multipe of cacheline\n",
+ fw_info->ldr_capability.max_dma_buf_size);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+/**
+ * ish_fw_xfer_ishtp() Loads ISH firmware using ishtp interface
+ * @client_data: Client data instance
+ * @fw: Pointer to firmware data struct in host memory
+ *
+ * This function uses ISH-TP to transfer ISH firmware from host to
+ * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
+ * support.
+ *
+ * Return: 0 for success, negative error code for failure.
+ */
+static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
+ const struct firmware *fw)
+{
+ int rv;
+ u32 fragment_offset, fragment_size, payload_max_size;
+ struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
+ struct loader_msg_hdr ldr_xfer_ipc_ack;
+
+ payload_max_size =
+ LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
+
+ ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
+ if (!ldr_xfer_ipc_frag) {
+ client_data->flag_retry = true;
+ return -ENOMEM;
+ }
+
+ ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
+ ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
+
+ /* Break the firmware image into fragments and send as ISH-TP payload */
+ fragment_offset = 0;
+ while (fragment_offset < fw->size) {
+ if (fragment_offset + payload_max_size < fw->size) {
+ fragment_size = payload_max_size;
+ ldr_xfer_ipc_frag->fragment.is_last = 0;
+ } else {
+ fragment_size = fw->size - fragment_offset;
+ ldr_xfer_ipc_frag->fragment.is_last = 1;
+ }
+
+ ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
+ ldr_xfer_ipc_frag->fragment.size = fragment_size;
+ memcpy(ldr_xfer_ipc_frag->data,
+ &fw->data[fragment_offset],
+ fragment_size);
+
+ dev_dbg(cl_data_to_dev(client_data),
+ "xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
+ ldr_xfer_ipc_frag->fragment.offset,
+ ldr_xfer_ipc_frag->fragment.size,
+ ldr_xfer_ipc_frag->fragment.is_last);
+
+ rv = loader_cl_send(client_data,
+ (u8 *)ldr_xfer_ipc_frag,
+ IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
+ (u8 *)&ldr_xfer_ipc_ack,
+ sizeof(ldr_xfer_ipc_ack));
+ if (rv < 0) {
+ client_data->flag_retry = true;
+ goto end_err_resp_buf_release;
+ }
+
+ fragment_offset += fragment_size;
+ }
+
+ kfree(ldr_xfer_ipc_frag);
+ return 0;
+
+end_err_resp_buf_release:
+ /* Free ISH buffer if not done already, in error case */
+ kfree(ldr_xfer_ipc_frag);
+ return rv;
+}
+
+/**
+ * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
+ * @client_data: Client data instance
+ * @fw: Pointer to firmware data struct in host memory
+ * @fw_info: Loader firmware properties
+ *
+ * Host firmware load is a unique case where we need to download
+ * a large firmware image (200+ Kb). This function implements
+ * direct DMA transfer in kernel and ISH firmware. This allows
+ * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
+ * directly to ISH UMA at location of choice.
+ * Function depends on corresponding support in ISH firmware.
+ *
+ * Return: 0 for success, negative error code for failure.
+ */
+static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
+ const struct firmware *fw,
+ const struct shim_fw_info fw_info)
+{
+ int rv;
+ void *dma_buf;
+ dma_addr_t dma_buf_phy;
+ u32 fragment_offset, fragment_size, payload_max_size;
+ struct loader_msg_hdr ldr_xfer_dma_frag_ack;
+ struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
+ struct device *devc = ishtp_get_pci_device(client_data->cl_device);
+ u32 shim_fw_buf_size =
+ fw_info.ldr_capability.max_dma_buf_size;
+
+ /*
+ * payload_max_size should be set to minimum of
+ * (1) Size of firmware to be loaded,
+ * (2) Max DMA buffer size supported by Shim firmware,
+ * (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
+ */
+ payload_max_size = min3(fw->size,
+ (size_t)shim_fw_buf_size,
+ (size_t)dma_buf_size_limit);
+
+ /*
+ * Buffer size should be multiple of cacheline size
+ * if it's not, select the previous cacheline boundary.
+ */
+ payload_max_size &= ~(L1_CACHE_BYTES - 1);
+
+ dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32);
+ if (!dma_buf) {
+ client_data->flag_retry = true;
+ return -ENOMEM;
+ }
+
+ dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(devc, dma_buf_phy)) {
+ dev_err(cl_data_to_dev(client_data), "DMA map failed\n");
+ client_data->flag_retry = true;
+ rv = -ENOMEM;
+ goto end_err_dma_buf_release;
+ }
+
+ ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
+ ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
+ ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
+
+ /* Send the firmware image in chucks of payload_max_size */
+ fragment_offset = 0;
+ while (fragment_offset < fw->size) {
+ if (fragment_offset + payload_max_size < fw->size) {
+ fragment_size = payload_max_size;
+ ldr_xfer_dma_frag.fragment.is_last = 0;
+ } else {
+ fragment_size = fw->size - fragment_offset;
+ ldr_xfer_dma_frag.fragment.is_last = 1;
+ }
+
+ ldr_xfer_dma_frag.fragment.offset = fragment_offset;
+ ldr_xfer_dma_frag.fragment.size = fragment_size;
+ memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
+
+ dma_sync_single_for_device(devc, dma_buf_phy,
+ payload_max_size,
+ DMA_TO_DEVICE);
+
+ /*
+ * Flush cache here because the dma_sync_single_for_device()
+ * does not do for x86.
+ */
+ clflush_cache_range(dma_buf, payload_max_size);
+
+ dev_dbg(cl_data_to_dev(client_data),
+ "xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
+ ldr_xfer_dma_frag.fragment.offset,
+ ldr_xfer_dma_frag.fragment.size,
+ ldr_xfer_dma_frag.fragment.is_last,
+ ldr_xfer_dma_frag.ddr_phys_addr);
+
+ rv = loader_cl_send(client_data,
+ (u8 *)&ldr_xfer_dma_frag,
+ sizeof(ldr_xfer_dma_frag),
+ (u8 *)&ldr_xfer_dma_frag_ack,
+ sizeof(ldr_xfer_dma_frag_ack));
+ if (rv < 0) {
+ client_data->flag_retry = true;
+ goto end_err_resp_buf_release;
+ }
+
+ fragment_offset += fragment_size;
+ }
+
+ dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
+ kfree(dma_buf);
+ return 0;
+
+end_err_resp_buf_release:
+ /* Free ISH buffer if not done already, in error case */
+ dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
+end_err_dma_buf_release:
+ kfree(dma_buf);
+ return rv;
+}
+
+/**
+ * ish_fw_start() Start executing ISH main firmware
+ * @client_data: client data instance
+ *
+ * This function sends message to Shim firmware loader to start
+ * the execution of ISH main firmware.
+ *
+ * Return: 0 for success, negative error code for failure.
+ */
+static int ish_fw_start(struct ishtp_cl_data *client_data)
+{
+ struct loader_start ldr_start;
+ struct loader_msg_hdr ldr_start_ack;
+
+ memset(&ldr_start, 0, sizeof(ldr_start));
+ ldr_start.hdr.command = LOADER_CMD_START;
+ return loader_cl_send(client_data,
+ (u8 *)&ldr_start,
+ sizeof(ldr_start),
+ (u8 *)&ldr_start_ack,
+ sizeof(ldr_start_ack));
+}
+
+/**
+ * load_fw_from_host() Loads ISH firmware from host
+ * @client_data: Client data instance
+ *
+ * This function loads the ISH firmware to ISH SRAM and starts execution
+ *
+ * Return: 0 for success, negative error code for failure.
+ */
+static int load_fw_from_host(struct ishtp_cl_data *client_data)
+{
+ int rv;
+ u32 xfer_mode;
+ char *filename;
+ const struct firmware *fw;
+ struct shim_fw_info fw_info;
+ struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
+
+ client_data->flag_retry = false;
+
+ filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
+ if (!filename) {
+ client_data->flag_retry = true;
+ rv = -ENOMEM;
+ goto end_error;
+ }
+
+ /* Get filename of the ISH firmware to be loaded */
+ rv = get_firmware_variant(client_data, filename);
+ if (rv < 0)
+ goto end_err_filename_buf_release;
+
+ rv = request_firmware(&fw, filename, cl_data_to_dev(client_data));
+ if (rv < 0)
+ goto end_err_filename_buf_release;
+
+ /* Step 1: Query Shim firmware loader properties */
+
+ rv = ish_query_loader_prop(client_data, fw, &fw_info);
+ if (rv < 0)
+ goto end_err_fw_release;
+
+ /* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
+
+ xfer_mode = fw_info.ldr_capability.xfer_mode;
+ if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
+ rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
+ } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
+ rv = ish_fw_xfer_ishtp(client_data, fw);
+ } else {
+ dev_err(cl_data_to_dev(client_data),
+ "No transfer mode selected in firmware\n");
+ rv = -EINVAL;
+ }
+ if (rv < 0)
+ goto end_err_fw_release;
+
+ /* Step 3: Start ISH main firmware exeuction */
+
+ rv = ish_fw_start(client_data);
+ if (rv < 0)
+ goto end_err_fw_release;
+
+ release_firmware(fw);
+ kfree(filename);
+ dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
+ filename);
+ return 0;
+
+end_err_fw_release:
+ release_firmware(fw);
+end_err_filename_buf_release:
+ kfree(filename);
+end_error:
+ /* Keep a count of retries, and give up after 3 attempts */
+ if (client_data->flag_retry &&
+ client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
+ dev_warn(cl_data_to_dev(client_data),
+ "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
+ rv);
+ ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
+ } else {
+ dev_err(cl_data_to_dev(client_data),
+ "ISH host firmware load failed %d\n", rv);
+ }
+ return rv;
+}
+
+static void load_fw_from_host_handler(struct work_struct *work)
+{
+ struct ishtp_cl_data *client_data;
+
+ client_data = container_of(work, struct ishtp_cl_data,
+ work_fw_load);
+ load_fw_from_host(client_data);
+}
+
+/**
+ * loader_init() - Init function for ISH-TP client
+ * @loader_ishtp_cl: ISH-TP client instance
+ * @reset: true if called for init after reset
+ *
+ * Return: 0 for success, negative error code for failure
+ */
+static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
+{
+ int rv;
+ struct ishtp_fw_client *fw_client;
+ struct ishtp_cl_data *client_data =
+ ishtp_get_client_data(loader_ishtp_cl);
+
+ dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
+
+ rv = ishtp_cl_link(loader_ishtp_cl);
+ if (rv < 0) {
+ dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n");
+ return rv;
+ }
+
+ /* Connect to firmware client */
+ ishtp_set_tx_ring_size(loader_ishtp_cl, LOADER_CL_TX_RING_SIZE);
+ ishtp_set_rx_ring_size(loader_ishtp_cl, LOADER_CL_RX_RING_SIZE);
+
+ fw_client =
+ ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_ishtp_cl),
+ &loader_ishtp_guid);
+ if (!fw_client) {
+ dev_err(cl_data_to_dev(client_data),
+ "ISH client uuid not found\n");
+ rv = -ENOENT;
+ goto err_cl_unlink;
+ }
+
+ ishtp_cl_set_fw_client_id(loader_ishtp_cl,
+ ishtp_get_fw_client_id(fw_client));
+ ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_CONNECTING);
+
+ rv = ishtp_cl_connect(loader_ishtp_cl);
+ if (rv < 0) {
+ dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
+ goto err_cl_unlink;
+ }
+
+ dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
+
+ ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb);
+
+ return 0;
+
+err_cl_unlink:
+ ishtp_cl_unlink(loader_ishtp_cl);
+ return rv;
+}
+
+static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
+{
+ ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_DISCONNECTING);
+ ishtp_cl_disconnect(loader_ishtp_cl);
+ ishtp_cl_unlink(loader_ishtp_cl);
+ ishtp_cl_flush_queues(loader_ishtp_cl);
+
+ /* Disband and free all Tx and Rx client-level rings */
+ ishtp_cl_free(loader_ishtp_cl);
+}
+
+static void reset_handler(struct work_struct *work)
+{
+ int rv;
+ struct ishtp_cl_data *client_data;
+ struct ishtp_cl *loader_ishtp_cl;
+ struct ishtp_cl_device *cl_device;
+
+ client_data = container_of(work, struct ishtp_cl_data,
+ work_ishtp_reset);
+
+ loader_ishtp_cl = client_data->loader_ishtp_cl;
+ cl_device = client_data->cl_device;
+
+ /* Unlink, flush queues & start again */
+ ishtp_cl_unlink(loader_ishtp_cl);
+ ishtp_cl_flush_queues(loader_ishtp_cl);
+ ishtp_cl_free(loader_ishtp_cl);
+
+ loader_ishtp_cl = ishtp_cl_allocate(cl_device);
+ if (!loader_ishtp_cl)
+ return;
+
+ ishtp_set_drvdata(cl_device, loader_ishtp_cl);
+ ishtp_set_client_data(loader_ishtp_cl, client_data);
+ client_data->loader_ishtp_cl = loader_ishtp_cl;
+ client_data->cl_device = cl_device;
+
+ rv = loader_init(loader_ishtp_cl, 1);
+ if (rv < 0) {
+ dev_err(ishtp_device(cl_device), "Reset Failed\n");
+ return;
+ }
+
+ /* ISH firmware loading from host */
+ load_fw_from_host(client_data);
+}
+
+/**
+ * loader_ishtp_cl_probe() - ISH-TP client driver probe
+ * @cl_device: ISH-TP client device instance
+ *
+ * This function gets called on device create on ISH-TP bus
+ *
+ * Return: 0 for success, negative error code for failure
+ */
+static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
+{
+ struct ishtp_cl *loader_ishtp_cl;
+ struct ishtp_cl_data *client_data;
+ int rv;
+
+ client_data = devm_kzalloc(ishtp_device(cl_device),
+ sizeof(*client_data),
+ GFP_KERNEL);
+ if (!client_data)
+ return -ENOMEM;
+
+ loader_ishtp_cl = ishtp_cl_allocate(cl_device);
+ if (!loader_ishtp_cl)
+ return -ENOMEM;
+
+ ishtp_set_drvdata(cl_device, loader_ishtp_cl);
+ ishtp_set_client_data(loader_ishtp_cl, client_data);
+ client_data->loader_ishtp_cl = loader_ishtp_cl;
+ client_data->cl_device = cl_device;
+
+ init_waitqueue_head(&client_data->response.wait_queue);
+
+ INIT_WORK(&client_data->work_ishtp_reset,
+ reset_handler);
+ INIT_WORK(&client_data->work_fw_load,
+ load_fw_from_host_handler);
+
+ rv = loader_init(loader_ishtp_cl, 0);
+ if (rv < 0) {
+ ishtp_cl_free(loader_ishtp_cl);
+ return rv;
+ }
+ ishtp_get_device(cl_device);
+
+ client_data->retry_count = 0;
+
+ /* ISH firmware loading from host */
+ schedule_work(&client_data->work_fw_load);
+
+ return 0;
+}
+
+/**
+ * loader_ishtp_cl_remove() - ISH-TP client driver remove
+ * @cl_device: ISH-TP client device instance
+ *
+ * This function gets called on device remove on ISH-TP bus
+ *
+ * Return: 0
+ */
+static int loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
+{
+ struct ishtp_cl_data *client_data;
+ struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
+
+ client_data = ishtp_get_client_data(loader_ishtp_cl);
+
+ /*
+ * The sequence of the following two cancel_work_sync() is
+ * important. The work_fw_load can in turn schedue
+ * work_ishtp_reset, so first cancel work_fw_load then
+ * cancel work_ishtp_reset.
+ */
+ cancel_work_sync(&client_data->work_fw_load);
+ cancel_work_sync(&client_data->work_ishtp_reset);
+ loader_deinit(loader_ishtp_cl);
+ ishtp_put_device(cl_device);
+
+ return 0;
+}
+
+/**
+ * loader_ishtp_cl_reset() - ISH-TP client driver reset
+ * @cl_device: ISH-TP client device instance
+ *
+ * This function gets called on device reset on ISH-TP bus
+ *
+ * Return: 0
+ */
+static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
+{
+ struct ishtp_cl_data *client_data;
+ struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
+
+ client_data = ishtp_get_client_data(loader_ishtp_cl);
+
+ schedule_work(&client_data->work_ishtp_reset);
+
+ return 0;
+}
+
+static struct ishtp_cl_driver loader_ishtp_cl_driver = {
+ .name = "ish-loader",
+ .guid = &loader_ishtp_guid,
+ .probe = loader_ishtp_cl_probe,
+ .remove = loader_ishtp_cl_remove,
+ .reset = loader_ishtp_cl_reset,
+};
+
+static int __init ish_loader_init(void)
+{
+ return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE);
+}
+
+static void __exit ish_loader_exit(void)
+{
+ ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
+}
+
+late_initcall(ish_loader_init);
+module_exit(ish_loader_exit);
+
+module_param(dma_buf_size_limit, int, 0644);
+MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
+
+MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
+MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
+
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("ishtp:*");
--
1.9.1
^ permalink raw reply related
* Re: [PATCH RESEND -next] Input: uinput - Avoid Use-After-Free with udev lock
From: Mukesh Ojha @ 2019-04-02 6:03 UTC (permalink / raw)
To: linux-input, linux-kernel
Cc: Gaurav Kohli, Peter Hutterer, Martin Kepplinger, Paul E. McKenney
In-Reply-To: <1553768752-21739-1-git-send-email-mojha@codeaurora.org>
Please don't consider this patch, i will send v2 of this.
Thanks,
Mukesh
On 3/28/2019 3:55 PM, Mukesh Ojha wrote:
> uinput_destroy_device() gets called from two places. In one place,
> uinput_ioctl_handler() it is protected under a lock udev->mutex
> but same is not true for other place inside uinput_release().
>
> This can result in a race where udev device gets freed while it
> is in use.
>
> [ 160.093398] Call trace:
> [ 160.093417] kernfs_get+0x64/0x88
> [ 160.093438] kernfs_new_node+0x94/0xc8
> [ 160.093450] kernfs_create_dir_ns+0x44/0xfc
> [ 160.093463] sysfs_create_dir_ns+0xa8/0x130
> [ 160.093479] kobject_add_internal+0x278/0x650
> [ 160.093491] kobject_add_varg+0xe0/0x130
> [ 160.093502] kobject_add+0x15c/0x1d0
> [ 160.093518] device_add+0x2bc/0xde0
> [ 160.093533] input_register_device+0x5f4/0xa0c
> [ 160.093547] uinput_ioctl_handler+0x1184/0x2198
> [ 160.093560] uinput_ioctl+0x38/0x48
> [ 160.093573] vfs_ioctl+0x7c/0xb4
> [ 160.093585] do_vfs_ioctl+0x9ec/0x2350
> [ 160.093597] SyS_ioctl+0x6c/0xa4
> [ 160.093610] el0_svc_naked+0x34/0x38
> [ 160.093621] ---[ end trace bccf0093cda2c538 ]---
> [ 160.099041] =============================================================================
> [ 160.107459] BUG kernfs_node_cache (Tainted: G S W O ): Object already free
> [ 160.115235] -----------------------------------------------------------------------------
> [ 160.115235]
> [ 160.125151] Disabling lock debugging due to kernel taint
> [ 160.130626] INFO: Allocated in __kernfs_new_node+0x8c/0x3c0 age=11 cpu=2 pid=7098
> [ 160.138314] kmem_cache_alloc+0x358/0x388
> [ 160.142445] __kernfs_new_node+0x8c/0x3c0
> [ 160.146590] kernfs_new_node+0x80/0xc8
> [ 160.150462] kernfs_create_dir_ns+0x44/0xfc
> [ 160.154777] sysfs_create_dir_ns+0xa8/0x130
> [ 160.158416] CPU5: update max cpu_capacity 1024
> [ 160.159085] kobject_add_internal+0x278/0x650
> [ 160.163567] kobject_add_varg+0xe0/0x130
> [ 160.167606] kobject_add+0x15c/0x1d0
> [ 160.168452] CPU5: update max cpu_capacity 780
> [ 160.171287] get_device_parent+0x2d0/0x34c
> [ 160.175510] device_add+0x240/0xde0
> [ 160.178371] CPU6: update max cpu_capacity 916
> [ 160.179108] input_register_device+0x5f4/0xa0c
> [ 160.183686] uinput_ioctl_handler+0x1184/0x2198
> [ 160.188346] uinput_ioctl+0x38/0x48
> [ 160.191941] vfs_ioctl+0x7c/0xb4
> [ 160.195261] do_vfs_ioctl+0x9ec/0x2350
> [ 160.199111] SyS_ioctl+0x6c/0xa4
> [ 160.202436] INFO: Freed in kernfs_put+0x2c8/0x434 age=14 cpu=0 pid=7096
> [ 160.209230] kernfs_put+0x2c8/0x434
> [ 160.212825] kobject_del+0x50/0xcc
> [ 160.216332] cleanup_glue_dir+0x124/0x16c
> [ 160.220456] device_del+0x55c/0x5c8
> [ 160.224047] __input_unregister_device+0x274/0x2a8
> [ 160.228974] input_unregister_device+0x90/0xd0
> [ 160.233553] uinput_destroy_device+0x15c/0x1dc
> [ 160.238131] uinput_release+0x44/0x5c
> [ 160.241898] __fput+0x1f4/0x4e4
> [ 160.245127] ____fput+0x20/0x2c
> [ 160.248358] task_work_run+0x9c/0x174
> [ 160.252127] do_notify_resume+0x104/0x6bc
> [ 160.256253] work_pending+0x8/0x14
> [ 160.259751] INFO: Slab 0xffffffbf0215ff00 objects=33 used=11 fp=0xffffffc0857ffd08 flags=0x8101
> [ 160.268693] INFO: Object 0xffffffc0857ffd08 @offset=15624 fp=0xffffffc0857fefb0
> [ 160.268693]
> [ 160.277721] Redzone ffffffc0857ffd00: bb bb bb bb bb bb bb bb ........
> [ 160.286656] Object ffffffc0857ffd08: 00 00 00 00 01 00 00 80 58 a2 37 45 c1 ff ff ff ........X.7E....
> [ 160.296207] Object ffffffc0857ffd18: ae 21 10 0b 90 ff ff ff 20 fd 7f 85 c0 ff ff ff .!...... .......
> [ 160.305780] Object ffffffc0857ffd28: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> [ 160.315342] Object ffffffc0857ffd38: 00 00 00 00 00 00 00 00 7d a3 25 69 00 00 00 00 ........}.%i....
> [ 160.324896] Object ffffffc0857ffd48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> [ 160.334446] Object ffffffc0857ffd58: 80 c0 28 47 c1 ff ff ff 00 00 00 00 00 00 00 00 ..(G............
> [ 160.344000] Object ffffffc0857ffd68: 80 4a ce d1 c0 ff ff ff dc 32 01 00 01 00 00 00 .J.......2......
> [ 160.353554] Object ffffffc0857ffd78: 11 00 ed 41 00 00 00 00 00 00 00 00 00 00 00 00 ...A............
> [ 160.363099] Redzone ffffffc0857ffd88: bb bb bb bb bb bb bb bb ........
> [ 160.372032] Padding ffffffc0857ffee0: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
> [ 160.378299] CPU6: update max cpu_capacity 780
> [ 160.380971] CPU: 4 PID: 7098 Comm: syz-executor Tainted: G S B W O 4.14.98+ #1
>
> So, avoid the race by taking a udev lock inside `uinput_release()`.
>
> Change-Id: I3bbb07589b7b6e0e1b3bea572b5eb4f6b09774d6
> Signed-off-by: Mukesh Ojha <mojha@codeaurora.org>
> Cc: Gaurav Kohli <gkohli@codeaurora.org>
> Cc: Peter Hutterer <peter.hutterer@who-t.net>
> Cc: Martin Kepplinger <martink@posteo.de>
> Cc: "Paul E. McKenney" <paulmck@linux.ibm.com>
>
> ---
> drivers/input/misc/uinput.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
> index 26ec603f..a3fb3b1 100644
> --- a/drivers/input/misc/uinput.c
> +++ b/drivers/input/misc/uinput.c
> @@ -714,9 +714,15 @@ static __poll_t uinput_poll(struct file *file, poll_table *wait)
> static int uinput_release(struct inode *inode, struct file *file)
> {
> struct uinput_device *udev = file->private_data;
> + ssize_t retval;
> +
> + retval = mutex_lock_interruptible(&udev->mutex);
> + if (retval)
> + return retval;
>
> uinput_destroy_device(udev);
> kfree(udev);
> + mutex_unlock(&udev->mutex);
>
> return 0;
> }
^ permalink raw reply
* Re: [PATCH -next] Input: uinput - Avoid Use-After-Free with udev lock
From: Mukesh Ojha @ 2019-04-02 6:04 UTC (permalink / raw)
To: linux-input, linux-kernel
In-Reply-To: <1553767582-15318-1-git-send-email-mojha@codeaurora.org>
Please don't consider this patch, i will send v2 of this.
Thanks,
Mukesh
On 3/28/2019 3:36 PM, Mukesh Ojha wrote:
> uinput_destroy_device() gets called from two places. In one place,
> uinput_ioctl_handler() it is protected under a lock udev->mutex
> but same is not true for other place inside uinput_release().
>
> This can result in a race where udev device gets freed while it
> is in use.
>
> [ 160.093398] Call trace:
> [ 160.093417] kernfs_get+0x64/0x88
> [ 160.093438] kernfs_new_node+0x94/0xc8
> [ 160.093450] kernfs_create_dir_ns+0x44/0xfc
> [ 160.093463] sysfs_create_dir_ns+0xa8/0x130
> [ 160.093479] kobject_add_internal+0x278/0x650
> [ 160.093491] kobject_add_varg+0xe0/0x130
> [ 160.093502] kobject_add+0x15c/0x1d0
> [ 160.093518] device_add+0x2bc/0xde0
> [ 160.093533] input_register_device+0x5f4/0xa0c
> [ 160.093547] uinput_ioctl_handler+0x1184/0x2198
> [ 160.093560] uinput_ioctl+0x38/0x48
> [ 160.093573] vfs_ioctl+0x7c/0xb4
> [ 160.093585] do_vfs_ioctl+0x9ec/0x2350
> [ 160.093597] SyS_ioctl+0x6c/0xa4
> [ 160.093610] el0_svc_naked+0x34/0x38
> [ 160.093621] ---[ end trace bccf0093cda2c538 ]---
> [ 160.099041] =============================================================================
> [ 160.107459] BUG kernfs_node_cache (Tainted: G S W O ): Object already free
> [ 160.115235] -----------------------------------------------------------------------------
> [ 160.115235]
> [ 160.125151] Disabling lock debugging due to kernel taint
> [ 160.130626] INFO: Allocated in __kernfs_new_node+0x8c/0x3c0 age=11 cpu=2 pid=7098
> [ 160.138314] kmem_cache_alloc+0x358/0x388
> [ 160.142445] __kernfs_new_node+0x8c/0x3c0
> [ 160.146590] kernfs_new_node+0x80/0xc8
> [ 160.150462] kernfs_create_dir_ns+0x44/0xfc
> [ 160.154777] sysfs_create_dir_ns+0xa8/0x130
> [ 160.158416] CPU5: update max cpu_capacity 1024
> [ 160.159085] kobject_add_internal+0x278/0x650
> [ 160.163567] kobject_add_varg+0xe0/0x130
> [ 160.167606] kobject_add+0x15c/0x1d0
> [ 160.168452] CPU5: update max cpu_capacity 780
> [ 160.171287] get_device_parent+0x2d0/0x34c
> [ 160.175510] device_add+0x240/0xde0
> [ 160.178371] CPU6: update max cpu_capacity 916
> [ 160.179108] input_register_device+0x5f4/0xa0c
> [ 160.183686] uinput_ioctl_handler+0x1184/0x2198
> [ 160.188346] uinput_ioctl+0x38/0x48
> [ 160.191941] vfs_ioctl+0x7c/0xb4
> [ 160.195261] do_vfs_ioctl+0x9ec/0x2350
> [ 160.199111] SyS_ioctl+0x6c/0xa4
> [ 160.202436] INFO: Freed in kernfs_put+0x2c8/0x434 age=14 cpu=0 pid=7096
> [ 160.209230] kernfs_put+0x2c8/0x434
> [ 160.212825] kobject_del+0x50/0xcc
> [ 160.216332] cleanup_glue_dir+0x124/0x16c
> [ 160.220456] device_del+0x55c/0x5c8
> [ 160.224047] __input_unregister_device+0x274/0x2a8
> [ 160.228974] input_unregister_device+0x90/0xd0
> [ 160.233553] uinput_destroy_device+0x15c/0x1dc
> [ 160.238131] uinput_release+0x44/0x5c
> [ 160.241898] __fput+0x1f4/0x4e4
> [ 160.245127] ____fput+0x20/0x2c
> [ 160.248358] task_work_run+0x9c/0x174
> [ 160.252127] do_notify_resume+0x104/0x6bc
> [ 160.256253] work_pending+0x8/0x14
> [ 160.259751] INFO: Slab 0xffffffbf0215ff00 objects=33 used=11 fp=0xffffffc0857ffd08 flags=0x8101
> [ 160.268693] INFO: Object 0xffffffc0857ffd08 @offset=15624 fp=0xffffffc0857fefb0
> [ 160.268693]
> [ 160.277721] Redzone ffffffc0857ffd00: bb bb bb bb bb bb bb bb ........
> [ 160.286656] Object ffffffc0857ffd08: 00 00 00 00 01 00 00 80 58 a2 37 45 c1 ff ff ff ........X.7E....
> [ 160.296207] Object ffffffc0857ffd18: ae 21 10 0b 90 ff ff ff 20 fd 7f 85 c0 ff ff ff .!...... .......
> [ 160.305780] Object ffffffc0857ffd28: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> [ 160.315342] Object ffffffc0857ffd38: 00 00 00 00 00 00 00 00 7d a3 25 69 00 00 00 00 ........}.%i....
> [ 160.324896] Object ffffffc0857ffd48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> [ 160.334446] Object ffffffc0857ffd58: 80 c0 28 47 c1 ff ff ff 00 00 00 00 00 00 00 00 ..(G............
> [ 160.344000] Object ffffffc0857ffd68: 80 4a ce d1 c0 ff ff ff dc 32 01 00 01 00 00 00 .J.......2......
> [ 160.353554] Object ffffffc0857ffd78: 11 00 ed 41 00 00 00 00 00 00 00 00 00 00 00 00 ...A............
> [ 160.363099] Redzone ffffffc0857ffd88: bb bb bb bb bb bb bb bb ........
> [ 160.372032] Padding ffffffc0857ffee0: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
> [ 160.378299] CPU6: update max cpu_capacity 780
> [ 160.380971] CPU: 4 PID: 7098 Comm: syz-executor Tainted: G S B W O 4.14.98+ #1
>
> So, avoid the race by taking a udev lock inside `uinput_release()`.
>
> Change-Id: I3bbb07589b7b6e0e1b3bea572b5eb4f6b09774d6
> Signed-off-by: Mukesh Ojha <mojha@codeaurora.org>
> Cc:Gaurav Kohli <gkohli@codeaurora.org>
> Cc:Peter Hutterer <peter.hutterer@who-t.net>
> Cc:Martin Kepplinger <martink@posteo.de>
> Cc:"Paul E. McKenney" <paulmck@linux.ibm.com>
>
> ---
> drivers/input/misc/uinput.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
> index 26ec603f..a3fb3b1 100644
> --- a/drivers/input/misc/uinput.c
> +++ b/drivers/input/misc/uinput.c
> @@ -714,9 +714,15 @@ static __poll_t uinput_poll(struct file *file, poll_table *wait)
> static int uinput_release(struct inode *inode, struct file *file)
> {
> struct uinput_device *udev = file->private_data;
> + ssize_t retval;
> +
> + retval = mutex_lock_interruptible(&udev->mutex);
> + if (retval)
> + return retval;
>
> uinput_destroy_device(udev);
> kfree(udev);
> + mutex_unlock(&udev->mutex);
>
> return 0;
> }
^ permalink raw reply
* Re: [PATCH v3 3/4] driver core: add dev_print_hex_dump() logging function.
From: Greg Kroah-Hartman @ 2019-04-02 6:33 UTC (permalink / raw)
To: Life is hard, and then you die
Cc: Dmitry Torokhov, Henrik Rydberg, Andy Shevchenko,
Sergey Senozhatsky, Steven Rostedt, Rafael J. Wysocki,
Lukas Wunner, Federico Lorenzi, linux-input, linux-kernel
In-Reply-To: <20190402024714.GA14213@innovation.ch>
On Mon, Apr 01, 2019 at 07:47:14PM -0700, Life is hard, and then you die wrote:
>
> On Thu, Mar 28, 2019 at 12:29:52PM +0100, Greg Kroah-Hartman wrote:
> > On Thu, Mar 28, 2019 at 03:27:55AM -0700, Life is hard, and then you die wrote:
> > >
> > > On Thu, Mar 28, 2019 at 06:29:17AM +0100, Greg Kroah-Hartman wrote:
> > > > On Wed, Mar 27, 2019 at 05:28:17PM -0700, Life is hard, and then you die wrote:
> > > > >
> > > > > On Wed, Mar 27, 2019 at 11:37:57AM +0900, Greg Kroah-Hartman wrote:
> > > > > > On Tue, Mar 26, 2019 at 06:48:06PM -0700, Ronald Tschalär wrote:
> > > > > > > This is the dev_xxx() analog to print_hex_dump(), using dev_printk()
> > > > > > > instead of straight printk() to match other dev_xxx() logging functions.
> > > > > > > ---
> > > > > > > drivers/base/core.c | 43 ++++++++++++++++++++++++++++++++++++++++++
> > > > > > > include/linux/device.h | 15 +++++++++++++++
> > > > > > > 2 files changed, 58 insertions(+)
> [snip]
> > > > > > Anyway, no, please do not do this. Please do not dump large hex values
> > > > > > like this to the kernel log, it does not help anyone.
> > > > > >
> > > > > > You can do this while debugging, sure, but not for "real" kernel code.
> > > > >
> > > > > As used by this driver, it is definitely called for debugging only and
> > > > > must be explicitly enabled via a module param. But having the ability
> > > > > for folks to easily generate and print out debugging info has proven
> > > > > quite valuable.
> > > >
> > > > We have dynamic debugging, no need for module parameters at all. This
> > > > isn't the 1990's anymore :)
> > >
> > > I am aware of dynamic debugging, but there are several issues with it
> > > from the perspective of the logging I'm doing here (I mentioned these
> > > in response to an earlier review already):
> > >
> > > 1. Dynamic debugging can't be enabled at a function or line level on
> > > the kernel command line, so this means that to debug issues
> > > during boot you have to enable everything, which can be way too
> > > verbose
> >
> > You can, and should enable it at a function or line level by writing to
> > the proper kernel file in debugfs.
> >
> > You have read Documentation/admin-guide/dynamic-debug-howto.rst, right?
>
> Yes, and I've played with the parameters quite a bit.
>
> > No need to do anything on the command line, that's so old-school :)
>
> Sorry if I'm being unduly dense, but then how to enable debugging
> during early boot? The only other alternative I see is modifying the
> initrd, and asking folks to do that is noticeably more complicated
> than having them add something to the command line in grub. So from my
> perspective I find kernel params far from old-school :-)
You can do dynamic debugging from the kernel command line, if your code
is built into the kernel (but why would a tiny driver under testing like
this, not be built into the kernel?) what specifically did not work for you?
> > > 2. The expressions to enable the individual logging statements are
> > > quite brittle (in particular the line-based ones) since they
> > > (may) change any time the code is changed - having stable
> > > commands to give to users and put in documentation (e.g.
> > > "echo 0x200 > /sys/module/applespi/parameters/debug") is
> > > quite valuable.
> > >
> > > One way to work around this would be to put every single logging
> > > statement in a function of its own, thereby ensuring a stable
> > > name is associated with each one.
> >
> > Again, read the documentation, this works today as-is.
>
> I have read it (we're talking about the dynamic debug docs here), but
> I just don't see how it addresses this in any way.
You can enable/disable logging per-function, which is what you want,
right?
Anyway, I'm glad tracepoints work for you, that should be all that is
now needed.
good luck with your driver!
greg k-h
^ permalink raw reply
* Re: [RESEND PATCH v6 01/11] dt-bindings: mfd: add DT bindings for max77650
From: Lee Jones @ 2019-04-02 7:25 UTC (permalink / raw)
To: Bartosz Golaszewski
Cc: Rob Herring, Mark Rutland, Linus Walleij, Dmitry Torokhov,
Jacek Anaszewski, Pavel Machek, Sebastian Reichel, Liam Girdwood,
Greg Kroah-Hartman, linux-kernel, linux-gpio, devicetree,
linux-input, linux-leds, linux-pm, Bartosz Golaszewski,
Rob Herring
In-Reply-To: <20190318174228.18194-2-brgl@bgdev.pl>
On Mon, 18 Mar 2019, Bartosz Golaszewski wrote:
> From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
>
> Add a DT binding document for max77650 ultra-low power PMIC. This
> describes the core mfd device and the GPIO module.
>
> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
> Reviewed-by: Rob Herring <robh@kernel.org>
> ---
> .../devicetree/bindings/mfd/max77650.txt | 46 +++++++++++++++++++
> 1 file changed, 46 insertions(+)
> create mode 100644 Documentation/devicetree/bindings/mfd/max77650.txt
For my own reference:
Acked-for-MFD-by: Lee Jones <lee.jones@linaro.org>
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply
* Re: [RESEND PATCH v6 05/11] mfd: core: document mfd_add_devices()
From: Lee Jones @ 2019-04-02 7:41 UTC (permalink / raw)
To: Bartosz Golaszewski
Cc: Rob Herring, Mark Rutland, Linus Walleij, Dmitry Torokhov,
Jacek Anaszewski, Pavel Machek, Sebastian Reichel, Liam Girdwood,
Greg Kroah-Hartman, linux-kernel, linux-gpio, devicetree,
linux-input, linux-leds, linux-pm, Bartosz Golaszewski
In-Reply-To: <20190318174228.18194-6-brgl@bgdev.pl>
On Mon, 18 Mar 2019, Bartosz Golaszewski wrote:
> From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
>
> Add a kernel doc for mfd_add_devices().
>
> Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
> ---
> drivers/mfd/mfd-core.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
> index 94e3f32ce935..0898a8db1747 100644
> --- a/drivers/mfd/mfd-core.c
> +++ b/drivers/mfd/mfd-core.c
> @@ -269,6 +269,20 @@ static int mfd_add_device(struct device *parent, int id,
> return ret;
> }
>
> +/**
> + * mfd_add_devices - register a set of child devices
"register child devices"
> + *
> + * @parent: Parent device for all sub-nodes.
> + * @id: Platform device id. If >= 0, each sub-device will have its cell_id
> + * added to this number and use it as the platform device id.
> + * @cells: Array of mfd cells describing sub-devices.
> + * @n_devs: Number of sub-devices to register.
> + * @mem_base: Parent register range resource for sub-devices.
> + * @irq_base: Base of the range of virtual interrupt numbers allocated for
> + * this MFD device. Unused if @domain is specified.
> + * @domain: Interrupt domain used to create mappings for HW interrupt numbers
> + * specificed in sub-devices' IRQ resources.
Spelling.
> + */
> int mfd_add_devices(struct device *parent, int id,
> const struct mfd_cell *cells, int n_devs,
> struct resource *mem_base,
How about this:
/**
* mfd_add_devices - register child devices
*
* @parent: Pointer to parent device.
* @id: Can be PLATFORM_DEVID_AUTO to let the Platform API take care
* of device numbering, or will be added to a device's cell_id.
* @cells: Array of (struct mfd_cell)s describing child devices.
* @n_devs: Number of child devices to register.
* @mem_base: Parent register range resource for child devices.
* @irq_base: Base of the range of virtual interrupt numbers allocated for
* this MFD device. Unused if @domain is specified.
* @domain: Interrupt domain to create mappings for hardware interrupts.
*/
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply
* Re: [RESEND PATCH v6 05/11] mfd: core: document mfd_add_devices()
From: Bartosz Golaszewski @ 2019-04-02 8:08 UTC (permalink / raw)
To: Lee Jones
Cc: Rob Herring, Mark Rutland, Linus Walleij, Dmitry Torokhov,
Jacek Anaszewski, Pavel Machek, Sebastian Reichel, Liam Girdwood,
Greg Kroah-Hartman, Linux Kernel Mailing List,
open list:GPIO SUBSYSTEM, devicetree, Linux Input,
Linux LED Subsystem, Linux PM list, Bartosz Golaszewski
In-Reply-To: <20190402074103.GG4187@dell>
wt., 2 kwi 2019 o 09:41 Lee Jones <lee.jones@linaro.org> napisał(a):
>
> On Mon, 18 Mar 2019, Bartosz Golaszewski wrote:
>
> > From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
> >
> > Add a kernel doc for mfd_add_devices().
> >
> > Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
> > ---
> > drivers/mfd/mfd-core.c | 14 ++++++++++++++
> > 1 file changed, 14 insertions(+)
> >
> > diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
> > index 94e3f32ce935..0898a8db1747 100644
> > --- a/drivers/mfd/mfd-core.c
> > +++ b/drivers/mfd/mfd-core.c
> > @@ -269,6 +269,20 @@ static int mfd_add_device(struct device *parent, int id,
> > return ret;
> > }
> >
> > +/**
> > + * mfd_add_devices - register a set of child devices
>
> "register child devices"
>
> > + *
> > + * @parent: Parent device for all sub-nodes.
> > + * @id: Platform device id. If >= 0, each sub-device will have its cell_id
> > + * added to this number and use it as the platform device id.
> > + * @cells: Array of mfd cells describing sub-devices.
> > + * @n_devs: Number of sub-devices to register.
> > + * @mem_base: Parent register range resource for sub-devices.
> > + * @irq_base: Base of the range of virtual interrupt numbers allocated for
> > + * this MFD device. Unused if @domain is specified.
> > + * @domain: Interrupt domain used to create mappings for HW interrupt numbers
> > + * specificed in sub-devices' IRQ resources.
>
> Spelling.
>
> > + */
> > int mfd_add_devices(struct device *parent, int id,
> > const struct mfd_cell *cells, int n_devs,
> > struct resource *mem_base,
>
> How about this:
>
> /**
> * mfd_add_devices - register child devices
> *
> * @parent: Pointer to parent device.
> * @id: Can be PLATFORM_DEVID_AUTO to let the Platform API take care
> * of device numbering, or will be added to a device's cell_id.
> * @cells: Array of (struct mfd_cell)s describing child devices.
> * @n_devs: Number of child devices to register.
> * @mem_base: Parent register range resource for child devices.
> * @irq_base: Base of the range of virtual interrupt numbers allocated for
> * this MFD device. Unused if @domain is specified.
> * @domain: Interrupt domain to create mappings for hardware interrupts.
> */
>
Sure, looks good to me.
FYI the latest version of this series is v7, but the mfd driver didn't
change since v6.
Bart
^ permalink raw reply
* Re: [PATCH v7 0/4] input: touchscreen: Add goodix GT5553 CTP support
From: Jagan Teki @ 2019-04-02 13:30 UTC (permalink / raw)
To: Dmitry Torokhov, Bastien Nocera, Rob Herring
Cc: Henrik Rydberg, linux-input, linux-kernel, devicetree,
Mark Rutland, linux-amarula, Michael Trimarchi
In-Reply-To: <20190321082104.2874-1-jagan@amarulasolutions.com>
On Thu, Mar 21, 2019 at 1:51 PM Jagan Teki <jagan@amarulasolutions.com> wrote:
>
> This is v7 patchset for supporting goodix GT5553 CTP. Here is the
> previous version[1]
>
> Changes for v5:
> - rebase on linux-next
> Changes for v5:
> - document bindings for required regulators, which are need during
> power-on sequence
> - enable, disable required regulators as described in power-on sequence
> using normal regulator calls
> - update the proper commi messages
> Changes for v4:
> - document AVDD22, DVDD12, VDDIO as optional properties
> - use regulator bulk calls, for get, enable and disable functionalities
> Changes for v4:
> - devm_add_action_or_reset for disabling regulator
> Changes for v3:
> - add cover-letter
> - s/ADVV28/AVDD28 on commit head
> - fix few typo
> Changes for v2:
> - Rename vcc-supply with AVDD28-supply
> - disable regulator in remove
> - fix to setup regulator in probe code
> - add chipdata
> - drop example node in dt-bindings
>
> [1] https://patchwork.kernel.org/cover/10819645/
>
> Jagan Teki (4):
> dt-bindings: input: touchscreen: goodix: Document regulator properties
> Input: goodix - Add regulators suppot
> dt-bindings: input: touchscreen: goodix: Add GT5663 compatible
> Input: goodix - Add GT5663 CTP support
Ping?
^ permalink raw reply
* Re: [PATCH] HID: force setting drvdata to NULL when removing the driver
From: Benjamin Tissoires @ 2019-04-02 13:44 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Jiri Kosina, Bruno Prémont, Jonathan Cameron,
Srinivas Pandruvada, Hans de Goede, Jason Gerecke, Ping Cheng,
linux-input@vger.kernel.org, lkml
In-Reply-To: <CAKdAkRRwKS+wzXjh=gyOQtSEiMwWhArZVc_cwecJsEZ=MGRa8w@mail.gmail.com>
Hi Dmitry,
On Fri, Mar 29, 2019 at 11:26 PM Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
>
> Hi Benjamin,
>
> On Thu, Mar 28, 2019 at 8:52 AM Benjamin Tissoires
> <benjamin.tissoires@redhat.com> wrote:
> >
> > Or when the probe failed.
> >
> > This is a common pattern in the HID drivers to reset the drvdata. Some
> > do it properly, some do it only in case of failure.
> > Anyway, it's never a good thing to have breadcrumbs, so force a clean
> > state when removing or when probe is failing.
>
> Just a data point: driver core already clears drvdata, so as long as
> dev_get/set_drvdata() is the same as hid_get/set_drvdata() no special
> handling is needed in HID core.
You are correct (as always ;-P). I'll drop the hid-core changes and
send a v2 ASAP.
Cheers,
Benjamin
>
> Thanks.
>
> --
> Dmitry
>
> On Thu, Mar 28, 2019 at 8:52 AM Benjamin Tissoires
> <benjamin.tissoires@redhat.com> wrote:
> >
> > Or when the probe failed.
> >
> > This is a common pattern in the HID drivers to reset the drvdata. Some
> > do it properly, some do it only in case of failure.
> > Anyway, it's never a good thing to have breadcrumbs, so force a clean
> > state when removing or when probe is failing.
> >
> > Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> > ---
> > drivers/hid/hid-core.c | 2 ++
> > drivers/hid/hid-cougar.c | 6 ++----
> > drivers/hid/hid-gfrm.c | 7 -------
> > drivers/hid/hid-lenovo.c | 2 --
> > drivers/hid/hid-logitech-dj.c | 2 --
> > drivers/hid/hid-logitech-hidpp.c | 8 +++-----
> > drivers/hid/hid-picolcd_core.c | 7 +------
> > drivers/hid/hid-sensor-hub.c | 1 -
> > drivers/hid/wacom_sys.c | 18 +++++-------------
> > 9 files changed, 13 insertions(+), 40 deletions(-)
> >
> > diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> > index b5a8af8daa74..011e49da4d63 100644
> > --- a/drivers/hid/hid-core.c
> > +++ b/drivers/hid/hid-core.c
> > @@ -2203,6 +2203,7 @@ static int hid_device_probe(struct device *dev)
> > if (ret) {
> > hid_close_report(hdev);
> > hdev->driver = NULL;
> > + hid_set_drvdata(hdev, NULL);
> > }
> > }
> > unlock:
> > @@ -2231,6 +2232,7 @@ static int hid_device_remove(struct device *dev)
> > else /* default remove */
> > hid_hw_stop(hdev);
> > hid_close_report(hdev);
> > + hid_set_drvdata(hdev, NULL);
> > hdev->driver = NULL;
> > }
> >
> > diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
> > index e0bb7b34f3a4..4ff3bc1d25e2 100644
> > --- a/drivers/hid/hid-cougar.c
> > +++ b/drivers/hid/hid-cougar.c
> > @@ -207,7 +207,7 @@ static int cougar_probe(struct hid_device *hdev,
> > error = hid_parse(hdev);
> > if (error) {
> > hid_err(hdev, "parse failed\n");
> > - goto fail;
> > + return error;
> > }
> >
> > if (hdev->collection->usage == COUGAR_VENDOR_USAGE) {
> > @@ -219,7 +219,7 @@ static int cougar_probe(struct hid_device *hdev,
> > error = hid_hw_start(hdev, connect_mask);
> > if (error) {
> > hid_err(hdev, "hw start failed\n");
> > - goto fail;
> > + return error;
> > }
> >
> > error = cougar_bind_shared_data(hdev, cougar);
> > @@ -249,8 +249,6 @@ static int cougar_probe(struct hid_device *hdev,
> >
> > fail_stop_and_cleanup:
> > hid_hw_stop(hdev);
> > -fail:
> > - hid_set_drvdata(hdev, NULL);
> > return error;
> > }
> >
> > diff --git a/drivers/hid/hid-gfrm.c b/drivers/hid/hid-gfrm.c
> > index cf477f8c8f4c..1a20997e7750 100644
> > --- a/drivers/hid/hid-gfrm.c
> > +++ b/drivers/hid/hid-gfrm.c
> > @@ -127,12 +127,6 @@ static int gfrm_probe(struct hid_device *hdev, const struct hid_device_id *id)
> > return ret;
> > }
> >
> > -static void gfrm_remove(struct hid_device *hdev)
> > -{
> > - hid_hw_stop(hdev);
> > - hid_set_drvdata(hdev, NULL);
> > -}
> > -
> > static const struct hid_device_id gfrm_devices[] = {
> > { HID_BLUETOOTH_DEVICE(0x58, 0x2000),
> > .driver_data = GFRM100 },
> > @@ -146,7 +140,6 @@ static struct hid_driver gfrm_driver = {
> > .name = "gfrm",
> > .id_table = gfrm_devices,
> > .probe = gfrm_probe,
> > - .remove = gfrm_remove,
> > .input_mapping = gfrm_input_mapping,
> > .raw_event = gfrm_raw_event,
> > .input_configured = gfrm_input_configured,
> > diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
> > index eacc76d2ab96..cde9d22bb3ec 100644
> > --- a/drivers/hid/hid-lenovo.c
> > +++ b/drivers/hid/hid-lenovo.c
> > @@ -869,8 +869,6 @@ static void lenovo_remove_tpkbd(struct hid_device *hdev)
> >
> > led_classdev_unregister(&data_pointer->led_micmute);
> > led_classdev_unregister(&data_pointer->led_mute);
> > -
> > - hid_set_drvdata(hdev, NULL);
> > }
> >
> > static void lenovo_remove_cptkbd(struct hid_device *hdev)
> > diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
> > index 826fa1e1c8d9..a75101293755 100644
> > --- a/drivers/hid/hid-logitech-dj.c
> > +++ b/drivers/hid/hid-logitech-dj.c
> > @@ -1094,7 +1094,6 @@ static int logi_dj_probe(struct hid_device *hdev,
> > hid_parse_fail:
> > kfifo_free(&djrcv_dev->notif_fifo);
> > kfree(djrcv_dev);
> > - hid_set_drvdata(hdev, NULL);
> > return retval;
> >
> > }
> > @@ -1145,7 +1144,6 @@ static void logi_dj_remove(struct hid_device *hdev)
> >
> > kfifo_free(&djrcv_dev->notif_fifo);
> > kfree(djrcv_dev);
> > - hid_set_drvdata(hdev, NULL);
> > }
> >
> > static const struct hid_device_id logi_dj_receivers[] = {
> > diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> > index 199cc256e9d9..b950a44157a2 100644
> > --- a/drivers/hid/hid-logitech-hidpp.c
> > +++ b/drivers/hid/hid-logitech-hidpp.c
> > @@ -3237,15 +3237,15 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> > if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
> > ret = wtp_allocate(hdev, id);
> > if (ret)
> > - goto allocate_fail;
> > + return ret;
> > } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
> > ret = m560_allocate(hdev);
> > if (ret)
> > - goto allocate_fail;
> > + return ret;
> > } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
> > ret = k400_allocate(hdev);
> > if (ret)
> > - goto allocate_fail;
> > + return ret;
> > }
> >
> > INIT_WORK(&hidpp->work, delayed_work_cb);
> > @@ -3343,8 +3343,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> > sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
> > cancel_work_sync(&hidpp->work);
> > mutex_destroy(&hidpp->send_mutex);
> > -allocate_fail:
> > - hid_set_drvdata(hdev, NULL);
> > return ret;
> > }
> >
> > diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
> > index c1b29a9eb41a..a5d30f267a7b 100644
> > --- a/drivers/hid/hid-picolcd_core.c
> > +++ b/drivers/hid/hid-picolcd_core.c
> > @@ -550,8 +550,7 @@ static int picolcd_probe(struct hid_device *hdev,
> > data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
> > if (data == NULL) {
> > hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
> > - error = -ENOMEM;
> > - goto err_no_cleanup;
> > + return -ENOMEM;
> > }
> >
> > spin_lock_init(&data->lock);
> > @@ -613,9 +612,6 @@ static int picolcd_probe(struct hid_device *hdev,
> > hid_hw_stop(hdev);
> > err_cleanup_data:
> > kfree(data);
> > -err_no_cleanup:
> > - hid_set_drvdata(hdev, NULL);
> > -
> > return error;
> > }
> >
> > @@ -651,7 +647,6 @@ static void picolcd_remove(struct hid_device *hdev)
> > picolcd_exit_cir(data);
> > picolcd_exit_keys(data);
> >
> > - hid_set_drvdata(hdev, NULL);
> > mutex_destroy(&data->mutex);
> > /* Finally, clean up the picolcd data itself */
> > kfree(data);
> > diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
> > index 4256fdc5cd6d..a3db5d8b382d 100644
> > --- a/drivers/hid/hid-sensor-hub.c
> > +++ b/drivers/hid/hid-sensor-hub.c
> > @@ -755,7 +755,6 @@ static void sensor_hub_remove(struct hid_device *hdev)
> > }
> > spin_unlock_irqrestore(&data->lock, flags);
> > mfd_remove_devices(&hdev->dev);
> > - hid_set_drvdata(hdev, NULL);
> > mutex_destroy(&data->mutex);
> > }
> >
> > diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> > index a8633b1437b2..c2fb614bff44 100644
> > --- a/drivers/hid/wacom_sys.c
> > +++ b/drivers/hid/wacom_sys.c
> > @@ -2716,14 +2716,12 @@ static int wacom_probe(struct hid_device *hdev,
> > wacom_wac->features = *((struct wacom_features *)id->driver_data);
> > features = &wacom_wac->features;
> >
> > - if (features->check_for_hid_type && features->hid_type != hdev->type) {
> > - error = -ENODEV;
> > - goto fail;
> > - }
> > + if (features->check_for_hid_type && features->hid_type != hdev->type)
> > + return -ENODEV;
> >
> > error = kfifo_alloc(&wacom_wac->pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
> > if (error)
> > - goto fail;
> > + return error;
> >
> > wacom_wac->hid_data.inputmode = -1;
> > wacom_wac->mode_report = -1;
> > @@ -2741,12 +2739,12 @@ static int wacom_probe(struct hid_device *hdev,
> > error = hid_parse(hdev);
> > if (error) {
> > hid_err(hdev, "parse failed\n");
> > - goto fail;
> > + return error;
> > }
> >
> > error = wacom_parse_and_register(wacom, false);
> > if (error)
> > - goto fail;
> > + return error;
> >
> > if (hdev->bus == BUS_BLUETOOTH) {
> > error = device_create_file(&hdev->dev, &dev_attr_speed);
> > @@ -2757,10 +2755,6 @@ static int wacom_probe(struct hid_device *hdev,
> > }
> >
> > return 0;
> > -
> > -fail:
> > - hid_set_drvdata(hdev, NULL);
> > - return error;
> > }
> >
> > static void wacom_remove(struct hid_device *hdev)
> > @@ -2789,8 +2783,6 @@ static void wacom_remove(struct hid_device *hdev)
> > wacom_release_resources(wacom);
> >
> > kfifo_free(&wacom_wac->pen_fifo);
> > -
> > - hid_set_drvdata(hdev, NULL);
> > }
> >
> > #ifdef CONFIG_PM
> > --
> > 2.19.2
> >
>
>
> --
> Dmitry
^ permalink raw reply
* Re: [PATCH] HID: force setting drvdata to NULL when removing the driver
From: Hans de Goede @ 2019-04-02 13:52 UTC (permalink / raw)
To: Benjamin Tissoires, Dmitry Torokhov
Cc: Jiri Kosina, Bruno Prémont, Jonathan Cameron,
Srinivas Pandruvada, Jason Gerecke, Ping Cheng,
linux-input@vger.kernel.org, lkml
In-Reply-To: <CAO-hwJK2yusO2f+oFnUcNGuxo6e_+7F6Cjqmcsuimy4zrm-Jww@mail.gmail.com>
Hi,
On 02-04-19 15:44, Benjamin Tissoires wrote:
> Hi Dmitry,
>
> On Fri, Mar 29, 2019 at 11:26 PM Dmitry Torokhov
> <dmitry.torokhov@gmail.com> wrote:
>>
>> Hi Benjamin,
>>
>> On Thu, Mar 28, 2019 at 8:52 AM Benjamin Tissoires
>> <benjamin.tissoires@redhat.com> wrote:
>>>
>>> Or when the probe failed.
>>>
>>> This is a common pattern in the HID drivers to reset the drvdata. Some
>>> do it properly, some do it only in case of failure.
>>> Anyway, it's never a good thing to have breadcrumbs, so force a clean
>>> state when removing or when probe is failing.
>>
>> Just a data point: driver core already clears drvdata, so as long as
>> dev_get/set_drvdata() is the same as hid_get/set_drvdata() no special
>> handling is needed in HID core.
>
> You are correct (as always ;-P). I'll drop the hid-core changes and
> send a v2 ASAP.
I was just looking at the same thing. I should have known about this
since I wrote the patch to make the core clear drvdata. I should have
mentioned that, but I was assuming that the hid code was special somehow,
however now I see it just uses a regular device_add, so indeed the core
changes are not necessary.
Given the large hid-logitech-*.c patch-set it might be easier for
Jiri if you split out the hid-logitech-*.c changes into a separate
patch, then he can keep that on his logitech branch (just a thought).
Regards,
Hans
>
> Cheers,
> Benjamin
>
>>
>> Thanks.
>>
>> --
>> Dmitry
>>
>> On Thu, Mar 28, 2019 at 8:52 AM Benjamin Tissoires
>> <benjamin.tissoires@redhat.com> wrote:
>>>
>>> Or when the probe failed.
>>>
>>> This is a common pattern in the HID drivers to reset the drvdata. Some
>>> do it properly, some do it only in case of failure.
>>> Anyway, it's never a good thing to have breadcrumbs, so force a clean
>>> state when removing or when probe is failing.
>>>
>>> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
>>> ---
>>> drivers/hid/hid-core.c | 2 ++
>>> drivers/hid/hid-cougar.c | 6 ++----
>>> drivers/hid/hid-gfrm.c | 7 -------
>>> drivers/hid/hid-lenovo.c | 2 --
>>> drivers/hid/hid-logitech-dj.c | 2 --
>>> drivers/hid/hid-logitech-hidpp.c | 8 +++-----
>>> drivers/hid/hid-picolcd_core.c | 7 +------
>>> drivers/hid/hid-sensor-hub.c | 1 -
>>> drivers/hid/wacom_sys.c | 18 +++++-------------
>>> 9 files changed, 13 insertions(+), 40 deletions(-)
>>>
>>> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
>>> index b5a8af8daa74..011e49da4d63 100644
>>> --- a/drivers/hid/hid-core.c
>>> +++ b/drivers/hid/hid-core.c
>>> @@ -2203,6 +2203,7 @@ static int hid_device_probe(struct device *dev)
>>> if (ret) {
>>> hid_close_report(hdev);
>>> hdev->driver = NULL;
>>> + hid_set_drvdata(hdev, NULL);
>>> }
>>> }
>>> unlock:
>>> @@ -2231,6 +2232,7 @@ static int hid_device_remove(struct device *dev)
>>> else /* default remove */
>>> hid_hw_stop(hdev);
>>> hid_close_report(hdev);
>>> + hid_set_drvdata(hdev, NULL);
>>> hdev->driver = NULL;
>>> }
>>>
>>> diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
>>> index e0bb7b34f3a4..4ff3bc1d25e2 100644
>>> --- a/drivers/hid/hid-cougar.c
>>> +++ b/drivers/hid/hid-cougar.c
>>> @@ -207,7 +207,7 @@ static int cougar_probe(struct hid_device *hdev,
>>> error = hid_parse(hdev);
>>> if (error) {
>>> hid_err(hdev, "parse failed\n");
>>> - goto fail;
>>> + return error;
>>> }
>>>
>>> if (hdev->collection->usage == COUGAR_VENDOR_USAGE) {
>>> @@ -219,7 +219,7 @@ static int cougar_probe(struct hid_device *hdev,
>>> error = hid_hw_start(hdev, connect_mask);
>>> if (error) {
>>> hid_err(hdev, "hw start failed\n");
>>> - goto fail;
>>> + return error;
>>> }
>>>
>>> error = cougar_bind_shared_data(hdev, cougar);
>>> @@ -249,8 +249,6 @@ static int cougar_probe(struct hid_device *hdev,
>>>
>>> fail_stop_and_cleanup:
>>> hid_hw_stop(hdev);
>>> -fail:
>>> - hid_set_drvdata(hdev, NULL);
>>> return error;
>>> }
>>>
>>> diff --git a/drivers/hid/hid-gfrm.c b/drivers/hid/hid-gfrm.c
>>> index cf477f8c8f4c..1a20997e7750 100644
>>> --- a/drivers/hid/hid-gfrm.c
>>> +++ b/drivers/hid/hid-gfrm.c
>>> @@ -127,12 +127,6 @@ static int gfrm_probe(struct hid_device *hdev, const struct hid_device_id *id)
>>> return ret;
>>> }
>>>
>>> -static void gfrm_remove(struct hid_device *hdev)
>>> -{
>>> - hid_hw_stop(hdev);
>>> - hid_set_drvdata(hdev, NULL);
>>> -}
>>> -
>>> static const struct hid_device_id gfrm_devices[] = {
>>> { HID_BLUETOOTH_DEVICE(0x58, 0x2000),
>>> .driver_data = GFRM100 },
>>> @@ -146,7 +140,6 @@ static struct hid_driver gfrm_driver = {
>>> .name = "gfrm",
>>> .id_table = gfrm_devices,
>>> .probe = gfrm_probe,
>>> - .remove = gfrm_remove,
>>> .input_mapping = gfrm_input_mapping,
>>> .raw_event = gfrm_raw_event,
>>> .input_configured = gfrm_input_configured,
>>> diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
>>> index eacc76d2ab96..cde9d22bb3ec 100644
>>> --- a/drivers/hid/hid-lenovo.c
>>> +++ b/drivers/hid/hid-lenovo.c
>>> @@ -869,8 +869,6 @@ static void lenovo_remove_tpkbd(struct hid_device *hdev)
>>>
>>> led_classdev_unregister(&data_pointer->led_micmute);
>>> led_classdev_unregister(&data_pointer->led_mute);
>>> -
>>> - hid_set_drvdata(hdev, NULL);
>>> }
>>>
>>> static void lenovo_remove_cptkbd(struct hid_device *hdev)
>>> diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
>>> index 826fa1e1c8d9..a75101293755 100644
>>> --- a/drivers/hid/hid-logitech-dj.c
>>> +++ b/drivers/hid/hid-logitech-dj.c
>>> @@ -1094,7 +1094,6 @@ static int logi_dj_probe(struct hid_device *hdev,
>>> hid_parse_fail:
>>> kfifo_free(&djrcv_dev->notif_fifo);
>>> kfree(djrcv_dev);
>>> - hid_set_drvdata(hdev, NULL);
>>> return retval;
>>>
>>> }
>>> @@ -1145,7 +1144,6 @@ static void logi_dj_remove(struct hid_device *hdev)
>>>
>>> kfifo_free(&djrcv_dev->notif_fifo);
>>> kfree(djrcv_dev);
>>> - hid_set_drvdata(hdev, NULL);
>>> }
>>>
>>> static const struct hid_device_id logi_dj_receivers[] = {
>>> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
>>> index 199cc256e9d9..b950a44157a2 100644
>>> --- a/drivers/hid/hid-logitech-hidpp.c
>>> +++ b/drivers/hid/hid-logitech-hidpp.c
>>> @@ -3237,15 +3237,15 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
>>> if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
>>> ret = wtp_allocate(hdev, id);
>>> if (ret)
>>> - goto allocate_fail;
>>> + return ret;
>>> } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
>>> ret = m560_allocate(hdev);
>>> if (ret)
>>> - goto allocate_fail;
>>> + return ret;
>>> } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
>>> ret = k400_allocate(hdev);
>>> if (ret)
>>> - goto allocate_fail;
>>> + return ret;
>>> }
>>>
>>> INIT_WORK(&hidpp->work, delayed_work_cb);
>>> @@ -3343,8 +3343,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
>>> sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
>>> cancel_work_sync(&hidpp->work);
>>> mutex_destroy(&hidpp->send_mutex);
>>> -allocate_fail:
>>> - hid_set_drvdata(hdev, NULL);
>>> return ret;
>>> }
>>>
>>> diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
>>> index c1b29a9eb41a..a5d30f267a7b 100644
>>> --- a/drivers/hid/hid-picolcd_core.c
>>> +++ b/drivers/hid/hid-picolcd_core.c
>>> @@ -550,8 +550,7 @@ static int picolcd_probe(struct hid_device *hdev,
>>> data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
>>> if (data == NULL) {
>>> hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
>>> - error = -ENOMEM;
>>> - goto err_no_cleanup;
>>> + return -ENOMEM;
>>> }
>>>
>>> spin_lock_init(&data->lock);
>>> @@ -613,9 +612,6 @@ static int picolcd_probe(struct hid_device *hdev,
>>> hid_hw_stop(hdev);
>>> err_cleanup_data:
>>> kfree(data);
>>> -err_no_cleanup:
>>> - hid_set_drvdata(hdev, NULL);
>>> -
>>> return error;
>>> }
>>>
>>> @@ -651,7 +647,6 @@ static void picolcd_remove(struct hid_device *hdev)
>>> picolcd_exit_cir(data);
>>> picolcd_exit_keys(data);
>>>
>>> - hid_set_drvdata(hdev, NULL);
>>> mutex_destroy(&data->mutex);
>>> /* Finally, clean up the picolcd data itself */
>>> kfree(data);
>>> diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
>>> index 4256fdc5cd6d..a3db5d8b382d 100644
>>> --- a/drivers/hid/hid-sensor-hub.c
>>> +++ b/drivers/hid/hid-sensor-hub.c
>>> @@ -755,7 +755,6 @@ static void sensor_hub_remove(struct hid_device *hdev)
>>> }
>>> spin_unlock_irqrestore(&data->lock, flags);
>>> mfd_remove_devices(&hdev->dev);
>>> - hid_set_drvdata(hdev, NULL);
>>> mutex_destroy(&data->mutex);
>>> }
>>>
>>> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
>>> index a8633b1437b2..c2fb614bff44 100644
>>> --- a/drivers/hid/wacom_sys.c
>>> +++ b/drivers/hid/wacom_sys.c
>>> @@ -2716,14 +2716,12 @@ static int wacom_probe(struct hid_device *hdev,
>>> wacom_wac->features = *((struct wacom_features *)id->driver_data);
>>> features = &wacom_wac->features;
>>>
>>> - if (features->check_for_hid_type && features->hid_type != hdev->type) {
>>> - error = -ENODEV;
>>> - goto fail;
>>> - }
>>> + if (features->check_for_hid_type && features->hid_type != hdev->type)
>>> + return -ENODEV;
>>>
>>> error = kfifo_alloc(&wacom_wac->pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
>>> if (error)
>>> - goto fail;
>>> + return error;
>>>
>>> wacom_wac->hid_data.inputmode = -1;
>>> wacom_wac->mode_report = -1;
>>> @@ -2741,12 +2739,12 @@ static int wacom_probe(struct hid_device *hdev,
>>> error = hid_parse(hdev);
>>> if (error) {
>>> hid_err(hdev, "parse failed\n");
>>> - goto fail;
>>> + return error;
>>> }
>>>
>>> error = wacom_parse_and_register(wacom, false);
>>> if (error)
>>> - goto fail;
>>> + return error;
>>>
>>> if (hdev->bus == BUS_BLUETOOTH) {
>>> error = device_create_file(&hdev->dev, &dev_attr_speed);
>>> @@ -2757,10 +2755,6 @@ static int wacom_probe(struct hid_device *hdev,
>>> }
>>>
>>> return 0;
>>> -
>>> -fail:
>>> - hid_set_drvdata(hdev, NULL);
>>> - return error;
>>> }
>>>
>>> static void wacom_remove(struct hid_device *hdev)
>>> @@ -2789,8 +2783,6 @@ static void wacom_remove(struct hid_device *hdev)
>>> wacom_release_resources(wacom);
>>>
>>> kfifo_free(&wacom_wac->pen_fifo);
>>> -
>>> - hid_set_drvdata(hdev, NULL);
>>> }
>>>
>>> #ifdef CONFIG_PM
>>> --
>>> 2.19.2
>>>
>>
>>
>> --
>> Dmitry
^ permalink raw reply
* Re: [PATCH] HID: force setting drvdata to NULL when removing the driver
From: Benjamin Tissoires @ 2019-04-02 14:00 UTC (permalink / raw)
To: Hans de Goede
Cc: Dmitry Torokhov, Jiri Kosina, Bruno Prémont,
Jonathan Cameron, Srinivas Pandruvada, Jason Gerecke, Ping Cheng,
linux-input@vger.kernel.org, lkml
In-Reply-To: <a31a6f95-924a-4930-e4df-5576abc694fb@redhat.com>
On Tue, Apr 2, 2019 at 3:52 PM Hans de Goede <hdegoede@redhat.com> wrote:
>
> Hi,
>
> On 02-04-19 15:44, Benjamin Tissoires wrote:
> > Hi Dmitry,
> >
> > On Fri, Mar 29, 2019 at 11:26 PM Dmitry Torokhov
> > <dmitry.torokhov@gmail.com> wrote:
> >>
> >> Hi Benjamin,
> >>
> >> On Thu, Mar 28, 2019 at 8:52 AM Benjamin Tissoires
> >> <benjamin.tissoires@redhat.com> wrote:
> >>>
> >>> Or when the probe failed.
> >>>
> >>> This is a common pattern in the HID drivers to reset the drvdata. Some
> >>> do it properly, some do it only in case of failure.
> >>> Anyway, it's never a good thing to have breadcrumbs, so force a clean
> >>> state when removing or when probe is failing.
> >>
> >> Just a data point: driver core already clears drvdata, so as long as
> >> dev_get/set_drvdata() is the same as hid_get/set_drvdata() no special
> >> handling is needed in HID core.
> >
> > You are correct (as always ;-P). I'll drop the hid-core changes and
> > send a v2 ASAP.
>
> I was just looking at the same thing. I should have known about this
> since I wrote the patch to make the core clear drvdata. I should have
> mentioned that, but I was assuming that the hid code was special somehow,
> however now I see it just uses a regular device_add, so indeed the core
> changes are not necessary.
>
> Given the large hid-logitech-*.c patch-set it might be easier for
> Jiri if you split out the hid-logitech-*.c changes into a separate
> patch, then he can keep that on his logitech branch (just a thought).
>
I do not expect the logitech changes to now create some big conflict.
But looking at the current for-5.2* branches, I should probably split
the series per driver given that there is no more dependency on
hid-core. This way, we can take the logitech changes in the
for-5.2/logitech branch, and you can rebase your work on top of it.
Cheers,
Benjamin
> Regards,
>
> Hans
>
>
> >
> > Cheers,
> > Benjamin
> >
> >>
> >> Thanks.
> >>
> >> --
> >> Dmitry
> >>
> >> On Thu, Mar 28, 2019 at 8:52 AM Benjamin Tissoires
> >> <benjamin.tissoires@redhat.com> wrote:
> >>>
> >>> Or when the probe failed.
> >>>
> >>> This is a common pattern in the HID drivers to reset the drvdata. Some
> >>> do it properly, some do it only in case of failure.
> >>> Anyway, it's never a good thing to have breadcrumbs, so force a clean
> >>> state when removing or when probe is failing.
> >>>
> >>> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> >>> ---
> >>> drivers/hid/hid-core.c | 2 ++
> >>> drivers/hid/hid-cougar.c | 6 ++----
> >>> drivers/hid/hid-gfrm.c | 7 -------
> >>> drivers/hid/hid-lenovo.c | 2 --
> >>> drivers/hid/hid-logitech-dj.c | 2 --
> >>> drivers/hid/hid-logitech-hidpp.c | 8 +++-----
> >>> drivers/hid/hid-picolcd_core.c | 7 +------
> >>> drivers/hid/hid-sensor-hub.c | 1 -
> >>> drivers/hid/wacom_sys.c | 18 +++++-------------
> >>> 9 files changed, 13 insertions(+), 40 deletions(-)
> >>>
> >>> diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
> >>> index b5a8af8daa74..011e49da4d63 100644
> >>> --- a/drivers/hid/hid-core.c
> >>> +++ b/drivers/hid/hid-core.c
> >>> @@ -2203,6 +2203,7 @@ static int hid_device_probe(struct device *dev)
> >>> if (ret) {
> >>> hid_close_report(hdev);
> >>> hdev->driver = NULL;
> >>> + hid_set_drvdata(hdev, NULL);
> >>> }
> >>> }
> >>> unlock:
> >>> @@ -2231,6 +2232,7 @@ static int hid_device_remove(struct device *dev)
> >>> else /* default remove */
> >>> hid_hw_stop(hdev);
> >>> hid_close_report(hdev);
> >>> + hid_set_drvdata(hdev, NULL);
> >>> hdev->driver = NULL;
> >>> }
> >>>
> >>> diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
> >>> index e0bb7b34f3a4..4ff3bc1d25e2 100644
> >>> --- a/drivers/hid/hid-cougar.c
> >>> +++ b/drivers/hid/hid-cougar.c
> >>> @@ -207,7 +207,7 @@ static int cougar_probe(struct hid_device *hdev,
> >>> error = hid_parse(hdev);
> >>> if (error) {
> >>> hid_err(hdev, "parse failed\n");
> >>> - goto fail;
> >>> + return error;
> >>> }
> >>>
> >>> if (hdev->collection->usage == COUGAR_VENDOR_USAGE) {
> >>> @@ -219,7 +219,7 @@ static int cougar_probe(struct hid_device *hdev,
> >>> error = hid_hw_start(hdev, connect_mask);
> >>> if (error) {
> >>> hid_err(hdev, "hw start failed\n");
> >>> - goto fail;
> >>> + return error;
> >>> }
> >>>
> >>> error = cougar_bind_shared_data(hdev, cougar);
> >>> @@ -249,8 +249,6 @@ static int cougar_probe(struct hid_device *hdev,
> >>>
> >>> fail_stop_and_cleanup:
> >>> hid_hw_stop(hdev);
> >>> -fail:
> >>> - hid_set_drvdata(hdev, NULL);
> >>> return error;
> >>> }
> >>>
> >>> diff --git a/drivers/hid/hid-gfrm.c b/drivers/hid/hid-gfrm.c
> >>> index cf477f8c8f4c..1a20997e7750 100644
> >>> --- a/drivers/hid/hid-gfrm.c
> >>> +++ b/drivers/hid/hid-gfrm.c
> >>> @@ -127,12 +127,6 @@ static int gfrm_probe(struct hid_device *hdev, const struct hid_device_id *id)
> >>> return ret;
> >>> }
> >>>
> >>> -static void gfrm_remove(struct hid_device *hdev)
> >>> -{
> >>> - hid_hw_stop(hdev);
> >>> - hid_set_drvdata(hdev, NULL);
> >>> -}
> >>> -
> >>> static const struct hid_device_id gfrm_devices[] = {
> >>> { HID_BLUETOOTH_DEVICE(0x58, 0x2000),
> >>> .driver_data = GFRM100 },
> >>> @@ -146,7 +140,6 @@ static struct hid_driver gfrm_driver = {
> >>> .name = "gfrm",
> >>> .id_table = gfrm_devices,
> >>> .probe = gfrm_probe,
> >>> - .remove = gfrm_remove,
> >>> .input_mapping = gfrm_input_mapping,
> >>> .raw_event = gfrm_raw_event,
> >>> .input_configured = gfrm_input_configured,
> >>> diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
> >>> index eacc76d2ab96..cde9d22bb3ec 100644
> >>> --- a/drivers/hid/hid-lenovo.c
> >>> +++ b/drivers/hid/hid-lenovo.c
> >>> @@ -869,8 +869,6 @@ static void lenovo_remove_tpkbd(struct hid_device *hdev)
> >>>
> >>> led_classdev_unregister(&data_pointer->led_micmute);
> >>> led_classdev_unregister(&data_pointer->led_mute);
> >>> -
> >>> - hid_set_drvdata(hdev, NULL);
> >>> }
> >>>
> >>> static void lenovo_remove_cptkbd(struct hid_device *hdev)
> >>> diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
> >>> index 826fa1e1c8d9..a75101293755 100644
> >>> --- a/drivers/hid/hid-logitech-dj.c
> >>> +++ b/drivers/hid/hid-logitech-dj.c
> >>> @@ -1094,7 +1094,6 @@ static int logi_dj_probe(struct hid_device *hdev,
> >>> hid_parse_fail:
> >>> kfifo_free(&djrcv_dev->notif_fifo);
> >>> kfree(djrcv_dev);
> >>> - hid_set_drvdata(hdev, NULL);
> >>> return retval;
> >>>
> >>> }
> >>> @@ -1145,7 +1144,6 @@ static void logi_dj_remove(struct hid_device *hdev)
> >>>
> >>> kfifo_free(&djrcv_dev->notif_fifo);
> >>> kfree(djrcv_dev);
> >>> - hid_set_drvdata(hdev, NULL);
> >>> }
> >>>
> >>> static const struct hid_device_id logi_dj_receivers[] = {
> >>> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> >>> index 199cc256e9d9..b950a44157a2 100644
> >>> --- a/drivers/hid/hid-logitech-hidpp.c
> >>> +++ b/drivers/hid/hid-logitech-hidpp.c
> >>> @@ -3237,15 +3237,15 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> >>> if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
> >>> ret = wtp_allocate(hdev, id);
> >>> if (ret)
> >>> - goto allocate_fail;
> >>> + return ret;
> >>> } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_M560) {
> >>> ret = m560_allocate(hdev);
> >>> if (ret)
> >>> - goto allocate_fail;
> >>> + return ret;
> >>> } else if (hidpp->quirks & HIDPP_QUIRK_CLASS_K400) {
> >>> ret = k400_allocate(hdev);
> >>> if (ret)
> >>> - goto allocate_fail;
> >>> + return ret;
> >>> }
> >>>
> >>> INIT_WORK(&hidpp->work, delayed_work_cb);
> >>> @@ -3343,8 +3343,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> >>> sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
> >>> cancel_work_sync(&hidpp->work);
> >>> mutex_destroy(&hidpp->send_mutex);
> >>> -allocate_fail:
> >>> - hid_set_drvdata(hdev, NULL);
> >>> return ret;
> >>> }
> >>>
> >>> diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
> >>> index c1b29a9eb41a..a5d30f267a7b 100644
> >>> --- a/drivers/hid/hid-picolcd_core.c
> >>> +++ b/drivers/hid/hid-picolcd_core.c
> >>> @@ -550,8 +550,7 @@ static int picolcd_probe(struct hid_device *hdev,
> >>> data = kzalloc(sizeof(struct picolcd_data), GFP_KERNEL);
> >>> if (data == NULL) {
> >>> hid_err(hdev, "can't allocate space for Minibox PicoLCD device data\n");
> >>> - error = -ENOMEM;
> >>> - goto err_no_cleanup;
> >>> + return -ENOMEM;
> >>> }
> >>>
> >>> spin_lock_init(&data->lock);
> >>> @@ -613,9 +612,6 @@ static int picolcd_probe(struct hid_device *hdev,
> >>> hid_hw_stop(hdev);
> >>> err_cleanup_data:
> >>> kfree(data);
> >>> -err_no_cleanup:
> >>> - hid_set_drvdata(hdev, NULL);
> >>> -
> >>> return error;
> >>> }
> >>>
> >>> @@ -651,7 +647,6 @@ static void picolcd_remove(struct hid_device *hdev)
> >>> picolcd_exit_cir(data);
> >>> picolcd_exit_keys(data);
> >>>
> >>> - hid_set_drvdata(hdev, NULL);
> >>> mutex_destroy(&data->mutex);
> >>> /* Finally, clean up the picolcd data itself */
> >>> kfree(data);
> >>> diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
> >>> index 4256fdc5cd6d..a3db5d8b382d 100644
> >>> --- a/drivers/hid/hid-sensor-hub.c
> >>> +++ b/drivers/hid/hid-sensor-hub.c
> >>> @@ -755,7 +755,6 @@ static void sensor_hub_remove(struct hid_device *hdev)
> >>> }
> >>> spin_unlock_irqrestore(&data->lock, flags);
> >>> mfd_remove_devices(&hdev->dev);
> >>> - hid_set_drvdata(hdev, NULL);
> >>> mutex_destroy(&data->mutex);
> >>> }
> >>>
> >>> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> >>> index a8633b1437b2..c2fb614bff44 100644
> >>> --- a/drivers/hid/wacom_sys.c
> >>> +++ b/drivers/hid/wacom_sys.c
> >>> @@ -2716,14 +2716,12 @@ static int wacom_probe(struct hid_device *hdev,
> >>> wacom_wac->features = *((struct wacom_features *)id->driver_data);
> >>> features = &wacom_wac->features;
> >>>
> >>> - if (features->check_for_hid_type && features->hid_type != hdev->type) {
> >>> - error = -ENODEV;
> >>> - goto fail;
> >>> - }
> >>> + if (features->check_for_hid_type && features->hid_type != hdev->type)
> >>> + return -ENODEV;
> >>>
> >>> error = kfifo_alloc(&wacom_wac->pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
> >>> if (error)
> >>> - goto fail;
> >>> + return error;
> >>>
> >>> wacom_wac->hid_data.inputmode = -1;
> >>> wacom_wac->mode_report = -1;
> >>> @@ -2741,12 +2739,12 @@ static int wacom_probe(struct hid_device *hdev,
> >>> error = hid_parse(hdev);
> >>> if (error) {
> >>> hid_err(hdev, "parse failed\n");
> >>> - goto fail;
> >>> + return error;
> >>> }
> >>>
> >>> error = wacom_parse_and_register(wacom, false);
> >>> if (error)
> >>> - goto fail;
> >>> + return error;
> >>>
> >>> if (hdev->bus == BUS_BLUETOOTH) {
> >>> error = device_create_file(&hdev->dev, &dev_attr_speed);
> >>> @@ -2757,10 +2755,6 @@ static int wacom_probe(struct hid_device *hdev,
> >>> }
> >>>
> >>> return 0;
> >>> -
> >>> -fail:
> >>> - hid_set_drvdata(hdev, NULL);
> >>> - return error;
> >>> }
> >>>
> >>> static void wacom_remove(struct hid_device *hdev)
> >>> @@ -2789,8 +2783,6 @@ static void wacom_remove(struct hid_device *hdev)
> >>> wacom_release_resources(wacom);
> >>>
> >>> kfifo_free(&wacom_wac->pen_fifo);
> >>> -
> >>> - hid_set_drvdata(hdev, NULL);
> >>> }
> >>>
> >>> #ifdef CONFIG_PM
> >>> --
> >>> 2.19.2
> >>>
> >>
> >>
> >> --
> >> Dmitry
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox