Re: [PATCH] net: qrtr: mhi: synchronize qrtr and mhi preparation

Johan Hovold
2025-03-18T08:03:52Z

Hi Chris,

On Thu, Nov 21, 2024 at 04:28:41PM -0800, Chris Lew wrote:
> On 11/8/2024 2:32 AM, Johan Hovold wrote:
> > On Mon, Nov 04, 2024 at 05:29:37PM -0800, Chris Lew wrote:
> >> From: Bhaumik Bhatt <bbhatt@codeaurora.org>
> >>
> >> The call to qrtr_endpoint_register() was moved before
> >> mhi_prepare_for_transfer_autoqueue() to prevent a case where a dl
> >> callback can occur before the qrtr endpoint is registered.
> >>
> >> Now the reverse can happen where qrtr will try to send a packet
> >> before the channels are prepared. Add a wait in the sending path to
> >> ensure the channels are prepared before trying to do a ul transfer.
> >>
> >> Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation")
> >> Reported-by: Johan Hovold <johan@kernel.org>
> >> Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com/
> >> Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
> >> Signed-off-by: Chris Lew <quic_clew@quicinc.com>
> >
> >> @@ -53,6 +54,10 @@ static int qcom_mhi_qrtr_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
> >> if (skb->sk)
> >> sock_hold(skb->sk);
> >>
> >> + rc = wait_for_completion_interruptible(&qdev->prepared);
> >> + if (rc)
> >> + goto free_skb;
> >> +
> >> rc = skb_linearize(skb);
> >> if (rc)
> >> goto free_skb;
> >> @@ -85,6 +90,7 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
> >> qdev->mhi_dev = mhi_dev;
> >> qdev->dev = &mhi_dev->dev;
> >> qdev->ep.xmit = qcom_mhi_qrtr_send;
> >> + init_completion(&qdev->prepared);
> >>
> >> dev_set_drvdata(&mhi_dev->dev, qdev);
> >> rc = qrtr_endpoint_register(&qdev->ep, QRTR_EP_NID_AUTO);
> >> @@ -97,6 +103,7 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
> >> qrtr_endpoint_unregister(&qdev->ep);
> >> return rc;
> >> }
> >> + complete_all(&qdev->prepared);
> >>
> >> dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n");
> >
> > While this probably works, it still looks like a bit of a hack.
> >
> > Why can't you restructure the code so that the channels are fully
> > initialised before you register or enable them instead?
>
> Ok, I think we will have to stop using the autoqueue feature of MHI and
> change the flow to be mhi_prepare_for_transfer() -->
> qrtr_endpoint_register() --> mhi_queue_buf(DMA_FROM_DEVICE). This would
> make it so ul_transfers only happen after mhi_prepare_for_transfer() and
> dl_transfers happen after qrtr_endpoint_register().
>
> I'll take a stab at implementing this.

This bug still exists in mainline and occasionally triggers a
NULL-pointer dereference on boot with the in-kernel pd-mapper on X Elite
laptops like the T14s.

Have you made any progress in reworking the code to address the race?

Johan