Files
linux/drivers/remoteproc/mtk_scp_ipi.c
Tzung-Bi Shih d935187cfb remoteproc: mediatek: Break lock dependency to prepare_lock
A potential circular locking dependency (ABBA deadlock) exists between
`ec_dev->lock` and the clock framework's `prepare_lock`.

The first order (A -> B) occurs when scp_ipi_send() is called while
`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
2. scp_ipi_send() calls clk_prepare_enable(), which acquires
   `prepare_lock`.
See #0 in the following example calling trace.
(Lock Order: `ec_dev->lock` -> `prepare_lock`)

The reverse order (B -> A) is more complex and has been observed
(learned) by lockdep.  It involves the clock prepare operation
triggering power domain changes, which then propagates through sysfs
and power supply uevents, eventually calling back into the ChromeOS EC
driver and attempting to acquire `ec_dev->lock`:
1. Something calls clk_prepare(), which acquires `prepare_lock`.  It
   then triggers genpd operations like genpd_runtime_resume(), which
   takes `&genpd->mlock`.
2. Power domain changes can trigger regulator changes; regulator
   changes can then trigger device link changes; device link changes
   can then trigger sysfs changes.  Eventually, power_supply_uevent()
   is called.
3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
   cros_ec_cmd_xfer_status(), which then attempts to acquire
   `ec_dev->lock`.
See #1 ~ #6 in the following example calling trace.
(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)

Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
remoteproc prepare()/unprepare() callbacks.  This ensures `prepare_lock`
is only acquired in prepare()/unprepare() callbacks.  Since
`ec_dev->lock` is not involved in the callbacks, the dependency loop is
broken.

This means the clock is always "prepared" when the SCP is running.  The
prolonged "prepared time" for the clock should be acceptable as SCP is
designed to be a very power efficient processor.  The power consumption
impact can be negligible.

A simplified calling trace reported by lockdep:
> -> #6 (&ec_dev->lock)
>        cros_ec_cmd_xfer
>        cros_ec_cmd_xfer_status
>        cros_usbpd_charger_get_port_status
>        cros_usbpd_charger_get_prop
>        power_supply_get_property
>        power_supply_show_property
>        power_supply_uevent
>        dev_uevent
>        uevent_show
>        dev_attr_show
>        sysfs_kf_seq_show
>        kernfs_seq_show
> -> #5 (kn->active#2)
>        kernfs_drain
>        __kernfs_remove
>        kernfs_remove_by_name_ns
>        sysfs_remove_file_ns
>        device_del
>        __device_link_del
>        device_links_driver_bound
> -> #4 (device_links_lock)
>        device_link_remove
>        _regulator_put
>        regulator_put
> -> #3 (regulator_list_mutex)
>        regulator_lock_dependent
>        regulator_disable
>        scpsys_power_off
>        _genpd_power_off
>        genpd_power_off
> -> #2 (&genpd->mlock/1)
>        genpd_add_subdomain
>        pm_genpd_add_subdomain
>        scpsys_add_subdomain
>        scpsys_probe
> -> #1 (&genpd->mlock)
>        genpd_runtime_resume
>        __rpm_callback
>        rpm_callback
>        rpm_resume
>        __pm_runtime_resume
>        clk_core_prepare
>        clk_prepare
> -> #0 (prepare_lock)
>        clk_prepare
>        scp_ipi_send
>        scp_send_ipi
>        mtk_rpmsg_send
>        rpmsg_send
>        cros_ec_pkt_xfer_rpmsg

Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-01-26 08:45:49 -07:00

222 lines
5.3 KiB
C

// SPDX-License-Identifier: GPL-2.0
//
// Copyright (c) 2019 MediaTek Inc.
#include <asm/barrier.h>
#include <linux/clk.h>
#include <linux/err.h>
#include <linux/io.h>
#include <linux/iopoll.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/platform_device.h>
#include <linux/time64.h>
#include <linux/remoteproc/mtk_scp.h>
#include "mtk_common.h"
#define SCP_TIMEOUT_US (2000 * USEC_PER_MSEC)
/**
* scp_ipi_register() - register an ipi function
*
* @scp: mtk_scp structure
* @id: IPI ID
* @handler: IPI handler
* @priv: private data for IPI handler
*
* Register an ipi function to receive ipi interrupt from SCP.
*
* Return: 0 if ipi registers successfully, -error on error.
*/
int scp_ipi_register(struct mtk_scp *scp,
u32 id,
scp_ipi_handler_t handler,
void *priv)
{
if (!scp)
return -EPROBE_DEFER;
if (WARN_ON(id >= SCP_IPI_MAX) || WARN_ON(handler == NULL))
return -EINVAL;
scp_ipi_lock(scp, id);
scp->ipi_desc[id].handler = handler;
scp->ipi_desc[id].priv = priv;
scp_ipi_unlock(scp, id);
return 0;
}
EXPORT_SYMBOL_GPL(scp_ipi_register);
/**
* scp_ipi_unregister() - unregister an ipi function
*
* @scp: mtk_scp structure
* @id: IPI ID
*
* Unregister an ipi function to receive ipi interrupt from SCP.
*/
void scp_ipi_unregister(struct mtk_scp *scp, u32 id)
{
if (!scp)
return;
if (WARN_ON(id >= SCP_IPI_MAX))
return;
scp_ipi_lock(scp, id);
scp->ipi_desc[id].handler = NULL;
scp->ipi_desc[id].priv = NULL;
scp_ipi_unlock(scp, id);
}
EXPORT_SYMBOL_GPL(scp_ipi_unregister);
/*
* scp_memcpy_aligned() - Copy src to dst, where dst is in SCP SRAM region.
*
* @dst: Pointer to the destination buffer, should be in SCP SRAM region.
* @src: Pointer to the source buffer.
* @len: Length of the source buffer to be copied.
*
* Since AP access of SCP SRAM don't support byte write, this always write a
* full word at a time, and may cause some extra bytes to be written at the
* beginning & ending of dst.
*/
void scp_memcpy_aligned(void __iomem *dst, const void *src, unsigned int len)
{
void __iomem *ptr;
u32 val;
unsigned int i = 0, remain;
if (!IS_ALIGNED((unsigned long)dst, 4)) {
ptr = (void __iomem *)ALIGN_DOWN((unsigned long)dst, 4);
i = 4 - (dst - ptr);
val = readl_relaxed(ptr);
memcpy((u8 *)&val + (4 - i), src, i);
writel_relaxed(val, ptr);
}
__iowrite32_copy(dst + i, src + i, (len - i) / 4);
remain = (len - i) % 4;
if (remain > 0) {
val = readl_relaxed(dst + len - remain);
memcpy(&val, src + len - remain, remain);
writel_relaxed(val, dst + len - remain);
}
}
EXPORT_SYMBOL_GPL(scp_memcpy_aligned);
/**
* scp_ipi_lock() - Lock before operations of an IPI ID
*
* @scp: mtk_scp structure
* @id: IPI ID
*
* Note: This should not be used by drivers other than mtk_scp.
*/
void scp_ipi_lock(struct mtk_scp *scp, u32 id)
{
if (WARN_ON(id >= SCP_IPI_MAX))
return;
mutex_lock(&scp->ipi_desc[id].lock);
}
EXPORT_SYMBOL_GPL(scp_ipi_lock);
/**
* scp_ipi_unlock() - Unlock after operations of an IPI ID
*
* @scp: mtk_scp structure
* @id: IPI ID
*
* Note: This should not be used by drivers other than mtk_scp.
*/
void scp_ipi_unlock(struct mtk_scp *scp, u32 id)
{
if (WARN_ON(id >= SCP_IPI_MAX))
return;
mutex_unlock(&scp->ipi_desc[id].lock);
}
EXPORT_SYMBOL_GPL(scp_ipi_unlock);
/**
* scp_ipi_send() - send data from AP to scp.
*
* @scp: mtk_scp structure
* @id: IPI ID
* @buf: the data buffer
* @len: the data buffer length
* @wait: number of msecs to wait for ack. 0 to skip waiting.
*
* This function is thread-safe. When this function returns,
* SCP has received the data and starts the processing.
* When the processing completes, IPI handler registered
* by scp_ipi_register will be called in interrupt context.
*
* Return: 0 if sending data successfully, -error on error.
**/
int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
unsigned int wait)
{
struct mtk_share_obj __iomem *send_obj = scp->send_buf;
u32 val;
int ret;
const struct mtk_scp_sizes_data *scp_sizes;
scp_sizes = scp->data->scp_sizes;
if (WARN_ON(id <= SCP_IPI_INIT) || WARN_ON(id >= SCP_IPI_MAX) ||
WARN_ON(id == SCP_IPI_NS_SERVICE) ||
WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf))
return -EINVAL;
ret = clk_enable(scp->clk);
if (ret) {
dev_err(scp->dev, "failed to enable clock\n");
return ret;
}
mutex_lock(&scp->send_lock);
/* Wait until SCP receives the last command */
ret = readl_poll_timeout_atomic(scp->cluster->reg_base + scp->data->host_to_scp_reg,
val, !val, 0, SCP_TIMEOUT_US);
if (ret) {
dev_err(scp->dev, "%s: IPI timeout!\n", __func__);
goto unlock_mutex;
}
scp_memcpy_aligned(&send_obj->share_buf, buf, len);
writel(len, &send_obj->len);
writel(id, &send_obj->id);
scp->ipi_id_ack[id] = false;
/* send the command to SCP */
writel(scp->data->host_to_scp_int_bit,
scp->cluster->reg_base + scp->data->host_to_scp_reg);
if (wait) {
/* wait for SCP's ACK */
ret = wait_event_timeout(scp->ack_wq,
scp->ipi_id_ack[id],
msecs_to_jiffies(wait));
scp->ipi_id_ack[id] = false;
if (WARN(!ret, "scp ipi %d ack time out !", id))
ret = -EIO;
else
ret = 0;
}
unlock_mutex:
mutex_unlock(&scp->send_lock);
clk_disable(scp->clk);
return ret;
}
EXPORT_SYMBOL_GPL(scp_ipi_send);
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("MediaTek scp IPI interface");