[PATCH] Fixes kernel crash generating from bam_dma_irq()

[PATCH] Fixes kernel crash generating from bam_dma_irq()

[Parth Y Shah]

While performing suspend/resume, we were getting below kernel crash.

[   54.541672] [FTS][Info]gesture suspend...
[   54.605256] [FTS][Error][GESTURE]Enter into gesture(suspend) failed!
[   54.605256]
[   58.345850] irq event 10: bogus return value fffffff3
......

[   58.345966] [<ffff0000080830f0>] el1_irq+0xb0/0x124
[   58.345971] [<ffff000008085360>] arch_cpu_idle+0x10/0x18
[   58.345975] [<ffff0000081077f4>] do_idle+0x1ac/0x1e0
[   58.345979] [<ffff0000081079c8>] cpu_startup_entry+0x20/0x28
[   58.345983] [<ffff000008a80ed0>] rest_init+0xd0/0xdc
[   58.345988] [<ffff0000091c0b48>] start_kernel+0x390/0x3a4
[   58.345990] handlers:
[   58.345994] [<ffff0000085120d0>] bam_dma_irq

The reason for the crash we found is, bam_dma_irq() was returning
negative value when the device resumes in some conditions.

In addition, the irq handler should have one of the below return values.

IRQ_NONE            interrupt was not from this device or was not handled
IRQ_HANDLED         interrupt was handled by this device
IRQ_WAKE_THREAD     handler requests to wake the handler thread

Therefore, to resolve this crash, we have changed the return value to
IRQ_NONE.

Signed-off-by: Parth Y Shah <sparth1292@gmail.com>
---
 drivers/dma/qcom/bam_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
index 4eeb8bb..d5773d4 100644
--- a/drivers/dma/qcom/bam_dma.c
+++ b/drivers/dma/qcom/bam_dma.c
@@ -875,7 +875,7 @@ static irqreturn_t bam_dma_irq(int irq, void *data)
 
 	ret = bam_pm_runtime_get_sync(bdev->dev);
 	if (ret < 0)
-		return ret;
+		return IRQ_NONE;
 
 	if (srcs & BAM_IRQ) {
 		clr_mask = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_STTS));
-- 
2.7.4

Re: [PATCH] Fixes kernel crash generating from bam_dma_irq()

[Vinod Koul]

Hi Parth,

On 06-12-20, 15:51, Parth Y Shah wrote:
> While performing suspend/resume, we were getting below kernel crash.
> 
> [   54.541672] [FTS][Info]gesture suspend...
> [   54.605256] [FTS][Error][GESTURE]Enter into gesture(suspend) failed!
> [   54.605256]
> [   58.345850] irq event 10: bogus return value fffffff3
> ......
> 
> [   58.345966] [<ffff0000080830f0>] el1_irq+0xb0/0x124
> [   58.345971] [<ffff000008085360>] arch_cpu_idle+0x10/0x18
> [   58.345975] [<ffff0000081077f4>] do_idle+0x1ac/0x1e0
> [   58.345979] [<ffff0000081079c8>] cpu_startup_entry+0x20/0x28
> [   58.345983] [<ffff000008a80ed0>] rest_init+0xd0/0xdc
> [   58.345988] [<ffff0000091c0b48>] start_kernel+0x390/0x3a4
> [   58.345990] handlers:
> [   58.345994] [<ffff0000085120d0>] bam_dma_irq
> 
> The reason for the crash we found is, bam_dma_irq() was returning
> negative value when the device resumes in some conditions.
> 
> In addition, the irq handler should have one of the below return values.
> 
> IRQ_NONE            interrupt was not from this device or was not handled
> IRQ_HANDLED         interrupt was handled by this device
> IRQ_WAKE_THREAD     handler requests to wake the handler thread
> 
> Therefore, to resolve this crash, we have changed the return value to
> IRQ_NONE.

The change and explanation look good to me, unfortunately the patch
title is incorrect. It describes the fix it does and not the change in
this patch. Also do add subsystem and driver tags to the patch! git log
would tell you this information

Consider: "dmaengine: bam_dma: fix return of bam_dma_irq()" as a
suggestion.

> 
> Signed-off-by: Parth Y Shah <sparth1292@gmail.com>
> ---
>  drivers/dma/qcom/bam_dma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
> index 4eeb8bb..d5773d4 100644
> --- a/drivers/dma/qcom/bam_dma.c
> +++ b/drivers/dma/qcom/bam_dma.c
> @@ -875,7 +875,7 @@ static irqreturn_t bam_dma_irq(int irq, void *data)
>  
>  	ret = bam_pm_runtime_get_sync(bdev->dev);

Also this looks wrong to me. get_sync() can sleep and we cant invoke
that in an irq. Srini have you seen this issue

>  	if (ret < 0)
> -		return ret;
> +		return IRQ_NONE;
>  
>  	if (srcs & BAM_IRQ) {
>  		clr_mask = readl_relaxed(bam_addr(bdev, 0, BAM_IRQ_STTS));
> -- 
> 2.7.4

-- 
~Vinod