UPSTREAM: misc: fastrpc: Drop unhandled DSP PD exit notification - #962
UPSTREAM: misc: fastrpc: Drop unhandled DSP PD exit notification#962Jianping (Jianping-Li) wants to merge 1 commit into
Conversation
PR #962 — validate-patchPR: #962
Final Summary
|
PR #962 — checker-log-analyzerPR: #962
Detailed report: Full report
|
Newer DSP firmware implements a PD (Protection Domain) notification framework that sends PD state notifications upon request. The PD exit notification is unconditionally sent by the DSP with a fixed sentinel 0xABCDABCD in the context field. fastrpc_rpmsg_callback() treats every inbound message as an invoke response, so the sentinel is masked and shifted like any real response ((0xABCDABCD & 0xFF0) >> 4 == 188) and looked up in the channel's context idr. This is not merely cosmetic. In the common case idr slot 188 is empty, the lookup fails, and the driver only logs a spurious "No context ID matches response" error on every teardown. But the context idr is shared by every protection domain and the listener thread on the channel and is filled cyclically over [1, FASTRPC_CTX_MAX]. If slot 188 holds a live context when the sentinel arrives, the sentinel's return value is written into that unrelated in-flight invocation and it is completed early. Since neither the fastrpc library nor the driver supports the DSP PD notification framework, it is safe to drop the PD exit notification before it is ever turned into a context lookup. This removes both the log spam and the mis-completion race. A genuine response can never be masked: a real context is (idr_index << 4) | pd (at most 0xFF3) and can never equal the sentinel. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com> Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20260729094352.111065-11-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com>
16e28be to
69e097d
Compare
Test Matrix
|
PR #962 — validate-patchPR: #962
Final Summary
|
PR #962 — checker-log-analyzerPR: #962
Detailed report: Full report
|
LAVA Failed Case Triage SummaryPR: #962 Job 207586 | SoC lemans-evkLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207586 Failed test cases in LAVA job 207586 (SoC: lemans-evk).
Job 207587 | SoC qcs9100-rideLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207587 Failed test cases in LAVA job 207587 (SoC: qcs9100-ride).
Job 207588 | SoC qcs615-rideLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207588 Failed test cases in LAVA job 207588 (SoC: qcs615-ride).
Job 207589 | SoC hamoa-evkLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207589 Failed test cases in LAVA job 207589 (SoC: hamoa-evk).
Job 207590 | SoC purwa-evkLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207590 Failed test cases in LAVA job 207590 (SoC: purwa-evk).
Job 207591 | SoC shikra-iqs-evkLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207591 Failed test cases in LAVA job 207591 (SoC: shikra-iqs-evk).
Job 207592 | SoC qcs6490-rb3gen2LAVA job: https://lava-oss.qualcomm.com/scheduler/job/207592 Failed test cases in LAVA job 207592 (SoC: qcs6490-rb3gen2).
Job 207593 | SoC qcs8300-rideLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207593 Failed test cases in LAVA job 207593 (SoC: qcs8300-ride).
Job 207594 | SoC monaco-evkLAVA job: https://lava-oss.qualcomm.com/scheduler/job/207594 Failed test cases in LAVA job 207594 (SoC: monaco-evk).
|
Newer DSP firmware implements a PD (Protection Domain) notification framework that sends PD state notifications upon request. The PD exit notification is unconditionally sent by the DSP with a fixed sentinel 0xABCDABCD in the context field.
fastrpc_rpmsg_callback() treats every inbound message as an invoke response, so the sentinel is masked and shifted like any real response ((0xABCDABCD & 0xFF0) >> 4 == 188) and looked up in the channel's context idr.
This is not merely cosmetic. In the common case idr slot 188 is empty, the lookup fails, and the driver only logs a spurious "No context ID matches response" error on every teardown. But the context idr is shared by every protection domain and the listener thread on the channel and is filled cyclically over [1, FASTRPC_CTX_MAX]. If slot 188 holds a live context when the sentinel arrives, the sentinel's return value is written into that unrelated in-flight invocation and it is completed early.
Since neither the fastrpc library nor the driver supports the DSP PD notification framework, it is safe to drop the PD exit notification before it is ever turned into a context lookup. This removes both the log spam and the mis-completion race. A genuine response can never be masked: a real context is (idr_index << 4) | pd (at most 0xFF3) and can never equal the sentinel.
Link: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/drivers/misc/fastrpc.c?id=5533bb4bc53c6cd401b9b329d7e26802fd5aa1f5
CRs-Fixed: 4633198