[ Upstream commit bce3f770684cc1d91ff9edab431b71ac991faf29 ]

When processing a SYSERR, if the device does not respond to the MHI_RESET
from the host, the host will be stuck in a difficult to recover state.
The host will remain in MHI_PM_SYS_ERR_PROCESS and not clean up the host
channels.  Clients will not be notified of the SYSERR via the destruction
of their channel devices, which means clients may think that the device is
still up.  Subsequent SYSERR events such as a device fatal error will not
be processed as the state machine cannot transition from PROCESS back to
DETECT.  The only way to recover from this is to unload the mhi module
(wipe the state machine state) or for the mhi controller to initiate
SHUTDOWN.

This issue was discovered by stress testing soc_reset events on AIC100
via the sysfs node.

soc_reset is processed entirely in hardware.  When the register write
hits the endpoint hardware, it causes the soc to reset without firmware
involvement.  In stress testing, there is a rare race where soc_reset N
will cause the soc to reset and PBL to signal SYSERR (fatal error).  If
soc_reset N+1 is triggered before PBL can process the MHI_RESET from the
host, then the soc will reset again, and re-run PBL from the beginning.
This will cause PBL to lose all state.  PBL will be waiting for the host
to respond to the new syserr, but host will be stuck expecting the
previous MHI_RESET to be processed.

Additionally, the AMSS EE firmware (QSM) was hacked to synthetically
reproduce the issue by simulating a FW hang after the QSM issued a
SYSERR.  In this case, soc_reset would not recover the device.

For this failure case, to recover the device, we need a state similar to
PROCESS, but can transition to DETECT.  There is not a viable existing
state to use.  POR has the needed transitions, but assumes the device is
in a good state and could allow the host to attempt to use the device.
Allowing PROCESS to transition to DETECT invites the possibility of
parallel SYSERR processing which could get the host and device out of
sync.

Thus, invent a new state - MHI_PM_SYS_ERR_FAIL

This essentially a holding state.  It allows us to clean up the host
elements that are based on the old state of the device (channels), but
does not allow us to directly advance back to an operational state.  It
does allow the detection and processing of another SYSERR which may
recover the device, or allows the controller to do a clean shutdown.

Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Reviewed-by: Carl Vanderlip <quic_carlv@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20240112180800.536733-1-quic_jhugo@quicinc.com
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 27711860c54ccb5e80719df684f49f0bf3f8fb51 ]

There is a copy and paste bug here so it checks "ev_ring_el_cache" instead
of "ring_item_cache".

Fixes: 62210a26cd4f ("bus: mhi: ep: Use slab allocator where applicable")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/bebcd822-d465-45da-adae-5435ec93e6d4@moroto.mountain
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

[ Upstream commit 4acd21a45c1446277e2abaece97d7fa7c2e692a9 ]

Update the architecture dependency to be the generic Tegra
because the driver works on the four latest Tegra generations
not just Tegra210, if you build a kernel with a specific
ARCH_TEGRA_xxx_SOC option that excludes Tegra210 you don't get
this driver.

Fixes: 46a88534afb59 ("bus: Add support for Tegra ACONNECT")
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Cc: Jon Hunter <jonathanh@nvidia.com>
Cc: Thierry Reding <treding@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

When the range parsing was open-coded the number of u32 entries to
parse had to be a multiple of 4 and the driver checks this. With
the range parsing converted to the range parser the counting changes
from individual u32 entries to a complete range, so the check must
not reject counts not divisible by 4.

Fixes: 2a88e4792c6d ("bus: imx-weim: Remove open coded "ranges" parsing")
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>

Pull char/misc and other driver updates from Greg KH:
 "Here is the big set of char/misc and other driver subsystem changes
  for 6.8-rc1.

  Other than lots of binder driver changes (as you can see by the merge
  conflicts) included in here are:

   - lots of iio driver updates and additions

   - spmi driver updates

   - eeprom driver updates

   - firmware driver updates

   - ocxl driver updates

   - mhi driver updates

   - w1 driver updates

   - nvmem driver updates

   - coresight driver updates

   - platform driver remove callback api changes

   - tags.sh script updates

   - bus_type constant marking cleanups

   - lots of other small driver updates

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (341 commits)
  android: removed duplicate linux/errno
  uio: Fix use-after-free in uio_open
  drivers: soc: xilinx: add check for platform
  firmware: xilinx: Export function to use in other module
  scripts/tags.sh: remove find_sources
  scripts/tags.sh: use -n to test archinclude
  scripts/tags.sh: add local annotation
  scripts/tags.sh: use more portable -path instead of -wholename
  scripts/tags.sh: Update comment (addition of gtags)
  firmware: zynqmp: Convert to platform remove callback returning void
  firmware: turris-mox-rwtm: Convert to platform remove callback returning void
  firmware: stratix10-svc: Convert to platform remove callback returning void
  firmware: stratix10-rsu: Convert to platform remove callback returning void
  firmware: raspberrypi: Convert to platform remove callback returning void
  firmware: qemu_fw_cfg: Convert to platform remove callback returning void
  firmware: mtk-adsp-ipc: Convert to platform remove callback returning void
  firmware: imx-dsp: Convert to platform remove callback returning void
  firmware: coreboot_table: Convert to platform remove callback returning void
  firmware: arm_scpi: Convert to platform remove callback returning void
  firmware: arm_scmi: Convert to platform remove callback returning void
  ...

Pull SoC driver updates from Arnd Bergmann:
 "A new drivers/cache/ subsystem is added to contain drivers for
  abstracting cache flush methods on riscv and potentially others, as
  this is needed for handling non-coherent DMA but several SoCs require
  nonstandard hardware methods for it.

  op-tee gains support for asynchronous notification with FF-A, as well
  as support for a system thread for executing in secure world.

  The tee, reset, bus, memory and scmi subsystems have a couple of minor
  updates.

  Platform specific soc driver changes include:

   - Samsung Exynos gains driver support for Google GS101 (Tensor G1)
     across multiple subsystems

   - Qualcomm Snapdragon gains support for SM8650 and X1E along with
     added features for some other SoCs

   - Mediatek adds support for "Smart Voltage Scaling" on MT8186 and
     MT8195, and driver support for MT8188 along with some code
     refactoring.

   - Microchip Polarfire FPGA support for "Auto Update" of the FPGA
     bitstream

   - Apple M1 mailbox driver is rewritten into a SoC driver

   - minor updates on amlogic, mvebu, ti, zynq, imx, renesas and
     hisilicon"

* tag 'soc-drivers-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits)
  memory: ti-emif-pm: Convert to platform remove callback returning void
  memory: ti-aemif: Convert to platform remove callback returning void
  memory: tegra210-emc: Convert to platform remove callback returning void
  memory: tegra186-emc: Convert to platform remove callback returning void
  memory: stm32-fmc2-ebi: Convert to platform remove callback returning void
  memory: exynos5422-dmc: Convert to platform remove callback returning void
  memory: renesas-rpc-if: Convert to platform remove callback returning void
  memory: omap-gpmc: Convert to platform remove callback returning void
  memory: mtk-smi: Convert to platform remove callback returning void
  memory: jz4780-nemc: Convert to platform remove callback returning void
  memory: fsl_ifc: Convert to platform remove callback returning void
  memory: fsl-corenet-cf: Convert to platform remove callback returning void
  memory: emif: Convert to platform remove callback returning void
  memory: brcmstb_memc: Convert to platform remove callback returning void
  memory: brcmstb_dpfe: Convert to platform remove callback returning void
  soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset
  firmware: qcom: qseecom: fix memory leaks in error paths
  dt-bindings: clock: google,gs101: rename CMU_TOP gate defines
  soc: qcom: llcc: Fix typo in kernel-doc
  dt-bindings: soc: qcom,aoss-qmp: document the X1E80100 Always-On Subsystem side channel
  ...

Now that the driver core can properly handle constant struct bus_type,
move the moxtet_bus_type to be a constant structure as well, placing it
into read-only memory which can not be modified at runtime.

Cc: Marek Behún <kabel@kernel.org>
Link: https://lore.kernel.org/r/2023121939-written-guru-db83@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mvebu drivers for 6.8 (part 1)

moxtet bus fixes

* tag 'mvebu-drivers-6.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu:
  bus: moxtet: Add spi device table
  bus: moxtet: Mark the irq as shared

Link: https://lore.kernel.org/r/87il4sbym0.fsf@BL-laptop
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

i.MX drivers change for 6.8:

- Change imx-weim bus driver to use device_get_match_data()

* tag 'imx-drivers-6.8' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  bus: imx-weim: Use device_get_match_data()

Link: https://lore.kernel.org/r/20231216064605.876196-1-shawnguo@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Ensure read and write locks for the channel are not taken in succession by
dropping the read lock from parse_xfer_event() such that a callback given
to client can potentially queue buffers and acquire the write lock in that
process. Any queueing of buffers should be done without channel read lock
acquired as it can result in multiple locks and a soft lockup.

Cc: <stable@vger.kernel.org> # 5.7
Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device")
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Tested-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/1702276972-41296-3-git-send-email-quic_qianyu@quicinc.com
[mani: added fixes tag and cc'ed stable]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>