linux-stable.git/drivers/thermal, branch linux-6.8.y

thermal/debugfs: Pass cooling device state to thermal_debug_cdev_add()

2024-05-30T07:49:16+00:00

[ Upstream commit 31a0fa0019b022024cc082ae292951a596b06f8c ]

If cdev_dt_seq_show() runs before the first state transition of a cooling
device, it will not print any state residency information for it, even
though it might be reasonably expected to print residency information for
the initial state of the cooling device.

For this reason, rearrange the code to get the initial state of a cooling
device at the registration time and pass it to thermal_debug_cdev_add(),
so that the latter can create a duration record for that state which will
allow cdev_dt_seq_show() to print its residency information.

Fixes: 755113d76786 ("thermal/debugfs: Add thermal cooling device debugfs information")
Reported-by: Lukasz Luba 
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Lukasz Luba 
Tested-by: Lukasz Luba 
Signed-off-by: Sasha Levin

thermal/debugfs: Create records for cdev states as they get used

2024-05-30T07:49:16+00:00

[ Upstream commit f4ae18fcb652c6cccc834ded525ac37f91d5cdb1 ]

Because thermal_debug_cdev_state_update() only creates a duration record
for the old state of a cooling device, if its new state is used for the
first time, there will be no record for it and cdev_dt_seq_show() will
not print the duration information for it even though it contains code
to compute the duration value in that case.

Address this by making thermal_debug_cdev_state_update() create a
duration record for the new state if there is none.

Fixes: 755113d76786 ("thermal/debugfs: Add thermal cooling device debugfs information")
Reported-by: Lukasz Luba 
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Lukasz Luba 
Tested-by: Lukasz Luba 
Signed-off-by: Sasha Levin

thermal/debugfs: Avoid excessive updates of trip point statistics

2024-05-30T07:49:15+00:00

[ Upstream commit 0a293c77580581c4b058eb40287acadac6ffd14a ]

Since thermal_debug_update_temp() is called before invoking
thermal_debug_tz_trip_down() for the trips that were crossed by the
zone temperature on the way up, it updates the statistics for them
as though the current zone temperature was above the low temperature
of each of them.  However, if a given trip has just been crossed on the
way down, the zone temperature is in fact below its low temperature,
but this is handled by thermal_debug_tz_trip_down() running after the
update of the trip statistics.

The remedy is to call thermal_debug_update_temp() after
thermal_debug_tz_trip_down() has been invoked for all of the
trips in question, but then thermal_debug_tz_trip_up() needs to
be adjusted, so it does not update the statistics for the trips
that has just been crossed on the way up, as that will be taken
care of by thermal_debug_update_temp() down the road.

Modify the code accordingly.

Fixes: 7ef01f228c9f ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Lukasz Luba 
Acked-by: Daniel Lezcano 
Signed-off-by: Sasha Levin

thermal/drivers/tsens: Fix null pointer dereference

2024-05-30T07:49:13+00:00

[ Upstream commit d998ddc86a27c92140b9f7984ff41e3d1d07a48f ]

compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c)
as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null
pointer dereference (if DEBUG or DYNAMIC_DEBUG set).
Fix this bug by adding null pointer check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: dfc1193d4dbd ("thermal/drivers/tsens: Replace custom 8960 apis with generic apis")
Signed-off-by: Aleksandr Mishin 
Reviewed-by: Konrad Dybcio 
Signed-off-by: Daniel Lezcano 
Link: https://lore.kernel.org/r/20240411114021.12203-1-amishin@t-argos.ru
Signed-off-by: Sasha Levin

thermal/drivers/mediatek/lvts_thermal: Add coeff for mt8192

2024-05-30T07:49:13+00:00

[ Upstream commit 7954c92ede882b0dfd52a5db90291a4151b44c1a ]

In order for lvts_raw_to_temp to function properly on mt8192,
temperature coefficients for mt8192 need to be added.

Fixes: 288732242db4 ("thermal/drivers/mediatek/lvts_thermal: Add mt8192 support")
Signed-off-by: Hsin-Te Yuan 
Reviewed-by: AngeloGioacchino Del Regno 
Signed-off-by: Daniel Lezcano 
Link: https://lore.kernel.org/r/20240416-lvts_thermal-v2-1-f8a36882cc53@chromium.org
Signed-off-by: Sasha Levin

thermal/debugfs: Prevent use-after-free from occurring after cdev removal

2024-05-17T10:14:29+00:00

[ Upstream commit d351eb0ab04c3e8109895fc33250cebbce9c11da ]

Since thermal_debug_cdev_remove() does not run under cdev->lock, it can
run in parallel with thermal_debug_cdev_state_update() and it may free
the struct thermal_debugfs object used by the latter after it has been
checked against NULL.

If that happens, thermal_debug_cdev_state_update() will access memory
that has been freed already causing the kernel to crash.

Address this by using cdev->lock in thermal_debug_cdev_remove() around
the cdev->debugfs value check (in case the same cdev is removed at the
same time in two different threads) and its reset to NULL.

Fixes: 755113d76786 ("thermal/debugfs: Add thermal cooling device debugfs information")
Cc :6.8+  # 6.8+
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Lukasz Luba 
Signed-off-by: Sasha Levin

thermal/debugfs: Fix two locking issues with thermal zone debug

2024-05-17T10:14:29+00:00

[ Upstream commit c7f7c37271787a7f77d7eedc132b0b419a76b4c8 ]

With the current thermal zone locking arrangement in the debugfs code,
user space can open the "mitigations" file for a thermal zone before
the zone's debugfs pointer is set which will result in a NULL pointer
dereference in tze_seq_start().

Moreover, thermal_debug_tz_remove() is not called under the thermal
zone lock, so it can run in parallel with the other functions accessing
the thermal zone's struct thermal_debugfs object.  Then, it may clear
tz->debugfs after one of those functions has checked it and the
struct thermal_debugfs object may be freed prematurely.

To address the first problem, pass a pointer to the thermal zone's
struct thermal_debugfs object to debugfs_create_file() in
thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(),
tze_seq_stop(), and tze_seq_show() retrieve it from s->private
instead of a pointer to the thermal zone object.  This will ensure
that tz_debugfs will be valid across the "mitigations" file accesses
until thermal_debugfs_remove_id() called by thermal_debug_tz_remove()
removes that file.

To address the second problem, use tz->lock in thermal_debug_tz_remove()
around the tz->debugfs value check (in case the same thermal zone is
removed at the same time in two different threads) and its reset to NULL.

Fixes: 7ef01f228c9f ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
Cc :6.8+  # 6.8+
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Lukasz Luba 
Signed-off-by: Sasha Levin

thermal/debugfs: Free all thermal zone debug memory on zone removal

2024-05-17T10:14:29+00:00

[ Upstream commit 72c1afffa4c645fe0e0f1c03e5f34395ed65b5f4 ]

Because thermal_debug_tz_remove() does not free all memory allocated for
thermal zone diagnostics, some of that memory becomes unreachable after
freeing the thermal zone's struct thermal_debugfs object.

Address this by making thermal_debug_tz_remove() free all of the memory
in question.

Fixes: 7ef01f228c9f ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
Cc :6.8+  # 6.8+
Signed-off-by: Rafael J. Wysocki 
Reviewed-by: Lukasz Luba 
Signed-off-by: Sasha Levin

thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()

2024-04-27T15:12:55+00:00

[ Upstream commit b552f63cd43735048bbe9bfbb7a9dcfce166fbdd ]

The count field in struct trip_stats, representing the number of times
the zone temperature was above the trip point, needs to be incremented
in thermal_debug_tz_trip_up(), for two reasons.

First, if a trip point is crossed on the way up for the first time,
thermal_debug_update_temp() called from update_temperature() does
not see it because it has not been added to trips_crossed[] array
in the thermal zone's struct tz_debugfs object yet.  Therefore, when
thermal_debug_tz_trip_up() is called after that, the trip point's
count value is 0, and the attempt to divide by it during the average
temperature computation leads to a divide error which causes the kernel
to crash.  Setting the count to 1 before the division by incrementing it
fixes this problem.

Second, if a trip point is crossed on the way up, but it has been
crossed on the way up already before, its count value needs to be
incremented to make a record of the fact that the zone temperature is
above the trip now.  Without doing that, if the mitigations applied
after crossing the trip cause the zone temperature to drop below its
threshold, the count will not be updated for this episode at all and
the average temperature in the trip statistics record will be somewhat
higher than it should be.

Fixes: 7ef01f228c9f ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
Cc :6.8+  # 6.8+
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Sasha Levin

thermal/of: Assume polling-delay(-passive) 0 when absent

2024-04-13T11:10:10+00:00

[ Upstream commit 488164006a281986d95abbc4b26e340c19c4c85b ]

Currently, thermal zones associated with providers that have interrupts
for signaling hot/critical trips are required to set a polling-delay
of 0 to indicate no polling. This feels a bit backwards.

Change the code such that "no polling delay" also means "no polling".

Suggested-by: Bjorn Andersson 
Signed-off-by: Konrad Dybcio 
Reviewed-by: Dmitry Baryshkov 
Reviewed-by: Bjorn Andersson 
Signed-off-by: Daniel Lezcano 
Link: https://lore.kernel.org/r/20240125-topic-thermal-v1-2-3c9d4dced138@linaro.org
Signed-off-by: Sasha Levin