Merge tag 'mhi-for-v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next

Manivannan writes:

MHI Host
--------

- Add SAHARA channel support in the pci_generic dri

Merge tag 'mhi-for-v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next

Manivannan writes:

MHI Host
--------

- Add SAHARA channel support in the pci_generic driver for Foxconn products.
This allows capturing crashdump (ramdump) using the in-kernel sahara client
driver.

- Add support for devices with no M3 state. Some devices do not support the
M3 power state due to hardware issues. For those devices, MHI bus will now
run the full host-side suspend/resume sequence but skip the device-side
M3/M0 handshake, so any transfer queued by clients during suspend is
deferred until resume.

- Set 'mhi_cntrl->no_m3' flag in the pci_generic driver for the QDU100 device
so that the MHI bus also skips the M3 transition during system suspend.
Earlier, the flag was only used to disable runtime PM, but the system
suspend path was still transitioning the device to M3.

- Fix sys error transition latency by polling for the state transition in
mhi_pm_sys_error_transition() instead of waiting up to 24 seconds for an
interrupt from the device. Since a device that has been reset (e.g., via
AT!RESET) is not guaranteed to raise one.

- Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET in
mhi_soc_reset() so that the reset actually reaches the device before the
caller's post-reset delay begins.

- Fix controller cleanup on EDL sysfs failure in mhi_register_controller().
The error path was leaving the device registered when sysfs_create_file()
failed.

MHI Endpoint
------------

- Add mhi_cntrl->flush_async() callback to drain the in-flight async DMA
read/write operations issued through the MHI controller driver. This is
used by the MHI EP stack before disconnect to avoid UAF where a late DMA
completion could invoke a now-invalid xfer_cb().

- Implement the flush_async() callback in the PCI EPF MHI controller driver
by waiting for the in-flight DMA operations to complete and then flushing
the DMA workqueue. Since I'm the maintainer for this PCI EPF driver, I'm
taking this patch through MHI tree due to dependency.

- Flush the in-flight async transfers before notifying disconnect in
mhi_ep_abort_transfer() to fix a UAF, where a success callback delivered
after the -ENOTCONN notification could reference resources already freed
by the client.

- Fix device refcount leak in the error path of mhi_ep_create_device() when
dev_set_name() or device_add() fails.

Common
------

- Clean up kernel-doc warnings in include/linux/mhi.h.

- Add Jeff Hugo as the Reviewer of MHI bus.

* tag 'mhi-for-v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi:
PCI: epf-mhi: Implement mhi_cntrl->flush_async() to flush DMA read/write
bus: mhi: ep: Flush async transfers before notifying disconnect in mhi_ep_abort_transfer()
bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async read/write
bus: mhi: Clean up some kernel-doc warnings
bus: mhi: host: Fix controller cleanup on EDL sysfs failure
bus: mhi: pci_generic: Add SAHARA channel support for Foxconn products
bus: mhi: host: pci_generic: Set 'mhi_cntrl->no_m3' flag
bus: mhi: host: Add support for devices with no M3 state
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
MAINTAINERS: Add Jeff Hugo as the Reviewer of MHI bus
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
bus: mhi: core: Fix sys error transition latency

show more ...

bus: mhi: ep: Flush async transfers before notifying disconnect in mhi_ep_abort_transfer()

mhi_ep_abort_transfer() notifies the client drivers about the channel
disconnect using -ENOTCONN and only t

bus: mhi: ep: Flush async transfers before notifying disconnect in mhi_ep_abort_transfer()

mhi_ep_abort_transfer() notifies the client drivers about the channel
disconnect using -ENOTCONN and only then flushes the ring workqueue to
drain the in-flight transfers. But the async DMA transfers issued by the
ring workers can still complete after the notification. And the completion
handlers trigger the client xfer_cb() as long as it is set.

So a transfer completing during the flush can deliver a success callback to
the client even after it has been notified about the disconnect. This can
lead to UAF (Use-After-Free) issues as the client can free its per-transfer
resources in response to the -ENOTCONN notification and the trailing
success callback would then reference the freed resources.

So to fix this issue, disable all the channels first to prevent new
transfers and then drain both the ring workqueue and the in-flight async
transfers before notifying the disconnect. The completion and queue paths
bail out once the channel state is not MHI_CH_STATE_RUNNING, so disabling
the channels upfront makes sure that no new transfer sneaks in during the
drain and all the pending completions are delivered while xfer_cb() is
still valid.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>

show more ...

bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async read/write

MHI EP stack makes use of the MHI controller drivers like MHI EPF to do
read/write to the host memory. And that driv

bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async read/write

MHI EP stack makes use of the MHI controller drivers like MHI EPF to do
read/write to the host memory. And that driver is free to use mechanisms
like DMA to offload the read/write operations.

So if DMA is used for offload, then there is no guarantee that those DMA
operations would be completed by the time mhi_ep_remove() gets called. This
can lead to UAF (Use-After-Free) issues as the DMA callback can trigger
xfer_cb() even after mhi_ep_remove() has returned.

So to fix this issue, introduce the mhi_cntrl->flush_async() callback and
call it in mhi_ep_remove() to drain all the in-flight async transfers
before disconnecting the channels.

The completion handlers keep triggering xfer_cb() as long as it is set. So
flushing the transfers after notifying the client about the disconnect
(-ENOTCONN) would still let a success callback slip through afterwards and
lead to the same UAF. So disable the channels first to prevent new
transfers, then flush the in-flight transfers so that their completions are
delivered while xfer_cb() is still valid and only then notify the
disconnect and clear xfer_cb().

Fixes: 2547beb00ddb ("bus: mhi: ep: Add support for async DMA read operation")
Fixes: ee08acb58fe4 ("bus: mhi: ep: Add support for async DMA write operation")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable+noautosel@kernel.org # Needs dmaengine driver fix as well
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>

show more ...

bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

mhi_ep_create_device() takes one device reference for the UL channel and
another for the DL channel after allocating t

bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

mhi_ep_create_device() takes one device reference for the UL channel and
another for the DL channel after allocating the transfer device. These
references are normally released by mhi_ep_destroy_device() before the
device itself is removed.

If dev_set_name() or device_add() fails, the error path currently drops
only one reference. The remaining channel references keep the device
from being released and leave the channels associated with a device that
was never registered.

Route both failures through a common unwind path that drops the DL
channel reference, the UL channel reference, and the initial reference
from device_initialize().

Fixes: 297c77a0f273 ("bus: mhi: ep: Add support for creating and destroying MHI EP devices")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260603195142.2189386-1-dbgh9129@gmail.com

show more ...