mirror-linux/drivers/bluetooth
Neeraj Sanjay Kale 1f77c05408 Bluetooth: btnxpuart: Fix kernel panic during FW release
This fixes a kernel panic seen during release FW in a stress test
scenario where WLAN and BT FW download occurs simultaneously, and due to
a HW bug, chip sends out only 1 bootloader signatures.

When driver receives the bootloader signature, it enters FW download
mode, but since no consequtive bootloader signatures seen, FW file is
not requested.

After 60 seconds, when FW download times out, release_firmware causes a
kernel panic.

[ 2601.949184] Unable to handle kernel paging request at virtual address 0000312e6f006573
[ 2601.992076] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000111802000
[ 2601.992080] [0000312e6f006573] pgd=0000000000000000, p4d=0000000000000000
[ 2601.992087] Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP
[ 2601.992091] Modules linked in: algif_hash algif_skcipher af_alg btnxpuart(O) pciexxx(O) mlan(O) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce snd_soc_fsl_easrc snd_soc_fsl_asoc_card imx8_media_dev(C) snd_soc_fsl_micfil polyval_generic snd_soc_fsl_xcvr snd_soc_fsl_sai snd_soc_imx_audmux snd_soc_fsl_asrc snd_soc_imx_card snd_soc_imx_hdmi snd_soc_fsl_aud2htx snd_soc_fsl_utils imx_pcm_dma dw_hdmi_cec flexcan can_dev
[ 2602.001825] CPU: 2 PID: 20060 Comm: hciconfig Tainted: G         C O       6.6.23-lts-next-06236-gb586a521770e #1
[ 2602.010182] Hardware name: NXP i.MX8MPlus EVK board (DT)
[ 2602.010185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 2602.010191] pc : _raw_spin_lock+0x34/0x68
[ 2602.010201] lr : free_fw_priv+0x20/0xfc
[ 2602.020561] sp : ffff800089363b30
[ 2602.020563] x29: ffff800089363b30 x28: ffff0000d0eb5880 x27: 0000000000000000
[ 2602.020570] x26: 0000000000000000 x25: ffff0000d728b330 x24: 0000000000000000
[ 2602.020577] x23: ffff0000dc856f38
[ 2602.033797] x22: ffff800089363b70 x21: ffff0000dc856000
[ 2602.033802] x20: ff00312e6f006573 x19: ffff0000d0d9ea80 x18: 0000000000000000
[ 2602.033809] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaad80dd480
[ 2602.083320] x14: 0000000000000000 x13: 00000000000001b9 x12: 0000000000000002
[ 2602.083326] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff800089363a30
[ 2602.083333] x8 : ffff0001793d75c0 x7 : ffff0000d6dbc400 x6 : 0000000000000000
[ 2602.083339] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000001
[ 2602.083346] x2 : 0000000000000000 x1 : 0000000000000001 x0 : ff00312e6f006573
[ 2602.083354] Call trace:
[ 2602.083356]  _raw_spin_lock+0x34/0x68
[ 2602.083364]  release_firmware+0x48/0x6c
[ 2602.083370]  nxp_setup+0x3c4/0x540 [btnxpuart]
[ 2602.083383]  hci_dev_open_sync+0xf0/0xa34
[ 2602.083391]  hci_dev_open+0xd8/0x178
[ 2602.083399]  hci_sock_ioctl+0x3b0/0x590
[ 2602.083405]  sock_do_ioctl+0x60/0x118
[ 2602.083413]  sock_ioctl+0x2f4/0x374
[ 2602.091430]  __arm64_sys_ioctl+0xac/0xf0
[ 2602.091437]  invoke_syscall+0x48/0x110
[ 2602.091445]  el0_svc_common.constprop.0+0xc0/0xe0
[ 2602.091452]  do_el0_svc+0x1c/0x28
[ 2602.091457]  el0_svc+0x40/0xe4
[ 2602.091465]  el0t_64_sync_handler+0x120/0x12c
[ 2602.091470]  el0t_64_sync+0x190/0x194

Fixes: e3c4891098 ("Bluetooth: btnxpuart: Handle FW Download Abort scenario")
Fixes: 689ca16e52 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets")
Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-03-25 15:22:17 -04:00
..
Kconfig Bluetooth: btusb: Configure altsetting for HCI_USER_CHANNEL 2025-03-07 12:43:27 -05:00
Makefile Bluetooth: hci_uart: Add support for Amlogic HCI UART 2024-09-10 12:44:10 -04:00
ath3k.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm203x.c
bfusb.c Bluetooth: Fix code style warning 2025-03-25 12:31:27 -04:00
bluecard_cs.c
bpa10x.c
bt3c_cs.c
btbcm.c Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() 2025-01-15 10:34:27 -05:00
btbcm.h
btintel.c Bluetooth: btintel: Add support to configure TX power 2025-03-25 12:51:42 -04:00
btintel.h t blameBluetooth: btintel: Fix leading white space 2025-03-25 12:52:00 -04:00
btintel_pcie.c t blameBluetooth: btintel: Fix leading white space 2025-03-25 12:52:00 -04:00
btintel_pcie.h Bluetooth: btintel_pcie: Add support for device coredump 2025-03-25 12:44:48 -04:00
btmrvl_debugfs.c
btmrvl_drv.h
btmrvl_main.c Bluetooth: Use str_enable_disable-like helpers 2025-01-15 10:36:11 -05:00
btmrvl_sdio.c Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() 2024-09-27 10:52:19 -04:00
btmrvl_sdio.h
btmtk.c Bluetooth: btmtk: Remove the resetting step before downloading the fw 2025-03-25 12:51:10 -04:00
btmtk.h Bluetooth: btmtk: remove #ifdef around declarations 2024-07-26 10:56:54 -04:00
btmtksdio.c Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal 2025-03-25 12:51:26 -04:00
btmtkuart.c bluetooth: Fix typos in the comments 2024-11-14 15:28:07 -05:00
btnxpuart.c Bluetooth: btnxpuart: Fix kernel panic during FW release 2025-03-25 15:22:17 -04:00
btqca.c Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqca.h Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
btqcomsmd.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
btrsi.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
btrtl.c Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() 2025-01-15 10:34:41 -05:00
btrtl.h Bluetooth: btrtl: Add Realtek devcoredump support 2023-08-11 11:35:14 -07:00
btsdio.c Bluetooth: btsdio: Do not bind to non-removable CYW4373 2024-09-12 12:24:08 -04:00
btusb.c Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers 2025-03-25 12:44:32 -04:00
dtl1_cs.c
h4_recv.h move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hci_ag6xx.c
hci_aml.c Bluetooth: hci_uart: Add support for Amlogic HCI UART 2024-09-10 12:44:10 -04:00
hci_ath.c
hci_bcm.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
hci_bcm4377.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hci_bcsp.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hci_h4.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
hci_h5.c Bluetooth: btrtl: fix out of bounds memory access 2024-03-06 17:26:21 -05:00
hci_intel.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
hci_ldisc.c Bluetooth: hci_uart: Fix another race during initialization 2025-03-25 12:32:15 -04:00
hci_ll.c bluetooth: Fix typos in the comments 2024-11-14 15:28:07 -05:00
hci_mrvl.c Bluetooth: hci_mrvl: Add serdev support for 88W8997 2023-04-23 21:45:29 -07:00
hci_nokia.c bluetooth: Fix typos in the comments 2024-11-14 15:28:07 -05:00
hci_qca.c Bluetooth: qca: add WCN3950 support 2025-03-25 12:42:35 -04:00
hci_serdev.c Bluetooth: HCI: Remove HCI_AMP support 2024-05-14 10:54:49 -04:00
hci_uart.h Bluetooth: hci_uart: Fix another race during initialization 2025-03-25 12:32:15 -04:00
hci_vhci.c Bluetooth: hci_vhci: Mark Sync Flow Control as supported 2025-03-25 12:47:07 -04:00
virtio_bt.c virtio: rename virtio_find_vqs_info() to virtio_find_vqs() 2024-07-17 05:20:58 -04:00