hwmon: (npcm750-pwm-fan) serialize PWM register updates

npcm7xx_pwm_config_set() writes the channel's CMR register and then
does a read-modify-write of the CR register that holds the enable and
invert bits of all four channels of a PWM module. It is called from the
hwmon pwm write path and from npcm7xx_pwm_cz_set_cur_state(), the
set_cur_state callback of the thermal cooling devices the driver
registers for channels with "cooling-levels".

The per-module pwm_lock serializing these updates was dropped on the
assumption that the hwmon core serializes all attribute accesses. That
only covers the hwmon attributes: the cooling devices are registered
directly with the thermal core, which only holds the lock of the
cooling device being updated. So a thermal zone update or a write to a
cooling device's cur_state can run concurrently with a pwm write, or
with the cooling device of another channel of the same module, and one
CR update overwrites the other:

    CPU0 (pwmN write)               CPU1 (cooling dev, same module)
    tmp = ioread32(CR)
                                    tmp = ioread32(CR)
                                    tmp |= ch1 enable
                                    iowrite32(tmp, CR)
    tmp |= ch0 enable
    iowrite32(tmp, CR)              /* ch1 enable bit lost */

leaving a fan stopped or running at a duty cycle that no longer matches
its enable state.

The bug was found by code inspection and has not been reproduced.

Fix by restoring a per-module mutex around the register updates; a
driver lock is used instead of hwmon_lock() because the cooling devices
are registered before the hwmon device exists.

Fixes: abfb05085177 ("hwmon: (corsair-psu) Rely on subsystem locking")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

0 files changed, 0 insertions, 0 deletions