linux-kernel - Re: [PATCH 1/3] i2c: bcm2835: Fix hang for writing messages larger than 16 bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Sep 2016 08:46:58 +0200
From:   Martin Sperl <kernel@...tin.sperl.org>
To:     Noralf Trønnes <noralf@...nnes.org>,
        wsa@...-dreams.de, swarren@...dotorg.org, eric@...olt.net
Cc:     linux-rpi-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-i2c@...r.kernel.org
Subject: Re: [PATCH 1/3] i2c: bcm2835: Fix hang for writing messages larger
 than 16 bytes

On 19.09.2016 17:26, Noralf Trønnes wrote:
> Writing messages larger than the FIFO size results in a hang, rendering
> the machine unusable. This is because the RXD status flag is set on the
> first interrupt which results in bcm2835_drain_rxfifo() stealing bytes
> from the buffer. The controller continues to trigger interrupts waiting
> for the missing bytes, but bcm2835_fill_txfifo() has none to give.
I remember having seen similar interrupt issues with the SPI HW-block.
> In this situation wait_for_completion_timeout() apparently is unable to
> stop the madness.
That is because it is a level irq that immediately triggers another 
interrupt giving
no CPU no time to do other (threaded) OS activity - this might be slightly
different for multi-core machines...
> The BCM2835 ARM Peripherals datasheet has this to say about the flags:
>    TXD: is set when the FIFO has space for at least one byte of data.
>    RXD: is set when the FIFO contains at least one byte of data.
>    TXW: is set during a write transfer and the FIFO is less than full.
>    RXR: is set during a read transfer and the FIFO is or more full.
>
> Implementing the logic from the downstream i2c-bcm2708 driver solved
> the hang problem.
>
> Signed-off-by: Noralf Trønnes<noralf@...nnes.org>
Reviewed-by: Martin Sperl <kernel@...tin.sperl.org>