linux-kernel - Re: [PATCH v7 05/10] drivers: qcom: rpmh-rsc: write sleep/wake requests to TCS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 3 May 2018 14:35:39 -0700
From:   Matthias Kaehlcke <mka@...omium.org>
To:     Lina Iyer <ilina@...eaurora.org>
Cc:     andy.gross@...aro.org, david.brown@...aro.org,
        linux-arm-msm@...r.kernel.org, linux-soc@...r.kernel.org,
        rnayak@...eaurora.org, bjorn.andersson@...aro.org,
        linux-kernel@...r.kernel.org, sboyd@...nel.org,
        evgreen@...omium.org, dianders@...omium.org
Subject: Re: [PATCH v7 05/10] drivers: qcom: rpmh-rsc: write sleep/wake
 requests to TCS

Hi Lina,

On Wed, May 02, 2018 at 01:37:44PM -0600, Lina Iyer wrote:
> Sleep and wake requests are sent when the application processor
> subsystem of the SoC is entering deep sleep states like in suspend.
> These requests help lower the system power requirements when the
> resources are not in use.
> 
> Sleep and wake requests are written to the TCS slots but are not
> triggered at the time of writing. The TCS are triggered by the firmware
> after the last of the CPUs has executed its WFI. Since these requests
> may come in different batches of requests, it is the job of this
> controller driver to find and arrange the requests into the available
> TCSes.
> 
> Signed-off-by: Lina Iyer <ilina@...eaurora.org>
> Reviewed-by: Evan Green <evgreen@...omium.org>
> 
> ---
> 
> Changes in v7:
> 	- Bug fix in find_match()
> ---
>  drivers/soc/qcom/rpmh-internal.h |   8 +++
>  drivers/soc/qcom/rpmh-rsc.c      | 118 +++++++++++++++++++++++++++++++
>  2 files changed, 126 insertions(+)
> 
> diff --git a/drivers/soc/qcom/rpmh-internal.h b/drivers/soc/qcom/rpmh-internal.h
> index d9a21726e568..6e19fe458c31 100644
> --- a/drivers/soc/qcom/rpmh-internal.h
> +++ b/drivers/soc/qcom/rpmh-internal.h
> @@ -14,6 +14,7 @@
>  #define MAX_CMDS_PER_TCS		16
>  #define MAX_TCS_PER_TYPE		3
>  #define MAX_TCS_NR			(MAX_TCS_PER_TYPE * TCS_TYPE_NR)
> +#define MAX_TCS_SLOTS			(MAX_CMDS_PER_TCS * MAX_TCS_PER_TYPE)
>  #define RPMH_MAX_CTRLR			2
>  
>  struct rsc_drv;
> @@ -30,6 +31,8 @@ struct rsc_drv;
>   * @ncpt:      number of commands in each TCS
>   * @lock:      lock for synchronizing this TCS writes
>   * @req:       requests that are sent from the TCS
> + * @cmd_cache: flattened cache of cmds in sleep/wake TCS
> + * @slots:     indicates which of @cmd_addr are occupied
>   */
>  struct tcs_group {
>  	struct rsc_drv *drv;
> @@ -40,6 +43,8 @@ struct tcs_group {
>  	int ncpt;
>  	spinlock_t lock;
>  	const struct tcs_request *req[MAX_TCS_PER_TYPE];
> +	u32 *cmd_cache;
> +	DECLARE_BITMAP(slots, MAX_TCS_SLOTS);
>  };
>  
>  /**
> @@ -69,6 +74,9 @@ struct rsc_drv {
>  extern struct list_head rsc_drv_list;
>  
>  int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg);
> +int rpmh_rsc_write_ctrl_data(struct rsc_drv *drv,
> +			     const struct tcs_request *msg);
> +int rpmh_rsc_invalidate(struct rsc_drv *drv);
>  
>  void rpmh_tx_done(const struct tcs_request *msg, int r);
>  
> diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
> index 33270b1d5991..4e2144a14c31 100644
> --- a/drivers/soc/qcom/rpmh-rsc.c
> +++ b/drivers/soc/qcom/rpmh-rsc.c
> @@ -113,6 +113,12 @@ static struct tcs_group *get_tcs_for_msg(struct rsc_drv *drv,
>  	case RPMH_ACTIVE_ONLY_STATE:
>  		type = ACTIVE_TCS;
>  		break;
> +	case RPMH_WAKE_ONLY_STATE:
> +		type = WAKE_TCS;
> +		break;
> +	case RPMH_SLEEP_STATE:
> +		type = SLEEP_TCS;
> +		break;
>  	default:
>  		return ERR_PTR(-EINVAL);
>  	}
> @@ -353,6 +359,105 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg)
>  }
>  EXPORT_SYMBOL(rpmh_rsc_send_data);
>  
> +static int find_match(const struct tcs_group *tcs, const struct tcs_cmd *cmd,
> +		      int len)
> +{
> +	int i, j;
> +
> +	/* Check for already cached commands */
> +	for_each_set_bit(i, tcs->slots, MAX_TCS_SLOTS) {
> +		if (tcs->cmd_cache[i] != cmd[0].addr)
> +			continue;
> +		for (j = 0; j < len; j++) {
> +			if (tcs->cmd_cache[i + j] != cmd[j].addr) {

As mentioned in the review of v6, the code could read memory beyond
tcs->cmd_cache if 'i + len > ARRAY_SIZE(tcs->cmd_cache)'

> +				WARN(1, "Message does not match previous sequence.\n");
> +				return -EINVAL;
> +			}
> +		}
> +		return i;
> +	}
> +
> +	return -ENODATA;
> +}
> +
> +static int find_slots(struct tcs_group *tcs, const struct tcs_request *msg,
> +		      int *tcs_id, int *cmd_id)

The change from m/n => tcs_id/cmd_id in v7 greatly improves
readability, thanks!

Matthias

PS: Please remember to include reviewers of earlier revisions to cc: