linux-kernel - Re: [PATCH v3] mfd: cros ec: Lock the SPI bus while holding chipselect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Nov 2015 14:37:29 -0800
From:	Gwendal Grignou <gwendal@...omium.org>
To:	Lee Jones <lee.jones@...aro.org>
Cc:	Nicolas Boichat <drinkcat@...omium.org>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	Javier Martinez Canillas <javier@....samsung.com>,
	Olof Johansson <olof@...om.net>,
	Doug Anderson <dianders@...omium.org>, rspangler@...omium.org,
	Gwendal Grignou <gwendal@...omium.org>,
	linux-spi@...r.kernel.org, Mark Brown <broonie@...nel.org>
Subject: Re: [PATCH v3] mfd: cros ec: Lock the SPI bus while holding chipselect

Reviewed-by: Gwendal Grignou <gwendal@...omium.org>

On Wed, Nov 25, 2015 at 12:12 AM, Lee Jones <lee.jones@...aro.org> wrote:
> On Wed, 25 Nov 2015, Nicolas Boichat wrote:
>
>> cros_ec_cmd_xfer_spi and cros_ec_pkt_xfer_spi generally work like
>> this:
>>  - Pull CS down (active), wait a bit, then send a command
>>  - Wait for response (multiple requests)
>>  - Wait a while, pull CS up (inactive)
>>
>> These operations, individually, lock the SPI bus, but there is
>> nothing preventing the SPI framework from interleaving messages
>> intended for other devices as the bus is unlocked in between.
>>
>> This is a problem as the EC expects CS to be held low for the
>> whole duration.
>>
>> Solution: Lock the SPI bus during the whole transaction, to make
>> sure that no other messages can be interleaved.
>>
>> Signed-off-by: Nicolas Boichat <drinkcat@...omium.org>
>> ---
>>
>> v2: Move bus_unlock earlier in the functions.
>> v3: Remove comments.
>>
>> Applies on top on linux-next/master (20151124)
>>
>>  drivers/mfd/cros_ec_spi.c | 30 ++++++++++++++++++------------
>>  1 file changed, 18 insertions(+), 12 deletions(-)
>
> Acked-by: Lee Jones <lee.jones@...aro.org>
>
>> diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
>> index 6a0f6ec..d6af52d 100644
>> --- a/drivers/mfd/cros_ec_spi.c
>> +++ b/drivers/mfd/cros_ec_spi.c
>> @@ -113,7 +113,7 @@ static int terminate_request(struct cros_ec_device *ec_dev)
>>       trans.delay_usecs = ec_spi->end_of_msg_delay;
>>       spi_message_add_tail(&trans, &msg);
>>
>> -     ret = spi_sync(ec_spi->spi, &msg);
>> +     ret = spi_sync_locked(ec_spi->spi, &msg);
>>
>>       /* Reset end-of-response timer */
>>       ec_spi->last_transfer_ns = ktime_get_ns();
>> @@ -147,7 +147,7 @@ static int receive_n_bytes(struct cros_ec_device *ec_dev, u8 *buf, int n)
>>
>>       spi_message_init(&msg);
>>       spi_message_add_tail(&trans, &msg);
>> -     ret = spi_sync(ec_spi->spi, &msg);
>> +     ret = spi_sync_locked(ec_spi->spi, &msg);
>>       if (ret < 0)
>>               dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
>>
>> @@ -391,10 +391,10 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
>>       }
>>
>>       rx_buf = kzalloc(len, GFP_KERNEL);
>> -     if (!rx_buf) {
>> -             ret = -ENOMEM;
>> -             goto exit;
>> -     }
>> +     if (!rx_buf)
>> +             return -ENOMEM;
>> +
>> +     spi_bus_lock(ec_spi->spi->master);
>>
>>       /*
>>        * Leave a gap between CS assertion and clocking of data to allow the
>> @@ -414,7 +414,7 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
>>       trans.len = len;
>>       trans.cs_change = 1;
>>       spi_message_add_tail(&trans, &msg);
>> -     ret = spi_sync(ec_spi->spi, &msg);
>> +     ret = spi_sync_locked(ec_spi->spi, &msg);
>>
>>       /* Get the response */
>>       if (!ret) {
>> @@ -440,6 +440,9 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
>>       }
>>
>>       final_ret = terminate_request(ec_dev);
>> +
>> +     spi_bus_unlock(ec_spi->spi->master);
>> +
>>       if (!ret)
>>               ret = final_ret;
>>       if (ret < 0)
>> @@ -520,10 +523,10 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>>       }
>>
>>       rx_buf = kzalloc(len, GFP_KERNEL);
>> -     if (!rx_buf) {
>> -             ret = -ENOMEM;
>> -             goto exit;
>> -     }
>> +     if (!rx_buf)
>> +             return -ENOMEM;
>> +
>> +     spi_bus_lock(ec_spi->spi->master);
>>
>>       /* Transmit phase - send our message */
>>       debug_packet(ec_dev->dev, "out", ec_dev->dout, len);
>> @@ -534,7 +537,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>>       trans.cs_change = 1;
>>       spi_message_init(&msg);
>>       spi_message_add_tail(&trans, &msg);
>> -     ret = spi_sync(ec_spi->spi, &msg);
>> +     ret = spi_sync_locked(ec_spi->spi, &msg);
>>
>>       /* Get the response */
>>       if (!ret) {
>> @@ -560,6 +563,9 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
>>       }
>>
>>       final_ret = terminate_request(ec_dev);
>> +
>> +     spi_bus_unlock(ec_spi->spi->master);
>> +
>>       if (!ret)
>>               ret = final_ret;
>>       if (ret < 0)
>
> --
> Lee Jones
> Linaro STMicroelectronics Landing Team Lead
> Linaro.org │ Open source software for ARM SoCs
> Follow Linaro: Facebook | Twitter | Blog
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/