linux-kernel - Re: [PATCH v2 1/6] drivers: qcom: rpmh-rsc: return if the controller is idle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180911223910.GH22824@google.com>
Date:   Tue, 11 Sep 2018 15:39:10 -0700
From:   Matthias Kaehlcke <mka@...omium.org>
To:     Raju P L S S S N <rplsssn@...eaurora.org>
Cc:     andy.gross@...aro.org, david.brown@...aro.org,
        linux-arm-msm@...r.kernel.org, linux-soc@...r.kernel.org,
        rnayak@...eaurora.org, bjorn.andersson@...aro.org,
        linux-kernel@...r.kernel.org, sboyd@...nel.org,
        evgreen@...omium.org, dianders@...omium.org, ilina@...eaurora.org
Subject: Re: [PATCH v2 1/6] drivers: qcom: rpmh-rsc: return if the controller
 is idle

Hi Raju/Lina,

On Fri, Jul 27, 2018 at 03:34:44PM +0530, Raju P L S S S N wrote:
> From: Lina Iyer <ilina@...eaurora.org>
> 
> Allow the controller status be queried. The controller is busy if it is
> actively processing request.
> 
> Signed-off-by: Lina Iyer <ilina@...eaurora.org>
> Signed-off-by: Raju P.L.S.S.S.N <rplsssn@...eaurora.org>
> ---
> Changes in v2:
>      - Remove unnecessary EXPORT_SYMBOL
> ---
>  drivers/soc/qcom/rpmh-internal.h |  1 +
>  drivers/soc/qcom/rpmh-rsc.c      | 20 ++++++++++++++++++++
>  2 files changed, 21 insertions(+)
> 
> diff --git a/drivers/soc/qcom/rpmh-internal.h b/drivers/soc/qcom/rpmh-internal.h
> index a7bbbb6..4ff43bf 100644
> --- a/drivers/soc/qcom/rpmh-internal.h
> +++ b/drivers/soc/qcom/rpmh-internal.h
> @@ -108,6 +108,7 @@ struct rsc_drv {
>  int rpmh_rsc_write_ctrl_data(struct rsc_drv *drv,
>  			     const struct tcs_request *msg);
>  int rpmh_rsc_invalidate(struct rsc_drv *drv);
> +bool rpmh_rsc_ctrlr_is_idle(struct rsc_drv *drv);
>  
>  void rpmh_tx_done(const struct tcs_request *msg, int r);
>  
> diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
> index 33fe9f9..42d0041 100644
> --- a/drivers/soc/qcom/rpmh-rsc.c
> +++ b/drivers/soc/qcom/rpmh-rsc.c
> @@ -496,6 +496,26 @@ static int tcs_ctrl_write(struct rsc_drv *drv, const struct tcs_request *msg)
>  }
>  
>  /**
> + *  rpmh_rsc_ctrlr_is_idle: Check if any of the AMCs are busy.
> + *
> + *  @drv: The controller
> + *
> + *  Returns true if the TCSes are engaged in handling requests.
> + */
> +bool rpmh_rsc_ctrlr_is_idle(struct rsc_drv *drv)
> +{
> +	int m;
> +	struct tcs_group *tcs = get_tcs_of_type(drv, ACTIVE_TCS);
> +
> +	for (m = tcs->offset; m < tcs->offset + tcs->num_tcs; m++) {
> +		if (!tcs_is_free(drv, m))
> +			return false;
> +	}
> +
> +	return true;
> +}

This looks racy, tcs_write() could be running simultaneously and use
TCSes that were seen as free by _is_idle(). This could be fixed by
holding tcs->lock (assuming this doesn't cause lock ordering problems).
However even with this tcs_write() could run right after releasing the
lock, using TCSes and the caller of _is_idle() would consider the
controller to be idle.