linux-kernel - Re: [PATCH 1/3] soc: qcom: geni: More properly switch to DMA mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Oct 2020 13:39:36 +0530
From:   Akash Asthana <akashast@...eaurora.org>
To:     Douglas Anderson <dianders@...omium.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Wolfram Sang <wsa@...nel.org>
Cc:     linux-arm-msm@...r.kernel.org, Stephen Boyd <swboyd@...omium.org>,
        linux-i2c@...r.kernel.org, Andy Gross <agross@...nel.org>,
        Girish Mahadevan <girishm@...eaurora.org>,
        Karthikeyan Ramasubramanian <kramasub@...eaurora.org>,
        Mukesh Kumar Savaliya <msavaliy@...eaurora.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/3] soc: qcom: geni: More properly switch to DMA mode


On 10/9/2020 4:22 AM, Douglas Anderson wrote:
> On geni-i2c transfers using DMA, it was seen that if you program the
> command (I2C_READ) before calling geni_se_rx_dma_prep() that it could
> cause interrupts to fire.  If we get unlucky, these interrupts can
> just keep firing (and not be handled) blocking further progress and
> hanging the system.
>
> In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
> we avoided that by making sure we didn't program the command until
> after geni_se_rx_dma_prep() was called.  While that avoided the
> problems, it also turns out to be invalid.  At least in the TX case we
> started seeing sporadic corrupted transfers.  This is easily seen by
> adding an msleep() between the DMA prep and the writing of the
> command, which makes the problem worse.  That means we need to revert
> that commit and find another way to fix the bogus IRQs.
>
> Specifically, after reverting commit 02b9aec59243 ("i2c:
> i2c-qcom-geni: Fix DMA transfer race"), I put some traces in.  I found
> that the when the interrupts were firing like crazy:
> - "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set.
> - "dma" was set.
>
> Further debugging showed that I could make the problem happen more
> reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd()
> ran up until geni_se_rx_dma_prep() programmed the length.
>
> A rather simple fix is to change geni_se_select_dma_mode() so it's a
> true inverse of geni_se_select_fifo_mode() and disables all the FIFO
> related interrupts.  Now the problematic interrupts can't fire and we
> can program things in the correct order without worrying.
>
> As part of this, let's also change the writel_relaxed() in the prepare
> function to a writel() so that our DMA is guaranteed to be prepared
> now that we can't rely on geni_se_setup_m_cmd()'s writel().
>
> NOTE: the only current user of GENI_SE_DMA in mainline is i2c.
>
> Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
> Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
> Signed-off-by: Douglas Anderson <dianders@...omium.org>
Reviewed-by: Akash Asthana <akashast@...eaurora.org>

-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,\na Linux Foundation Collaborative Project