linux-kernel - Re: [RESEND PATCH v3 02/10] spmi: pmic-arb: do not ack and clear peripheral interrupts in cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 2 Dec 2021 20:52:30 +0800
From:   Fenglin Wu <quic_fenglinw@...cinc.com>
To:     Bryan O'Donoghue <bryan.odonoghue@...aro.org>,
        <linux-arm-msm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <sboyd@...nel.org>
CC:     <collinsd@...eaurora.org>, <subbaram@...eaurora.org>,
        <tglx@...utronix.de>, <maz@...nel.org>
Subject: Re: [RESEND PATCH v3 02/10] spmi: pmic-arb: do not ack and clear
 peripheral interrupts in cleanup_irq


On 2021/12/2 10:39, Bryan O'Donoghue wrote:
> On 02/12/2021 00:00, Fenglin Wu wrote:
>> From: Subbaraman Narayanamurthy <subbaram@...eaurora.org>
>>
>> Currently, cleanup_irq() is invoked when a peripheral's interrupt
>> fires and there is no mapping present in the interrupt domain of
>> spmi interrupt controller.
>>
>> The cleanup_irq clears the arbiter bit, clears the pmic interrupt
>> and disables it at the pmic in that order. The last disable in
>> cleanup_irq races with request_irq() in that it stomps over the
>> enable issued by request_irq. Fix this by not writing to the pmic
>> in cleanup_irq. The latched bit will be left set in the pmic,
>> which will not send us more interrupts even if the enable bit
>> stays enabled.
>>
>> When a client wants to request an interrupt, use the activate
>> callback on the irq_domain to clear latched bit. This ensures
>> that the latched, if set due to the above changes in cleanup_irq
>> or when the bootloader leaves it set, gets cleaned up, paving way
>> for upcoming interrupts to trigger.
>>
>> With this, there is a possibility of unwanted triggering of
>> interrupt right after the latched bit is cleared - the interrupt
>> may be left enabled too. To avoid that, clear the enable first
>> followed by clearing the latched bit in the activate callback.
>>
>> Signed-off-by: Subbaraman Narayanamurthy <subbaram@...eaurora.org>
>> [collinsd@...eaurora.org: fix merge conflict]
>> Signed-off-by: David Collins <collinsd@...eaurora.org>
>> Signed-off-by: Fenglin Wu <quic_fenglinw@...cinc.com>
>> ---
>>   drivers/spmi/spmi-pmic-arb.c | 15 +++++----------
>>   1 file changed, 5 insertions(+), 10 deletions(-)
>>
>> diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
>> index da629cc..ce7ae99 100644
>> --- a/drivers/spmi/spmi-pmic-arb.c
>> +++ b/drivers/spmi/spmi-pmic-arb.c
>> @@ -492,16 +492,6 @@ static void cleanup_irq(struct spmi_pmic_arb 
>> *pmic_arb, u16 apid, int id)
>>       dev_err_ratelimited(&pmic_arb->spmic->dev, "%s apid=%d sid=0x%x 
>> per=0x%x irq=%d\n",
>>               __func__, apid, sid, per, id);
>>       writel_relaxed(irq_mask, pmic_arb->ver_ops->irq_clear(pmic_arb, 
>> apid));
>> -
>> -    if (pmic_arb_write_cmd(pmic_arb->spmic, SPMI_CMD_EXT_WRITEL, sid,
>> -            (per << 8) + QPNPINT_REG_LATCHED_CLR, &irq_mask, 1))
>> -        dev_err_ratelimited(&pmic_arb->spmic->dev, "failed to ack 
>> irq_mask = 0x%x for ppid = %x\n",
>> -                irq_mask, ppid);spmi: pmic-arb: cleanup unrequested 
>> irqs
>> -
>> -    if (pmic_arb_write_cmd(pmic_arb->spmic, SPMI_CMD_EXT_WRITEL, sid,
>> -                   (per << 8) + QPNPINT_REG_EN_CLR, &irq_mask, 1))
>> -        dev_err_ratelimited(&pmic_arb->spmic->dev, "failed to ack 
>> irq_mask = 0x%x for ppid = %x\n",
>> -                irq_mask, ppid);
>>   }
>>     static int periph_interrupt(struct spmi_pmic_arb *pmic_arb, u16 
>> apid)
>> @@ -674,6 +664,7 @@ static int qpnpint_irq_domain_activate(struct 
>> irq_domain *domain,
>>       u16 apid = hwirq_to_apid(d->hwirq);
>>       u16 sid = hwirq_to_sid(d->hwirq);
>>       u16 irq = hwirq_to_irq(d->hwirq);
>> +    u8 buf;
>>         if (pmic_arb->apid_data[apid].irq_ee != pmic_arb->ee) {
>>           dev_err(&pmic_arb->spmic->dev, "failed to xlate sid = %#x, 
>> periph = %#x, irq = %u: ee=%u but owner=%u\n",
>> @@ -682,6 +673,10 @@ static int qpnpint_irq_domain_activate(struct 
>> irq_domain *domain,
>>           return -ENODEV;
>>       }
>>   +    buf = BIT(irq);
>> +    qpnpint_spmi_write(d, QPNPINT_REG_EN_CLR, &buf, 1);
>> +    qpnpint_spmi_write(d, QPNPINT_REG_LATCHED_CLR, &buf, 1);
>> +
>>       return 0;
>>   }
>>
>
> Shouldn't this have a
>
> Fixes: 6bc546e71e50 ("spmi: pmic-arb: cleanup unrequested irqs")
> Fixes: 02abec3616c1 ("spmi: pmic-arb: rename pa_xx to pmic_arb_xx and 
> other cleanup")
>
> so we know to backport as necessary
>
Got it, I will add the Fixes tag and send it again.

> ---
> bod
>