linux-kernel - RE: [PATCH v3] gpio: mmio: handle "ngpios" properly in bgpio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 6 Mar 2023 18:47:02 +0000
From:   Asmaa Mnebhi <asmaa@...dia.com>
To:     Andy Shevchenko <andy.shevchenko@...il.com>
CC:     "linus.walleij@...aro.org" <linus.walleij@...aro.org>,
        "linux-gpio@...r.kernel.org" <linux-gpio@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v3] gpio: mmio: handle "ngpios" properly in bgpio_init()

> > +       ret = gpiochip_get_ngpios(gc, dev);
> > +       if (ret)
> > +               gc->ngpio = gc->bgpio_bits;
> 
> But this doesn't update bgpio_bits in the success case. Can you explain why
> it's not a problem (should be at least in the code as a comment).

In the success rate, the bgpio_bits would also be equal to "sz * 8" anyways.
The argument " unsigned long sz" passed in bgpio_init is specifically for this purpose. That tells the gpio library the gpio register access size.
if (!is_power_of_2(sz))
                 return -EINVAL;
 gc->bgpio_bits = sz * 8;

If in the success case, we make it dependent on the ngpio value, we would need to round it up anyways to the closest (power of 2 && multiple of 8) which is the same as "sz * 8"
I will add a comment in the code in my next patch.

> 
> ...
> 
> > +int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) {
> > +       u32 ngpios = gc->ngpio;
> > +       int ret;
> > +
> > +       if (ngpios == 0) {
> 
> > +               ret = device_property_read_u32(dev, "ngpios", &ngpios);
> > +               if (ret) {
> > +                       chip_err(gc, "Failed to get ngpios property\n");
> > +                       return -EINVAL;
> > +               }
> 
> This is not an equivalent to what was in the GPIO library. Why is it so?

Sure. I will keep it the same in my next patch.
The reason I didn’t is because I noticed that the final result of the logic is the same i.e. " goto err_free_dev_name"
"if(ret == -ENODATA)" is handled separately is to add an informative message: chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); and return ret = -EINVAL.

> 
> > +               gc->ngpio = ngpios;
> > +       }
> > +
> > +       if (gc->ngpio > FASTPATH_NGPIO)
> > +               chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n",
> > +                       gc->ngpio, FASTPATH_NGPIO);
> > +
> > +       return 0;
> > +}
> 
> ...
> 
> >                 pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
> > -                      base, base + (int)ngpios - 1,
> > +                      base, base + (int)gc->ngpio - 1,
> >                        gc->label ? : "generic", ret);
> 
> AFAIU this will give a different result to what was previous in one of the error
> cases.

this one provides the "local" gpio pin id i.e. 0->31 for example.
chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", gc->ngpio, FASTPATH_NGPIO);

while this one provides the "global" gpio pin id. when bgpio_init sets the base : gc->base = -1; and gpiochip_add_data_with_key applies this logic:
pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__, base, base + (int)gc->ngpio - 1,
base = gc->base;
         if (base < 0) {
                 base = gpiochip_find_base(gc->ngpio);
Then the base would be = GPIO_DYNAMIC_BASE

Apologies if I misunderstood your question?