linux-kernel - Re: PWM regression causing failures with the pwm-atmel driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230522172358.bw677efyovbrfwjg@pengutronix.de>
Date:   Mon, 22 May 2023 19:23:58 +0200
From:   Uwe Kleine-König <u.kleine-koenig@...gutronix.de>
To:     Peter Rosin <peda@...ntia.se>
Cc:     LKML <linux-kernel@...r.kernel.org>, linux-pwm@...r.kernel.org,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        Thierry Reding <thierry.reding@...il.com>,
        Conor Dooley <conor.dooley@...rochip.com>,
        Claudiu Beznea <claudiu.beznea@...rochip.com>
Subject: Re: PWM regression causing failures with the pwm-atmel driver

Hello Peter,

On Mon, May 22, 2023 at 05:19:43PM +0200, Peter Rosin wrote:
> I have a device with a "sound card" that has an amplifier that needs
> an extra boost when high amplification is requested. This extra
> boost is controlled with a pwm-regulator.
> 
> As of commit c73a3107624d ("pwm: Handle .get_state() failures") this
> device no longer works. I have tracked the problem to an unfortunate
> interaction between the underlying PWM driver and the PWM core.
> 
> The driver is drivers/pwm/pwm-atmel.c which has difficulties getting
> the period and/or duty_cycle from the HW when the PWM is not enabled.
> Because of this, I think, the driver does not fill in .period and
> .duty_cycle at all in atmel_pwm_get_state() unless the PWM is enabled.
> 
> However, the PWM core is not expecting these fields to be left as-is,
> at least not in pwm_adjust_config(), and its local state variable on
> the stack ends up with whatever crap was on the stack on entry for
> these fields. That fails spectacularly when the function continues to
> do math on these uninitialized values.
> 
> In particular, I find this in the kernel log when a bad kernel runs:
> pwm-regulator: probe of reg-ana failed with error -22
> 
> Before commit c73a3107624d this was a silent failure, and the situation
> "repaired itself" when the PWM was later reprogrammed, at least for my
> case. After that commit, the failure is fatal and the "sound card"
> fails to come up at all.
> 
> 
> I see a couple of adjustments that could be made.
> 
> 1. Zero out some fields in the driver:
> 
> @@ -390,4 +390,6 @@ static int atmel_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
>  		state->enabled = true;
>  	} else {
> +		state->period = 0;
> +		state->duty_cycle = 0;
>  		state->enabled = false;
>  	}

I don't particularily like that. While state->period is an invalid
value, IMHO enabled = false is enough information from the driver's POV.
 
> 2. Don't try to "adjust" a disabled PWM:
> 
> @@ -656,7 +656,7 @@ int pwm_adjust_config(struct pwm_device *pwm)
>  	 * In either case, we setup the new period and polarity, and assign a
>  	 * duty cycle of 0.
>  	 */
> -	if (!state.period) {
> +	if (!state.enabled || !state.period) {
>  		state.duty_cycle = 0;
>  		state.period = pargs.period;
>  		state.polarity = pargs.polarity;

In my book code that calls pwm_get_state() should consider .period
(and .duty_cycle) undefined if .enabled is false. So this hunk is an
improvement. Having said that, I think pwm_adjust_config() has a strange
semantic. I don't understand when you would want to call it, and it only
has one caller (i.e. pwm-regulator).

So another option would be

diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c
index b64d99695b84..418aff0ddbed 100644
--- a/drivers/regulator/pwm-regulator.c
+++ b/drivers/regulator/pwm-regulator.c
@@ -368,10 +368,6 @@ static int pwm_regulator_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	ret = pwm_adjust_config(drvdata->pwm);
-	if (ret)
-		return ret;
-
 	regulator = devm_regulator_register(&pdev->dev,
 					    &drvdata->desc, &config);
 	if (IS_ERR(regulator)) {

and drop pwm_adjust_config() as a followup?!

> 3. Zero out the state before calling pwm_get_state:
> 
> @@ -115,7 +115,7 @@ static int pwm_device_request(struct pwm_device *pwm, const char *label)
>  	}
>  
>  	if (pwm->chip->ops->get_state) {
> -		struct pwm_state state;
> +		struct pwm_state state = { .enabled = true };

I wonder why you picked .enabled = true here but = false on all other
code locations.

Also you don't seem to have 1271a7b98e7989ba6bb978e14403fc84efe16e13
which has the same effect and is included in v6.3 and v6.2.13.

Best regards
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | https://www.pengutronix.de/ |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)