linux-kernel - [PATCH] dmaengine: qcom: bam_dma: Fix BAM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250110051409.4099727-1-quic_mdalam@quicinc.com>
Date: Fri, 10 Jan 2025 10:44:09 +0530
From: Md Sadre Alam <quic_mdalam@...cinc.com>
To: <vkoul@...nel.org>, <ulf.hansson@...aro.org>, <robin.murphy@....com>,
        <kees@...nel.org>, <u.kleine-koenig@...libre.com>,
        <linux-arm-msm@...r.kernel.org>, <av2082000@...il.com>,
        <dmaengine@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC: <djakov@...nel.org>, <quic_mdalam@...cinc.com>, <quic_varada@...cinc.com>,
        <quic_srichara@...cinc.com>
Subject: [PATCH] dmaengine: qcom: bam_dma: Fix BAM_RIVISON register handling

This patch fixes a bug introduced in the previous commit where the
BAM_DESC_CNT_TRSHLD register was conditionally written based on BAM-NDP
mode. Additionally, it addresses an issue where reading the BAM_REVISION
register hangs if num-ees is not zero. A check has been added to prevent
this.

Cc: stable@...r.kernel.org
Fixes: 57a7138d0627 ("dmaengine: qcom: bam_dma: Avoid writing unavailable register")
Reported-by: Georgi Djakov <djakov@...nel.org>
Link: https://lore.kernel.org/lkml/9ef3daa8-cdb1-49f2-8d19-a72d6210ff3a@kernel.org/
Signed-off-by: Md Sadre Alam <quic_mdalam@...cinc.com>
---
 drivers/dma/qcom/bam_dma.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
index c14557efd577..2b88b27f2f91 100644
--- a/drivers/dma/qcom/bam_dma.c
+++ b/drivers/dma/qcom/bam_dma.c
@@ -445,11 +445,15 @@ static void bam_reset(struct bam_device *bdev)
 	writel_relaxed(val, bam_addr(bdev, 0, BAM_CTRL));
 
 	/* set descriptor threshold, start with 4 bytes */
-	if (in_range(bdev->bam_revision, BAM_NDP_REVISION_START,
-		     BAM_NDP_REVISION_END))
+	if (!bdev->num_ees && in_range(bdev->bam_revision, BAM_NDP_REVISION_START,
+				       BAM_NDP_REVISION_END))
 		writel_relaxed(DEFAULT_CNT_THRSHLD,
 			       bam_addr(bdev, 0, BAM_DESC_CNT_TRSHLD));
 
+	if (bdev->num_ees && !bdev->bam_revision)
+		writel_relaxed(DEFAULT_CNT_THRSHLD, bam_addr(bdev, 0,
+							     BAM_DESC_CNT_TRSHLD));
+
 	/* Enable default set of h/w workarounds, ie all except BAM_FULL_PIPE */
 	writel_relaxed(BAM_CNFG_BITS_DEFAULT, bam_addr(bdev, 0, BAM_CNFG_BITS));
 
@@ -1006,10 +1010,14 @@ static void bam_apply_new_config(struct bam_chan *bchan,
 			maxburst = bchan->slave.src_maxburst;
 		else
 			maxburst = bchan->slave.dst_maxburst;
-		if (in_range(bdev->bam_revision, BAM_NDP_REVISION_START,
-			     BAM_NDP_REVISION_END))
+		if (!bdev->num_ees && in_range(bdev->bam_revision, BAM_NDP_REVISION_START,
+					       BAM_NDP_REVISION_END))
 			writel_relaxed(maxburst,
 				       bam_addr(bdev, 0, BAM_DESC_CNT_TRSHLD));
+
+		if (bdev->num_ees && !bdev->bam_revision)
+			writel_relaxed(DEFAULT_CNT_THRSHLD, bam_addr(bdev, 0,
+								     BAM_DESC_CNT_TRSHLD));
 	}
 
 	bchan->reconfigure = 0;
@@ -1196,12 +1204,13 @@ static struct dma_chan *bam_dma_xlate(struct of_phandle_args *dma_spec,
  */
 static int bam_init(struct bam_device *bdev)
 {
-	u32 val;
+	u32 val = 0;
 
 	/* read revision and configuration information */
-	val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION));
-	if (!bdev->num_ees)
+	if (!bdev->num_ees) {
+		val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION));
 		bdev->num_ees = (val >> NUM_EES_SHIFT) & NUM_EES_MASK;
+	}
 
 	bdev->bam_revision = val & REVISION_MASK;
 
-- 
2.34.1