| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20251126045926.2413532-1-joonwonkang@google.com>
Date: Wed, 26 Nov 2025 04:59:26 +0000
From: Joonwon Kang <joonwonkang@...gle.com>
To: jassisinghbrar@...il.com
Cc: sudeep.holla@....com, thierry.reding@...il.com, jonathanh@...dia.com,
linux-kernel@...r.kernel.org, Joonwon Kang <joonwonkang@...gle.com>
Subject: [PATCH] mailbox: Allow NULL message sending
Clients may want to send interrupt only without any useful message
involved. Since the current mailbox framework does not allow NULL
message sending(although it allows receiving it), the clients should
allocate a dummy message buffer and pretend sending it. Besides, if
the mailbox controller calls `mbox_chan_txdone()` when the client
drivers happen to send NULL message anyway, it will result in unexpected
results by making the tx status messed up. This commit lifts the
limitation and allows the clients to send interrupt only without any
message buffer allocated.
Signed-off-by: Joonwon Kang <joonwonkang@...gle.com>
---
drivers/mailbox/mailbox.c | 20 ++++++++++++--------
drivers/mailbox/pcc.c | 6 +++---
drivers/mailbox/tegra-hsp.c | 2 +-
include/linux/mailbox_controller.h | 2 +-
4 files changed, 17 insertions(+), 13 deletions(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index 2acc6ec229a4..0007a023112c 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -52,7 +52,7 @@ static void msg_submit(struct mbox_chan *chan)
int err = -EBUSY;
scoped_guard(spinlock_irqsave, &chan->lock) {
- if (!chan->msg_count || chan->active_req)
+ if (!chan->msg_count || chan->active_req >= 0)
break;
count = chan->msg_count;
@@ -69,7 +69,7 @@ static void msg_submit(struct mbox_chan *chan)
/* Try to submit a message to the MBOX controller */
err = chan->mbox->ops->send_data(chan, data);
if (!err) {
- chan->active_req = data;
+ chan->active_req = idx;
chan->msg_count--;
}
}
@@ -83,17 +83,21 @@ static void msg_submit(struct mbox_chan *chan)
static void tx_tick(struct mbox_chan *chan, int r)
{
+ int idx;
void *mssg;
scoped_guard(spinlock_irqsave, &chan->lock) {
- mssg = chan->active_req;
- chan->active_req = NULL;
+ idx = chan->active_req;
+ if (idx >= 0) {
+ mssg = chan->msg_data[idx];
+ chan->active_req = -1;
+ }
}
/* Submit next message */
msg_submit(chan);
- if (!mssg)
+ if (idx < 0)
return;
/* Notify the client */
@@ -114,7 +118,7 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer)
for (i = 0; i < mbox->num_chans; i++) {
struct mbox_chan *chan = &mbox->chans[i];
- if (chan->active_req && chan->cl) {
+ if (chan->active_req >= 0 && chan->cl) {
txdone = chan->mbox->ops->last_tx_done(chan);
if (txdone)
tx_tick(chan, 0);
@@ -319,7 +323,7 @@ static int __mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl)
scoped_guard(spinlock_irqsave, &chan->lock) {
chan->msg_free = 0;
chan->msg_count = 0;
- chan->active_req = NULL;
+ chan->active_req = -1;
chan->cl = cl;
init_completion(&chan->tx_complete);
@@ -477,7 +481,7 @@ void mbox_free_channel(struct mbox_chan *chan)
/* The queued TX requests are simply aborted, no callbacks are made */
scoped_guard(spinlock_irqsave, &chan->lock) {
chan->cl = NULL;
- chan->active_req = NULL;
+ chan->active_req = -1;
if (chan->txdone_method == TXDONE_BY_ACK)
chan->txdone_method = TXDONE_BY_POLL;
}
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 0a00719b2482..7eca06d5ecf6 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -333,7 +333,7 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
{
struct pcc_chan_info *pchan;
struct mbox_chan *chan = p;
- struct pcc_header *pcc_header = chan->active_req;
+ struct pcc_header *pcc_header = NULL;
void *handle = NULL;
pchan = chan->con_priv;
@@ -362,8 +362,8 @@ static irqreturn_t pcc_mbox_irq(int irq, void *p)
if (pchan->chan.rx_alloc)
handle = write_response(pchan);
- if (chan->active_req) {
- pcc_header = chan->active_req;
+ if (chan->active_req >= 0) {
+ pcc_header = chan->msg_data[chan->active_req];
if (pcc_header->flags & PCC_CMD_COMPLETION_NOTIFY)
mbox_chan_txdone(chan, 0);
}
diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c
index ed9a0bb2bcd8..de7494ce0a9f 100644
--- a/drivers/mailbox/tegra-hsp.c
+++ b/drivers/mailbox/tegra-hsp.c
@@ -497,7 +497,7 @@ static int tegra_hsp_mailbox_flush(struct mbox_chan *chan,
mbox_chan_txdone(chan, 0);
/* Wait until channel is empty */
- if (chan->active_req != NULL)
+ if (chan->active_req >= 0)
continue;
return 0;
diff --git a/include/linux/mailbox_controller.h b/include/linux/mailbox_controller.h
index 80a427c7ca29..230d2669861d 100644
--- a/include/linux/mailbox_controller.h
+++ b/include/linux/mailbox_controller.h
@@ -123,7 +123,7 @@ struct mbox_chan {
unsigned txdone_method;
struct mbox_client *cl;
struct completion tx_complete;
- void *active_req;
+ int active_req;
unsigned msg_count, msg_free;
void *msg_data[MBOX_TX_QUEUE_LEN];
spinlock_t lock; /* Serialise access to the channel */
--
2.52.0.487.g5c8c507ade-goog
Powered by blists - more mailing lists