| From 498274e7447ded076291b4de0cbe05a621b6c1b9 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 8 Jul 2019 15:48:36 +0100 |
| Subject: firmware: arm_scmi: Check if platform has released shmem before using |
| |
| From: Sudeep Holla <sudeep.holla@arm.com> |
| |
| [ Upstream commit 9dc34d635c67e57051853855c43249408641a5ab ] |
| |
| Sometimes platfom may take too long to respond to the command and OS |
| might timeout before platform transfer the ownership of the shared |
| memory region to the OS with the response. |
| |
| Since the mailbox channel associated with the channel is freed and new |
| commands are dispatch on the same channel, OS needs to wait until it |
| gets back the ownership. If not, either OS may end up overwriting the |
| platform response for the last command(which is fine as OS timed out |
| that command) or platform might overwrite the payload for the next |
| command with the response for the old. |
| |
| The latter is problematic as platform may end up interpretting the |
| response as the payload. In order to avoid such race, let's wait until |
| the OS gets back the ownership before we prepare the shared memory with |
| the payload for the next command. |
| |
| Reported-by: Jim Quinlan <james.quinlan@broadcom.com> |
| Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/firmware/arm_scmi/driver.c | 8 ++++++++ |
| 1 file changed, 8 insertions(+) |
| |
| diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c |
| index 8f952f2f1a292..09119e3f5c018 100644 |
| --- a/drivers/firmware/arm_scmi/driver.c |
| +++ b/drivers/firmware/arm_scmi/driver.c |
| @@ -271,6 +271,14 @@ static void scmi_tx_prepare(struct mbox_client *cl, void *m) |
| struct scmi_chan_info *cinfo = client_to_scmi_chan_info(cl); |
| struct scmi_shared_mem __iomem *mem = cinfo->payload; |
| |
| + /* |
| + * Ideally channel must be free by now unless OS timeout last |
| + * request and platform continued to process the same, wait |
| + * until it releases the shared memory, otherwise we may endup |
| + * overwriting its response with new message payload or vice-versa |
| + */ |
| + spin_until_cond(ioread32(&mem->channel_status) & |
| + SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE); |
| /* Mark channel busy + clear error */ |
| iowrite32(0x0, &mem->channel_status); |
| iowrite32(t->hdr.poll_completion ? 0 : SCMI_SHMEM_FLAG_INTR_ENABLED, |
| -- |
| 2.20.1 |
| |