From patchwork Thu Jan 28 16:33:40 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jon Hunter X-Patchwork-Id: 8152451 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 69A85BEEE5 for ; Thu, 28 Jan 2016 16:41:59 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7E5A82035B for ; Thu, 28 Jan 2016 16:41:58 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 7E73F202F8 for ; Thu, 28 Jan 2016 16:41:57 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1aOpcR-0004b7-0r; Thu, 28 Jan 2016 16:40:27 +0000 Received: from hqemgate15.nvidia.com ([216.228.121.64]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1aOpWm-0005i2-AG for linux-arm-kernel@lists.infradead.org; Thu, 28 Jan 2016 16:34:48 +0000 Received: from hqnvupgp08.nvidia.com (Not Verified[216.228.121.13]) by hqemgate15.nvidia.com id ; Thu, 28 Jan 2016 08:34:21 -0800 Received: from hqemhub02.nvidia.com ([172.20.150.31]) by hqnvupgp08.nvidia.com (PGP Universal service); Thu, 28 Jan 2016 08:35:07 -0800 X-PGP-Universal: processed; by hqnvupgp08.nvidia.com on Thu, 28 Jan 2016 08:35:07 -0800 Received: from jonathanh-lm.nvidia.com (172.20.144.16) by hqemhub02.nvidia.com (172.20.150.31) with Microsoft SMTP Server (TLS) id 8.3.406.0; Thu, 28 Jan 2016 08:34:14 -0800 From: Jon Hunter To: Stephen Warren , Thierry Reding , Alexandre Courbot , "Rafael J. Wysocki" , Kevin Hilman , Ulf Hansson , Rob Herring , Pawel Moll , Mark Rutland , Ian Campbell , Kumar Gala Subject: [PATCH V5 02/14] soc: tegra: pmc: Protect public functions from potential race conditions Date: Thu, 28 Jan 2016 16:33:40 +0000 Message-ID: <1453998832-27383-3-git-send-email-jonathanh@nvidia.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1453998832-27383-1-git-send-email-jonathanh@nvidia.com> References: <1453998832-27383-1-git-send-email-jonathanh@nvidia.com> X-NVConfidentiality: public MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20160128_083436_686401_15C86B9F X-CRM114-Status: GOOD ( 15.47 ) X-Spam-Score: -6.9 (------) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-tegra@vger.kernel.org, devicetree@vger.kernel.org, Jon Hunter , linux-arm-kernel@lists.infradead.org, linux-pm@vger.kernel.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The PMC base address pointer is initialised during early boot so that early platform code may used the PMC public functions. During the probe of the PMC driver the base address pointer is mapped again and the initial mapping is freed. This exposes a window where a device accessing the PMC registers via one of the public functions, could race with the updating of the pointer and lead to a invalid access. Furthermore, the only protection between multiple devices attempting to access the PMC registers is when setting the powergate state to on or off. None of the other public functions that access the PMC registers are protected. Use the existing mutex to protect paths that may race with regard to accessing the PMC registers. Signed-off-by: Jon Hunter --- drivers/soc/tegra/pmc.c | 44 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 9 deletions(-) diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c index 85b4e166273a..f8cdb7ce9755 100644 --- a/drivers/soc/tegra/pmc.c +++ b/drivers/soc/tegra/pmc.c @@ -235,7 +235,10 @@ int tegra_powergate_is_powered(int id) if (!pmc->soc || id < 0 || id >= pmc->soc->num_powergates) return -EINVAL; + mutex_lock(&pmc->powergates_lock); status = tegra_pmc_readl(PWRGATE_STATUS) & (1 << id); + mutex_unlock(&pmc->powergates_lock); + return !!status; } @@ -250,6 +253,8 @@ int tegra_powergate_remove_clamping(int id) if (!pmc->soc || id < 0 || id >= pmc->soc->num_powergates) return -EINVAL; + mutex_lock(&pmc->powergates_lock); + /* * On Tegra124 and later, the clamps for the GPU are controlled by a * separate register (with different semantics). @@ -257,7 +262,7 @@ int tegra_powergate_remove_clamping(int id) if (id == TEGRA_POWERGATE_3D) { if (pmc->soc->has_gpu_clamps) { tegra_pmc_writel(0, GPU_RG_CNTRL); - return 0; + goto out; } } @@ -274,6 +279,9 @@ int tegra_powergate_remove_clamping(int id) tegra_pmc_writel(mask, REMOVE_CLAMPING); +out: + mutex_unlock(&pmc->powergates_lock); + return 0; } EXPORT_SYMBOL(tegra_powergate_remove_clamping); @@ -520,9 +528,11 @@ int tegra_io_rail_power_on(int id) unsigned int bit, mask; int err; + mutex_lock(&pmc->powergates_lock); + err = tegra_io_rail_prepare(id, &request, &status, &bit); if (err < 0) - return err; + goto error; mask = 1 << bit; @@ -535,12 +545,15 @@ int tegra_io_rail_power_on(int id) err = tegra_io_rail_poll(status, mask, 0, 250); if (err < 0) { pr_info("tegra_io_rail_poll() failed: %d\n", err); - return err; + goto error; } tegra_io_rail_unprepare(); - return 0; +error: + mutex_unlock(&pmc->powergates_lock); + + return err < 0 ? err : 0; } EXPORT_SYMBOL(tegra_io_rail_power_on); @@ -550,10 +563,12 @@ int tegra_io_rail_power_off(int id) unsigned int bit, mask; int err; + mutex_lock(&pmc->powergates_lock); + err = tegra_io_rail_prepare(id, &request, &status, &bit); if (err < 0) { pr_info("tegra_io_rail_prepare() failed: %d\n", err); - return err; + goto error; } mask = 1 << bit; @@ -566,11 +581,14 @@ int tegra_io_rail_power_off(int id) err = tegra_io_rail_poll(status, mask, mask, 250); if (err < 0) - return err; + goto error; tegra_io_rail_unprepare(); - return 0; +error: + mutex_unlock(&pmc->powergates_lock); + + return err < 0 ? err : 0; } EXPORT_SYMBOL(tegra_io_rail_power_off); @@ -817,9 +835,15 @@ static int tegra_pmc_probe(struct platform_device *pdev) /* take over the memory region from the early initialization */ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + + mutex_lock(&pmc->powergates_lock); pmc->base = devm_ioremap_resource(&pdev->dev, res); - if (IS_ERR(pmc->base)) - return PTR_ERR(pmc->base); + mutex_unlock(&pmc->powergates_lock); + + if (IS_ERR(pmc->base)) { + err = PTR_ERR(pmc->base); + goto error; + } pmc->clk = devm_clk_get(&pdev->dev, "pclk"); if (IS_ERR(pmc->clk)) { @@ -853,7 +877,9 @@ static int tegra_pmc_probe(struct platform_device *pdev) return 0; error: + mutex_lock(&pmc->powergates_lock); pmc->base = base; + mutex_unlock(&pmc->powergates_lock); return err; }