1. 23 Apr, 2022 1 commit
    • Jeffrey Hugo's avatar
      bus: mhi: host: Use cached values for calculating the shared write pointer · e565d3ef
      Jeffrey Hugo authored
      mhi_recycle_ev_ring() computes the shared write pointer for the ring
      (ctxt_wp) using a read/modify/write pattern where the ctxt_wp value in the
      shared memory is read, incremented, and written back.  There are no checks
      on the read value, it is assumed that it is kept in sync with the locally
      cached value.  Per the MHI spec, this is correct.  The device should only
      read ctxt_wp, never write it.
      
      However, there are devices in the wild that violate the spec, and can
      update the ctxt_wp in a specific scenario.  This can cause corruption, and
      violate the above assumption that the ctxt_wp is in sync with the cached
      value.
      
      This can occur when the device has loaded firmware from the host, and is
      transitioning from the SBL EE to the AMSS EE.  As part of shutting down
      SBL, the SBL flushes it's local MHI context to the shared memory since
      the local context will not persist across an EE change.  In the case of
      the event ring, SBL will flush its entire context, not just the parts that
      it is allowed to update.  This means SBL will write to ctxt_wp, and
      possibly corrupt it.
      
      An example:
      
      Host				Device
      ----				---
      Update ctxt_wp to 0x1f0
      				SBL observes 0x1f0
      Update ctxt_wp to 0x0
      				Starts transition to AMSS EE
      				Context flush, writes 0x1f0 to ctxt_wp
      Update ctxt_wp to 0x200
      Update ctxt_wp to 0x210
      				AMSS observes 0x210
      				0x210 exceeds ring size
      				AMSS signals syserr
      
      The reason the ctxt_wp goes off the end of the ring is that the rollover
      check is only performed on the cached wp, which is out of sync with
      ctxt_wp.
      
      Since the host is the authority of the value of ctxt_wp per the MHI spec,
      we can fix this issue by not reading ctxt_wp from the shared memory, and
      instead compute it based on the cached value.  If SBL corrupts ctxt_wp,
      the host won't observe it, and will correct the value at some point later.
      Signed-off-by: default avatarJeffrey Hugo <quic_jhugo@quicinc.com>
      Reviewed-by: default avatarHemant Kumar <quic_hemantk@quicinc.com>
      Reviewed-by: default avatarBhaumik Bhatt <quic_bbhatt@quicinc.com>
      Reviewed-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
      Link: https://lore.kernel.org/r/1649868113-18826-1-git-send-email-quic_jhugo@quicinc.com
      [mani: used the quicinc domain for Hemant and Bhaumik]
      Signed-off-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
      e565d3ef
  2. 11 Apr, 2022 1 commit
  3. 04 Apr, 2022 18 commits
  4. 03 Apr, 2022 8 commits
  5. 02 Apr, 2022 12 commits