Messages in this thread Patch in this message | | | From | Xu Qiang <> | Subject | [PATCH -next] irq-chip/gic-v3-its: Fixed an issue where the ITS executes the residual commands in the queue again when the ITS wakes up from sleep mode. | Date | Sat, 7 Nov 2020 10:42:26 +0000 |
| |
On my platform, ITS_FLAGS_SAVE_SUSPEND_STATE is not set,thus do nothing in its suspend and resuse function.On the other hand,firmware stores GITS_CTRL,GITS_CBASER,GITS_CWRITER and GITS_BASER<n> in the suspend, and restores these registers in the resume. As a result, the ITS executes the residual commands in the queue.
Memory corruption may occur in the following scenarios:
The kernel sends three commands in the following sequence: 1.mapd(deviceA, ITT_addr1, valid:1) 2.mapti(deviceA):ITS write ITT_addr1 memory; 3.mapd(deviceA, ITT_addr1, valid:0) and kfree(ITT_addr1); 4.mapd(deviceA, ITT_addr2, valid:1); 5.mapti(deviceA):ITS write ITT_addr2 memory;
To solve this problem,dropping the checks for ITS_FLAGS_SAVE_SUSPEND_STATE.
Signed-off-by: Xu Qiang <xuqiang36@huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 13 ------------- 1 file changed, 13 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 0fec31931e11..06f2c1c252b9 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -42,7 +42,6 @@ #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) -#define ITS_FLAGS_SAVE_SUSPEND_STATE (1ULL << 3) #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) #define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) @@ -4741,9 +4740,6 @@ static int its_save_disable(void) list_for_each_entry(its, &its_nodes, entry) { void __iomem *base; - if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE)) - continue; - base = its->base; its->ctlr_save = readl_relaxed(base + GITS_CTLR); err = its_force_quiescent(base); @@ -4762,9 +4758,6 @@ static int its_save_disable(void) list_for_each_entry_continue_reverse(its, &its_nodes, entry) { void __iomem *base; - if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE)) - continue; - base = its->base; writel_relaxed(its->ctlr_save, base + GITS_CTLR); } @@ -4784,9 +4777,6 @@ static void its_restore_enable(void) void __iomem *base; int i; - if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE)) - continue; - base = its->base; /* @@ -5074,9 +5064,6 @@ static int __init its_probe_one(struct resource *res, ctlr |= GITS_CTLR_ImDe; writel_relaxed(ctlr, its->base + GITS_CTLR); - if (GITS_TYPER_HCC(typer)) - its->flags |= ITS_FLAGS_SAVE_SUSPEND_STATE; - err = its_init_domain(handle, its); if (err) goto out_free_tables; -- 2.25.0
| |