[RFC PATCH] firmware: qemu_fw_cfg.c: hold ACPI global lock during device access

Allowing for the future possibility of implementing AML-based
(i.e., firmware-triggered) access to the QEMU fw_cfg device,
acquire the global ACPI lock when accessing the device on behalf
of the guest-side sysfs driver, to prevent any potential race
conditions.

Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
---

Turns out, there *is* a way to acquire a global ACPI lock from within
a "random" kernel driver after all. Luckily I have a healthy dose of
respect for Michael's opinions :) so I kept circling back through
existing kernel sources for an example I can use, and I think this
might be it.

I'm posting as RFC because I'm not really confident about assessing
the likelihood of there ever being a race condition between the kernel
fw_cfg sysfs driver and firmware on my own. Obviously Michael has
concerns about it, but any additional opinions from the QEMU camp would
be much appreciated.

Thanks again,
 --Gabriel

 drivers/firmware/qemu_fw_cfg.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index 7bba76c..cc4c27a 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c

@@ -77,12 +77,26 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
 static inline void fw_cfg_read_blob(u16 key,
 				    void *buf, loff_t pos, size_t count)
 {
+#ifdef CONFIG_ACPI
+	u32 glk;
+	int status;
+	status = acpi_acquire_global_lock(ACPI_WAIT_FOREVER, &glk);
+	if (ACPI_FAILURE(status)) {
+		/* Should never get here */
+		WARN(1, "fw_cfg_read_blob: Failed to lock ACPI!\n");
+		memset(buf, 0, count);
+		return;
+	}
+#endif
 	mutex_lock(&fw_cfg_dev_lock);
 	iowrite16(fw_cfg_sel_endianness(key), fw_cfg_reg_ctrl);
 	while (pos-- > 0)
 		ioread8(fw_cfg_reg_data);
 	ioread8_rep(fw_cfg_reg_data, buf, count);
 	mutex_unlock(&fw_cfg_dev_lock);
+#ifdef CONFIG_ACPI
+	acpi_release_global_lock(glk);
+#endif
 }
 
 /* clean up fw_cfg device i/o */

-- 
2.4.3

On Mon, Mar 07, 2016 at 06:55:43PM -0500, Gabriel Somlo wrote:

Why not fix up the ACPI api to not require #ifdef here?  It should be
added to a .h file somewhere instead.

+	if (ACPI_FAILURE(status)) {
+		/* Should never get here */
+		WARN(1, "fw_cfg_read_blob: Failed to lock ACPI!\n");
+		memset(buf, 0, count);
+		return;
+	}
+#endif
 	mutex_lock(&fw_cfg_dev_lock);
 	iowrite16(fw_cfg_sel_endianness(key), fw_cfg_reg_ctrl);
 	while (pos-- > 0)
 		ioread8(fw_cfg_reg_data);
 	ioread8_rep(fw_cfg_reg_data, buf, count);
 	mutex_unlock(&fw_cfg_dev_lock);
+#ifdef CONFIG_ACPI
+	acpi_release_global_lock(glk);

Same here.

thanks,

greg k-h

On Mon, Mar 07, 2016 at 04:02:15PM -0800, Greg KH wrote:

On Mon, Mar 07, 2016 at 06:55:43PM -0500, Gabriel Somlo wrote:

quoted

Allowing for the future possibility of implementing AML-based
(i.e., firmware-triggered) access to the QEMU fw_cfg device,
acquire the global ACPI lock when accessing the device on behalf
of the guest-side sysfs driver, to prevent any potential race
conditions.

Suggested-by: Michael S. Tsirkin <redacted>
Signed-off-by: Gabriel Somlo <somlo-D+Gtc/HYRWM@public.gmane.org>

ACK, except for Gerd's comments below.

quoted

---

Turns out, there *is* a way to acquire a global ACPI lock from within
a "random" kernel driver after all. Luckily I have a healthy dose of
respect for Michael's opinions :) so I kept circling back through
existing kernel sources for an example I can use, and I think this
might be it.

I'm posting as RFC because I'm not really confident about assessing
the likelihood of there ever being a race condition between the kernel
fw_cfg sysfs driver and firmware on my own. Obviously Michael has
concerns about it, but any additional opinions from the QEMU camp would
be much appreciated.

Thanks again,
 --Gabriel

 drivers/firmware/qemu_fw_cfg.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index 7bba76c..cc4c27a 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c

@@ -77,12 +77,26 @@ static inline u16 fw_cfg_sel_endianness(u16 key)
 static inline void fw_cfg_read_blob(u16 key,
 				    void *buf, loff_t pos, size_t count)
 {
+#ifdef CONFIG_ACPI

You should include linux/acpi.h if you use this,
do not rely on some other header to pull this in.

quoted

+	u32 glk;
+	int status;
+	status = acpi_acquire_global_lock(ACPI_WAIT_FOREVER, &glk);

Why not fix up the ACPI api to not require #ifdef here?  It should be
added to a .h file somewhere instead.

Indeed. In fact include/acpi/platform/aclinux.h already has
this code:

#ifndef CONFIG_ACPI

/* External globals for __KERNEL__, stubs is needed */

#define ACPI_GLOBAL(t,a)
#define ACPI_INIT_GLOBAL(t,a,b)

/* Generating stubs for configurable ACPICA macros */

#define ACPI_NO_MEM_ALLOCATIONS

/* Generating stubs for configurable ACPICA functions */

#define ACPI_NO_ERROR_MESSAGES
#undef ACPI_DEBUG_OUTPUT

/* External interface for __KERNEL__, stub is needed */

#define ACPI_EXTERNAL_RETURN_STATUS(prototype) \
        static ACPI_INLINE prototype {return(AE_NOT_CONFIGURED);}
#define ACPI_EXTERNAL_RETURN_OK(prototype) \
        static ACPI_INLINE prototype {return(AE_OK);}
#define ACPI_EXTERNAL_RETURN_VOID(prototype) \
        static ACPI_INLINE prototype {return;}
#define ACPI_EXTERNAL_RETURN_UINT32(prototype) \
        static ACPI_INLINE prototype {return(0);}
#define ACPI_EXTERNAL_RETURN_PTR(prototype) \
        static ACPI_INLINE prototype {return(NULL);}

#endif                          /* CONFIG_ACPI */


so it's just a question of testing the return code for AE_NOT_CONFIGURED.

-- 
MST
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html