From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C0E4C2D0A3 for ; Mon, 9 Nov 2020 13:41:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0971C20731 for ; Mon, 9 Nov 2020 13:41:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HxXrRMJM" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733161AbgKINlq (ORCPT ); Mon, 9 Nov 2020 08:41:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55648 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732868AbgKINlp (ORCPT ); Mon, 9 Nov 2020 08:41:45 -0500 Received: from mail-qk1-x744.google.com (mail-qk1-x744.google.com [IPv6:2607:f8b0:4864:20::744]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D1A2C0613CF; Mon, 9 Nov 2020 05:41:45 -0800 (PST) Received: by mail-qk1-x744.google.com with SMTP id q22so581663qkq.6; Mon, 09 Nov 2020 05:41:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=6suTyo4TXlaNokCXSHMT1l0mhWwQ6HTAA/EgSaVZH8k=; b=HxXrRMJMDA3c0CXRKUCj5J6ueLRDZHlb5EsKxs0hvHoqjciEx8fJRXKM8QJo20cbj5 zhEe5qS9PbAk9ph8fVZO+h0zb3tzpAaq6BtHcT6CpxG7tHZCuyw9zifJGf6YezGwiYB3 LJVmGTthjqgG/4yxS1DXPlOqd+Nlu3MR+3XrOvzthf0du8maGbpc25AFFblD8hSIEt65 zZB0QRiYeUmZIaFprd2ovYaasK+9QFhgJPOj/IeS/vw/eGupQs8OWXfX/6v1p4JMPHlG cxxrn4/tqgWhBpOuN6P2/12oD9pSjmGfLQRkBgNwpqrW57As9nyi2h1Xt4uc/D80kGes aKJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=6suTyo4TXlaNokCXSHMT1l0mhWwQ6HTAA/EgSaVZH8k=; b=cIiV7ya7rPxHrqmx89Qy8fIwAQbRkujKPAk0qV061Wx+C9nIDPN/P4WftGVsn4Cv9X 2TrPXs0ctKzeRROVaDUQqZZxrNUy2KZxg5vMI68XDQR9L0PJLESmudyap72mjx5LlY3C AtTB71ToOdU3MCiGLJdfoEmX1XjAdjc5N0TWbf8xix3zbds/y1e6b93b5EAWCLmis+TK uMdE7oaljFWowM+R98TyYO6/sWOXPaSTPadiZSGCsEZP+7FYBdXKFz/9k1vb4Dm9nW1s iRowF0gnQzv8RdCFUB99EBz/kH0mpu8CqlbFBlbNf1Bb+Ve8ZZBEMDDMlAMXGiAtkMfO lpAw== X-Gm-Message-State: AOAM53106giz8QLWZymAsRy0NHc9bcMpAZO21J9wfTxe+HEHJvcVbB3t uP53a6XuBjyAI6zUlk32oHQ= X-Google-Smtp-Source: ABdhPJyI5eMgEbZkAVel5Tv5l3zwCXrtrLf2cCo7PxplIsv2Zw4jKq/hneWxBtta0zpYtrGfDXTfiA== X-Received: by 2002:a05:620a:10a3:: with SMTP id h3mr2820364qkk.459.1604929304530; Mon, 09 Nov 2020 05:41:44 -0800 (PST) Received: from shinobu (072-189-064-225.res.spectrum.com. [72.189.64.225]) by smtp.gmail.com with ESMTPSA id l125sm6214424qkc.111.2020.11.09.05.41.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2020 05:41:43 -0800 (PST) Date: Mon, 9 Nov 2020 08:41:28 -0500 From: William Breathitt Gray To: Arnd Bergmann , Syed Nayyar Waris Cc: Linus Walleij , Andrew Morton , "open list:GPIO SUBSYSTEM" , "linux-kernel@vger.kernel.org" , Michal Simek , Bartosz Golaszewski , Andy Shevchenko , Linux ARM Subject: Re: [PATCH v12 4/4] gpio: xilinx: Utilize generic bitmap_get_value and _set_value Message-ID: <20201109134128.GA5596@shinobu> References: <15a044d3ba23f00c31fd09437bdd3e5924bb91cd.1603055402.git.syednwaris@gmail.com> <20201101150033.GA68138@shinobu> <20201109123411.GA19869@syed> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="k+w/mQv8wyuph6w0" Content-Disposition: inline In-Reply-To: <20201109123411.GA19869@syed> Precedence: bulk List-ID: X-Mailing-List: linux-gpio@vger.kernel.org --k+w/mQv8wyuph6w0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Nov 09, 2020 at 06:04:11PM +0530, Syed Nayyar Waris wrote: > On Sun, Nov 01, 2020 at 09:08:29PM +0100, Arnd Bergmann wrote: > > On Sun, Nov 1, 2020 at 4:00 PM William Breathitt Gray > > wrote: > > > > > > On Thu, Oct 29, 2020 at 11:44:47PM +0100, Arnd Bergmann wrote: > > > > On Sun, Oct 18, 2020 at 11:44 PM Syed Nayyar Waris wrote: > > > > > > > > > > This patch reimplements the xgpio_set_multiple() function in > > > > > drivers/gpio/gpio-xilinx.c to use the new generic functions: > > > > > bitmap_get_value() and bitmap_set_value(). The code is now simpler > > > > > to read and understand. Moreover, instead of looping for each bit > > > > > in xgpio_set_multiple() function, now we can check each channel at > > > > > a time and save cycles. > > > > > > > > This now causes -Wtype-limits warnings in linux-next with gcc-10: > > > > > > Hi Arnd, > > > > > > What version of gcc-10 are you running? I'm having trouble generating > > > these warnings so I suspect I'm using a different version than you. > >=20 > > I originally saw it with the binaries from > > https://mirrors.edge.kernel.org/pub/tools/crosstool/, but I have > > also been able to reproduce it with a minimal test case on the > > binaries from godbolt.org, see https://godbolt.org/z/Wq8q4n > >=20 > > > Let me first verify that I understand the problem correctly. The issue > > > is the possibility of a stack smash in bitmap_set_value() when the va= lue > > > of start + nbits is larger than the length of the map bitmap memory > > > region. This is because index (or index + 1) could be outside the ran= ge > > > of the bitmap memory region passed in as map. Is my understanding > > > correct here? > >=20 > > Yes, that seems to be the case here. > >=20 > > > In xgpio_set_multiple(), the variables width[0] and width[1] serve as > > > possible start and nbits values for the bitmap_set_value() calls. > > > Because width[0] and width[1] are unsigned int variables, GCC conside= rs > > > the possibility that the value of width[0]/width[1] might exceed the > > > length of the bitmap memory region named old and thus result in a sta= ck > > > smash. > > > > > > I don't know if invalid width values are actually possible for the > > > Xilinx gpio device, but let's err on the side of safety and assume th= is > > > is actually a possibility. We should verify that the combined value of > > > gpio_width[0] + gpio_width[1] does not exceed 64 bits; we can add a > > > check for this in xgpio_probe() when we grab the gpio_width values. > > > > > > However, we're still left with the GCC warnings because GCC is not sm= art > > > enough to know that we've already checked the boundary and width[0] a= nd > > > width[1] are valid values. I suspect we can avoid this warning is we > > > refactor bitmap_set_value() to increment map seperately and then set = it: > >=20 > > As I understand it, part of the problem is that gcc sees the possible > > range as being constrained by the operations on 'start' and 'nbits', > > in particular the shift in BIT_WORD() that put an upper bound on > > the index, but then it sees that the upper bound is higher than the > > upper bound of the array, i.e. element zero. > >=20 > > I added a check > >=20 > > if (start >=3D 64 || start + size >=3D 64) return; > >=20 > > in the godbolt.org testcase, which does help limit the start > > index appropriately, but it is not sufficient to let the compiler > > see that the 'if (space >=3D nbits) ' condition is guaranteed to > > be true for all values here. > >=20 > > > static inline void bitmap_set_value(unsigned long *map, > > > unsigned long value, > > > unsigned long start, unsigned lon= g nbits) > > > { > > > const unsigned long offset =3D start % BITS_PER_LONG; > > > const unsigned long ceiling =3D round_up(start + 1, BITS_PER_= LONG); > > > const unsigned long space =3D ceiling - start; > > > > > > map +=3D BIT_WORD(start); > > > value &=3D GENMASK(nbits - 1, 0); > > > > > > if (space >=3D nbits) { > > > *map &=3D ~(GENMASK(nbits - 1, 0) << offset); > > > *map |=3D value << offset; > > > } else { > > > *map &=3D ~BITMAP_FIRST_WORD_MASK(start); > > > *map |=3D value << offset; > > > map++; > > > *map &=3D ~BITMAP_LAST_WORD_MASK(start + nbits); > > > *map |=3D value >> space; > > > } > > > } > > > > > > This avoids adding a costly conditional check inside bitmap_set_value= () > > > when almost all bitmap_set_value() calls will have static arguments w= ith > > > well-defined and obvious boundaries. > > > > > > Do you think this would be an acceptable solution to resolve your GCC > > > warnings? > >=20 > > Unfortunately, it does not seem to make a difference, as gcc still > > knows that this compiles to the same result, and it produces the same > > warning as before (see https://godbolt.org/z/rjx34r) > >=20 > > Arnd >=20 > Hi Arnd, >=20 > Sharing a different version of bitmap_set_valuei() function. See below. >=20 > Let me know if the below solution looks good to you and if it resolves > the above compiler warning. >=20 >=20 > @@ -1,5 +1,5 @@ > static inline void bitmap_set_value(unsigned long *map, > - unsigned long value, > + unsigned long value, const size_t le= ngth, > unsigned long start, unsigned long n= bits) > { > const size_t index =3D BIT_WORD(start); > @@ -7,6 +7,9 @@ static inline void bitmap_set_value(unsigned long *map, > const unsigned long ceiling =3D round_up(start + 1, BITS_PER_LON= G); > const unsigned long space =3D ceiling - start; > =20 > + if (index >=3D length) > + return; > + > value &=3D GENMASK(nbits - 1, 0); > =20 > if (space >=3D nbits) { > @@ -15,6 +18,10 @@ static inline void bitmap_set_value(unsigned long *map, > } else { > map[index + 0] &=3D ~BITMAP_FIRST_WORD_MASK(start); > map[index + 0] |=3D value << offset; > + > + if (index + 1 >=3D length) > + return; > + > map[index + 1] &=3D ~BITMAP_LAST_WORD_MASK(start + nbits= ); > map[index + 1] |=3D value >> space; > } One of my concerns is that we're incurring the latency two additional conditional checks just to suppress a compiler warning about a case that wouldn't occur in the actual use of bitmap_set_value(). I'm hoping there's a way for us to suppress these warnings without adding onto the latency of this function; given that bitmap_set_value() is intended to be used in loops, conditionals here could significantly increase latency in drivers. I wonder if array_index_nospec() might have the side effect of suppressing these warnings for us. For example, would this work: static inline void bitmap_set_value(unsigned long *map, unsigned long value, unsigned long start, unsigned long nbits) { const unsigned long offset =3D start % BITS_PER_LONG; const unsigned long ceiling =3D round_up(start + 1, BITS_PER_LONG); const unsigned long space =3D ceiling - start; size_t index =3D BIT_WORD(start); value &=3D GENMASK(nbits - 1, 0); if (space >=3D nbits) { index =3D array_index_nospec(index, index + 1); map[index] &=3D ~(GENMASK(nbits - 1, 0) << offset); map[index] |=3D value << offset; } else { index =3D array_index_nospec(index, index + 2); map[index + 0] &=3D ~BITMAP_FIRST_WORD_MASK(start); map[index + 0] |=3D value << offset; map[index + 1] &=3D ~BITMAP_LAST_WORD_MASK(start + nbits); map[index + 1] |=3D value >> space; } } Or is this going to produce the same warning because we're not using an explicit check against the map array size? William Breathitt Gray --k+w/mQv8wyuph6w0 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEk5I4PDJ2w1cDf/bghvpINdm7VJIFAl+pRvQACgkQhvpINdm7 VJJpyQ//bhvn/+QqYckOWct6OuWH4FmJK16nBeN5cVHQfhgnIZZ0PplxJ9l7JaLd 7xCphMvKonQXLBzNBdKpRLxIBZEt7qG3Fc3b4VBkEdV1iUGLQ2YddoMbwJdNYpt3 WxaP81/eDq6SJrKqy6+3RB3S/fkfzywYMVLYnXnt1Di6Z7JsRD28vWdMvZC2CdM9 yKxdHkxn/VqjaS6czPlAwlElKG+YvKv2wSyzSoj9dIBNd1WdFH4zLi8DxZPe/jtd gtCWqpzI80pDLMH+WGyh8vKqfGmccohZ5QYsaNJBbexa473BjZlovrt+Krsdoeho UvP0Urn5DRRZDyuPQ57VOhNnCbv01g4/+UD/pnh/JvpduXph9O14KvlTkplC8H2f ibhan9bywAHwoZuup+oWak+hZgPT6+W4GXxwvLhIFRUY+jXsCzs5FcSeqCjlOGcf pPToEoWGnhKuO/nrgxbIHaDzH7JAa7IYmD7Z9Jzvb5Cv63IeKQj25tf2yBh/AbKD vSaJftmu0ItxbRrFGFVV15Ju0mYZFZSYJ5Eisa5YWhin8IilFV2G4wR9j86/iVDE 9xrovGSEwpjnLZrfjAyecXwJfr4VbPBocYhq4dwbx0yi8kbDmJcahU9W8r7opfVU NxmDdy28i/hGCzqkiqhTpST71FZEJvope2elB+T1wTID5LYaHkc= =wbBm -----END PGP SIGNATURE----- --k+w/mQv8wyuph6w0-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,DKIM_VALID,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0AF1C388F7 for ; Mon, 9 Nov 2020 13:42:19 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3EF352068D for ; Mon, 9 Nov 2020 13:42:19 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="b51oXqa1"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HxXrRMJM" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3EF352068D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Type:Cc: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: In-Reply-To:MIME-Version:References:Message-ID:Subject:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=faBF5cggTdkSjbx2ToaO0XvDfCltA69oo6buGL+xuOA=; b=b51oXqa1gmzslA/ULuoQAb1hS tcPDUT2/ndUP2ijIlDP2ewLtPI4U1Lrs9HzIRfh9y6NecBVnBooZUPoejOnpFvySELFpMSSonXqwM db2rofolP9pfuQsliv+JoUS0gdWoVSiwcaeIKIxZxs7xjwVdbWq7Qe5TpoQ/lyCif7loGVml4+G9Y E6Q5YzmzV5f/JVvFwSlRtd+gnAWitX3eYXiG49zGRzNucsuOFcZzF2+ommWtX9ID8yu59UdXJlB13 e0w4+hR/ZdppYHFxNbgLq90GXsA+uXhfSnKbVIFqnnk1MmtNG21VllBswXxD65GQbCQ5xDfumaHNA AV5uUTBgQ==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kc7Qd-0004Vk-U8; Mon, 09 Nov 2020 13:41:52 +0000 Received: from mail-qk1-x744.google.com ([2607:f8b0:4864:20::744]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kc7QZ-0004UA-Pn for linux-arm-kernel@lists.infradead.org; Mon, 09 Nov 2020 13:41:49 +0000 Received: by mail-qk1-x744.google.com with SMTP id t191so6666764qka.4 for ; Mon, 09 Nov 2020 05:41:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=6suTyo4TXlaNokCXSHMT1l0mhWwQ6HTAA/EgSaVZH8k=; b=HxXrRMJMDA3c0CXRKUCj5J6ueLRDZHlb5EsKxs0hvHoqjciEx8fJRXKM8QJo20cbj5 zhEe5qS9PbAk9ph8fVZO+h0zb3tzpAaq6BtHcT6CpxG7tHZCuyw9zifJGf6YezGwiYB3 LJVmGTthjqgG/4yxS1DXPlOqd+Nlu3MR+3XrOvzthf0du8maGbpc25AFFblD8hSIEt65 zZB0QRiYeUmZIaFprd2ovYaasK+9QFhgJPOj/IeS/vw/eGupQs8OWXfX/6v1p4JMPHlG cxxrn4/tqgWhBpOuN6P2/12oD9pSjmGfLQRkBgNwpqrW57As9nyi2h1Xt4uc/D80kGes aKJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=6suTyo4TXlaNokCXSHMT1l0mhWwQ6HTAA/EgSaVZH8k=; b=DGQO4SltglfH8/g7IqzOHLXhB3GkWNlFovyO0RvpCaZemUy5Fx18310tGLC4bBshxw zyyAqTjBBLa/mmT9f4jZbxrFU0ujinxYjxiTwG0Gi79Hp5xU9XVaZnArKWHBgj6DKjPl yBZ585OO6ar9cUH8dFCXxiz6VlgUDRarHZbyyvpE62Ap5tsu6G5y9555uCor2yF92mQ4 OtYH5juqIZjwX72MvS+7Q3M0Pdf65En56ZTvssXOttVmm7aY2BWeNx1dIDtnAfUVMvAa UpFyrKwAFNKH2/HWhKrXdgJT1/IB9DD6B4gA5xE7wPAUqq+3mBOvPEIUiZAPFYovFHAo gIqQ== X-Gm-Message-State: AOAM53374A1FiPpkE8drgutqTkN3iN5uuM4eGtGBQVL8MlPDWBryJR8O 6yztJUxxU5a9ulCHCm/NygA= X-Google-Smtp-Source: ABdhPJyI5eMgEbZkAVel5Tv5l3zwCXrtrLf2cCo7PxplIsv2Zw4jKq/hneWxBtta0zpYtrGfDXTfiA== X-Received: by 2002:a05:620a:10a3:: with SMTP id h3mr2820364qkk.459.1604929304530; Mon, 09 Nov 2020 05:41:44 -0800 (PST) Received: from shinobu (072-189-064-225.res.spectrum.com. [72.189.64.225]) by smtp.gmail.com with ESMTPSA id l125sm6214424qkc.111.2020.11.09.05.41.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2020 05:41:43 -0800 (PST) Date: Mon, 9 Nov 2020 08:41:28 -0500 From: William Breathitt Gray To: Arnd Bergmann , Syed Nayyar Waris Subject: Re: [PATCH v12 4/4] gpio: xilinx: Utilize generic bitmap_get_value and _set_value Message-ID: <20201109134128.GA5596@shinobu> References: <15a044d3ba23f00c31fd09437bdd3e5924bb91cd.1603055402.git.syednwaris@gmail.com> <20201101150033.GA68138@shinobu> <20201109123411.GA19869@syed> MIME-Version: 1.0 In-Reply-To: <20201109123411.GA19869@syed> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201109_084147_904745_5E20B05C X-CRM114-Status: GOOD ( 51.25 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Bartosz Golaszewski , Linus Walleij , Michal Simek , "linux-kernel@vger.kernel.org" , "open list:GPIO SUBSYSTEM" , Andrew Morton , Andy Shevchenko , Linux ARM Content-Type: multipart/mixed; boundary="===============7220119566637987265==" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org --===============7220119566637987265== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="k+w/mQv8wyuph6w0" Content-Disposition: inline --k+w/mQv8wyuph6w0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Nov 09, 2020 at 06:04:11PM +0530, Syed Nayyar Waris wrote: > On Sun, Nov 01, 2020 at 09:08:29PM +0100, Arnd Bergmann wrote: > > On Sun, Nov 1, 2020 at 4:00 PM William Breathitt Gray > > wrote: > > > > > > On Thu, Oct 29, 2020 at 11:44:47PM +0100, Arnd Bergmann wrote: > > > > On Sun, Oct 18, 2020 at 11:44 PM Syed Nayyar Waris wrote: > > > > > > > > > > This patch reimplements the xgpio_set_multiple() function in > > > > > drivers/gpio/gpio-xilinx.c to use the new generic functions: > > > > > bitmap_get_value() and bitmap_set_value(). The code is now simpler > > > > > to read and understand. Moreover, instead of looping for each bit > > > > > in xgpio_set_multiple() function, now we can check each channel at > > > > > a time and save cycles. > > > > > > > > This now causes -Wtype-limits warnings in linux-next with gcc-10: > > > > > > Hi Arnd, > > > > > > What version of gcc-10 are you running? I'm having trouble generating > > > these warnings so I suspect I'm using a different version than you. > >=20 > > I originally saw it with the binaries from > > https://mirrors.edge.kernel.org/pub/tools/crosstool/, but I have > > also been able to reproduce it with a minimal test case on the > > binaries from godbolt.org, see https://godbolt.org/z/Wq8q4n > >=20 > > > Let me first verify that I understand the problem correctly. The issue > > > is the possibility of a stack smash in bitmap_set_value() when the va= lue > > > of start + nbits is larger than the length of the map bitmap memory > > > region. This is because index (or index + 1) could be outside the ran= ge > > > of the bitmap memory region passed in as map. Is my understanding > > > correct here? > >=20 > > Yes, that seems to be the case here. > >=20 > > > In xgpio_set_multiple(), the variables width[0] and width[1] serve as > > > possible start and nbits values for the bitmap_set_value() calls. > > > Because width[0] and width[1] are unsigned int variables, GCC conside= rs > > > the possibility that the value of width[0]/width[1] might exceed the > > > length of the bitmap memory region named old and thus result in a sta= ck > > > smash. > > > > > > I don't know if invalid width values are actually possible for the > > > Xilinx gpio device, but let's err on the side of safety and assume th= is > > > is actually a possibility. We should verify that the combined value of > > > gpio_width[0] + gpio_width[1] does not exceed 64 bits; we can add a > > > check for this in xgpio_probe() when we grab the gpio_width values. > > > > > > However, we're still left with the GCC warnings because GCC is not sm= art > > > enough to know that we've already checked the boundary and width[0] a= nd > > > width[1] are valid values. I suspect we can avoid this warning is we > > > refactor bitmap_set_value() to increment map seperately and then set = it: > >=20 > > As I understand it, part of the problem is that gcc sees the possible > > range as being constrained by the operations on 'start' and 'nbits', > > in particular the shift in BIT_WORD() that put an upper bound on > > the index, but then it sees that the upper bound is higher than the > > upper bound of the array, i.e. element zero. > >=20 > > I added a check > >=20 > > if (start >=3D 64 || start + size >=3D 64) return; > >=20 > > in the godbolt.org testcase, which does help limit the start > > index appropriately, but it is not sufficient to let the compiler > > see that the 'if (space >=3D nbits) ' condition is guaranteed to > > be true for all values here. > >=20 > > > static inline void bitmap_set_value(unsigned long *map, > > > unsigned long value, > > > unsigned long start, unsigned lon= g nbits) > > > { > > > const unsigned long offset =3D start % BITS_PER_LONG; > > > const unsigned long ceiling =3D round_up(start + 1, BITS_PER_= LONG); > > > const unsigned long space =3D ceiling - start; > > > > > > map +=3D BIT_WORD(start); > > > value &=3D GENMASK(nbits - 1, 0); > > > > > > if (space >=3D nbits) { > > > *map &=3D ~(GENMASK(nbits - 1, 0) << offset); > > > *map |=3D value << offset; > > > } else { > > > *map &=3D ~BITMAP_FIRST_WORD_MASK(start); > > > *map |=3D value << offset; > > > map++; > > > *map &=3D ~BITMAP_LAST_WORD_MASK(start + nbits); > > > *map |=3D value >> space; > > > } > > > } > > > > > > This avoids adding a costly conditional check inside bitmap_set_value= () > > > when almost all bitmap_set_value() calls will have static arguments w= ith > > > well-defined and obvious boundaries. > > > > > > Do you think this would be an acceptable solution to resolve your GCC > > > warnings? > >=20 > > Unfortunately, it does not seem to make a difference, as gcc still > > knows that this compiles to the same result, and it produces the same > > warning as before (see https://godbolt.org/z/rjx34r) > >=20 > > Arnd >=20 > Hi Arnd, >=20 > Sharing a different version of bitmap_set_valuei() function. See below. >=20 > Let me know if the below solution looks good to you and if it resolves > the above compiler warning. >=20 >=20 > @@ -1,5 +1,5 @@ > static inline void bitmap_set_value(unsigned long *map, > - unsigned long value, > + unsigned long value, const size_t le= ngth, > unsigned long start, unsigned long n= bits) > { > const size_t index =3D BIT_WORD(start); > @@ -7,6 +7,9 @@ static inline void bitmap_set_value(unsigned long *map, > const unsigned long ceiling =3D round_up(start + 1, BITS_PER_LON= G); > const unsigned long space =3D ceiling - start; > =20 > + if (index >=3D length) > + return; > + > value &=3D GENMASK(nbits - 1, 0); > =20 > if (space >=3D nbits) { > @@ -15,6 +18,10 @@ static inline void bitmap_set_value(unsigned long *map, > } else { > map[index + 0] &=3D ~BITMAP_FIRST_WORD_MASK(start); > map[index + 0] |=3D value << offset; > + > + if (index + 1 >=3D length) > + return; > + > map[index + 1] &=3D ~BITMAP_LAST_WORD_MASK(start + nbits= ); > map[index + 1] |=3D value >> space; > } One of my concerns is that we're incurring the latency two additional conditional checks just to suppress a compiler warning about a case that wouldn't occur in the actual use of bitmap_set_value(). I'm hoping there's a way for us to suppress these warnings without adding onto the latency of this function; given that bitmap_set_value() is intended to be used in loops, conditionals here could significantly increase latency in drivers. I wonder if array_index_nospec() might have the side effect of suppressing these warnings for us. For example, would this work: static inline void bitmap_set_value(unsigned long *map, unsigned long value, unsigned long start, unsigned long nbits) { const unsigned long offset =3D start % BITS_PER_LONG; const unsigned long ceiling =3D round_up(start + 1, BITS_PER_LONG); const unsigned long space =3D ceiling - start; size_t index =3D BIT_WORD(start); value &=3D GENMASK(nbits - 1, 0); if (space >=3D nbits) { index =3D array_index_nospec(index, index + 1); map[index] &=3D ~(GENMASK(nbits - 1, 0) << offset); map[index] |=3D value << offset; } else { index =3D array_index_nospec(index, index + 2); map[index + 0] &=3D ~BITMAP_FIRST_WORD_MASK(start); map[index + 0] |=3D value << offset; map[index + 1] &=3D ~BITMAP_LAST_WORD_MASK(start + nbits); map[index + 1] |=3D value >> space; } } Or is this going to produce the same warning because we're not using an explicit check against the map array size? William Breathitt Gray --k+w/mQv8wyuph6w0 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEk5I4PDJ2w1cDf/bghvpINdm7VJIFAl+pRvQACgkQhvpINdm7 VJJpyQ//bhvn/+QqYckOWct6OuWH4FmJK16nBeN5cVHQfhgnIZZ0PplxJ9l7JaLd 7xCphMvKonQXLBzNBdKpRLxIBZEt7qG3Fc3b4VBkEdV1iUGLQ2YddoMbwJdNYpt3 WxaP81/eDq6SJrKqy6+3RB3S/fkfzywYMVLYnXnt1Di6Z7JsRD28vWdMvZC2CdM9 yKxdHkxn/VqjaS6czPlAwlElKG+YvKv2wSyzSoj9dIBNd1WdFH4zLi8DxZPe/jtd gtCWqpzI80pDLMH+WGyh8vKqfGmccohZ5QYsaNJBbexa473BjZlovrt+Krsdoeho UvP0Urn5DRRZDyuPQ57VOhNnCbv01g4/+UD/pnh/JvpduXph9O14KvlTkplC8H2f ibhan9bywAHwoZuup+oWak+hZgPT6+W4GXxwvLhIFRUY+jXsCzs5FcSeqCjlOGcf pPToEoWGnhKuO/nrgxbIHaDzH7JAa7IYmD7Z9Jzvb5Cv63IeKQj25tf2yBh/AbKD vSaJftmu0ItxbRrFGFVV15Ju0mYZFZSYJ5Eisa5YWhin8IilFV2G4wR9j86/iVDE 9xrovGSEwpjnLZrfjAyecXwJfr4VbPBocYhq4dwbx0yi8kbDmJcahU9W8r7opfVU NxmDdy28i/hGCzqkiqhTpST71FZEJvope2elB+T1wTID5LYaHkc= =wbBm -----END PGP SIGNATURE----- --k+w/mQv8wyuph6w0-- --===============7220119566637987265== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel --===============7220119566637987265==--