[PATCH v3 0/2] fsi: sbefifo: fixes

[PATCH v3 0/2] fsi: sbefifo: fixes

[Ninad Palsule]

Hello,
Please review the version 3 of the patchset. I have incorporated review
comments by Eddie.

Ninad Palsule (2):
  fsi: sbefifo: Bump up user write cmd length
  fsi: sbefifo: Handle pending write command

 drivers/fsi/fsi-sbefifo.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

-- 
2.39.2

[PATCH v3 1/2] fsi: sbefifo: Bump up user write cmd length

[Ninad Palsule]

This commit increases user write limit for command length from 1MB to
4MB. This is required to support images larger than 1MB.

As per 'commit 15e2a7218c27 ("fsi: sbefifo: Bump max command length")'
the alternate solution is to break image into 1MB pieces by cronous
server that means kernel driver needs to provide way to send end of
message command once all pieces are transferred. This requires
restructuring of both kernel driver and cronus server (application).
Hence this commit chose to bump up cmd length to reduce code impact.

Testing:
  Loaded 3 MB image through cronus server.

Signed-off-by: Ninad Palsule <ninad@linux.ibm.com>
---
v2:
  - Add the cmd length check back and changed it to 4MB
---
 drivers/fsi/fsi-sbefifo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
index 9912b7a6a4b9a..a95b32461f8f3 100644
--- a/drivers/fsi/fsi-sbefifo.c
+++ b/drivers/fsi/fsi-sbefifo.c
@@ -113,7 +113,7 @@ enum sbe_state
 #define SBEFIFO_TIMEOUT_IN_RSP		1000
 
 /* Other constants */
-#define SBEFIFO_MAX_USER_CMD_LEN	(0x100000 + PAGE_SIZE)
+#define SBEFIFO_MAX_USER_CMD_LEN       (0x400000 + PAGE_SIZE)
 #define SBEFIFO_RESET_MAGIC		0x52534554 /* "RSET" */
 
 struct sbefifo {
-- 
2.39.2

[PATCH v3 2/2] fsi: sbefifo: Handle pending write command

[Ninad Palsule]

If previous write command is still pending then free it first.

As per the current kernel driver design, write operation prepares a
buffer for FSI write, the actual FSI write is performed on next read
operation. There is a possibility of memory leak if buggy application
sends two back to back writes or two parallel writes.

Signed-off-by: Ninad Palsule <ninad@linux.ibm.com>
---
v3:
  - Incorporated review comments by Eddie.
---
 drivers/fsi/fsi-sbefifo.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
index a95b32461f8f3..1cc88a78e588a 100644
--- a/drivers/fsi/fsi-sbefifo.c
+++ b/drivers/fsi/fsi-sbefifo.c
@@ -877,6 +877,13 @@ static ssize_t sbefifo_user_write(struct file *file, const char __user *buf,
 
 	mutex_lock(&user->file_lock);
 
+	/* If previous write command is still pending then free it. It is safe
+	 * to do that because read cannot be in progress since we hold the
+	 * lock.
+	 */
+	if (user->pending_cmd)
+		sbefifo_release_command(user);
+
 	/* Can we use the pre-allocate buffer ? If not, allocate */
 	if (len <= PAGE_SIZE)
 		user->pending_cmd = user->cmd_page;
-- 
2.39.2

Re: [PATCH v3 1/2] fsi: sbefifo: Bump up user write cmd length

[Eddie James]

On 10/10/23 15:43, Ninad Palsule wrote:
> This commit increases user write limit for command length from 1MB to
> 4MB. This is required to support images larger than 1MB.
>
> As per 'commit 15e2a7218c27 ("fsi: sbefifo: Bump max command length")'
> the alternate solution is to break image into 1MB pieces by cronous
> server that means kernel driver needs to provide way to send end of
> message command once all pieces are transferred. This requires
> restructuring of both kernel driver and cronus server (application).
> Hence this commit chose to bump up cmd length to reduce code impact.
>
> Testing:
>    Loaded 3 MB image through cronus server.


Reviewed-by: Eddie James <eajames@linux.ibm.com>


>
> Signed-off-by: Ninad Palsule <ninad@linux.ibm.com>
> ---
> v2:
>    - Add the cmd length check back and changed it to 4MB
> ---
>   drivers/fsi/fsi-sbefifo.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
> index 9912b7a6a4b9a..a95b32461f8f3 100644
> --- a/drivers/fsi/fsi-sbefifo.c
> +++ b/drivers/fsi/fsi-sbefifo.c
> @@ -113,7 +113,7 @@ enum sbe_state
>   #define SBEFIFO_TIMEOUT_IN_RSP		1000
>   
>   /* Other constants */
> -#define SBEFIFO_MAX_USER_CMD_LEN	(0x100000 + PAGE_SIZE)
> +#define SBEFIFO_MAX_USER_CMD_LEN       (0x400000 + PAGE_SIZE)
>   #define SBEFIFO_RESET_MAGIC		0x52534554 /* "RSET" */
>   
>   struct sbefifo {

Re: [PATCH v3 2/2] fsi: sbefifo: Handle pending write command

[Eddie James]

On 10/10/23 15:43, Ninad Palsule wrote:
> If previous write command is still pending then free it first.
>
> As per the current kernel driver design, write operation prepares a
> buffer for FSI write, the actual FSI write is performed on next read
> operation. There is a possibility of memory leak if buggy application
> sends two back to back writes or two parallel writes.


Reviewed-by: Eddie James <eajames@linux.ibm.com>


>
> Signed-off-by: Ninad Palsule <ninad@linux.ibm.com>
> ---
> v3:
>    - Incorporated review comments by Eddie.
> ---
>   drivers/fsi/fsi-sbefifo.c | 7 +++++++
>   1 file changed, 7 insertions(+)
>
> diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
> index a95b32461f8f3..1cc88a78e588a 100644
> --- a/drivers/fsi/fsi-sbefifo.c
> +++ b/drivers/fsi/fsi-sbefifo.c
> @@ -877,6 +877,13 @@ static ssize_t sbefifo_user_write(struct file *file, const char __user *buf,
>   
>   	mutex_lock(&user->file_lock);
>   
> +	/* If previous write command is still pending then free it. It is safe
> +	 * to do that because read cannot be in progress since we hold the
> +	 * lock.
> +	 */
> +	if (user->pending_cmd)
> +		sbefifo_release_command(user);
> +
>   	/* Can we use the pre-allocate buffer ? If not, allocate */
>   	if (len <= PAGE_SIZE)
>   		user->pending_cmd = user->cmd_page;