From nobody Fri Dec 17 07:31:13 2021 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id CA616190372B; Fri, 17 Dec 2021 07:31:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JFgdZ0KvNz3JsK; Fri, 17 Dec 2021 07:31:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id C2FB2179DF; Fri, 17 Dec 2021 07:31:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1BH7VDuP044998; Fri, 17 Dec 2021 07:31:13 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1BH7VDIx044997; Fri, 17 Dec 2021 07:31:13 GMT (envelope-from git) Date: Fri, 17 Dec 2021 07:31:13 GMT Message-Id: <202112170731.1BH7VDIx044997@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Andriy Gapon Subject: git: 86af87acd152 - stable/13 - twsi: make data receiving code safer List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: avg X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 86af87acd152d7b2c9775094b6b2cbf3764c6407 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1639726275; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=p5I3SHrgoS9kjvIeU/CwmrGyuTooS04PF4OmforO4r0=; b=fBk5XpFYMSNnxdQ956Go41Jh9v7qAfL2pYPDBVkSvfo4bP+DXeE54L0SjQpk2lG6Veggx6 1cm0if1442gT9FZt5b3lX8uTT7J5k+GspInt02o2KLxLsl1gAxo+UPE0rjvvu+jlLRV7tM 2x6wIRMZE/3cYbuKyzoikmHCI52S7GZCfX3JEzMpUEhxLkCl6k9NJKtrLC3Nby3xGlU9oc jtzJ1yK6zG6pocu2DXQnUq9guBDVCYa/YetnvVJ0f2Simhgw1K+dm43VlVJdHUAGr5bs0A PehNAIfb6ARx/VtFz5qEXIhOjrd4v2CX6+dhzHrI7J1WeH7kH7cQdrmbpc2LzA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1639726275; a=rsa-sha256; cv=none; b=APR13IstxNGDOtmevTMOX5spGjyIOgxEZJ7+nXNI/kWofazU+m3mfSIItXXur5UKcvhFkH 6vF8O8jCY06PjEMf0dhzppNAs3UMnc9zlNxVSKWonfHEh5m1+O0d6mZjujOTCMDIHofOWT B6Yfx0n688GmN1sHuHQO/waFbf6Lh8IytzBFlV1gHKPdD7MltJz36zoWFWYW/9vsvJOs4V OXo8WTZn3jCAVWLK2cU3GkayEnKSxxw9fTGF8iTsXz/GHIrnZDfo3BAn0mxSwbGc1JuT36 oluspkYWpNuym6egR9jEEBSiVUhYPKh8K6v+1asqHsxHiQrQgB8/xRnbgCGw0A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by avg: URL: https://cgit.FreeBSD.org/src/commit/?id=86af87acd152d7b2c9775094b6b2cbf3764c6407 commit 86af87acd152d7b2c9775094b6b2cbf3764c6407 Author: Andriy Gapon AuthorDate: 2021-11-26 08:34:42 +0000 Commit: Andriy Gapon CommitDate: 2021-12-17 07:30:54 +0000 twsi: make data receiving code safer Assert that we are not receiving data beyond the requested length. Assert that we have not NACK-ed incoming data prematurely. Abort the current transfer if the incoming data is NACK-ed or not NACK-ed unexpectedly. Add debug logging of received data to complement logging of sent data. (cherry picked from commit 00c07d9559c6197957b00811a0b29876a5c8b573) --- sys/dev/iicbus/twsi/twsi.c | 62 ++++++++++++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 21 deletions(-) diff --git a/sys/dev/iicbus/twsi/twsi.c b/sys/dev/iicbus/twsi/twsi.c index b94396883be5..2f77e2dc69c3 100644 --- a/sys/dev/iicbus/twsi/twsi.c +++ b/sys/dev/iicbus/twsi/twsi.c @@ -671,37 +671,57 @@ twsi_intr(void *arg) break; case TWSI_STATUS_DATA_RD_ACK: - debugf(sc, "Ack received after receiving data\n"); - sc->msgs[sc->msg_idx].buf[sc->recv_bytes++] = TWSI_READ(sc, sc->reg_data); - debugf(sc, "msg_len=%d recv_bytes=%d\n", sc->msgs[sc->msg_idx].len, sc->recv_bytes); + debugf(sc, "Received and ACK-ed data\n"); + KASSERT(sc->recv_bytes < sc->msgs[sc->msg_idx].len, + ("receiving beyond the end of buffer")); + + sc->msgs[sc->msg_idx].buf[sc->recv_bytes] = + TWSI_READ(sc, sc->reg_data); + debugf(sc, "Received byte %d (of %d) = 0x%x\n", + sc->recv_bytes, + sc->msgs[sc->msg_idx].len, + sc->msgs[sc->msg_idx].buf[sc->recv_bytes]); + sc->recv_bytes++; /* If we only have one byte left, disable ACK */ - if (sc->msgs[sc->msg_idx].len - sc->recv_bytes == 1) + if (sc->msgs[sc->msg_idx].len - sc->recv_bytes == 1) { sc->control_val &= ~TWSI_CONTROL_ACK; - if (sc->msgs[sc->msg_idx].len == sc->recv_bytes) { - debugf(sc, "Done with msg %d\n", sc->msg_idx); - sc->msg_idx++; - if (sc->msg_idx == sc->nmsgs - 1) { - debugf(sc, "No more msgs\n"); - transfer_done = 1; - sc->error = 0; - } + } else if (sc->msgs[sc->msg_idx].len == sc->recv_bytes) { + /* + * We should not have ACK-ed the last byte. + * The protocol state machine is in invalid state. + */ + debugf(sc, "RX all but asked for more?\n"); + twsi_error(sc, IIC_ESTATUS); } - TWSI_WRITE(sc, sc->reg_control, sc->control_val); break; case TWSI_STATUS_DATA_RD_NOACK: - if (sc->msgs[sc->msg_idx].len - sc->recv_bytes == 1) { - sc->msgs[sc->msg_idx].buf[sc->recv_bytes++] = TWSI_READ(sc, sc->reg_data); - debugf(sc, "Done RX data, send stop (2)\n"); - if (!(sc->msgs[sc->msg_idx].flags & IIC_M_NOSTOP)) + debugf(sc, "Received and NACK-ed data\n"); + KASSERT(sc->recv_bytes == sc->msgs[sc->msg_idx].len - 1, + ("sent NACK before receiving all requested data")); + sc->msgs[sc->msg_idx].buf[sc->recv_bytes] = + TWSI_READ(sc, sc->reg_data); + debugf(sc, "Received byte %d (of %d) = 0x%x\n", + sc->recv_bytes, + sc->msgs[sc->msg_idx].len, + sc->msgs[sc->msg_idx].buf[sc->recv_bytes]); + sc->recv_bytes++; + + if (sc->msgs[sc->msg_idx].len == sc->recv_bytes) { + debugf(sc, "Done RX data\n"); + if (!(sc->msgs[sc->msg_idx].flags & IIC_M_NOSTOP)) { + debugf(sc, "Send STOP\n"); TWSI_WRITE(sc, sc->reg_control, sc->control_val | TWSI_CONTROL_STOP); + } } else { - debugf(sc, "No ack when receiving data, sending stop anyway\n"); - if (!(sc->msgs[sc->msg_idx].flags & IIC_M_NOSTOP)) - TWSI_WRITE(sc, sc->reg_control, - sc->control_val | TWSI_CONTROL_STOP); + /* + * We should not have NACK-ed yet. + * The protocol state machine is in invalid state. + */ + debugf(sc, "NACK-ed before receving all bytes?\n"); + twsi_error(sc, IIC_ESTATUS); } sc->transfer = 0; transfer_done = 1;