[PATCH v2 0/2] fsi: sbefifo: fixes

[PATCH v2 0/2] fsi: sbefifo: fixes

[Ninad Palsule]

Hello,
Please review the version 2 of patchset. I have incorporated review
comments by Joel.

Ninad Palsule (2):
  fsi: sbefifo: Bump up user write cmd length
  fsi: sbefifo: Validate pending user write

 drivers/fsi/fsi-sbefifo.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

-- 
2.39.2

[PATCH v2 1/2] fsi: sbefifo: Bump up user write cmd length

[Ninad Palsule]

This commit increases user write limit for command length from 1MB to
4MB. This is required to support images larger than 1MB.

As per 'commit 15e2a7218c27 ("fsi: sbefifo: Bump max command length")'
the alternate solution is to break image into 1MB pieces by cronous
server that means kernel driver needs to provide way to send end of
message command once all pieces are transferred. This requires
restructuring of both kernel driver and cronus server (application).
Hence this commit chose to bump up cmd length to reduce code impact.

Testing:
  Loaded 3 MB image through cronus server.

Signed-off-by: Ninad Palsule <ninad@linux.ibm.com>
---
v2:
  - Add the cmd length check back and changed it to 4MB
---
 drivers/fsi/fsi-sbefifo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
index 9912b7a6a4b9..a95b32461f8f 100644
--- a/drivers/fsi/fsi-sbefifo.c
+++ b/drivers/fsi/fsi-sbefifo.c
@@ -113,7 +113,7 @@ enum sbe_state
 #define SBEFIFO_TIMEOUT_IN_RSP		1000
 
 /* Other constants */
-#define SBEFIFO_MAX_USER_CMD_LEN	(0x100000 + PAGE_SIZE)
+#define SBEFIFO_MAX_USER_CMD_LEN       (0x400000 + PAGE_SIZE)
 #define SBEFIFO_RESET_MAGIC		0x52534554 /* "RSET" */
 
 struct sbefifo {
-- 
2.39.2

[PATCH v2 2/2] fsi: sbefifo: Validate pending user write

[Ninad Palsule]

This commit rejects user write operation if previous write operation is
still pending.

As per the current kernel driver design, write operation prepares a
buffer for FSI write, the actual FSI write is performed on next read
operation. There is a possibility of memory leak if buggy application
sends two back to back writes or two parallel writes.

Signed-off-by: Ninad Palsule <ninad@linux.ibm.com>
---
 drivers/fsi/fsi-sbefifo.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
index a95b32461f8f..fc41cdd6e890 100644
--- a/drivers/fsi/fsi-sbefifo.c
+++ b/drivers/fsi/fsi-sbefifo.c
@@ -877,6 +877,12 @@ static ssize_t sbefifo_user_write(struct file *file, const char __user *buf,
 
 	mutex_lock(&user->file_lock);
 
+	/* Previous write is still in progress */
+	if (user->pending_cmd) {
+		mutex_unlock(&user->file_lock);
+		return -EALREADY;
+	}
+
 	/* Can we use the pre-allocate buffer ? If not, allocate */
 	if (len <= PAGE_SIZE)
 		user->pending_cmd = user->cmd_page;
-- 
2.39.2