From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753147AbcKIJZs (ORCPT <rfc822;w@1wt.eu>);
        Wed, 9 Nov 2016 04:25:48 -0500
Received: from Galois.linutronix.de ([146.0.238.70]:57167 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751647AbcKIJZp (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 9 Nov 2016 04:25:45 -0500
Date: Wed, 9 Nov 2016 10:23:05 +0100 (CET)
From: Thomas Gleixner <tglx@linutronix.de>
To: Lu Baolu <baolu.lu@linux.intel.com>
cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Mathias Nyman <mathias.nyman@linux.intel.com>,
        Ingo Molnar <mingo@redhat.com>, linux-usb@vger.kernel.org,
        x86@kernel.org, LKML <linux-kernel@vger.kernel.org>,
        Peter Zijlstra <peterz@infradead.org>
Subject: Re: [PATCH v4 1/4] usb: dbc: early driver for xhci debug
 capability
In-Reply-To: <1477976354-13291-2-git-send-email-baolu.lu@linux.intel.com>
Message-ID: <alpine.DEB.2.20.1611091015170.3501@nanos>
References: <1477976354-13291-1-git-send-email-baolu.lu@linux.intel.com> <1477976354-13291-2-git-send-email-baolu.lu@linux.intel.com>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, 1 Nov 2016, Lu Baolu wrote:
> +static int __init xdbc_init(void)
> +{
...
> +	base = ioremap_nocache(xdbc.xhci_start, xdbc.xhci_length);
> +	if (!base) {
> +		xdbc_trace("failed to remap the io address\n");
> +		ret = -ENOMEM;
> +		goto free_and_quit;
> +	}
> +
> +	early_iounmap(xdbc.xhci_base, xdbc.xhci_length);
> +	xdbc_trace("early mapped IO address released\n");
> +
> +	xdbc.xhci_base = base;
> +	offset = xhci_find_next_ext_cap(xdbc.xhci_base, 0, XHCI_EXT_CAPS_DEBUG);
> +	xdbc.xdbc_reg = (struct xdbc_regs __iomem *)(xdbc.xhci_base + offset);

This is broken. What prevents that 

     - a printk is in progress on another cpu?

     - a printk happens between the unmap and storing the new base ?

Nothing AFAICT. So this needs to be done in a safe way. And just making it

	oldbase = xdbc.xhci_base;
	base = ioremap(....);
	xdbc.xhci_base = base;
	early_iounmap(oldbase);

does not work either because the compiler can rightfully cache
xdbc.xhci_base in the write related functions. The same issue with
xdbc.xdbc_reg.

Thanks,

	tglx