Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup

Browse source 
commit 9136291f1dbc1d4d1cacd2840fb35f4f3ce16c46 upstream.

This patch fixes a bug in the XOR driver where the cleanup function can be
called and free descriptors that never been processed by the engine (which
result in data errors).

The cleanup function will free descriptors based on the ownership bit in
the descriptors.

Fixes: ff7b04796d ("dmaengine: DMA engine driver for Marvell XOR engine")
Signed-off-by: Lior Amsalem <alior@marvell.com>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: Ofer Heifetz <oferh@marvell.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
This commit is contained in:
Lior Amsalem 2015-05-26 15:07:32 +02:00 committed by Zefan Li
parent 61473c581d
commit fbd2f7f70b
2 changed files with 47 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

72
drivers/dma/mv_xor.c
View file

@ -390,7 +390,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
dma_cookie_t cookie = 0; dma_cookie_t cookie = 0;
int busy = mv_chan_is_busy(mv_chan); int busy = mv_chan_is_busy(mv_chan);
u32 current_desc = mv_chan_get_current_desc(mv_chan); u32 current_desc = mv_chan_get_current_desc(mv_chan);
int seen_current = 0; int current_cleaned = 0;
struct mv_xor_desc *hw_desc;
dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__); dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__);
dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc); dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc);
@ -402,38 +403,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
list_for_each_entry_safe(iter, _iter, &mv_chan->chain, list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
chain_node) { chain_node) {
prefetch(_iter);
prefetch(&_iter->async_tx);
/* do not advance past the current descriptor loaded into the /* clean finished descriptors */
* hardware channel, subsequent descriptors are either in hw_desc = iter->hw_desc;
* process or have not been submitted if (hw_desc->status & XOR_DESC_SUCCESS) {
*/ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
if (seen_current) cookie);
break;
/* stop the search if we reach the current descriptor and the /* done processing desc, clean slot */
* channel is busy mv_xor_clean_slot(iter, mv_chan);
*/
if (iter->async_tx.phys == current_desc) { /* break if we did cleaned the current */
seen_current = 1; if (iter->async_tx.phys == current_desc) {
if (busy) current_cleaned = 1;
break; break;
}
} else {
if (iter->async_tx.phys == current_desc) {
current_cleaned = 0;
break;
}
} }
cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
if (mv_xor_clean_slot(iter, mv_chan))
break;
} }
if ((busy == 0) && !list_empty(&mv_chan->chain)) { if ((busy == 0) && !list_empty(&mv_chan->chain)) {
struct mv_xor_desc_slot *chain_head; if (current_cleaned) {
chain_head = list_entry(mv_chan->chain.next, /*
struct mv_xor_desc_slot, * current descriptor cleaned and removed, run
chain_node); * from list head
*/
mv_xor_start_new_chain(mv_chan, chain_head); iter = list_entry(mv_chan->chain.next,
struct mv_xor_desc_slot,
chain_node);
mv_xor_start_new_chain(mv_chan, iter);
} else {
if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
/*
* descriptors are still waiting after
* current, trigger them
*/
iter = list_entry(iter->chain_node.next,
struct mv_xor_desc_slot,
chain_node);
mv_xor_start_new_chain(mv_chan, iter);
} else {
/*
* some descriptors are still waiting
* to be cleaned
*/
tasklet_schedule(&mv_chan->irq_tasklet);
}
}
} }
if (cookie > 0) if (cookie > 0)

1
drivers/dma/mv_xor.h
View file

@ -30,6 +30,7 @@
#define XOR_OPERATION_MODE_XOR 0 #define XOR_OPERATION_MODE_XOR 0
#define XOR_OPERATION_MODE_MEMCPY 2 #define XOR_OPERATION_MODE_MEMCPY 2
#define XOR_OPERATION_MODE_MEMSET 4 #define XOR_OPERATION_MODE_MEMSET 4
#define XOR_DESC_SUCCESS 0x40000000
#define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4)) #define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4))
#define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4)) #define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4))