diff mbox

dmaengine: pl330: fix the race condition in pl330 driver.

Message ID CABb+yY3+cNqQHVxZg62CPxhb+oKEXcU-twAvpyo6DWUK_8m4qQ@mail.gmail.com
State New
Headers show

Commit Message

Jassi Brar March 31, 2015, 5:20 a.m. UTC 
On Tue, Mar 31, 2015 at 9:10 AM, Scott Branden <sbranden@broadcom.com> wrote:
> Hi Vinod, Jassi,
>
> Some details on the problem encountered.
>
>
> On 15-03-30 10:25 AM, Vinod Koul wrote:
>>
>> On Mon, Mar 30, 2015 at 10:17:17PM +0530, Jassi Brar wrote:
>>>
>>> On Fri, Mar 27, 2015 at 5:25 AM, Scott Branden <sbranden@broadcom.com>
>>> wrote:
>>>>
>>>> From: ismail <ismail@broadcom.com>
>>>>
>>>> Update the thread running index before issuing the
>>>> GO command to the DMAC.
>>>>
>>>> Tested-by: Mohamed Ismail Abdul Packir Mohamed <ismail@broadcom.com>
>>>> Reviewed-by: Ray Jui <rjui@broadcom.com>
>>>> Reviewed-by: Arun Parameswaran <aparames@broadcom.com>
>>>> Reviewed-by: Scott Branden <sbranden@broadcom.com>
>>>> Signed-off-by: Scott Branden <sbranden@broadcom.com>
>>>> Signed-off-by: Mohamed Ismail Abdul Packir Mohamed <ismail@broadcom.com>
>>>> ---
>>>>   drivers/dma/pl330.c | 4 ++--
>>>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
>>>> index 0e1f567..631642d 100644
>>>> --- a/drivers/dma/pl330.c
>>>> +++ b/drivers/dma/pl330.c
>>>> @@ -1072,11 +1072,11 @@ static bool _trigger(struct pl330_thread *thrd)
>>>>          /* Set to generate interrupts for SEV */
>>>>          writel(readl(regs + INTEN) | (1 << thrd->ev), regs + INTEN);
>>>>
>>>> +       thrd->req_running = idx;
>>>> +
>>>>          /* Only manager can execute GO */
>>>>          _execute_DBGINSN(thrd, insn, true);
>>>>
>>>> -       thrd->req_running = idx;
>>>> -
>>>
>>> It would help to know what the behavior looks like before and after
>>> the patch. If anything we should look at locking rather the
>>> reordering.
>>
>> Yes that ia fair request, looking at changelog it is hard to understand
>> the
>> issue seen?
>>
> We encountered this problem as we modified the driver to make SMC calls to a
> TZ handler.  This slowed down the driver to the point where DMA transactions
> easily failed.  I believe the same could be accomplished by adding a delay
> between the GOCMD and update of the req_running and running the built in
> dmatest.
>
> The DMA transaction is broken if the interrupt occurs before the
> thrd->req_running is updated.
>
> The pl330 issues a GOCMD (in _trigger function) to start a new transfer.
>
> The issue of GOCMD generates an interrupt and the IRQ handler will call the
> pl330_update function to process the interrupt.
>
> The pl330_update function will verify the thread running index and break the
> transaction, if the thread running index is not set.
>
As I suspected the locking seems screwed up. The following patch
should fix the race properly. Can you please test the attached patches
instead?

Thanks.
diff mbox

Patch

From 2cd6bf6748f28008a1650dca57a8f14b27283803 Mon Sep 17 00:00:00 2001
From: Jassi Brar <jaswinder.singh@linaro.org>
Date: Tue, 31 Mar 2015 10:21:14 +0530
Subject: [PATCH 2/2] dma: pl330: fix race between trigger and completion

We need to hold the lock on channel in ISR to prevent it
racing against the trigger call on the channel.

Reported-by: Scott Branden <sbranden@broadcom.com>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
---
 drivers/dma/pl330.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index d1f777e..ce40677 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1573,6 +1573,7 @@  static int pl330_update(struct pl330_dmac *pl330)
 		if (val & (1 << ev)) { /* Event occurred */
 			struct pl330_thread *thrd;
 			u32 inten = readl(regs + INTEN);
+			unsigned long flag;
 			int active;
 
 			/* Clear the event */
@@ -1584,10 +1585,13 @@  static int pl330_update(struct pl330_dmac *pl330)
 			id = pl330->events[ev];
 
 			thrd = &pl330->channels[id];
+			spin_lock_irqsave(&thrd->pch->lock, flag);
 
 			active = thrd->req_running;
-			if (active == -1) /* Aborted */
+			if (active == -1) { /* Aborted */
+				spin_unlock_irqrestore(&thrd->pch->lock, flag);
 				continue;
+			}
 
 			/* Detach the req */
 			descdone = thrd->req[active].desc;
@@ -1600,6 +1604,7 @@  static int pl330_update(struct pl330_dmac *pl330)
 
 			/* For now, just make a list of callbacks to be done */
 			list_add_tail(&descdone->rqd, &pl330->req_done);
+			spin_unlock_irqrestore(&thrd->pch->lock, flag);
 		}
 	}
 
-- 
1.9.1