redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

net: qca_spi: Fix race condition in spi transfers 

[ Upstream commit e65a9e480e ]

With performance optimization the spi transfer and messages of basic
register operations like qcaspi_read_register moved into the private
driver structure. But they weren't protected against mutual access
(e.g. between driver kthread and ethtool). So dumping the QCA7000
registers via ethtool during network traffic could make spi_sync
hang forever, because the completion in spi_message is overwritten.

So revert the optimization completely.

Fixes: 291ab06ecf ("net: qualcomm: new Ethernet over SPI driver for QCA700")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
Stefan Wahren 2018-09-05 15:23:18 +02:00 committed by Greg Kroah-Hartman
parent 47f74ff002
commit e4df3c97c3
3 changed files with 94 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
drivers/net/ethernet/qualcomm/qca_7k.c
View File

@ -45,34 +45,33 @@ qcaspi_read_register(struct qcaspi *qca, u16 reg, u16 *result)
{
__be16 rx_data;
__be16 tx_data;
struct spi_transfer *transfer;
struct spi_message *msg;
struct spi_transfer transfer[2];
struct spi_message msg;
int ret;
memset(transfer, 0, sizeof(transfer));
spi_message_init(&msg);
tx_data = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_INTERNAL | reg);
*result = 0;
transfer[0].tx_buf = &tx_data;
transfer[0].len = QCASPI_CMD_LEN;
transfer[1].rx_buf = &rx_data;
transfer[1].len = QCASPI_CMD_LEN;
spi_message_add_tail(&transfer[0], &msg);
if (qca->legacy_mode) {
msg = &qca->spi_msg1;
transfer = &qca->spi_xfer1;
transfer->tx_buf = &tx_data;
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
spi_sync(qca->spi_dev, msg);
} else {
msg = &qca->spi_msg2;
transfer = &qca->spi_xfer2[0];
transfer->tx_buf = &tx_data;
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
transfer = &qca->spi_xfer2[1];
spi_sync(qca->spi_dev, &msg);
spi_message_init(&msg);
}
transfer->tx_buf = NULL;
transfer->rx_buf = &rx_data;
transfer->len = QCASPI_CMD_LEN;
ret = spi_sync(qca->spi_dev, msg);
spi_message_add_tail(&transfer[1], &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (!ret)
ret = msg->status;
ret = msg.status;
if (ret)
qcaspi_spi_error(qca);
@ -86,35 +85,32 @@ int
qcaspi_write_register(struct qcaspi *qca, u16 reg, u16 value)
{
__be16 tx_data[2];
struct spi_transfer *transfer;
struct spi_message *msg;
struct spi_transfer transfer[2];
struct spi_message msg;
int ret;
memset(&transfer, 0, sizeof(transfer));
spi_message_init(&msg);
tx_data[0] = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_INTERNAL | reg);
tx_data[1] = cpu_to_be16(value);
transfer[0].tx_buf = &tx_data[0];
transfer[0].len = QCASPI_CMD_LEN;
transfer[1].tx_buf = &tx_data[1];
transfer[1].len = QCASPI_CMD_LEN;
spi_message_add_tail(&transfer[0], &msg);
if (qca->legacy_mode) {
msg = &qca->spi_msg1;
transfer = &qca->spi_xfer1;
transfer->tx_buf = &tx_data[0];
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
spi_sync(qca->spi_dev, msg);
} else {
msg = &qca->spi_msg2;
transfer = &qca->spi_xfer2[0];
transfer->tx_buf = &tx_data[0];
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
transfer = &qca->spi_xfer2[1];
spi_sync(qca->spi_dev, &msg);
spi_message_init(&msg);
}
transfer->tx_buf = &tx_data[1];
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
ret = spi_sync(qca->spi_dev, msg);
spi_message_add_tail(&transfer[1], &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (!ret)
ret = msg->status;
ret = msg.status;
if (ret)
qcaspi_spi_error(qca);

112
drivers/net/ethernet/qualcomm/qca_spi.c
View File

@ -99,22 +99,24 @@ static u32
qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
{
__be16 cmd;
struct spi_message *msg = &qca->spi_msg2;
struct spi_transfer *transfer = &qca->spi_xfer2[0];
struct spi_message msg;
struct spi_transfer transfer[2];
int ret;
memset(&transfer, 0, sizeof(transfer));
spi_message_init(&msg);
cmd = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_EXTERNAL);
transfer->tx_buf = &cmd;
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
transfer = &qca->spi_xfer2[1];
transfer->tx_buf = src;
transfer->rx_buf = NULL;
transfer->len = len;
transfer[0].tx_buf = &cmd;
transfer[0].len = QCASPI_CMD_LEN;
transfer[1].tx_buf = src;
transfer[1].len = len;
ret = spi_sync(qca->spi_dev, msg);
spi_message_add_tail(&transfer[0], &msg);
spi_message_add_tail(&transfer[1], &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
qcaspi_spi_error(qca);
return 0;
}
@ -125,17 +127,20 @@ qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len)
static u32
qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
{
struct spi_message *msg = &qca->spi_msg1;
struct spi_transfer *transfer = &qca->spi_xfer1;
struct spi_message msg;
struct spi_transfer transfer;
int ret;
transfer->tx_buf = src;
transfer->rx_buf = NULL;
transfer->len = len;
memset(&transfer, 0, sizeof(transfer));
spi_message_init(&msg);
ret = spi_sync(qca->spi_dev, msg);
transfer.tx_buf = src;
transfer.len = len;
if (ret || (msg->actual_length != len)) {
spi_message_add_tail(&transfer, &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (ret || (msg.actual_length != len)) {
qcaspi_spi_error(qca);
return 0;
}
@ -146,23 +151,25 @@ qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len)
static u32
qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
{
struct spi_message *msg = &qca->spi_msg2;
struct spi_message msg;
__be16 cmd;
struct spi_transfer *transfer = &qca->spi_xfer2[0];
struct spi_transfer transfer[2];
int ret;
memset(&transfer, 0, sizeof(transfer));
spi_message_init(&msg);
cmd = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_EXTERNAL);
transfer->tx_buf = &cmd;
transfer->rx_buf = NULL;
transfer->len = QCASPI_CMD_LEN;
transfer = &qca->spi_xfer2[1];
transfer->tx_buf = NULL;
transfer->rx_buf = dst;
transfer->len = len;
transfer[0].tx_buf = &cmd;
transfer[0].len = QCASPI_CMD_LEN;
transfer[1].rx_buf = dst;
transfer[1].len = len;
ret = spi_sync(qca->spi_dev, msg);
spi_message_add_tail(&transfer[0], &msg);
spi_message_add_tail(&transfer[1], &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) {
if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) {
qcaspi_spi_error(qca);
return 0;
}
@ -173,17 +180,20 @@ qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len)
static u32
qcaspi_read_legacy(struct qcaspi *qca, u8 *dst, u32 len)
{
struct spi_message *msg = &qca->spi_msg1;
struct spi_transfer *transfer = &qca->spi_xfer1;
struct spi_message msg;
struct spi_transfer transfer;
int ret;
transfer->tx_buf = NULL;
transfer->rx_buf = dst;
transfer->len = len;
memset(&transfer, 0, sizeof(transfer));
spi_message_init(&msg);
ret = spi_sync(qca->spi_dev, msg);
transfer.rx_buf = dst;
transfer.len = len;
if (ret || (msg->actual_length != len)) {
spi_message_add_tail(&transfer, &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (ret || (msg.actual_length != len)) {
qcaspi_spi_error(qca);
return 0;
}
@ -195,19 +205,23 @@ static int
qcaspi_tx_cmd(struct qcaspi *qca, u16 cmd)
{
__be16 tx_data;
struct spi_message *msg = &qca->spi_msg1;
struct spi_transfer *transfer = &qca->spi_xfer1;
struct spi_message msg;
struct spi_transfer transfer;
int ret;
tx_data = cpu_to_be16(cmd);
transfer->len = sizeof(tx_data);
transfer->tx_buf = &tx_data;
transfer->rx_buf = NULL;
memset(&transfer, 0, sizeof(transfer));
ret = spi_sync(qca->spi_dev, msg);
spi_message_init(&msg);
tx_data = cpu_to_be16(cmd);
transfer.len = sizeof(cmd);
transfer.tx_buf = &tx_data;
spi_message_add_tail(&transfer, &msg);
ret = spi_sync(qca->spi_dev, &msg);
if (!ret)
ret = msg->status;
ret = msg.status;
if (ret)
qcaspi_spi_error(qca);
@ -836,16 +850,6 @@ qcaspi_netdev_setup(struct net_device *dev)
qca = netdev_priv(dev);
memset(qca, 0, sizeof(struct qcaspi));
memset(&qca->spi_xfer1, 0, sizeof(struct spi_transfer));
memset(&qca->spi_xfer2, 0, sizeof(struct spi_transfer) * 2);
spi_message_init(&qca->spi_msg1);
spi_message_add_tail(&qca->spi_xfer1, &qca->spi_msg1);
spi_message_init(&qca->spi_msg2);
spi_message_add_tail(&qca->spi_xfer2[0], &qca->spi_msg2);
spi_message_add_tail(&qca->spi_xfer2[1], &qca->spi_msg2);
memset(&qca->txr, 0, sizeof(qca->txr));
qca->txr.count = TX_RING_MAX_LEN;
}

5
drivers/net/ethernet/qualcomm/qca_spi.h
View File

@ -83,11 +83,6 @@ struct qcaspi {
struct tx_ring txr;
struct qcaspi_stats stats;
struct spi_message spi_msg1;
struct spi_message spi_msg2;
struct spi_transfer spi_xfer1;
struct spi_transfer spi_xfer2[2];
u8 *rx_buffer;
u32 buffer_size;
u8 sync;