]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
spi: pl022: Fix race in giveback() leading to driver lock-up
authorAlexander Sverdlin <alexander.sverdlin@nokia.com>
Fri, 27 Feb 2015 15:30:21 +0000 (16:30 +0100)
committerSasha Levin <sasha.levin@oracle.com>
Sat, 28 Mar 2015 13:49:32 +0000 (09:49 -0400)
commit766afbabcbf94423ccd8c8ae1081a2bd38043d08
treed1dfaf298fb7620e521a48e06b4f6ef3192f759b
parentf3aa910546efe131b46ee2b7721a473b7b6938bc
spi: pl022: Fix race in giveback() leading to driver lock-up

[ Upstream commit cd6fa8d2ca53cac3226fdcffcf763be390abae32 ]

Commit fd316941c ("spi/pl022: disable port when unused") introduced a race,
which leads to possible driver lock up (easily reproducible on SMP).

The problem happens in giveback() function where the completion of the transfer
is signalled to SPI subsystem and then the HW SPI controller is disabled. Another
transfer might be setup in between, which brings driver in locked-up state.

Exact event sequence on SMP:

core0                                   core1

                                        => pump_transfers()
                                        /* message->state == STATE_DONE */
                                          => giveback()
                                            => spi_finalize_current_message()

=> pl022_unprepare_transfer_hardware()
=> pl022_transfer_one_message
  => flush()
  => do_interrupt_dma_transfer()
    => set_up_next_transfer()
    /* Enable SSP, turn on interrupts */
    writew((readw(SSP_CR1(pl022->virtbase)) |
           SSP_CR1_MASK_SSE), SSP_CR1(pl022->virtbase));

...

=> pl022_interrupt_handler()
  => readwriter()

                                        /* disable the SPI/SSP operation */
                                        => writew((readw(SSP_CR1(pl022->virtbase)) &
                                                  (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));

Lockup! SPI controller is disabled and the data will never be received. Whole
SPI subsystem is waiting for transfer ACK and blocked.

So, only signal transfer completion after disabling the controller.

Fixes: fd316941c (spi/pl022: disable port when unused)
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
drivers/spi/spi-pl022.c