dmaengine Archive on lore.kernel.org
 help / color / Atom feed
From: Philipp Puschmann <philipp.puschmann@emlix.com>
To: linux-kernel@vger.kernel.org
Cc: jlu@pengutronix.de, yibin.gong@nxp.com, fugang.duan@nxp.com,
	l.stach@pengutronix.de, dan.j.williams@intel.com,
	vkoul@kernel.org, shawnguo@kernel.org, s.hauer@pengutronix.de,
	kernel@pengutronix.de, festevam@gmail.com, linux-imx@nxp.com,
	dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
	Philipp Puschmann <philipp.puschmann@emlix.com>
Subject: [PATCH v5 1/3] dmaengine: imx-sdma: fix buffer ownership
Date: Mon, 23 Sep 2019 15:58:06 +0200
Message-ID: <20190923135808.815-2-philipp.puschmann@emlix.com> (raw)
In-Reply-To: <20190923135808.815-1-philipp.puschmann@emlix.com>

BD_DONE flag marks ownership of the buffer. When 1 SDMA owns the
buffer, when 0 ARM owns it. When processing the buffers in
sdma_update_channel_loop the ownership of the currently processed
buffer was set to SDMA again before running the callback function of
the buffer and while the sdma script may be running in parallel. So
there was the possibility to get the buffer overwritten by SDMA before
it has been processed by kernel leading to kind of random errors in the
upper layers, e.g. bluetooth.

Fixes: 1ec1e82f2510 ("dmaengine: Add Freescale i.MX SDMA support")
Signed-off-by: Philipp Puschmann <philipp.puschmann@emlix.com>
---

Changelog v5:
 - no changes

Changelog v4:
 - fixed the fixes tag
 
Changelog v3:
 - use correct dma_wmb() instead of dma_wb()
 - add fixes tag

Changelog v2:
 - add dma_wb()
 
 drivers/dma/imx-sdma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 9ba74ab7e912..b42281604e54 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -802,7 +802,6 @@ static void sdma_update_channel_loop(struct sdma_channel *sdmac)
 		*/
 
 		desc->chn_real_count = bd->mode.count;
-		bd->mode.status |= BD_DONE;
 		bd->mode.count = desc->period_len;
 		desc->buf_ptail = desc->buf_tail;
 		desc->buf_tail = (desc->buf_tail + 1) % desc->num_bd;
@@ -817,6 +816,9 @@ static void sdma_update_channel_loop(struct sdma_channel *sdmac)
 		dmaengine_desc_get_callback_invoke(&desc->vd.tx, NULL);
 		spin_lock(&sdmac->vc.lock);
 
+		dma_wmb();
+		bd->mode.status |= BD_DONE;
+
 		if (error)
 			sdmac->status = old_status;
 	}
-- 
2.23.0


  reply index

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-23 13:58 [PATCH v5 0/3] Fix UART DMA freezes for i.MX SOCs Philipp Puschmann
2019-09-23 13:58 ` Philipp Puschmann [this message]
2019-12-03  9:47   ` [PATCH v5 1/3] dmaengine: imx-sdma: fix buffer ownership Lucas Stach
2019-12-04  9:19   ` Robin Gong
2019-12-10  9:44     ` Philipp Puschmann
2019-12-10 13:01       ` Robin Gong
2019-09-23 13:58 ` [PATCH v5 2/3] dmaengine: imx-sdma: fix dma freezes Philipp Puschmann
2019-09-24  3:14   ` Robin Gong
2019-09-23 13:58 ` [PATCH v5 3/3] dmaengine: imx-sdma: drop redundant variable Philipp Puschmann
2019-09-23 14:55 ` [PATCH v5 0/3] Fix UART DMA freezes for i.MX SOCs Adam Ford
2019-09-23 15:06   ` Philipp Puschmann
2019-09-23 15:09     ` Jan Lübbe

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190923135808.815-2-philipp.puschmann@emlix.com \
    --to=philipp.puschmann@emlix.com \
    --cc=dan.j.williams@intel.com \
    --cc=dmaengine@vger.kernel.org \
    --cc=festevam@gmail.com \
    --cc=fugang.duan@nxp.com \
    --cc=jlu@pengutronix.de \
    --cc=kernel@pengutronix.de \
    --cc=l.stach@pengutronix.de \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-imx@nxp.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=s.hauer@pengutronix.de \
    --cc=shawnguo@kernel.org \
    --cc=vkoul@kernel.org \
    --cc=yibin.gong@nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

dmaengine Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/dmaengine/0 dmaengine/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dmaengine dmaengine/ https://lore.kernel.org/dmaengine \
		dmaengine@vger.kernel.org
	public-inbox-index dmaengine

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.dmaengine


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git