linuxppc-dev.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
From: Finn Thain <fthain@telegraphics.com.au>
To: Benjamin Herrenschmidt <benh@kernel.crashing.org>,
	Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH 06/10] via-cuda: Avoid TREQ race condition
Date: Thu,  1 Dec 2016 01:09:33 -0500 (EST)	[thread overview]
Message-ID: <d06cc9f68b6b84b67d1ae13e19392f3bcc972896.1480572271.git.fthain@telegraphics.com.au> (raw)
In-Reply-To: <cover.1480572271.git.fthain@telegraphics.com.au>

When a read transaction completes, one of several things will happen:
either a new transfer is started by the driver, a new transfer request
is raised by the Cuda (i.e. TREQ asserted), or both happen at once.

When both happen at once, there is a race condition between the TREQ test
in the read_done state and the same test in cuda_start(). Moreover, the
former test uses a stale TREQ value.

Theoretically, this can result in the undesirable outcome that the
interrupt handler completes with the state machine 'idle' when it should
instead start the next transaction.

Avoid this race by calling cuda_start() first and then confirming that it
succeeded. If not, test the current TREQ value before entering the
'reading' state.

Tested-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
---
 drivers/macintosh/via-cuda.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c
index e65c0b6..ff9062a 100644
--- a/drivers/macintosh/via-cuda.c
+++ b/drivers/macintosh/via-cuda.c
@@ -605,12 +605,11 @@ cuda_interrupt(int irq, void *arg)
 	    memcpy(ibuf, cuda_rbuf, ibuf_len);
 	}
 	reply_ptr = cuda_rbuf;
-	if (TREQ_asserted(status)) {
+	cuda_state = idle;
+	cuda_start();
+	if (cuda_state == idle && TREQ_asserted(in_8(&via[B]))) {
 	    assert_TIP();
 	    cuda_state = reading;
-	} else {
-	    cuda_state = idle;
-	    cuda_start();
 	}
 	break;
 
-- 
2.7.3

  parent reply	other threads:[~2016-12-01  6:15 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-12-01  6:09 [PATCH 00/10] Replace via-maciisi with via-cuda driver Finn Thain
2016-12-01  6:09 ` [PATCH 05/10] via-cuda: Fix re-initialization of reply_ptr and reading_reply Finn Thain
2016-12-01  6:09 ` [PATCH 03/10] via-cuda: Add TREQ, TIP and TACK signal helpers Finn Thain
2016-12-01  6:09 ` [PATCH 07/10] via-cuda: Use spinlock_irq_save/restore instead of enable/disable_irq Finn Thain
2016-12-01  6:09 ` [PATCH 02/10] via-cuda: Remove redundant temporary variable Finn Thain
2016-12-01  6:09 ` [PATCH 01/10] via-cuda: Cleanup printk calls Finn Thain
2016-12-01  6:09 ` Finn Thain [this message]
2016-12-01  6:09 ` [PATCH 04/10] via-cuda: Prevent read buffer overflow Finn Thain
2016-12-01  6:09 ` [PATCH 10/10] m68k/mac: Replace via-maciisi driver with via-cuda driver Finn Thain
2016-12-01  6:09 ` [PATCH 08/10] via-cuda: Initialize data_index early and increment consistently Finn Thain
2016-12-01  6:09 ` [PATCH 09/10] via-cuda: Add support for Egret system controller Finn Thain

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d06cc9f68b6b84b67d1ae13e19392f3bcc972896.1480572271.git.fthain@telegraphics.com.au \
    --to=fthain@telegraphics.com.au \
    --cc=benh@kernel.crashing.org \
    --cc=geert@linux-m68k.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-m68k@vger.kernel.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).