diff mbox series

[v14,12/12] dmaengine: imx-sdma: add terminated list for freed descriptor in worker

Message ID 1617809456-17693-13-git-send-email-yibin.gong@nxp.com
State Superseded
Headers show
Series add ecspi ERR009165 for i.mx6/7 soc family | expand

Commit Message

Robin Gong April 7, 2021, 3:30 p.m. UTC
Add terminated list for keeping descriptor so that it could be freed in
worker without any potential involving next descriptor raised up before
this descriptor freed, because vchan_get_all_descriptors get all
descriptors including the last terminated descriptor and the next
descriptor, hence, the next descriptor maybe freed unexpectly when it's
done in worker without this patch.
https://www.spinics.net/lists/dmaengine/msg23367.html

Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Reported-by: Richard Leitner <richard.leitner@skidata.com>
---
 drivers/dma/imx-sdma.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

Comments

Vinod Koul April 12, 2021, 9:39 a.m. UTC | #1
On 07-04-21, 23:30, Robin Gong wrote:
> Add terminated list for keeping descriptor so that it could be freed in
> worker without any potential involving next descriptor raised up before
> this descriptor freed, because vchan_get_all_descriptors get all
> descriptors including the last terminated descriptor and the next
> descriptor, hence, the next descriptor maybe freed unexpectly when it's
> done in worker without this patch.
> https://www.spinics.net/lists/dmaengine/msg23367.html

Sound like you should implement .device_synchronize() and do the actual
work there..?

> 
> Signed-off-by: Robin Gong <yibin.gong@nxp.com>
> Reported-by: Richard Leitner <richard.leitner@skidata.com>
> ---
>  drivers/dma/imx-sdma.c | 17 ++++++++++-------
>  1 file changed, 10 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
> index 9519b41..4174580 100644
> --- a/drivers/dma/imx-sdma.c
> +++ b/drivers/dma/imx-sdma.c
> @@ -381,6 +381,7 @@ struct sdma_channel {
>  	enum dma_status			status;
>  	struct imx_dma_data		data;
>  	struct work_struct		terminate_worker;
> +	struct list_head                terminated;
>  	bool				is_ram_script;
>  };
>  
> @@ -1041,9 +1042,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
>  {
>  	struct sdma_channel *sdmac = container_of(work, struct sdma_channel,
>  						  terminate_worker);
> -	unsigned long flags;
> -	LIST_HEAD(head);
> -
>  	/*
>  	 * According to NXP R&D team a delay of one BD SDMA cost time
>  	 * (maximum is 1ms) should be added after disable of the channel
> @@ -1052,10 +1050,7 @@ static void sdma_channel_terminate_work(struct work_struct *work)
>  	 */
>  	usleep_range(1000, 2000);
>  
> -	spin_lock_irqsave(&sdmac->vc.lock, flags);
> -	vchan_get_all_descriptors(&sdmac->vc, &head);
> -	spin_unlock_irqrestore(&sdmac->vc.lock, flags);
> -	vchan_dma_desc_free_list(&sdmac->vc, &head);
> +	vchan_dma_desc_free_list(&sdmac->vc, &sdmac->terminated);
>  }
>  
>  static int sdma_terminate_all(struct dma_chan *chan)
> @@ -1069,6 +1064,13 @@ static int sdma_terminate_all(struct dma_chan *chan)
>  
>  	if (sdmac->desc) {
>  		vchan_terminate_vdesc(&sdmac->desc->vd);
> +		/*
> +		 * move out current descriptor into terminated list so that
> +		 * it could be free in sdma_channel_terminate_work alone
> +		 * later without potential involving next descriptor raised
> +		 * up before the last descriptor terminated.
> +		 */
> +		vchan_get_all_descriptors(&sdmac->vc, &sdmac->terminated);
>  		sdmac->desc = NULL;
>  		schedule_work(&sdmac->terminate_worker);
>  	}
> @@ -2075,6 +2077,7 @@ static int sdma_probe(struct platform_device *pdev)
>  
>  		sdmac->channel = i;
>  		sdmac->vc.desc_free = sdma_desc_free;
> +		INIT_LIST_HEAD(&sdmac->terminated);
>  		INIT_WORK(&sdmac->terminate_worker,
>  				sdma_channel_terminate_work);
>  		/*
> -- 
> 2.7.4
Vinod Koul June 15, 2021, 6:06 a.m. UTC | #2
On 07-04-21, 23:30, Robin Gong wrote:
> Add terminated list for keeping descriptor so that it could be freed in

> worker without any potential involving next descriptor raised up before

> this descriptor freed, because vchan_get_all_descriptors get all

> descriptors including the last terminated descriptor and the next

> descriptor, hence, the next descriptor maybe freed unexpectly when it's

> done in worker without this patch.

> https://www.spinics.net/lists/dmaengine/msg23367.html


Acked-By: Vinod Koul <vkoul@kernel.org>


-- 
~Vinod
diff mbox series

Patch

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 9519b41..4174580 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -381,6 +381,7 @@  struct sdma_channel {
 	enum dma_status			status;
 	struct imx_dma_data		data;
 	struct work_struct		terminate_worker;
+	struct list_head                terminated;
 	bool				is_ram_script;
 };
 
@@ -1041,9 +1042,6 @@  static void sdma_channel_terminate_work(struct work_struct *work)
 {
 	struct sdma_channel *sdmac = container_of(work, struct sdma_channel,
 						  terminate_worker);
-	unsigned long flags;
-	LIST_HEAD(head);
-
 	/*
 	 * According to NXP R&D team a delay of one BD SDMA cost time
 	 * (maximum is 1ms) should be added after disable of the channel
@@ -1052,10 +1050,7 @@  static void sdma_channel_terminate_work(struct work_struct *work)
 	 */
 	usleep_range(1000, 2000);
 
-	spin_lock_irqsave(&sdmac->vc.lock, flags);
-	vchan_get_all_descriptors(&sdmac->vc, &head);
-	spin_unlock_irqrestore(&sdmac->vc.lock, flags);
-	vchan_dma_desc_free_list(&sdmac->vc, &head);
+	vchan_dma_desc_free_list(&sdmac->vc, &sdmac->terminated);
 }
 
 static int sdma_terminate_all(struct dma_chan *chan)
@@ -1069,6 +1064,13 @@  static int sdma_terminate_all(struct dma_chan *chan)
 
 	if (sdmac->desc) {
 		vchan_terminate_vdesc(&sdmac->desc->vd);
+		/*
+		 * move out current descriptor into terminated list so that
+		 * it could be free in sdma_channel_terminate_work alone
+		 * later without potential involving next descriptor raised
+		 * up before the last descriptor terminated.
+		 */
+		vchan_get_all_descriptors(&sdmac->vc, &sdmac->terminated);
 		sdmac->desc = NULL;
 		schedule_work(&sdmac->terminate_worker);
 	}
@@ -2075,6 +2077,7 @@  static int sdma_probe(struct platform_device *pdev)
 
 		sdmac->channel = i;
 		sdmac->vc.desc_free = sdma_desc_free;
+		INIT_LIST_HEAD(&sdmac->terminated);
 		INIT_WORK(&sdmac->terminate_worker,
 				sdma_channel_terminate_work);
 		/*