linux/drivers/net/ipa
Alex Elder 064c9c32b1 net: ipa: lock when freeing transaction
Transactions sit on one of several lists, depending on their state
(allocated, pending, complete, or polled).  A spinlock protects
against concurrent access when transactions are moved between these
lists.

Transactions are also reference counted.  A newly-allocated
transaction has an initial count of 1; a transaction is released in
gsi_trans_free() only if its decremented reference count reaches 0.
Releasing a transaction includes removing it from the polled (or if
unused, allocated) list, so the spinlock is acquired when we release
a transaction.

The reference count is used to allow a caller to synchronously wait
for a committed transaction to complete.  In this case, the waiter
takes an extra reference to the transaction *before* committing it
(so it won't be freed), and releases its reference (calls
gsi_trans_free()) when it is done with it.

Similarly, gsi_channel_update() takes an extra reference to ensure a
transaction isn't released before the function is done operating on
it.  Until the transaction is moved to the completed list (by this
function) it won't be freed, so this reference is taken "safely."

But in the quiesce path, we want to wait for the "last" transaction,
which we find in the completed or polled list.  Transactions on
these lists can be freed at any time, so we (try to) prevent that
by taking the reference while holding the spinlock.

Currently gsi_trans_free() decrements a transaction's reference
count unconditionally, acquiring the lock to remove the transaction
from its list *only* when the count reaches 0.  This does not
protect the quiesce path, which depends on the lock to ensure its
extra reference prevents release of the transaction.

Fix this by only dropping the last reference to a transaction
in gsi_trans_free() while holding the spinlock.

Fixes: 9dd441e4ed ("soc: qcom: ipa: GSI transactions")
Reported-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Alex Elder <elder@linaro.org>
Link: https://lore.kernel.org/r/20201114182017.28270-1-elder@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-16 17:32:22 -08:00
..
gsi_private.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
gsi_reg.h net: ipa: share field mask values for GSI general interrupt 2020-09-28 18:34:56 -07:00
gsi_trans.c net: ipa: lock when freeing transaction 2020-11-16 17:32:22 -08:00
gsi_trans.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
gsi.c net: ipa: fix two mild warnings 2020-09-28 18:34:56 -07:00
gsi.h net: ipa: do not enable GSI interrupt for wakeup 2020-09-18 17:47:07 -07:00
ipa_clock.c net: ipa: manage endpoints separate from clock 2020-09-18 17:47:07 -07:00
ipa_clock.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_cmd.c net: ipa: introduce ipa_cmd_tag_process() 2020-06-30 13:10:57 -07:00
ipa_cmd.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_data-sc7180.c net: ipa: fix modem LAN RX endpoint id 2020-06-11 18:39:08 -07:00
ipa_data-sdm845.c net: ipa: no checksum offload for SDM845 LAN RX 2020-06-30 13:10:57 -07:00
ipa_data.h net: ipa: remove endpoint delay mode feature 2020-05-06 17:37:54 -07:00
ipa_endpoint.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-10-15 12:43:21 -07:00
ipa_endpoint.h drivers: ipa: remove discription of nonexistent element 2020-05-27 14:58:28 -07:00
ipa_gsi.c net: ipa: include declarations in "ipa_gsi.c" 2020-07-07 12:43:18 -07:00
ipa_gsi.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_interrupt.c net: ipa: enable wakeup on IPA interrupt 2020-09-18 17:47:07 -07:00
ipa_interrupt.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_main.c net: ipa: rename a phandle variable 2020-09-28 18:34:56 -07:00
ipa_mem.c net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_mem.h net: ipa: redefine struct ipa_mem_data 2020-05-04 11:26:55 -07:00
ipa_modem.c net: ipa: new notification infrastructure 2020-07-28 17:10:47 -07:00
ipa_modem.h soc: qcom: ipa: modem and microcontroller 2020-03-08 22:07:10 -07:00
ipa_qmi_msg.c net: ipa: fix QMI structure definition bugs 2020-07-07 12:43:18 -07:00
ipa_qmi_msg.h soc: qcom: ipa: AP/modem communications 2020-03-08 22:07:10 -07:00
ipa_qmi.c soc: qcom: ipa: AP/modem communications 2020-03-08 22:07:10 -07:00
ipa_qmi.h soc: qcom: ipa: AP/modem communications 2020-03-08 22:07:10 -07:00
ipa_reg.c
ipa_reg.h net: ipa: fix two comments 2020-09-28 18:34:56 -07:00
ipa_smp2p.c drivers: ipa: fix typos for ipa_smp2p structure doc 2020-05-14 13:06:55 -07:00
ipa_smp2p.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_table.c net: ipa: fix u32_replace_bits by u32p_xxx version 2020-09-11 17:28:48 -07:00
ipa_table.h net: ipa: fix kerneldoc comments 2020-07-13 17:11:53 -07:00
ipa_uc.c net: ipa: fix two comments 2020-09-28 18:34:56 -07:00
ipa_uc.h soc: qcom: ipa: modem and microcontroller 2020-03-08 22:07:10 -07:00
ipa_version.h
ipa.h net: ipa: repurpose CLOCK_HELD flag 2020-09-18 17:47:07 -07:00
Kconfig remoteproc: clean up notification config 2020-03-16 17:31:51 -07:00
Makefile soc: qcom: ipa: support build of IPA code 2020-03-08 22:07:10 -07:00