Commit b62ffd8c authored Nov 13, 2013 by Horia Geanta Committed by Herbert Xu Dec 05, 2013

crypto: talitos - fix locating offending descriptor in error path



Commit 3e721aeb
("crypto: talitos - handle descriptor not found in error path")
tried to address the fact that CDPR (Current Descriptor Pointer Register)
is unreliable.

As it turns out, there are still issues in the function detecting the
offending descriptor:
-only 32 bits of the descriptor address are read, however the address is
36-bit - since reset_channel() initializes channels with EAE (extended
address) bit set
-reading CDPR can return zero in cur_desc; when searching the channel
fifo for this address, cur_desc == dma_desc (= 0) case might happen,
leading to an oops when trying to return desc->hdr (desc is zero)
-read channel's .tail only once; the tail is a moving target; use a
local variable for the end of search condition

Signed-off-by: Lei Xu <Lei.Xu@freescale.com>
Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
Tested-by: Kalyani Chowdhury <Kalyani.Chowdhury@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent f13ab86a

drivers/crypto/talitos.c

+15 −6

Original line number	Diff line number	Diff line
		@@ -338,20 +338,29 @@ DEF_TALITOS_DONE(ch1_3, TALITOS_ISR_CH_1_3_DONE)
		static u32 current_desc_hdr(struct device *dev, int ch)
		{
		struct talitos_private *priv = dev_get_drvdata(dev);
		int tail = priv->chan[ch].tail;
		int tail, iter;
		dma_addr_t cur_desc;

		cur_desc = in_be32(priv->chan[ch].reg + TALITOS_CDPR_LO);
		cur_desc = ((u64)in_be32(priv->chan[ch].reg + TALITOS_CDPR)) << 32;
		cur_desc \|= in_be32(priv->chan[ch].reg + TALITOS_CDPR_LO);

		while (priv->chan[ch].fifo[tail].dma_desc != cur_desc) {
		tail = (tail + 1) & (priv->fifo_len - 1);
		if (tail == priv->chan[ch].tail) {
		if (!cur_desc) {
		dev_err(dev, "CDPR is NULL, giving up search for offending descriptor\n");
		return 0;
		}

		tail = priv->chan[ch].tail;

		iter = tail;
		while (priv->chan[ch].fifo[iter].dma_desc != cur_desc) {
		iter = (iter + 1) & (priv->fifo_len - 1);
		if (iter == tail) {
		dev_err(dev, "couldn't locate current descriptor\n");
		return 0;
		}
		}

		return priv->chan[ch].fifo[tail].desc->hdr;
		return priv->chan[ch].fifo[iter].desc->hdr;
		}

		/*