Re: [PATCH 2/4 net] qca_spi: Fix SPI IRQ handling

[Stefan Wahren]

Hi Paolo,

Am 24.11.23 um 16:33 schrieb Paolo Abeni:
> On Fri, 2023-11-24 at 15:01 +0100, Stefan Wahren wrote:
> > Hi Paolo,
> >
> > Am 23.11.23 um 12:37 schrieb Paolo Abeni:
> > > On Tue, 2023-11-21 at 17:30 +0100, Stefan Wahren wrote:
> > > > The functions qcaspi_netdev_open/close are responsible of request &
> > > > free of the SPI interrupt, which wasn't the best choice. Currently
> > > > it's possible to trigger a double free of the interrupt by calling
> > > > qcaspi_netdev_close() after qcaspi_netdev_open() has failed.
> > > > So let us split IRQ allocation & enabling, so we can take advantage
> > > > of a device managed IRQ and also fix the issue.
> > > >
> > > > Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
> > > > Signed-off-by: Stefan Wahren <wahrenst@xxxxxxx>
> > > The change makes sense, but the changelog is confusing.
> > >
> > > qcaspi_netdev_close() and qcaspi_netdev_open() are invoked only via
> > > ndo_open and ndo_close(), right? So qcaspi_netdev_close() will never be
> > > invoked qcaspi_netdev_open(), failure - that is when IFF_UP is not set.
> > sorry, i missed to mention an important part. This issue is partly
> > connected to patch 3.
> > Please look at qcaspi_set_ringparam() which also call ndo_close() and
> > ndo_open().
> Ah, I see it now. IMHO root cause of the problem is there. The ethtool
> op should not flip the device state.
>
> A more narrow fix would be to park/unpark the thread inside
> set_ringparam() - instead of the whole patch 1 && 2 I suspect.

before i send a complete new version of this series, could you please
have a look at this replacement for patch 1 & 2:

qca_debug: Prevent crash on TX ring changes

The qca_spi driver stop and restart the SPI kernel thread
(via ndo_stop & ndo_open) in case of TX ring changes. This is
a big issue because it allows userspace to prevent restart of
the SPI kernel thread (via signals). A subsequent change of
TX ring wrongly assume a valid spi_thread pointer which result
in a crash.

So prevent this by stopping the network queue and temporary park
the SPI thread. Because this could happen during transmission
we also need to call qcaspi_flush_tx_ring().

Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for
QCA7000")
Signed-off-by: Stefan Wahren <wahrenst@xxxxxxx>
---
 drivers/net/ethernet/qualcomm/qca_debug.c | 17 ++++++++++++-----
 drivers/net/ethernet/qualcomm/qca_spi.c   |  7 ++++++-
 drivers/net/ethernet/qualcomm/qca_spi.h   |  2 ++
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c
b/drivers/net/ethernet/qualcomm/qca_debug.c
index f62c39544e08..478ab3ce949d 100644
--- a/drivers/net/ethernet/qualcomm/qca_debug.c
+++ b/drivers/net/ethernet/qualcomm/qca_debug.c
@@ -263,22 +263,29 @@ qcaspi_set_ringparam(struct net_device *dev,
struct ethtool_ringparam *ring,
              struct kernel_ethtool_ringparam *kernel_ring,
              struct netlink_ext_ack *extack)
 {
-    const struct net_device_ops *ops = dev->netdev_ops;
     struct qcaspi *qca = netdev_priv(dev);
+    bool queue_active = !netif_queue_stopped(dev);

     if ((ring->rx_pending) ||
         (ring->rx_mini_pending) ||
         (ring->rx_jumbo_pending))
         return -EINVAL;

-    if (netif_running(dev))
-        ops->ndo_stop(dev);
+    if (queue_active)
+        netif_stop_queue(dev);

+    if (qca->spi_thread)
+        kthread_park(qca->spi_thread);
+
+    qcaspi_flush_tx_ring(qca);
     qca->txr.count = max_t(u32, ring->tx_pending, TX_RING_MIN_LEN);
     qca->txr.count = min_t(u16, qca->txr.count, TX_RING_MAX_LEN);

-    if (netif_running(dev))
-        ops->ndo_open(dev);
+    if (qca->spi_thread)
+        kthread_unpark(qca->spi_thread);
+
+    if (queue_active)
+        netif_wake_queue(dev);

     return 0;
 }
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c
b/drivers/net/ethernet/qualcomm/qca_spi.c
index d0578530dfbc..2ebe9834a1d3 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -468,7 +468,7 @@ qcaspi_tx_ring_has_space(struct tx_ring *txr)
  *   call from the qcaspi_spi_thread.
  */

-static void
+void
 qcaspi_flush_tx_ring(struct qcaspi *qca)
 {
     int i;
@@ -581,6 +581,11 @@ qcaspi_spi_thread(void *data)
     netdev_info(qca->net_dev, "SPI thread created\n");
     while (!kthread_should_stop()) {
         set_current_state(TASK_INTERRUPTIBLE);
+        if (kthread_should_park()) {
+            kthread_parkme();
+            continue;
+        }
+
         if ((qca->intr_req == qca->intr_svc) &&
             !qca->txr.skb[qca->txr.head])
             schedule();
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h
b/drivers/net/ethernet/qualcomm/qca_spi.h
index 3067356106f0..95d7306e58e9 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.h
+++ b/drivers/net/ethernet/qualcomm/qca_spi.h
@@ -107,4 +107,6 @@ struct qcaspi {
     u16 burst_len;
 };

+void qcaspi_flush_tx_ring(struct qcaspi *qca);
+
 #endif /* _QCA_SPI_H */
--
2.34.1


> IMHO the changes in this still make sense - a refactor for net-next.
>
> Cheers,
>
> Paolo