linux-stable/drivers/net/ethernet/micrel/ks8851_common.c

1264 lines
31 KiB
C
Raw Normal View History

// SPDX-License-Identifier: GPL-2.0-only
/* drivers/net/ethernet/micrel/ks8851.c
*
* Copyright 2009 Simtec Electronics
* http://www.simtec.co.uk/
* Ben Dooks <ben@simtec.co.uk>
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/interrupt.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/ethtool.h>
#include <linux/cache.h>
#include <linux/crc32.h>
#include <linux/mii.h>
#include <linux/gpio/consumer.h>
#include <linux/regulator/consumer.h>
#include <linux/of_mdio.h>
#include <linux/of_net.h>
#include "ks8851.h"
/**
* ks8851_lock - register access lock
* @ks: The chip state
* @flags: Spinlock flags
*
* Claim chip register access lock
*/
static void ks8851_lock(struct ks8851_net *ks, unsigned long *flags)
{
ks->lock(ks, flags);
}
/**
* ks8851_unlock - register access unlock
* @ks: The chip state
* @flags: Spinlock flags
*
* Release chip register access lock
*/
static void ks8851_unlock(struct ks8851_net *ks, unsigned long *flags)
{
ks->unlock(ks, flags);
}
/**
* ks8851_wrreg16 - write 16bit register value to chip
* @ks: The chip state
* @reg: The register address
* @val: The value to write
*
* Issue a write to put the value @val into the register specified in @reg.
*/
static void ks8851_wrreg16(struct ks8851_net *ks, unsigned int reg,
unsigned int val)
{
ks->wrreg16(ks, reg, val);
}
/**
* ks8851_rdreg16 - read 16 bit register from device
* @ks: The chip information
* @reg: The register address
*
* Read a 16bit register from the chip, returning the result
*/
static unsigned int ks8851_rdreg16(struct ks8851_net *ks,
unsigned int reg)
{
return ks->rdreg16(ks, reg);
}
/**
* ks8851_soft_reset - issue one of the soft reset to the device
* @ks: The device state.
* @op: The bit(s) to set in the GRR
*
* Issue the relevant soft-reset command to the device's GRR register
* specified by @op.
*
* Note, the delays are in there as a caution to ensure that the reset
* has time to take effect and then complete. Since the datasheet does
* not currently specify the exact sequence, we have chosen something
* that seems to work with our device.
*/
static void ks8851_soft_reset(struct ks8851_net *ks, unsigned op)
{
ks8851_wrreg16(ks, KS_GRR, op);
mdelay(1); /* wait a short time to effect reset */
ks8851_wrreg16(ks, KS_GRR, 0);
mdelay(1); /* wait for condition to clear */
}
/**
* ks8851_set_powermode - set power mode of the device
* @ks: The device state
* @pwrmode: The power mode value to write to KS_PMECR.
*
* Change the power mode of the chip.
*/
static void ks8851_set_powermode(struct ks8851_net *ks, unsigned pwrmode)
{
unsigned pmecr;
netif_dbg(ks, hw, ks->netdev, "setting power mode %d\n", pwrmode);
pmecr = ks8851_rdreg16(ks, KS_PMECR);
pmecr &= ~PMECR_PM_MASK;
pmecr |= pwrmode;
ks8851_wrreg16(ks, KS_PMECR, pmecr);
}
/**
* ks8851_write_mac_addr - write mac address to device registers
* @dev: The network device
*
* Update the KS8851 MAC address registers from the address in @dev.
*
* This call assumes that the chip is not running, so there is no need to
* shutdown the RXQ process whilst setting this.
*/
static int ks8851_write_mac_addr(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
unsigned long flags;
u16 val;
int i;
ks8851_lock(ks, &flags);
/*
* Wake up chip in case it was powered off when stopped; otherwise,
* the first write to the MAC address does not take effect.
*/
ks8851_set_powermode(ks, PMECR_PM_NORMAL);
for (i = 0; i < ETH_ALEN; i += 2) {
val = (dev->dev_addr[i] << 8) | dev->dev_addr[i + 1];
ks8851_wrreg16(ks, KS_MAR(i), val);
}
if (!netif_running(dev))
ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN);
ks8851_unlock(ks, &flags);
return 0;
}
/**
* ks8851_read_mac_addr - read mac address from device registers
* @dev: The network device
*
* Update our copy of the KS8851 MAC address from the registers of @dev.
*/
static void ks8851_read_mac_addr(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
unsigned long flags;
u8 addr[ETH_ALEN];
u16 reg;
int i;
ks8851_lock(ks, &flags);
for (i = 0; i < ETH_ALEN; i += 2) {
reg = ks8851_rdreg16(ks, KS_MAR(i));
addr[i] = reg >> 8;
addr[i + 1] = reg & 0xff;
}
eth_hw_addr_set(dev, addr);
ks8851_unlock(ks, &flags);
}
/**
* ks8851_init_mac - initialise the mac address
* @ks: The device structure
* @np: The device node pointer
*
* Get or create the initial mac address for the device and then set that
* into the station address register. A mac address supplied in the device
* tree takes precedence. Otherwise, if there is an EEPROM present, then
* we try that. If no valid mac address is found we use eth_random_addr()
* to create a new one.
*/
static void ks8851_init_mac(struct ks8851_net *ks, struct device_node *np)
{
struct net_device *dev = ks->netdev;
of: net: pass the dst buffer to of_get_mac_address() of_get_mac_address() returns a "const void*" pointer to a MAC address. Lately, support to fetch the MAC address by an NVMEM provider was added. But this will only work with platform devices. It will not work with PCI devices (e.g. of an integrated root complex) and esp. not with DSA ports. There is an of_* variant of the nvmem binding which works without devices. The returned data of a nvmem_cell_read() has to be freed after use. On the other hand the return of_get_mac_address() points to some static data without a lifetime. The trick for now, was to allocate a device resource managed buffer which is then returned. This will only work if we have an actual device. Change it, so that the caller of of_get_mac_address() has to supply a buffer where the MAC address is written to. Unfortunately, this will touch all drivers which use the of_get_mac_address(). Usually the code looks like: const char *addr; addr = of_get_mac_address(np); if (!IS_ERR(addr)) ether_addr_copy(ndev->dev_addr, addr); This can then be simply rewritten as: of_get_mac_address(np, ndev->dev_addr); Sometimes is_valid_ether_addr() is used to test the MAC address. of_get_mac_address() already makes sure, it just returns a valid MAC address. Thus we can just test its return code. But we have to be careful if there are still other sources for the MAC address before the of_get_mac_address(). In this case we have to keep the is_valid_ether_addr() call. The following coccinelle patch was used to convert common cases to the new style. Afterwards, I've manually gone over the drivers and fixed the return code variable: either used a new one or if one was already available use that. Mansour Moufid, thanks for that coccinelle patch! <spml> @a@ identifier x; expression y, z; @@ - x = of_get_mac_address(y); + x = of_get_mac_address(y, z); <... - ether_addr_copy(z, x); ...> @@ identifier a.x; @@ - if (<+... x ...+>) {} @@ identifier a.x; @@ if (<+... x ...+>) { ... } - else {} @@ identifier a.x; expression e; @@ - if (<+... x ...+>@e) - {} - else + if (!(e)) {...} @@ expression x, y, z; @@ - x = of_get_mac_address(y, z); + of_get_mac_address(y, z); ... when != x </spml> All drivers, except drivers/net/ethernet/aeroflex/greth.c, were compile-time tested. Suggested-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-04-12 17:47:17 +00:00
int ret;
ret = of_get_ethdev_address(np, dev);
of: net: pass the dst buffer to of_get_mac_address() of_get_mac_address() returns a "const void*" pointer to a MAC address. Lately, support to fetch the MAC address by an NVMEM provider was added. But this will only work with platform devices. It will not work with PCI devices (e.g. of an integrated root complex) and esp. not with DSA ports. There is an of_* variant of the nvmem binding which works without devices. The returned data of a nvmem_cell_read() has to be freed after use. On the other hand the return of_get_mac_address() points to some static data without a lifetime. The trick for now, was to allocate a device resource managed buffer which is then returned. This will only work if we have an actual device. Change it, so that the caller of of_get_mac_address() has to supply a buffer where the MAC address is written to. Unfortunately, this will touch all drivers which use the of_get_mac_address(). Usually the code looks like: const char *addr; addr = of_get_mac_address(np); if (!IS_ERR(addr)) ether_addr_copy(ndev->dev_addr, addr); This can then be simply rewritten as: of_get_mac_address(np, ndev->dev_addr); Sometimes is_valid_ether_addr() is used to test the MAC address. of_get_mac_address() already makes sure, it just returns a valid MAC address. Thus we can just test its return code. But we have to be careful if there are still other sources for the MAC address before the of_get_mac_address(). In this case we have to keep the is_valid_ether_addr() call. The following coccinelle patch was used to convert common cases to the new style. Afterwards, I've manually gone over the drivers and fixed the return code variable: either used a new one or if one was already available use that. Mansour Moufid, thanks for that coccinelle patch! <spml> @a@ identifier x; expression y, z; @@ - x = of_get_mac_address(y); + x = of_get_mac_address(y, z); <... - ether_addr_copy(z, x); ...> @@ identifier a.x; @@ - if (<+... x ...+>) {} @@ identifier a.x; @@ if (<+... x ...+>) { ... } - else {} @@ identifier a.x; expression e; @@ - if (<+... x ...+>@e) - {} - else + if (!(e)) {...} @@ expression x, y, z; @@ - x = of_get_mac_address(y, z); + of_get_mac_address(y, z); ... when != x </spml> All drivers, except drivers/net/ethernet/aeroflex/greth.c, were compile-time tested. Suggested-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2021-04-12 17:47:17 +00:00
if (!ret) {
ks8851_write_mac_addr(dev);
return;
}
if (ks->rc_ccr & CCR_EEPROM) {
ks8851_read_mac_addr(dev);
if (is_valid_ether_addr(dev->dev_addr))
return;
netdev_err(ks->netdev, "invalid mac address read %pM\n",
dev->dev_addr);
}
eth_hw_addr_random(dev);
ks8851_write_mac_addr(dev);
}
/**
* ks8851_dbg_dumpkkt - dump initial packet contents to debug
* @ks: The device state
* @rxpkt: The data for the received packet
*
* Dump the initial data from the packet to dev_dbg().
*/
static void ks8851_dbg_dumpkkt(struct ks8851_net *ks, u8 *rxpkt)
{
netdev_dbg(ks->netdev,
"pkt %02x%02x%02x%02x %02x%02x%02x%02x %02x%02x%02x%02x\n",
rxpkt[4], rxpkt[5], rxpkt[6], rxpkt[7],
rxpkt[8], rxpkt[9], rxpkt[10], rxpkt[11],
rxpkt[12], rxpkt[13], rxpkt[14], rxpkt[15]);
}
/**
* ks8851_rx_pkts - receive packets from the host
* @ks: The device information.
*
* This is called from the IRQ work queue when the system detects that there
* are packets in the receive queue. Find out how many packets there are and
* read them from the FIFO.
*/
static void ks8851_rx_pkts(struct ks8851_net *ks)
{
struct sk_buff *skb;
unsigned rxfc;
unsigned rxlen;
unsigned rxstat;
u8 *rxpkt;
rxfc = (ks8851_rdreg16(ks, KS_RXFCTR) >> 8) & 0xff;
netif_dbg(ks, rx_status, ks->netdev,
"%s: %d packets\n", __func__, rxfc);
/* Currently we're issuing a read per packet, but we could possibly
* improve the code by issuing a single read, getting the receive
* header, allocating the packet and then reading the packet data
* out in one go.
*
* This form of operation would require us to hold the SPI bus'
* chipselect low during the entie transaction to avoid any
* reset to the data stream coming from the chip.
*/
for (; rxfc != 0; rxfc--) {
rxstat = ks8851_rdreg16(ks, KS_RXFHSR);
rxlen = ks8851_rdreg16(ks, KS_RXFHBCR) & RXFHBCR_CNT_MASK;
netif_dbg(ks, rx_status, ks->netdev,
"rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen);
/* the length of the packet includes the 32bit CRC */
/* set dma read address */
ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00);
net: ks8851: Dequeue RX packets explicitly The ks8851 driver lets the chip auto-dequeue received packets once they have been read in full. It achieves that by setting the ADRFE flag in the RXQCR register ("Auto-Dequeue RXQ Frame Enable"). However if allocation of a packet's socket buffer or retrieval of the packet over the SPI bus fails, the packet will not have been read in full and is not auto-dequeued. Such partial retrieval of a packet confuses the chip's RX queue management: On the next RX interrupt, the first packet read from the queue will be the one left there previously and this one can be retrieved without issues. But for any newly received packets, the frame header status and byte count registers (RXFHSR and RXFHBCR) contain bogus values, preventing their retrieval. The chip allows explicitly dequeueing a packet from the RX queue by setting the RRXEF flag in the RXQCR register ("Release RX Error Frame"). This could be used to dequeue the packet in case of an error, but if that error is a failed SPI transfer, it is unknown if the packet was transferred in full and was auto-dequeued or if it was only transferred in part and requires an explicit dequeue. The safest approach is thus to always dequeue packets explicitly and forgo auto-dequeueing. Without this change, I've witnessed packet retrieval break completely when an SPI DMA transfer fails, requiring a chip reset. Explicit dequeueing magically fixes this and makes packet retrieval absolutely robust for me. The chip's documentation suggests auto-dequeuing and uses the RRXEF flag only to dequeue error frames which the driver doesn't want to retrieve. But that seems to be a fair-weather approach. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20 14:02:00 +00:00
/* start DMA access */
ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
if (rxlen > 4) {
unsigned int rxalign;
rxlen -= 4;
rxalign = ALIGN(rxlen, 4);
skb = netdev_alloc_skb_ip_align(ks->netdev, rxalign);
if (skb) {
/* 4 bytes of status header + 4 bytes of
* garbage: we put them before ethernet
* header, so that they are copied,
* but ignored.
*/
rxpkt = skb_put(skb, rxlen) - 8;
ks->rdfifo(ks, rxpkt, rxalign + 8);
if (netif_msg_pktdata(ks))
ks8851_dbg_dumpkkt(ks, rxpkt);
skb->protocol = eth_type_trans(skb, ks->netdev);
net: ks8851: Handle softirqs at the end of IRQ thread to fix hang [ Upstream commit be0384bf599cf1eb8d337517feeb732d71f75a6f ] The ks8851_irq() thread may call ks8851_rx_pkts() in case there are any packets in the MAC FIFO, which calls netif_rx(). This netif_rx() implementation is guarded by local_bh_disable() and local_bh_enable(). The local_bh_enable() may call do_softirq() to run softirqs in case any are pending. One of the softirqs is net_rx_action, which ultimately reaches the driver .start_xmit callback. If that happens, the system hangs. The entire call chain is below: ks8851_start_xmit_par from netdev_start_xmit netdev_start_xmit from dev_hard_start_xmit dev_hard_start_xmit from sch_direct_xmit sch_direct_xmit from __dev_queue_xmit __dev_queue_xmit from __neigh_update __neigh_update from neigh_update neigh_update from arp_process.constprop.0 arp_process.constprop.0 from __netif_receive_skb_one_core __netif_receive_skb_one_core from process_backlog process_backlog from __napi_poll.constprop.0 __napi_poll.constprop.0 from net_rx_action net_rx_action from __do_softirq __do_softirq from call_with_stack call_with_stack from do_softirq do_softirq from __local_bh_enable_ip __local_bh_enable_ip from netif_rx netif_rx from ks8851_irq ks8851_irq from irq_thread_fn irq_thread_fn from irq_thread irq_thread from kthread kthread from ret_from_fork The hang happens because ks8851_irq() first locks a spinlock in ks8851_par.c ks8851_lock_par() spin_lock_irqsave(&ksp->lock, ...) and with that spinlock locked, calls netif_rx(). Once the execution reaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again which attempts to claim the already locked spinlock again, and the hang happens. Move the do_softirq() call outside of the spinlock protected section of ks8851_irq() by disabling BHs around the entire spinlock protected section of ks8851_irq() handler. Place local_bh_enable() outside of the spinlock protected section, so that it can trigger do_softirq() without the ks8851_par.c ks8851_lock_par() spinlock being held, and safely call ks8851_start_xmit_par() without attempting to lock the already locked spinlock. Since ks8851_irq() is protected by local_bh_disable()/local_bh_enable() now, replace netif_rx() with __netif_rx() which is not duplicating the local_bh_disable()/local_bh_enable() calls. Fixes: 797047f875b5 ("net: ks8851: Implement Parallel bus operations") Signed-off-by: Marek Vasut <marex@denx.de> Link: https://lore.kernel.org/r/20240405203204.82062-2-marex@denx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-05 20:30:40 +00:00
__netif_rx(skb);
ks->netdev->stats.rx_packets++;
ks->netdev->stats.rx_bytes += rxlen;
}
}
net: ks8851: Dequeue RX packets explicitly The ks8851 driver lets the chip auto-dequeue received packets once they have been read in full. It achieves that by setting the ADRFE flag in the RXQCR register ("Auto-Dequeue RXQ Frame Enable"). However if allocation of a packet's socket buffer or retrieval of the packet over the SPI bus fails, the packet will not have been read in full and is not auto-dequeued. Such partial retrieval of a packet confuses the chip's RX queue management: On the next RX interrupt, the first packet read from the queue will be the one left there previously and this one can be retrieved without issues. But for any newly received packets, the frame header status and byte count registers (RXFHSR and RXFHBCR) contain bogus values, preventing their retrieval. The chip allows explicitly dequeueing a packet from the RX queue by setting the RRXEF flag in the RXQCR register ("Release RX Error Frame"). This could be used to dequeue the packet in case of an error, but if that error is a failed SPI transfer, it is unknown if the packet was transferred in full and was auto-dequeued or if it was only transferred in part and requires an explicit dequeue. The safest approach is thus to always dequeue packets explicitly and forgo auto-dequeueing. Without this change, I've witnessed packet retrieval break completely when an SPI DMA transfer fails, requiring a chip reset. Explicit dequeueing magically fixes this and makes packet retrieval absolutely robust for me. The chip's documentation suggests auto-dequeuing and uses the RRXEF flag only to dequeue error frames which the driver doesn't want to retrieve. But that seems to be a fair-weather approach. Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: Frank Pavlic <f.pavlic@kunbus.de> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-20 14:02:00 +00:00
/* end DMA access and dequeue packet */
ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_RRXEF);
}
}
/**
* ks8851_irq - IRQ handler for dealing with interrupt requests
* @irq: IRQ number
* @_ks: cookie
*
* This handler is invoked when the IRQ line asserts to find out what happened.
* As we cannot allow ourselves to sleep in HARDIRQ context, this handler runs
* in thread context.
*
* Read the interrupt status, work out what needs to be done and then clear
* any of the interrupts that are not needed.
*/
static irqreturn_t ks8851_irq(int irq, void *_ks)
{
struct ks8851_net *ks = _ks;
unsigned handled = 0;
unsigned long flags;
unsigned int status;
net: ks8851: Handle softirqs at the end of IRQ thread to fix hang [ Upstream commit be0384bf599cf1eb8d337517feeb732d71f75a6f ] The ks8851_irq() thread may call ks8851_rx_pkts() in case there are any packets in the MAC FIFO, which calls netif_rx(). This netif_rx() implementation is guarded by local_bh_disable() and local_bh_enable(). The local_bh_enable() may call do_softirq() to run softirqs in case any are pending. One of the softirqs is net_rx_action, which ultimately reaches the driver .start_xmit callback. If that happens, the system hangs. The entire call chain is below: ks8851_start_xmit_par from netdev_start_xmit netdev_start_xmit from dev_hard_start_xmit dev_hard_start_xmit from sch_direct_xmit sch_direct_xmit from __dev_queue_xmit __dev_queue_xmit from __neigh_update __neigh_update from neigh_update neigh_update from arp_process.constprop.0 arp_process.constprop.0 from __netif_receive_skb_one_core __netif_receive_skb_one_core from process_backlog process_backlog from __napi_poll.constprop.0 __napi_poll.constprop.0 from net_rx_action net_rx_action from __do_softirq __do_softirq from call_with_stack call_with_stack from do_softirq do_softirq from __local_bh_enable_ip __local_bh_enable_ip from netif_rx netif_rx from ks8851_irq ks8851_irq from irq_thread_fn irq_thread_fn from irq_thread irq_thread from kthread kthread from ret_from_fork The hang happens because ks8851_irq() first locks a spinlock in ks8851_par.c ks8851_lock_par() spin_lock_irqsave(&ksp->lock, ...) and with that spinlock locked, calls netif_rx(). Once the execution reaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again which attempts to claim the already locked spinlock again, and the hang happens. Move the do_softirq() call outside of the spinlock protected section of ks8851_irq() by disabling BHs around the entire spinlock protected section of ks8851_irq() handler. Place local_bh_enable() outside of the spinlock protected section, so that it can trigger do_softirq() without the ks8851_par.c ks8851_lock_par() spinlock being held, and safely call ks8851_start_xmit_par() without attempting to lock the already locked spinlock. Since ks8851_irq() is protected by local_bh_disable()/local_bh_enable() now, replace netif_rx() with __netif_rx() which is not duplicating the local_bh_disable()/local_bh_enable() calls. Fixes: 797047f875b5 ("net: ks8851: Implement Parallel bus operations") Signed-off-by: Marek Vasut <marex@denx.de> Link: https://lore.kernel.org/r/20240405203204.82062-2-marex@denx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-05 20:30:40 +00:00
local_bh_disable();
ks8851_lock(ks, &flags);
status = ks8851_rdreg16(ks, KS_ISR);
netif_dbg(ks, intr, ks->netdev,
"%s: status 0x%04x\n", __func__, status);
if (status & IRQ_LCI)
handled |= IRQ_LCI;
if (status & IRQ_LDI) {
u16 pmecr = ks8851_rdreg16(ks, KS_PMECR);
pmecr &= ~PMECR_WKEVT_MASK;
ks8851_wrreg16(ks, KS_PMECR, pmecr | PMECR_WKEVT_LINK);
handled |= IRQ_LDI;
}
if (status & IRQ_RXPSI)
handled |= IRQ_RXPSI;
if (status & IRQ_TXI) {
net: ks8851: Fix TX stall caused by TX buffer overrun commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream. There is a bug in the ks8851 Ethernet driver that more data is written to the hardware TX buffer than actually available. This is caused by wrong accounting of the free TX buffer space. The driver maintains a tx_space variable that represents the TX buffer space that is deemed to be free. The ks8851_start_xmit_spi() function adds an SKB to a queue if tx_space is large enough and reduces tx_space by the amount of buffer space it will later need in the TX buffer and then schedules a work item. If there is not enough space then the TX queue is stopped. The worker function ks8851_tx_work() dequeues all the SKBs and writes the data into the hardware TX buffer. The last packet will trigger an interrupt after it was send. Here it is assumed that all data fits into the TX buffer. In the interrupt routine (which runs asynchronously because it is a threaded interrupt) tx_space is updated with the current value from the hardware. Also the TX queue is woken up again. Now it could happen that after data was sent to the hardware and before handling the TX interrupt new data is queued in ks8851_start_xmit_spi() when the TX buffer space had still some space left. When the interrupt is actually handled tx_space is updated from the hardware but now we already have new SKBs queued that have not been written to the hardware TX buffer yet. Since tx_space has been overwritten by the value from the hardware the space is not accounted for. Now we have more data queued then buffer space available in the hardware and ks8851_tx_work() will potentially overrun the hardware TX buffer. In many cases it will still work because often the buffer is written out fast enough so that no overrun occurs but for example if the peer throttles us via flow control then an overrun may happen. This can be fixed in different ways. The most simple way would be to set tx_space to 0 before writing data to the hardware TX buffer preventing the queuing of more SKBs until the TX interrupt has been handled. I have chosen a slightly more efficient (and still rather simple) way and track the amount of data that is already queued and not yet written to the hardware. When new SKBs are to be queued the already queued amount of data is honoured when checking free TX buffer space. I tested this with a setup of two linked KS8851 running iperf3 between the two in bidirectional mode. Before the fix I got a stall after some minutes. With the fix I saw now issues anymore after hours. Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-14 18:11:12 +00:00
unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR);
net: ks8851: Fix TX stall caused by TX buffer overrun commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream. There is a bug in the ks8851 Ethernet driver that more data is written to the hardware TX buffer than actually available. This is caused by wrong accounting of the free TX buffer space. The driver maintains a tx_space variable that represents the TX buffer space that is deemed to be free. The ks8851_start_xmit_spi() function adds an SKB to a queue if tx_space is large enough and reduces tx_space by the amount of buffer space it will later need in the TX buffer and then schedules a work item. If there is not enough space then the TX queue is stopped. The worker function ks8851_tx_work() dequeues all the SKBs and writes the data into the hardware TX buffer. The last packet will trigger an interrupt after it was send. Here it is assumed that all data fits into the TX buffer. In the interrupt routine (which runs asynchronously because it is a threaded interrupt) tx_space is updated with the current value from the hardware. Also the TX queue is woken up again. Now it could happen that after data was sent to the hardware and before handling the TX interrupt new data is queued in ks8851_start_xmit_spi() when the TX buffer space had still some space left. When the interrupt is actually handled tx_space is updated from the hardware but now we already have new SKBs queued that have not been written to the hardware TX buffer yet. Since tx_space has been overwritten by the value from the hardware the space is not accounted for. Now we have more data queued then buffer space available in the hardware and ks8851_tx_work() will potentially overrun the hardware TX buffer. In many cases it will still work because often the buffer is written out fast enough so that no overrun occurs but for example if the peer throttles us via flow control then an overrun may happen. This can be fixed in different ways. The most simple way would be to set tx_space to 0 before writing data to the hardware TX buffer preventing the queuing of more SKBs until the TX interrupt has been handled. I have chosen a slightly more efficient (and still rather simple) way and track the amount of data that is already queued and not yet written to the hardware. When new SKBs are to be queued the already queued amount of data is honoured when checking free TX buffer space. I tested this with a setup of two linked KS8851 running iperf3 between the two in bidirectional mode. Before the fix I got a stall after some minutes. With the fix I saw now issues anymore after hours. Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-14 18:11:12 +00:00
netif_dbg(ks, intr, ks->netdev,
"%s: txspace %d\n", __func__, tx_space);
net: ks8851: Fix TX stall caused by TX buffer overrun commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream. There is a bug in the ks8851 Ethernet driver that more data is written to the hardware TX buffer than actually available. This is caused by wrong accounting of the free TX buffer space. The driver maintains a tx_space variable that represents the TX buffer space that is deemed to be free. The ks8851_start_xmit_spi() function adds an SKB to a queue if tx_space is large enough and reduces tx_space by the amount of buffer space it will later need in the TX buffer and then schedules a work item. If there is not enough space then the TX queue is stopped. The worker function ks8851_tx_work() dequeues all the SKBs and writes the data into the hardware TX buffer. The last packet will trigger an interrupt after it was send. Here it is assumed that all data fits into the TX buffer. In the interrupt routine (which runs asynchronously because it is a threaded interrupt) tx_space is updated with the current value from the hardware. Also the TX queue is woken up again. Now it could happen that after data was sent to the hardware and before handling the TX interrupt new data is queued in ks8851_start_xmit_spi() when the TX buffer space had still some space left. When the interrupt is actually handled tx_space is updated from the hardware but now we already have new SKBs queued that have not been written to the hardware TX buffer yet. Since tx_space has been overwritten by the value from the hardware the space is not accounted for. Now we have more data queued then buffer space available in the hardware and ks8851_tx_work() will potentially overrun the hardware TX buffer. In many cases it will still work because often the buffer is written out fast enough so that no overrun occurs but for example if the peer throttles us via flow control then an overrun may happen. This can be fixed in different ways. The most simple way would be to set tx_space to 0 before writing data to the hardware TX buffer preventing the queuing of more SKBs until the TX interrupt has been handled. I have chosen a slightly more efficient (and still rather simple) way and track the amount of data that is already queued and not yet written to the hardware. When new SKBs are to be queued the already queued amount of data is honoured when checking free TX buffer space. I tested this with a setup of two linked KS8851 running iperf3 between the two in bidirectional mode. Before the fix I got a stall after some minutes. With the fix I saw now issues anymore after hours. Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-14 18:11:12 +00:00
spin_lock(&ks->statelock);
ks->tx_space = tx_space;
if (netif_queue_stopped(ks->netdev))
netif_wake_queue(ks->netdev);
spin_unlock(&ks->statelock);
net: ks8851: Fix TX stall caused by TX buffer overrun commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream. There is a bug in the ks8851 Ethernet driver that more data is written to the hardware TX buffer than actually available. This is caused by wrong accounting of the free TX buffer space. The driver maintains a tx_space variable that represents the TX buffer space that is deemed to be free. The ks8851_start_xmit_spi() function adds an SKB to a queue if tx_space is large enough and reduces tx_space by the amount of buffer space it will later need in the TX buffer and then schedules a work item. If there is not enough space then the TX queue is stopped. The worker function ks8851_tx_work() dequeues all the SKBs and writes the data into the hardware TX buffer. The last packet will trigger an interrupt after it was send. Here it is assumed that all data fits into the TX buffer. In the interrupt routine (which runs asynchronously because it is a threaded interrupt) tx_space is updated with the current value from the hardware. Also the TX queue is woken up again. Now it could happen that after data was sent to the hardware and before handling the TX interrupt new data is queued in ks8851_start_xmit_spi() when the TX buffer space had still some space left. When the interrupt is actually handled tx_space is updated from the hardware but now we already have new SKBs queued that have not been written to the hardware TX buffer yet. Since tx_space has been overwritten by the value from the hardware the space is not accounted for. Now we have more data queued then buffer space available in the hardware and ks8851_tx_work() will potentially overrun the hardware TX buffer. In many cases it will still work because often the buffer is written out fast enough so that no overrun occurs but for example if the peer throttles us via flow control then an overrun may happen. This can be fixed in different ways. The most simple way would be to set tx_space to 0 before writing data to the hardware TX buffer preventing the queuing of more SKBs until the TX interrupt has been handled. I have chosen a slightly more efficient (and still rather simple) way and track the amount of data that is already queued and not yet written to the hardware. When new SKBs are to be queued the already queued amount of data is honoured when checking free TX buffer space. I tested this with a setup of two linked KS8851 running iperf3 between the two in bidirectional mode. Before the fix I got a stall after some minutes. With the fix I saw now issues anymore after hours. Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-14 18:11:12 +00:00
handled |= IRQ_TXI;
}
if (status & IRQ_RXI)
handled |= IRQ_RXI;
if (status & IRQ_SPIBEI) {
netdev_err(ks->netdev, "%s: spi bus error\n", __func__);
handled |= IRQ_SPIBEI;
}
ks8851_wrreg16(ks, KS_ISR, handled);
if (status & IRQ_RXI) {
/* the datasheet says to disable the rx interrupt during
* packet read-out, however we're masking the interrupt
* from the device so do not bother masking just the RX
* from the device. */
ks8851_rx_pkts(ks);
}
/* if something stopped the rx process, probably due to wanting
* to change the rx settings, then do something about restarting
* it. */
if (status & IRQ_RXPSI) {
struct ks8851_rxctrl *rxc = &ks->rxctrl;
/* update the multicast hash table */
ks8851_wrreg16(ks, KS_MAHTR0, rxc->mchash[0]);
ks8851_wrreg16(ks, KS_MAHTR1, rxc->mchash[1]);
ks8851_wrreg16(ks, KS_MAHTR2, rxc->mchash[2]);
ks8851_wrreg16(ks, KS_MAHTR3, rxc->mchash[3]);
ks8851_wrreg16(ks, KS_RXCR2, rxc->rxcr2);
ks8851_wrreg16(ks, KS_RXCR1, rxc->rxcr1);
}
ks8851_unlock(ks, &flags);
if (status & IRQ_LCI)
mii_check_link(&ks->mii);
net: ks8851: Handle softirqs at the end of IRQ thread to fix hang [ Upstream commit be0384bf599cf1eb8d337517feeb732d71f75a6f ] The ks8851_irq() thread may call ks8851_rx_pkts() in case there are any packets in the MAC FIFO, which calls netif_rx(). This netif_rx() implementation is guarded by local_bh_disable() and local_bh_enable(). The local_bh_enable() may call do_softirq() to run softirqs in case any are pending. One of the softirqs is net_rx_action, which ultimately reaches the driver .start_xmit callback. If that happens, the system hangs. The entire call chain is below: ks8851_start_xmit_par from netdev_start_xmit netdev_start_xmit from dev_hard_start_xmit dev_hard_start_xmit from sch_direct_xmit sch_direct_xmit from __dev_queue_xmit __dev_queue_xmit from __neigh_update __neigh_update from neigh_update neigh_update from arp_process.constprop.0 arp_process.constprop.0 from __netif_receive_skb_one_core __netif_receive_skb_one_core from process_backlog process_backlog from __napi_poll.constprop.0 __napi_poll.constprop.0 from net_rx_action net_rx_action from __do_softirq __do_softirq from call_with_stack call_with_stack from do_softirq do_softirq from __local_bh_enable_ip __local_bh_enable_ip from netif_rx netif_rx from ks8851_irq ks8851_irq from irq_thread_fn irq_thread_fn from irq_thread irq_thread from kthread kthread from ret_from_fork The hang happens because ks8851_irq() first locks a spinlock in ks8851_par.c ks8851_lock_par() spin_lock_irqsave(&ksp->lock, ...) and with that spinlock locked, calls netif_rx(). Once the execution reaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again which attempts to claim the already locked spinlock again, and the hang happens. Move the do_softirq() call outside of the spinlock protected section of ks8851_irq() by disabling BHs around the entire spinlock protected section of ks8851_irq() handler. Place local_bh_enable() outside of the spinlock protected section, so that it can trigger do_softirq() without the ks8851_par.c ks8851_lock_par() spinlock being held, and safely call ks8851_start_xmit_par() without attempting to lock the already locked spinlock. Since ks8851_irq() is protected by local_bh_disable()/local_bh_enable() now, replace netif_rx() with __netif_rx() which is not duplicating the local_bh_disable()/local_bh_enable() calls. Fixes: 797047f875b5 ("net: ks8851: Implement Parallel bus operations") Signed-off-by: Marek Vasut <marex@denx.de> Link: https://lore.kernel.org/r/20240405203204.82062-2-marex@denx.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-05 20:30:40 +00:00
local_bh_enable();
return IRQ_HANDLED;
}
/**
* ks8851_flush_tx_work - flush outstanding TX work
* @ks: The device state
*/
static void ks8851_flush_tx_work(struct ks8851_net *ks)
{
if (ks->flush_tx_work)
ks->flush_tx_work(ks);
}
/**
* ks8851_net_open - open network device
* @dev: The network device being opened.
*
* Called when the network device is marked active, such as a user executing
* 'ifconfig up' on the device.
*/
static int ks8851_net_open(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
unsigned long flags;
int ret;
ret = request_threaded_irq(dev->irq, NULL, ks8851_irq,
IRQF_TRIGGER_LOW | IRQF_ONESHOT,
dev->name, ks);
if (ret < 0) {
netdev_err(dev, "failed to get irq\n");
return ret;
}
/* lock the card, even if we may not actually be doing anything
* else at the moment */
ks8851_lock(ks, &flags);
netif_dbg(ks, ifup, ks->netdev, "opening\n");
/* bring chip out of any power saving mode it was in */
ks8851_set_powermode(ks, PMECR_PM_NORMAL);
/* issue a soft reset to the RX/TX QMU to put it into a known
* state. */
ks8851_soft_reset(ks, GRR_QMU);
/* setup transmission parameters */
ks8851_wrreg16(ks, KS_TXCR, (TXCR_TXE | /* enable transmit process */
TXCR_TXPE | /* pad to min length */
TXCR_TXCRC | /* add CRC */
TXCR_TXFCE)); /* enable flow control */
/* auto-increment tx data, reset tx pointer */
ks8851_wrreg16(ks, KS_TXFDPR, TXFDPR_TXFPAI);
/* setup receiver control */
ks8851_wrreg16(ks, KS_RXCR1, (RXCR1_RXPAFMA | /* from mac filter */
RXCR1_RXFCE | /* enable flow control */
RXCR1_RXBE | /* broadcast enable */
RXCR1_RXUE | /* unicast enable */
RXCR1_RXE)); /* enable rx block */
/* transfer entire frames out in one go */
ks8851_wrreg16(ks, KS_RXCR2, RXCR2_SRDBL_FRAME);
/* set receive counter timeouts */
ks8851_wrreg16(ks, KS_RXDTTR, 1000); /* 1ms after first frame to IRQ */
ks8851_wrreg16(ks, KS_RXDBCTR, 4096); /* >4Kbytes in buffer to IRQ */
ks8851_wrreg16(ks, KS_RXFCTR, 10); /* 10 frames to IRQ */
ks->rc_rxqcr = (RXQCR_RXFCTE | /* IRQ on frame count exceeded */
RXQCR_RXDBCTE | /* IRQ on byte count exceeded */
RXQCR_RXDTTE); /* IRQ on time exceeded */
ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
/* clear then enable interrupts */
ks8851_wrreg16(ks, KS_ISR, ks->rc_ier);
ks8851_wrreg16(ks, KS_IER, ks->rc_ier);
net: ks8851: Fix TX stall caused by TX buffer overrun commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream. There is a bug in the ks8851 Ethernet driver that more data is written to the hardware TX buffer than actually available. This is caused by wrong accounting of the free TX buffer space. The driver maintains a tx_space variable that represents the TX buffer space that is deemed to be free. The ks8851_start_xmit_spi() function adds an SKB to a queue if tx_space is large enough and reduces tx_space by the amount of buffer space it will later need in the TX buffer and then schedules a work item. If there is not enough space then the TX queue is stopped. The worker function ks8851_tx_work() dequeues all the SKBs and writes the data into the hardware TX buffer. The last packet will trigger an interrupt after it was send. Here it is assumed that all data fits into the TX buffer. In the interrupt routine (which runs asynchronously because it is a threaded interrupt) tx_space is updated with the current value from the hardware. Also the TX queue is woken up again. Now it could happen that after data was sent to the hardware and before handling the TX interrupt new data is queued in ks8851_start_xmit_spi() when the TX buffer space had still some space left. When the interrupt is actually handled tx_space is updated from the hardware but now we already have new SKBs queued that have not been written to the hardware TX buffer yet. Since tx_space has been overwritten by the value from the hardware the space is not accounted for. Now we have more data queued then buffer space available in the hardware and ks8851_tx_work() will potentially overrun the hardware TX buffer. In many cases it will still work because often the buffer is written out fast enough so that no overrun occurs but for example if the peer throttles us via flow control then an overrun may happen. This can be fixed in different ways. The most simple way would be to set tx_space to 0 before writing data to the hardware TX buffer preventing the queuing of more SKBs until the TX interrupt has been handled. I have chosen a slightly more efficient (and still rather simple) way and track the amount of data that is already queued and not yet written to the hardware. When new SKBs are to be queued the already queued amount of data is honoured when checking free TX buffer space. I tested this with a setup of two linked KS8851 running iperf3 between the two in bidirectional mode. Before the fix I got a stall after some minutes. With the fix I saw now issues anymore after hours. Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver") Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Ben Dooks <ben.dooks@codethink.co.uk> Cc: Tristram Ha <Tristram.Ha@microchip.com> Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-14 18:11:12 +00:00
ks->queued_len = 0;
netif_start_queue(ks->netdev);
netif_dbg(ks, ifup, ks->netdev, "network device up\n");
ks8851_unlock(ks, &flags);
mii_check_link(&ks->mii);
return 0;
}
/**
* ks8851_net_stop - close network device
* @dev: The device being closed.
*
* Called to close down a network device which has been active. Cancell any
* work, shutdown the RX and TX process and then place the chip into a low
* power state whilst it is not being used.
*/
static int ks8851_net_stop(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
unsigned long flags;
netif_info(ks, ifdown, dev, "shutting down\n");
netif_stop_queue(dev);
ks8851_lock(ks, &flags);
ks8851: Fix mutex deadlock in ks8851_net_stop() There is a potential deadlock scenario when the ks8851 driver is removed. The interrupt handler schedules a workqueue which acquires a mutex that ks8851_net_stop() also acquires before flushing the workqueue. Previously lockdep wouldn't be able to find this problem but now that it has the support we can trigger this lockdep warning by rmmoding the driver after an ifconfig up. Fix the possible deadlock by disabling the interrupts in the chip and then release the lock across the workqueue flushing. The mutex is only there to proect the registers anyway so this should be ok. ======================================================= [ INFO: possible circular locking dependency detected ] 3.0.21-00021-g8b33780-dirty #2911 ------------------------------------------------------- rmmod/125 is trying to acquire lock: ((&ks->irq_work)){+.+...}, at: [<c019e0b8>] flush_work+0x0/0xac but task is already holding lock: (&ks->lock){+.+...}, at: [<bf00b850>] ks8851_net_stop+0x64/0x138 [ks8851] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&ks->lock){+.+...}: [<c01b89c8>] __lock_acquire+0x940/0x9f8 [<c01b9058>] lock_acquire+0x10c/0x130 [<c083dbec>] mutex_lock_nested+0x68/0x3dc [<bf00bd48>] ks8851_irq_work+0x24/0x46c [ks8851] [<c019c580>] process_one_work+0x2d8/0x518 [<c019cb98>] worker_thread+0x220/0x3a0 [<c01a2ad4>] kthread+0x88/0x94 [<c0107008>] kernel_thread_exit+0x0/0x8 -> #0 ((&ks->irq_work)){+.+...}: [<c01b7984>] validate_chain+0x914/0x1018 [<c01b89c8>] __lock_acquire+0x940/0x9f8 [<c01b9058>] lock_acquire+0x10c/0x130 [<c019e104>] flush_work+0x4c/0xac [<bf00b858>] ks8851_net_stop+0x6c/0x138 [ks8851] [<c06b209c>] __dev_close_many+0x98/0xcc [<c06b2174>] dev_close_many+0x68/0xd0 [<c06b22ec>] rollback_registered_many+0xcc/0x2b8 [<c06b2554>] rollback_registered+0x28/0x34 [<c06b25b8>] unregister_netdevice_queue+0x58/0x7c [<c06b25f4>] unregister_netdev+0x18/0x20 [<bf00c1f4>] ks8851_remove+0x64/0xb4 [ks8851] [<c049ddf0>] spi_drv_remove+0x18/0x1c [<c0468e98>] __device_release_driver+0x7c/0xbc [<c0468f64>] driver_detach+0x8c/0xb4 [<c0467f00>] bus_remove_driver+0xb8/0xe8 [<c01c1d20>] sys_delete_module+0x1e8/0x27c [<c0105ec0>] ret_fast_syscall+0x0/0x3c other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ks->lock); lock((&ks->irq_work)); lock(&ks->lock); lock((&ks->irq_work)); *** DEADLOCK *** 4 locks held by rmmod/125: #0: (&__lockdep_no_validate__){+.+.+.}, at: [<c0468f44>] driver_detach+0x6c/0xb4 #1: (&__lockdep_no_validate__){+.+.+.}, at: [<c0468f50>] driver_detach+0x78/0xb4 #2: (rtnl_mutex){+.+.+.}, at: [<c06b25e8>] unregister_netdev+0xc/0x20 #3: (&ks->lock){+.+...}, at: [<bf00b850>] ks8851_net_stop+0x64/0x138 [ks8851] Cc: Ben Dooks <ben-linux@fluff.org> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2012-04-18 17:25:58 +00:00
/* turn off the IRQs and ack any outstanding */
ks8851_wrreg16(ks, KS_IER, 0x0000);
ks8851_wrreg16(ks, KS_ISR, 0xffff);
ks8851_unlock(ks, &flags);
/* stop any outstanding work */
ks8851_flush_tx_work(ks);
flush_work(&ks->rxctrl_work);
ks8851_lock(ks, &flags);
/* shutdown RX process */
ks8851_wrreg16(ks, KS_RXCR1, 0x0000);
/* shutdown TX process */
ks8851_wrreg16(ks, KS_TXCR, 0x0000);
/* set powermode to soft power down to save power */
ks8851_set_powermode(ks, PMECR_PM_SOFTDOWN);
ks8851_unlock(ks, &flags);
/* ensure any queued tx buffers are dumped */
while (!skb_queue_empty(&ks->txq)) {
struct sk_buff *txb = skb_dequeue(&ks->txq);
netif_dbg(ks, ifdown, ks->netdev,
"%s: freeing txb %p\n", __func__, txb);
dev_kfree_skb(txb);
}
free_irq(dev->irq, ks);
return 0;
}
/**
* ks8851_start_xmit - transmit packet
* @skb: The buffer to transmit
* @dev: The device used to transmit the packet.
*
* Called by the network layer to transmit the @skb. Queue the packet for
* the device and schedule the necessary work to transmit the packet when
* it is free.
*
* We do this to firstly avoid sleeping with the network device locked,
* and secondly so we can round up more than one packet to transmit which
* means we can try and avoid generating too many transmit done interrupts.
*/
static netdev_tx_t ks8851_start_xmit(struct sk_buff *skb,
struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
return ks->start_xmit(skb, dev);
}
/**
* ks8851_rxctrl_work - work handler to change rx mode
* @work: The work structure this belongs to.
*
* Lock the device and issue the necessary changes to the receive mode from
* the network device layer. This is done so that we can do this without
* having to sleep whilst holding the network device lock.
*
* Since the recommendation from Micrel is that the RXQ is shutdown whilst the
* receive parameters are programmed, we issue a write to disable the RXQ and
* then wait for the interrupt handler to be triggered once the RXQ shutdown is
* complete. The interrupt handler then writes the new values into the chip.
*/
static void ks8851_rxctrl_work(struct work_struct *work)
{
struct ks8851_net *ks = container_of(work, struct ks8851_net, rxctrl_work);
unsigned long flags;
ks8851_lock(ks, &flags);
/* need to shutdown RXQ before modifying filter parameters */
ks8851_wrreg16(ks, KS_RXCR1, 0x00);
ks8851_unlock(ks, &flags);
}
static void ks8851_set_rx_mode(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
struct ks8851_rxctrl rxctrl;
memset(&rxctrl, 0, sizeof(rxctrl));
if (dev->flags & IFF_PROMISC) {
/* interface to receive everything */
rxctrl.rxcr1 = RXCR1_RXAE | RXCR1_RXINVF;
} else if (dev->flags & IFF_ALLMULTI) {
/* accept all multicast packets */
rxctrl.rxcr1 = (RXCR1_RXME | RXCR1_RXAE |
RXCR1_RXPAFMA | RXCR1_RXMAFMA);
} else if (dev->flags & IFF_MULTICAST && !netdev_mc_empty(dev)) {
struct netdev_hw_addr *ha;
u32 crc;
/* accept some multicast */
netdev_for_each_mc_addr(ha, dev) {
crc = ether_crc(ETH_ALEN, ha->addr);
crc >>= (32 - 6); /* get top six bits */
rxctrl.mchash[crc >> 4] |= (1 << (crc & 0xf));
}
rxctrl.rxcr1 = RXCR1_RXME | RXCR1_RXPAFMA;
} else {
/* just accept broadcast / unicast */
rxctrl.rxcr1 = RXCR1_RXPAFMA;
}
rxctrl.rxcr1 |= (RXCR1_RXUE | /* unicast enable */
RXCR1_RXBE | /* broadcast enable */
RXCR1_RXE | /* RX process enable */
RXCR1_RXFCE); /* enable flow control */
rxctrl.rxcr2 |= RXCR2_SRDBL_FRAME;
/* schedule work to do the actual set of the data if needed */
spin_lock(&ks->statelock);
if (memcmp(&rxctrl, &ks->rxctrl, sizeof(rxctrl)) != 0) {
memcpy(&ks->rxctrl, &rxctrl, sizeof(ks->rxctrl));
schedule_work(&ks->rxctrl_work);
}
spin_unlock(&ks->statelock);
}
static int ks8851_set_mac_address(struct net_device *dev, void *addr)
{
struct sockaddr *sa = addr;
if (netif_running(dev))
return -EBUSY;
if (!is_valid_ether_addr(sa->sa_data))
return -EADDRNOTAVAIL;
eth_hw_addr_set(dev, sa->sa_data);
return ks8851_write_mac_addr(dev);
}
static int ks8851_net_ioctl(struct net_device *dev, struct ifreq *req, int cmd)
{
struct ks8851_net *ks = netdev_priv(dev);
if (!netif_running(dev))
return -EINVAL;
return generic_mii_ioctl(&ks->mii, if_mii(req), cmd, NULL);
}
static const struct net_device_ops ks8851_netdev_ops = {
.ndo_open = ks8851_net_open,
.ndo_stop = ks8851_net_stop,
.ndo_eth_ioctl = ks8851_net_ioctl,
.ndo_start_xmit = ks8851_start_xmit,
.ndo_set_mac_address = ks8851_set_mac_address,
.ndo_set_rx_mode = ks8851_set_rx_mode,
.ndo_validate_addr = eth_validate_addr,
};
/* ethtool support */
static void ks8851_get_drvinfo(struct net_device *dev,
struct ethtool_drvinfo *di)
{
strscpy(di->driver, "KS8851", sizeof(di->driver));
strscpy(di->version, "1.00", sizeof(di->version));
strscpy(di->bus_info, dev_name(dev->dev.parent), sizeof(di->bus_info));
}
static u32 ks8851_get_msglevel(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
return ks->msg_enable;
}
static void ks8851_set_msglevel(struct net_device *dev, u32 to)
{
struct ks8851_net *ks = netdev_priv(dev);
ks->msg_enable = to;
}
static int ks8851_get_link_ksettings(struct net_device *dev,
struct ethtool_link_ksettings *cmd)
{
struct ks8851_net *ks = netdev_priv(dev);
mii_ethtool_get_link_ksettings(&ks->mii, cmd);
return 0;
}
static int ks8851_set_link_ksettings(struct net_device *dev,
const struct ethtool_link_ksettings *cmd)
{
struct ks8851_net *ks = netdev_priv(dev);
return mii_ethtool_set_link_ksettings(&ks->mii, cmd);
}
static u32 ks8851_get_link(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
return mii_link_ok(&ks->mii);
}
static int ks8851_nway_reset(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
return mii_nway_restart(&ks->mii);
}
/* EEPROM support */
static void ks8851_eeprom_regread(struct eeprom_93cx6 *ee)
{
struct ks8851_net *ks = ee->data;
unsigned val;
val = ks8851_rdreg16(ks, KS_EEPCR);
ee->reg_data_out = (val & EEPCR_EESB) ? 1 : 0;
ee->reg_data_clock = (val & EEPCR_EESCK) ? 1 : 0;
ee->reg_chip_select = (val & EEPCR_EECS) ? 1 : 0;
}
static void ks8851_eeprom_regwrite(struct eeprom_93cx6 *ee)
{
struct ks8851_net *ks = ee->data;
unsigned val = EEPCR_EESA; /* default - eeprom access on */
if (ee->drive_data)
val |= EEPCR_EESRWA;
if (ee->reg_data_in)
val |= EEPCR_EEDO;
if (ee->reg_data_clock)
val |= EEPCR_EESCK;
if (ee->reg_chip_select)
val |= EEPCR_EECS;
ks8851_wrreg16(ks, KS_EEPCR, val);
}
/**
* ks8851_eeprom_claim - claim device EEPROM and activate the interface
* @ks: The network device state.
*
* Check for the presence of an EEPROM, and then activate software access
* to the device.
*/
static int ks8851_eeprom_claim(struct ks8851_net *ks)
{
/* start with clock low, cs high */
ks8851_wrreg16(ks, KS_EEPCR, EEPCR_EESA | EEPCR_EECS);
return 0;
}
/**
* ks8851_eeprom_release - release the EEPROM interface
* @ks: The device state
*
* Release the software access to the device EEPROM
*/
static void ks8851_eeprom_release(struct ks8851_net *ks)
{
unsigned val = ks8851_rdreg16(ks, KS_EEPCR);
ks8851_wrreg16(ks, KS_EEPCR, val & ~EEPCR_EESA);
}
#define KS_EEPROM_MAGIC (0x00008851)
static int ks8851_set_eeprom(struct net_device *dev,
struct ethtool_eeprom *ee, u8 *data)
{
struct ks8851_net *ks = netdev_priv(dev);
int offset = ee->offset;
unsigned long flags;
int len = ee->len;
u16 tmp;
/* currently only support byte writing */
if (len != 1)
return -EINVAL;
if (ee->magic != KS_EEPROM_MAGIC)
return -EINVAL;
if (!(ks->rc_ccr & CCR_EEPROM))
return -ENOENT;
ks8851_lock(ks, &flags);
ks8851_eeprom_claim(ks);
eeprom_93cx6_wren(&ks->eeprom, true);
/* ethtool currently only supports writing bytes, which means
* we have to read/modify/write our 16bit EEPROMs */
eeprom_93cx6_read(&ks->eeprom, offset/2, &tmp);
if (offset & 1) {
tmp &= 0xff;
tmp |= *data << 8;
} else {
tmp &= 0xff00;
tmp |= *data;
}
eeprom_93cx6_write(&ks->eeprom, offset/2, tmp);
eeprom_93cx6_wren(&ks->eeprom, false);
ks8851_eeprom_release(ks);
ks8851_unlock(ks, &flags);
return 0;
}
static int ks8851_get_eeprom(struct net_device *dev,
struct ethtool_eeprom *ee, u8 *data)
{
struct ks8851_net *ks = netdev_priv(dev);
int offset = ee->offset;
unsigned long flags;
int len = ee->len;
/* must be 2 byte aligned */
if (len & 1 || offset & 1)
return -EINVAL;
if (!(ks->rc_ccr & CCR_EEPROM))
return -ENOENT;
ks8851_lock(ks, &flags);
ks8851_eeprom_claim(ks);
ee->magic = KS_EEPROM_MAGIC;
eeprom_93cx6_multiread(&ks->eeprom, offset/2, (__le16 *)data, len/2);
ks8851_eeprom_release(ks);
ks8851_unlock(ks, &flags);
return 0;
}
static int ks8851_get_eeprom_len(struct net_device *dev)
{
struct ks8851_net *ks = netdev_priv(dev);
/* currently, we assume it is an 93C46 attached, so return 128 */
return ks->rc_ccr & CCR_EEPROM ? 128 : 0;
}
static const struct ethtool_ops ks8851_ethtool_ops = {
.get_drvinfo = ks8851_get_drvinfo,
.get_msglevel = ks8851_get_msglevel,
.set_msglevel = ks8851_set_msglevel,
.get_link = ks8851_get_link,
.nway_reset = ks8851_nway_reset,
.get_eeprom_len = ks8851_get_eeprom_len,
.get_eeprom = ks8851_get_eeprom,
.set_eeprom = ks8851_set_eeprom,
.get_link_ksettings = ks8851_get_link_ksettings,
.set_link_ksettings = ks8851_set_link_ksettings,
};
/* MII interface controls */
/**
* ks8851_phy_reg - convert MII register into a KS8851 register
* @reg: MII register number.
*
* Return the KS8851 register number for the corresponding MII PHY register
* if possible. Return zero if the MII register has no direct mapping to the
* KS8851 register set.
*/
static int ks8851_phy_reg(int reg)
{
switch (reg) {
case MII_BMCR:
return KS_P1MBCR;
case MII_BMSR:
return KS_P1MBSR;
case MII_PHYSID1:
return KS_PHY1ILR;
case MII_PHYSID2:
return KS_PHY1IHR;
case MII_ADVERTISE:
return KS_P1ANAR;
case MII_LPA:
return KS_P1ANLPR;
}
return -EOPNOTSUPP;
}
static int ks8851_phy_read_common(struct net_device *dev, int phy_addr, int reg)
{
struct ks8851_net *ks = netdev_priv(dev);
unsigned long flags;
int result;
int ksreg;
ksreg = ks8851_phy_reg(reg);
if (ksreg < 0)
return ksreg;
ks8851_lock(ks, &flags);
result = ks8851_rdreg16(ks, ksreg);
ks8851_unlock(ks, &flags);
return result;
}
/**
* ks8851_phy_read - MII interface PHY register read.
* @dev: The network device the PHY is on.
* @phy_addr: Address of PHY (ignored as we only have one)
* @reg: The register to read.
*
* This call reads data from the PHY register specified in @reg. Since the
* device does not support all the MII registers, the non-existent values
* are always returned as zero.
*
* We return zero for unsupported registers as the MII code does not check
* the value returned for any error status, and simply returns it to the
* caller. The mii-tool that the driver was tested with takes any -ve error
* as real PHY capabilities, thus displaying incorrect data to the user.
*/
static int ks8851_phy_read(struct net_device *dev, int phy_addr, int reg)
{
int ret;
ret = ks8851_phy_read_common(dev, phy_addr, reg);
if (ret < 0)
return 0x0; /* no error return allowed, so use zero */
return ret;
}
static void ks8851_phy_write(struct net_device *dev,
int phy, int reg, int value)
{
struct ks8851_net *ks = netdev_priv(dev);
unsigned long flags;
int ksreg;
ksreg = ks8851_phy_reg(reg);
if (ksreg >= 0) {
ks8851_lock(ks, &flags);
ks8851_wrreg16(ks, ksreg, value);
ks8851_unlock(ks, &flags);
}
}
static int ks8851_mdio_read(struct mii_bus *bus, int phy_id, int reg)
{
struct ks8851_net *ks = bus->priv;
if (phy_id != 0)
return -EOPNOTSUPP;
/* KS8851 PHY ID registers are swapped in HW, swap them back. */
if (reg == MII_PHYSID1)
reg = MII_PHYSID2;
else if (reg == MII_PHYSID2)
reg = MII_PHYSID1;
return ks8851_phy_read_common(ks->netdev, phy_id, reg);
}
static int ks8851_mdio_write(struct mii_bus *bus, int phy_id, int reg, u16 val)
{
struct ks8851_net *ks = bus->priv;
ks8851_phy_write(ks->netdev, phy_id, reg, val);
return 0;
}
/**
* ks8851_read_selftest - read the selftest memory info.
* @ks: The device state
*
* Read and check the TX/RX memory selftest information.
*/
static void ks8851_read_selftest(struct ks8851_net *ks)
{
unsigned both_done = MBIR_TXMBF | MBIR_RXMBF;
unsigned rd;
rd = ks8851_rdreg16(ks, KS_MBIR);
if ((rd & both_done) != both_done) {
netdev_warn(ks->netdev, "Memory selftest not finished\n");
return;
}
if (rd & MBIR_TXMBFA)
netdev_err(ks->netdev, "TX memory selftest fail\n");
if (rd & MBIR_RXMBFA)
netdev_err(ks->netdev, "RX memory selftest fail\n");
}
/* driver bus management functions */
#ifdef CONFIG_PM_SLEEP
int ks8851_suspend(struct device *dev)
{
struct ks8851_net *ks = dev_get_drvdata(dev);
struct net_device *netdev = ks->netdev;
if (netif_running(netdev)) {
netif_device_detach(netdev);
ks8851_net_stop(netdev);
}
return 0;
}
EXPORT_SYMBOL_GPL(ks8851_suspend);
int ks8851_resume(struct device *dev)
{
struct ks8851_net *ks = dev_get_drvdata(dev);
struct net_device *netdev = ks->netdev;
if (netif_running(netdev)) {
ks8851_net_open(netdev);
netif_device_attach(netdev);
}
return 0;
}
EXPORT_SYMBOL_GPL(ks8851_resume);
#endif
static int ks8851_register_mdiobus(struct ks8851_net *ks, struct device *dev)
{
struct mii_bus *mii_bus;
int ret;
mii_bus = mdiobus_alloc();
if (!mii_bus)
return -ENOMEM;
mii_bus->name = "ks8851_eth_mii";
mii_bus->read = ks8851_mdio_read;
mii_bus->write = ks8851_mdio_write;
mii_bus->priv = ks;
mii_bus->parent = dev;
mii_bus->phy_mask = ~((u32)BIT(0));
snprintf(mii_bus->id, MII_BUS_ID_SIZE, "%s", dev_name(dev));
ret = mdiobus_register(mii_bus);
if (ret)
goto err_mdiobus_register;
ks->mii_bus = mii_bus;
return 0;
err_mdiobus_register:
mdiobus_free(mii_bus);
return ret;
}
static void ks8851_unregister_mdiobus(struct ks8851_net *ks)
{
mdiobus_unregister(ks->mii_bus);
mdiobus_free(ks->mii_bus);
}
int ks8851_probe_common(struct net_device *netdev, struct device *dev,
int msg_en)
{
struct ks8851_net *ks = netdev_priv(netdev);
unsigned cider;
int ret;
ks->netdev = netdev;
ks->tx_space = 6144;
ks->gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
ret = PTR_ERR_OR_ZERO(ks->gpio);
if (ret) {
if (ret != -EPROBE_DEFER)
dev_err(dev, "reset gpio request failed: %d\n", ret);
return ret;
}
ret = gpiod_set_consumer_name(ks->gpio, "ks8851_rst_n");
if (ret) {
dev_err(dev, "failed to set reset gpio name: %d\n", ret);
return ret;
}
ks->vdd_io = devm_regulator_get(dev, "vdd-io");
if (IS_ERR(ks->vdd_io)) {
ret = PTR_ERR(ks->vdd_io);
goto err_reg_io;
}
ret = regulator_enable(ks->vdd_io);
if (ret) {
dev_err(dev, "regulator vdd_io enable fail: %d\n", ret);
goto err_reg_io;
}
ks->vdd_reg = devm_regulator_get(dev, "vdd");
if (IS_ERR(ks->vdd_reg)) {
ret = PTR_ERR(ks->vdd_reg);
goto err_reg;
}
ret = regulator_enable(ks->vdd_reg);
if (ret) {
dev_err(dev, "regulator vdd enable fail: %d\n", ret);
goto err_reg;
}
if (ks->gpio) {
usleep_range(10000, 11000);
gpiod_set_value_cansleep(ks->gpio, 0);
}
spin_lock_init(&ks->statelock);
INIT_WORK(&ks->rxctrl_work, ks8851_rxctrl_work);
SET_NETDEV_DEV(netdev, dev);
/* setup EEPROM state */
ks->eeprom.data = ks;
ks->eeprom.width = PCI_EEPROM_WIDTH_93C46;
ks->eeprom.register_read = ks8851_eeprom_regread;
ks->eeprom.register_write = ks8851_eeprom_regwrite;
/* setup mii state */
ks->mii.dev = netdev;
ks->mii.phy_id = 1;
ks->mii.phy_id_mask = 1;
ks->mii.reg_num_mask = 0xf;
ks->mii.mdio_read = ks8851_phy_read;
ks->mii.mdio_write = ks8851_phy_write;
dev_info(dev, "message enable is %d\n", msg_en);
ret = ks8851_register_mdiobus(ks, dev);
if (ret)
goto err_mdio;
/* set the default message enable */
ks->msg_enable = netif_msg_init(msg_en, NETIF_MSG_DRV |
NETIF_MSG_PROBE |
NETIF_MSG_LINK);
skb_queue_head_init(&ks->txq);
netdev->ethtool_ops = &ks8851_ethtool_ops;
dev_set_drvdata(dev, ks);
netif_carrier_off(ks->netdev);
netdev->if_port = IF_PORT_100BASET;
netdev->netdev_ops = &ks8851_netdev_ops;
/* issue a global soft reset to reset the device. */
ks8851_soft_reset(ks, GRR_GSR);
/* simple check for a valid chip being connected to the bus */
cider = ks8851_rdreg16(ks, KS_CIDER);
if ((cider & ~CIDER_REV_MASK) != CIDER_ID) {
dev_err(dev, "failed to read device ID\n");
ret = -ENODEV;
goto err_id;
}
/* cache the contents of the CCR register for EEPROM, etc. */
ks->rc_ccr = ks8851_rdreg16(ks, KS_CCR);
ks8851_read_selftest(ks);
ks8851_init_mac(ks, dev->of_node);
ret = register_netdev(netdev);
if (ret) {
dev_err(dev, "failed to register network device\n");
goto err_id;
}
netdev_info(netdev, "revision %d, MAC %pM, IRQ %d, %s EEPROM\n",
CIDER_REV_GET(cider), netdev->dev_addr, netdev->irq,
ks->rc_ccr & CCR_EEPROM ? "has" : "no");
return 0;
err_id:
ks8851_unregister_mdiobus(ks);
err_mdio:
if (ks->gpio)
gpiod_set_value_cansleep(ks->gpio, 1);
regulator_disable(ks->vdd_reg);
err_reg:
regulator_disable(ks->vdd_io);
err_reg_io:
return ret;
}
EXPORT_SYMBOL_GPL(ks8851_probe_common);
void ks8851_remove_common(struct device *dev)
{
struct ks8851_net *priv = dev_get_drvdata(dev);
ks8851_unregister_mdiobus(priv);
if (netif_msg_drv(priv))
dev_info(dev, "remove\n");
unregister_netdev(priv->netdev);
if (priv->gpio)
gpiod_set_value_cansleep(priv->gpio, 1);
regulator_disable(priv->vdd_reg);
regulator_disable(priv->vdd_io);
}
EXPORT_SYMBOL_GPL(ks8851_remove_common);
MODULE_DESCRIPTION("KS8851 Network driver");
MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
MODULE_LICENSE("GPL");