ENGR00289237 PXP: fix a multiple instances hang issue

In pxp_issue_pending(), the wait for pxp done processes will be woken up
together in PXP ISR. So there will be some situations that one process will
set PXP hardware registers after another process's setting but before the
first PXP task done. So the PXP hardware may be corrupted and hang maybe
happen.

Signed-off-by: Fancy Fang <B47543@freescale.com>

2 files changed, 11 insertions, 15 deletions

diff --git a/drivers/dma/pxp/pxp_device.c b/drivers/dma/pxp/pxp_device.c
index 140dce0a99f6..d05b06df0c90 100644
--- a/drivers/dma/pxp/pxp_device.c
+++ b/drivers/dma/pxp/pxp_device.c
@@ -433,12 +433,10 @@ static long pxp_device_ioctl(struct file *filp,
                         if (chan_id < 0 || chan_id >= NR_PXP_VIRT_CHANNEL)
                                 return -ENODEV;
 
-                        if (!wait_event_interruptible_timeout
+                        ret = wait_event_interruptible
                             (irq_info[chan_id].waitq,
-                             (irq_info[chan_id].irq_pending != 0), 2 * HZ)) {
-                                pr_warning("pxp blocking: timeout.\n");
-                                return -ETIME;
-                        } else if (signal_pending(current)) {
+                             (irq_info[chan_id].irq_pending != 0));
+                        if (ret < 0) {
                                 printk(KERN_WARNING
                                        "pxp interrupt received.\n");
                                 return -ERESTARTSYS;
diff --git a/drivers/dma/pxp/pxp_dma_v2.c b/drivers/dma/pxp/pxp_dma_v2.c
index 0df4200d2481..55c35b35a875 100644
--- a/drivers/dma/pxp/pxp_dma_v2.c
+++ b/drivers/dma/pxp/pxp_dma_v2.c
@@ -477,10 +477,11 @@ static void pxp_set_oln(int layer_no, struct pxps *pxp)
         struct pxp_config_data *pxp_conf = &pxp->pxp_conf_state;
         struct pxp_layer_param *olparams_data = &pxp_conf->ol_param[layer_no];
         dma_addr_t phys_addr = olparams_data->paddr;
-        __raw_writel(phys_addr, pxp->base + HW_PXP_AS_BUF);
         u32 pitch = olparams_data->stride ? olparams_data->stride :
                                             olparams_data->width;
 
+        __raw_writel(phys_addr, pxp->base + HW_PXP_AS_BUF);
+
         /* Fixme */
         if (olparams_data->width == 0 && olparams_data->height == 0) {
                 __raw_writel(0xffffffff, pxp->base + HW_PXP_OUT_AS_ULC);
@@ -1114,9 +1115,6 @@ static void pxpdma_dostart_work(struct pxps *pxp)
         struct pxp_channel *pxp_chan = NULL;
         unsigned long flags, flags1;
 
-        while (__raw_readl(pxp->base + HW_PXP_CTRL) & BM_PXP_CTRL_ENABLE)
-                ;
-
         spin_lock_irqsave(&pxp->lock, flags);
         if (list_empty(&head)) {
                 pxp->pxp_ongoing = 0;
@@ -1323,7 +1321,7 @@ static irqreturn_t pxp_irq(int irq, void *dev_id)
         list_splice_init(&desc->tx_list, &pxp_chan->free_list);
         list_move(&desc->list, &pxp_chan->free_list);
 
-        wake_up(&pxp->done);
+        wake_up_interruptible(&pxp->done);
         pxp->pxp_ongoing = 0;
         mod_timer(&pxp->clk_timer, jiffies + msecs_to_jiffies(timeout_in_ms));
 
@@ -1439,6 +1437,7 @@ static void pxp_issue_pending(struct dma_chan *chan)
         struct pxp_dma *pxp_dma = to_pxp_dma(chan->device);
         struct pxps *pxp = to_pxp(pxp_dma);
         unsigned long flags0, flags;
+        int ret;
 
         spin_lock_irqsave(&pxp->lock, flags0);
         spin_lock_irqsave(&pxp_chan->lock, flags);
@@ -1456,11 +1455,10 @@ static void pxp_issue_pending(struct dma_chan *chan)
         spin_unlock_irqrestore(&pxp->lock, flags0);
 
         pxp_clk_enable(pxp);
-        if (!wait_event_interruptible_timeout(pxp->done, PXP_WAITCON, 2 * HZ) ||
-                signal_pending(current)) {
-                pxp_clk_disable(pxp);
-                return;
-        }
+again:
+        ret = wait_event_interruptible_exclusive(pxp->done, PXP_WAITCON);
+        if (ret < 0)
+                goto again;
 
         spin_lock_irqsave(&pxp->lock, flags);
         pxp->pxp_ongoing = 1;