target/linux/brcm2708/patches-4.14/950-0207-dwc_otg-add-smp_mb-to-prevent-driver-state-corruptio.patch

   1 From efdde709efccc4f95c7641eea8960dbc31fc58b5 Mon Sep 17 00:00:00 2001
   2 From: P33M <p33m@github.com>
   3 Date: Thu, 15 Feb 2018 11:22:44 +0000
   4 Subject: [PATCH 207/454] dwc_otg: add smp_mb() to prevent driver state
   5  corruption on boot
   6
   7 Occasional crashes have been seen where the FIQ code dereferences
   8 invalid/random pointers immediately after being set up, leading to
   9 panic on boot.
  10
  11 The crash occurs as the FIQ code races against hcd_init_fiq() and
  12 the hcd_init_fiq() code races against the outstanding memory stores
  13 from dwc_otg_hcd_init(). Use explicit barriers after touching
  14 driver state.
  15 ---
  16  drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 11 ++++++++++-
  17  1 file changed, 10 insertions(+), 1 deletion(-)
  18
  19 --- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
  20 +++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
  21 @@ -519,6 +519,11 @@ static void hcd_init_fiq(void *cookie)
  22                 DWC_ERROR("Can't get FIQ irq");
  23                 return;
  24         }
  25 +       /*
  26 +        * We could take an interrupt immediately after enabling the FIQ.
  27 +        * Ensure coherency of hcd->fiq_state.
  28 +        */
  29 +       smp_mb();
  30         enable_fiq(irq);
  31         local_fiq_enable();
  32  #endif
  33 @@ -598,7 +603,11 @@ int hcd_init(dwc_bus_dev_t *_dev)
  34
  35         if (fiq_enable) {
  36                 if (num_online_cpus() > 1) {
  37 -                       /* bcm2709: can run the FIQ on a separate core to IRQs */
  38 +                       /*
  39 +                        * bcm2709: can run the FIQ on a separate core to IRQs.
  40 +                        * Ensure driver state is visible to other cores before setting up the FIQ.
  41 +                        */
  42 +                       smp_mb();
  43                         smp_call_function_single(1, hcd_init_fiq, otg_dev, 1);
  44                 } else {
  45                         smp_call_function_single(0, hcd_init_fiq, otg_dev, 1);