Patch "spi/spi-xilinx: Fix race condition on last word read" has been added to the 4.3-stable tree

This is a note to let you know that I've just added the patch titled

spi/spi-xilinx: Fix race condition on last word read

to the 4.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
spi-spi-xilinx-fix-race-condition-on-last-word-read.patch
and it can be found in the queue-4.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ricardo Ribalda Delgado <[email protected]>
Date: Wed, 28 Oct 2015 16:16:02 +0100
Subject: spi/spi-xilinx: Fix race condition on last word read

From: Ricardo Ribalda Delgado <[email protected]>

commit eca37c7c117460e2fbe4e32c991bff32a961f688 upstream.

Some users have reported that in polled mode the driver fails randomly to read the last word of the transfer.

The end condition used for the transmissions (in polled and irq mode) has been the TX_EMPTY flag. But Lars-Peter Clausen has identified a delay from the TX_EMPTY to the actual end of the data rx.

I believe that this race condition has not been detected until now because of the latency added by the IRQ handler or the PCIe bridge. This bugs affects setups with low latency access to the spi core.

This patch replaces the readout logic:

For all the words, except the last one, the TX_EMPTY flag is used (and cached).

If !TX_EMPY or is the last word. The status register is read and the RX_EMPTY flag is used.

The performance is not affected: there is an extra read of the Status Register, but the readout can start as soon as there is a word in the buffer.

---
 drivers/spi/spi-xilinx.c |   38 ++++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 14 deletions(-)

@@ -270,6 +270,7 @@ static int xilinx_spi_txrx_bufs(struct s
 
 	while (remaining_words) {
 		int n_words, tx_words, rx_words;
+		u32 sr;
 
 		n_words = min(remaining_words, xspi->buffer_size);
 

@@ -284,24 +285,33 @@ static int xilinx_spi_txrx_bufs(struct s
 		if (use_irq) {
 			xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
 			wait_for_completion(&xspi->done);
-		} else
-			while (!(xspi->read_fn(xspi->regs + XSPI_SR_OFFSET) &
-						XSPI_SR_TX_EMPTY_MASK))
-				;
-
-		/* A transmit has just completed. Process received data and
-		 * check for more data to transmit. Always inhibit the
-		 * transmitter while the Isr refills the transmit register/FIFO,
-		 * or make sure it is stopped if we're done.
-		 */
-		if (use_irq)
+			/* A transmit has just completed. Process received data
+			 * and check for more data to transmit. Always inhibit
+			 * the transmitter while the Isr refills the transmit
+			 * register/FIFO, or make sure it is stopped if we're
+			 * done.
+			 */
 			xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
-			       xspi->regs + XSPI_CR_OFFSET);
+				       xspi->regs + XSPI_CR_OFFSET);
+			sr = XSPI_SR_TX_EMPTY_MASK;
+		} else
+			sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
 
 		/* Read out all the data from the Rx FIFO */
 		rx_words = n_words;
-		while (rx_words--)
-			xilinx_spi_rx(xspi);
+		while (rx_words) {
+			if ((sr & XSPI_SR_TX_EMPTY_MASK) && (rx_words > 1)) {
+				xilinx_spi_rx(xspi);
+				rx_words--;
+				continue;
+			}
+
+			sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+			if (!(sr & XSPI_SR_RX_EMPTY_MASK)) {
+				xilinx_spi_rx(xspi);
+				rx_words--;
+			}
+		}
 
 		remaining_words -= n_words;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.3/v4l2-ctrls-arrays-are-also-considered-compound-controls.patch queue-4.3/spi-spi-xilinx-fix-race-condition-on-last-word-read.patch