[Cbe-oss-dev] [PATCH] spufs: avoid using backing operation for wbox write

[Arnd Bergmann]

On Tuesday 07 August 2007, Arnd Bergmann wrote:

> I've also been able to spot a bug in this area in the line
> 'ctx->csa.prob.mb_stat_R = (((4 - slot) & 0xff) << 8);' when writing
> to the mailbox from user space, we overwrite the entire mb_stat_R
> state, not just the part responsible for the inbound mbox.

If this is indeed the problem, please try the patch below.

	Arnd <><
--

Subject: spufs: fix mb_stat_R contents in backing_wbox_write

When a process writes into the inbound spu mailbox (wbox) while
the context is saved, we accidentally break the contents of
the mb_stat_R register, which can cause the user side to hang.

Signed-off-by: Arnd Bergmann <arnd.bergmann at de.ibm.com>

--- a/arch/powerpc/platforms/cell/spufs/backing_ops.c
+++ b/arch/powerpc/platforms/cell/spufs/backing_ops.c
@@ -162,7 +162,8 @@ static int spu_backing_wbox_write(struct spu_context *ctx, u32 data)
 		BUG_ON(avail != (4 - slot));
 		ctx->csa.spu_mailbox_data[slot] = data;
 		ctx->csa.spu_chnlcnt_RW[29] = ++slot;
-		ctx->csa.prob.mb_stat_R = (((4 - slot) & 0xff) << 8);
+		ctx->csa.prob.mb_stat_R &= ~(0x00ff00);
+		ctx->csa.prob.mb_stat_R |= (((4 - slot) & 0xff) << 8);
 		gen_spu_event(ctx, MFC_SPU_MAILBOX_WRITTEN_EVENT);
 		ret = 4;
 	} else {