From nobody Fri Apr 3 08:25:42 2026 Received: from TWMBX01.aspeed.com (mail.aspeedtech.com [211.20.114.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30B443C5555 for ; Tue, 31 Mar 2026 12:12:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=211.20.114.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774959153; cv=none; b=bfewMElmJ1CZk3NZY5ga0iNOiAhgckP6aJXSenbS/agOzka9fZuI52jGIoZ1c85J1iikEceWHMUbSjMnFo2vyqVhnYqaqblbJvaj5m04NcuwNeyFuOi+nPAY3ES5gwwyA9dBOdaZJroWt+WdGSe011zlKdjPEXSEdc/8lDhOkhQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774959153; c=relaxed/simple; bh=zXraJM4rpO14mz7DUQbRXxLT+rMD+bP7LNhl1brNqWo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:To:CC; b=Wm0vp9/6fTPKSuL2APkJUta7jcasmBbaLgq3tDJF4W9KjBfuEk7spjelpvHRNjZPnk4J8G46EhqcXtqcCBBxIcZm040UDW8groCGO+MnqSwxE7Xu95Spils/MLWUCH62VZ6JlCSr8NKDp8oS17JXFc9tpU5rYpnAWGLlIB3E2Dg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=aspeedtech.com; spf=pass smtp.mailfrom=aspeedtech.com; arc=none smtp.client-ip=211.20.114.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=aspeedtech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=aspeedtech.com Received: from TWMBX01.aspeed.com (192.168.0.62) by TWMBX01.aspeed.com (192.168.0.62) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.10; Tue, 31 Mar 2026 20:12:29 +0800 Received: from [127.0.1.1] (192.168.10.13) by TWMBX01.aspeed.com (192.168.0.62) with Microsoft SMTP Server id 15.2.1748.10 via Frontend Transport; Tue, 31 Mar 2026 20:12:29 +0800 From: Billy Tsai Date: Tue, 31 Mar 2026 20:12:23 +0800 Subject: [PATCH] i3c: mipi-i3c-hci: fix atomic updates to RING_OPERATION1 register Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260331-i3c-hci-dma-lock-v1-1-708bc5848381@aspeedtech.com> X-B4-Tracking: v=1; b=H4sIACa6y2kC/x3MSQqAMAxA0atI1gZS64RXERclRg2OtCBC8e4Wl 2/xf4QgXiVAl0XwcmvQ80gweQa8uGMW1DEZCipqstagWsaFFcfd4Xbyiq4hcqYkbssKUnZ5mfT 5l/3wvh/2fLkKYgAAAA== X-Change-ID: 20260331-i3c-hci-dma-lock-a700a140c845 To: Alexandre Belloni , Frank Li , Nicolas Pitre , Boris Brezillon CC: , , "Billy Tsai" X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774959149; l=3526; i=billy_tsai@aspeedtech.com; s=20251118; h=from:subject:message-id; bh=zXraJM4rpO14mz7DUQbRXxLT+rMD+bP7LNhl1brNqWo=; b=wjuA4WSwCZqv8JAsbxYjpEqyHR1FkkSzQCDMBoeSDMEHU45qNt6ZxWONH6n3NOeDC2dFHpvOy UNWYAkkyOahCiQ33LgAOSBe3S8s6zM7tNHeXAk+RfeQd057j70Ip8LF X-Developer-Key: i=billy_tsai@aspeedtech.com; a=ed25519; pk=/A8qvgZ6CPfnwKgT6/+k+nvXOkN477MshEGJvVdzeeQ= The RING_OPERATION1 register contains multiple bitfields (enqueue, software dequeue, and IBI dequeue pointers) that are updated from different contexts. Because these updates are performed via read-modify-write sequences, concurrent access from process and IRQ contexts can lead to lost updates. Example: CPU 0 (hci_dma_queue_xfer): reads RING_OPERATION1 (enq=3D5, deq=3D2) CPU 1 (hci_dma_xfer_done): reads RING_OPERATION1 (enq=3D5, deq=3D2) CPU 0: updates enq to 6, writes back (enq=3D6, deq=3D2) CPU 1: updates deq to 3, writes back (enq=3D5, deq=3D3) <--Pointer 6 is LOS= T! Fix this by wrapping all accesses to RING_OPERATION1 and associated ring state variables (xfer_space, done_ptr, ibi_chunk_ptr) in the unified hci->lock. This ensures that the read-modify-write sequence is atomic across enqueue, dequeue, and completion paths. Specifically: - Add hci->lock protection to hci_dma_xfer_done() and hci_dma_process_ibi(). - Ensure hci_dma_queue_xfer() and hci_dma_dequeue_xfer() use the unified lock consistently. - Ensure the software-maintained ring pointers are synchronized with the hardware pointer updates. Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver") Signed-off-by: Billy Tsai --- drivers/i3c/master/mipi-i3c-hci/dma.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mip= i-i3c-hci/dma.c index e487ef52f6b4..3d967157411e 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -617,10 +617,12 @@ static int hci_dma_handle_error(struct i3c_hci *hci, = struct hci_xfer *xfer_list, static void hci_dma_xfer_done(struct i3c_hci *hci, struct hci_rh_data *rh) { u32 op1_val, op2_val, resp, *ring_resp; - unsigned int tid, done_ptr =3D rh->done_ptr; + unsigned int tid, done_ptr; unsigned int done_cnt =3D 0; struct hci_xfer *xfer; =20 + spin_lock(&hci->lock); + done_ptr =3D rh->done_ptr; for (;;) { op2_val =3D rh_reg_read(RING_OPERATION2); if (done_ptr =3D=3D FIELD_GET(RING_OP2_CR_DEQ_PTR, op2_val)) @@ -659,6 +661,7 @@ static void hci_dma_xfer_done(struct i3c_hci *hci, stru= ct hci_rh_data *rh) op1_val &=3D ~RING_OP1_CR_SW_DEQ_PTR; op1_val |=3D FIELD_PREP(RING_OP1_CR_SW_DEQ_PTR, done_ptr); rh_reg_write(RING_OPERATION1, op1_val); + spin_unlock(&hci->lock); } =20 static int hci_dma_request_ibi(struct i3c_hci *hci, struct i3c_dev_desc *d= ev, @@ -716,6 +719,7 @@ static void hci_dma_process_ibi(struct i3c_hci *hci, st= ruct hci_rh_data *rh) void *ring_ibi_data; dma_addr_t ring_ibi_data_dma; =20 + spin_lock(&hci->lock); op1_val =3D rh_reg_read(RING_OPERATION1); deq_ptr =3D FIELD_GET(RING_OP1_IBI_DEQ_PTR, op1_val); =20 @@ -767,6 +771,7 @@ static void hci_dma_process_ibi(struct i3c_hci *hci, st= ruct hci_rh_data *rh) dev_dbg(&hci->master.dev, "no LAST_STATUS available (e=3D%d d=3D%d)", enq_ptr, deq_ptr); + spin_unlock(&hci->lock); return; } deq_ptr =3D last_ptr + 1; @@ -849,6 +854,7 @@ static void hci_dma_process_ibi(struct i3c_hci *hci, st= ruct hci_rh_data *rh) =20 /* and tell the hardware about freed chunks */ rh_reg_write(CHUNK_CONTROL, rh_reg_read(CHUNK_CONTROL) + ibi_chunks); + spin_unlock(&hci->lock); } =20 static bool hci_dma_irq_handler(struct i3c_hci *hci) --- base-commit: f311a05784634febd299f03476b80f3f18489767 change-id: 20260331-i3c-hci-dma-lock-a700a140c845 Best regards, --=20 Billy Tsai