Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
From:   Frank Li <Frank.Li@nxp.com>
To:     miquel.raynal@bootlin.com, conor.culhane@silvaco.com,
        alexandre.belloni@bootlin.com, joe@perches.com,
        linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org,
        imx@lists.linux.dev
Subject: [PATCH 1/6] i3c: master: svc: fix race condition in ibi work thread
Date:   Mon, 16 Oct 2023 11:32:27 -0400
Message-Id: <20231016153232.2851095-2-Frank.Li@nxp.com>
In-Reply-To: <20231016153232.2851095-1-Frank.Li@nxp.com>
References: <20231016153232.2851095-1-Frank.Li@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?6Hb7fQ/bCrQpNyRFy3eS7Ipvehe6iM90xZtvB2BiY6/nnLDfLd4E245GcMLA?=
 =?us-ascii?Q?0qxmkuPZHSQ66klwvF6IWLUOfvpzLz1wXLD6zla5mrK+kCpYi1VglYK7ZHbR?=
 =?us-ascii?Q?N8i1kCVS+mxk/dOdKb3Su1sKr9EZWzkEYaDl4SlyBIKjn86fYj7kjMzJvxdv?=
 =?us-ascii?Q?hzc0xHqrB1+8jhFl3s47ObAGHvu5gscfiisTmzNix6q96OmfvmvPlCGKMWK8?=
 =?us-ascii?Q?Xa1J9qqTU3nPrvw4vkvV2LfZKY6px14U6LI7Zf+M/u9vlhp+0RaRFn9P2KIo?=
 =?us-ascii?Q?+BrnBKVdkSObqLkqIQaa5miJLLTkuJdDHTvzngdwnePlS789AM776lYRR5r9?=
 =?us-ascii?Q?/zZ3RwUtiwJlHyA0QicHKj2H0891uM96lC6IFT3lUy4rafCJ4+a0MR+qSF8O?=
 =?us-ascii?Q?IiNcgEnIwNysdRjYXs7Z9+jbpc4RABo2AqJSmpD/Qa+9mJZ143nijTkKugIj?=
 =?us-ascii?Q?2QidszjHeAhmgJn3OkAyyKFxHhFxN30N/nhA7eC/YCXRXOuy9cc1HzcmD8dz?=
 =?us-ascii?Q?PcjAHRDuCIxmvJV+qjAgP9WLDxu8yIrTdv807Au49xYMPd24HJWwnd9PbUHM?=
 =?us-ascii?Q?JUYmZxV1nbDaxPVy1gKwLBmTCDwCuYmpH5aosIC2lQtg4uwLwggTYR134cIZ?=
 =?us-ascii?Q?uvTiS0xWT0yfC7H97fd3h5xFIZzUn08VHhBlPXYvudIHmlWae4ffZGWRFfIn?=
 =?us-ascii?Q?UHSjDy6Hmjgc1FvI14x+jEwGjtyx6rv79X21u3BK7mS66BgD1hzvdKwf5dN7?=
 =?us-ascii?Q?3txuJtaLjyjtyQazWGgZ+XDyUsHzJ0b3B5EvvF66YqRdAh+5dQ35iDrk/Ozz?=
 =?us-ascii?Q?d8rPUxhy6U8ghHFO94atS5EPIbZ8KKqZOaUMAngBObrpZFrlPhLsxOap9qqT?=
 =?us-ascii?Q?Kdyc52o+vbE+LEBNdqsR7xs3+YHEbxji0WIMUjF4MOe2tknZ3DXzW77G7g9N?=
 =?us-ascii?Q?oIF1EMQrOj6Wp89OUCDgiWPN0aiPa1hxcPi1JG1RiYi0jNWYFs8byfsWhhS4?=
 =?us-ascii?Q?5O6UH4D0ICyhuCDBPwwMgqqP3O0o3l76oZUkv7U3m4boJnPb2Jka6n+PMKcL?=
 =?us-ascii?Q?W+8H9mPFkLGbr54NTvASElJb4aSCaguKbJZNmcBuLVPZuDj2Xy9+niXGHNRC?=
 =?us-ascii?Q?HB90Wj3TzlLjhNF6RVeU/q9sM4Q5jdd3CpRfOhbwL5mBxEBOi3I5xmx8H9eN?=
 =?us-ascii?Q?S/uAMLlxYNDxqAxYtko668ET2KzOUwgJdFotByGmzEK8PErABN3K5vyOhoQh?=
 =?us-ascii?Q?YbPMhTd63wSesnW7SVvg+onGzAdhQRnbJUbhPFoNiLWWuOWMaK4e1491HQHD?=
 =?us-ascii?Q?Vc90JskRm3iKLNpTBnIjAUSUaFyuUqgpEK5LBCKIzuCrxieHLqxmzUNWix6u?=
 =?us-ascii?Q?BW/cspn+C0sh0NEljmh5UOcm7afY/hwv05NJmYbg2TeSOVb6rLkKYOZYYnWN?=
 =?us-ascii?Q?QYXPy0OVXqpmhJuwJ0SMqMCisWfXhCwYBbXPlEAWZRDe/t/8ElftDQoeKrW2?=
 =?us-ascii?Q?tjf/TPMCeqqIfQifbRPCL7FHYe1rKSpaE9vIFfB0wBUoTdARF1SeMK9B1rAP?=
 =?us-ascii?Q?90h2EY+uHb3g18IQ9BI=3D?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 26d73f0e-e4e4-4fa2-cd0e-08dbce5d26b8
X-MS-Exchange-CrossTenant-AuthSource: AM6PR04MB4838.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2023 15:32:48.1604
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: q3XSOQmhczwsxHwqXMiJuWtIEs8HCTFdcCACjloCZHpkxHGjXMzkX/x9Ltzt2bUySyIzJPRJe/hun17mjCEgEg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB7592
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Mon, 16 Oct 2023 08:33:02 -0700 (PDT)

The ibi work thread operates asynchronously with other transfers, such as
svc_i3c_master_priv_xfers(). Introduces mutex protection to ensure the
completion of the entire i3c/i2c transaction.

Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
 drivers/i3c/master/svc-i3c-master.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index c308e22f0ac5..ebdb3ea1af9d 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -202,6 +202,7 @@ struct svc_i3c_master {
 		/* Prevent races within IBI handlers */
 		spinlock_t lock;
 	} ibi;
+	struct mutex lock;
 };
 
 /**
@@ -383,6 +384,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	u32 status, val;
 	int ret;
 
+	mutex_lock(&master->lock);
 	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
 	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
 	       SVC_I3C_MCTRL_IBIRESP_AUTO,
@@ -459,6 +461,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 
 reenable_ibis:
 	svc_i3c_master_enable_interrupts(master, SVC_I3C_MINT_SLVSTART);
+	mutex_unlock(&master->lock);
 }
 
 static irqreturn_t svc_i3c_master_irq_handler(int irq, void *dev_id)
@@ -1203,9 +1206,11 @@ static int svc_i3c_master_send_bdcast_ccc_cmd(struct svc_i3c_master *master,
 	cmd->read_len = 0;
 	cmd->continued = false;
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	ret = xfer->ret;
 	kfree(buf);
@@ -1249,9 +1254,11 @@ static int svc_i3c_master_send_direct_ccc_cmd(struct svc_i3c_master *master,
 	cmd->read_len = read_len;
 	cmd->continued = false;
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	if (cmd->read_len != xfer_len)
 		ccc->dests[0].payload.len = cmd->read_len;
@@ -1308,9 +1315,11 @@ static int svc_i3c_master_priv_xfers(struct i3c_dev_desc *dev,
 		cmd->continued = (i + 1) < nxfers;
 	}
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	ret = xfer->ret;
 	svc_i3c_master_free_xfer(xfer);
@@ -1346,9 +1355,11 @@ static int svc_i3c_master_i2c_xfers(struct i2c_dev_desc *dev,
 		cmd->continued = (i + 1 < nxfers);
 	}
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	ret = xfer->ret;
 	svc_i3c_master_free_xfer(xfer);
@@ -1539,6 +1550,8 @@ static int svc_i3c_master_probe(struct platform_device *pdev)
 
 	INIT_WORK(&master->hj_work, svc_i3c_master_hj_work);
 	INIT_WORK(&master->ibi_work, svc_i3c_master_ibi_work);
+	mutex_init(&master->lock);
+
 	ret = devm_request_irq(dev, master->irq, svc_i3c_master_irq_handler,
 			       IRQF_NO_SUSPEND, "svc-i3c-irq", master);
 	if (ret)
-- 
2.34.1