Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
From:   Frank Li <Frank.Li@nxp.com>
To:     miquel.raynal@bootlin.com
Cc:     Frank.li@nxp.com, alexandre.belloni@bootlin.com,
        conor.culhane@silvaco.com, imx@lists.linux.dev, joe@perches.com,
        linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: [PATCH v4 1/6] i3c: master: svc: fix race condition in ibi work thread
Date:   Mon, 23 Oct 2023 12:16:53 -0400
Message-Id: <20231023161658.3890811-2-Frank.Li@nxp.com>
In-Reply-To: <20231023161658.3890811-1-Frank.Li@nxp.com>
References: <20231023161658.3890811-1-Frank.Li@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?9xG898d1HPqildgpO2+8kvlb7/VOhVc51pME8yo8eVViiBsYLWg2KIvpmF6u?=
 =?us-ascii?Q?qE9xhocyi7LTVhNC7N1VTkkxpIY6qawS2iVORG4RzRpZ+amHrCbPt7/97pWq?=
 =?us-ascii?Q?W89CefpGJs3/nv3NMim0k6er91thvKDNY2byDkUPPG/zk/oCA2dq5Aj4bP/V?=
 =?us-ascii?Q?AjL21wvR8kkbf0cHrW9+YiEaa9Zx5fvSQpqNl7W5hNxrf6Aqi/ZHvlWm2hDQ?=
 =?us-ascii?Q?OuzUD0Af4X11PXfpmVtJ4vTW4wSZgXBA/jVLWqwTP9FaCiIZl3H7aLrpAaOe?=
 =?us-ascii?Q?Cem6cxdfw4K/OYwgTmljvZ6uRn11ipiIImp1my+XXBihiWXxDY+sQv8wxT+e?=
 =?us-ascii?Q?YqnW65NCGLRqkLdf2C0Nx1b3rm4GDyaWkUtBaJOIfL+Vu6rzPnU/rYlOyNGC?=
 =?us-ascii?Q?VefijjiWHbBxOAz59dTGFnzadGdcQa7Q2RmWO6C1hDridN/h3mZphZCyTeCE?=
 =?us-ascii?Q?YlL4/FYwmS1uRiggAZbZ8GwqX6iC0Cvoi7s3mTqQEtXr+m+edRlCFmVvyZpF?=
 =?us-ascii?Q?M6ZHVtiaMH6a2rgOlTmPplpSapUwlmK+avboal5yar86mEYWCWkICU9TlYGb?=
 =?us-ascii?Q?uttcy2uh7z53L2UmnY3M3xBMgTGCGefENMnU9xL+oGSp16sXp5TY1hlDvLwg?=
 =?us-ascii?Q?lWwJtVTFPN8bmbt21Gjj6q5iglaupYH/qrQs7aG0cOfmQvqJ5dB5H/bUZNxs?=
 =?us-ascii?Q?I2o96dCb//lyX+CLEGqjZiPK93khekQ/nX9GF6Jcu9Xfe/g52yEDpipu11Fm?=
 =?us-ascii?Q?BxJVbkXNGP+/W9W/LTH11TDwvO/1pEUCT4XOMlj3obfTs3+Ic6yksptqdMRD?=
 =?us-ascii?Q?GQ2OaLMLzqU6N+vqaeM4sAblWcTtFaTKPL381viGk00JP0QB0cmLO9iGlnZT?=
 =?us-ascii?Q?acRtQ+u37b2cTd74IhvGgtcHLDq2y1VrHwUvEkUn9oBNtlJX7p5RxqqMn+Wb?=
 =?us-ascii?Q?y4YmO71k95dBBUMogw5KbMXEt/v2JV5luiV4I1y9QPayfZWVtKZro3al8Nxh?=
 =?us-ascii?Q?Go6J4e6pdRL+w/9jCK8IjiJ74l7HQyvTHdQ9/7hyznkfsDw4nyoD34ZnUc7i?=
 =?us-ascii?Q?D6X7ZA20beFB51UttTpmpofkafS4JbiYeaV9j1bTqEfyo1Qc8GedmEbQBrby?=
 =?us-ascii?Q?zSF4LVb6JJOyC6VzQpPwnkawVRGOn4dTdU1VW1wWP9I1i2oEqL8EDMyNXVPn?=
 =?us-ascii?Q?E48oYVJ4GBkMXYNlscaUTVQRvVhzdWFTdqDLlLWabiYjvcfgOJSCT3HLureb?=
 =?us-ascii?Q?KrtVIywCAWySv9G2X6fnitG9dyvwQDi1jS2kncOmIZzxLCD5qpXyxY/jy/F8?=
 =?us-ascii?Q?BLkS7tkUupQ0gyyMEk7C9nZPImj4z+Xg422qY2Y0Xd+vPKcUQE6TYtTQN5Az?=
 =?us-ascii?Q?wHGBulUTKLmsRkSzpKbkLc+CV9cD5+xyh938cHKwTzWBHqKYS30cuRUgLztJ?=
 =?us-ascii?Q?FzjFYHNvwG43CVaL7JvtvaSdsiRa9iUfNekrwMTqo6mD873ithCdrGYUoMkq?=
 =?us-ascii?Q?tZL+6jLsznVTACeJEPcfPIpX0rIFKUKqF60L6ka9Ethh+02z0Le34WlYU9+N?=
 =?us-ascii?Q?ekr6YC/s25Mxkh8Ce6nVKIOJJ8e5XQOmZC6t0bdZ?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8489aece-a84a-42fc-3c3d-08dbd3e384bc
X-MS-Exchange-CrossTenant-AuthSource: AM6PR04MB4838.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Oct 2023 16:17:14.3524
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9uflEK7zPHL/LXkr8Lfd/TBXARYo03GlXp4fmMfSYmqzDHcJqyyjNBM8uuBctIlw7bUzjNsglpJNEmZiEVuWTg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR04MB8655
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Mon, 23 Oct 2023 09:17:30 -0700 (PDT)

The ibi work thread operates asynchronously with other transfers, such as
svc_i3c_master_priv_xfers(). Introduce mutex protection to ensure the
completion of the entire i3c/i2c transaction.

Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Cc: stable@vger.kernel.org
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---

Notes:
    Change from v1 to v2
    - update commit message
    - Add Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

 drivers/i3c/master/svc-i3c-master.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index d29de5fe533e6..8cd708c965085 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -174,6 +174,7 @@ struct svc_i3c_regs_save {
  * @ibi.slots: Available IBI slots
  * @ibi.tbq_slot: To be queued IBI slot
  * @ibi.lock: IBI lock
+ * @lock: Transfer lock, protect between IBI work thread and callbacks from master
  */
 struct svc_i3c_master {
 	struct i3c_master_controller base;
@@ -202,6 +203,7 @@ struct svc_i3c_master {
 		/* Prevent races within IBI handlers */
 		spinlock_t lock;
 	} ibi;
+	struct mutex lock;
 };
 
 /**
@@ -383,6 +385,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	u32 status, val;
 	int ret;
 
+	mutex_lock(&master->lock);
 	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
 	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
 	       SVC_I3C_MCTRL_IBIRESP_AUTO,
@@ -459,6 +462,7 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 
 reenable_ibis:
 	svc_i3c_master_enable_interrupts(master, SVC_I3C_MINT_SLVSTART);
+	mutex_unlock(&master->lock);
 }
 
 static irqreturn_t svc_i3c_master_irq_handler(int irq, void *dev_id)
@@ -1203,9 +1207,11 @@ static int svc_i3c_master_send_bdcast_ccc_cmd(struct svc_i3c_master *master,
 	cmd->read_len = 0;
 	cmd->continued = false;
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	ret = xfer->ret;
 	kfree(buf);
@@ -1249,9 +1255,11 @@ static int svc_i3c_master_send_direct_ccc_cmd(struct svc_i3c_master *master,
 	cmd->read_len = read_len;
 	cmd->continued = false;
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	if (cmd->read_len != xfer_len)
 		ccc->dests[0].payload.len = cmd->read_len;
@@ -1308,9 +1316,11 @@ static int svc_i3c_master_priv_xfers(struct i3c_dev_desc *dev,
 		cmd->continued = (i + 1) < nxfers;
 	}
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	ret = xfer->ret;
 	svc_i3c_master_free_xfer(xfer);
@@ -1346,9 +1356,11 @@ static int svc_i3c_master_i2c_xfers(struct i2c_dev_desc *dev,
 		cmd->continued = (i + 1 < nxfers);
 	}
 
+	mutex_lock(&master->lock);
 	svc_i3c_master_enqueue_xfer(master, xfer);
 	if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000)))
 		svc_i3c_master_dequeue_xfer(master, xfer);
+	mutex_unlock(&master->lock);
 
 	ret = xfer->ret;
 	svc_i3c_master_free_xfer(xfer);
@@ -1539,6 +1551,8 @@ static int svc_i3c_master_probe(struct platform_device *pdev)
 
 	INIT_WORK(&master->hj_work, svc_i3c_master_hj_work);
 	INIT_WORK(&master->ibi_work, svc_i3c_master_ibi_work);
+	mutex_init(&master->lock);
+
 	ret = devm_request_irq(dev, master->irq, svc_i3c_master_irq_handler,
 			       IRQF_NO_SUSPEND, "svc-i3c-irq", master);
 	if (ret)
-- 
2.34.1