Re: [PATCH v8 1/5] PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dw_pcie_ep_cleanup() modifies the MSI iATU mapping without holding ep->epc->lock, introducing a critical race condition with concurrent EPF interrupt requests.
--

commit f01add14b7c42730aa5b71bb56cc8682eb2fa21a
Author: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>

PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup()

This commit clears the MSI iATU mapping in dw_pcie_ep_cleanup() to avoid
retaining a stale MSI iATU mapping after a fundamental reset triggered by
PERST# assert/deassert.

> diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
> index d4dc3b24da607..4ae0e1b55f390 100644
> --- a/drivers/pci/controller/dwc/pcie-designware-ep.c
> +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
> @@ -1035,6 +1035,11 @@ void dw_pcie_ep_cleanup(struct dw_pcie_ep *ep)
>  {
>  	struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
>  
> +	if (ep->msi_iatu_mapped) {
> +		dw_pcie_ep_unmap_addr(ep->epc, 0, 0, ep->msi_mem_phys);

Is it safe to modify the MSI iATU mapping without holding ep->epc->lock here?

dw_pcie_ep_cleanup() can be invoked asynchronously from reset/link-down
threaded IRQ handlers (e.g., qcom_pcie_perst_irq_thread() calling
qcom_pcie_perst_deassert()) which might not hold the endpoint controller lock.

Concurrently, an endpoint function driver can attempt to raise an MSI
interrupt via pci_epc_raise_irq(), which acquires ep->epc->lock and invokes
dw_pcie_ep_raise_msi_irq().

If dw_pcie_ep_cleanup() unmaps the window right before
dw_pcie_ep_raise_msi_irq() writes to ep->msi_mem, could this result in
a write to an unmapped PCIe outbound window and trigger an AXI bus error?

Furthermore, dw_pcie_ep_unmap_addr() modifies the shared ep->ob_window_map
bitmask. Does modifying this without the EPC lock race against other functions
like dw_pcie_ep_map_addr(), potentially corrupting the hardware outbound window
routing?

> +		ep->msi_iatu_mapped = false;
> +	}
> +
>  	dwc_pcie_debugfs_deinit(pci);
>  	dw_pcie_edma_remove(pci);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518-pci-port-reset-v8-0-eb5a7d331dfc@oss.qualcomm.com?part=1