From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7ABEA3033E3 for ; Thu, 16 Apr 2026 17:57:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.10 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776362242; cv=none; b=T4YIwksgZdVW2GpyI83wbd2jHrTVXWUMJxrTyntNyMVMSj8opILBqYev+FTf6CNqFyN5AKsJ5L8/sVZo//m/gcych8WHvWw3DUBGBz6VQ96/H65iLHYdj2kgOF5vt9CRHPQBP3vm8ApeVqTiJUSDCSKTKDukKiEdwvv7k+X8VK4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776362242; c=relaxed/simple; bh=wfG7OXmk6jxD8gytR4muq6DVuXJrOsNEGNsRvQWdBrw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VLTwQWFSA2BgdCY2gr5g/mNxv3uBnkuJCWTiVGrqSfx1X/mXIS/dobBxHCQK6F8eLfK06t8TpU38cvysJDUgDiHaLeLvmwlCtVp2U41zi2kZ/pClB/hloivY8aGwp9UnaDjcmcg+hLYNw1iEa9OiQAcusHM8yK39XnCwOcmht1s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=VlW+Ju7H; arc=none smtp.client-ip=198.175.65.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="VlW+Ju7H" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1776362241; x=1807898241; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=wfG7OXmk6jxD8gytR4muq6DVuXJrOsNEGNsRvQWdBrw=; b=VlW+Ju7Hf4lrhC/s9Q0PkUscvChzwPYlzclAsTUMbiuc6F5w/T8A6ZLF 7RlVTCVZG5HBc6JVqFcCyImDQcOHeDrol6bcc62iFmaWcZs1IStcJxK+u dui0R0E1uMIlzttCiKkQqN1JYLR5VdE8s4yFQN3JLWWTTpRZ74BWUAy8x nA1yRcsg1lHlv3fdXqpu3Gykn9ySrYATSS1OfCNIQ/U4PU2w6nKVDa61+ mgq29FfKHr8AUcQV/8WE8MkflAm/KjcI8Uxxm99KtIi8sq0U8cblzq59C wppE6+tU6wStUSfxTR37yD7zlQ+xGDwaqBHBYYayJpIm4UqiLa4OCBZvt w==; X-CSE-ConnectionGUID: yMgJmBejQf6S+YJKZvaEHQ== X-CSE-MsgGUID: U0X7ISihReeUqY/q2CkLHg== X-IronPort-AV: E=McAfee;i="6800,10657,11761"; a="94778356" X-IronPort-AV: E=Sophos;i="6.23,181,1770624000"; d="scan'208";a="94778356" Received: from orviesa005.jf.intel.com ([10.64.159.145]) by orvoesa102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Apr 2026 10:57:21 -0700 X-CSE-ConnectionGUID: GxLc2QaFToGsAxCIxgGlBg== X-CSE-MsgGUID: VOi+i/kKQXWLGBoEX0v+1Q== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,181,1770624000"; d="scan'208";a="235784504" Received: from abityuts-desk.ger.corp.intel.com (HELO ahunter6-desk) ([10.245.244.222]) by orviesa005-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Apr 2026 10:57:20 -0700 From: Adrian Hunter To: alexandre.belloni@bootlin.com Cc: Frank.Li@nxp.com, linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 03/16] i3c: mipi-i3c-hci: Prevent DMA enqueue while ring is aborting or in error Date: Thu, 16 Apr 2026 20:56:51 +0300 Message-ID: <20260416175704.41217-4-adrian.hunter@intel.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260416175704.41217-1-adrian.hunter@intel.com> References: <20260416175704.41217-1-adrian.hunter@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Finland Oy, Registered Address: c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo, Business Identity Code: 0357606 - 4, Domiciled in Helsinki Content-Transfer-Encoding: 8bit Block the DMA enqueue path while a Ring abort is in progress or after an error condition has been detected. Previously, new transfers could be enqueued while the DMA Ring was being aborted or while error handling was underway. This allowed enqueue and error-recovery paths to run concurrently, potentially interfering with each other and corrupting Ring state. Introduce explicit enqueue blocking and a wait queue to serialize access: enqueue operations now wait until abort or error handling has completed before proceeding. Enqueue is unblocked once the Ring is safely restarted. Signed-off-by: Adrian Hunter --- drivers/i3c/master/mipi-i3c-hci/core.c | 1 + drivers/i3c/master/mipi-i3c-hci/dma.c | 25 +++++++++++++++++++++++-- drivers/i3c/master/mipi-i3c-hci/hci.h | 2 ++ 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/i3c/master/mipi-i3c-hci/core.c b/drivers/i3c/master/mipi-i3c-hci/core.c index bb8f2d830b0d..5e1bc6d819cf 100644 --- a/drivers/i3c/master/mipi-i3c-hci/core.c +++ b/drivers/i3c/master/mipi-i3c-hci/core.c @@ -976,6 +976,7 @@ static int i3c_hci_probe(struct platform_device *pdev) spin_lock_init(&hci->lock); mutex_init(&hci->control_mutex); + init_waitqueue_head(&hci->enqueue_wait_queue); /* * Multi-bus instances share the same MMIO address range, but not diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c index 4cd32e3afa7b..314635e6e190 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -484,6 +484,12 @@ static int hci_dma_queue_xfer(struct i3c_hci *hci, spin_lock_irq(&hci->lock); + while (unlikely(hci->enqueue_blocked)) { + spin_unlock_irq(&hci->lock); + wait_event(hci->enqueue_wait_queue, !READ_ONCE(hci->enqueue_blocked)); + spin_lock_irq(&hci->lock); + } + if (n > rh->xfer_space) { spin_unlock_irq(&hci->lock); hci_dma_unmap_xfer(hci, xfer_list, n); @@ -539,6 +545,14 @@ static int hci_dma_queue_xfer(struct i3c_hci *hci, return 0; } +static void hci_dma_unblock_enqueue(struct i3c_hci *hci) +{ + if (hci->enqueue_blocked) { + hci->enqueue_blocked = false; + wake_up_all(&hci->enqueue_wait_queue); + } +} + static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, struct hci_xfer *xfer_list, int n) { @@ -550,12 +564,17 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, guard(mutex)(&hci->control_mutex); + spin_lock_irq(&hci->lock); + ring_status = rh_reg_read(RING_STATUS); if (ring_status & RING_STATUS_RUNNING) { + hci->enqueue_blocked = true; + spin_unlock_irq(&hci->lock); /* stop the ring */ reinit_completion(&rh->op_done); rh_reg_write(RING_CONTROL, rh_reg_read(RING_CONTROL) | RING_CTRL_ABORT); wait_for_completion_timeout(&rh->op_done, HZ); + spin_lock_irq(&hci->lock); ring_status = rh_reg_read(RING_STATUS); if (ring_status & RING_STATUS_RUNNING) { /* @@ -567,8 +586,6 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, } } - spin_lock_irq(&hci->lock); - for (i = 0; i < n; i++) { struct hci_xfer *xfer = xfer_list + i; int idx = xfer->ring_entry; @@ -604,6 +621,8 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE); rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE | RING_CTRL_RUN_STOP); + hci_dma_unblock_enqueue(hci); + spin_unlock_irq(&hci->lock); return did_unqueue; @@ -647,6 +666,8 @@ static void hci_dma_xfer_done(struct i3c_hci *hci, struct hci_rh_data *rh) } if (xfer->completion) complete(xfer->completion); + if (RESP_STATUS(resp)) + hci->enqueue_blocked = true; } done_ptr = (done_ptr + 1) % rh->xfer_entries; diff --git a/drivers/i3c/master/mipi-i3c-hci/hci.h b/drivers/i3c/master/mipi-i3c-hci/hci.h index f17f43494c1b..d630400ec945 100644 --- a/drivers/i3c/master/mipi-i3c-hci/hci.h +++ b/drivers/i3c/master/mipi-i3c-hci/hci.h @@ -54,6 +54,8 @@ struct i3c_hci { struct mutex control_mutex; atomic_t next_cmd_tid; bool irq_inactive; + bool enqueue_blocked; + wait_queue_head_t enqueue_wait_queue; u32 caps; unsigned int quirks; unsigned int DAT_entries; -- 2.51.0