From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6AB9B39E183 for ; Tue, 21 Apr 2026 17:55:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.19 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776794103; cv=none; b=HVKeSPWusaSZGyXnw84Y4MynvzG8WpAgWi8JG3Oucd1wD97QMKnm4D+QVVa3LWqwXfEfHcyyfM4DDdLN1X1hYxqDyqH0RlfjNKp+At/a+ULnnSYNomX89hBklEZfZknQGlORzUPZwSS6S8bU+WD6HRGcklWvPYZwJfb/6DDgBTE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776794103; c=relaxed/simple; bh=xxelxfnOqKgCX1CUYpTwvXJMX6Jd7zw74OCgqfemx5c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DeMwZ4DUavUJaYrRVte8h+VBrIXQxB1U6lALPG4XyvVrYJi10s+ODP/LC6TCATyleT1bJsfESKF1vVijLduTV8epUKJyxhKSDGah+4KczqPOOemJ4D1w0thzSHJHEpdYpcZqOK3Fijc7Z9bbTO2G7WlAzBrczm4knEZNcGV+lG8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ffyy86uy; arc=none smtp.client-ip=198.175.65.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ffyy86uy" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1776794102; x=1808330102; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=xxelxfnOqKgCX1CUYpTwvXJMX6Jd7zw74OCgqfemx5c=; b=ffyy86uywClA4e/dOhnKPp6Lpzpb3lVwqFzlA1SghB4lw2diJVhHJ6rN /CCBk2CFqLNYPjslksxTHBqGTuDLDHVyz2c27IEguEtbm8qlYVvKlAB+V RnHruyvPAhJZWl1ittXgoGZOXfG1UHVTCSBZrh0tWBo38WBPySDuDryKg eY8w9Dize5a/rR7kMKY9NEGnoxnZwba0vFdrpeUcTBx4F3Y3boTc+ysxd 5NvkqLboV43nYXhYlYxalZ9jp/808cQW9zemt92el9XzFnnJy/e+BhU2w YLRwNjjHhtw/WvbND9WfAgsjriy9zwDcSTKU6o2kMIbWTfjbhtvQVfj8W w==; X-CSE-ConnectionGUID: PRhmavswRPS5s1dq8OhuLg== X-CSE-MsgGUID: ZFGx5C5FShSpIJgOQmL2Og== X-IronPort-AV: E=McAfee;i="6800,10657,11763"; a="77651382" X-IronPort-AV: E=Sophos;i="6.23,192,1770624000"; d="scan'208";a="77651382" Received: from fmviesa006.fm.intel.com ([10.60.135.146]) by orvoesa111.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Apr 2026 10:55:02 -0700 X-CSE-ConnectionGUID: +lpqxnjvR9OBHBjiBX6xwg== X-CSE-MsgGUID: SbSf12NiSKSyv9XDpKqEEQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,192,1770624000"; d="scan'208";a="227494932" Received: from hrotuna-mobl2.ger.corp.intel.com (HELO ahunter6-desk) ([10.245.244.242]) by fmviesa006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Apr 2026 10:55:00 -0700 From: Adrian Hunter To: alexandre.belloni@bootlin.com Cc: Frank.Li@nxp.com, linux-i3c@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH V2 08/16] i3c: mipi-i3c-hci: Avoid restarting DMA ring after aborting wrong transfer Date: Tue, 21 Apr 2026 20:54:27 +0300 Message-ID: <20260421175435.122094-9-adrian.hunter@intel.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260421175435.122094-1-adrian.hunter@intel.com> References: <20260421175435.122094-1-adrian.hunter@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Organization: Intel Finland Oy, Registered Address: c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo, Business Identity Code: 0357606 - 4, Domiciled in Helsinki Content-Transfer-Encoding: 8bit Software ABORT of the DMA ring is used to recover from transfer list timeouts, but it is inherently racy. The intended transfer list may complete just before the ABORT takes effect, causing the subsequent transfer list to be aborted instead. In this case, an incomplete transfer list may remain in the ring and has not yet been processed by hci_dma_dequeue_xfer(). Restarting the DMA ring at that point can lead to unpredictable results. Detect when the next queued transfer is not the first entry of a transfer list and does not belong to the list currently being dequeued. In that case, skip restarting the DMA ring and defer recovery until a subsequent call to hci_dma_dequeue_xfer(), which will safely restart the ring once the incomplete list is handled. Signed-off-by: Adrian Hunter --- Changes in V2: Renamed completing_xfer to final_xfer drivers/i3c/master/mipi-i3c-hci/dma.c | 15 +++++++++++++++ drivers/i3c/master/mipi-i3c-hci/hci.h | 1 + 2 files changed, 16 insertions(+) diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c index 899fdf6555a8..268f54b32101 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -503,6 +503,7 @@ static int hci_dma_queue_xfer(struct i3c_hci *hci, u32 *ring_data = rh->xfer + rh->xfer_struct_sz * enqueue_ptr; xfer->final_xfer = xfer_list + n - 1; + xfer->xfer_list_pos = i; /* store cmd descriptor */ *ring_data++ = xfer->cmd_desc[0]; @@ -669,6 +670,20 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, } } + /* + * A software ABORT may race with transfer completion and abort the next + * transfer list instead. Detect that case, and do not restart the ring. + * It will be handled by a subsequent dequeue. + */ + if (!did_unqueue) { + struct hci_xfer *xfer = rh->src_xfers[rh->done_ptr]; + + if (xfer && xfer->xfer_list_pos && xfer->final_xfer != xfer_list->final_xfer) { + spin_unlock_irq(&hci->lock); + return false; + } + } + /* restart the ring */ reinit_completion(&rh->op_done); mipi_i3c_hci_resume(hci); diff --git a/drivers/i3c/master/mipi-i3c-hci/hci.h b/drivers/i3c/master/mipi-i3c-hci/hci.h index f07fc627d4d2..83d4f13a68a3 100644 --- a/drivers/i3c/master/mipi-i3c-hci/hci.h +++ b/drivers/i3c/master/mipi-i3c-hci/hci.h @@ -107,6 +107,7 @@ struct hci_xfer { struct hci_xfer *final_xfer; int ring_number; int ring_entry; + int xfer_list_pos; }; }; }; -- 2.51.0