From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1167F3C8C48 for ; Mon, 20 Jul 2026 10:14:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542496; cv=none; b=AMI9v7mM/49/wqjohtIm2ctIQ+lBgejOCP1xrZCtDaXV9XJJaF/3CkPxuKZ66ylMXhazoqFcVvHBhjwIXjlalmRlKjbKUZA2HV5piwNvRi6Wtqit4RT6+AeJ3xA/OqbCQ6+rpcJzwj9OXVkPbVeDB2etlqG5BD86shtrmnh1c4g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784542496; c=relaxed/simple; bh=0aiI1f6vHsTeiGWLu/hog9EOHsxEKlYzD2ZIFajrF80=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=WTf1fbyqoYy06vh/p2LL6OhxpegzoNWRVucMSg0BT6nkd8bbRPkxJPx8mv40T34rtkeH1/arDguRq+vcQKIEJm1zqKj9MEhcqvkM5XwNkIVNz0EUzkWe/sZyo1S/1tvmD//kLUzZIGHKXPTXLViPulf6/0zYYz8FdgY/fibDskg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38dc69c74b8so7610135a91.0 for ; Mon, 20 Jul 2026 03:14:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784542485; x=1785147285; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+KR23a5utjuBAUGcUFKPLl7/miZdWqDcdDLPWy8Jfvk=; b=bueGdt9eWgYGusp6HijH+GpvWzPC9wHAQMzWlu1ngrXbdgXRbL1FXge6Rmk405dyEq aoH4x3Y4Ts2Vb30lyYaqQngaFI7jlyaVSuQftl8JauUgmHYHj9HXE/klobb3t+EfhYsC qX5WppeIXjbGVFQcHMxMihA+63GvMVApIfPPoP9AmM6oIp8B79E7gEhyRnkICY6KbQih UpYQgVZ31tnQDSoRejWrqNOLG/WAAoGbRTclhee4sXRAGbwiqvEXTsAI8pzl1Qx4kxBE Un7GzeXCanI1xHEzkzAK9ap8QYeIeOUZBaMT+G57MQTqbIUgTHvMbLS+VRNbuAICvvTl kdjw== X-Forwarded-Encrypted: i=1; AHgh+RosgmSQaTAIDD0symUcxlfYHtm66yd8gKuBOhirTbRKpgDwmVLFMMrwANT8Br6f8SUTWBds+f+G0dru1fg=@vger.kernel.org X-Gm-Message-State: AOJu0YwGJ4I1hWkFK3X4eAW/lV6zq5uBawtZ+DyUGAX/1B2a4XchNrYT qGgchPKZXduwW6o2y9XMPU6fMeVJbMykXMG4Gj5PeZ3vnqZciwWzkJvNwRdmhcDBXg== X-Gm-Gg: AfdE7cmKOuCP2U41KUEokjpTTMRMo9PXLxJlHAi5YmfzUVyyCreZGzLcv0DOEH2QgRv zU2D9OiO1ghx0oe+27unnc+AGKoTBpNrzCU7f2a7bKaWmgGhBebIgiTtP2ZjsCoRbXrqPH0UXXN WYvWiTEx9uFw4dnSHCa56gvf1ZO2hctvuyCl1ygMPKkLg1pLpnZ3S2WffT8+l51oujq+nmXtcg7 nTYszdX1bpFpTHpYkZO7QJO4g/aCkbNyf0W39z+oxiNaTbDke8xFllu7yibH4J5VMY+btsBauqP +B0RfqpoIx7CiQ9lGx2v2GEQiDm+BUVOaPRY35kq8jzxLOSb0cN30ccjcC7XSZSN+ICkcVm5jyi IFxY8MD0MCso5rNRc0h2972KzjDTJFVwSZAgbXCkdzQ7edf2V7KxUOcrVQGX+XBnAkmYIDJ06cp Ne5jy8YKKzebHTue7hqUGLBgy4M/U4Jlcgwz7gjB7F//y/ueb3x89OLHr5/uAecenSFmEQAzVPh /gjuyfSqby8c0kICQ== X-Received: by 2002:a05:6a20:244c:b0:3c3:7fff:ba77 with SMTP id adf61e73a8af0-3c3ad973f68mr13774806637.42.1784542484649; Mon, 20 Jul 2026 03:14:44 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-16-100.dynamic-ip.hinet.net. [61.228.16.100]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cb517f94c31sm4411321a12.13.2026.07.20.03.14.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 03:14:44 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: Mark Brown , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v2 2/5] Input: applespi - track asynchronous SPI transfers in flight Date: Mon, 20 Jul 2026 18:14:32 +0800 Message-Id: <20260720101435.13612-3-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260720101435.13612-1-fourdollars@debian.org> References: <20260720101435.13612-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The driver queues read and write packets asynchronously. When shutting down, removing, or suspending, the driver must guarantee that no asynchronous transfers remain in flight to prevent memory corruption or use-after-free conditions. Introduce a 'spi_complete' slot tracking array in struct applespi_data to represent the two concurrent transfers (one for reads, one for writes). Implement applespi_async_outstanding() and applespi_async_complete() to track transfers under cmd_msg_lock. Modify applespi_async() to allocate a completion slot and assert that the caller holds the required cmd_msg_lock. This ensures robust and lock-safe tracking of all asynchronous SPI transactions. Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 70 +++++++++++++++++++++++++++++-- 1 file changed, 67 insertions(+), 3 deletions(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c index 64bbeba85ea9..a8f8d5370e95 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -421,6 +421,12 @@ struct applespi_data { bool read_active; bool write_active; + struct applespi_complete_info { + void (*complete)(void *context); + struct applespi_data *applespi; + } spi_complete[2]; + bool cancel_spi; + struct work_struct work; struct touchpad_info_protocol rcvd_tp_info; @@ -607,13 +613,71 @@ static void applespi_setup_write_txfrs(struct applespi_data *applespi) spi_message_add_tail(st_t, msg); } +static bool applespi_async_outstanding(struct applespi_data *applespi) +{ + return applespi->spi_complete[0].complete || + applespi->spi_complete[1].complete; +} + +static void applespi_async_complete(void *context) +{ + struct applespi_complete_info *info = context; + struct applespi_data *applespi = info->applespi; + void (*complete)(void *context); + unsigned long flags; + + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + + complete = info->complete; + info->complete = NULL; + + if (applespi->cancel_spi && !applespi_async_outstanding(applespi)) + wake_up_all(&applespi->wait_queue); + + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); + + if (complete) + complete(applespi); +} + static int applespi_async(struct applespi_data *applespi, struct spi_message *message, void (*complete)(void *)) { - message->complete = complete; - message->context = applespi; + struct applespi_complete_info *info; + int sts; + + assert_spin_locked(&applespi->cmd_msg_lock); + + if (applespi->cancel_spi) { + if (!applespi_async_outstanding(applespi)) + wake_up_all(&applespi->wait_queue); + return -ESHUTDOWN; + } + + /* + * There can only be at most 2 spi requests in flight, one for "reads" + * and one for "writes". + */ + if (!applespi->spi_complete[0].complete) + info = &applespi->spi_complete[0]; + else if (!applespi->spi_complete[1].complete) + info = &applespi->spi_complete[1]; + else { + dev_warn(&applespi->spi->dev, "Both SPI async slots in use\n"); + return -EBUSY; + } + + info->complete = complete; + info->applespi = applespi; + + message->complete = applespi_async_complete; + message->context = info; + + sts = spi_async(applespi->spi, message); + if (sts) + info->complete = NULL; - return spi_async(applespi->spi, message); + return sts; } static inline bool applespi_check_write_status(struct applespi_data *applespi, -- 2.39.5