Re: [PATCH v4 07/16] i3c: renesas: Clean DATBAS register on detach

Claudiu Beznea <[email protected]>
Newsgroups org.infradead.lists.linux-i3c,dev.linux.lists.sashiko-reviews
Message-ID <[email protected]>

On 6/12/26 19:20, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> 
> New issues:
> - [Critical] `renesas_i3c_group_devs_in_slots` assumes the target swap slot is occupied by an I3C device, which crashes if the slot is free. It also fails to update the free slot bitmask.
> 
> Pre-existing issues:
> - [High] The DATBAS registers and device address trackers for unused slots are left dirty after Dynamic Address Assignment (DAA), which can cause hardware TX/RX logic issues.
> --
> 
> commit bcdea49e3d9ced6f5b774a208065f0889dbb7c12
> Author: Claudiu Beznea <[email protected]>
> 
> i3c: renesas: Clean DATBAS register on detach
> 
> The controller uses DATBAS registers on TX/RX logic. Clean the DATBAS
> register for the detached I3C device to avoid issues.
> 
>> diff --git a/drivers/i3c/master/renesas-i3c.c b/drivers/i3c/master/renesas-i3c.c
>> index a63edddbc9fe0..abe24e563d217 100644
>> --- a/drivers/i3c/master/renesas-i3c.c
>> +++ b/drivers/i3c/master/renesas-i3c.c
>> @@ -1042,6 +1042,8 @@ static void renesas_i3c_detach_i3c_dev(struct i3c_dev_desc *dev)
>>   	struct i3c_master_controller *m = i3c_dev_get_master(dev);
>>   	struct renesas_i3c *i3c = to_renesas_i3c(m);
>>   
>> +	renesas_writel(i3c->regs, DATBAS(data->index), 0);
>> +
>>   	i3c_dev_set_master_data(dev, NULL);
>>   	i3c->addrs[data->index].addr = 0;
>>   	i3c->addrs[data->index].i3c_dev = NULL;
> 
> [Severity: Critical]
> Since we are allowing I3C devices to be detached and free their slots here,
> will this cause a null pointer dereference in
> renesas_i3c_group_devs_in_slots() during resume?

We are allowing detaching when the bus is cleaned up and on re-attaching.

In case the bus is cleaned up, all the devices on the bus are detached.

On re-attaching, I considered that will happen as a result of a previously 
detach operation which will free a slot, but looking again at the code, all the 
detach and re-attach logic are under different conditions. I will re-consider 
and update it accordingly.

Thank you,
Claudiu

-- 
linux-i3c mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-i3c
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.