[PATCHv2] dmaengine: mv_xor: protect MBUS window access with a spinlock

[PATCHv2] dmaengine: mv_xor: protect MBUS window access with a spinlock

[Rosen Penev]

mv_xor_add_io_win() reads and writes shared MBUS window registers
and updates the shared win_start/win_end arrays in mv_xor_device.
Multiple DMA channels can call this function concurrently via
mv_xor_prep_dma_xor(), leading to races where two threads can
select the same free window slot, corrupt the registers, or produce
inconsistent cached state.

Add a spinlock to struct mv_xor_device and hold it across the
register read-modify-write and cache update in mv_xor_add_io_win().

Fixes: 77ff7a706f01 ("mv_xor: Add support for IO (PCIe) src/dst areas")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 v2: use guard()
 drivers/dma/mv_xor.c | 3 +++
 drivers/dma/mv_xor.h | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index c4e0dce3ca64..da8eea8789ae 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -494,6 +494,8 @@ static int mv_xor_add_io_win(struct mv_xor_chan *mv_chan, u32 addr)
 	if (xordev->xor_type == XOR_ARMADA_37XX)
 		return 0;
 
+	guard(spinlock_irqsave)(&xordev->win_lock);
+
 	/*
 	 * Loop over the cached windows to check, if the requested area
 	 * is already mapped. If this the case, nothing needs to be done
@@ -1345,6 +1347,7 @@ static int mv_xor_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, xordev);
 
+	spin_lock_init(&xordev->win_lock);
 
 	/*
 	 * We need to know which type of XOR device we use before
diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
index c87cefd38a07..034db4d0bfb1 100644
--- a/drivers/dma/mv_xor.h
+++ b/drivers/dma/mv_xor.h
@@ -80,6 +80,7 @@ struct mv_xor_device {
 	struct clk	     *clk;
 	struct mv_xor_chan   *channels[MV_XOR_MAX_CHANNELS];
 	int		     xor_type;
+	spinlock_t	     win_lock;
 
 	u32                  win_start[WINDOW_COUNT];
 	u32                  win_end[WINDOW_COUNT];
-- 
2.55.0

Re: [PATCHv2] dmaengine: mv_xor: protect MBUS window access with a spinlock

[Frank Li]

On Thu, Sep 17, 2026 at 04:27:02PM -0700, Rosen Penev wrote:
> mv_xor_add_io_win() reads and writes shared MBUS window registers
> and updates the shared win_start/win_end arrays in mv_xor_device.
> Multiple DMA channels can call this function concurrently via
> mv_xor_prep_dma_xor(), leading to races where two threads can
> select the same free window slot, corrupt the registers, or produce
> inconsistent cached state.
>
> Add a spinlock to struct mv_xor_device and hold it across the
> register read-modify-write and cache update in mv_xor_add_io_win().
>
> Fixes: 77ff7a706f01 ("mv_xor: Add support for IO (PCIe) src/dst areas")
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  v2: use guard()
>  drivers/dma/mv_xor.c | 3 +++
>  drivers/dma/mv_xor.h | 1 +
>  2 files changed, 4 insertions(+)
>
> diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
> index c4e0dce3ca64..da8eea8789ae 100644
> --- a/drivers/dma/mv_xor.c
> +++ b/drivers/dma/mv_xor.c
> @@ -494,6 +494,8 @@ static int mv_xor_add_io_win(struct mv_xor_chan *mv_chan, u32 addr)
>  	if (xordev->xor_type == XOR_ARMADA_37XX)
>  		return 0;
>
> +	guard(spinlock_irqsave)(&xordev->win_lock);
> +
>  	/*
>  	 * Loop over the cached windows to check, if the requested area
>  	 * is already mapped. If this the case, nothing needs to be done
> @@ -1345,6 +1347,7 @@ static int mv_xor_probe(struct platform_device *pdev)
>
>  	platform_set_drvdata(pdev, xordev);
>
> +	spin_lock_init(&xordev->win_lock);
>
>  	/*
>  	 * We need to know which type of XOR device we use before
> diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
> index c87cefd38a07..034db4d0bfb1 100644
> --- a/drivers/dma/mv_xor.h
> +++ b/drivers/dma/mv_xor.h
> @@ -80,6 +80,7 @@ struct mv_xor_device {
>  	struct clk	     *clk;
>  	struct mv_xor_chan   *channels[MV_XOR_MAX_CHANNELS];
>  	int		     xor_type;
> +	spinlock_t	     win_lock;

check patch require all lock have comments for it.

Frank

>
>  	u32                  win_start[WINDOW_COUNT];
>  	u32                  win_end[WINDOW_COUNT];
> --
> 2.55.0
>