spmi: mtk-pmif: Keep spinlock until read is fully done

Move the spin unlocking to after reading the contents of the
PMIF_SWINF_(x)_RDATA_31_0 register in pmif_spmi_read_cmd():
since this is the only register that we can read to get the
data from all of the arbitered busses, a concurrent request
for reading (especially on a busy arbiter) will show a race
condition and a unexpected or corrupted value may be read.

Doing the entire read sequence while spin locked guarantees
that concurrent access to the arbiter doesn't happen.

Fixes: f200fff8d019 ("spmi: mtk-pmif: Serialize PMIF status check and command submission")
Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Fixes: b45b3ccef8c0 ("spmi: mediatek: Add support for MT6873/8192")
Link: https://patch.msgid.link/20260123182039.224314-4-sboyd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/spmi/spmi-mtk-pmif.c b/drivers/spmi/spmi-mtk-pmif.c
index 68f458587c67365398306b35ba526126d37dc763..9f416b231ab86176c7f2f012b656232aa7323360 100644 (file)
--- a/drivers/spmi/spmi-mtk-pmif.c
+++ b/drivers/spmi/spmi-mtk-pmif.c
@@ -22,7 +22,7 @@
 #define PMIF_CMD_EXT_REG       2
 #define PMIF_CMD_EXT_REG_LONG  3
 
-#define PMIF_DELAY_US   10
+#define PMIF_DELAY_US   2
 #define PMIF_TIMEOUT_US (10 * 1000)
 
 #define PMIF_CHAN_OFFSET 0x5
@@ -372,7 +372,6 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,
        /* Send the command. */
        cmd = (opc << 30) | (sid << 24) | ((len - 1) << 16) | addr;
        pmif_writel(arb, pbus, cmd, inf_reg->ch_send);
-       raw_spin_unlock_irqrestore(&pbus->lock, flags);
 
        /*
         * Wait for Software Interface FSM state to be WFVLDCLR,
@@ -382,13 +381,16 @@ static int pmif_spmi_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,
                                        data, GET_SWINF(data) == SWINF_WFVLDCLR,
                                        PMIF_DELAY_US, PMIF_TIMEOUT_US);
        if (ret < 0) {
+               raw_spin_unlock_irqrestore(&pbus->lock, flags);
                dev_err(&ctrl->dev, "failed to wait for SWINF_WFVLDCLR\n");
                return ret;
        }
 
        data = pmif_readl(arb, pbus, inf_reg->rdata);
-       memcpy(buf, &data, len);
        pmif_writel(arb, pbus, 1, inf_reg->ch_rdy);
+       raw_spin_unlock_irqrestore(&pbus->lock, flags);
+
+       memcpy(buf, &data, len);
 
        return 0;
 }