[PATCH v20 8/8] i3c: hub: p3h2x4x: Add SMBus slave mode support

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] i3c: hub: race condition in W1C register drops SMBus packets on overflow
--

commit c3c584227ca9aea44ff10ea314eddee7cc1ae7a9
Author: Lakshay Piplani <lakshay.piplani at nxp.com>

i3c: hub: p3h2x4x: Add SMBus slave mode support

This commit adds SMBus slave mode support for the P3H2x4x hub SMBus target
ports, allowing it to receive downstream payloads and report them via IBI.
The payloads are then forwarded to the registered I2C slave client.

> diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
> index a3324cc365956..7fdfa79dfeb6c 100644
> --- a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
> +++ b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c
[ ... ]
> @@ -15,6 +17,178 @@ enum p3h2x4x_smbus_desc_idx {
[ ... ]
> +		case P3H2X4X_TARGET_BUF_OVRFL_VAL:
> +			p3h2x4x_read_smbus_agent_rx_buf(i3cdev, RCV_BUF_0, i);
> +			p3h2x4x_read_smbus_agent_rx_buf(i3cdev, RCV_BUF_1, i);
> +			regmap_write(p3h2x4x_i3c_hub->regmap, P3H2X4X_TP0_SMBUS_AGNT_STS + i,
> +				     P3H2X4X_TARGET_BUF_OVRFL);

[Severity: Medium]
Does this write clear newly received packets on overflow?

If an external device sends a burst of packets, causing an overflow (bits 1, 2,
and 3 set in the status register), the IBI handler reads buffer 0 (which clears
bit 1 via a Write-1-to-Clear) and buffer 1 (which clears bit 2).

If the hardware receives a new packet into buffer 0 in the small window before
the overflow flag is cleared, bit 1 is set again by the hardware. The driver
then executes the regmap_write() to clear the overflow state.

Because P3H2X4X_TARGET_BUF_OVRFL is defined as GENMASK(3, 1), it writes '1' to
bits 1, 2, and 3. Since the register uses W1C semantics, this second write
inadvertently clears the newly set bit 1, permanently dropping the new packet
without reading it.

> +			dev_err(&i3cdev->dev, "Overflow, reading buffer zero and one\n");
> +			break;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922103551.2754613-1-lakshay.piplani@nxp.com?part=8