Re: [PATCH v2 1/2] NTB: epf: serialize memory window parameter writes

[Koichiro Den]

On Sun, Nov 01, 2026 at 03:57:05PM +0200, Avi Weiss wrote:
> ntb_epf_mw_set_trans() writes the address and size to shared control
> registers before ntb_epf_send_command() acquires cmd_lock. Concurrent
> memory window setup requests can overwrite each other's parameters,
> causing one window to use another's DMA address.
> 
> Hold cmd_lock across the parameter writes and command submission.
> Use a locked command helper to preserve the existing serialization
> for other command callers.
> 
> Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
> Signed-off-by: Avi Weiss <thnkslprpt@xxxxxxxxx>

Reviewed-by: Koichiro Den <den@xxxxxxxxxxxxx>

> ---
>  drivers/ntb/hw/epf/ntb_hw_epf.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
> index c47607d4f8a7f..da7fbe1800656 100644
> --- a/drivers/ntb/hw/epf/ntb_hw_epf.c
> +++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
> @@ -123,15 +123,14 @@ struct ntb_epf_dev {
>  
>  #define ntb_ndev(__ntb) container_of(__ntb, struct ntb_epf_dev, ntb)
>  
> -static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
> -				u32 argument)
> +static int ntb_epf_send_command_locked(struct ntb_epf_dev *ndev, u32 command,
> +				       u32 argument)
>  {
>  	ktime_t timeout;
>  	bool timedout;
>  	int ret = 0;
>  	u32 status;
>  
> -	mutex_lock(&ndev->cmd_lock);
>  	writel(argument, ndev->ctrl_reg + NTB_EPF_ARGUMENT);
>  	writel(command, ndev->ctrl_reg + NTB_EPF_COMMAND);
>  
> @@ -157,6 +156,17 @@ static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
>  	}
>  
>  	writew(0, ndev->ctrl_reg + NTB_EPF_CMD_STATUS);
> +
> +	return ret;
> +}
> +
> +static int ntb_epf_send_command(struct ntb_epf_dev *ndev, u32 command,
> +				u32 argument)
> +{
> +	int ret;
> +
> +	mutex_lock(&ndev->cmd_lock);
> +	ret = ntb_epf_send_command_locked(ndev, command, argument);
>  	mutex_unlock(&ndev->cmd_lock);
>  
>  	return ret;
> @@ -494,11 +504,13 @@ static int ntb_epf_mw_set_trans(struct ntb_dev *ntb, int pidx, int idx,
>  		return -EINVAL;
>  	}
>  
> +	mutex_lock(&ndev->cmd_lock);
>  	writel(lower_32_bits(addr), ndev->ctrl_reg + NTB_EPF_LOWER_ADDR);
>  	writel(upper_32_bits(addr), ndev->ctrl_reg + NTB_EPF_UPPER_ADDR);
>  	writel(lower_32_bits(size), ndev->ctrl_reg + NTB_EPF_LOWER_SIZE);
>  	writel(upper_32_bits(size), ndev->ctrl_reg + NTB_EPF_UPPER_SIZE);
> -	ntb_epf_send_command(ndev, CMD_CONFIGURE_MW, idx);
> +	ntb_epf_send_command_locked(ndev, CMD_CONFIGURE_MW, idx);
> +	mutex_unlock(&ndev->cmd_lock);
>  
>  	return 0;
>  }
> -- 
> 2.43.0
>