From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 09BD3C624D4 for ; Wed, 2 Sep 2026 15:36:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References :Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=8IDRrUyGJ4W+X6nqnY/dGzAclZo4HIxDPCYhFpwcbcM=; b=CLdpMKIwN7XAt5ZR6yMhhYtGeI Kk82EZl2q9zS16EMFTj42Da1YOaPid5USIijevJMJ1gR/nL0jHBOyfZHUB+5H7qtaKkknT7Sb+b8e qz81XCUZlBQ00oEk+w+XDzL6edMbQQXRSvqBfoVukc4jVqN6WyBZkEP6XEf0JGJlFy7WZrvLhcUhp tNd1hwE9E9VzDPA8ZbwednE49vZy9DkHdUJ36ZHKTGGdjBRB8ONpDjJbdBtwSbavwOkCWUWH/bPTA O5hb2wqXwuTmbtqjaP0KzWM4rMOqc7sThqL26VHM/WdMV1TEVkABoHIASzd1HseLRbN78ZNGA9Mfm 6LMxYALg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x1n0R-0000000F6Y7-1bTa; Wed, 02 Sep 2026 15:36:07 +0000 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x1n0L-0000000F6Ul-3YGb for linux-arm-kernel@lists.infradead.org; Wed, 02 Sep 2026 15:36:04 +0000 Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 3A7982058E5; Wed, 02 Sep 2026 17:35:54 +0200 (CEST) Received: from dude04.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::ac]) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.96) (envelope-from ) id 1x1n0E-004bxm-0N; Wed, 02 Sep 2026 17:35:54 +0200 From: Jonas Rebmann Date: Wed, 02 Sep 2026 17:35:46 +0200 Subject: [PATCH 4/5] spi: spi-sun4i: sun4i_spi_handler(): fix race condition between transfer completion and RX FIFO interrupt MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260902-spi-sun4i-fixes-v1-4-19985ef75673@pengutronix.de> References: <20260902-spi-sun4i-fixes-v1-0-19985ef75673@pengutronix.de> In-Reply-To: <20260902-spi-sun4i-fixes-v1-0-19985ef75673@pengutronix.de> To: Mark Brown , Chen-Yu Tsai , Jernej Skrabec , Samuel Holland , Maxime Ripard , Alexandru Gagniuc , Olliver Schinagl Cc: linux-spi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, Mark Brown , kernel@pengutronix.de, Marc Kleine-Budde , Jonas Rebmann , Tobias Schramm X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=openpgp-sha256; l=3493; i=jre@pengutronix.de; h=from:subject:message-id; bh=xez/HqbUFh5c/PkzUu4yoRKWnkmidv1BioLuPqVozpo=; b=owGbwMvMwCV2ZcYT3onnbjcwnlZLYsia4RTB07rN/6zrF6dbj9faXlIX2cof8iWBIyQ2939gz fMFjs1nOkpZGMS4GGTFFFli1eQUhIz9r5tV2sXCzGFlAhnCwMUpABNJiWVkOH7lhM6UJb8WfUtM ifv6cNGp6ycOXXVbe5ohxfxyusLTxYsZGWb07e3j9HmxwpN//1PdAMEN7R80atyMrlaEP5mw1t5 mOQMA X-Developer-Key: i=jre@pengutronix.de; a=openpgp; fpr=0B7B750D5D3CD21B3B130DE8B61515E135CD49B5 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260902_083602_041487_0C3B5103 X-CRM114-Status: GOOD ( 15.35 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Marc Kleine-Budde In commit 196737912da5 ("spi: sun4i: Allow transfers larger than FIFO size"), support for transfers larger than the FIFO size was added. This commit moves the draining of the RX-FIFO from sun4i_spi_transfer_one() (after completion of the transfer) to the IRQ handler when the IRQ "transfer complete" is handled. In addition, the IRQ "RX-FIFO 3/4 full" is activated for all transfers. However, this does not take into account that the RX-IRQ for transfers that exceed 3/4 of the FIFO size is still pending after the IRQ "transfer complete" has been processed. All interrupt sources are only deactivated after the wait_for_completion_timeout() in sun4i_spi_transfer_one(). This opens a race window for "RX-FIFO 3/4 full" interrupts to come. The sequence is as follows: | sun4i_spi_transfer_one() | sun4i_spi_fill_fifo() // fill TX-FIFO with 48 bytes | // enable RX-FIFO 3/4 full IRQ | wait_for_completion_timeout(); | | // SPI controller transfers 48 bytes | // SPI controller issues "transfer complete" and "RX-FIFO 3/4 full" IRQ | | // IRQ handler start | sun4i_spi_handler() | // ACK "transfer complete" IRQ | sun4i_spi_drain_fifo(); | complete(); ----. | return IRQ_HANDLED; \ | // IRQ handler end \__ race | / window | // wait_for_completion_timeout() continues / | // disable all IRQ sources ----' Avoid the race condition by disabling all interrupts when handling the "transfer complete" IRQ and before calling complete(). Also move the draining of the RX-FIFO back into sun4i_spi_transfer_one() where it was before commit 196737912da5 ("spi: sun4i: Allow transfers larger than FIFO size"). This has the added benefit of spending a little less time in the IRQ handler. Cc: Tobias Schramm Fixes: 196737912da5 ("spi: sun4i: Allow transfers larger than FIFO size") Signed-off-by: Marc Kleine-Budde Signed-off-by: Jonas Rebmann --- drivers/spi/spi-sun4i.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c index ae009d598450..18951c1972da 100644 --- a/drivers/spi/spi-sun4i.c +++ b/drivers/spi/spi-sun4i.c @@ -333,6 +333,9 @@ static int sun4i_spi_transfer_one(struct spi_controller *host, start = jiffies; time_left = wait_for_completion_timeout(&sspi->done, msecs_to_jiffies(tx_time)); + + sun4i_spi_drain_fifo(sspi, SUN4I_FIFO_DEPTH); + end = jiffies; if (!time_left) { dev_warn(&host->dev, @@ -340,13 +343,12 @@ static int sun4i_spi_transfer_one(struct spi_controller *host, dev_name(&spi->dev), tfr->len, tfr->speed_hz, jiffies_to_msecs(end - start), tx_time); ret = -ETIMEDOUT; + sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, 0); goto out; } out: - sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, 0); - return ret; } @@ -357,8 +359,7 @@ static irqreturn_t sun4i_spi_handler(int irq, void *dev_id) /* Transfer complete */ if (status & SUN4I_INT_CTL_TC) { - sun4i_spi_write(sspi, SUN4I_INT_STA_REG, SUN4I_INT_CTL_TC); - sun4i_spi_drain_fifo(sspi, SUN4I_FIFO_DEPTH); + sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, 0); complete(&sspi->done); return IRQ_HANDLED; } -- 2.55.0.123.gf60db8d575