public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Praveen Talari <praveen.talari@oss.qualcomm.com>,
	Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>,
	Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>,
	linux-arm-msm@vger.kernel.org, linux-spi@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH AUTOSEL 6.19-6.6] spi: geni-qcom: Check DMA interrupts early in ISR
Date: Tue, 24 Mar 2026 07:19:20 -0400	[thread overview]
Message-ID: <20260324111931.3257972-11-sashal@kernel.org> (raw)
In-Reply-To: <20260324111931.3257972-1-sashal@kernel.org>

From: Praveen Talari <praveen.talari@oss.qualcomm.com>

[ Upstream commit 8c89a077ca796a2fe248c584e9d7e66cff0388c8 ]

The current interrupt handler only checks the GENI main IRQ status
(m_irq) before deciding to return IRQ_NONE. This can lead to spurious
IRQ_NONE returns when DMA interrupts are pending but m_irq is zero.

Move the DMA TX/RX status register reads to the beginning of the ISR,
right after reading m_irq. Update the early return condition to check
all three status registers (m_irq, dma_tx_status, dma_rx_status) before
returning IRQ_NONE.

Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260313-spi-geni-qcom-fix-dma-irq-handling-v1-1-0bd122589e02@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

Record: The ISR function itself hasn't changed significantly between 6.6
and mainline in the area being patched. The fix should apply cleanly to
6.6.y and later stable trees.

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: SUBSYSTEM CRITICALITY
- **Subsystem:** drivers/spi (SPI bus drivers)
- **Specific driver:** spi-geni-qcom — Qualcomm GENI SPI driver
- **Criticality:** IMPORTANT — used on Qualcomm SoCs (Snapdragon
  platforms), which power many mobile devices, Chromebooks, and embedded
  systems
- The GENI SPI is used for communication with peripherals like sensors,
  touch controllers, etc.

Record: [drivers/spi, Qualcomm GENI] [IMPORTANT — widely used on
Qualcomm platforms including phones, Chromebooks, embedded]

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: WHO IS AFFECTED
Users of Qualcomm SoC platforms that use SPI in DMA mode. This includes
many Android devices, Chromebooks with Qualcomm chips, and embedded
systems.

### Step 8.2: TRIGGER CONDITIONS
The bug triggers when:
1. The SPI controller is operating in DMA mode (GENI_SE_DMA)
2. A DMA transfer completes and fires a DMA interrupt
3. No GENI main interrupt fires at the same time (m_irq == 0)

This is a normal operational scenario — DMA completion interrupts can
arrive without accompanying GENI main interrupts. The trigger is **not
rare** during normal DMA SPI transfers.

### Step 8.3: FAILURE MODE SEVERITY
When triggered:
1. The DMA completion interrupt is not acknowledged → **SPI transfer
   timeout**
2. On shared interrupt lines, repeated IRQ_NONE → kernel may disable the
   entire IRQ line → **device becomes non-functional**
3. Transfer timeouts cause SPI peripheral communication failures →
   **device malfunction**

Record: Severity: **HIGH** — causes SPI transfer failures/timeouts in
DMA mode, potential IRQ line disabling.

### Step 8.4: RISK-BENEFIT RATIO
- **BENEFIT:** HIGH — fixes real hardware communication failure on
  Qualcomm platforms
- **RISK:** VERY LOW — the change only moves existing register reads
  earlier and updates one condition check. No new logic, no new code
  paths. The DMA status registers were already being read later; moving
  them earlier is completely safe.
- **Ratio:** Strongly favorable for backporting.

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: EVIDENCE COMPILATION

**FOR backporting:**
- Fixes a real bug: DMA interrupts are silently ignored, causing SPI
  transfer timeouts
- Small and surgical: ~7 lines changed in a single function
- Obviously correct: moves register reads earlier and updates condition
  (matching what the serial GENI driver already does)
- Affects widely-used hardware (Qualcomm SoCs)
- Reviewed by Qualcomm engineer, applied by SPI subsystem maintainer
- Low regression risk: only behavioral change is properly handling DMA-
  only interrupts
- Bug exists since v6.3, present in stable trees 6.6.y+

**AGAINST backporting:**
- No explicit Cc: stable nomination
- No Reported-by (may indicate the bug is not commonly triggered, or was
  found during code review)
- No Fixes: tag (though the fix target is clearly e5f0dfa78ac77)

### Step 9.2: STABLE RULES CHECKLIST
1. **Obviously correct and tested?** YES — reviewed by Qualcomm, applied
   by maintainer, matches pattern used in serial GENI driver
2. **Fixes a real bug?** YES — DMA interrupts not handled, causing
   transfer failures
3. **Important issue?** YES — device communication failure, potential
   IRQ line disabling
4. **Small and contained?** YES — single function, ~7 lines
5. **No new features or APIs?** Correct — no new features
6. **Can apply to stable?** YES — likely clean apply to 6.6.y+

### Step 9.3: EXCEPTION CATEGORIES
Not an exception category — this is a standard bug fix.

### Step 9.4: DECISION
The fix is small, obviously correct, fixes a real bug that causes SPI
transfer failures in DMA mode on Qualcomm platforms, and has very low
regression risk. It meets all stable kernel criteria.

## Verification

- [Phase 1] Parsed tags: Signed-off-by from Qualcomm author, Reviewed-by
  from Qualcomm, Link to patch, applied by Mark Brown (SPI maintainer)
- [Phase 2] Diff analysis: ~7 lines changed in `geni_spi_isr()`, moves
  DMA status reads to top of ISR, updates early return condition
- [Phase 3] git blame: Early return (`if (!m_irq)`) introduced in
  `2ee471a1e28ec7` (2020). DMA mode added in `e5f0dfa78ac77` (v6.3)
  without updating the early return — this is the root cause
- [Phase 3] Author check: Praveen Talari is a regular Qualcomm GENI
  contributor (serial and SPI)
- [Phase 4] lore.kernel.org: Found patch at msgid link; v1 patch, no
  NAKs, accepted by maintainer
- [Phase 5] Callers: `geni_spi_isr` registered via `devm_request_irq()`
  at line 1167, invoked on every SPI interrupt
- [Phase 5] Similar pattern: Serial GENI driver (`qcom_geni_serial.c`
  lines 1065-1070) already reads all IRQ status registers at top of ISR
  — the SPI driver was inconsistent
- [Phase 6] Bug introduced in v6.3 (DMA mode commit). Present in stable
  trees 6.6.y and later
- [Phase 6] Clean apply expected: ISR area has not been significantly
  modified since 6.6
- [Phase 8] Failure mode: DMA transfer timeouts / unhandled interrupts /
  potential IRQ line disabling, severity HIGH
- [Phase 8] Risk: VERY LOW — moves existing reads earlier, no new logic

**YES**

 drivers/spi/spi-geni-qcom.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index acfcf870efd84..736120107184f 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -958,10 +958,13 @@ static irqreturn_t geni_spi_isr(int irq, void *data)
 	struct spi_controller *spi = data;
 	struct spi_geni_master *mas = spi_controller_get_devdata(spi);
 	struct geni_se *se = &mas->se;
-	u32 m_irq;
+	u32 m_irq, dma_tx_status, dma_rx_status;
 
 	m_irq = readl(se->base + SE_GENI_M_IRQ_STATUS);
-	if (!m_irq)
+	dma_tx_status = readl_relaxed(se->base + SE_DMA_TX_IRQ_STAT);
+	dma_rx_status = readl_relaxed(se->base + SE_DMA_RX_IRQ_STAT);
+
+	if (!m_irq && !dma_tx_status && !dma_rx_status)
 		return IRQ_NONE;
 
 	if (m_irq & (M_CMD_OVERRUN_EN | M_ILLEGAL_CMD_EN | M_CMD_FAILURE_EN |
@@ -1009,8 +1012,6 @@ static irqreturn_t geni_spi_isr(int irq, void *data)
 		}
 	} else if (mas->cur_xfer_mode == GENI_SE_DMA) {
 		const struct spi_transfer *xfer = mas->cur_xfer;
-		u32 dma_tx_status = readl_relaxed(se->base + SE_DMA_TX_IRQ_STAT);
-		u32 dma_rx_status = readl_relaxed(se->base + SE_DMA_RX_IRQ_STAT);
 
 		if (dma_tx_status)
 			writel(dma_tx_status, se->base + SE_DMA_TX_IRQ_CLR);
-- 
2.51.0


  parent reply	other threads:[~2026-03-24 11:19 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-24 11:19 [PATCH AUTOSEL 6.19] drm/amd/display: Fix gamma 2.2 colorop TFs Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19] mshv: Fix error handling in mshv_region_pin Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.1] tg3: replace placeholder MAC address with device property Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.12] btrfs: reserve enough transaction items for qgroup ioctls Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-5.10] objtool: Fix Clang jump table detection Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.12] HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.1] i2c: tegra: Don't mark devices with pins as IRQ safe Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.18] smb: client: fix generic/694 due to wrong ->i_blocks Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-5.10] atm: lec: fix use-after-free in sock_def_readable() Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-5.10] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq Sasha Levin
2026-03-24 11:19 ` Sasha Levin [this message]
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.12] wifi: mac80211: check tdls flag in ieee80211_tdls_oper Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19] objtool/klp: fix mkstemp() failure with long paths Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.6] arm64/scs: Fix handling of advance_loc4 Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.12] HID: logitech-hidpp: Enable MX Master 4 over bluetooth Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-5.15] btrfs: reject root items with drop_progress and zero drop_level Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-5.15] btrfs: don't take device_list_mutex when querying zone info Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-6.18] HID: core: Mitigate potential OOB by removing bogus memset() Sasha Levin
2026-03-24 11:19 ` [PATCH AUTOSEL 6.19-5.10] HID: multitouch: Check to ensure report responses match the request Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260324111931.3257972-11-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=broonie@kernel.org \
    --cc=konrad.dybcio@oss.qualcomm.com \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-spi@vger.kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=praveen.talari@oss.qualcomm.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox