From nobody Sun Apr 5 16:29:51 2026 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8739036655B for ; Fri, 20 Feb 2026 19:44:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771616660; cv=none; b=NiVZDiVMsn/Q3VogSA6wsk9eAkYEZadadti850aLBztKpRXkvn/OGFi0ZuibZGBsgslnXlpHiJ3zjaXLRNxIi5LPNKZLM0T3VGSsfVDRVGVbqccXk4dF5y6T5y/sWKgH0+bAoilwqqYJHPHEXA6Pjdbp4ei6clpmhL8L3r80L8w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771616660; c=relaxed/simple; bh=HZw/m+iZYxEGcuIZeLOrzXaThPDTnv+UpkVRVzMpSOI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=CJEs47FwD7EMaAIeGSBcZb6kRZCMHreYJo722MKENdBAxoRAzrZN6CzERcFlQVr1p68rfXzIEGpGG/6kDWgzlY3i2L7YiYxJSHJeiwHrN/2ubc6ErHeA2bgHIQJ2AJBxfuqJujVod6opaw4u1Z0MpO7khbh++sm9QlYUkcISjVk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=sifive.com; spf=pass smtp.mailfrom=sifive.com; dkim=pass (2048-bit key) header.d=sifive.com header.i=@sifive.com header.b=jxy5J+rF; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=sifive.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sifive.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=sifive.com header.i=@sifive.com header.b="jxy5J+rF" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-483487335c2so23002585e9.2 for ; Fri, 20 Feb 2026 11:44:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sifive.com; s=google; t=1771616654; x=1772221454; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=exW6wJ5MettYqKMw45/sBx+PnMDuRihL33c51S/rlCU=; b=jxy5J+rFq7uBZmpuei0xJfpmLSegTmO1bDaZ++JM6GEBESlZihdvT6BZgks2xciM60 FVtpbi7fwg+Ncw9hSP3sqmFyiQ3U5R1/P3tiaEqyuXnS/WmbftX9CS5Kxi9ECE3F0da7 +6pL0MKsFSGLtNEZ1fNT3TK989sGwlH5tle853DDmadGIiKXqzLLyUGjD6kyODFPNwJA i26vh91rTYushN79utjUruy8//KQ0TSDVXRJDUoH10eAvw4jYvDwzSIXyDpcKL6+dEh9 x5LhpL2mOzyOmVyyxnLOoSCmw97qRAblayTGvLDMI7afSmX9kOtAAglFUIaVBlL9YRQd Ww0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771616654; x=1772221454; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=exW6wJ5MettYqKMw45/sBx+PnMDuRihL33c51S/rlCU=; b=ePjpMcx+iqA1SPorBJet0fSJQR10kD7ySrS8aor6qQYD7qqaMtTlrFiHxPadm1Q8KT HvlbtyDNxTPG4wGL9GWSPHiba3DmXhHGzdR3E6aXhq0No9VKNiqN/EDZptmwuf1jKfiZ MpgNfsJLQE6KtTDgE0qFxX8NMNVsuEvMyort6CSqEn0nTTKMu0K/gB6mJYJXRlXpOLbQ WYwVoNkKnKpjSp73t0AEvQDY+xVUIYCOdwIVsMVM8vq5rVX7k0sYh66KKpQFOoEPsbkV ymM0VszoZxnf67L93FfIL+zVQUnOj6h/p+yrN9iYAp3aFbDia5w7Oj2Az6Krq8aF5LYz 2cmA== X-Forwarded-Encrypted: i=1; AJvYcCXyLL9gnjuboA/300xABr1QEKidrlAtqNUzH8PuRJmudo/O5n0jFqS5Qd2hKU0K8MLcwvpwbx4SBLxm4R0=@vger.kernel.org X-Gm-Message-State: AOJu0Yw5td7DlD3JVbY2RFyhWp6Z4CLDavMQdEfV1R6vcGIGqCOR/npJ EqsoZpV6XsgT1H/LqmOyPbQsuAKTVbx9MpPMb9X/Zvv6Y8dynQNY2dhHmh2tXtdGmy7UfvtKaYx L3hy+ X-Gm-Gg: AZuq6aJTd6ouf3WbNjVb+0rRxnB0CJgHYUHC1aQ5Yi9CdFy1MpmVRuPlWKz+zCOtrsQ K2lu/gsyFyqHRr6ZCiAxlwFuo98gSECU4gpelpgzKTYT7e4eF8GQ4EEFLQbrQQohBC1C6PjCQR1 KAcJdTfUoRpZb8PzOTPxebLh+4USPUVT0F8v2mluHlaPSwkLS2GOd0DPvLGGZb7im/z2lGiCq5e Jy5xwHMcm9Q1niZjRn0ZG46gYulk4RxOHP9LJdJUNBasfL5UGI0wZbsuTTEVE9FJax4LPSJxaJZ nCJ1/GFXhqf2Pe4/CVrsMXqCe04MMGCQofXOnBEyMzPKau9U7oZjebwxFEkzx0IcupFIipqaMZg nRdpBWzpoKwQEQ9aDPvKMlA6VwlteUrMt6Z6LfhsoDiuvm1IdBo2YWARiwH+0DalQF7icyM3+Ux 4w6RlnjhXdKouorwCQ5DOqcQlfdx02KpY= X-Received: by 2002:a05:600c:46c9:b0:483:6f37:1b51 with SMTP id 5b1f17b1804b1-483a95ea9c9mr9114085e9.23.1771616653836; Fri, 20 Feb 2026 11:44:13 -0800 (PST) Received: from [127.0.1.1] ([210.176.154.34]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-483a3e1b7ccsm24460755e9.11.2026.02.20.11.44.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Feb 2026 11:44:13 -0800 (PST) From: Max Hsu Date: Sat, 21 Feb 2026 03:43:54 +0800 Subject: [PATCH 2/5] dmaengine: sf-pdma: fix race between done and error interrupts Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260221-pdma-v1-2-838d929c2326@sifive.com> References: <20260221-pdma-v1-0-838d929c2326@sifive.com> In-Reply-To: <20260221-pdma-v1-0-838d929c2326@sifive.com> To: Paul Walmsley , Samuel Holland , Vinod Koul , Frank Li , Green Wan , Rob Herring , Krzysztof Kozlowski , Conor Dooley , Palmer Debbelt , Conor Dooley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti Cc: linux-riscv@lists.infradead.org, dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Walmsley , devicetree@vger.kernel.org, Max Hsu , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=2398; i=max.hsu@sifive.com; h=from:subject:message-id; bh=HZw/m+iZYxEGcuIZeLOrzXaThPDTnv+UpkVRVzMpSOI=; b=owEB7QES/pANAwAKAdID/Z0HeUC9AcsmYgBpmLl71dxWi5B+zksLXjlly23frduiErFqlc8fz Z/otqlEM4iJAbMEAAEKAB0WIQTqXmcbOhS2KZE9X2jSA/2dB3lAvQUCaZi5ewAKCRDSA/2dB3lA vcuoDACgaeWfX7TSgRc1yNCZNUpKCUjEzSewb3vD7LvYIUVNGUfInacZIz+DBH6FaLxFB9wtTAQ J7hyWDGbq5fOphtYG/+4mE1K4SYEXr7LLG3QI5plJqhkgVzy+NA+JNUKWt7z5Nc/70t5KXh8KlC cjjhkknMwzd+BtXvy30eiEvVSqmaeyy/8UIDqAT/4/pwDmCkAaV1EcWgzyK4LdRlHHE99mNiKo+ n015Nh6m2BWRuSkkm1MYESTug3DX3WC6/ByMs28nGKB/DxyKtrAtMT6Mk+tQWuvPIPvxHnpo3K7 avJD/L46htLvCT+z8SyM6kU1J+V2zChbhqoEA/K3aJ6uMaI2AcAYuTFj5kkPJtoepUMvRQusLap RAJJT6K8glfyHNIGLIfhWibLjyIkXfOxNEM0a2xoRjY2Ko/Ri9BxAbGjt/4kz0IA8h5UKMXZ0xu +nDU6BCnE4e7YBBie6Zj/Bpg57kOAiQ/3C9GLsC7Uj4B0Ennz3k7dOUaZugVOuQEE/n3s= X-Developer-Key: i=max.hsu@sifive.com; a=openpgp; fpr=EA5E671B3A14B629913D5F68D203FD9D077940BD According to the FU540-C000 v1p5 [1] and FU740-C000 v1p7 [2] specs, when a DMA transaction error occurs, the hardware sets both the DONE and ERROR interrupt bits simultaneously. On SMP systems, this can cause the done_isr and err_isr to execute concurrently on different CPUs, leading to race conditions and NULL pointer dereferences. Fix by: - In done_isr: abort if ERROR bit is set or DONE bit was already cleared - In err_isr: clear both DONE and ERROR bits to prevent done_isr from processing the same transaction Link: https://www.sifive.com/document-file/freedom-u540-c000-manual [1] Link: https://www.sifive.com/document-file/freedom-u740-c000-manual [2] Fixes: 6973886ad58e ("dmaengine: sf-pdma: add platform DMA support for HiFi= ve Unleashed A00") Cc: stable@vger.kernel.org Signed-off-by: Max Hsu Reviewed-by: Frank Li --- drivers/dma/sf-pdma/sf-pdma.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c index 7ad3c29be146..ac7d3b127a24 100644 --- a/drivers/dma/sf-pdma/sf-pdma.c +++ b/drivers/dma/sf-pdma/sf-pdma.c @@ -346,9 +346,25 @@ static irqreturn_t sf_pdma_done_isr(int irq, void *dev= _id) struct sf_pdma_chan *chan =3D dev_id; struct pdma_regs *regs =3D &chan->regs; u64 residue; + u32 control_reg; =20 spin_lock(&chan->vchan.lock); - writel((readl(regs->ctrl)) & ~PDMA_DONE_STATUS_MASK, regs->ctrl); + control_reg =3D readl(regs->ctrl); + if (control_reg & PDMA_ERR_STATUS_MASK) { + spin_unlock(&chan->vchan.lock); + return IRQ_HANDLED; + } + + /* + * Check if DONE bit is still set. If not, the error ISR on another + * CPU has already cleared it, so abort to avoid double-processing. + */ + if (!(control_reg & PDMA_DONE_STATUS_MASK)) { + spin_unlock(&chan->vchan.lock); + return IRQ_HANDLED; + } + + writel((control_reg & ~PDMA_DONE_STATUS_MASK), regs->ctrl); residue =3D readq(regs->residue); =20 if (!residue) { @@ -375,7 +391,7 @@ static irqreturn_t sf_pdma_err_isr(int irq, void *dev_i= d) struct pdma_regs *regs =3D &chan->regs; =20 spin_lock(&chan->lock); - writel((readl(regs->ctrl)) & ~PDMA_ERR_STATUS_MASK, regs->ctrl); + writel((readl(regs->ctrl)) & ~(PDMA_DONE_STATUS_MASK | PDMA_ERR_STATUS_MA= SK), regs->ctrl); spin_unlock(&chan->lock); =20 tasklet_schedule(&chan->err_tasklet); --=20 2.43.0