From nobody Sun May 24 18:41:11 2026 Received: from mail-pj1-f66.google.com (mail-pj1-f66.google.com [209.85.216.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F3A73C3C01 for ; Fri, 22 May 2026 09:58:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.66 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779443886; cv=none; b=qMzS0uGeShSP9SoYYMd7eGv7DNxaR2TmT4D8ncVzsSRVpJEE9GxFMUvpst2O5ZrVL3yVMga1+jtMUhi1MNU3dapUgsvTFPWTNcGDMX197pT64kcmmGjkHN4bJcfuZxK+FcCYHEOPOdlGkQO8niUVNVJk1RTP464DkkalYWYx+l8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779443886; c=relaxed/simple; bh=ngAw18xIScEFM+It58VxjuaUlQbcZgx/Z/Iy/8x4uic=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Regcfg9QzPBI42Dm2yNWV2YM7aGwp0OBMVxspZaXH+JrXxOQ9Q5tl5hueSZE/7DVKTqIou6NSMjInw7q/enX6UqUJlWId4Gn3mBoEoLcf1l90vpMEq+uaL+XPbkIUfEZfV/s5b/9w1mkEtsWPod+dvJqTJYwBhj6s+ayWFCnEYg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=M9poCuFr; arc=none smtp.client-ip=209.85.216.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="M9poCuFr" Received: by mail-pj1-f66.google.com with SMTP id 98e67ed59e1d1-367cbac9cb1so6718720a91.3 for ; Fri, 22 May 2026 02:58:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779443885; x=1780048685; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=gzT000h1QTlmVrCMvUhZU+5EGxiL+DAZp9rDjkpmglg=; b=M9poCuFrQMlxxE5pa3moLCWj5I2B6eB8W4ruO6179EcU4az+fqiQS+G1adA8gbxGLg CAR+dg11p32Iwikp9R3zCbTH0OUn1Tq41u84FfRuOwiEeMNm5cArO0/xyyNWDY0n7Xax hk9TElKKZBdmQ8hv8KRgmMUThczYghB76xliz/QTgkqfzZPXH8mtjBp1piLjx7F4QMHQ dNJ0gUl9J0pKCHdcOeOnezwNkWop0GePhFQU6+mW8mGfBDODy82Z+tJ4rqdVd1c5kUms K8kQ+7LkBr6z1GpT94WaQ3J60D78V8NC1vknvNxzQykO16RUovaZjIRvLPc01vJFYQw0 2HZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779443885; x=1780048685; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=gzT000h1QTlmVrCMvUhZU+5EGxiL+DAZp9rDjkpmglg=; b=LX8bomWYdkhaDTiwX1FG0E0jJTy/oEcsY3tvgvS4tCIhALD4uJJZithHmOIjpLxja0 lv2mF9/9KHW10+xOjuh/EzY2W/FwCFrty2/ak4Te60tefBtMjIMUpJ0ISp70s7cZx+TS yKLZ7XQv9CPhtHYkjgapdWimJqLgPOA3ytRU/opHIr7JdMWo96NB5NvTCrjW8K9P7Ddv QOz6+H6Uc3PXLJqgonpq53dfa70WlaQkER+qoSYAYdv/Uq1+bZJaF9KDFo/TBoPfhvdO GYQucSgd+P+BbfNzKWm3WQdj7ZmEozInxwBzUhPkeGvxpjV79aSQZ0ounSIBK4rzFt74 j3Rg== X-Forwarded-Encrypted: i=1; AFNElJ94vHahMIr5y5MYUvMz9heH33qxV4zM/DuCAG/BlFr6DqWjWvjF3w2Di9m+wbkmysPL6ORtat5WStr42k0=@vger.kernel.org X-Gm-Message-State: AOJu0YwCcPwkm01hvQ4a9Dyj0Q1kEXmOJPIEmx88uTxLhKt/ITZ2SjUJ h9XohTAE7SyUT9EAmqdOFKfMKmrPEX6QwwDKEigF1FWhxelGh95tXeUE X-Gm-Gg: Acq92OEPK5BRPGuhhGEOknLZy/pCBVYcWov97SN1zBozGXNAXkNtBxhT6bTb9EvA96n 3eSqT8N+WbLLysWH00uROeg6ejZj+KiD1qWFcGODMc686e1KIcJNjrdXLM4XAt57DIf7celS4tn Cz0ZuV0zWOIMBJdZP79rPiZHoGwPWp1QBMCfSmVLDl+vkqzzNEa+RGYWDWIUQCDBdVabcoz/EAA G3BcDkv3xW+z7cg8zrDTer1nn/7/SjoOmHLBcDdhSbELaXVjFzV3ofYbQQDyydvvtPzPX2EeQl8 qdNW0EUF0v6Ukt4vr140ZNS4XQJGquaBdyTG1QkDLe5evZfI/9B4xjrTGSSutIkU7RTrFprMmiZ +DHfAjyNuyIPYkV0AAH5Bb1BpeRQY8dxVb7xN2RvkcOpGBZOW4PY+87tZutvLjVwox55cGdMrhG dT65va2NI6gRiV2MdCBg== X-Received: by 2002:a17:90b:2586:b0:368:f0d0:1ce8 with SMTP id 98e67ed59e1d1-36a6770aa6bmr2941275a91.9.1779443884700; Fri, 22 May 2026 02:58:04 -0700 (PDT) Received: from Dell-5540.. ([2001:926:3:e0:6695:664d:99d8:94e1]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a674b5f19sm1218777a91.0.2026.05.22.02.58.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 22 May 2026 02:58:04 -0700 (PDT) From: Peng Yang X-Google-Original-From: Peng Yang To: Mark Brown Cc: Serge Semin , linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, pyangyyd@gmail.com, Peng Yang Subject: [PATCH] spi: dw: fix race between transfer IRQ handler and timeout handler Date: Fri, 22 May 2026 17:57:27 +0800 Message-ID: <20260522095727.18307-1-pyangyyd@amazon.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dw_spi_transfer_handler() can race with dw_spi_handle_err() on SMP. When an IRQ-based transfer times out, the error path resets the chip while the IRQ handler is still accessing the FIFO on another CPU. This causes bus errors on platforms where empty FIFO access is illegal. Fix by adding a spinlock around FIFO access and chip reset to make them in serial. Fixes: 0b6bfad4cee4 ("spi: spi-dw: Remove extraneous locking") Signed-off-by: Peng Yang --- drivers/spi/spi-dw-core.c | 10 ++++++++++ drivers/spi/spi-dw.h | 1 + 2 files changed, 11 insertions(+) diff --git a/drivers/spi/spi-dw-core.c b/drivers/spi/spi-dw-core.c index b47637888..e2ae04410 100644 --- a/drivers/spi/spi-dw-core.c +++ b/drivers/spi/spi-dw-core.c @@ -213,6 +213,7 @@ EXPORT_SYMBOL_NS_GPL(dw_spi_check_status, "SPI_DW_CORE"= ); static irqreturn_t dw_spi_transfer_handler(struct dw_spi *dws) { u16 irq_status =3D dw_readl(dws, DW_SPI_ISR); + unsigned long flags; =20 if (dw_spi_check_status(dws, false)) { spi_finalize_current_transfer(dws->ctlr); @@ -226,7 +227,9 @@ static irqreturn_t dw_spi_transfer_handler(struct dw_sp= i *dws) * final stage of the transfer. By doing so we'll get the next IRQ * right when the leftover incoming data is received. */ + spin_lock_irqsave(&dws->buf_lock, flags); dw_reader(dws); + spin_unlock_irqrestore(&dws->buf_lock, flags); if (!dws->rx_len) { dw_spi_mask_intr(dws, 0xff); spi_finalize_current_transfer(dws->ctlr); @@ -240,7 +243,9 @@ static irqreturn_t dw_spi_transfer_handler(struct dw_sp= i *dws) * have the TXE IRQ flood at the final stage of the transfer. */ if (irq_status & DW_SPI_INT_TXEI) { + spin_lock_irqsave(&dws->buf_lock, flags); dw_writer(dws); + spin_unlock_irqrestore(&dws->buf_lock, flags); if (!dws->tx_len) dw_spi_mask_intr(dws, DW_SPI_INT_TXEI); } @@ -468,11 +473,14 @@ static int dw_spi_transfer_one(struct spi_controller = *ctlr, static inline void dw_spi_abort(struct spi_controller *ctlr) { struct dw_spi *dws =3D spi_controller_get_devdata(ctlr); + unsigned long flags; =20 if (dws->dma_mapped) dws->dma_ops->dma_stop(dws); =20 + spin_lock_irqsave(&dws->buf_lock, flags); dw_spi_reset_chip(dws); + spin_unlock_irqrestore(&dws->buf_lock, flags); } =20 static void dw_spi_handle_err(struct spi_controller *ctlr, @@ -939,6 +947,8 @@ int dw_spi_add_controller(struct device *dev, struct dw= _spi *dws) dws->ctlr =3D ctlr; dws->dma_addr =3D (dma_addr_t)(dws->paddr + DW_SPI_DR); =20 + spin_lock_init(&dws->buf_lock); + spi_controller_set_devdata(ctlr, dws); =20 /* Basic HW init */ diff --git a/drivers/spi/spi-dw.h b/drivers/spi/spi-dw.h index 9cc79c566..4c0843e96 100644 --- a/drivers/spi/spi-dw.h +++ b/drivers/spi/spi-dw.h @@ -196,6 +196,7 @@ struct dw_spi { const struct dw_spi_dma_ops *dma_ops; struct completion dma_completion; =20 + spinlock_t buf_lock; /* Serialize FIFO access vs chip reset */ #ifdef CONFIG_DEBUG_FS struct dentry *debugfs; struct debugfs_regset32 regset; --=20 2.50.1