Re: [PATCH 1/2] spi: tegra210-quad: don't overwrite refreshed status with lost-IRQ snapshot

[Breno Leitao]

On Fri, Oct 16, 2026 at 01:25:19PM +0000, Vishwaroop A wrote:
> tegra_qspi_handle_timeout() captures a "lost IRQ" FIFO status snapshot
> when the ISR cache is empty on entry but QSPI_TRANS_STATUS shows the
> transfer completed. After masking the controller IRQ and draining the
> workqueue with cancel_work_sync(), it re-loads the ISR cache with
> smp_load_acquire(): if the drain observed a real ISR completion, the
> refreshed cache holds ISR-published status_reg, tx_status and rx_status
> that reflect the true hardware error state at IRQ time.
> 
> However, when both cache and snapshot are set, the code keeps the
> refreshed value in the local status variable but then unconditionally
> publishes the pre-drain lost_fifo_status / lost_tx_status /
> lost_rx_status snapshot into tqspi->status_reg / tx_status / rx_status
> via the lost_irq_snapshot branch. That snapshot is racy: if the ISR
> fires on another CPU between our live QSPI_TRANS_STATUS read and our
> live QSPI_FIFO_STATUS snapshot, the ISR W1Cs the hardware error bits
> before we sample them, so the snapshot may contain zeroed error
> fields. Overwriting the ISR-published values with these zeros makes
> the manual completion handler downstream silently accept a transfer
> that actually reported a FIFO error.
> 
> Clear lost_irq_snapshot when the refreshed cache is non-zero, so the
> ISR-published status wins over the pre-drain snapshot in that case.
> The lost-IRQ path (refreshed == 0 && live QSPI_RDY set) is unaffected.
> 
> Fixes: 1ff82c13ea94 ("spi: tegra210-quad: Cache TRANS_STATUS in ISR for timeout handler")
> Reported-by: Carol Soto <csoto@xxxxxxxxxx>
> Link: https://github.com/NVIDIA/NV-Kernels/pull/579
> Signed-off-by: Vishwaroop A <va@xxxxxxxxxx>

Reviewed-by: Breno Leitao <leitao@xxxxxxxxxx>