ata: sata_dwc_460ex: preserve sactive_issued state across ISR invocations

drivers/ata/sata_dwc_460ex.c static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) · line 526

[Severity: High]
This is a pre-existing issue, but since you are checking for ATA_TAG_POISON here, I noticed that sata_dwc_error_intr() doesn't seem to do this.

When an error interrupt fires while no command is active, active_tag is ATA_TAG_POISON (253). Does this out-of-bounds heap read leak memory into the kernel log?

drivers/ata/sata_dwc_460ex.c:sata_dwc_error_intr() {
    ...
    tag = ap->link.active_tag;

    dev_err(ap->dev,
        "... pending=%d issued=%d",
        ..., hsdevp->dma_pending[tag], hsdevp->cmd_issued[tag]);
    ...
}

drivers/ata/sata_dwc_460ex.c static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) · line 544

[Severity: High]
Does this early exit path drop NCQ DMAC interrupts when they arrive before DEV interrupts?

In SATA DMA transactions, the DMAC (transfer complete) interrupt can arrive before the device sends the SDB FIS (DEV interrupt). When this happens, sactive still matches sactive_issued, so tag_mask is 0.

By exiting early here, it appears dma_interrupt_count will not be incremented for the DMAC interrupt. When the DEV interrupt later arrives, the count will only reach 1, potentially causing the NCQ command to permanently hang.

[ ... ]

drivers/ata/sata_dwc_460ex.c static irqreturn_t sata_dwc_isr(int irq, void *dev_instance) · line 626

[Severity: High]
Because sactive_issued is persistent across ISR invocations now, does skipping cleanup here permanently break the port?

If continue is taken (e.g., from a spurious hardware interrupt with an invalid tag), the stale tag is never cleared from hsdev->sactive_issued. This seems to cause tag_mask to evaluate to non-zero on all subsequent interrupts, permanently breaking the non-NCQ early fallback path (which expects tag_mask == 0) and potentially causing endless log spam.

[Severity: Critical]
Since sactive_issued is no longer cleared on ISR entry, does this loop need to clear the completed tags from hsdev->sactive_issued?

Because pending tags are not cleared from sactive_issued until they fully complete, they appear to be repeatedly processed on subsequent interrupts. If multiple NCQ tags are active, a DEV interrupt for Tag A increments the global dma_interrupt_count to 1 but does not clear sactive_issued.

If a DEV interrupt for Tag B arrives next, tag_mask still contains Tag A. The loop processes Tag A again, increments the count to 2, and erroneously completes Tag A before its DMAC interrupt arrives:

drivers/ata/sata_dwc_460ex.c:sata_dwc_isr() {
    ...
    if (ata_is_dma(qc->tf.protocol)) {
        hsdevp->dma_interrupt_count++;
        ...
        if ((hsdevp->dma_interrupt_count % 2) == 0)
            sata_dwc_dma_xfer_complete(ap);
    ...
}

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1