Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'spi-fix-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"There are a bunch of device specific fixes (more than I'd like, I've
been lax sending these) plus one important core fix for the conversion
to use an IDR for bus number allocation which avoids issues with
collisions when some but not all of the buses in the system have a
fixed bus number specified.
The Armada changes are rather large, specificially "spi: armada-3700:
Fix padding when sending not 4-byte aligned data", but it's a storage
corruption issue and there's things like indentation changes which
make it look bigger than it really is. It's been cooking in -next for
quite a while now and is part of the reason for the delay"
* tag 'spi-fix-v4.14-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: fix IDR collision on systems with both fixed and dynamic SPI bus numbers
spi: bcm-qspi: Fix use after free in bcm_qspi_probe() in error path
spi: a3700: Return correct value on timeout detection
spi: uapi: spidev: add missing ioctl header
spi: stm32: Fix logical error in stm32_spi_prepare_mbr()
spi: armada-3700: Fix padding when sending not 4-byte aligned data
spi: armada-3700: Fix failing commands with quad-SPI
+65
-107
+48
-97
drivers/spi/spi-armada-3700.c
+48
-97
drivers/spi/spi-armada-3700.c
···
99
99
/* A3700_SPI_IF_TIME_REG */
100
100
#define A3700_SPI_CLK_CAPT_EDGE BIT(7)
101
101
102
-
/* Flags and macros for struct a3700_spi */
103
-
#define A3700_INSTR_CNT 1
104
-
#define A3700_ADDR_CNT 3
105
-
#define A3700_DUMMY_CNT 1
106
-
107
102
struct a3700_spi {
108
103
struct spi_master *master;
109
104
void __iomem *base;
···
112
117
u8 byte_len;
113
118
u32 wait_mask;
114
119
struct completion done;
115
-
u32 addr_cnt;
116
-
u32 instr_cnt;
117
-
size_t hdr_cnt;
118
120
};
119
121
120
122
static u32 spireg_read(struct a3700_spi *a3700_spi, u32 offset)
···
153
161
}
154
162
155
163
static int a3700_spi_pin_mode_set(struct a3700_spi *a3700_spi,
156
-
unsigned int pin_mode)
164
+
unsigned int pin_mode, bool receiving)
157
165
{
158
166
u32 val;
159
167
···
169
177
break;
170
178
case SPI_NBITS_QUAD:
171
179
val |= A3700_SPI_DATA_PIN1;
180
+
/* RX during address reception uses 4-pin */
181
+
if (receiving)
182
+
val |= A3700_SPI_ADDR_PIN;
172
183
break;
173
184
default:
174
185
dev_err(&a3700_spi->master->dev, "wrong pin mode %u", pin_mode);
···
387
392
388
393
spireg_write(a3700_spi, A3700_SPI_INT_MASK_REG, 0);
389
394
390
-
return true;
395
+
/* Timeout was reached */
396
+
return false;
391
397
}
392
398
393
399
static bool a3700_spi_transfer_wait(struct spi_device *spi,
···
442
446
443
447
static void a3700_spi_header_set(struct a3700_spi *a3700_spi)
444
448
{
445
-
u32 instr_cnt = 0, addr_cnt = 0, dummy_cnt = 0;
449
+
unsigned int addr_cnt;
446
450
u32 val = 0;
447
451
448
452
/* Clear the header registers */
449
453
spireg_write(a3700_spi, A3700_SPI_IF_INST_REG, 0);
450
454
spireg_write(a3700_spi, A3700_SPI_IF_ADDR_REG, 0);
451
455
spireg_write(a3700_spi, A3700_SPI_IF_RMODE_REG, 0);
456
+
spireg_write(a3700_spi, A3700_SPI_IF_HDR_CNT_REG, 0);
452
457
453
458
/* Set header counters */
454
459
if (a3700_spi->tx_buf) {
455
-
if (a3700_spi->buf_len <= a3700_spi->instr_cnt) {
456
-
instr_cnt = a3700_spi->buf_len;
457
-
} else if (a3700_spi->buf_len <= (a3700_spi->instr_cnt +
458
-
a3700_spi->addr_cnt)) {
459
-
instr_cnt = a3700_spi->instr_cnt;
460
-
addr_cnt = a3700_spi->buf_len - instr_cnt;
461
-
} else if (a3700_spi->buf_len <= a3700_spi->hdr_cnt) {
462
-
instr_cnt = a3700_spi->instr_cnt;
463
-
addr_cnt = a3700_spi->addr_cnt;
464
-
/* Need to handle the normal write case with 1 byte
465
-
* data
466
-
*/
467
-
if (!a3700_spi->tx_buf[instr_cnt + addr_cnt])
468
-
dummy_cnt = a3700_spi->buf_len - instr_cnt -
469
-
addr_cnt;
460
+
/*
461
+
* when tx data is not 4 bytes aligned, there will be unexpected
462
+
* bytes out of SPI output register, since it always shifts out
463
+
* as whole 4 bytes. This might cause incorrect transaction with
464
+
* some devices. To avoid that, use SPI header count feature to
465
+
* transfer up to 3 bytes of data first, and then make the rest
466
+
* of data 4-byte aligned.
467
+
*/
468
+
addr_cnt = a3700_spi->buf_len % 4;
469
+
if (addr_cnt) {
470
+
val = (addr_cnt & A3700_SPI_ADDR_CNT_MASK)
471
+
<< A3700_SPI_ADDR_CNT_BIT;
472
+
spireg_write(a3700_spi, A3700_SPI_IF_HDR_CNT_REG, val);
473
+
474
+
/* Update the buffer length to be transferred */
475
+
a3700_spi->buf_len -= addr_cnt;
476
+
477
+
/* transfer 1~3 bytes through address count */
478
+
val = 0;
479
+
while (addr_cnt--) {
480
+
val = (val << 8) | a3700_spi->tx_buf[0];
481
+
a3700_spi->tx_buf++;
482
+
}
483
+
spireg_write(a3700_spi, A3700_SPI_IF_ADDR_REG, val);
470
484
}
471
-
val |= ((instr_cnt & A3700_SPI_INSTR_CNT_MASK)
472
-
<< A3700_SPI_INSTR_CNT_BIT);
473
-
val |= ((addr_cnt & A3700_SPI_ADDR_CNT_MASK)
474
-
<< A3700_SPI_ADDR_CNT_BIT);
475
-
val |= ((dummy_cnt & A3700_SPI_DUMMY_CNT_MASK)
476
-
<< A3700_SPI_DUMMY_CNT_BIT);
477
485
}
478
-
spireg_write(a3700_spi, A3700_SPI_IF_HDR_CNT_REG, val);
479
-
480
-
/* Update the buffer length to be transferred */
481
-
a3700_spi->buf_len -= (instr_cnt + addr_cnt + dummy_cnt);
482
-
483
-
/* Set Instruction */
484
-
val = 0;
485
-
while (instr_cnt--) {
486
-
val = (val << 8) | a3700_spi->tx_buf[0];
487
-
a3700_spi->tx_buf++;
488
-
}
489
-
spireg_write(a3700_spi, A3700_SPI_IF_INST_REG, val);
490
-
491
-
/* Set Address */
492
-
val = 0;
493
-
while (addr_cnt--) {
494
-
val = (val << 8) | a3700_spi->tx_buf[0];
495
-
a3700_spi->tx_buf++;
496
-
}
497
-
spireg_write(a3700_spi, A3700_SPI_IF_ADDR_REG, val);
498
486
}
499
487
500
488
static int a3700_is_wfifo_full(struct a3700_spi *a3700_spi)
···
492
512
static int a3700_spi_fifo_write(struct a3700_spi *a3700_spi)
493
513
{
494
514
u32 val;
495
-
int i = 0;
496
515
497
516
while (!a3700_is_wfifo_full(a3700_spi) && a3700_spi->buf_len) {
498
-
val = 0;
499
-
if (a3700_spi->buf_len >= 4) {
500
-
val = cpu_to_le32(*(u32 *)a3700_spi->tx_buf);
501
-
spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, val);
502
-
503
-
a3700_spi->buf_len -= 4;
504
-
a3700_spi->tx_buf += 4;
505
-
} else {
506
-
/*
507
-
* If the remained buffer length is less than 4-bytes,
508
-
* we should pad the write buffer with all ones. So that
509
-
* it avoids overwrite the unexpected bytes following
510
-
* the last one.
511
-
*/
512
-
val = GENMASK(31, 0);
513
-
while (a3700_spi->buf_len) {
514
-
val &= ~(0xff << (8 * i));
515
-
val |= *a3700_spi->tx_buf++ << (8 * i);
516
-
i++;
517
-
a3700_spi->buf_len--;
518
-
519
-
spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG,
520
-
val);
521
-
}
522
-
break;
523
-
}
517
+
val = cpu_to_le32(*(u32 *)a3700_spi->tx_buf);
518
+
spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, val);
519
+
a3700_spi->buf_len -= 4;
520
+
a3700_spi->tx_buf += 4;
524
521
}
525
522
526
523
return 0;
···
602
645
a3700_spi->rx_buf = xfer->rx_buf;
603
646
a3700_spi->buf_len = xfer->len;
604
647
605
-
/* SPI transfer headers */
606
-
a3700_spi_header_set(a3700_spi);
607
-
608
648
if (xfer->tx_buf)
609
649
nbits = xfer->tx_nbits;
610
650
else if (xfer->rx_buf)
611
651
nbits = xfer->rx_nbits;
612
652
613
-
a3700_spi_pin_mode_set(a3700_spi, nbits);
653
+
a3700_spi_pin_mode_set(a3700_spi, nbits, xfer->rx_buf ? true : false);
654
+
655
+
/* Flush the FIFOs */
656
+
a3700_spi_fifo_flush(a3700_spi);
657
+
658
+
/* Transfer first bytes of data when buffer is not 4-byte aligned */
659
+
a3700_spi_header_set(a3700_spi);
614
660
615
661
if (xfer->rx_buf) {
616
662
/* Set read data length */
···
693
733
dev_err(&spi->dev, "wait wfifo empty timed out\n");
694
734
return -ETIMEDOUT;
695
735
}
696
-
} else {
697
-
/*
698
-
* If the instruction in SPI_INSTR does not require data
699
-
* to be written to the SPI device, wait until SPI_RDY
700
-
* is 1 for the SPI interface to be in idle.
701
-
*/
702
-
if (!a3700_spi_transfer_wait(spi, A3700_SPI_XFER_RDY)) {
703
-
dev_err(&spi->dev, "wait xfer ready timed out\n");
704
-
return -ETIMEDOUT;
705
-
}
736
+
}
737
+
738
+
if (!a3700_spi_transfer_wait(spi, A3700_SPI_XFER_RDY)) {
739
+
dev_err(&spi->dev, "wait xfer ready timed out\n");
740
+
return -ETIMEDOUT;
706
741
}
707
742
708
743
val = spireg_read(a3700_spi, A3700_SPI_IF_CFG_REG);
···
789
834
memset(spi, 0, sizeof(struct a3700_spi));
790
835
791
836
spi->master = master;
792
-
spi->instr_cnt = A3700_INSTR_CNT;
793
-
spi->addr_cnt = A3700_ADDR_CNT;
794
-
spi->hdr_cnt = A3700_INSTR_CNT + A3700_ADDR_CNT +
795
-
A3700_DUMMY_CNT;
796
837
797
838
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
798
839
spi->base = devm_ioremap_resource(dev, res);
+5
-4
drivers/spi/spi-bcm-qspi.c
+5
-4
drivers/spi/spi-bcm-qspi.c
···
1250
1250
goto qspi_probe_err;
1251
1251
}
1252
1252
} else {
1253
-
goto qspi_probe_err;
1253
+
goto qspi_resource_err;
1254
1254
}
1255
1255
1256
1256
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
···
1272
1272
qspi->base[CHIP_SELECT] = devm_ioremap_resource(dev, res);
1273
1273
if (IS_ERR(qspi->base[CHIP_SELECT])) {
1274
1274
ret = PTR_ERR(qspi->base[CHIP_SELECT]);
1275
-
goto qspi_probe_err;
1275
+
goto qspi_resource_err;
1276
1276
}
1277
1277
}
1278
1278
···
1280
1280
GFP_KERNEL);
1281
1281
if (!qspi->dev_ids) {
1282
1282
ret = -ENOMEM;
1283
-
goto qspi_probe_err;
1283
+
goto qspi_resource_err;
1284
1284
}
1285
1285
1286
1286
for (val = 0; val < num_irqs; val++) {
···
1369
1369
bcm_qspi_hw_uninit(qspi);
1370
1370
clk_disable_unprepare(qspi->clk);
1371
1371
qspi_probe_err:
1372
-
spi_master_put(master);
1373
1372
kfree(qspi->dev_ids);
1373
+
qspi_resource_err:
1374
+
spi_master_put(master);
1374
1375
return ret;
1375
1376
}
1376
1377
/* probe function to be called by SoC specific platform driver probe */
+2
-2
drivers/spi/spi-stm32.c
+2
-2
drivers/spi/spi-stm32.c
···
263
263
* no need to check it there.
264
264
* However, we need to ensure the following calculations.
265
265
*/
266
-
if ((div < SPI_MBR_DIV_MIN) &&
267
-
(div > SPI_MBR_DIV_MAX))
266
+
if (div < SPI_MBR_DIV_MIN ||
267
+
div > SPI_MBR_DIV_MAX)
268
268
return -EINVAL;
269
269
270
270
/* Determine the first power of 2 greater than or equal to div */
+9
-4
drivers/spi/spi.c
+9
-4
drivers/spi/spi.c
···
45
45
46
46
#define CREATE_TRACE_POINTS
47
47
#include <trace/events/spi.h>
48
-
#define SPI_DYN_FIRST_BUS_NUM 0
49
48
50
49
static DEFINE_IDR(spi_master_idr);
51
50
···
2085
2086
struct device *dev = ctlr->dev.parent;
2086
2087
struct boardinfo *bi;
2087
2088
int status = -ENODEV;
2088
-
int id;
2089
+
int id, first_dynamic;
2089
2090
2090
2091
if (!dev)
2091
2092
return -ENODEV;
···
2115
2116
}
2116
2117
}
2117
2118
if (ctlr->bus_num < 0) {
2119
+
first_dynamic = of_alias_get_highest_id("spi");
2120
+
if (first_dynamic < 0)
2121
+
first_dynamic = 0;
2122
+
else
2123
+
first_dynamic++;
2124
+
2118
2125
mutex_lock(&board_lock);
2119
-
id = idr_alloc(&spi_master_idr, ctlr, SPI_DYN_FIRST_BUS_NUM, 0,
2120
-
GFP_KERNEL);
2126
+
id = idr_alloc(&spi_master_idr, ctlr, first_dynamic,
2127
+
0, GFP_KERNEL);
2121
2128
mutex_unlock(&board_lock);
2122
2129
if (WARN(id < 0, "couldn't get idr"))
2123
2130
return id;