summaryrefslogtreecommitdiff
path: root/drivers/spi
AgeCommit message (Collapse)Author
2015-03-06Merge branch 'topic/err' of ↵Mark Brown
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-dw
2015-03-06spi: dw: program registers as soon as possibleAndy Shevchenko
This patch refactors the code in pump_transfers() to reprogram the registers immediately when we have a new configuration data. The behaviour is slightly modified: - chip is always disabled and reenabled - CTRL0 is always reprogrammed This change allows to do a further refactoring and simplier conversion to use SPI core DMA routines in the future. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi: dw: make sure SPI controller is enabledAndy Shevchenko
The error handling is partially broken since the controller is disabled on error and is not re-enabled until condition occurs, i.e. mode (poll, PIO/DMA), chip (cs_change), or speed (clk_div) is changed. In the result of these changes we will have a predictable state of the SPi controller independently on how successfull was a previous transfer. The patch disables interrupts and re-enables the SPI controller wherever it needs to be done. Thus most of the time the SPI controller is kept enabled. The runtime PM, when it will be implemented, must take care of the controller disabling and re-enabling. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi: pl022: Fix race in giveback() leading to driver lock-upAlexander Sverdlin
Commit fd316941c ("spi/pl022: disable port when unused") introduced a race, which leads to possible driver lock up (easily reproducible on SMP). The problem happens in giveback() function where the completion of the transfer is signalled to SPI subsystem and then the HW SPI controller is disabled. Another transfer might be setup in between, which brings driver in locked-up state. Exact event sequence on SMP: core0 core1 => pump_transfers() /* message->state == STATE_DONE */ => giveback() => spi_finalize_current_message() => pl022_unprepare_transfer_hardware() => pl022_transfer_one_message => flush() => do_interrupt_dma_transfer() => set_up_next_transfer() /* Enable SSP, turn on interrupts */ writew((readw(SSP_CR1(pl022->virtbase)) | SSP_CR1_MASK_SSE), SSP_CR1(pl022->virtbase)); ... => pl022_interrupt_handler() => readwriter() /* disable the SPI/SSP operation */ => writew((readw(SSP_CR1(pl022->virtbase)) & (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase)); Lockup! SPI controller is disabled and the data will never be received. Whole SPI subsystem is waiting for transfer ACK and blocked. So, only signal transfer completion after disabling the controller. Fixes: fd316941c (spi/pl022: disable port when unused) Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-03-06spi: pl022: Remove dead codeAlexander Sverdlin
"flag" variable does nothing, remove it. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi: pl022: Don't touch unspecified bits in interrupt maskAlexander Sverdlin
PL022 Programmers model explicitely states "do not modify undefined register bits". Correct the "all enable" interrupt mask so that it only enables defined ones. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi: pl022: Remove incorrect TxFIFO full reportingAlexander Sverdlin
According to PL022 specification, TNF bit states for "Transmit FIFO Not full". So the logic here is inverted. But "Receive Overrun Interrupt", which is handled here, is only triggered on Rx errors. So instead of fixing the if statement, remove the whole message. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi/rockchip: do an error handling in proper timeAndy Shevchenko
There was handle_err() callback introduced that is dedicated for error handling. The patch moves error handling to this callback. Cc: Heiko Stuebner <heiko@sntech.de> Cc: linux-rockchip@lists.infradead.org Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi: introduce master->handle_err() callbackAndy Shevchenko
This callback would be useful to handle an error that occurs in the generic implementation of transfer_one_message(). The good candidate for this is to drain FIFO and / or to terminate DMA transfers when timeout happened. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-06spi: dw-mid: avoid potential NULL dereferenceAndy Shevchenko
When DMA descriptor allocation fails we should not try to assign any fields in the bad descriptor. The patch adds the necessary checks for that. Fixes: 7063c0d942a1 (spi/dw_spi: add DMA support) Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-03-03spi: img-spfi: Remove udelay in soft resetSifan Naeem
Removing the udelay between setting and clearing the soft reset bit in the spfi control register as it is not required. Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com> Reviewed-by: Andrew Bresticker <abrestic@chromium.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-03spi: img-spfi: Verify max spfi transfer lengthSifan Naeem
Maximum transfer length supported by SPFI is 65535, this is limited by the number of bits available in SPFI TSize register to represent the transfer size. For transfer requests larger than the maximum supported the driver will return an invalid argument error. Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com> Reviewed-by: Andrew Bresticker <abrestic@chromium.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-03-03spi: spi-imx: use correct enumeration typeStefan Agner
The fourth argument of dmaengine_prep_slave_sg needs to be of the enumeration type dma_transfer_direction instead of dma_data_direction. Since the used enumeration values actually stay the same, this is not an actual issue at runtime. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-26spi: atmel: Fix interrupt setup for PDC transfersTorsten Fleischer
Additionally to the current DMA transfer the PDC allows to set up a next DMA transfer. This is useful for larger SPI transfers. The driver currently waits for ENDRX as end of the transfer. But ENDRX is set when the current DMA transfer is done (RCR = 0), i.e. it doesn't include the next DMA transfer. Thus a subsequent SPI transfer could be started although there is currently a transfer in progress. This can cause invalid accesses to the SPI slave devices and to SPI transfer errors. This issue has been observed on a hardware with a M25P128 SPI NOR flash. So instead of ENDRX we should wait for RXBUFF. This flag is set if there is no more DMA transfer in progress (RCR = RNCR = 0). Signed-off-by: Torsten Fleischer <torfl6749@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-02-26spi: dw: revisit FIFO size detection againAndy Shevchenko
The commit d297933cc7fc (spi: dw: Fix detecting FIFO depth) tries to fix the logic of the FIFO detection based on the description on the comments. However, there is a slight difference between numbers in TX Level and TX FIFO size. So, by specification the FIFO size would be in a range 2-256 bytes. From TX Level prospective it means we can set threshold in the range 0-(FIFO size - 1) bytes. Hence there are currently two issues: a) FIFO size 2 bytes is actually skipped since TX Level is 1 bit and could be either 0 or 1 byte; b) FIFO size is incorrectly decreased by 1 which already done by meaning of TX Level register. This patch fixes it eventually right. Fixes: d297933cc7fc (spi: dw: Fix detecting FIFO depth) Reviewed-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-02-24spi: dw: always reprogram CTRL0Andy Shevchenko
Instead of an additional reading from the register let's update it even if the value is kept the same. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-24spi: dw: refactor code that handles clk_divAndy Shevchenko
This patch does the following changes: a) the calculation of clk_div is simplified to oneliner; b) chip->clk_div is updated if clk_div is not zero, therefore the condition is simplified by using chip->clk_div in both cases; c) while here, the redundant parentheses are removed. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-24spi: dw: get TX level without an additional variableAndy Shevchenko
There is no need to have an additional variable to get a TX level. The patch refactors this piece of code. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-24spi: dw: move piece of code out of conditionAndy Shevchenko
There is no sense to keep a member assignment in the internal structure inside the condition which reprograms HW. It makes code readability better if kept outside of the condition. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-24spi: dw-pci: correct number of chip selectsAndy Shevchenko
The commit d58cf5ff6500 brought a second controller to the list of supported devices and changed a number of the chip selects. Besides the previous number was wrong anyway the mentioned patch makes it wrong again meanwhile has a proper numbers in the commit message. Indeed, SPI1 has 5 bits and SPI2 has 2 bits, but it does not mean to have power of two of this bits as a possible number of the chip selects. So, this patch fixes it eventually. Fixes: d58cf5ff6500 (spi: dw-pci: describe Intel MID controllers better) Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-02-24spi: spidev: only use up TX/RX bounce buffer space when neededIan Abbott
This patch changes the way space is reserved in spidev's pre-allocated TX and RX bounce buffers to avoid wasting space in the buffers for an SPI message consisting of multiple, half-duplex transfers in different directions. Background: spidev data structures have separate, pre-allocated TX and RX bounce buffers (`spidev->tx_buffer` and `spidev->rx_buffer`) of fixed size (`bufsiz`). The `SPI_IOC_MESSAGE(N)` ioctl processing uses a kernel copy of the N `struct spi_ioc_transfer` elements copied from the userspace ioctl arg pointer. In these elements: `.len` is the length of transfer in bytes; `.rx_buf` is either a userspace pointer to a buffer to copy the RX data to or is set to 0 to discard the data; and `.tx_buf` is either a userspace pointer to TX data supplied by the user or is set to 0 to transmit zeros for this transfer. `spidev_message()` uses the array of N `struct spi_ioc_transfer` elements to construct a kernel SPI message consisting of a `struct spi_message` containing a linked list (allocated as an array) of N `struct spi_transfer` elements. This involves iterating through the `struct spi_ioc_transfer` and `struct spi_transfer` elements (variables `u_tmp` and `k_tmp` respectively). Before the first iteration, variables `tx_buf` and `rx_buf` point to the start of the TX and RX bounce buffers `spidev->tx_buffer` and `spidev->rx_buffer` and variable `total` is set to 0. These variables keep track of the next available space in the bounce buffers and the total length of the SPI message. Each iteration checks that there is enough room left in the buffers for the transfer. If `u_tmp->rx_buf` is non-zero, `k_tmp->rx_buf` is set to `rx_buf`, otherwise it remains set to NULL. If `u_tmp->tx_buf` is non-zero, `k_tmp->tx_buf` is set to `tx_buf` and the userspace TX data copied there, otherwise it remains set to NULL. The variables `total`, `rx_buf` and `tx_buf` are advanced by the length of the transfer. The "problem": While iterating through the transfers, the local bounce buffer "free space" pointer variables `tx_buf` and `rx_buf` are always advanced by the length of the transfer. If `u_tmp->rx_buf` is 0 (so `k_tmp->rx_buf` is NULL), then `rx_buf` is advanced unnecessarily and that part of `spidev->rx_buffer` is wasted. Similarly, if `u_tmp->tx_buf` is 0 (so `k_tmp->tx_buf` is NULL), part of `spidev->tx_buffer` is wasted. What this patch does: To avoid wasting space unnecessarily in the RX bounce buffer, only advance `rx_buf` by the transfer length if `u_tmp->rx_buf` is non-zero. Similarly, to avoid wasting space unnecessarily in the TX bounce buffer, only advance `tx_buf` if `u_tmp->tx_buf is non-zero. To avoid pointer subtraction, use new variables `rx_total` and `tx_total` to keep track of the amount of space allocated in each of the bounce buffers. If these exceed the available space, a `-EMSGSIZE` error will be returned. Limit the total length of the transfers (tracked by variable `total`) to `INT_MAX` instead of `bufsiz`, returning an `-EMSGSIZE` error if exceeded. The total length is returned by `spidev_message()` on success and we want that to be non-negative. The message size limits for the `SPI_IOC_MESSAGE(N)` ioctl are now as follows: (a) total length of transfers is <= INTMAX; (b) total length of transfers with non-NULL rx_buf is <= bufsiz; (c) total length of transfers with non-NULL tx_buf is <= bufsiz. Some transfers may have NULL rx_buf and NULL tx_buf. If the transfer is completed successfully by the SPI core, `spidev_message()` iterates through the transfers to copy any RX data from the bounce buffer back to userspace on those transfers where `u_tmp->rx_buf` is non-zero. The variable `rx_buf` is again used to keep track of the corresponding positions in the bounce buffer. Now it is only advanced for those transfers that use the RX bounce buffer. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-24spi: s3c64xx: fix compiler warning in spi-s3c64xxAndre Przywara
The Exynos 7 arm64 support now allows the S3C64xx SPI driver to be compiled into an ARM64 kernel, so the cast from the [rt]x_dmach int variable to a void* in this driver now triggers a warning. Add a long cast to silence the compiler. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-23spi: sh-msiof: remove slave_id settings for DMAEngineArnd Bergmann
Current sh-msiof sets dma_slave_config :: slave_id field for DMAEngine, but it is no longer needed. Let's remove it. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-02-23spi: rspi: remove slave_id settings for DMAEngineArnd Bergmann
Current rspi sets dma_slave_config :: slave_id field for DMAEngine, but it is no longer needed. Let's remove it. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
2015-02-21drivers: spi: ti-qspi: wait for busy bit clear before data write/readMugunthan V N
Data corruption is seen while reading/writing large data from/to qspi device because the data register is over written or read before data is ready which is denoted by busy bit in status register. SO adding a busy bit check before writing/reading data to/from qspi device. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-19Merge branch 'kconfig' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild Pull kconfig updates from Michal Marek: "Yann E Morin was supposed to take over kconfig maintainership, but this hasn't happened. So I'm sending a few kconfig patches that I collected: - Fix for missing va_end in kconfig - merge_config.sh displays used if given too few arguments - s/boolean/bool/ in Kconfig files for consistency, with the plan to only support bool in the future" * 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild: kconfig: use va_end to match corresponding va_start merge_config.sh: Display usage if given too few arguments kconfig: use bool instead of boolean for type definition attributes
2015-02-11treewide: Remove unnecessary BCMA_CORETABLE_END macroJoe Perches
Use the normal {} instead of a macro to terminate an array. Remove the macro too. Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-02-11spi: sc18is602: Support multiple devices on a single I2C bus if DT is configuredGuenter Roeck
The driver currently only supports a single device per I2C bus since it uses the I2C bus number to set the SPI bus number. This makes it impossible to connect more than one chip to a single I2C bus. We don't want to use dynamic bus numbers unconditionally since this would result in every instantiation getting a different bus number starting with 65,535 counting down unless devicetree is configured. If devicetree is configured, however, the SPI bus number is obtained from devicetree data. So we can use dynamic SPI bus numbers in this case. Reported-and-Tested-by: Marco Menchise <marco.menchise@gmail.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-11spi: bcm53xx: use msecs_to_jiffies for conversionNicholas Mc Guire
Converting milliseconds to jiffies by "val * HZ / 1000" is technically ok but msecs_to_jiffies(val) is the cleaner solution and handles all corner cases correctly. This is only an API consolidation and should make things more readable Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-08Merge remote-tracking branch 'spi/topic/xilinx' into spi-nextMark Brown
2015-02-08Merge remote-tracking branches 'spi/topic/sirf', 'spi/topic/spidev', ↵Mark Brown
'spi/topic/st-ssc' and 'spi/topic/ti-qspi' into spi-next
2015-02-08Merge remote-tracking branches 'spi/topic/orion', 'spi/topic/pxa2xx', ↵Mark Brown
'spi/topic/qup', 'spi/topic/rockchip' and 'spi/topic/samsung' into spi-next
2015-02-08Merge remote-tracking branches 'spi/topic/img-spfi', 'spi/topic/imx', ↵Mark Brown
'spi/topic/inline', 'spi/topic/meson' and 'spi/topic/mxs' into spi-next
2015-02-08Merge remote-tracking branches 'spi/topic/falcon', 'spi/topic/fsf', ↵Mark Brown
'spi/topic/fsl', 'spi/topic/fsl-dspi' and 'spi/topic/gpio' into spi-next
2015-02-08Merge remote-tracking branches 'spi/topic/atmel', 'spi/topic/config', ↵Mark Brown
'spi/topic/dln2' and 'spi/topic/dw' into spi-next
2015-02-08Merge remote-tracking branch 'spi/topic/sh-msiof' into spi-nextMark Brown
2015-02-08Merge remote-tracking branch 'spi/topic/core' into spi-nextMark Brown
2015-02-05spi: mxs: cleanup wait_for_completion return handlingNicholas Mc Guire
return type of wait_for_completion_timeout is unsigned long not int, this patch uses the return value of wait_for_completion_timeout in the condition directly rather than adding a additional appropriately typed variable. Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-05spi: ti-qspi: cleanup wait_for_completion return handlingNicholas Mc Guire
return type of wait_for_completion_timeout is unsigned long not int, this patch uses the return value of wait_for_completion_timeout in the condition directly rather than assigning it to an incorrect type variable. Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-04Merge remote-tracking branches 'spi/fix/fsl-dspi' and 'spi/fix/imx' into ↵Mark Brown
spi-linus
2015-02-04spi: spi-imx: cleanup wait_for_completion handlingNicholas Mc Guire
return type of wait_for_completion_timeout is unsigned long not int and always returns >=0 , this patch adds a suitable return variable and simplifies the return value checking as there is no < 0 case. Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-04spi: sh-msiof: cleanup wait_for_completion return handlingNicholas Mc Guire
return type of wait_for_completion_timeout is unsigned long not int, this patch uses the return value of wait_for_completion_timeout in the condition directly rather than assigning it to an incorrect type variable. Signed-off-by: Nicholas Mc Guire <der.herr@hofr.at> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-04spi: match var type to return type of wait_for_completionNicholas Mc Guire
return type of wait_for_completion_timeout is unsigned long not int, this patch changes the type of m from int to unsigned long. Signed-off-by: Nicholas Mc Guire <der.herr@hofr.at> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-04spi: spi-pxa2xx: only include mach/dma.h for legacy DMARob Herring
Move the include of mach/dma.h to the legacy PXA DMA code where it is used. This enables building spi-pxa2xx on ARM64. Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-04spi: atmel: cleanup wait_for_completion return handlingNicholas Mc Guire
return type of wait_for_completion_timeout is unsigned long not int, this patch adds an appropriate variable and fixes up the assignment. It removes the else branch as the only thing it was doing is assigning ret = 0; - but ret is never used thereafter so that is not needed. As the string in dev_err already states "timeout" there is little point in printing the 0. A typo in "trasfer" -> transfer is also fixed. Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-03spi: imx: use pio mode for i.mx6dlRobin Gong
For TKT238285 hardware issue which may cause txfifo store data twice can only be caught on i.mx6dl, we use pio mode instead of DMA mode on i.mx6dl. Fixes: f62caccd12c17e4 (spi: spi-imx: add DMA support) Signed-off-by: Robin Gong <b38343@freescale.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2015-02-02spi: fsl-dspi: Remove possible memory leak of 'chip'Bhuvanchandra DV
Move the check for spi->bits_per_word before allocation, to avoid memory leak. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-02spi: sh-msiof: Update calculation of frequency dividingNobuhiro Iwamatsu
sh-msiof of frequency dividing does not perform the calculation, driver have to manage setting value in the table. It is not possible to set frequency dividing value close to the actual data in this way. This changes from frequency dividing of table management to setting by calculation. This driver is able to set a value close to the actual data. Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-02spi: spidev: Convert buf pointers for 32-bit compat SPI_IOC_MESSAGE(n)Ian Abbott
The SPI_IOC_MESSAGE(n) ioctl commands' argument points to an array of n struct spi_ioc_transfer elements. The spidev's compat_ioctl handler just converts this pointer and passes it on to the unlocked_ioctl handler to process it. The tx_buf and rx_buf members of struct spi_ioc_transfer are of type __u64 and hold pointer values. A 32-bit userspace application running in a 64-bit kernel might not have widened the 32-bit pointers correctly for the kernel. The application might have sign-extended the pointer to when the kernel expects it to be zero-extended, or vice versa, leading to an -EFAULT being returned by spidev_message() if the widened pointer is invalid. Handle the SPI_IOC_MESSAGE(n) ioctl commands specially in the compat_ioctl handler, calling new function spidev_compat_ioctl_message() to handle them. This processes them in the same way as the unlocked_ioctl handler except that it uses compat_ptr() to convert the tx_buf and rx_buf members of each struct spi_ioc_transfer element. To save code, factor out part of the unlocked_ioctl handler into a new function spidev_get_ioc_message(). This checks the ioctl command code is a valid SPI_IOC_MESSAGE(n), determines n and copies the array of n struct spi_ioc_transfer elements from userspace into dynamically allocated memory, returning either a pointer to the memory, an ERR_PTR(-err) value, or NULL (for SPI_IOC_MESSAGE(0)). Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Mark Brown <broonie@kernel.org>
2015-02-02spi/xilinx: Fix access invalid memory on xilinx_spi_txRicardo Ribalda Delgado
On 1 and 2 bytes per word, the transfer of the 3 last bytes will access memory outside tx_ptr. Although this has not trigger any error on real hardware, we should better fix this. Fixes: 24ba5e593f391507 (Remove rx_fn and tx_fn pointer) Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org>