From aaacf4bb51b243875b203e6ff73b5047636b4efa Mon Sep 17 00:00:00 2001 From: Wolfgang Ocker Date: Mon, 1 Dec 2008 13:13:52 -0800 Subject: spi: avoid spidev crash when device is removed I saw a kernel oops in spidev_remove() when a spidev device was registered and I unloaded the SPI master driver: Unable to handle kernel paging request for data at address 0x00000004 Faulting instruction address: 0xc01c0c50 Oops: Kernel access of bad area, sig: 11 [#1] CDSPR Modules linked in: spi_ppc4xx(-) NIP: c01c0c50 LR: c01bf9e4 CTR: c01c0c34 REGS: cec89c30 TRAP: 0300 Not tainted (2.6.27.3izt) MSR: 00021000 CR: 24000228 XER: 20000007 DEAR: 00000004, ESR: 00800000 TASK = cf889040[2070] 'rmmod' THREAD: cec88000 GPR00: 00000000 cec89ce0 cf889040 cec8e000 00000004 cec8e000 ffffffff 00000000 GPR08: 0000001c c0336380 00000000 c01c0c34 00000001 1001a338 100e0000 100df49c GPR16: 100b54c0 100df49c 100ddd20 100f05a8 100b5340 100efd68 00000000 00000000 GPR24: 100ec008 100f0428 c0327788 c0327794 cec8e0ac cec8e000 c0336380 00000000 NIP [c01c0c50] spidev_remove+0x1c/0xe4 LR [c01bf9e4] spi_drv_remove+0x2c/0x3c Call Trace: [cec89d00] [c01bf9e4] spi_drv_remove+0x2c/0x3c [cec89d10] [c01859a0] __device_release_driver+0x78/0xb4 [cec89d20] [c0185ab0] device_release_driver+0x28/0x44 [cec89d40] [c0184be8] bus_remove_device+0xac/0xd8 [cec89d60] [c0183094] device_del+0x100/0x194 [cec89d80] [c0183140] device_unregister+0x18/0x30 [cec89da0] [c01bf30c] __unregister+0x20/0x34 [cec89db0] [c0182778] device_for_each_child+0x38/0x74 [cec89de0] [c01bf2d0] spi_unregister_master+0x28/0x44 [cec89e00] [c01bfeac] spi_bitbang_stop+0x1c/0x58 [cec89e20] [d908a5e0] spi_ppc4xx_of_remove+0x24/0x7c [spi_ppc4xx] [...] IMHO a call to spi_set_drvdata() is missing in spidev_probe(). The patch below helped. Signed-off-by: Wolfgang Ocker Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spidev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/spi') diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c index 89a43755a453..5d869c4d3eb2 100644 --- a/drivers/spi/spidev.c +++ b/drivers/spi/spidev.c @@ -597,7 +597,9 @@ static int spidev_probe(struct spi_device *spi) } mutex_unlock(&device_list_lock); - if (status != 0) + if (status == 0) + spi_set_drvdata(spi, spidev); + else kfree(spidev); return status; -- cgit v1.2.3 From b7d271df873c5121a4ca1c70dea126b5920ec2f1 Mon Sep 17 00:00:00 2001 From: Stefano Babic Date: Mon, 1 Dec 2008 13:13:53 -0800 Subject: spi: mpc52xx_psc_spi chipselect bugfix According to the manual the "tdfOnExit" flag must be set on the last byte we want to send. The PSC controller holds SS low until the flag is set. However, the flag was set always on the last byte of the FIFO, independently if it is the last byte of the transfer. This generates spurious toggling of the SS signals that breaks the protocol of some peripherals. Fix. Signed-off-by: Stefano Babic Acked-by: Grant Likely Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/mpc52xx_psc_spi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/spi') diff --git a/drivers/spi/mpc52xx_psc_spi.c b/drivers/spi/mpc52xx_psc_spi.c index 0debe11b67b4..3b97803e1d11 100644 --- a/drivers/spi/mpc52xx_psc_spi.c +++ b/drivers/spi/mpc52xx_psc_spi.c @@ -142,6 +142,7 @@ static int mpc52xx_psc_spi_transfer_rxtx(struct spi_device *spi, unsigned rfalarm; unsigned send_at_once = MPC52xx_PSC_BUFSIZE; unsigned recv_at_once; + int last_block = 0; if (!t->tx_buf && !t->rx_buf && t->len) return -EINVAL; @@ -151,15 +152,17 @@ static int mpc52xx_psc_spi_transfer_rxtx(struct spi_device *spi, while (rb < t->len) { if (t->len - rb > MPC52xx_PSC_BUFSIZE) { rfalarm = MPC52xx_PSC_RFALARM; + last_block = 0; } else { send_at_once = t->len - sb; rfalarm = MPC52xx_PSC_BUFSIZE - (t->len - rb); + last_block = 1; } dev_dbg(&spi->dev, "send %d bytes...\n", send_at_once); for (; send_at_once; sb++, send_at_once--) { /* set EOF flag before the last word is sent */ - if (send_at_once == 1) + if (send_at_once == 1 && last_block) out_8(&psc->ircr2, 0x01); if (tx_buf) -- cgit v1.2.3 From 6a010b56e9bd2fdb32efd153e1a08305949b6b53 Mon Sep 17 00:00:00 2001 From: Julien Boibessot Date: Mon, 1 Dec 2008 13:13:55 -0800 Subject: spi: fix spi_imx probe oopsing Corrects spi_imx driver oops during initialization/probing: can't use drv_data before it's allocated. Signed-off-by: Julien Boibessot Acked-by: Sascha Hauer Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spi_imx.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) (limited to 'drivers/spi') diff --git a/drivers/spi/spi_imx.c b/drivers/spi/spi_imx.c index 0b4db0ce78d6..269a55ec52ef 100644 --- a/drivers/spi/spi_imx.c +++ b/drivers/spi/spi_imx.c @@ -1456,7 +1456,7 @@ static int __init spi_imx_probe(struct platform_device *pdev) struct device *dev = &pdev->dev; struct spi_imx_master *platform_info; struct spi_master *master; - struct driver_data *drv_data = NULL; + struct driver_data *drv_data; struct resource *res; int irq, status = 0; @@ -1467,14 +1467,6 @@ static int __init spi_imx_probe(struct platform_device *pdev) goto err_no_pdata; } - drv_data->clk = clk_get(&pdev->dev, "perclk2"); - if (IS_ERR(drv_data->clk)) { - dev_err(&pdev->dev, "probe - cannot get get\n"); - status = PTR_ERR(drv_data->clk); - goto err_no_clk; - } - clk_enable(drv_data->clk); - /* Allocate master with space for drv_data */ master = spi_alloc_master(dev, sizeof(struct driver_data)); if (!master) { @@ -1495,6 +1487,14 @@ static int __init spi_imx_probe(struct platform_device *pdev) drv_data->dummy_dma_buf = SPI_DUMMY_u32; + drv_data->clk = clk_get(&pdev->dev, "perclk2"); + if (IS_ERR(drv_data->clk)) { + dev_err(&pdev->dev, "probe - cannot get clock\n"); + status = PTR_ERR(drv_data->clk); + goto err_no_clk; + } + clk_enable(drv_data->clk); + /* Find and map resources */ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!res) { @@ -1630,12 +1630,13 @@ err_no_iomap: kfree(drv_data->ioarea); err_no_iores: - spi_master_put(master); - -err_no_pdata: clk_disable(drv_data->clk); clk_put(drv_data->clk); + err_no_clk: + spi_master_put(master); + +err_no_pdata: err_no_mem: return status; } -- cgit v1.2.3 From 4e253d23003b54c88d0919d6088be74f00eec3c7 Mon Sep 17 00:00:00 2001 From: Jan Nikitenko Date: Mon, 1 Dec 2008 13:13:56 -0800 Subject: spi: au1550_spi full duplex dma fix Fix unsafe order in dma mapping operation: always flush data from the cache *BEFORE* invalidating it, to allow full duplex transfers where the same buffer may be used for both writes and reads. Tested with mmc-spi. Signed-off-by: Jan Nikitenko Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/au1550_spi.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) (limited to 'drivers/spi') diff --git a/drivers/spi/au1550_spi.c b/drivers/spi/au1550_spi.c index 87b73e0169c5..b02f25c702fd 100644 --- a/drivers/spi/au1550_spi.c +++ b/drivers/spi/au1550_spi.c @@ -369,10 +369,23 @@ static int au1550_spi_dma_txrxb(struct spi_device *spi, struct spi_transfer *t) dma_rx_addr = t->rx_dma; /* - * check if buffers are already dma mapped, map them otherwise + * check if buffers are already dma mapped, map them otherwise: + * - first map the TX buffer, so cache data gets written to memory + * - then map the RX buffer, so that cache entries (with + * soon-to-be-stale data) get removed * use rx buffer in place of tx if tx buffer was not provided * use temp rx buffer (preallocated or realloc to fit) for rx dma */ + if (t->tx_buf) { + if (t->tx_dma == 0) { /* if DMA_ADDR_INVALID, map it */ + dma_tx_addr = dma_map_single(hw->dev, + (void *)t->tx_buf, + t->len, DMA_TO_DEVICE); + if (dma_mapping_error(hw->dev, dma_tx_addr)) + dev_err(hw->dev, "tx dma map error\n"); + } + } + if (t->rx_buf) { if (t->rx_dma == 0) { /* if DMA_ADDR_INVALID, map it */ dma_rx_addr = dma_map_single(hw->dev, @@ -396,15 +409,8 @@ static int au1550_spi_dma_txrxb(struct spi_device *spi, struct spi_transfer *t) dma_sync_single_for_device(hw->dev, dma_rx_addr, t->len, DMA_FROM_DEVICE); } - if (t->tx_buf) { - if (t->tx_dma == 0) { /* if DMA_ADDR_INVALID, map it */ - dma_tx_addr = dma_map_single(hw->dev, - (void *)t->tx_buf, - t->len, DMA_TO_DEVICE); - if (dma_mapping_error(hw->dev, dma_tx_addr)) - dev_err(hw->dev, "tx dma map error\n"); - } - } else { + + if (!t->tx_buf) { dma_sync_single_for_device(hw->dev, dma_rx_addr, t->len, DMA_BIDIRECTIONAL); hw->tx = hw->rx; -- cgit v1.2.3 From e39ea8a2def1fcb203ed0183317124348962e351 Mon Sep 17 00:00:00 2001 From: Ben Dooks Date: Mon, 1 Dec 2008 13:13:56 -0800 Subject: spi: fix spi_s3c24xx_gpio device handle lookup The spidev_to_sg() call in spi_s3c24xx_gpio.c was using the wrong method to convert the spi device into the private data for the driver. Fix this by using spi_master_get_devdata. Signed-off-by: Ben Dooks Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/spi/spi_s3c24xx_gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/spi') diff --git a/drivers/spi/spi_s3c24xx_gpio.c b/drivers/spi/spi_s3c24xx_gpio.c index cc1f647f579b..8bb2b4ee3e50 100644 --- a/drivers/spi/spi_s3c24xx_gpio.c +++ b/drivers/spi/spi_s3c24xx_gpio.c @@ -34,7 +34,7 @@ struct s3c2410_spigpio { static inline struct s3c2410_spigpio *spidev_to_sg(struct spi_device *spi) { - return spi->controller_data; + return spi_master_get_devdata(spi->master); } static inline void setsck(struct spi_device *dev, int on) -- cgit v1.2.3 From b93c35ff39d19f20c47c06c206986afefecc777a Mon Sep 17 00:00:00 2001 From: Ben Dooks Date: Mon, 1 Dec 2008 13:13:57 -0800 Subject: spi: fix spi_s3c24xx_gpio num_chipselect The spi master driver must have num_chipselect set to allow the bus to initialise. Pass this through the platform data. Signed-off-by: Ben Dooks Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- arch/arm/mach-s3c2410/include/mach/spi-gpio.h | 1 + drivers/spi/spi_s3c24xx_gpio.c | 1 + 2 files changed, 2 insertions(+) (limited to 'drivers/spi') diff --git a/arch/arm/mach-s3c2410/include/mach/spi-gpio.h b/arch/arm/mach-s3c2410/include/mach/spi-gpio.h index 3fe8be9ca110..980a099e209c 100644 --- a/arch/arm/mach-s3c2410/include/mach/spi-gpio.h +++ b/arch/arm/mach-s3c2410/include/mach/spi-gpio.h @@ -18,6 +18,7 @@ struct s3c2410_spigpio_info { unsigned long pin_mosi; unsigned long pin_miso; + int num_chipselect; int bus_num; void (*chip_select)(struct s3c2410_spigpio_info *spi, int cs); diff --git a/drivers/spi/spi_s3c24xx_gpio.c b/drivers/spi/spi_s3c24xx_gpio.c index 8bb2b4ee3e50..f2447a5476bb 100644 --- a/drivers/spi/spi_s3c24xx_gpio.c +++ b/drivers/spi/spi_s3c24xx_gpio.c @@ -118,6 +118,7 @@ static int s3c2410_spigpio_probe(struct platform_device *dev) /* setup spi bitbang adaptor */ sp->bitbang.master = spi_master_get(master); sp->bitbang.master->bus_num = info->bus_num; + sp->bitbang.master->num_chipselect = info->num_chipselect; sp->bitbang.chipselect = s3c2410_spigpio_chipselect; sp->bitbang.txrx_word[SPI_MODE_0] = s3c2410_spigpio_txrx_mode0; -- cgit v1.2.3