The case where spi_master sets the flags SPI_MASTER_MUST_RX/TX while
CONFIG_HAS_DMA is unset (which is unlikley) together with a driver
that reuses spi_messages with rx/tx_buff set to NULL, can result in:
* data disclosure over the SPI (for tx_buf == NULL)
* memory corruption (for rx_buf == NULL)

This happenes when dummy_rx/dummy_tx are changing address due to krealloc
or free and an allocation of the memory by a different part of the kernel.
Signed-off-by: NMartin Sperl <kernel@martin.sperl.org>
Signed-off-by: NMark Brown <broonie@kernel.org>

Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).

This results in the following messages:
  BUG: Bad page state in process
  page:db7ba030 count:0 mapcount:0 mapping:  (null) index:0x0
  flags: 0x200(arch_1)
  page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
  ...
Reported-by: NNoralf Trønnes <noralf@tronnes.org>
Suggested-by: NNoralf Trønnes <noralf@tronnes.org>
Tested-by: NNoralf Trønnes <noralf@tronnes.org>
Signed-off-by: NMartin Sperl <kernel@martin.sperl.org>
Signed-off-by: NMark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org

Some spi device drivers use the same tx_buf and rx_buf repeatly for better
performance such as driver/input/touchsreen/ads7846.c, but spi core grab tx_buf
/rx_buf of transfer and set them as dummy_tx/dummy_rx once they are NULL. Thus,
in the second time the tx_buf/rx_buf will be replaced by dummy_tx/dummy_rx and
the data which produced by the last tx or rx may be wrongly sent to the device
or handled by the upper level protocol. This patch just keep the orignal value
of tx_buf/rx_buf if they are NULL after this transfer processed.
Signed-off-by: NRobin Gong <b38343@freescale.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

If a driver doesn't implement the master->handle_err() callback and an
SPI transfer fails, the kernel will crash with a NULL pointer
dereference:

    Unable to handle kernel NULL pointer dereference at virtual address 00000000
    pgd = c0003000
    [00000000] *pgd=80000040004003, *pmd=00000000
    Internal error: Oops: 80000206 [#1] SMP ARM
    Modules linked in:
    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.0.0-rc7-koelsch-05861-g1fc9fdd4add4f783 #1046
    Hardware name: Generic R8A7791 (Flattened Device Tree)
    task: eec359c0 ti: eec54000 task.ti: eec54000
    PC is at 0x0
    LR is at spi_transfer_one_message+0x1cc/0x1f0

Make the master->handle_err() callback optional to avoid the crash.

Also fix a spelling mistake in the callback documentation while we're at
it.

Fixes: b716c4ff ("spi: introduce master->handle_err() callback")
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NMark Brown <broonie@kernel.org>

Trying to register an SPI device asynchronously (via async_schedule() call)
results in an ugly complaint from request_module() warning about potential
deadlock (because request_module tries to wait for async works to
complete, the caller is also an async work in this case).

While we could try to switch to using request_module_nowait(), other buses,
as well as SPI itself when not using device tree, do not try to load
modules explicitly, but rather rely on the standard infrastructure (such as
udev) to execute module loading. There is no reason why SPI OF-described
devices should be treated differently.
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

With spidev the mesg->complete callback points to spidev_complete.
Calling this unblocks spidev_sync and so spidev_sync_write finishes. As
the struct spi_message just read is a local variable in
spidev_sync_write and recording the trace event accesses this message
the recording is better done first. The same can happen for
spidev_sync_read.

This fixes an oops observed on a 3.14-rt system with spidev activity
after

	echo 1 > /sys/kernel/debug/tracing/events/spi/enable

.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NMark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org

Some devices samples state of the chip select signal during power up
and act differently based on this state, so SPI core should ensure
that CS line is driven in non-active state after spi_setup().
Signed-off-by: NIvan T. Ivanov <iivanov@mm-sol.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

All SPI drivers have been converted from legacy suspend/resume callbacks to
dev_pm_ops. So we can finally remove support for legacy PM from the SPI
core.

Since there aren't any special bus specific things to do during
suspend/resume and since the PM core will automatically fallback directly to
using the device's PM ops if no bus PM ops are specified there is no need to
have any special SPI bus PM ops.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NMark Brown <broonie@kernel.org>

This callback would be useful to handle an error that occurs in the generic
implementation of transfer_one_message(). The good candidate for this is to
drain FIFO and / or to terminate DMA transfers when timeout happened.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

return type of wait_for_completion_timeout is unsigned long not int, this
patch changes the type of m from int to unsigned long.
Signed-off-by: NNicholas Mc Guire <der.herr@hofr.at>
Signed-off-by: NMark Brown <broonie@kernel.org>

Signed-off-by: NJarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

In order to avoid the situation where the kthread is waiting for another
context to make the hardware idle let the message pump know if it's being
called from the worker thread context and if it isn't then defer to the
worker thread instead of idling the hardware immediately. This will ensure
that if this situation happens we block rather than busy waiting.
Signed-off-by: NMark Brown <broonie@kernel.org>

If we are using the standard SPI message pump (which all drivers should be
transitioning over to) then special case the message enqueue and instead of
starting the worker thread to push messages to the hardware do so in the
context of the caller if the controller is idle. This avoids a context
switch in the common case where the controller has a single user in a
single thread, for short PIO transfers there may be no need to context
switch away from the calling context to complete the transfer.

The code is a bit more complex than is desirable in part due to the need
to handle drivers not using the standard queue and in part due to handling
the various combinations of bus locking and asynchronous submission in
interrupt context.

It is still suboptimal since it will still wake the message pump for each
transfer in order to schedule idling of the hardware and if multiple
contexts are using the controller simultaneously a caller may end up
pumping a message for some random other thread rather than for itself,
and if the thread ends up deferring due to another context idling the
hardware then it will just busy wait.  It can, however, have the benefit
of aggregating power up and down of the hardware when a caller performs
a series of transfers back to back without any need for the use of
spi_async().
Signed-off-by: NMark Brown <broonie@kernel.org>

cur_msg is updated under the queue lock and holds the message we are
currently processing. Since currently we only ever do removals in the
pump kthread it doesn't matter in what order we do things but we want
to be able to push things out from the submitting thread so pull the
check to see if we're currently handling a message before we check to
see if the queue is idle.
Signed-off-by: NMark Brown <broonie@kernel.org>

Since most devices now do use the standard queue and in order to avoid
initialisation ordering issues being introduced by further refactorings
to improve performance move the initialisation of the queue and the lock
for it to the main master allocation.
Signed-off-by: NMark Brown <broonie@kernel.org>

kthread_run() could return ERR_PTR(-EINTR) from kthread_create_on_node().
Return the actual error code in spi_init_queue() instead of mangling it to
-ENOMEM.
Signed-off-by: NJarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

Since commit ce79d54a ("spi/of: Add OF notifier handler") the
following warning is seen on a imx53 system that has CONFIG_OF_DYNAMIC=n:

[    0.048119] ------------[ cut here ]------------
[    0.048146] WARNING: CPU: 0 PID: 1 at drivers/spi/spi.c:2419 spi_init+0x60/0xa8()
[    0.048158] Modules linked in:
[    0.048183] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc6-next-20141126-00003-g9388e85 #2080
[    0.048193] Hardware name: Freescale i.MX53 (Device Tree Support)
[    0.048203] Backtrace:
[    0.048235] [<80011f74>] (dump_backtrace) from [<80012110>] (show_stack+0x18/0x1c)
[    0.048246]  r6:00000973 r5:00000000 r4:00000000 r3:00000000
[    0.048284] [<800120f8>] (show_stack) from [<806b3ad8>] (dump_stack+0x88/0xa4)
[    0.048312] [<806b3a50>] (dump_stack) from [<8002a55c>] (warn_slowpath_common+0x80/0xbc)
[    0.048320]  r5:8096cfcc r4:00000000
[    0.048343] [<8002a4dc>] (warn_slowpath_common) from [<8002a5bc>] (warn_slowpath_null+0x24/0x2c)
[    0.048354]  r8:8096cf6c r7:809355ec r6:ddcd7c00 r5:812029e4 r4:00000000
[    0.048389] [<8002a598>] (warn_slowpath_null) from [<8096cfcc>] (spi_init+0x60/0xa8)
[    0.048405] [<8096cf6c>] (spi_init) from [<80008a7c>] (do_one_initcall+0x88/0x1e0)
[    0.048415]  r5:8099e018 r4:8099e018
[    0.048438] [<800089f4>] (do_one_initcall) from [<80935e38>] (kernel_init_freeable+0x110/0x1e0)
[    0.048448]  r10:80980700 r9:809806e4 r8:000000cc r7:809355ec r6:809f8940 r5:00000002
[    0.048478]  r4:8098d744
[    0.048508] [<80935d28>] (kernel_init_freeable) from [<806ae574>] (kernel_init+0x10/0xf4)
[    0.048517]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:806ae564
[    0.048547]  r4:00000000
[    0.048565] [<806ae564>] (kernel_init) from [<8000ed68>] (ret_from_fork+0x14/0x2c)
[    0.048574]  r4:00000000 r3:00000000
[    0.048616] ---[ end trace 405a65d177dae4fd ]---

Only check of_reconfig_notifier_register() in the CONFIG_OF_DYNAMIC=y case,
as intended by commit ce79d54a.
Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: NGrant Likely <grant.likely@linaro.org>

Add OF notifier handler needed for creating/destroying spi devices
according to dynamic runtime changes in the DT live tree. This code is
enabled when CONFIG_OF_DYNAMIC is selected.
Signed-off-by: NPantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: NGrant Likely <grant.likely@linaro.org>
Reviewed-by: NMark Brown <broonie@kernel.org>
Cc: <linux-spi@vger.kernel.org>

Dynamically inserting spi device nodes requires the use of a single
device registration method. Refactor the existing
of_register_spi_devices() to split out the core functionality for a
single device into a separate function; of_register_spi_device(). This
function will be used by the OF_DYNAMIC overlay code to make live
modifications to the tree.

Methods to lookup a device/master using a device node are added
as well, of_find_spi_master_by_node() & of_find_spi_device_by_node().
Signed-off-by: NPantelis Antoniou <pantelis.antoniou@konsulko.com>
[grant.likely] Split patch into two pieces for clarity
Signed-off-by: NGrant Likely <grant.likely@linaro.org>
Reviewed-by: NMark Brown <broonie@kernel.org>
Cc: <linux-spi@vger.kernel.org>

We can only use page_address on memory that has been mapped using kmap,
when the buffer passed to the SPI has been allocated by vmalloc the page
has not necessarily been mapped through kmap. This means sometimes
page_address will return NULL causing the pointer we pass to sg_set_buf
to be invalid.

As we only call page_address so that we can pass a virtual address to
sg_set_buf which will then immediately call virt_to_page on it, fix this
by calling sg_set_page directly rather then relying on the sg_set_buf
helper.
Signed-off-by: NCharles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: NMark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org

The commit 46420dd7 (PM / Domains: Add APIs to attach/detach a PM
domain for a device) started using errno values in pm.h header file.
It also failed to include the header for these, thus it caused
compiler errors.

Instead of including the errno header to pm.h, let's move the functions
to pm_domain.h, since it's a better match.

Fixes: 46420dd7 (PM / Domains: Add APIs to attach/detach a PM domain for a device)
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Acked-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Acked-by: NWolfram Sang <wsa@the-dreams.de>
Acked-by: NMark Brown <broonie@kernel.org>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

Since we cannot make sure the 'n' will always be none zero here, and
then if either equal to zero, the kzalloc() will return ZERO_SIZE_PTR,
which equals to ((void *)16).

So this patch fix this with just doing the zero check before calling
kzalloc().
Signed-off-by: NXiubo Li <Li.Xiubo@freescale.com>
Signed-off-by: NMark Brown <broonie@kernel.org>

Previously only the ACPI PM domain was supported by the spi bus.

Let's convert to the common attach/detach functions for PM domains,
which currently means we are extending the support to include the
generic PM domain as well.
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Reviewed-by: NKevin Hilman <khilman@linaro.org>
Reviewed-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

Client drivers such as the ChomeOS EC driver sometimes use transfers with
no buffers and only a delay specified in order to allow a delay after the
assertion of /CS. Rather than require controller drivers handle this noop
case gracefully put checks in the core to ensure that we don't call into
the controller for such transfers.
Reported-by: NAddy Ke <addy.ke@rock-chips.com>
Tested-by: NDoug Anderson <dianders@chromium.org>
Reviewed-by: NDoug Anderson <dianders@chromium.org>
Signed-off-by: NMark Brown <broonie@linaro.org>

These are all arguments or fields that got added without updating the
kerneldoc comments.
Signed-off-by: NThierry Reding <treding@nvidia.com>
Signed-off-by: NMark Brown <broonie@linaro.org>

This patch adds helper functions to configure clock parents and rates
as specified through 'assigned-clock-parents', 'assigned-clock-rates'
DT properties for a clock provider or clock consumer device.
The helpers are now being called by the bus code for the platform, I2C
and SPI busses, before the driver probing and also in the clock core
after registration of a clock provider.
Signed-off-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NMike Turquette <mturquette@linaro.org>

According to Documentation/dmaengine.txt, scatterlists must be mapped
using the DMA struct device.

However, "dma_chan.dev->device" is the sysfs class device's device.
Use "dma_chan.device->dev" instead, which is the real DMA device's device.
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NMark Brown <broonie@linaro.org>

According to Documentation/DMA-API.txt, dma_map_sg() returns 0 on failure.
As spi_map_buf() returns an error code, convert zero into -ENOMEM.
Keep the existing check for negative numbers just in case.
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NMark Brown <broonie@linaro.org>

Reported-by: kbuild test robot
Signed-off-by: NMark Brown <broonie@linaro.org>

Let memory subsystem handle the error logging.
Signed-off-by: NSachin Kamat <sachin.kamat@samsung.com>
Reviewed-by: NNaveen Krishna Chatradhi <ch.naveen@samsung.com>
Signed-off-by: NMark Brown <broonie@linaro.org>

Rejecting unsupported values of spi-tx-bus-width and spi-rx-bus-width
may break compatibility with future DTs. Just ignore them, falling back
to Single SPI Transfers.
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NMark Brown <broonie@linaro.org>

If we fail to create the master queue for some reason we should not attempt
to clean it up since attempting to stop a kthread that was not created will
hang and it's just generally bad practice. Unfortunately at present we call
spi_destroy_queue() even in cases where the creation fails.

Fix this by fixing the error handling in spi_master_initialize_queue() so
that we only flag the master as queued or destroy the queue if creation
succeeded. The change to the flag is done since the general master
cleanup uses this to destroy the queue.
Reported-by: NRicardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: NMark Brown <broonie@linaro.org>
Acked-by: NGeert Uytterhoeven <geert@linux-m68k.org>

If NO_DMA=y:

drivers/built-in.o: In function `spi_map_buf':
spi.c:(.text+0x21bc60): undefined reference to `dma_map_sg'
drivers/built-in.o: In function `spi_unmap_buf.isra.33':
spi.c:(.text+0x21c32e): undefined reference to `dma_unmap_sg'
make[3]: *** [vmlinux] Error 1

Protect the DMA code by #ifdef CONFIG_HAS_DMA to fix this:
  - Extract __spi_map_msg() from spi_map_msg(),
  - Provide dummy definitions of __spi_map_msg() and spi_unmap_msg() if
    !CONFIG_HAS_DMA.
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NMark Brown <broonie@linaro.org>

The availability of SPI Dual or Quad Transfer Mode as indicated by the
"spi-tx-bus-width" and "spi-rx-bus-width" properties in the device tree is
a hardware property of the SPI master, SPI slave, and board wiring.  Hence
the SPI core should not reject an SPI slave because an SPI master driver
doesn't (yet) support Dual or Quad Transfer Mode.

Change the lack of Dual or Quad Transfer Mode support in the SPI master
driver from an error condition to a warning condition, and ignore the
unsupported mode bits, falling back to Single Transfer Mode, to avoid
breakages when running old kernels with new device trees.

Fixes: f477b7fb (spi: DUAL and QUAD support)
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NMark Brown <broonie@linaro.org>
Cc: stable@vger.kernel.org

add optional property devicetree for SPI slave nodes
into devicetree so that LSB mode can be enabled by devicetree.
Signed-off-by: NZhao Qiang <B45475@freescale.com>
Signed-off-by: NMark Brown <broonie@linaro.org>

The existing timeout value in wait_for_completion_timeout is
calculated from the transfer length and speed with tolerance of 10msec.
This is too low because this is used for error conditions such as
hardware hang etc.
The xfer->speed_hz considered may not be the actual speed set
because the best clock divisor is chosen from a limited set such that
the actual speed <= requested speed. This will lead to timeout being
less than actual transfer time.
Considering acceptable latencies, this timeout can be set to a
value double the expected transfer plus 100 msecs.
This patch adds the same in the core.
Signed-off-by: NHarini Katakam <harinik@xilinx.com>
Signed-off-by: NMark Brown <broonie@linaro.org>

The core implementation of cs_change didn't follow the documentation
which says that cs_change in the middle of the transfer means to briefly
deassert chip select, instead it followed buggy drivers which change the
polarity of chip select.  Use a delay of 10us between deassert and
reassert simply from pulling numbers out of a hat.
Reported-by: NGerhard Sittig <gsi@denx.de>
Signed-off-by: NMark Brown <broonie@linaro.org>

There is no real reason why we require transfers to have a completion and
the only user of the completion now checks to see if one has been provided
before using it so stop enforcing this. This makes it more convenient for
drivers to chain multiple asynchronous transfers together.
Signed-off-by: NMark Brown <broonie@linaro.org>

When xfer->speed_hz is greater than master->max_speed_hz, it's generally safe
to use master->max_speed_hz as transfer speed.
Thus use master->max_speed_hz as transfer speed rather than return error when
xfer->speed_hz > master->max_speed_hz.
Signed-off-by: NAxel Lin <axel.lin@ingics.com>
Tested-by: NGuenter Roeck <linux@roeck-us.net>
Reviewed-by: NGuenter Roeck <linux@roeck-us.net>
Signed-off-by: NMark Brown <broonie@linaro.org>

Zero length transfer becomes invalid since
"spi: core: Validate length of the transfers in message" commit,
but it should be valid to support an odd device, for example, which
requires long delay between chipselect and the first transfer, etc.
Signed-off-by: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Tested-by: NThierry Reding <treding@nvidia.com>
Signed-off-by: NMark Brown <broonie@linaro.org>