1. 03 Jan, 2020 1 commit
    • wuxu.wu's avatar
      spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls · 19b61392
      wuxu.wu authored
      dw_spi_irq() and dw_spi_transfer_one concurrent calls.
      
      I find a panic in dw_writer(): txw = *(u8 *)(dws->tx), when dw->tx==null,
      dw->len==4, and dw->tx_end==1.
      
      When tpm driver's message overtime dw_spi_irq() and dw_spi_transfer_one
      may concurrent visit dw_spi, so I think dw_spi structure lack of protection.
      
      Otherwise dw_spi_transfer_one set dw rx/tx buffer and then open irq,
      store dw rx/tx instructions and other cores handle irq load dw rx/tx
      instructions may out of order.
      
      	[ 1025.321302] Call trace:
      	...
      	[ 1025.321319]  __crash_kexec+0x98/0x148
      	[ 1025.321323]  panic+0x17c/0x314
      	[ 1025.321329]  die+0x29c/0x2e8
      	[ 1025.321334]  die_kernel_fault+0x68/0x78
      	[ 1025.321337]  __do_kernel_fault+0x90/0xb0
      	[ 1025.321346]  do_page_fault+0x88/0x500
      	[ 1025.321347]  do_translation_fault+0xa8/0xb8
      	[ 1025.321349]  do_mem_abort+0x68/0x118
      	[ 1025.321351]  el1_da+0x20/0x8c
      	[ 1025.321362]  dw_writer+0xc8/0xd0
      	[ 1025.321364]  interrupt_transfer+0x60/0x110
      	[ 1025.321365]  dw_spi_irq+0x48/0x70
      	...
      Signed-off-by: default avatarwuxu.wu <wuxu.wu@huawei.com>
      Link: https://lore.kernel.org/r/1577849981-31489-1-git-send-email-wuxu.wu@huawei.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      19b61392
  2. 31 Dec, 2019 1 commit
    • Vladimir Oltean's avatar
      spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode · ca59d5a5
      Vladimir Oltean authored
      When used in Extended SPI mode on LS1021A, the DSPI controller wants to
      have the least significant 16-bit word written first to the TX FIFO.
      
      In fact, the LS1021A reference manual says:
      
      33.5.2.4.2 Draining the TX FIFO
      
      When Extended SPI Mode (DSPIx_MCR[XSPI]) is enabled, if the frame size
      of SPI Data to be transmitted is more than 16 bits, then it causes two
      Data entries to be popped from TX FIFO simultaneously which are
      transferred to the shift register. The first of the two popped entries
      forms the 16 least significant bits of the SPI frame to be transmitted.
      
      So given the following TX buffer:
      
       +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+
       | 0x0 | 0x1 | 0x2 | 0x3 | 0x4 | 0x5 | 0x6 | 0x7 | 0x8 | 0x9 | 0xa | 0xb |
       +-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+
       |     32-bit word 1     |     32-bit word 2     |     32-bit word 3     |
       +-----------------------+-----------------------+-----------------------+
      
      The correct way that a little-endian system should transmit it on the
      wire when bits_per_word is 32 is:
      
      0x03020100
      0x07060504
      0x0b0a0908
      
      But it is actually transmitted as following, as seen with a scope:
      
      0x01000302
      0x05040706
      0x09080b0a
      
      It appears that this patch has been submitted at least once before:
      https://lkml.org/lkml/2018/9/21/286
      but in that case Chuanhua Han did not manage to explain the problem
      clearly enough and the patch did not get merged, leaving XSPI mode
      broken.
      
      Fixes: 8fcd151d ("spi: spi-fsl-dspi: XSPI FIFO handling (in TCFQ mode)")
      Cc: Esben Haabendal <eha@deif.com>
      Cc: Chuanhua Han <chuanhua.han@nxp.com>
      Signed-off-by: default avatarVladimir Oltean <olteanv@gmail.com>
      Link: https://lore.kernel.org/r/20191228135536.14284-1-olteanv@gmail.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      Cc: stable@vger.kernel.org
      ca59d5a5
  3. 27 Dec, 2019 1 commit
  4. 25 Dec, 2019 1 commit
    • Kunihiko Hayashi's avatar
      spi: uniphier: Fix FIFO threshold · 9cd34efb
      Kunihiko Hayashi authored
      Rx threshold means the value to inform the receiver when the number of words
      in Rx FIFO is equal to or more than the value. Similarly, Tx threshold means
      the value to inform the sender when the number of words in Tx FIFO is equal
      to or less than the value. The controller triggers the driver to start
      the transfer.
      
      In case of Rx, the driver wants to detect that the specified number of words
      N are in Rx FIFO, so the value of Rx threshold should be N. In case of Tx,
      the driver wants to detect that the same number of spaces as Rx are in
      Tx FIFO, so the value of Tx threshold should be (FIFO size - N).
      
      For example, in order for the driver to receive at least 3 words from
      Rx FIFO, set 3 to Rx threshold.
         +-+-+-+-+-+-+-+-+
         | | | | | |*|*|*|
         +-+-+-+-+-+-+-+-+
      
      In order for the driver to send at least 3 words to Tx FIFO, because
      it needs at least 3 spaces, set 8(FIFO size) - 3 = 5 to Tx threshold.
         +-+-+-+-+-+-+-+-+
         |*|*|*|*|*| | | |
         +-+-+-+-+-+-+-+-+
      
      This adds new function uniphier_spi_set_fifo_threshold() to set
      threshold value to the register.
      
      And more, FIFO counts by 'words', so this renames 'fill_bytes' with
      'fill_words', and fixes the calculation using bytes_per_words.
      
      Fixes: 37ffab81 ("spi: uniphier: introduce polling mode")
      Cc: Keiji Hayashibara <hayashibara.keiji@socionext.com>
      Signed-off-by: default avatarKunihiko Hayashi <hayashi.kunihiko@socionext.com>
      Link: https://lore.kernel.org/r/1577149107-30670-2-git-send-email-hayashi.kunihiko@socionext.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      9cd34efb
  5. 16 Dec, 2019 2 commits
  6. 11 Dec, 2019 1 commit
  7. 09 Dec, 2019 2 commits
    • Christophe Leroy's avatar
      spi: fsl: don't map irq during probe · 3194d253
      Christophe Leroy authored
      With lastest kernel, the following warning is observed at startup:
      
      [    1.500609] ------------[ cut here ]------------
      [    1.505225] remove_proc_entry: removing non-empty directory 'irq/22', leaking at least 'fsl_spi'
      [    1.514234] WARNING: CPU: 0 PID: 1 at fs/proc/generic.c:682 remove_proc_entry+0x198/0x1c0
      [    1.522403] CPU: 0 PID: 1 Comm: swapper Not tainted 5.4.0-s3k-dev-02248-g93532430a4ff #2564
      [    1.530724] NIP:  c0197694 LR: c0197694 CTR: c0050d80
      [    1.535762] REGS: df4a5af0 TRAP: 0700   Not tainted  (5.4.0-02248-g93532430a4ff)
      [    1.543818] MSR:  00029032 <EE,ME,IR,DR,RI>  CR: 22028222  XER: 00000000
      [    1.550524]
      [    1.550524] GPR00: c0197694 df4a5ba8 df4a0000 00000054 00000000 00000000 00004a38 00000010
      [    1.550524] GPR08: c07c5a30 00000800 00000000 00001032 22000208 00000000 c0004b14 00000000
      [    1.550524] GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c0830000 c07fc078
      [    1.550524] GPR24: c08e8ca0 df665d10 df60ea98 c07c9db8 00000001 df5d5ae3 df5d5a80 df43f8e3
      [    1.585327] NIP [c0197694] remove_proc_entry+0x198/0x1c0
      [    1.590628] LR [c0197694] remove_proc_entry+0x198/0x1c0
      [    1.595829] Call Trace:
      [    1.598280] [df4a5ba8] [c0197694] remove_proc_entry+0x198/0x1c0 (unreliable)
      [    1.605321] [df4a5bd8] [c0067acc] unregister_irq_proc+0x5c/0x70
      [    1.611238] [df4a5bf8] [c005fbc4] free_desc+0x3c/0x80
      [    1.616286] [df4a5c18] [c005fe2c] irq_free_descs+0x70/0xa8
      [    1.621778] [df4a5c38] [c033d3fc] of_fsl_spi_probe+0xdc/0x3cc
      [    1.627525] [df4a5c88] [c02f0f64] platform_drv_probe+0x44/0xa4
      [    1.633350] [df4a5c98] [c02eee44] really_probe+0x1ac/0x418
      [    1.638829] [df4a5cc8] [c02ed3e8] bus_for_each_drv+0x64/0xb0
      [    1.644481] [df4a5cf8] [c02ef950] __device_attach+0xd4/0x128
      [    1.650132] [df4a5d28] [c02ed61c] bus_probe_device+0xa0/0xbc
      [    1.655783] [df4a5d48] [c02ebbe8] device_add+0x544/0x74c
      [    1.661096] [df4a5d88] [c0382b78] of_platform_device_create_pdata+0xa4/0x100
      [    1.668131] [df4a5da8] [c0382cf4] of_platform_bus_create+0x120/0x20c
      [    1.674474] [df4a5df8] [c0382d50] of_platform_bus_create+0x17c/0x20c
      [    1.680818] [df4a5e48] [c0382e88] of_platform_bus_probe+0x9c/0xf0
      [    1.686907] [df4a5e68] [c0751404] __machine_initcall_cmpcpro_cmpcpro_declare_of_platform_devices+0x74/0x1a4
      [    1.696629] [df4a5e98] [c072a4cc] do_one_initcall+0x8c/0x1d4
      [    1.702282] [df4a5ef8] [c072a768] kernel_init_freeable+0x154/0x204
      [    1.708455] [df4a5f28] [c0004b2c] kernel_init+0x18/0x110
      [    1.713769] [df4a5f38] [c00122ac] ret_from_kernel_thread+0x14/0x1c
      [    1.719926] Instruction dump:
      [    1.722889] 2c030000 4182004c 3863ffb0 3c80c05f 80e3005c 388436a0 3c60c06d 7fa6eb78
      [    1.730630] 7fe5fb78 38840280 38634178 4be8c611 <0fe00000> 4bffff6c 3c60c071 7fe4fb78
      [    1.738556] ---[ end trace 05d0720bf2e352e2 ]---
      
      The problem comes from the error path which calls
      irq_dispose_mapping() while the IRQ has been requested with
      devm_request_irq().
      
      IRQ doesn't need to be mapped with irq_of_parse_and_map(). The only
      need is to get the IRQ virtual number. For that, use
      of_irq_to_resource() instead of the
      irq_of_parse_and_map()/irq_dispose_mapping() pair.
      
      Fixes: 500a32ab ("spi: fsl: Call irq_dispose_mapping in err path")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarChristophe Leroy <christophe.leroy@c-s.fr>
      Link: https://lore.kernel.org/r/518cfb83347d5372748e7fe72f94e2e9443d0d4a.1575905123.git.christophe.leroy@c-s.frSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      3194d253
    • Chuhong Yuan's avatar
      spi: spi-cavium-thunderx: Add missing pci_release_regions() · a841e285
      Chuhong Yuan authored
      The driver forgets to call pci_release_regions() in probe failure
      and remove.
      Add the missed calls to fix it.
      Signed-off-by: default avatarChuhong Yuan <hslester96@gmail.com>
      Link: https://lore.kernel.org/r/20191206075500.18525-1-hslester96@gmail.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      a841e285
  8. 04 Dec, 2019 1 commit
  9. 03 Dec, 2019 1 commit
  10. 28 Nov, 2019 4 commits
  11. 27 Nov, 2019 1 commit
    • Charles Keepax's avatar
      spi: cadence: Correct handling of native chipselect · 61acd19f
      Charles Keepax authored
      To fix a regression on the Cadence SPI driver, this patch reverts
      commit 6046f540 ("spi: cadence: Fix default polarity of native
      chipselect").
      
      This patch was not the correct fix for the issue. The SPI framework
      calls the set_cs line with the logic level it desires on the chip select
      line, as such the old is_high handling was correct. However, this was
      broken by the fact that before commit 3e5ec1db ("spi: Fix SPI_CS_HIGH
      setting when using native and GPIO CS") all controllers that offered
      the use of a GPIO chip select had SPI_CS_HIGH applied, even for hardware
      chip selects. This caused the value passed into the driver to be inverted.
      Which unfortunately makes it look like a logical enable the chip select
      value.
      
      Since the core was corrected to not unconditionally apply SPI_CS_HIGH,
      the Cadence driver, whilst using the hardware chip select, will deselect
      the chip select every time we attempt to communicate with the device,
      which results in failed communications.
      
      Fixes: 3e5ec1db ("spi: Fix SPI_CS_HIGH setting when using native and GPIO CS")
      Signed-off-by: default avatarCharles Keepax <ckeepax@opensource.cirrus.com>
      Acked-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Link: https://lore.kernel.org/r/20191126164140.6240-1-ckeepax@opensource.cirrus.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      61acd19f
  12. 25 Nov, 2019 1 commit
  13. 22 Nov, 2019 2 commits
  14. 20 Nov, 2019 1 commit
  15. 18 Nov, 2019 2 commits
  16. 15 Nov, 2019 10 commits
  17. 12 Nov, 2019 1 commit
  18. 11 Nov, 2019 3 commits
  19. 08 Nov, 2019 4 commits