From 2ae0ab0143fcc06190713ed81a6486ed0ad3c861 Mon Sep 17 00:00:00 2001 From: Alexander Sverdlin Date: Tue, 12 Mar 2024 12:20:48 +0100 Subject: spi: lpspi: Avoid potential use-after-free in probe() fsl_lpspi_probe() is allocating/disposing memory manually with spi_alloc_host()/spi_alloc_target(), but uses devm_spi_register_controller(). In case of error after the latter call the memory will be explicitly freed in the probe function by spi_controller_put() call, but used afterwards by "devm" management outside probe() (spi_unregister_controller() <- devm_spi_unregister() below). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 ... Call trace: kernfs_find_ns kernfs_find_and_get_ns sysfs_remove_group sysfs_remove_groups device_remove_attrs device_del spi_unregister_controller devm_spi_unregister release_nodes devres_release_all really_probe driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") Signed-off-by: Alexander Sverdlin Link: https://msgid.link/r/20240312112050.2503643-1-alexander.sverdlin@siemens.com Signed-off-by: Mark Brown --- drivers/spi/spi-fsl-lpspi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c index 11991eb1263644..079035db7dd859 100644 --- a/drivers/spi/spi-fsl-lpspi.c +++ b/drivers/spi/spi-fsl-lpspi.c @@ -830,11 +830,11 @@ static int fsl_lpspi_probe(struct platform_device *pdev) is_target = of_property_read_bool((&pdev->dev)->of_node, "spi-slave"); if (is_target) - controller = spi_alloc_target(&pdev->dev, - sizeof(struct fsl_lpspi_data)); + controller = devm_spi_alloc_target(&pdev->dev, + sizeof(struct fsl_lpspi_data)); else - controller = spi_alloc_host(&pdev->dev, - sizeof(struct fsl_lpspi_data)); + controller = devm_spi_alloc_host(&pdev->dev, + sizeof(struct fsl_lpspi_data)); if (!controller) return -ENOMEM; -- cgit 1.2.3-korg From aa0162dc0dd95c3bf248e3c78068760094e8f64b Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Mon, 11 Mar 2024 23:53:17 +0100 Subject: spi: Restore delays for non-GPIO chip select SPI controller with integrated chip select handling still need to adhere to SPI device's CS setup, hold and inactive delays. For controller without set_cs_timing spi core shall handle the delays to avoid duplicated delay handling in each controller driver. Fixes a regression for the out of tree SPI controller and SPI HID transport on Apple M1/M1 Pro/Max notebooks. Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core") Signed-off-by: Janne Grunau Link: https://msgid.link/r/20240311-spi-cs-delays-regression-v1-1-0075020a90b2@jannau.net Signed-off-by: Mark Brown --- drivers/spi/spi.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index f18738ae95f8f9..ff75838c1b5dfa 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -1063,10 +1063,14 @@ static void spi_set_cs(struct spi_device *spi, bool enable, bool force) if (spi->mode & SPI_CS_HIGH) enable = !enable; - if (spi_is_csgpiod(spi)) { - if (!spi->controller->set_cs_timing && !activate) - spi_delay_exec(&spi->cs_hold, NULL); + /* + * Handle chip select delays for GPIO based CS or controllers without + * programmable chip select timing. + */ + if ((spi_is_csgpiod(spi) || !spi->controller->set_cs_timing) && !activate) + spi_delay_exec(&spi->cs_hold, NULL); + if (spi_is_csgpiod(spi)) { if (!(spi->mode & SPI_NO_CS)) { /* * Historically ACPI has no means of the GPIO polarity and @@ -1099,16 +1103,16 @@ static void spi_set_cs(struct spi_device *spi, bool enable, bool force) if ((spi->controller->flags & SPI_CONTROLLER_GPIO_SS) && spi->controller->set_cs) spi->controller->set_cs(spi, !enable); - - if (!spi->controller->set_cs_timing) { - if (activate) - spi_delay_exec(&spi->cs_setup, NULL); - else - spi_delay_exec(&spi->cs_inactive, NULL); - } } else if (spi->controller->set_cs) { spi->controller->set_cs(spi, !enable); } + + if (spi_is_csgpiod(spi) || !spi->controller->set_cs_timing) { + if (activate) + spi_delay_exec(&spi->cs_setup, NULL); + else + spi_delay_exec(&spi->cs_inactive, NULL); + } } #ifdef CONFIG_HAS_DMA -- cgit 1.2.3-korg From 29895ce18311ddd702973ddb3a6c687db663e0fb Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Wed, 13 Mar 2024 12:45:30 -0700 Subject: spi: Fix error code checking in spi_mem_exec_op() After commit cff49d58f57e ("spi: Unify error codes by replacing -ENOTSUPP with -EOPNOTSUPP"), our SPI NOR flashes would stop probing with the following visible in the kernel log: [ 2.196300] brcmstb_qspi f0440920.qspi: using bspi-mspi mode [ 2.210295] spi-nor: probe of spi1.0 failed with error -95 It turns out that the check in spi_mem_exec_op() was changed to check for -ENOTSUPP (old error code) or -EOPNOTSUPP (new error code), but this means that for drivers that were converted, the second condition is now true, and we stop falling through like we used to. Fix the error to check for neither error being neither -ENOTSUPP *nor* -EOPNOTSUPP. Fixes: cff49d58f57e ("spi: Unify error codes by replacing -ENOTSUPP with -EOPNOTSUPP") Reviewed-by: Michael Walle Reviewed-by: Pratyush Yadav Signed-off-by: Florian Fainelli Reviewed-by: Miquel Raynal Reviewed-by: Mika Westerberg Reviewed-by: Tudor Ambarus Link: https://msgid.link/r/20240313194530.3150446-1-florian.fainelli@broadcom.com Signed-off-by: Mark Brown --- drivers/spi/spi-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c index c9d6d42a88f55b..17b8baf749e6aa 100644 --- a/drivers/spi/spi-mem.c +++ b/drivers/spi/spi-mem.c @@ -382,7 +382,7 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op) * read path) and expect the core to use the regular SPI * interface in other cases. */ - if (!ret || ret != -ENOTSUPP || ret != -EOPNOTSUPP) { + if (!ret || (ret != -ENOTSUPP && ret != -EOPNOTSUPP)) { spi_mem_add_op_stats(ctlr->pcpu_statistics, op, ret); spi_mem_add_op_stats(mem->spi->pcpu_statistics, op, ret); -- cgit 1.2.3-korg From 7397175cb7b48f7a3fc699083aa46f1234904c7e Mon Sep 17 00:00:00 2001 From: Kousik Sanagavarapu Date: Mon, 18 Mar 2024 21:08:34 +0530 Subject: spi: lm70llp: fix links in doc and comments Update links in the documentation and in-code comments which point to the datasheet and schematic. The current links don't work because National Semiconductor (which is the manufacturer of this board and lm70) has been a part of Texas Instruments since 2011 and hence http://www.national.com/ doesn't work anymore. Fixes: 78961a574037 ("spi_lm70llp parport adapter driver") Fixes: 2b7300513b98 ("hwmon: (lm70) Code streamlining and cleanup") Signed-off-by: Kousik Sanagavarapu Link: https://msgid.link/r/20240318154540.90613-2-five231003@gmail.com Signed-off-by: Mark Brown --- Documentation/spi/spi-lm70llp.rst | 4 ++-- drivers/spi/spi-lm70llp.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation/spi/spi-lm70llp.rst b/Documentation/spi/spi-lm70llp.rst index 2f20e5b405e66a..ff98ddc76a7478 100644 --- a/Documentation/spi/spi-lm70llp.rst +++ b/Documentation/spi/spi-lm70llp.rst @@ -6,7 +6,7 @@ Supported board/chip: * National Semiconductor LM70 LLP evaluation board - Datasheet: http://www.national.com/pf/LM/LM70.html + Datasheet: https://www.ti.com/lit/gpn/lm70 Author: Kaiwan N Billimoria @@ -28,7 +28,7 @@ Hardware Interfacing The schematic for this particular board (the LM70EVAL-LLP) is available (on page 4) here: - http://www.national.com/appinfo/tempsensors/files/LM70LLPEVALmanual.pdf + https://download.datasheets.com/pdfs/documentation/nat/kit&board/lm70llpevalmanual.pdf The hardware interfacing on the LM70 LLP eval board is as follows: diff --git a/drivers/spi/spi-lm70llp.c b/drivers/spi/spi-lm70llp.c index f982bdebd02838..3c0c24ed1f3dbe 100644 --- a/drivers/spi/spi-lm70llp.c +++ b/drivers/spi/spi-lm70llp.c @@ -29,10 +29,10 @@ * * Datasheet and Schematic: * The LM70 is a temperature sensor chip from National Semiconductor; its - * datasheet is available at http://www.national.com/pf/LM/LM70.html + * datasheet is available at https://www.ti.com/lit/gpn/lm70 * The schematic for this particular board (the LM70EVAL-LLP) is * available (on page 4) here: - * http://www.national.com/appinfo/tempsensors/files/LM70LLPEVALmanual.pdf + * https://download.datasheets.com/pdfs/documentation/nat/kit&board/lm70llpevalmanual.pdf * * Also see Documentation/spi/spi-lm70llp.rst. The SPI<->parport code here is * (heavily) based on spi-butterfly by David Brownell. -- cgit 1.2.3-korg From cf6d79a0f5769b5f4d9579ddaf88d2c30b03b873 Mon Sep 17 00:00:00 2001 From: Adam Butcher Date: Mon, 18 Mar 2024 17:50:52 +0000 Subject: spi: spi-imx: fix off-by-one in mx51 CPU mode burst length c712c05e46c8 ("spi: imx: fix the burst length at DMA mode and CPU mode") corrects three cases of setting the ECSPI burst length but erroneously leaves the in-range CPU case one bit to big (in that field a value of 0 means 1 bit). The effect was that transmissions that should have been 8-bit bytes appeared as 9-bit causing failed communication with SPI devices. Link: https://lore.kernel.org/all/20240201105451.507005-1-carlos.song@nxp.com/ Link: https://lore.kernel.org/all/20240204091912.36488-1-carlos.song@nxp.com/ Fixes: c712c05e46c8 ("spi: imx: fix the burst length at DMA mode and CPU mode") Signed-off-by: Adam Butcher Link: https://msgid.link/r/20240318175119.3334-1-adam@jessamine.co.uk Signed-off-by: Mark Brown --- drivers/spi/spi-imx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 833a1bb7a91438..c3e5cee18bea73 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -668,8 +668,8 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, ctrl |= (MX51_ECSPI_CTRL_MAX_BURST * BITS_PER_BYTE - 1) << MX51_ECSPI_CTRL_BL_OFFSET; else - ctrl |= spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word, - BITS_PER_BYTE) * spi_imx->bits_per_word + ctrl |= (spi_imx->count / DIV_ROUND_UP(spi_imx->bits_per_word, + BITS_PER_BYTE) * spi_imx->bits_per_word - 1) << MX51_ECSPI_CTRL_BL_OFFSET; } } -- cgit 1.2.3-korg From 2ff0573e7aff5129d73ec5c3159cd84d862cb1cc Mon Sep 17 00:00:00 2001 From: David Lechner Date: Tue, 19 Mar 2024 13:33:42 -0500 Subject: spi: docs: spidev: fix echo command format The two example echo commands for binding the spidev driver were being rendered as one line in the HTML output. This patch makes use of the restructured text :: to format the commands as a code block instead which preserves the line break. Signed-off-by: David Lechner Link: https://msgid.link/r/20240319183344.2106335-1-dlechner@baylibre.com Signed-off-by: Mark Brown --- Documentation/spi/spidev.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/spi/spidev.rst b/Documentation/spi/spidev.rst index 369c657ba4358b..e08b301ad24ac6 100644 --- a/Documentation/spi/spidev.rst +++ b/Documentation/spi/spidev.rst @@ -61,7 +61,7 @@ the spidev driver failing to probe. Sysfs also supports userspace driven binding/unbinding of drivers to devices that do not bind automatically using one of the tables above. -To make the spidev driver bind to such a device, use the following: +To make the spidev driver bind to such a device, use the following:: echo spidev > /sys/bus/spi/devices/spiB.C/driver_override echo spiB.C > /sys/bus/spi/drivers/spidev/bind -- cgit 1.2.3-korg From a20ad45008a7c82f1184dc6dee280096009ece55 Mon Sep 17 00:00:00 2001 From: Fei Shao Date: Thu, 21 Mar 2024 15:08:57 +0800 Subject: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes. Add a check to trans->tx_buf before using it. Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers") Signed-off-by: Fei Shao Reviewed-by: AngeloGioacchino Del Regno Link: https://msgid.link/r/20240321070942.1587146-2-fshao@chromium.org Signed-off-by: Mark Brown --- drivers/spi/spi-mt65xx.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c index 8d4633b353eef6..e4cb22fe007523 100644 --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c @@ -788,17 +788,19 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id) mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len); mtk_spi_setup_packet(host); - cnt = mdata->xfer_len / 4; - iowrite32_rep(mdata->base + SPI_TX_DATA_REG, - trans->tx_buf + mdata->num_xfered, cnt); + if (trans->tx_buf) { + cnt = mdata->xfer_len / 4; + iowrite32_rep(mdata->base + SPI_TX_DATA_REG, + trans->tx_buf + mdata->num_xfered, cnt); - remainder = mdata->xfer_len % 4; - if (remainder > 0) { - reg_val = 0; - memcpy(®_val, - trans->tx_buf + (cnt * 4) + mdata->num_xfered, - remainder); - writel(reg_val, mdata->base + SPI_TX_DATA_REG); + remainder = mdata->xfer_len % 4; + if (remainder > 0) { + reg_val = 0; + memcpy(®_val, + trans->tx_buf + (cnt * 4) + mdata->num_xfered, + remainder); + writel(reg_val, mdata->base + SPI_TX_DATA_REG); + } } mtk_spi_enable_transfer(host); -- cgit 1.2.3-korg