linux-toradex.git/drivers/spi/spidev.c, branch v2.6.27.49

spi: avoid spidev crash when device is removed

2008-12-13T23:29:16+00:00

commit aaacf4bb51b243875b203e6ff73b5047636b4efa upstream.

I saw a kernel oops in spidev_remove() when a spidev device was registered
and I unloaded the SPI master driver:

Unable to handle kernel paging request for data at address 0x00000004
Faulting instruction address: 0xc01c0c50
Oops: Kernel access of bad area, sig: 11 [#1]
CDSPR
Modules linked in: spi_ppc4xx(-)
NIP: c01c0c50 LR: c01bf9e4 CTR: c01c0c34
REGS: cec89c30 TRAP: 0300   Not tainted  (2.6.27.3izt)
MSR: 00021000   CR: 24000228  XER: 20000007
DEAR: 00000004, ESR: 00800000
TASK = cf889040[2070] 'rmmod' THREAD: cec88000
GPR00: 00000000 cec89ce0 cf889040 cec8e000 00000004 cec8e000 ffffffff 00000000
GPR08: 0000001c c0336380 00000000 c01c0c34 00000001 1001a338 100e0000 100df49c
GPR16: 100b54c0 100df49c 100ddd20 100f05a8 100b5340 100efd68 00000000 00000000
GPR24: 100ec008 100f0428 c0327788 c0327794 cec8e0ac cec8e000 c0336380 00000000
NIP [c01c0c50] spidev_remove+0x1c/0xe4
LR [c01bf9e4] spi_drv_remove+0x2c/0x3c
Call Trace:
[cec89d00] [c01bf9e4] spi_drv_remove+0x2c/0x3c
[cec89d10] [c01859a0] __device_release_driver+0x78/0xb4
[cec89d20] [c0185ab0] device_release_driver+0x28/0x44
[cec89d40] [c0184be8] bus_remove_device+0xac/0xd8
[cec89d60] [c0183094] device_del+0x100/0x194
[cec89d80] [c0183140] device_unregister+0x18/0x30
[cec89da0] [c01bf30c] __unregister+0x20/0x34
[cec89db0] [c0182778] device_for_each_child+0x38/0x74
[cec89de0] [c01bf2d0] spi_unregister_master+0x28/0x44
[cec89e00] [c01bfeac] spi_bitbang_stop+0x1c/0x58
[cec89e20] [d908a5e0] spi_ppc4xx_of_remove+0x24/0x7c [spi_ppc4xx]
[...]

IMHO a call to spi_set_drvdata() is missing in spidev_probe(). The patch
below helped.

Signed-off-by: Wolfgang Ocker 
Signed-off-by: David Brownell 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

spidev: BKL removal

2008-07-24T17:47:30+00:00

Another step to removing ->ioctl and to removing the BKL

[dbrownell@users.sourceforge.net: take final step; BKL not needed]
Signed-off-by: Alan Cox 
Signed-off-by: David Brownell 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

device create: spi: convert device_create to device_create_drvdata

2008-07-22T04:54:45+00:00

Switch over to use the shiny new device_create_drvdata() call
instead of the original device_create() calls, so this continues
to work after device_create() is  removed.

Note that this driver never had the race which motivated removing
the original call; it locked correctly.

Signed-off-by: David Brownell 
Signed-off-by: Greg Kroah-Hartman

Merge commit 'v2.6.26' into bkl-removal

2008-07-14T21:29:34+00:00

spi: fix the read path in spidev

2008-07-04T17:40:08+00:00

This got broken by the recent "fix rmmod $spi_driver while spidev-user is
active".  I tested the rmmod & write path but didn't check the read path.
I am sorry.  The read logic changed and spidev_sync_read() +
spidev_sync_write() do not return zero on success anymore but the number
of bytes that has been transfered over the bus.  This patch changes the
logic and copy_to_user() gets called again.

The write path returns the number of bytes which are written to the
underlying device what may be less than the requested size.  This patch
makes the same change to the read path or else we request a read of 20
bytes, get 10, don't call copy to user and report to the user that we read
10 bytes.

[akpm@linux-foundation.org: remove test of known-to-be-zero local]
Signed-off-by: Sebastian Siewior 
Acked-by: David Brownell 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

spidev: BKL pushdown

2008-06-20T20:05:50+00:00

Add the BKL to spidev_open(), even though the existing locking looks
adequate.

Signed-off-by: Jonathan Corbet

spi: fix refcount-related spidev oops-on-rmmod

2008-06-06T18:29:08+00:00

This addresses other oopsing paths in "spidev" by changing how it manages
refcounting.  It decouples the lifecycle of the per-device data from the
class device (not just the spi device):

  - Use class_{create,destroy} not class_{register,unregister}.
  - Use device_{create,destroy} not device_{register,unregister}.
  - Free the per-device data only when TWO conditions are true:
      * Driver is unbound from underlying SPI device, and
      * Device is no longer open (new)

Also, spi_{get,set}_drvdata not dev_{get,set}_drvdata for simpler code.

Signed-off-by: David Brownell 
Sebastian Siewior 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

spi: remove some spidev oops-on-rmmod paths

2008-05-24T16:56:14+00:00

Somehow the spidev code forgot to include a critical mechanism: when the
underlying device is removed (e.g.  spi_master rmmod), open file
descriptors must be prevented from issuing new I/O requests to that
device.  On penalty of the oopsing reported by Sebastian Siewior
 ...

This is a partial fix, adding handshaking between the lower level (SPI
messaging) and the file operations using the spi_dev.  (It also fixes an
issue where reads and writes didn't return the number of bytes sent or
received.)

There's still a refcounting issue to be addressed (separately).

Signed-off-by: David Brownell 
Reported-by: Sebastian Siewior 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fix abuses of ptrdiff_t

2007-10-29T14:41:33+00:00

Use of ptrdiff_t in places like

-                       if (!access_ok(VERIFY_WRITE, u_tmp->rx_buf, u_tmp->len))
+                       if (!access_ok(VERIFY_WRITE, (u8 __user *)
+                                               (ptrdiff_t) u_tmp->rx_buf,
+                                               u_tmp->len))

is wrong; for one thing, it's a bad C (it's what uintptr_t is for; in general
we are not even promised that ptrdiff_t is large enough to hold a pointer,
just enough to hold a difference between two pointers within the same object).
For another, it confuses the fsck out of sparse.

Use unsigned long or uintptr_t instead.  There are several places misusing
ptrdiff_t; fixed.

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

spidev warning fix

2007-08-11T22:47:42+00:00

Git rid of "warning: passing arg 2 of `access_ok' makes pointer from integer
without a cast" reported on SH ...  most architectures use macros in that
test, SH uses inlined functions.

Signed-off-by: David Brownell 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds