linux-toradex.git/drivers/spi, branch v3.10.78

spi: spidev: fix possible arithmetic overflow for multi-transfer message

2015-05-06T19:56:21+00:00

commit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream.

`spidev_message()` sums the lengths of the individual SPI transfers to
determine the overall SPI message length.  It restricts the total
length, returning an error if too long, but it does not check for
arithmetic overflow.  For example, if the SPI message consisted of two
transfers and the first has a length of 10 and the second has a length
of (__u32)(-1), the total length would be seen as 9, even though the
second transfer is actually very long.  If the second transfer specifies
a null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could
overrun the spidev's pre-allocated tx buffer before it reaches an
invalid user memory address.  Fix it by checking that neither the total
nor the individual transfer lengths exceed the maximum allowed value.

Thanks to Dan Carpenter for reporting the potential integer overflow.

Signed-off-by: Ian Abbott 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: pl022: Fix race in giveback() leading to driver lock-up

2015-03-26T14:00:58+00:00

commit cd6fa8d2ca53cac3226fdcffcf763be390abae32 upstream.

Commit fd316941c ("spi/pl022: disable port when unused") introduced a race,
which leads to possible driver lock up (easily reproducible on SMP).

The problem happens in giveback() function where the completion of the transfer
is signalled to SPI subsystem and then the HW SPI controller is disabled. Another
transfer might be setup in between, which brings driver in locked-up state.

Exact event sequence on SMP:

core0                                   core1

                                        => pump_transfers()
                                        /* message->state == STATE_DONE */
                                          => giveback()
                                            => spi_finalize_current_message()

=> pl022_unprepare_transfer_hardware()
=> pl022_transfer_one_message
  => flush()
  => do_interrupt_dma_transfer()
    => set_up_next_transfer()
    /* Enable SSP, turn on interrupts */
    writew((readw(SSP_CR1(pl022->virtbase)) |
           SSP_CR1_MASK_SSE), SSP_CR1(pl022->virtbase));

...

=> pl022_interrupt_handler()
  => readwriter()

                                        /* disable the SPI/SSP operation */
                                        => writew((readw(SSP_CR1(pl022->virtbase)) &
                                                  (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));

Lockup! SPI controller is disabled and the data will never be received. Whole
SPI subsystem is waiting for transfer ACK and blocked.

So, only signal transfer completion after disabling the controller.

Fixes: fd316941c (spi/pl022: disable port when unused)
Signed-off-by: Alexander Sverdlin 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi/pxa2xx: Clear cur_chip pointer before starting next message

2015-02-06T06:35:37+00:00

commit c957e8f084e0d21febcd6b8a0ea9631eccc92f36 upstream.

Once the current message is finished, the driver notifies SPI core about
this by calling spi_finalize_current_message(). This function queues next
message to be transferred. If there are more messages in the queue, it is
possible that the driver is asked to transfer the next message at this
point.

When spi_finalize_current_message() returns the driver clears the
drv_data->cur_chip pointer to NULL. The problem is that if the driver
already started the next message clearing drv_data->cur_chip will cause
NULL pointer dereference which crashes the kernel like:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
 IP: [] cs_deassert+0x18/0x70 [spi_pxa2xx_platform]
 PGD 78bb8067 PUD 37712067 PMD 0
 Oops: 0000 [#1] SMP
 Modules linked in:
 CPU: 1 PID: 11 Comm: ksoftirqd/1 Tainted: G           O   3.18.0-rc4-mjo #5
 Hardware name: Intel Corp. VALLEYVIEW B3 PLATFORM/NOTEBOOK, BIOS MNW2CRB1.X64.0071.R30.1408131301 08/13/2014
 task: ffff880077f9f290 ti: ffff88007a820000 task.ti: ffff88007a820000
 RIP: 0010:[]  [] cs_deassert+0x18/0x70 [spi_pxa2xx_platform]
 RSP: 0018:ffff88007a823d08  EFLAGS: 00010202
 RAX: 0000000000000008 RBX: ffff8800379a4430 RCX: 0000000000000026
 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff8800379a4430
 RBP: ffff88007a823d18 R08: 00000000ffffffff R09: 000000007a9bc65a
 R10: 000000000000028f R11: 0000000000000005 R12: ffff880070123e98
 R13: ffff880070123de8 R14: 0000000000000100 R15: ffffc90004888000
 FS:  0000000000000000(0000) GS:ffff880079a80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000048 CR3: 000000007029b000 CR4: 00000000001007e0
 Stack:
  ffff88007a823d58 ffff8800379a4430 ffff88007a823d48 ffffffffa0022c89
  0000000000000000 ffff8800379a4430 0000000000000000 0000000000000006
  ffff88007a823da8 ffffffffa0023be0 ffff88007a823dd8 ffffffff81076204
 Call Trace:
  [] giveback+0x69/0xa0 [spi_pxa2xx_platform]
  [] pump_transfers+0x710/0x740 [spi_pxa2xx_platform]
  [] ? pick_next_task_fair+0x744/0x830
  [] tasklet_action+0xa9/0xe0
  [] __do_softirq+0xee/0x280
  [] run_ksoftirqd+0x20/0x40
  [] smpboot_thread_fn+0xff/0x1b0
  [] ? SyS_setgroups+0x150/0x150
  [] kthread+0xcd/0xf0
  [] ? kthread_create_on_node+0x180/0x180
  [] ret_from_fork+0x7c/0xb0

Fix this by clearing drv_data->cur_chip before we call spi_finalize_current_message().

Reported-by: Martin Oldfield 
Signed-off-by: Mika Westerberg 
Acked-by: Robert Jarzmik 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: dw-mid: fix FIFO size

2015-02-06T06:35:36+00:00

commit 67bf9cda4b498b8cea4a40be67a470afe57d2e88 upstream.

The FIFO size is 40 accordingly to the specifications, but this means 0x40,
i.e. 64 bytes. This patch fixes the typo and enables FIFO size autodetection
for Intel MID devices.

Fixes: 7063c0d942a1 (spi/dw_spi: add DMA support)
Signed-off-by: Andy Shevchenko 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: dw: Fix dynamic speed change.

2014-12-06T23:05:49+00:00

commit 0a8727e69778683495058852f783eeda141a754e upstream.

An IOCTL call that calls spi_setup() and then dw_spi_setup() will
overwrite the persisted last transfer speed. On each transfer, the
SPI speed is compared to the last transfer speed to determine if the
clock divider registers need to be updated (did the speed change?).
This bug was observed with the spidev driver using spi-config to
update the max transfer speed.

This fix: Don't overwrite the persisted last transaction clock speed
when updating the SPI parameters in dw_spi_setup(). On the next
transaction, the new speed won't match the persisted last speed
and the hardware registers will be updated.
On initialization, the persisted last transaction clock
speed will be 0 but will be updated after the first SPI
transaction.

Move zeroed clock divider check into clock change test because
chip->clk_div is zero on startup and would cause a divide-by-zero
error. The calculation was wrong as well (can't support odd #).

Reported-by: Vlastimil Setka 
Signed-off-by: Vlastimil Setka 
Signed-off-by: Thor Thayer 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: pxa2xx: toggle clocks on suspend if not disabled by runtime PM

2014-11-14T16:47:59+00:00

commit 2b9375b91bef65b837bed61a05fb387159b38ddf upstream.

If PM_RUNTIME is enabled, it is easy to trigger the following backtrace
on pxa2xx hosts:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at /home/lumag/linux/arch/arm/mach-pxa/clock.c:35 clk_disable+0xa0/0xa8()
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 3.17.0-00007-g1b3d2ee-dirty #104
[] (unwind_backtrace) from [] (show_stack+0x10/0x14)
[] (show_stack) from [] (warn_slowpath_common+0x6c/0x8c)
[] (warn_slowpath_common) from [] (warn_slowpath_null+0x1c/0x24)
[] (warn_slowpath_null) from [] (clk_disable+0xa0/0xa8)
[] (clk_disable) from [] (pxa2xx_spi_suspend+0x2c/0x34)
[] (pxa2xx_spi_suspend) from [] (platform_pm_suspend+0x2c/0x54)
[] (platform_pm_suspend) from [] (dpm_run_callback.isra.14+0x2c/0x74)
[] (dpm_run_callback.isra.14) from [] (__device_suspend+0x120/0x2f8)
[] (__device_suspend) from [] (dpm_suspend+0x50/0x208)
[] (dpm_suspend) from [] (suspend_devices_and_enter+0x8c/0x3a0)
[] (suspend_devices_and_enter) from [] (pm_suspend+0x214/0x2a8)
[] (pm_suspend) from [] (test_suspend+0x14c/0x1dc)
[] (test_suspend) from [] (do_one_initcall+0x8c/0x1fc)
[] (do_one_initcall) from [] (kernel_init_freeable+0xf4/0x1b4)
[] (kernel_init_freeable) from [] (kernel_init+0x8/0xec)
[] (kernel_init) from [] (ret_from_fork+0x14/0x24)
---[ end trace 46524156d8faa4f6 ]---

This happens because suspend function tries to disable a clock that is
already disabled by runtime_suspend callback. Add if
(!pm_runtime_suspended()) checks to suspend/resume path.

Fixes: 7d94a505858 (spi/pxa2xx: add support for runtime PM)
Signed-off-by: Dmitry Eremin-Solenikov 
Reported-by: Andrea Adami 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: pl022: Fix incorrect dma_unmap_sg

2014-11-14T16:47:59+00:00

commit 3ffa6158f002e096d28ede71be4e0ee8ab20baa2 upstream.

When mapped RX DMA entries are unmapped in an error condition when DMA
is firstly configured in the driver, the number of TX DMA entries was
passed in, which is incorrect

Signed-off-by: Ray Jui 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: dw-mid: terminate ongoing transfers at exit

2014-10-30T16:35:12+00:00

commit 8e45ef682cb31fda62ed4eeede5d9745a0a1b1e2 upstream.

Do full clean up at exit, means terminate all ongoing DMA transfers.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: dw-mid: check that DMA was inited before exit

2014-10-30T16:35:10+00:00

commit fb57862ead652454ceeb659617404c5f13bc34b5 upstream.

If the driver was compiled with DMA support, but DMA channels weren't acquired
by some reason, mid_spi_dma_exit() will crash the kernel.

Fixes: 7063c0d942a1 (spi/dw_spi: add DMA support)
Signed-off-by: Andy Shevchenko 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

spi: dw-mid: respect 8 bit mode

2014-10-30T16:35:10+00:00

commit b41583e7299046abdc578c33f25ed83ee95b9b31 upstream.

In case of 8 bit mode and DMA usage we end up with every second byte written as
0. We have to respect bits_per_word settings what this patch actually does.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman