In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(),
which could lead to a NULL pointer dereference on failure of
kzalloc().

Fix this bug by adding a check of tmpbuf.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings,
and our static analyzer no longer warns about this code.

Fixes: 67dca5e5 ("spi: spi-mem: Add support for Zynq QSPI controller")
Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
Link: https://lore.kernel.org/r/20211130172253.203700-1-zhou1615@umn.eduSigned-off-by: Mark Brown <broonie@kernel.org>

In some case, like after a transfer timeout, master->cur_msg pointer
is NULL which led to a kernel crash when trying to use master->cur_msg->spi.
mtk_spi_can_dma(), pointed by master->can_dma, doesn't use this parameter
avoid the problem by setting NULL as second parameter.

Fixes: a568231f ("spi: mediatek: Add spi bus for Mediatek MT8173")
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Link: https://lore.kernel.org/r/20220131141708.888710-1-benjamin.gaignard@collabora.comSigned-off-by: Mark Brown <broonie@kernel.org>

The schema for SPI child nodes' 'reg' property is not complete. 'reg' is
a matrix of cells. The schema needs to define both the number of 'reg'
entries and constraints on each entry.
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20220126231326.1636199-1-robh@kernel.orgSigned-off-by: Mark Brown <broonie@kernel.org>

Apply only valid chip select value. This change fixes case where chip
select is set to initial value of '-1' during probe and  PM supend and
subsequent resume can try to use the value with undefined behaviour.
Also in case where gpio based chip select, the check in
bcm_qspi_chip_select() shall prevent undefined behaviour on resume.

Fixes: fa236a7e ("spi: bcm-qspi: Add Broadcom MSPI driver")
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20220127185359.27322-1-kdasu.kdev@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

The issue happens in several error paths in uniphier_spi_probe().
When either dma_get_slave_caps() or devm_spi_register_master() returns
an error code, the function forgets to decrease the refcount of both
`dma_rx` and `dma_tx` objects, which may lead to refcount leaks.

Fix it by decrementing the reference count of specific objects in
those error paths.
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Fixes: 28d1dddc ("spi: uniphier: Add DMA transfer mode support")
Link: https://lore.kernel.org/r/20220125101214.35677-1-xiongx18@fudan.edu.cnSigned-off-by: Mark Brown <broonie@kernel.org>

This check misses checking for  platform_get_irq()'s call and may passes
the negative error codes to devm_request_irq(), which takes unsigned IRQ #,
causing it to fail with -EINVAL, overriding an original error code.
Stop calling devm_request_irq() with invalid IRQ #s.

Fixes: 454fa271 ("spi: Add Meson SPICC driver")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20220126110447.24549-1-linmq006@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

In uniphier_spi_remove(), there is a wrong code to get private data from
the platform device, so the driver can't be removed properly.

The driver should get spi_master from the platform device and retrieve
the private data from it.

Cc: <stable@vger.kernel.org>
Fixes: 5ba155a4 ("spi: add SPI controller driver for UniPhier SoC")
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Link: https://lore.kernel.org/r/1640148492-32178-1-git-send-email-hayashi.kunihiko@socionext.comSigned-off-by: Mark Brown <broonie@kernel.org>

The corresponding API for clk_prepare is clk_unprepare, other than
clk_disable_unprepare.

Fix this by changing clk_disable_unprepare to clk_unprepare.

Fixes: 5762ab71 ("spi: Add support for Armada 3700 SPI Controller")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20211206101931.2816597-1-mudongliangabcd@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

This adds a compatible string for the SPI controller found on
the RK3566 and RK3568 SoCs.
Signed-off-by: Nicolas Frattaroli <frattaroli.nicolas@gmail.com>
Link: https://lore.kernel.org/r/20211126154344.724316-2-frattaroli.nicolas@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

Commit 61367d0b ("spi: stm32: Add 'SPI_SIMPLEX_RX', 'SPI_3WIRE_RX' support for stm32f4")
allowed to properly communicate with the st-gyro-spi even when
there is no tx_buf provided by setting the flag SPI_MASTER_MUST_TX and
thus forcing a dummy TX buffer to work in Full Duplex.
This behavior should kept only for the STM32F4 and not for other
compatible since the STM32H7 do support SIMPLEX_RX and SIMPLEX_TX.
Add the flags variable within the struct stm32_spi_cfg so that flags
used at master registration time are compatible specific.

Fixes: 61367d0b ("spi: stm32: Add 'SPI_SIMPLEX_RX', 'SPI_3WIRE_RX' support for stm32f4")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Link: https://lore.kernel.org/r/20220119093245.624878-3-alain.volmat@foss.st.comSigned-off-by: Mark Brown <broonie@kernel.org>

Variables 'can_dma' and 'has_startbit' are described within the
struct stm32_spi_cfg comment but have never existed in this structure
so remove them.
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Link: https://lore.kernel.org/r/20220119093245.624878-2-alain.volmat@foss.st.comSigned-off-by: Mark Brown <broonie@kernel.org>

Some device driver need to communicate to qspi device during the remove
process, qspi controller must be functional when spi_unregister_master()
is called.

To ensure this, replace devm_spi_register_master() by spi_register_master()
and spi_unregister_master() is called directly in .remove callback before
stopping the qspi controller.

This issue was put in evidence using kernel v5.11 and later
with a spi-nor which supports the software reset feature introduced
by commit d73ee753 ("mtd: spi-nor: core: perform a Soft Reset on
shutdown")

Fixes: c530cd1d ("spi: spi-mem: add stm32 qspi controller")
Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: <stable@vger.kernel.org> # 5.8.x
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/20220117121744.29729-1-patrice.chotard@foss.st.comSigned-off-by: Mark Brown <broonie@kernel.org>

Commit b42faeee ("spi: Add a PTP system timestamp
to the transfer structure") added an include of ptp_clock_kernel.h
to spi.h for struct ptp_system_timestamp but a forward declaration
is enough. Let's use that to limit the number of objects we have
to rebuild every time we touch networking headers.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20210904013140.2377609-1-kuba@kernel.orgSigned-off-by: Mark Brown <broonie@kernel.org>

If the probe fails, we should use pm_runtime_disable() to balance
pm_runtime_enable().
Add missing pm_runtime_disable() for meson_spifc_probe.

Fixes: c3e4bc54 ("spi: meson: Add support for Amlogic Meson SPIFC")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20220107075424.7774-1-linmq006@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

Change 'actualy' to 'actually'
Signed-off-by: Qinghua Jin <qhjin.dev@gmail.com>
Link: https://lore.kernel.org/r/20220107024631.396862-1-qhjin.dev@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

A phandle for 'interrupts' value is wrong and should be one or more numbers.
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20220106182518.1435497-9-robh@kernel.orgSigned-off-by: Mark Brown <broonie@kernel.org>

We missed adding handle_err for gpi mode, so add a new function
spi_geni_handle_err() which would call handle_fifo_timeout() or newly
added handle_gpi_timeout() based on mode

Fixes: b59c1224 ("spi: spi-geni-qcom: Add support for GPI dma")
Reported-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20220103071118.27220-2-vkoul@kernel.orgSigned-off-by: Mark Brown <broonie@kernel.org>

Before we invoke spi_finalize_current_transfer() in
spi_gsi_callback_result() we should set the spi->cur_msg->status as
appropriate (0 for success, error otherwise).

The helps to return error on transfer and not wait till it timesout on
error

Fixes: b59c1224 ("spi: spi-geni-qcom: Add support for GPI dma")
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20220103071118.27220-1-vkoul@kernel.orgSigned-off-by: Mark Brown <broonie@kernel.org>

The spi-mux serves as both a SPI peripheral and controller, so add a
reference to spi-peripheral-props.yaml in addition to
spi-controller.yaml. This is necessary to avoid unevaluatedProperties
warnings once those are fully enabled.
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20220105183234.3426649-1-robh@kernel.orgSigned-off-by: Mark Brown <broonie@kernel.org>

If bits_per_word is configured, transfer only word amount
of data per iteration.
Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
Link: https://lore.kernel.org/r/20211222055958.1383233-2-oskari@lemmela.netSigned-off-by: Mark Brown <broonie@kernel.org>

Propagate firmware node by using a specific API call, i.e. device_set_node().
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211222155739.7699-3-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Propagate firmware node by using a specific API call, i.e. device_set_node().
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Serge Semin <fancer.lancer@gmail.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/20211222155739.7699-2-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Propagate firmware node by using a specific API call, i.e. device_set_node().
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211222155739.7699-1-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Add missing delay between transferred messages and words.
Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
Link: https://lore.kernel.org/r/20211222055958.1383233-3-oskari@lemmela.netSigned-off-by: Mark Brown <broonie@kernel.org>

Some mtk spi nor has dedicated dma(s) inside. Add a new clock name, axi,
for spi nor dma bus clock.
Signed-off-by: Tinghan Shen <tinghan.shen@mediatek.com>
Link: https://lore.kernel.org/r/20211220121825.6446-3-tinghan.shen@mediatek.comSigned-off-by: Mark Brown <broonie@kernel.org>

sama7g5 embedds 2 instances of the QSPI controller:
1/ One Octal Serial Peripheral Interface (QSPI0) Supporting up to
   200 MHz DDR. Octal, TwinQuad, HyperFlash and OctaFlash Protocols
   Supported
2/ One Quad Serial Peripheral Interface (QSPI1) Supporting Up to
   90 MHz DDR/133 MHz SDR
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211209122939.339810-3-tudor.ambarus@microchip.comSigned-off-by: Mark Brown <broonie@kernel.org>

Convert the Atmel QuadSPI controller Device Tree binding documentation
to json-schema.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211209122939.339810-2-tudor.ambarus@microchip.comSigned-off-by: Mark Brown <broonie@kernel.org>

Move the cs_setup delay to the end of spi_set_cs.

From include/linux/spi/spi.h:

 * @cs_setup: delay to be introduced by the controller after CS is
   asserted

The cs_setup delay needs to happen *after* CS is asserted, that is, at
the end of spi_set_cs, not at the beginning. Otherwise we're just
delaying before the SPI transaction starts at all, which isn't very
useful.

No drivers use this right now, but that is likely to change soon with an
upcoming Apple SPI HID transport driver.

Fixes: 25093bde ("spi: implement SW control for CS times")
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20211210170534.177139-1-marcan@marcan.stSigned-off-by: Mark Brown <broonie@kernel.org>

The spi-peripheral-props.yaml schema contains peripheral-specific
properties for SPI controllers that should be present in the peripheral
node. Add a reference to that so its constraints are followed.

additionalProperties: false cannot be used since it marks the controller
properties as unknown. Use unevaluatedProperties: false instead. This
has the side effect of allowing extra properties that are not specified
in the schema. The alternative is to list all the controller properties
in this schema but that would mean every peripheral binding would have
to repeat the same set of properties for each controller.
Signed-off-by: Pratyush Yadav <p.yadav@ti.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211109181911.2251-4-p.yadav@ti.comSigned-off-by: Mark Brown <broonie@kernel.org>

The spi-peripheral-props.yaml schema contains peripheral-specific
properties for SPI controllers that should be present in the peripheral
node. Move peripheral-specific properties to a separate file and refer
to it in spi-peripheral-props.yaml.
Signed-off-by: Pratyush Yadav <p.yadav@ti.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211109181911.2251-3-p.yadav@ti.comSigned-off-by: Mark Brown <broonie@kernel.org>

Many SPI controllers need to add properties to peripheral devices. This
could be the delay in clock or data lines, etc. These properties are
controller specific but need to be defined in the peripheral node
because they are per-peripheral and there can be multiple peripherals
attached to a controller.

If these properties are not added to the peripheral binding, then the
dtbs check emits a warning. But these properties do not make much sense
in the peripheral binding because they are controller-specific and they
will just pollute every peripheral binding. So this binding is added to
collect all such properties from all such controllers. Peripheral
bindings should simply refer to this binding and they should be rid of
the warnings.

There are some limitations with this approach. Firstly, there is no way
to specify required properties. The schema contains properties for all
controllers and there is no way to know which controller is being used.
Secondly, there is no way to restrict additional properties. Since this
schema will be used with an allOf operator, additionalProperties needs
to be true. In addition, the peripheral schema will have to set
unevaluatedProperties: false.

Despite these limitations, this appears to be the best solution to this
problem that doesn't involve modifying existing tools or schema specs.
Signed-off-by: Pratyush Yadav <p.yadav@ti.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211109181911.2251-2-p.yadav@ti.comSigned-off-by: Mark Brown <broonie@kernel.org>

There is no user of the enable_loopback member in the struct pxa2xx_spi_chip.
Remote this legacy member completely.

The mentioned in the documentation the testing phase can be performed with
spidev_test tool.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211123192723.44537-3-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Since the last user of the custom ->cs_control() gone, we may get rid of
this legacy API completely.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211123192723.44537-2-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

SPI PXA2xx driver supports GPIO chipselect by querying for known
GPIO connection ID. Replace custom ->cs_control() by GPIO table,
so the driver will use generic approach on this platform.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211123192723.44537-1-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

Use devm alloc call to allocate memory for spi controller data and
remove free calls from cleanup.
Signed-off-by: Krishna Yarlagadda <kyarlagadda@nvidia.com>
Link: https://lore.kernel.org/r/1637834152-32093-1-git-send-email-kyarlagadda@nvidia.comSigned-off-by: Mark Brown <broonie@kernel.org>

The 'direction' member of 'struct dma_slave_config' is deprecated.
Instead, drivers should use the direction argument to the
device_prep_slave_sg and device_prep_dma_cyclic functions or the
dir field in the dma_interleaved_template structure.
spi-atmel uses the direction argument to dmaengine_prep_slave_sg.
slave_config.direction is not used in neither of the DMA controller
drivers (at_h/xdmac) that spi-atmel is using, we can just remove the
setting of slave_config.direction and live with whatever stack value
is there.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20211125124110.838037-3-tudor.ambarus@microchip.comSigned-off-by: Mark Brown <broonie@kernel.org>

The callers passed a pointer to slave_config as an argument of
atmel_spi_dma_slave_config(), but they did not use it afterwards.
Use instead a local variable in atmel_spi_dma_slave_config(), and
stop passing arguments that are not needed in the callers.
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20211125124110.838037-2-tudor.ambarus@microchip.comSigned-off-by: Mark Brown <broonie@kernel.org>

Check if the transfer parameters have changed from previous settings
before applying new parameters.
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Link: https://lore.kernel.org/r/20211124193353.32311-3-kdasu.kdev@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

Check requested speed for a given transfer before setting
27MHz or 108Mhz sysclk on SoCs that support both. This way
for baud rates below 212Khz we can use 27Mhz clock.
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Link: https://lore.kernel.org/r/20211124193353.32311-2-kdasu.kdev@gmail.comSigned-off-by: Mark Brown <broonie@kernel.org>

The recent commit 3f076575 ("spi: deduplicate spi_match_id()
in __spi_register_driver()") inadvertently inverted a condition
that provokes a (harmless) warning:

  WARNING KERN SPI driver mtd_dataflash has no spi_device_id for atmel,at45

Restore logic to avoid such warning to be issued.

Fixes: 3f076575 ("spi: deduplicate spi_match_id() in __spi_register_driver()")
Reported-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20211123170034.41253-1-andriy.shevchenko@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>