aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/spi
diff options
context:
space:
mode:
authorNed Forrester <nforrester@whoi.edu>2008-11-19 18:36:21 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2008-11-19 21:49:58 -0500
commit393df744e056ba24e9531d0657d09fc3c7c0dd22 (patch)
treef52cbc0c769e308a777abd136006e580fa8194a4 /drivers/spi
parentf652c521e0bec2e70cf123f47e80117a7e6ed139 (diff)
pxa2xx_spi: bugfix full duplex dma data corruption
Fixes a data corruption bug in pxa2xx_spi.c when operating in full duplex mode with DMA and using buffers that overlap. SPI transmit and receive buffers are allowed to be the same or to overlap. However, this driver fails if such overlap is attempted in DMA mode because it maps the rx and tx buffers in the wrong order. By mapping DMA_FROM_DEVICE (read) before DMA_TO_DEVICE (write), it invalidates the cache before flushing it, thus discarding data which should have been transmitted. The patch corrects the order of mapping. This bug exists in all versions of pxa2xx_spi.c; similar bugs are in the drivers for two other SPI controllers (au1500, imx). A version of this patch has been tested on kernel 2.6.20 using verification of loopback data with: random transfer length, random bits-per-word, random positive offsets (both larger and smaller than transfer length) between the start of the rx and tx buffers, and varying clock rates. Signed-off-by: Ned Forrester <nforrester@whoi.edu> Cc: Vernon Sauder <vernoninhand@gmail.com> Cc: J. Scott Merritt <merrij3@rpi.edu> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Cc: <stable@kernel.org> [2.6.27.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/pxa2xx_spi.c24
1 files changed, 12 insertions, 12 deletions
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index dae87b1a4c6e..cf12f2d84be2 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -352,21 +352,21 @@ static int map_dma_buffers(struct driver_data *drv_data)
352 } else 352 } else
353 drv_data->tx_map_len = drv_data->len; 353 drv_data->tx_map_len = drv_data->len;
354 354
355 /* Stream map the rx buffer */ 355 /* Stream map the tx buffer. Always do DMA_TO_DEVICE first
356 drv_data->rx_dma = dma_map_single(dev, drv_data->rx, 356 * so we flush the cache *before* invalidating it, in case
357 drv_data->rx_map_len, 357 * the tx and rx buffers overlap.
358 DMA_FROM_DEVICE); 358 */
359 if (dma_mapping_error(dev, drv_data->rx_dma))
360 return 0;
361
362 /* Stream map the tx buffer */
363 drv_data->tx_dma = dma_map_single(dev, drv_data->tx, 359 drv_data->tx_dma = dma_map_single(dev, drv_data->tx,
364 drv_data->tx_map_len, 360 drv_data->tx_map_len, DMA_TO_DEVICE);
365 DMA_TO_DEVICE); 361 if (dma_mapping_error(dev, drv_data->tx_dma))
362 return 0;
366 363
367 if (dma_mapping_error(dev, drv_data->tx_dma)) { 364 /* Stream map the rx buffer */
368 dma_unmap_single(dev, drv_data->rx_dma, 365 drv_data->rx_dma = dma_map_single(dev, drv_data->rx,
369 drv_data->rx_map_len, DMA_FROM_DEVICE); 366 drv_data->rx_map_len, DMA_FROM_DEVICE);
367 if (dma_mapping_error(dev, drv_data->rx_dma)) {
368 dma_unmap_single(dev, drv_data->tx_dma,
369 drv_data->tx_map_len, DMA_TO_DEVICE);
370 return 0; 370 return 0;
371 } 371 }
372 372