USB: OHCI: Fix race between ED unlink and URB submission
[pandora-kernel.git] / drivers / spi / spidev.c
1 /*
2  * Simple synchronous userspace interface to SPI devices
3  *
4  * Copyright (C) 2006 SWAPP
5  *      Andrea Paterniani <a.paterniani@swapp-eng.it>
6  * Copyright (C) 2007 David Brownell (simplification, cleanup)
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21  */
22
23 #include <linux/init.h>
24 #include <linux/module.h>
25 #include <linux/ioctl.h>
26 #include <linux/fs.h>
27 #include <linux/device.h>
28 #include <linux/err.h>
29 #include <linux/list.h>
30 #include <linux/errno.h>
31 #include <linux/mutex.h>
32 #include <linux/slab.h>
33 #include <linux/compat.h>
34
35 #include <linux/spi/spi.h>
36 #include <linux/spi/spidev.h>
37
38 #include <asm/uaccess.h>
39
40
41 /*
42  * This supports access to SPI devices using normal userspace I/O calls.
43  * Note that while traditional UNIX/POSIX I/O semantics are half duplex,
44  * and often mask message boundaries, full SPI support requires full duplex
45  * transfers.  There are several kinds of internal message boundaries to
46  * handle chipselect management and other protocol options.
47  *
48  * SPI has a character major number assigned.  We allocate minor numbers
49  * dynamically using a bitmask.  You must use hotplug tools, such as udev
50  * (or mdev with busybox) to create and destroy the /dev/spidevB.C device
51  * nodes, since there is no fixed association of minor numbers with any
52  * particular SPI bus or device.
53  */
54 #define SPIDEV_MAJOR                    153     /* assigned */
55 #define N_SPI_MINORS                    32      /* ... up to 256 */
56
57 static DECLARE_BITMAP(minors, N_SPI_MINORS);
58
59
60 /* Bit masks for spi_device.mode management.  Note that incorrect
61  * settings for some settings can cause *lots* of trouble for other
62  * devices on a shared bus:
63  *
64  *  - CS_HIGH ... this device will be active when it shouldn't be
65  *  - 3WIRE ... when active, it won't behave as it should
66  *  - NO_CS ... there will be no explicit message boundaries; this
67  *      is completely incompatible with the shared bus model
68  *  - READY ... transfers may proceed when they shouldn't.
69  *
70  * REVISIT should changing those flags be privileged?
71  */
72 #define SPI_MODE_MASK           (SPI_CPHA | SPI_CPOL | SPI_CS_HIGH \
73                                 | SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP \
74                                 | SPI_NO_CS | SPI_READY)
75
76 struct spidev_data {
77         dev_t                   devt;
78         spinlock_t              spi_lock;
79         struct spi_device       *spi;
80         struct list_head        device_entry;
81
82         /* buffer is NULL unless this device is open (users > 0) */
83         struct mutex            buf_lock;
84         unsigned                users;
85         u8                      *buffer;
86 };
87
88 static LIST_HEAD(device_list);
89 static DEFINE_MUTEX(device_list_lock);
90
91 static unsigned bufsiz = 4096;
92 module_param(bufsiz, uint, S_IRUGO);
93 MODULE_PARM_DESC(bufsiz, "data bytes in biggest supported SPI message");
94
95 /*-------------------------------------------------------------------------*/
96
97 /*
98  * We can't use the standard synchronous wrappers for file I/O; we
99  * need to protect against async removal of the underlying spi_device.
100  */
101 static void spidev_complete(void *arg)
102 {
103         complete(arg);
104 }
105
106 static ssize_t
107 spidev_sync(struct spidev_data *spidev, struct spi_message *message)
108 {
109         DECLARE_COMPLETION_ONSTACK(done);
110         int status;
111
112         message->complete = spidev_complete;
113         message->context = &done;
114
115         spin_lock_irq(&spidev->spi_lock);
116         if (spidev->spi == NULL)
117                 status = -ESHUTDOWN;
118         else
119                 status = spi_async(spidev->spi, message);
120         spin_unlock_irq(&spidev->spi_lock);
121
122         if (status == 0) {
123                 wait_for_completion(&done);
124                 status = message->status;
125                 if (status == 0)
126                         status = message->actual_length;
127         }
128         return status;
129 }
130
131 static inline ssize_t
132 spidev_sync_write(struct spidev_data *spidev, size_t len)
133 {
134         struct spi_transfer     t = {
135                         .tx_buf         = spidev->buffer,
136                         .len            = len,
137                 };
138         struct spi_message      m;
139
140         spi_message_init(&m);
141         spi_message_add_tail(&t, &m);
142         return spidev_sync(spidev, &m);
143 }
144
145 static inline ssize_t
146 spidev_sync_read(struct spidev_data *spidev, size_t len)
147 {
148         struct spi_transfer     t = {
149                         .rx_buf         = spidev->buffer,
150                         .len            = len,
151                 };
152         struct spi_message      m;
153
154         spi_message_init(&m);
155         spi_message_add_tail(&t, &m);
156         return spidev_sync(spidev, &m);
157 }
158
159 /*-------------------------------------------------------------------------*/
160
161 /* Read-only message with current device setup */
162 static ssize_t
163 spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
164 {
165         struct spidev_data      *spidev;
166         ssize_t                 status = 0;
167
168         /* chipselect only toggles at start or end of operation */
169         if (count > bufsiz)
170                 return -EMSGSIZE;
171
172         spidev = filp->private_data;
173
174         mutex_lock(&spidev->buf_lock);
175         status = spidev_sync_read(spidev, count);
176         if (status > 0) {
177                 unsigned long   missing;
178
179                 missing = copy_to_user(buf, spidev->buffer, status);
180                 if (missing == status)
181                         status = -EFAULT;
182                 else
183                         status = status - missing;
184         }
185         mutex_unlock(&spidev->buf_lock);
186
187         return status;
188 }
189
190 /* Write-only message with current device setup */
191 static ssize_t
192 spidev_write(struct file *filp, const char __user *buf,
193                 size_t count, loff_t *f_pos)
194 {
195         struct spidev_data      *spidev;
196         ssize_t                 status = 0;
197         unsigned long           missing;
198
199         /* chipselect only toggles at start or end of operation */
200         if (count > bufsiz)
201                 return -EMSGSIZE;
202
203         spidev = filp->private_data;
204
205         mutex_lock(&spidev->buf_lock);
206         missing = copy_from_user(spidev->buffer, buf, count);
207         if (missing == 0) {
208                 status = spidev_sync_write(spidev, count);
209         } else
210                 status = -EFAULT;
211         mutex_unlock(&spidev->buf_lock);
212
213         return status;
214 }
215
216 static int spidev_message(struct spidev_data *spidev,
217                 struct spi_ioc_transfer *u_xfers, unsigned n_xfers)
218 {
219         struct spi_message      msg;
220         struct spi_transfer     *k_xfers;
221         struct spi_transfer     *k_tmp;
222         struct spi_ioc_transfer *u_tmp;
223         unsigned                n, total;
224         u8                      *buf;
225         int                     status = -EFAULT;
226
227         spi_message_init(&msg);
228         k_xfers = kcalloc(n_xfers, sizeof(*k_tmp), GFP_KERNEL);
229         if (k_xfers == NULL)
230                 return -ENOMEM;
231
232         /* Construct spi_message, copying any tx data to bounce buffer.
233          * We walk the array of user-provided transfers, using each one
234          * to initialize a kernel version of the same transfer.
235          */
236         buf = spidev->buffer;
237         total = 0;
238         for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
239                         n;
240                         n--, k_tmp++, u_tmp++) {
241                 k_tmp->len = u_tmp->len;
242
243                 total += k_tmp->len;
244                 /* Check total length of transfers.  Also check each
245                  * transfer length to avoid arithmetic overflow.
246                  */
247                 if (total > bufsiz || k_tmp->len > bufsiz) {
248                         status = -EMSGSIZE;
249                         goto done;
250                 }
251
252                 if (u_tmp->rx_buf) {
253                         k_tmp->rx_buf = buf;
254                         if (!access_ok(VERIFY_WRITE, (u8 __user *)
255                                                 (uintptr_t) u_tmp->rx_buf,
256                                                 u_tmp->len))
257                                 goto done;
258                 }
259                 if (u_tmp->tx_buf) {
260                         k_tmp->tx_buf = buf;
261                         if (copy_from_user(buf, (const u8 __user *)
262                                                 (uintptr_t) u_tmp->tx_buf,
263                                         u_tmp->len))
264                                 goto done;
265                 }
266                 buf += k_tmp->len;
267
268                 k_tmp->cs_change = !!u_tmp->cs_change;
269                 k_tmp->bits_per_word = u_tmp->bits_per_word;
270                 k_tmp->delay_usecs = u_tmp->delay_usecs;
271                 k_tmp->speed_hz = u_tmp->speed_hz;
272 #ifdef VERBOSE
273                 dev_dbg(&spidev->spi->dev,
274                         "  xfer len %zd %s%s%s%dbits %u usec %uHz\n",
275                         u_tmp->len,
276                         u_tmp->rx_buf ? "rx " : "",
277                         u_tmp->tx_buf ? "tx " : "",
278                         u_tmp->cs_change ? "cs " : "",
279                         u_tmp->bits_per_word ? : spidev->spi->bits_per_word,
280                         u_tmp->delay_usecs,
281                         u_tmp->speed_hz ? : spidev->spi->max_speed_hz);
282 #endif
283                 spi_message_add_tail(k_tmp, &msg);
284         }
285
286         status = spidev_sync(spidev, &msg);
287         if (status < 0)
288                 goto done;
289
290         /* copy any rx data out of bounce buffer */
291         buf = spidev->buffer;
292         for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
293                 if (u_tmp->rx_buf) {
294                         if (__copy_to_user((u8 __user *)
295                                         (uintptr_t) u_tmp->rx_buf, buf,
296                                         u_tmp->len)) {
297                                 status = -EFAULT;
298                                 goto done;
299                         }
300                 }
301                 buf += u_tmp->len;
302         }
303         status = total;
304
305 done:
306         kfree(k_xfers);
307         return status;
308 }
309
310 static long
311 spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
312 {
313         int                     err = 0;
314         int                     retval = 0;
315         struct spidev_data      *spidev;
316         struct spi_device       *spi;
317         u32                     tmp;
318         unsigned                n_ioc;
319         struct spi_ioc_transfer *ioc;
320
321         /* Check type and command number */
322         if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)
323                 return -ENOTTY;
324
325         /* Check access direction once here; don't repeat below.
326          * IOC_DIR is from the user perspective, while access_ok is
327          * from the kernel perspective; so they look reversed.
328          */
329         if (_IOC_DIR(cmd) & _IOC_READ)
330                 err = !access_ok(VERIFY_WRITE,
331                                 (void __user *)arg, _IOC_SIZE(cmd));
332         if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)
333                 err = !access_ok(VERIFY_READ,
334                                 (void __user *)arg, _IOC_SIZE(cmd));
335         if (err)
336                 return -EFAULT;
337
338         /* guard against device removal before, or while,
339          * we issue this ioctl.
340          */
341         spidev = filp->private_data;
342         spin_lock_irq(&spidev->spi_lock);
343         spi = spi_dev_get(spidev->spi);
344         spin_unlock_irq(&spidev->spi_lock);
345
346         if (spi == NULL)
347                 return -ESHUTDOWN;
348
349         /* use the buffer lock here for triple duty:
350          *  - prevent I/O (from us) so calling spi_setup() is safe;
351          *  - prevent concurrent SPI_IOC_WR_* from morphing
352          *    data fields while SPI_IOC_RD_* reads them;
353          *  - SPI_IOC_MESSAGE needs the buffer locked "normally".
354          */
355         mutex_lock(&spidev->buf_lock);
356
357         switch (cmd) {
358         /* read requests */
359         case SPI_IOC_RD_MODE:
360                 retval = __put_user(spi->mode & SPI_MODE_MASK,
361                                         (__u8 __user *)arg);
362                 break;
363         case SPI_IOC_RD_LSB_FIRST:
364                 retval = __put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,
365                                         (__u8 __user *)arg);
366                 break;
367         case SPI_IOC_RD_BITS_PER_WORD:
368                 retval = __put_user(spi->bits_per_word, (__u8 __user *)arg);
369                 break;
370         case SPI_IOC_RD_MAX_SPEED_HZ:
371                 retval = __put_user(spi->max_speed_hz, (__u32 __user *)arg);
372                 break;
373
374         /* write requests */
375         case SPI_IOC_WR_MODE:
376                 retval = __get_user(tmp, (u8 __user *)arg);
377                 if (retval == 0) {
378                         u8      save = spi->mode;
379
380                         if (tmp & ~SPI_MODE_MASK) {
381                                 retval = -EINVAL;
382                                 break;
383                         }
384
385                         tmp |= spi->mode & ~SPI_MODE_MASK;
386                         spi->mode = (u8)tmp;
387                         retval = spi_setup(spi);
388                         if (retval < 0)
389                                 spi->mode = save;
390                         else
391                                 dev_dbg(&spi->dev, "spi mode %02x\n", tmp);
392                 }
393                 break;
394         case SPI_IOC_WR_LSB_FIRST:
395                 retval = __get_user(tmp, (__u8 __user *)arg);
396                 if (retval == 0) {
397                         u8      save = spi->mode;
398
399                         if (tmp)
400                                 spi->mode |= SPI_LSB_FIRST;
401                         else
402                                 spi->mode &= ~SPI_LSB_FIRST;
403                         retval = spi_setup(spi);
404                         if (retval < 0)
405                                 spi->mode = save;
406                         else
407                                 dev_dbg(&spi->dev, "%csb first\n",
408                                                 tmp ? 'l' : 'm');
409                 }
410                 break;
411         case SPI_IOC_WR_BITS_PER_WORD:
412                 retval = __get_user(tmp, (__u8 __user *)arg);
413                 if (retval == 0) {
414                         u8      save = spi->bits_per_word;
415
416                         spi->bits_per_word = tmp;
417                         retval = spi_setup(spi);
418                         if (retval < 0)
419                                 spi->bits_per_word = save;
420                         else
421                                 dev_dbg(&spi->dev, "%d bits per word\n", tmp);
422                 }
423                 break;
424         case SPI_IOC_WR_MAX_SPEED_HZ:
425                 retval = __get_user(tmp, (__u32 __user *)arg);
426                 if (retval == 0) {
427                         u32     save = spi->max_speed_hz;
428
429                         spi->max_speed_hz = tmp;
430                         retval = spi_setup(spi);
431                         if (retval < 0)
432                                 spi->max_speed_hz = save;
433                         else
434                                 dev_dbg(&spi->dev, "%d Hz (max)\n", tmp);
435                 }
436                 break;
437
438         default:
439                 /* segmented and/or full-duplex I/O request */
440                 if (_IOC_NR(cmd) != _IOC_NR(SPI_IOC_MESSAGE(0))
441                                 || _IOC_DIR(cmd) != _IOC_WRITE) {
442                         retval = -ENOTTY;
443                         break;
444                 }
445
446                 tmp = _IOC_SIZE(cmd);
447                 if ((tmp % sizeof(struct spi_ioc_transfer)) != 0) {
448                         retval = -EINVAL;
449                         break;
450                 }
451                 n_ioc = tmp / sizeof(struct spi_ioc_transfer);
452                 if (n_ioc == 0)
453                         break;
454
455                 /* copy into scratch area */
456                 ioc = kmalloc(tmp, GFP_KERNEL);
457                 if (!ioc) {
458                         retval = -ENOMEM;
459                         break;
460                 }
461                 if (__copy_from_user(ioc, (void __user *)arg, tmp)) {
462                         kfree(ioc);
463                         retval = -EFAULT;
464                         break;
465                 }
466
467                 /* translate to spi_message, execute */
468                 retval = spidev_message(spidev, ioc, n_ioc);
469                 kfree(ioc);
470                 break;
471         }
472
473         mutex_unlock(&spidev->buf_lock);
474         spi_dev_put(spi);
475         return retval;
476 }
477
478 #ifdef CONFIG_COMPAT
479 static long
480 spidev_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
481 {
482         return spidev_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
483 }
484 #else
485 #define spidev_compat_ioctl NULL
486 #endif /* CONFIG_COMPAT */
487
488 static int spidev_open(struct inode *inode, struct file *filp)
489 {
490         struct spidev_data      *spidev;
491         int                     status = -ENXIO;
492
493         mutex_lock(&device_list_lock);
494
495         list_for_each_entry(spidev, &device_list, device_entry) {
496                 if (spidev->devt == inode->i_rdev) {
497                         status = 0;
498                         break;
499                 }
500         }
501         if (status == 0) {
502                 if (!spidev->buffer) {
503                         spidev->buffer = kmalloc(bufsiz, GFP_KERNEL);
504                         if (!spidev->buffer) {
505                                 dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
506                                 status = -ENOMEM;
507                         }
508                 }
509                 if (status == 0) {
510                         spidev->users++;
511                         filp->private_data = spidev;
512                         nonseekable_open(inode, filp);
513                 }
514         } else
515                 pr_debug("spidev: nothing for minor %d\n", iminor(inode));
516
517         mutex_unlock(&device_list_lock);
518         return status;
519 }
520
521 static int spidev_release(struct inode *inode, struct file *filp)
522 {
523         struct spidev_data      *spidev;
524         int                     status = 0;
525
526         mutex_lock(&device_list_lock);
527         spidev = filp->private_data;
528         filp->private_data = NULL;
529
530         /* last close? */
531         spidev->users--;
532         if (!spidev->users) {
533                 int             dofree;
534
535                 kfree(spidev->buffer);
536                 spidev->buffer = NULL;
537
538                 /* ... after we unbound from the underlying device? */
539                 spin_lock_irq(&spidev->spi_lock);
540                 dofree = (spidev->spi == NULL);
541                 spin_unlock_irq(&spidev->spi_lock);
542
543                 if (dofree)
544                         kfree(spidev);
545         }
546         mutex_unlock(&device_list_lock);
547
548         return status;
549 }
550
551 static const struct file_operations spidev_fops = {
552         .owner =        THIS_MODULE,
553         /* REVISIT switch to aio primitives, so that userspace
554          * gets more complete API coverage.  It'll simplify things
555          * too, except for the locking.
556          */
557         .write =        spidev_write,
558         .read =         spidev_read,
559         .unlocked_ioctl = spidev_ioctl,
560         .compat_ioctl = spidev_compat_ioctl,
561         .open =         spidev_open,
562         .release =      spidev_release,
563         .llseek =       no_llseek,
564 };
565
566 /*-------------------------------------------------------------------------*/
567
568 /* The main reason to have this class is to make mdev/udev create the
569  * /dev/spidevB.C character device nodes exposing our userspace API.
570  * It also simplifies memory management.
571  */
572
573 static struct class *spidev_class;
574
575 /*-------------------------------------------------------------------------*/
576
577 static int __devinit spidev_probe(struct spi_device *spi)
578 {
579         struct spidev_data      *spidev;
580         int                     status;
581         unsigned long           minor;
582
583         /* Allocate driver data */
584         spidev = kzalloc(sizeof(*spidev), GFP_KERNEL);
585         if (!spidev)
586                 return -ENOMEM;
587
588         /* Initialize the driver data */
589         spidev->spi = spi;
590         spin_lock_init(&spidev->spi_lock);
591         mutex_init(&spidev->buf_lock);
592
593         INIT_LIST_HEAD(&spidev->device_entry);
594
595         /* If we can allocate a minor number, hook up this device.
596          * Reusing minors is fine so long as udev or mdev is working.
597          */
598         mutex_lock(&device_list_lock);
599         minor = find_first_zero_bit(minors, N_SPI_MINORS);
600         if (minor < N_SPI_MINORS) {
601                 struct device *dev;
602
603                 spidev->devt = MKDEV(SPIDEV_MAJOR, minor);
604                 dev = device_create(spidev_class, &spi->dev, spidev->devt,
605                                     spidev, "spidev%d.%d",
606                                     spi->master->bus_num, spi->chip_select);
607                 status = IS_ERR(dev) ? PTR_ERR(dev) : 0;
608         } else {
609                 dev_dbg(&spi->dev, "no minor number available!\n");
610                 status = -ENODEV;
611         }
612         if (status == 0) {
613                 set_bit(minor, minors);
614                 list_add(&spidev->device_entry, &device_list);
615         }
616         mutex_unlock(&device_list_lock);
617
618         if (status == 0)
619                 spi_set_drvdata(spi, spidev);
620         else
621                 kfree(spidev);
622
623         return status;
624 }
625
626 static int __devexit spidev_remove(struct spi_device *spi)
627 {
628         struct spidev_data      *spidev = spi_get_drvdata(spi);
629
630         /* make sure ops on existing fds can abort cleanly */
631         spin_lock_irq(&spidev->spi_lock);
632         spidev->spi = NULL;
633         spi_set_drvdata(spi, NULL);
634         spin_unlock_irq(&spidev->spi_lock);
635
636         /* prevent new opens */
637         mutex_lock(&device_list_lock);
638         list_del(&spidev->device_entry);
639         device_destroy(spidev_class, spidev->devt);
640         clear_bit(MINOR(spidev->devt), minors);
641         if (spidev->users == 0)
642                 kfree(spidev);
643         mutex_unlock(&device_list_lock);
644
645         return 0;
646 }
647
648 static struct spi_driver spidev_spi_driver = {
649         .driver = {
650                 .name =         "spidev",
651                 .owner =        THIS_MODULE,
652         },
653         .probe =        spidev_probe,
654         .remove =       __devexit_p(spidev_remove),
655
656         /* NOTE:  suspend/resume methods are not necessary here.
657          * We don't do anything except pass the requests to/from
658          * the underlying controller.  The refrigerator handles
659          * most issues; the controller driver handles the rest.
660          */
661 };
662
663 /*-------------------------------------------------------------------------*/
664
665 static int __init spidev_init(void)
666 {
667         int status;
668
669         /* Claim our 256 reserved device numbers.  Then register a class
670          * that will key udev/mdev to add/remove /dev nodes.  Last, register
671          * the driver which manages those device numbers.
672          */
673         BUILD_BUG_ON(N_SPI_MINORS > 256);
674         status = register_chrdev(SPIDEV_MAJOR, "spi", &spidev_fops);
675         if (status < 0)
676                 return status;
677
678         spidev_class = class_create(THIS_MODULE, "spidev");
679         if (IS_ERR(spidev_class)) {
680                 unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
681                 return PTR_ERR(spidev_class);
682         }
683
684         status = spi_register_driver(&spidev_spi_driver);
685         if (status < 0) {
686                 class_destroy(spidev_class);
687                 unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
688         }
689         return status;
690 }
691 module_init(spidev_init);
692
693 static void __exit spidev_exit(void)
694 {
695         spi_unregister_driver(&spidev_spi_driver);
696         class_destroy(spidev_class);
697         unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
698 }
699 module_exit(spidev_exit);
700
701 MODULE_AUTHOR("Andrea Paterniani, <a.paterniani@swapp-eng.it>");
702 MODULE_DESCRIPTION("User mode SPI device interface");
703 MODULE_LICENSE("GPL");
704 MODULE_ALIAS("spi:spidev");