xref: /linux/drivers/spi/spidev.c (revision c0e297dc61f8d4453e07afbea1fa8d0e67cd4a34)
1 /*
2  * Simple synchronous userspace interface to SPI devices
3  *
4  * Copyright (C) 2006 SWAPP
5  *	Andrea Paterniani <a.paterniani@swapp-eng.it>
6  * Copyright (C) 2007 David Brownell (simplification, cleanup)
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  */
18 
19 #include <linux/init.h>
20 #include <linux/module.h>
21 #include <linux/ioctl.h>
22 #include <linux/fs.h>
23 #include <linux/device.h>
24 #include <linux/err.h>
25 #include <linux/list.h>
26 #include <linux/errno.h>
27 #include <linux/mutex.h>
28 #include <linux/slab.h>
29 #include <linux/compat.h>
30 #include <linux/of.h>
31 #include <linux/of_device.h>
32 
33 #include <linux/spi/spi.h>
34 #include <linux/spi/spidev.h>
35 
36 #include <linux/uaccess.h>
37 
38 
39 /*
40  * This supports access to SPI devices using normal userspace I/O calls.
41  * Note that while traditional UNIX/POSIX I/O semantics are half duplex,
42  * and often mask message boundaries, full SPI support requires full duplex
43  * transfers.  There are several kinds of internal message boundaries to
44  * handle chipselect management and other protocol options.
45  *
46  * SPI has a character major number assigned.  We allocate minor numbers
47  * dynamically using a bitmask.  You must use hotplug tools, such as udev
48  * (or mdev with busybox) to create and destroy the /dev/spidevB.C device
49  * nodes, since there is no fixed association of minor numbers with any
50  * particular SPI bus or device.
51  */
52 #define SPIDEV_MAJOR			153	/* assigned */
53 #define N_SPI_MINORS			32	/* ... up to 256 */
54 
55 static DECLARE_BITMAP(minors, N_SPI_MINORS);
56 
57 
58 /* Bit masks for spi_device.mode management.  Note that incorrect
59  * settings for some settings can cause *lots* of trouble for other
60  * devices on a shared bus:
61  *
62  *  - CS_HIGH ... this device will be active when it shouldn't be
63  *  - 3WIRE ... when active, it won't behave as it should
64  *  - NO_CS ... there will be no explicit message boundaries; this
65  *	is completely incompatible with the shared bus model
66  *  - READY ... transfers may proceed when they shouldn't.
67  *
68  * REVISIT should changing those flags be privileged?
69  */
70 #define SPI_MODE_MASK		(SPI_CPHA | SPI_CPOL | SPI_CS_HIGH \
71 				| SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP \
72 				| SPI_NO_CS | SPI_READY | SPI_TX_DUAL \
73 				| SPI_TX_QUAD | SPI_RX_DUAL | SPI_RX_QUAD)
74 
75 struct spidev_data {
76 	dev_t			devt;
77 	spinlock_t		spi_lock;
78 	struct spi_device	*spi;
79 	struct list_head	device_entry;
80 
81 	/* TX/RX buffers are NULL unless this device is open (users > 0) */
82 	struct mutex		buf_lock;
83 	unsigned		users;
84 	u8			*tx_buffer;
85 	u8			*rx_buffer;
86 	u32			speed_hz;
87 };
88 
89 static LIST_HEAD(device_list);
90 static DEFINE_MUTEX(device_list_lock);
91 
92 static unsigned bufsiz = 4096;
93 module_param(bufsiz, uint, S_IRUGO);
94 MODULE_PARM_DESC(bufsiz, "data bytes in biggest supported SPI message");
95 
96 /*-------------------------------------------------------------------------*/
97 
98 static ssize_t
99 spidev_sync(struct spidev_data *spidev, struct spi_message *message)
100 {
101 	DECLARE_COMPLETION_ONSTACK(done);
102 	int status;
103 	struct spi_device *spi;
104 
105 	spin_lock_irq(&spidev->spi_lock);
106 	spi = spidev->spi;
107 	spin_unlock_irq(&spidev->spi_lock);
108 
109 	if (spi == NULL)
110 		status = -ESHUTDOWN;
111 	else
112 		status = spi_sync(spi, message);
113 
114 	if (status == 0)
115 		status = message->actual_length;
116 
117 	return status;
118 }
119 
120 static inline ssize_t
121 spidev_sync_write(struct spidev_data *spidev, size_t len)
122 {
123 	struct spi_transfer	t = {
124 			.tx_buf		= spidev->tx_buffer,
125 			.len		= len,
126 			.speed_hz	= spidev->speed_hz,
127 		};
128 	struct spi_message	m;
129 
130 	spi_message_init(&m);
131 	spi_message_add_tail(&t, &m);
132 	return spidev_sync(spidev, &m);
133 }
134 
135 static inline ssize_t
136 spidev_sync_read(struct spidev_data *spidev, size_t len)
137 {
138 	struct spi_transfer	t = {
139 			.rx_buf		= spidev->rx_buffer,
140 			.len		= len,
141 			.speed_hz	= spidev->speed_hz,
142 		};
143 	struct spi_message	m;
144 
145 	spi_message_init(&m);
146 	spi_message_add_tail(&t, &m);
147 	return spidev_sync(spidev, &m);
148 }
149 
150 /*-------------------------------------------------------------------------*/
151 
152 /* Read-only message with current device setup */
153 static ssize_t
154 spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
155 {
156 	struct spidev_data	*spidev;
157 	ssize_t			status = 0;
158 
159 	/* chipselect only toggles at start or end of operation */
160 	if (count > bufsiz)
161 		return -EMSGSIZE;
162 
163 	spidev = filp->private_data;
164 
165 	mutex_lock(&spidev->buf_lock);
166 	status = spidev_sync_read(spidev, count);
167 	if (status > 0) {
168 		unsigned long	missing;
169 
170 		missing = copy_to_user(buf, spidev->rx_buffer, status);
171 		if (missing == status)
172 			status = -EFAULT;
173 		else
174 			status = status - missing;
175 	}
176 	mutex_unlock(&spidev->buf_lock);
177 
178 	return status;
179 }
180 
181 /* Write-only message with current device setup */
182 static ssize_t
183 spidev_write(struct file *filp, const char __user *buf,
184 		size_t count, loff_t *f_pos)
185 {
186 	struct spidev_data	*spidev;
187 	ssize_t			status = 0;
188 	unsigned long		missing;
189 
190 	/* chipselect only toggles at start or end of operation */
191 	if (count > bufsiz)
192 		return -EMSGSIZE;
193 
194 	spidev = filp->private_data;
195 
196 	mutex_lock(&spidev->buf_lock);
197 	missing = copy_from_user(spidev->tx_buffer, buf, count);
198 	if (missing == 0)
199 		status = spidev_sync_write(spidev, count);
200 	else
201 		status = -EFAULT;
202 	mutex_unlock(&spidev->buf_lock);
203 
204 	return status;
205 }
206 
207 static int spidev_message(struct spidev_data *spidev,
208 		struct spi_ioc_transfer *u_xfers, unsigned n_xfers)
209 {
210 	struct spi_message	msg;
211 	struct spi_transfer	*k_xfers;
212 	struct spi_transfer	*k_tmp;
213 	struct spi_ioc_transfer *u_tmp;
214 	unsigned		n, total, tx_total, rx_total;
215 	u8			*tx_buf, *rx_buf;
216 	int			status = -EFAULT;
217 
218 	spi_message_init(&msg);
219 	k_xfers = kcalloc(n_xfers, sizeof(*k_tmp), GFP_KERNEL);
220 	if (k_xfers == NULL)
221 		return -ENOMEM;
222 
223 	/* Construct spi_message, copying any tx data to bounce buffer.
224 	 * We walk the array of user-provided transfers, using each one
225 	 * to initialize a kernel version of the same transfer.
226 	 */
227 	tx_buf = spidev->tx_buffer;
228 	rx_buf = spidev->rx_buffer;
229 	total = 0;
230 	tx_total = 0;
231 	rx_total = 0;
232 	for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
233 			n;
234 			n--, k_tmp++, u_tmp++) {
235 		k_tmp->len = u_tmp->len;
236 
237 		total += k_tmp->len;
238 		/* Since the function returns the total length of transfers
239 		 * on success, restrict the total to positive int values to
240 		 * avoid the return value looking like an error.  Also check
241 		 * each transfer length to avoid arithmetic overflow.
242 		 */
243 		if (total > INT_MAX || k_tmp->len > INT_MAX) {
244 			status = -EMSGSIZE;
245 			goto done;
246 		}
247 
248 		if (u_tmp->rx_buf) {
249 			/* this transfer needs space in RX bounce buffer */
250 			rx_total += k_tmp->len;
251 			if (rx_total > bufsiz) {
252 				status = -EMSGSIZE;
253 				goto done;
254 			}
255 			k_tmp->rx_buf = rx_buf;
256 			if (!access_ok(VERIFY_WRITE, (u8 __user *)
257 						(uintptr_t) u_tmp->rx_buf,
258 						u_tmp->len))
259 				goto done;
260 			rx_buf += k_tmp->len;
261 		}
262 		if (u_tmp->tx_buf) {
263 			/* this transfer needs space in TX bounce buffer */
264 			tx_total += k_tmp->len;
265 			if (tx_total > bufsiz) {
266 				status = -EMSGSIZE;
267 				goto done;
268 			}
269 			k_tmp->tx_buf = tx_buf;
270 			if (copy_from_user(tx_buf, (const u8 __user *)
271 						(uintptr_t) u_tmp->tx_buf,
272 					u_tmp->len))
273 				goto done;
274 			tx_buf += k_tmp->len;
275 		}
276 
277 		k_tmp->cs_change = !!u_tmp->cs_change;
278 		k_tmp->tx_nbits = u_tmp->tx_nbits;
279 		k_tmp->rx_nbits = u_tmp->rx_nbits;
280 		k_tmp->bits_per_word = u_tmp->bits_per_word;
281 		k_tmp->delay_usecs = u_tmp->delay_usecs;
282 		k_tmp->speed_hz = u_tmp->speed_hz;
283 		if (!k_tmp->speed_hz)
284 			k_tmp->speed_hz = spidev->speed_hz;
285 #ifdef VERBOSE
286 		dev_dbg(&spidev->spi->dev,
287 			"  xfer len %zd %s%s%s%dbits %u usec %uHz\n",
288 			u_tmp->len,
289 			u_tmp->rx_buf ? "rx " : "",
290 			u_tmp->tx_buf ? "tx " : "",
291 			u_tmp->cs_change ? "cs " : "",
292 			u_tmp->bits_per_word ? : spidev->spi->bits_per_word,
293 			u_tmp->delay_usecs,
294 			u_tmp->speed_hz ? : spidev->spi->max_speed_hz);
295 #endif
296 		spi_message_add_tail(k_tmp, &msg);
297 	}
298 
299 	status = spidev_sync(spidev, &msg);
300 	if (status < 0)
301 		goto done;
302 
303 	/* copy any rx data out of bounce buffer */
304 	rx_buf = spidev->rx_buffer;
305 	for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
306 		if (u_tmp->rx_buf) {
307 			if (__copy_to_user((u8 __user *)
308 					(uintptr_t) u_tmp->rx_buf, rx_buf,
309 					u_tmp->len)) {
310 				status = -EFAULT;
311 				goto done;
312 			}
313 			rx_buf += u_tmp->len;
314 		}
315 	}
316 	status = total;
317 
318 done:
319 	kfree(k_xfers);
320 	return status;
321 }
322 
323 static struct spi_ioc_transfer *
324 spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
325 		unsigned *n_ioc)
326 {
327 	struct spi_ioc_transfer	*ioc;
328 	u32	tmp;
329 
330 	/* Check type, command number and direction */
331 	if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC
332 			|| _IOC_NR(cmd) != _IOC_NR(SPI_IOC_MESSAGE(0))
333 			|| _IOC_DIR(cmd) != _IOC_WRITE)
334 		return ERR_PTR(-ENOTTY);
335 
336 	tmp = _IOC_SIZE(cmd);
337 	if ((tmp % sizeof(struct spi_ioc_transfer)) != 0)
338 		return ERR_PTR(-EINVAL);
339 	*n_ioc = tmp / sizeof(struct spi_ioc_transfer);
340 	if (*n_ioc == 0)
341 		return NULL;
342 
343 	/* copy into scratch area */
344 	ioc = kmalloc(tmp, GFP_KERNEL);
345 	if (!ioc)
346 		return ERR_PTR(-ENOMEM);
347 	if (__copy_from_user(ioc, u_ioc, tmp)) {
348 		kfree(ioc);
349 		return ERR_PTR(-EFAULT);
350 	}
351 	return ioc;
352 }
353 
354 static long
355 spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
356 {
357 	int			err = 0;
358 	int			retval = 0;
359 	struct spidev_data	*spidev;
360 	struct spi_device	*spi;
361 	u32			tmp;
362 	unsigned		n_ioc;
363 	struct spi_ioc_transfer	*ioc;
364 
365 	/* Check type and command number */
366 	if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)
367 		return -ENOTTY;
368 
369 	/* Check access direction once here; don't repeat below.
370 	 * IOC_DIR is from the user perspective, while access_ok is
371 	 * from the kernel perspective; so they look reversed.
372 	 */
373 	if (_IOC_DIR(cmd) & _IOC_READ)
374 		err = !access_ok(VERIFY_WRITE,
375 				(void __user *)arg, _IOC_SIZE(cmd));
376 	if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)
377 		err = !access_ok(VERIFY_READ,
378 				(void __user *)arg, _IOC_SIZE(cmd));
379 	if (err)
380 		return -EFAULT;
381 
382 	/* guard against device removal before, or while,
383 	 * we issue this ioctl.
384 	 */
385 	spidev = filp->private_data;
386 	spin_lock_irq(&spidev->spi_lock);
387 	spi = spi_dev_get(spidev->spi);
388 	spin_unlock_irq(&spidev->spi_lock);
389 
390 	if (spi == NULL)
391 		return -ESHUTDOWN;
392 
393 	/* use the buffer lock here for triple duty:
394 	 *  - prevent I/O (from us) so calling spi_setup() is safe;
395 	 *  - prevent concurrent SPI_IOC_WR_* from morphing
396 	 *    data fields while SPI_IOC_RD_* reads them;
397 	 *  - SPI_IOC_MESSAGE needs the buffer locked "normally".
398 	 */
399 	mutex_lock(&spidev->buf_lock);
400 
401 	switch (cmd) {
402 	/* read requests */
403 	case SPI_IOC_RD_MODE:
404 		retval = __put_user(spi->mode & SPI_MODE_MASK,
405 					(__u8 __user *)arg);
406 		break;
407 	case SPI_IOC_RD_MODE32:
408 		retval = __put_user(spi->mode & SPI_MODE_MASK,
409 					(__u32 __user *)arg);
410 		break;
411 	case SPI_IOC_RD_LSB_FIRST:
412 		retval = __put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,
413 					(__u8 __user *)arg);
414 		break;
415 	case SPI_IOC_RD_BITS_PER_WORD:
416 		retval = __put_user(spi->bits_per_word, (__u8 __user *)arg);
417 		break;
418 	case SPI_IOC_RD_MAX_SPEED_HZ:
419 		retval = __put_user(spidev->speed_hz, (__u32 __user *)arg);
420 		break;
421 
422 	/* write requests */
423 	case SPI_IOC_WR_MODE:
424 	case SPI_IOC_WR_MODE32:
425 		if (cmd == SPI_IOC_WR_MODE)
426 			retval = __get_user(tmp, (u8 __user *)arg);
427 		else
428 			retval = __get_user(tmp, (u32 __user *)arg);
429 		if (retval == 0) {
430 			u32	save = spi->mode;
431 
432 			if (tmp & ~SPI_MODE_MASK) {
433 				retval = -EINVAL;
434 				break;
435 			}
436 
437 			tmp |= spi->mode & ~SPI_MODE_MASK;
438 			spi->mode = (u16)tmp;
439 			retval = spi_setup(spi);
440 			if (retval < 0)
441 				spi->mode = save;
442 			else
443 				dev_dbg(&spi->dev, "spi mode %x\n", tmp);
444 		}
445 		break;
446 	case SPI_IOC_WR_LSB_FIRST:
447 		retval = __get_user(tmp, (__u8 __user *)arg);
448 		if (retval == 0) {
449 			u32	save = spi->mode;
450 
451 			if (tmp)
452 				spi->mode |= SPI_LSB_FIRST;
453 			else
454 				spi->mode &= ~SPI_LSB_FIRST;
455 			retval = spi_setup(spi);
456 			if (retval < 0)
457 				spi->mode = save;
458 			else
459 				dev_dbg(&spi->dev, "%csb first\n",
460 						tmp ? 'l' : 'm');
461 		}
462 		break;
463 	case SPI_IOC_WR_BITS_PER_WORD:
464 		retval = __get_user(tmp, (__u8 __user *)arg);
465 		if (retval == 0) {
466 			u8	save = spi->bits_per_word;
467 
468 			spi->bits_per_word = tmp;
469 			retval = spi_setup(spi);
470 			if (retval < 0)
471 				spi->bits_per_word = save;
472 			else
473 				dev_dbg(&spi->dev, "%d bits per word\n", tmp);
474 		}
475 		break;
476 	case SPI_IOC_WR_MAX_SPEED_HZ:
477 		retval = __get_user(tmp, (__u32 __user *)arg);
478 		if (retval == 0) {
479 			u32	save = spi->max_speed_hz;
480 
481 			spi->max_speed_hz = tmp;
482 			retval = spi_setup(spi);
483 			if (retval >= 0)
484 				spidev->speed_hz = tmp;
485 			else
486 				dev_dbg(&spi->dev, "%d Hz (max)\n", tmp);
487 			spi->max_speed_hz = save;
488 		}
489 		break;
490 
491 	default:
492 		/* segmented and/or full-duplex I/O request */
493 		/* Check message and copy into scratch area */
494 		ioc = spidev_get_ioc_message(cmd,
495 				(struct spi_ioc_transfer __user *)arg, &n_ioc);
496 		if (IS_ERR(ioc)) {
497 			retval = PTR_ERR(ioc);
498 			break;
499 		}
500 		if (!ioc)
501 			break;	/* n_ioc is also 0 */
502 
503 		/* translate to spi_message, execute */
504 		retval = spidev_message(spidev, ioc, n_ioc);
505 		kfree(ioc);
506 		break;
507 	}
508 
509 	mutex_unlock(&spidev->buf_lock);
510 	spi_dev_put(spi);
511 	return retval;
512 }
513 
514 #ifdef CONFIG_COMPAT
515 static long
516 spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
517 		unsigned long arg)
518 {
519 	struct spi_ioc_transfer __user	*u_ioc;
520 	int				retval = 0;
521 	struct spidev_data		*spidev;
522 	struct spi_device		*spi;
523 	unsigned			n_ioc, n;
524 	struct spi_ioc_transfer		*ioc;
525 
526 	u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);
527 	if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))
528 		return -EFAULT;
529 
530 	/* guard against device removal before, or while,
531 	 * we issue this ioctl.
532 	 */
533 	spidev = filp->private_data;
534 	spin_lock_irq(&spidev->spi_lock);
535 	spi = spi_dev_get(spidev->spi);
536 	spin_unlock_irq(&spidev->spi_lock);
537 
538 	if (spi == NULL)
539 		return -ESHUTDOWN;
540 
541 	/* SPI_IOC_MESSAGE needs the buffer locked "normally" */
542 	mutex_lock(&spidev->buf_lock);
543 
544 	/* Check message and copy into scratch area */
545 	ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
546 	if (IS_ERR(ioc)) {
547 		retval = PTR_ERR(ioc);
548 		goto done;
549 	}
550 	if (!ioc)
551 		goto done;	/* n_ioc is also 0 */
552 
553 	/* Convert buffer pointers */
554 	for (n = 0; n < n_ioc; n++) {
555 		ioc[n].rx_buf = (uintptr_t) compat_ptr(ioc[n].rx_buf);
556 		ioc[n].tx_buf = (uintptr_t) compat_ptr(ioc[n].tx_buf);
557 	}
558 
559 	/* translate to spi_message, execute */
560 	retval = spidev_message(spidev, ioc, n_ioc);
561 	kfree(ioc);
562 
563 done:
564 	mutex_unlock(&spidev->buf_lock);
565 	spi_dev_put(spi);
566 	return retval;
567 }
568 
569 static long
570 spidev_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
571 {
572 	if (_IOC_TYPE(cmd) == SPI_IOC_MAGIC
573 			&& _IOC_NR(cmd) == _IOC_NR(SPI_IOC_MESSAGE(0))
574 			&& _IOC_DIR(cmd) == _IOC_WRITE)
575 		return spidev_compat_ioc_message(filp, cmd, arg);
576 
577 	return spidev_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
578 }
579 #else
580 #define spidev_compat_ioctl NULL
581 #endif /* CONFIG_COMPAT */
582 
583 static int spidev_open(struct inode *inode, struct file *filp)
584 {
585 	struct spidev_data	*spidev;
586 	int			status = -ENXIO;
587 
588 	mutex_lock(&device_list_lock);
589 
590 	list_for_each_entry(spidev, &device_list, device_entry) {
591 		if (spidev->devt == inode->i_rdev) {
592 			status = 0;
593 			break;
594 		}
595 	}
596 
597 	if (status) {
598 		pr_debug("spidev: nothing for minor %d\n", iminor(inode));
599 		goto err_find_dev;
600 	}
601 
602 	if (!spidev->tx_buffer) {
603 		spidev->tx_buffer = kmalloc(bufsiz, GFP_KERNEL);
604 		if (!spidev->tx_buffer) {
605 				dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
606 				status = -ENOMEM;
607 			goto err_find_dev;
608 			}
609 		}
610 
611 	if (!spidev->rx_buffer) {
612 		spidev->rx_buffer = kmalloc(bufsiz, GFP_KERNEL);
613 		if (!spidev->rx_buffer) {
614 			dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
615 			status = -ENOMEM;
616 			goto err_alloc_rx_buf;
617 		}
618 	}
619 
620 	spidev->users++;
621 	filp->private_data = spidev;
622 	nonseekable_open(inode, filp);
623 
624 	mutex_unlock(&device_list_lock);
625 	return 0;
626 
627 err_alloc_rx_buf:
628 	kfree(spidev->tx_buffer);
629 	spidev->tx_buffer = NULL;
630 err_find_dev:
631 	mutex_unlock(&device_list_lock);
632 	return status;
633 }
634 
635 static int spidev_release(struct inode *inode, struct file *filp)
636 {
637 	struct spidev_data	*spidev;
638 
639 	mutex_lock(&device_list_lock);
640 	spidev = filp->private_data;
641 	filp->private_data = NULL;
642 
643 	/* last close? */
644 	spidev->users--;
645 	if (!spidev->users) {
646 		int		dofree;
647 
648 		kfree(spidev->tx_buffer);
649 		spidev->tx_buffer = NULL;
650 
651 		kfree(spidev->rx_buffer);
652 		spidev->rx_buffer = NULL;
653 
654 		spidev->speed_hz = spidev->spi->max_speed_hz;
655 
656 		/* ... after we unbound from the underlying device? */
657 		spin_lock_irq(&spidev->spi_lock);
658 		dofree = (spidev->spi == NULL);
659 		spin_unlock_irq(&spidev->spi_lock);
660 
661 		if (dofree)
662 			kfree(spidev);
663 	}
664 	mutex_unlock(&device_list_lock);
665 
666 	return 0;
667 }
668 
669 static const struct file_operations spidev_fops = {
670 	.owner =	THIS_MODULE,
671 	/* REVISIT switch to aio primitives, so that userspace
672 	 * gets more complete API coverage.  It'll simplify things
673 	 * too, except for the locking.
674 	 */
675 	.write =	spidev_write,
676 	.read =		spidev_read,
677 	.unlocked_ioctl = spidev_ioctl,
678 	.compat_ioctl = spidev_compat_ioctl,
679 	.open =		spidev_open,
680 	.release =	spidev_release,
681 	.llseek =	no_llseek,
682 };
683 
684 /*-------------------------------------------------------------------------*/
685 
686 /* The main reason to have this class is to make mdev/udev create the
687  * /dev/spidevB.C character device nodes exposing our userspace API.
688  * It also simplifies memory management.
689  */
690 
691 static struct class *spidev_class;
692 
693 #ifdef CONFIG_OF
694 static const struct of_device_id spidev_dt_ids[] = {
695 	{ .compatible = "rohm,dh2228fv" },
696 	{ .compatible = "lineartechnology,ltc2488" },
697 	{},
698 };
699 MODULE_DEVICE_TABLE(of, spidev_dt_ids);
700 #endif
701 
702 /*-------------------------------------------------------------------------*/
703 
704 static int spidev_probe(struct spi_device *spi)
705 {
706 	struct spidev_data	*spidev;
707 	int			status;
708 	unsigned long		minor;
709 
710 	/*
711 	 * spidev should never be referenced in DT without a specific
712 	 * compatbile string, it is a Linux implementation thing
713 	 * rather than a description of the hardware.
714 	 */
715 	if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) {
716 		dev_err(&spi->dev, "buggy DT: spidev listed directly in DT\n");
717 		WARN_ON(spi->dev.of_node &&
718 			!of_match_device(spidev_dt_ids, &spi->dev));
719 	}
720 
721 	/* Allocate driver data */
722 	spidev = kzalloc(sizeof(*spidev), GFP_KERNEL);
723 	if (!spidev)
724 		return -ENOMEM;
725 
726 	/* Initialize the driver data */
727 	spidev->spi = spi;
728 	spin_lock_init(&spidev->spi_lock);
729 	mutex_init(&spidev->buf_lock);
730 
731 	INIT_LIST_HEAD(&spidev->device_entry);
732 
733 	/* If we can allocate a minor number, hook up this device.
734 	 * Reusing minors is fine so long as udev or mdev is working.
735 	 */
736 	mutex_lock(&device_list_lock);
737 	minor = find_first_zero_bit(minors, N_SPI_MINORS);
738 	if (minor < N_SPI_MINORS) {
739 		struct device *dev;
740 
741 		spidev->devt = MKDEV(SPIDEV_MAJOR, minor);
742 		dev = device_create(spidev_class, &spi->dev, spidev->devt,
743 				    spidev, "spidev%d.%d",
744 				    spi->master->bus_num, spi->chip_select);
745 		status = PTR_ERR_OR_ZERO(dev);
746 	} else {
747 		dev_dbg(&spi->dev, "no minor number available!\n");
748 		status = -ENODEV;
749 	}
750 	if (status == 0) {
751 		set_bit(minor, minors);
752 		list_add(&spidev->device_entry, &device_list);
753 	}
754 	mutex_unlock(&device_list_lock);
755 
756 	spidev->speed_hz = spi->max_speed_hz;
757 
758 	if (status == 0)
759 		spi_set_drvdata(spi, spidev);
760 	else
761 		kfree(spidev);
762 
763 	return status;
764 }
765 
766 static int spidev_remove(struct spi_device *spi)
767 {
768 	struct spidev_data	*spidev = spi_get_drvdata(spi);
769 
770 	/* make sure ops on existing fds can abort cleanly */
771 	spin_lock_irq(&spidev->spi_lock);
772 	spidev->spi = NULL;
773 	spin_unlock_irq(&spidev->spi_lock);
774 
775 	/* prevent new opens */
776 	mutex_lock(&device_list_lock);
777 	list_del(&spidev->device_entry);
778 	device_destroy(spidev_class, spidev->devt);
779 	clear_bit(MINOR(spidev->devt), minors);
780 	if (spidev->users == 0)
781 		kfree(spidev);
782 	mutex_unlock(&device_list_lock);
783 
784 	return 0;
785 }
786 
787 static struct spi_driver spidev_spi_driver = {
788 	.driver = {
789 		.name =		"spidev",
790 		.owner =	THIS_MODULE,
791 		.of_match_table = of_match_ptr(spidev_dt_ids),
792 	},
793 	.probe =	spidev_probe,
794 	.remove =	spidev_remove,
795 
796 	/* NOTE:  suspend/resume methods are not necessary here.
797 	 * We don't do anything except pass the requests to/from
798 	 * the underlying controller.  The refrigerator handles
799 	 * most issues; the controller driver handles the rest.
800 	 */
801 };
802 
803 /*-------------------------------------------------------------------------*/
804 
805 static int __init spidev_init(void)
806 {
807 	int status;
808 
809 	/* Claim our 256 reserved device numbers.  Then register a class
810 	 * that will key udev/mdev to add/remove /dev nodes.  Last, register
811 	 * the driver which manages those device numbers.
812 	 */
813 	BUILD_BUG_ON(N_SPI_MINORS > 256);
814 	status = register_chrdev(SPIDEV_MAJOR, "spi", &spidev_fops);
815 	if (status < 0)
816 		return status;
817 
818 	spidev_class = class_create(THIS_MODULE, "spidev");
819 	if (IS_ERR(spidev_class)) {
820 		unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
821 		return PTR_ERR(spidev_class);
822 	}
823 
824 	status = spi_register_driver(&spidev_spi_driver);
825 	if (status < 0) {
826 		class_destroy(spidev_class);
827 		unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
828 	}
829 	return status;
830 }
831 module_init(spidev_init);
832 
833 static void __exit spidev_exit(void)
834 {
835 	spi_unregister_driver(&spidev_spi_driver);
836 	class_destroy(spidev_class);
837 	unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
838 }
839 module_exit(spidev_exit);
840 
841 MODULE_AUTHOR("Andrea Paterniani, <a.paterniani@swapp-eng.it>");
842 MODULE_DESCRIPTION("User mode SPI device interface");
843 MODULE_LICENSE("GPL");
844 MODULE_ALIAS("spi:spidev");
845