1/*
2 * Simple synchronous userspace interface to SPI devices
3 *
4 * Copyright (C) 2006 SWAPP
5 *	Andrea Paterniani <a.paterniani@swapp-eng.it>
6 * Copyright (C) 2007 David Brownell (simplification, cleanup)
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 * GNU General Public License for more details.
17 */
18
19#include <linux/init.h>
20#include <linux/module.h>
21#include <linux/ioctl.h>
22#include <linux/fs.h>
23#include <linux/device.h>
24#include <linux/err.h>
25#include <linux/list.h>
26#include <linux/errno.h>
27#include <linux/mutex.h>
28#include <linux/slab.h>
29#include <linux/compat.h>
30#include <linux/of.h>
31#include <linux/of_device.h>
32
33#include <linux/spi/spi.h>
34#include <linux/spi/spidev.h>
35
36#include <linux/uaccess.h>
37
38
39/*
40 * This supports access to SPI devices using normal userspace I/O calls.
41 * Note that while traditional UNIX/POSIX I/O semantics are half duplex,
42 * and often mask message boundaries, full SPI support requires full duplex
43 * transfers.  There are several kinds of internal message boundaries to
44 * handle chipselect management and other protocol options.
45 *
46 * SPI has a character major number assigned.  We allocate minor numbers
47 * dynamically using a bitmask.  You must use hotplug tools, such as udev
48 * (or mdev with busybox) to create and destroy the /dev/spidevB.C device
49 * nodes, since there is no fixed association of minor numbers with any
50 * particular SPI bus or device.
51 */
52#define SPIDEV_MAJOR			153	/* assigned */
53#define N_SPI_MINORS			32	/* ... up to 256 */
54
55static DECLARE_BITMAP(minors, N_SPI_MINORS);
56
57
58/* Bit masks for spi_device.mode management.  Note that incorrect
59 * settings for some settings can cause *lots* of trouble for other
60 * devices on a shared bus:
61 *
62 *  - CS_HIGH ... this device will be active when it shouldn't be
63 *  - 3WIRE ... when active, it won't behave as it should
64 *  - NO_CS ... there will be no explicit message boundaries; this
65 *	is completely incompatible with the shared bus model
66 *  - READY ... transfers may proceed when they shouldn't.
67 *
68 * REVISIT should changing those flags be privileged?
69 */
70#define SPI_MODE_MASK		(SPI_CPHA | SPI_CPOL | SPI_CS_HIGH \
71				| SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP \
72				| SPI_NO_CS | SPI_READY | SPI_TX_DUAL \
73				| SPI_TX_QUAD | SPI_RX_DUAL | SPI_RX_QUAD)
74
75struct spidev_data {
76	dev_t			devt;
77	spinlock_t		spi_lock;
78	struct spi_device	*spi;
79	struct list_head	device_entry;
80
81	/* TX/RX buffers are NULL unless this device is open (users > 0) */
82	struct mutex		buf_lock;
83	unsigned		users;
84	u8			*tx_buffer;
85	u8			*rx_buffer;
86	u32			speed_hz;
87};
88
89static LIST_HEAD(device_list);
90static DEFINE_MUTEX(device_list_lock);
91
92static unsigned bufsiz = 4096;
93module_param(bufsiz, uint, S_IRUGO);
94MODULE_PARM_DESC(bufsiz, "data bytes in biggest supported SPI message");
95
96/*-------------------------------------------------------------------------*/
97
98static ssize_t
99spidev_sync(struct spidev_data *spidev, struct spi_message *message)
100{
101	DECLARE_COMPLETION_ONSTACK(done);
102	int status;
103	struct spi_device *spi;
104
105	spin_lock_irq(&spidev->spi_lock);
106	spi = spidev->spi;
107	spin_unlock_irq(&spidev->spi_lock);
108
109	if (spi == NULL)
110		status = -ESHUTDOWN;
111	else
112		status = spi_sync(spi, message);
113
114	if (status == 0)
115		status = message->actual_length;
116
117	return status;
118}
119
120static inline ssize_t
121spidev_sync_write(struct spidev_data *spidev, size_t len)
122{
123	struct spi_transfer	t = {
124			.tx_buf		= spidev->tx_buffer,
125			.len		= len,
126			.speed_hz	= spidev->speed_hz,
127		};
128	struct spi_message	m;
129
130	spi_message_init(&m);
131	spi_message_add_tail(&t, &m);
132	return spidev_sync(spidev, &m);
133}
134
135static inline ssize_t
136spidev_sync_read(struct spidev_data *spidev, size_t len)
137{
138	struct spi_transfer	t = {
139			.rx_buf		= spidev->rx_buffer,
140			.len		= len,
141			.speed_hz	= spidev->speed_hz,
142		};
143	struct spi_message	m;
144
145	spi_message_init(&m);
146	spi_message_add_tail(&t, &m);
147	return spidev_sync(spidev, &m);
148}
149
150/*-------------------------------------------------------------------------*/
151
152/* Read-only message with current device setup */
153static ssize_t
154spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
155{
156	struct spidev_data	*spidev;
157	ssize_t			status = 0;
158
159	/* chipselect only toggles at start or end of operation */
160	if (count > bufsiz)
161		return -EMSGSIZE;
162
163	spidev = filp->private_data;
164
165	mutex_lock(&spidev->buf_lock);
166	status = spidev_sync_read(spidev, count);
167	if (status > 0) {
168		unsigned long	missing;
169
170		missing = copy_to_user(buf, spidev->rx_buffer, status);
171		if (missing == status)
172			status = -EFAULT;
173		else
174			status = status - missing;
175	}
176	mutex_unlock(&spidev->buf_lock);
177
178	return status;
179}
180
181/* Write-only message with current device setup */
182static ssize_t
183spidev_write(struct file *filp, const char __user *buf,
184		size_t count, loff_t *f_pos)
185{
186	struct spidev_data	*spidev;
187	ssize_t			status = 0;
188	unsigned long		missing;
189
190	/* chipselect only toggles at start or end of operation */
191	if (count > bufsiz)
192		return -EMSGSIZE;
193
194	spidev = filp->private_data;
195
196	mutex_lock(&spidev->buf_lock);
197	missing = copy_from_user(spidev->tx_buffer, buf, count);
198	if (missing == 0)
199		status = spidev_sync_write(spidev, count);
200	else
201		status = -EFAULT;
202	mutex_unlock(&spidev->buf_lock);
203
204	return status;
205}
206
207static int spidev_message(struct spidev_data *spidev,
208		struct spi_ioc_transfer *u_xfers, unsigned n_xfers)
209{
210	struct spi_message	msg;
211	struct spi_transfer	*k_xfers;
212	struct spi_transfer	*k_tmp;
213	struct spi_ioc_transfer *u_tmp;
214	unsigned		n, total, tx_total, rx_total;
215	u8			*tx_buf, *rx_buf;
216	int			status = -EFAULT;
217
218	spi_message_init(&msg);
219	k_xfers = kcalloc(n_xfers, sizeof(*k_tmp), GFP_KERNEL);
220	if (k_xfers == NULL)
221		return -ENOMEM;
222
223	/* Construct spi_message, copying any tx data to bounce buffer.
224	 * We walk the array of user-provided transfers, using each one
225	 * to initialize a kernel version of the same transfer.
226	 */
227	tx_buf = spidev->tx_buffer;
228	rx_buf = spidev->rx_buffer;
229	total = 0;
230	tx_total = 0;
231	rx_total = 0;
232	for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
233			n;
234			n--, k_tmp++, u_tmp++) {
235		k_tmp->len = u_tmp->len;
236
237		total += k_tmp->len;
238		/* Since the function returns the total length of transfers
239		 * on success, restrict the total to positive int values to
240		 * avoid the return value looking like an error.  Also check
241		 * each transfer length to avoid arithmetic overflow.
242		 */
243		if (total > INT_MAX || k_tmp->len > INT_MAX) {
244			status = -EMSGSIZE;
245			goto done;
246		}
247
248		if (u_tmp->rx_buf) {
249			/* this transfer needs space in RX bounce buffer */
250			rx_total += k_tmp->len;
251			if (rx_total > bufsiz) {
252				status = -EMSGSIZE;
253				goto done;
254			}
255			k_tmp->rx_buf = rx_buf;
256			if (!access_ok(VERIFY_WRITE, (u8 __user *)
257						(uintptr_t) u_tmp->rx_buf,
258						u_tmp->len))
259				goto done;
260			rx_buf += k_tmp->len;
261		}
262		if (u_tmp->tx_buf) {
263			/* this transfer needs space in TX bounce buffer */
264			tx_total += k_tmp->len;
265			if (tx_total > bufsiz) {
266				status = -EMSGSIZE;
267				goto done;
268			}
269			k_tmp->tx_buf = tx_buf;
270			if (copy_from_user(tx_buf, (const u8 __user *)
271						(uintptr_t) u_tmp->tx_buf,
272					u_tmp->len))
273				goto done;
274			tx_buf += k_tmp->len;
275		}
276
277		k_tmp->cs_change = !!u_tmp->cs_change;
278		k_tmp->tx_nbits = u_tmp->tx_nbits;
279		k_tmp->rx_nbits = u_tmp->rx_nbits;
280		k_tmp->bits_per_word = u_tmp->bits_per_word;
281		k_tmp->delay_usecs = u_tmp->delay_usecs;
282		k_tmp->speed_hz = u_tmp->speed_hz;
283		if (!k_tmp->speed_hz)
284			k_tmp->speed_hz = spidev->speed_hz;
285#ifdef VERBOSE
286		dev_dbg(&spidev->spi->dev,
287			"  xfer len %zd %s%s%s%dbits %u usec %uHz\n",
288			u_tmp->len,
289			u_tmp->rx_buf ? "rx " : "",
290			u_tmp->tx_buf ? "tx " : "",
291			u_tmp->cs_change ? "cs " : "",
292			u_tmp->bits_per_word ? : spidev->spi->bits_per_word,
293			u_tmp->delay_usecs,
294			u_tmp->speed_hz ? : spidev->spi->max_speed_hz);
295#endif
296		spi_message_add_tail(k_tmp, &msg);
297	}
298
299	status = spidev_sync(spidev, &msg);
300	if (status < 0)
301		goto done;
302
303	/* copy any rx data out of bounce buffer */
304	rx_buf = spidev->rx_buffer;
305	for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
306		if (u_tmp->rx_buf) {
307			if (__copy_to_user((u8 __user *)
308					(uintptr_t) u_tmp->rx_buf, rx_buf,
309					u_tmp->len)) {
310				status = -EFAULT;
311				goto done;
312			}
313			rx_buf += u_tmp->len;
314		}
315	}
316	status = total;
317
318done:
319	kfree(k_xfers);
320	return status;
321}
322
323static struct spi_ioc_transfer *
324spidev_get_ioc_message(unsigned int cmd, struct spi_ioc_transfer __user *u_ioc,
325		unsigned *n_ioc)
326{
327	struct spi_ioc_transfer	*ioc;
328	u32	tmp;
329
330	/* Check type, command number and direction */
331	if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC
332			|| _IOC_NR(cmd) != _IOC_NR(SPI_IOC_MESSAGE(0))
333			|| _IOC_DIR(cmd) != _IOC_WRITE)
334		return ERR_PTR(-ENOTTY);
335
336	tmp = _IOC_SIZE(cmd);
337	if ((tmp % sizeof(struct spi_ioc_transfer)) != 0)
338		return ERR_PTR(-EINVAL);
339	*n_ioc = tmp / sizeof(struct spi_ioc_transfer);
340	if (*n_ioc == 0)
341		return NULL;
342
343	/* copy into scratch area */
344	ioc = kmalloc(tmp, GFP_KERNEL);
345	if (!ioc)
346		return ERR_PTR(-ENOMEM);
347	if (__copy_from_user(ioc, u_ioc, tmp)) {
348		kfree(ioc);
349		return ERR_PTR(-EFAULT);
350	}
351	return ioc;
352}
353
354static long
355spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
356{
357	int			err = 0;
358	int			retval = 0;
359	struct spidev_data	*spidev;
360	struct spi_device	*spi;
361	u32			tmp;
362	unsigned		n_ioc;
363	struct spi_ioc_transfer	*ioc;
364
365	/* Check type and command number */
366	if (_IOC_TYPE(cmd) != SPI_IOC_MAGIC)
367		return -ENOTTY;
368
369	/* Check access direction once here; don't repeat below.
370	 * IOC_DIR is from the user perspective, while access_ok is
371	 * from the kernel perspective; so they look reversed.
372	 */
373	if (_IOC_DIR(cmd) & _IOC_READ)
374		err = !access_ok(VERIFY_WRITE,
375				(void __user *)arg, _IOC_SIZE(cmd));
376	if (err == 0 && _IOC_DIR(cmd) & _IOC_WRITE)
377		err = !access_ok(VERIFY_READ,
378				(void __user *)arg, _IOC_SIZE(cmd));
379	if (err)
380		return -EFAULT;
381
382	/* guard against device removal before, or while,
383	 * we issue this ioctl.
384	 */
385	spidev = filp->private_data;
386	spin_lock_irq(&spidev->spi_lock);
387	spi = spi_dev_get(spidev->spi);
388	spin_unlock_irq(&spidev->spi_lock);
389
390	if (spi == NULL)
391		return -ESHUTDOWN;
392
393	/* use the buffer lock here for triple duty:
394	 *  - prevent I/O (from us) so calling spi_setup() is safe;
395	 *  - prevent concurrent SPI_IOC_WR_* from morphing
396	 *    data fields while SPI_IOC_RD_* reads them;
397	 *  - SPI_IOC_MESSAGE needs the buffer locked "normally".
398	 */
399	mutex_lock(&spidev->buf_lock);
400
401	switch (cmd) {
402	/* read requests */
403	case SPI_IOC_RD_MODE:
404		retval = __put_user(spi->mode & SPI_MODE_MASK,
405					(__u8 __user *)arg);
406		break;
407	case SPI_IOC_RD_MODE32:
408		retval = __put_user(spi->mode & SPI_MODE_MASK,
409					(__u32 __user *)arg);
410		break;
411	case SPI_IOC_RD_LSB_FIRST:
412		retval = __put_user((spi->mode & SPI_LSB_FIRST) ?  1 : 0,
413					(__u8 __user *)arg);
414		break;
415	case SPI_IOC_RD_BITS_PER_WORD:
416		retval = __put_user(spi->bits_per_word, (__u8 __user *)arg);
417		break;
418	case SPI_IOC_RD_MAX_SPEED_HZ:
419		retval = __put_user(spidev->speed_hz, (__u32 __user *)arg);
420		break;
421
422	/* write requests */
423	case SPI_IOC_WR_MODE:
424	case SPI_IOC_WR_MODE32:
425		if (cmd == SPI_IOC_WR_MODE)
426			retval = __get_user(tmp, (u8 __user *)arg);
427		else
428			retval = __get_user(tmp, (u32 __user *)arg);
429		if (retval == 0) {
430			u32	save = spi->mode;
431
432			if (tmp & ~SPI_MODE_MASK) {
433				retval = -EINVAL;
434				break;
435			}
436
437			tmp |= spi->mode & ~SPI_MODE_MASK;
438			spi->mode = (u16)tmp;
439			retval = spi_setup(spi);
440			if (retval < 0)
441				spi->mode = save;
442			else
443				dev_dbg(&spi->dev, "spi mode %x\n", tmp);
444		}
445		break;
446	case SPI_IOC_WR_LSB_FIRST:
447		retval = __get_user(tmp, (__u8 __user *)arg);
448		if (retval == 0) {
449			u32	save = spi->mode;
450
451			if (tmp)
452				spi->mode |= SPI_LSB_FIRST;
453			else
454				spi->mode &= ~SPI_LSB_FIRST;
455			retval = spi_setup(spi);
456			if (retval < 0)
457				spi->mode = save;
458			else
459				dev_dbg(&spi->dev, "%csb first\n",
460						tmp ? 'l' : 'm');
461		}
462		break;
463	case SPI_IOC_WR_BITS_PER_WORD:
464		retval = __get_user(tmp, (__u8 __user *)arg);
465		if (retval == 0) {
466			u8	save = spi->bits_per_word;
467
468			spi->bits_per_word = tmp;
469			retval = spi_setup(spi);
470			if (retval < 0)
471				spi->bits_per_word = save;
472			else
473				dev_dbg(&spi->dev, "%d bits per word\n", tmp);
474		}
475		break;
476	case SPI_IOC_WR_MAX_SPEED_HZ:
477		retval = __get_user(tmp, (__u32 __user *)arg);
478		if (retval == 0) {
479			u32	save = spi->max_speed_hz;
480
481			spi->max_speed_hz = tmp;
482			retval = spi_setup(spi);
483			if (retval >= 0)
484				spidev->speed_hz = tmp;
485			else
486				dev_dbg(&spi->dev, "%d Hz (max)\n", tmp);
487			spi->max_speed_hz = save;
488		}
489		break;
490
491	default:
492		/* segmented and/or full-duplex I/O request */
493		/* Check message and copy into scratch area */
494		ioc = spidev_get_ioc_message(cmd,
495				(struct spi_ioc_transfer __user *)arg, &n_ioc);
496		if (IS_ERR(ioc)) {
497			retval = PTR_ERR(ioc);
498			break;
499		}
500		if (!ioc)
501			break;	/* n_ioc is also 0 */
502
503		/* translate to spi_message, execute */
504		retval = spidev_message(spidev, ioc, n_ioc);
505		kfree(ioc);
506		break;
507	}
508
509	mutex_unlock(&spidev->buf_lock);
510	spi_dev_put(spi);
511	return retval;
512}
513
514#ifdef CONFIG_COMPAT
515static long
516spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
517		unsigned long arg)
518{
519	struct spi_ioc_transfer __user	*u_ioc;
520	int				retval = 0;
521	struct spidev_data		*spidev;
522	struct spi_device		*spi;
523	unsigned			n_ioc, n;
524	struct spi_ioc_transfer		*ioc;
525
526	u_ioc = (struct spi_ioc_transfer __user *) compat_ptr(arg);
527	if (!access_ok(VERIFY_READ, u_ioc, _IOC_SIZE(cmd)))
528		return -EFAULT;
529
530	/* guard against device removal before, or while,
531	 * we issue this ioctl.
532	 */
533	spidev = filp->private_data;
534	spin_lock_irq(&spidev->spi_lock);
535	spi = spi_dev_get(spidev->spi);
536	spin_unlock_irq(&spidev->spi_lock);
537
538	if (spi == NULL)
539		return -ESHUTDOWN;
540
541	/* SPI_IOC_MESSAGE needs the buffer locked "normally" */
542	mutex_lock(&spidev->buf_lock);
543
544	/* Check message and copy into scratch area */
545	ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
546	if (IS_ERR(ioc)) {
547		retval = PTR_ERR(ioc);
548		goto done;
549	}
550	if (!ioc)
551		goto done;	/* n_ioc is also 0 */
552
553	/* Convert buffer pointers */
554	for (n = 0; n < n_ioc; n++) {
555		ioc[n].rx_buf = (uintptr_t) compat_ptr(ioc[n].rx_buf);
556		ioc[n].tx_buf = (uintptr_t) compat_ptr(ioc[n].tx_buf);
557	}
558
559	/* translate to spi_message, execute */
560	retval = spidev_message(spidev, ioc, n_ioc);
561	kfree(ioc);
562
563done:
564	mutex_unlock(&spidev->buf_lock);
565	spi_dev_put(spi);
566	return retval;
567}
568
569static long
570spidev_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
571{
572	if (_IOC_TYPE(cmd) == SPI_IOC_MAGIC
573			&& _IOC_NR(cmd) == _IOC_NR(SPI_IOC_MESSAGE(0))
574			&& _IOC_DIR(cmd) == _IOC_WRITE)
575		return spidev_compat_ioc_message(filp, cmd, arg);
576
577	return spidev_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
578}
579#else
580#define spidev_compat_ioctl NULL
581#endif /* CONFIG_COMPAT */
582
583static int spidev_open(struct inode *inode, struct file *filp)
584{
585	struct spidev_data	*spidev;
586	int			status = -ENXIO;
587
588	mutex_lock(&device_list_lock);
589
590	list_for_each_entry(spidev, &device_list, device_entry) {
591		if (spidev->devt == inode->i_rdev) {
592			status = 0;
593			break;
594		}
595	}
596
597	if (status) {
598		pr_debug("spidev: nothing for minor %d\n", iminor(inode));
599		goto err_find_dev;
600	}
601
602	if (!spidev->tx_buffer) {
603		spidev->tx_buffer = kmalloc(bufsiz, GFP_KERNEL);
604		if (!spidev->tx_buffer) {
605			dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
606			status = -ENOMEM;
607			goto err_find_dev;
608		}
609	}
610
611	if (!spidev->rx_buffer) {
612		spidev->rx_buffer = kmalloc(bufsiz, GFP_KERNEL);
613		if (!spidev->rx_buffer) {
614			dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
615			status = -ENOMEM;
616			goto err_alloc_rx_buf;
617		}
618	}
619
620	spidev->users++;
621	filp->private_data = spidev;
622	nonseekable_open(inode, filp);
623
624	mutex_unlock(&device_list_lock);
625	return 0;
626
627err_alloc_rx_buf:
628	kfree(spidev->tx_buffer);
629	spidev->tx_buffer = NULL;
630err_find_dev:
631	mutex_unlock(&device_list_lock);
632	return status;
633}
634
635static int spidev_release(struct inode *inode, struct file *filp)
636{
637	struct spidev_data	*spidev;
638
639	mutex_lock(&device_list_lock);
640	spidev = filp->private_data;
641	filp->private_data = NULL;
642
643	/* last close? */
644	spidev->users--;
645	if (!spidev->users) {
646		int		dofree;
647
648		kfree(spidev->tx_buffer);
649		spidev->tx_buffer = NULL;
650
651		kfree(spidev->rx_buffer);
652		spidev->rx_buffer = NULL;
653
654		spin_lock_irq(&spidev->spi_lock);
655		if (spidev->spi)
656			spidev->speed_hz = spidev->spi->max_speed_hz;
657
658		/* ... after we unbound from the underlying device? */
659		dofree = (spidev->spi == NULL);
660		spin_unlock_irq(&spidev->spi_lock);
661
662		if (dofree)
663			kfree(spidev);
664	}
665	mutex_unlock(&device_list_lock);
666
667	return 0;
668}
669
670static const struct file_operations spidev_fops = {
671	.owner =	THIS_MODULE,
672	/* REVISIT switch to aio primitives, so that userspace
673	 * gets more complete API coverage.  It'll simplify things
674	 * too, except for the locking.
675	 */
676	.write =	spidev_write,
677	.read =		spidev_read,
678	.unlocked_ioctl = spidev_ioctl,
679	.compat_ioctl = spidev_compat_ioctl,
680	.open =		spidev_open,
681	.release =	spidev_release,
682	.llseek =	no_llseek,
683};
684
685/*-------------------------------------------------------------------------*/
686
687/* The main reason to have this class is to make mdev/udev create the
688 * /dev/spidevB.C character device nodes exposing our userspace API.
689 * It also simplifies memory management.
690 */
691
692static struct class *spidev_class;
693
694#ifdef CONFIG_OF
695static const struct of_device_id spidev_dt_ids[] = {
696	{ .compatible = "rohm,dh2228fv" },
697	{ .compatible = "lineartechnology,ltc2488" },
698	{},
699};
700MODULE_DEVICE_TABLE(of, spidev_dt_ids);
701#endif
702
703/*-------------------------------------------------------------------------*/
704
705static int spidev_probe(struct spi_device *spi)
706{
707	struct spidev_data	*spidev;
708	int			status;
709	unsigned long		minor;
710
711	/*
712	 * spidev should never be referenced in DT without a specific
713	 * compatible string, it is a Linux implementation thing
714	 * rather than a description of the hardware.
715	 */
716	if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) {
717		dev_err(&spi->dev, "buggy DT: spidev listed directly in DT\n");
718		WARN_ON(spi->dev.of_node &&
719			!of_match_device(spidev_dt_ids, &spi->dev));
720	}
721
722	/* Allocate driver data */
723	spidev = kzalloc(sizeof(*spidev), GFP_KERNEL);
724	if (!spidev)
725		return -ENOMEM;
726
727	/* Initialize the driver data */
728	spidev->spi = spi;
729	spin_lock_init(&spidev->spi_lock);
730	mutex_init(&spidev->buf_lock);
731
732	INIT_LIST_HEAD(&spidev->device_entry);
733
734	/* If we can allocate a minor number, hook up this device.
735	 * Reusing minors is fine so long as udev or mdev is working.
736	 */
737	mutex_lock(&device_list_lock);
738	minor = find_first_zero_bit(minors, N_SPI_MINORS);
739	if (minor < N_SPI_MINORS) {
740		struct device *dev;
741
742		spidev->devt = MKDEV(SPIDEV_MAJOR, minor);
743		dev = device_create(spidev_class, &spi->dev, spidev->devt,
744				    spidev, "spidev%d.%d",
745				    spi->master->bus_num, spi->chip_select);
746		status = PTR_ERR_OR_ZERO(dev);
747	} else {
748		dev_dbg(&spi->dev, "no minor number available!\n");
749		status = -ENODEV;
750	}
751	if (status == 0) {
752		set_bit(minor, minors);
753		list_add(&spidev->device_entry, &device_list);
754	}
755	mutex_unlock(&device_list_lock);
756
757	spidev->speed_hz = spi->max_speed_hz;
758
759	if (status == 0)
760		spi_set_drvdata(spi, spidev);
761	else
762		kfree(spidev);
763
764	return status;
765}
766
767static int spidev_remove(struct spi_device *spi)
768{
769	struct spidev_data	*spidev = spi_get_drvdata(spi);
770
771	/* make sure ops on existing fds can abort cleanly */
772	spin_lock_irq(&spidev->spi_lock);
773	spidev->spi = NULL;
774	spin_unlock_irq(&spidev->spi_lock);
775
776	/* prevent new opens */
777	mutex_lock(&device_list_lock);
778	list_del(&spidev->device_entry);
779	device_destroy(spidev_class, spidev->devt);
780	clear_bit(MINOR(spidev->devt), minors);
781	if (spidev->users == 0)
782		kfree(spidev);
783	mutex_unlock(&device_list_lock);
784
785	return 0;
786}
787
788static struct spi_driver spidev_spi_driver = {
789	.driver = {
790		.name =		"spidev",
791		.of_match_table = of_match_ptr(spidev_dt_ids),
792	},
793	.probe =	spidev_probe,
794	.remove =	spidev_remove,
795
796	/* NOTE:  suspend/resume methods are not necessary here.
797	 * We don't do anything except pass the requests to/from
798	 * the underlying controller.  The refrigerator handles
799	 * most issues; the controller driver handles the rest.
800	 */
801};
802
803/*-------------------------------------------------------------------------*/
804
805static int __init spidev_init(void)
806{
807	int status;
808
809	/* Claim our 256 reserved device numbers.  Then register a class
810	 * that will key udev/mdev to add/remove /dev nodes.  Last, register
811	 * the driver which manages those device numbers.
812	 */
813	BUILD_BUG_ON(N_SPI_MINORS > 256);
814	status = register_chrdev(SPIDEV_MAJOR, "spi", &spidev_fops);
815	if (status < 0)
816		return status;
817
818	spidev_class = class_create(THIS_MODULE, "spidev");
819	if (IS_ERR(spidev_class)) {
820		unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
821		return PTR_ERR(spidev_class);
822	}
823
824	status = spi_register_driver(&spidev_spi_driver);
825	if (status < 0) {
826		class_destroy(spidev_class);
827		unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
828	}
829	return status;
830}
831module_init(spidev_init);
832
833static void __exit spidev_exit(void)
834{
835	spi_unregister_driver(&spidev_spi_driver);
836	class_destroy(spidev_class);
837	unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
838}
839module_exit(spidev_exit);
840
841MODULE_AUTHOR("Andrea Paterniani, <a.paterniani@swapp-eng.it>");
842MODULE_DESCRIPTION("User mode SPI device interface");
843MODULE_LICENSE("GPL");
844MODULE_ALIAS("spi:spidev");
845