From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E55DE30F800; Wed, 3 Dec 2025 15:45:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764776708; cv=none; b=d9Ap88P2Ybv2SH7DnDOuEhmKrox0W+Nmwvz6owV1GCja2X+nylUXv7kiXl3byLqLF2axps9FpWy9XCwhMy2tnamffNxtXHAqT9paRe9mEQdzY9bEHkv15wYARME9BCv6X30SBgL57P0XgbvUdYSlkYrawQ6q2ehWJpc+i2zWLus= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764776708; c=relaxed/simple; bh=PK07SurysZSNZ41YBp5hJC7lkfYNzBiqGmRlPdMPyMU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tDN8BLYcLLZ0/XETxCM0sUw6HkiFim+NWXd+x/CGgV2Uf3hxW2d1DwFvj256G33TJkJuTnQyyEgeKYmU4O0MxB3o0IKnBbt3rPJUMRvukhZe3ACuIY8QIfYwYHCIoSrsSN8EzkCX6edUf3U31jWsfIIfeqJ1p+pICb/ztxZxxZ0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FcAcNoCC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FcAcNoCC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50B7DC4CEF5; Wed, 3 Dec 2025 15:45:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1764776707; bh=PK07SurysZSNZ41YBp5hJC7lkfYNzBiqGmRlPdMPyMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FcAcNoCCFPhoLoEUhLhhUsoyZOqh8N8qgic1pYmz6u0UBGvpTKi9GFyaOhCDeJFZO dnUPh9dyt1n/Y9dNOWRc0Tq+Yj8cL5vZZQt8OnUPwHykadzdKEb8WpSI5zGMHO2Qs3 Os0wJJtXKv3nIfjkYzNa7sPW33FWjXiS6+1mZmOY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Hang Zhou <929513338@qq.com>, Mark Brown , Sasha Levin Subject: [PATCH 5.10 263/300] spi: bcm63xx: fix premature CS deassertion on RX-only transactions Date: Wed, 3 Dec 2025 16:27:47 +0100 Message-ID: <20251203152410.379766411@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251203152400.447697997@linuxfoundation.org> References: <20251203152400.447697997@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hang Zhou <929513338@qq.com> [ Upstream commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 ] On BCM6358 (and also observed on BCM6368) the controller appears to only generate as many SPI clocks as bytes that have been written into the TX FIFO. For RX-only transfers the driver programs the transfer length in SPI_MSG_CTL but does not write anything into the FIFO, so chip select is deasserted early and the RX transfer segment is never fully clocked in. A concrete failing case is a three-transfer MAC address read from SPI-NOR: - TX 0x03 (read command) - TX 3-byte address - RX 6 bytes (MAC) In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works because the driver uses prepend_len and writes dummy bytes into the TX FIFO for the RX part. Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only segments so that the number of bytes written to the FIFO matches the total message length seen by the controller. Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up") Signed-off-by: Hang Zhou <929513338@qq.com> Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-bcm63xx.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c index da559b86f6b17..e05f8913ccda9 100644 --- a/drivers/spi/spi-bcm63xx.c +++ b/drivers/spi/spi-bcm63xx.c @@ -257,6 +257,20 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first, if (t->rx_buf) { do_rx = true; + + /* + * In certain hardware implementations, there appears to be a + * hidden accumulator that tracks the number of bytes written into + * the hardware FIFO, and this accumulator overrides the length in + * the SPI_MSG_CTL register. + * + * Therefore, for read-only transfers, we need to write some dummy + * value into the FIFO to keep the accumulator tracking the correct + * length. + */ + if (!t->tx_buf) + memset_io(bs->tx_io + len, 0xFF, t->len); + /* prepend is half-duplex write only */ if (t == first) prepend_len = 0; -- 2.51.0