From cae1cfe2ca0ef61d237d13ebaf82851915ea9996 Mon Sep 17 00:00:00 2001 From: Michael Walle Date: Wed, 6 May 2026 14:34:12 +0200 Subject: spi: fsl_espi: fix read transactions Since commit 7917c2e35604 ("spi: fsl_espi: fix din offset") MTD is basically broken because any read transaction will get wrong data. While the commit in question will fix simple transfers (where both SPI_XFER_BEGIN and SPI_XFER_END is set), it will break the most common case, where opcode and address is send first and then data comes as a second transfer. This basically reverts commit 7917c2e35604 ("spi: fsl_espi: fix din offset") and make the fix particular for this simple case. Instead of providing two buffers for reading and writing, just malloc one which is used for both. This will work because the data is first written on the SPI bus and then it will be read (and overwite the written data) into the same buffer. Suggested-by: Tomas Alvarez Vanoli Fixes: 7917c2e35604 ("spi: fsl_espi: fix din offset") Signed-off-by: Michael Walle Signed-off-by: Peng Fan --- drivers/spi/fsl_espi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/spi/fsl_espi.c b/drivers/spi/fsl_espi.c index 117e36376b7..c5bc603b5c0 100644 --- a/drivers/spi/fsl_espi.c +++ b/drivers/spi/fsl_espi.c @@ -216,13 +216,13 @@ int espi_xfer(struct fsl_spi_slave *fsl, uint cs, unsigned int bitlen, break; case SPI_XFER_BEGIN | SPI_XFER_END: len = data_len; - buffer = (unsigned char *)malloc(len * 2); + buffer = (unsigned char *)malloc(len); if (!buffer) { debug("SF: Failed to malloc memory.\n"); return 1; } memcpy(buffer, data_out, len); - rx_offset = len; + rx_offset = 0; cmd_len = 0; break; } @@ -275,7 +275,7 @@ int espi_xfer(struct fsl_spi_slave *fsl, uint cs, unsigned int bitlen, } } if (data_in) { - memcpy(data_in, buffer + rx_offset, tran_len); + memcpy(data_in, buffer + 2 * cmd_len, tran_len); if (*buffer == 0x0b) { data_in += tran_len; data_len -= tran_len; -- cgit v1.2.3