In regmap_spi_gather_write() the "addr" is prepared. The chip expects
the number of 32 bit words to write in the lower 8 bits of addr. However
the number of byte to write in shifted left by 3 (== divided by 8).
The function tcan4x5x_regmap_write() is called with a data buffer, which
holds the register information in the first 32 bits, followed by the
actual data. tcan4x5x_regmap_write() calls regmap_spi_gather_write()
with the val pointer pointing to the actual data, but without
decrementing the count point.
If the regmap framework only calls tcan4x5x_regmap_write() to read
single 32 bit registers these two bugs cancel each other.
This patch fixes the code.
Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
---
drivers/net/can/m_can/tcan4x5x.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
index b115b2e5333f..0d27ef81e6ea 100644
--- a/drivers/net/can/m_can/tcan4x5x.c
+++ b/drivers/net/can/m_can/tcan4x5x.c
@@ -179,7 +179,7 @@ static int regmap_spi_gather_write(void *context, const void *reg,
{ .tx_buf = val, .len = val_len, },
};
- addr = TCAN4X5X_WRITE_CMD | (*((u16 *)reg) << 8) | val_len >> 3;
+ addr = TCAN4X5X_WRITE_CMD | (*((u16 *)reg) << 8) | val_len >> 2;
spi_message_init(&m);
spi_message_add_tail(&t[0], &m);
@@ -193,7 +193,7 @@ static int tcan4x5x_regmap_write(void *context, const void *data, size_t count)
u16 *reg = (u16 *)(data);
const u32 *val = data + 4;
- return regmap_spi_gather_write(context, reg, 4, val, count);
+ return regmap_spi_gather_write(context, reg, 4, val, count - 4);
}
static int regmap_spi_async_write(void *context,
--
2.23.0.rc1
