When spi-mxs driver works in DMA mode, calling to spi_read() after spi_write() hangs DMA channel: "DMA transfer timeout".

To reproduce.
Write simple driver with userspace interface allowing to manually call to spi_read() / spi_write(). Put spi-mxs.c driver in DMA mode by using buffer size more than restriction in "mxs_spi_transfer_one()". Or remove this restriction at all. Run spi_read() one or more times, then spi_write().

Fix.
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index edf1360..9dd69d4 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -247,6 +247,8 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
                ctrl0 |= BM_SSP_CTRL0_LOCK_CS;
        if (!write)
                ctrl0 |= BM_SSP_CTRL0_READ;
+       else
+               ctrl0 &= ~BM_SSP_CTRL0_READ;
 
        /* Queue the DMA data transfer. */
        for (sg_count = 0; sg_count < sgs; sg_count++) {


Additionally, DMA channel stays broken after this error. To fix this, apply following patch:
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
index edf1360..db9d799 100644
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -321,6 +321,7 @@ static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
        ret = wait_for_completion_timeout(&spi->c,
                                msecs_to_jiffies(SSP_TIMEOUT));
        if (!ret) {
+               ssp->dmach->device->device_control(ssp->dmach, DMA_TERMINATE_ALL, 0);
                dev_err(ssp->dev, "DMA transfer timeout\n");
                ret = -ETIMEDOUT;
                goto err_vmalloc;

Tested on i.MX287'based custom board.

Sorry for this ridiculous english. :)