SpiDevice cancel safety: always set CS pin to high on drop

If a transfer is dropped, the CS will stay in a low state, which
seems to be unsafe.

2 files changed, 12 insertions, 4 deletions

diff --git a/embassy-embedded-hal/Cargo.toml b/embassy-embedded-hal/Cargo.toml
index 9dd2e419f..f385963f1 100644
--- a/embassy-embedded-hal/Cargo.toml
+++ b/embassy-embedded-hal/Cargo.toml
@@ -22,6 +22,7 @@ time = ["dep:embassy-time"]
 default = ["time"]
 
 [dependencies]
+embassy-hal-internal = { version = "0.2.0", path = "../embassy-hal-internal" }
 embassy-futures = { version = "0.1.0", path = "../embassy-futures" }
 embassy-sync = { version = "0.6.2", path = "../embassy-sync" }
 embassy-time = { version = "0.4.0", path = "../embassy-time", optional = true }
diff --git a/embassy-embedded-hal/src/shared_bus/asynch/spi.rs b/embassy-embedded-hal/src/shared_bus/asynch/spi.rs
index 30d4ecc36..0ba1033f6 100644
--- a/embassy-embedded-hal/src/shared_bus/asynch/spi.rs
+++ b/embassy-embedded-hal/src/shared_bus/asynch/spi.rs
@@ -25,6 +25,7 @@
 //! let display2 = ST7735::new(spi_dev2, dc2, rst2, Default::default(), 160, 128);
 //! ```
 
+use embassy_hal_internal::drop::OnDrop;
 use embassy_sync::blocking_mutex::raw::RawMutex;
 use embassy_sync::mutex::Mutex;
 use embedded_hal_1::digital::OutputPin;
@@ -70,6 +71,10 @@ where
         let mut bus = self.bus.lock().await;
         self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
+        let cs_drop = OnDrop::new(|| {
+            let _ = self.cs.set_high();
+        });
+
         let op_res = 'ops: {
             for op in operations {
                 let res = match op {
@@ -97,11 +102,10 @@ where
 
         // On failure, it's important to still flush and deassert CS.
         let flush_res = bus.flush().await;
-        let cs_res = self.cs.set_high();
+        drop(cs_drop);
 
         let op_res = op_res.map_err(SpiDeviceError::Spi)?;
         flush_res.map_err(SpiDeviceError::Spi)?;
-        cs_res.map_err(SpiDeviceError::Cs)?;
 
         Ok(op_res)
     }
@@ -155,6 +159,10 @@ where
         bus.set_config(&self.config).map_err(|_| SpiDeviceError::Config)?;
         self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
+        let cs_drop = OnDrop::new(|| {
+            let _ = self.cs.set_high();
+        });
+
         let op_res = 'ops: {
             for op in operations {
                 let res = match op {
@@ -182,11 +190,10 @@ where
 
         // On failure, it's important to still flush and deassert CS.
         let flush_res = bus.flush().await;
-        let cs_res = self.cs.set_high();
+        drop(cs_drop);
 
         let op_res = op_res.map_err(SpiDeviceError::Spi)?;
         flush_res.map_err(SpiDeviceError::Spi)?;
-        cs_res.map_err(SpiDeviceError::Cs)?;
 
         Ok(op_res)
     }