Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751704AbdIKJjo (ORCPT ); Mon, 11 Sep 2017 05:39:44 -0400 Received: from mail-io0-f195.google.com ([209.85.223.195]:33197 "EHLO mail-io0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751424AbdIKJhr (ORCPT ); Mon, 11 Sep 2017 05:37:47 -0400 X-Google-Smtp-Source: AOwi7QAx35UePM7fnQATmyVdO5LyaUjRLg3e0D8QJmJFn11AsBXKqbp9+3n4SXZP6XqLpoumaXCOtA== From: Bin Meng To: Mika Westerberg , Cyrille Pitchen , Marek Vasut , Boris Brezillon , Brian Norris , Richard Weinberger , David Woodhouse , linux-mtd , linux-kernel Cc: Stefan Roese Subject: [PATCH v2 04/10] spi-nor: intel-spi: Check transfer length in the HW/SW cycle Date: Mon, 11 Sep 2017 02:41:54 -0700 Message-Id: <1505122921-5534-5-git-send-email-bmeng.cn@gmail.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1505122921-5534-1-git-send-email-bmeng.cn@gmail.com> References: <1505122921-5534-1-git-send-email-bmeng.cn@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1620 Lines: 53 Intel SPI controller only has a 64 bytes FIFO. This adds a sanity check before triggering any HW/SW sequencer work. Additionally for the SW sequencer, if given data length is zero, we should not mark the 'Data Cycle' bit. Signed-off-by: Bin Meng Acked-by: Mika Westerberg --- Changes in v2: None drivers/mtd/spi-nor/intel-spi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/spi-nor/intel-spi.c b/drivers/mtd/spi-nor/intel-spi.c index 263c6ab..c4a9de6 100644 --- a/drivers/mtd/spi-nor/intel-spi.c +++ b/drivers/mtd/spi-nor/intel-spi.c @@ -399,6 +399,9 @@ static int intel_spi_hw_cycle(struct intel_spi *ispi, u8 opcode, int len) return -EINVAL; } + if (len > INTEL_SPI_FIFO_SZ) + return -EINVAL; + val |= (len - 1) << HSFSTS_CTL_FDBC_SHIFT; val |= HSFSTS_CTL_FCERR | HSFSTS_CTL_FDONE; val |= HSFSTS_CTL_FGO; @@ -419,14 +422,19 @@ static int intel_spi_hw_cycle(struct intel_spi *ispi, u8 opcode, int len) static int intel_spi_sw_cycle(struct intel_spi *ispi, u8 opcode, int len) { - u32 val, status; + u32 val = 0, status; int ret; ret = intel_spi_opcode_index(ispi, opcode); if (ret < 0) return ret; - val = ((len - 1) << SSFSTS_CTL_DBC_SHIFT) | SSFSTS_CTL_DS; + if (len > INTEL_SPI_FIFO_SZ) + return -EINVAL; + + /* Only mark 'Data Cycle' bit when there is data to be transferred */ + if (len > 0) + val = ((len - 1) << SSFSTS_CTL_DBC_SHIFT) | SSFSTS_CTL_DS; val |= ret << SSFSTS_CTL_COP_SHIFT; val |= SSFSTS_CTL_FCERR | SSFSTS_CTL_FDONE; val |= SSFSTS_CTL_SCGO; -- 2.9.2