From patchwork Mon Mar 4 20:18:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Trent Piepho X-Patchwork-Id: 10838529 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CF22F1803 for ; Mon, 4 Mar 2019 20:18:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BBA7A2A438 for ; Mon, 4 Mar 2019 20:18:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ABB962B4EB; Mon, 4 Mar 2019 20:18:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DC19B2A438 for ; Mon, 4 Mar 2019 20:18:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726061AbfCDUSy (ORCPT ); Mon, 4 Mar 2019 15:18:54 -0500 Received: from mail-eopbgr760124.outbound.protection.outlook.com ([40.107.76.124]:8928 "EHLO NAM02-CY1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726038AbfCDUSy (ORCPT ); Mon, 4 Mar 2019 15:18:54 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=impinj.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aIbrRHLAZBCT4Fca8YTjTeguobTarOrU/VZTKmXd0sw=; b=Tm4TrMp9cHgRVWF6BoBGJz3zyWvljodJfUPH8hUf1RfurBW6FYYNxH31k01xCsv+HMmAvYqj8STzA2eadz4PsgRgWmHXyFd1/rOx2axNlxQJNyQqYL2RWZjmASF0/b9Py5gIlRW/CuGl/oJdAZebd9IOctWhR+g8rgSYcYe0A7I= Received: from MWHPR0601MB3708.namprd06.prod.outlook.com (10.167.236.38) by MWHPR0601MB3659.namprd06.prod.outlook.com (10.167.236.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1665.18; Mon, 4 Mar 2019 20:18:49 +0000 Received: from MWHPR0601MB3708.namprd06.prod.outlook.com ([fe80::91d4:ba4b:1424:9452]) by MWHPR0601MB3708.namprd06.prod.outlook.com ([fe80::91d4:ba4b:1424:9452%2]) with mapi id 15.20.1665.019; Mon, 4 Mar 2019 20:18:49 +0000 From: Trent Piepho To: "linux-spi@vger.kernel.org" CC: NXP Linux Team , Mark Brown , Pengutronix Kernel Team , Trent Piepho , Jiada Wang , Fabio Estevam , Stefan Agner , Shawn Guo Subject: [PATCH] spi: imx: stop buffer overflow in RX FIFO flush Thread-Topic: [PATCH] spi: imx: stop buffer overflow in RX FIFO flush Thread-Index: AQHU0sd633ii9sVabkCr6lfmsegFbA== Date: Mon, 4 Mar 2019 20:18:49 +0000 Message-ID: <20190304201832.9045-1-tpiepho@impinj.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: BYAPR21CA0013.namprd21.prod.outlook.com (2603:10b6:a03:114::23) To MWHPR0601MB3708.namprd06.prod.outlook.com (2603:10b6:301:7c::38) authentication-results: spf=none (sender IP is ) smtp.mailfrom=tpiepho@impinj.com; x-ms-exchange-messagesentrepresentingtype: 1 x-mailer: git-send-email 2.14.5 x-originating-ip: [216.207.205.253] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b0f09b55-f1a1-42b5-ab30-08d6a0de9c9a x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020);SRVR:MWHPR0601MB3659; x-ms-traffictypediagnostic: MWHPR0601MB3659: x-microsoft-exchange-diagnostics: 1;MWHPR0601MB3659;20:z9P/XTnyBA0JCzKU4SOLsqW1Nk0l3pSuDZJycW6Ecuyg+XgDNqD7q/hFDavIH71/uc8Rb+YbeY5u6mlT+vz3skSKG0PJlyb6LYVZXFaAyWbzA0ChGMMmPEvW/VjsdBgdF6d3ItNasScnYy24b1aX7UoZ4ixqvXRlgr7WQGVAASs= x-microsoft-antispam-prvs: x-forefront-prvs: 09669DB681 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(376002)(366004)(136003)(396003)(346002)(39850400004)(199004)(189003)(99286004)(106356001)(2616005)(50226002)(5660300002)(6436002)(8936002)(26005)(105586002)(6486002)(6916009)(2501003)(36756003)(7736002)(14454004)(5640700003)(97736004)(1076003)(476003)(102836004)(316002)(305945005)(68736007)(2906002)(6512007)(86362001)(486006)(386003)(52116002)(256004)(4326008)(478600001)(6506007)(71200400001)(71190400001)(8676002)(53936002)(66066001)(186003)(54906003)(2351001)(25786009)(14444005)(6116002)(81166006)(3846002)(81156014);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR0601MB3659;H:MWHPR0601MB3708.namprd06.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1; received-spf: None (protection.outlook.com: impinj.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9L8e/Ni5zluaO+mSPzg1L/nkvPlXHixwlzRV2FlsAbIeUcC3gLYUavC9NMA76IOgH/yH3AbAMjr6VO9U6mo0YICt2GIiE0vOsf4tfFsGqOkBq+LTmeBIjq2/WvTUKK7Vb4RrgEhCCv9is6wN5DKZm3ESM90/WNbcPBZBnU4MoJEuMssk9dVuZN4r8aFQ/R3/hDAUdafUnC+scGxqdGfevZ4tnwlODw2zo6R9Fu3gX3PKCB1NydjvNO3vJ5fxITjDuAUu740Zi/6xIAAfiRwIFoFMkgUXntsYzGRa/MQ2bc56o4k2R1gXVMvzMeVkEYucTqTb3kkWstMxrj/5T2fG8BpFohHsAQiqgT/HtLpW41rgHY0kPK8gDk572PvzpDckB7IiQatqHiaGCA0mRLxVhPvZ/oSSYnYDX/IK333ugh4= MIME-Version: 1.0 X-OriginatorOrg: impinj.com X-MS-Exchange-CrossTenant-Network-Message-Id: b0f09b55-f1a1-42b5-ab30-08d6a0de9c9a X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Mar 2019 20:18:49.3492 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 6de70f0f-7357-4529-a415-d8cbb7e93e5e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR0601MB3659 Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 71abd29057cb ("spi: imx: Add support for SPI Slave mode") added an RX FIFO flush before start of a transfer. In slave mode, the master may have sent more data than expected and this data will still be in the RX FIFO at the start of the next transfer, and so needs to be flushed. However, the code to do the flush was accidentally saving this data into the previous transfer's RX buffer, clobbering the contents of whatever followed that buffer. Change it to empty the FIFO and throw away the data. Every one of the RX functions for the different eCSPI versions and modes reads the RX FIFO data using the same readl() call, so just use that, rather than using the spi_imx->rx function pointer and making sure all the different rx functions have a working "throw away" mode. There is another issue, which affects master mode when switching from DMA to PIO. There can be extra data in the RX FIFO which triggers this flush code, causing memory corruption in the same manner. I don't know why this data is unexpectedly in the FIFO. It's likely there is a different bug or erratum responsible for that. But regardless of that, I think this is proper fix the for bug at hand here. Fixes: 71abd29057cb ("spi: imx: Add support for SPI Slave mode") Cc: Jiada Wang Cc: Fabio Estevam Cc: Stefan Agner Cc: Shawn Guo Signed-off-by: Trent Piepho --- drivers/spi/spi-imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index c7632a82a7a6..342c218b3781 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -1501,7 +1501,7 @@ static int spi_imx_transfer(struct spi_device *spi, /* flush rxfifo before transfer */ while (spi_imx->devtype_data->rx_available(spi_imx)) - spi_imx->rx(spi_imx); + readl(spi_imx->base + MXC_CSPIRXDATA); if (spi_imx->slave_mode) return spi_imx_pio_transfer_slave(spi, transfer);