linux-kernel - Re: [PATCH v2] spi: microchip-core: prevent RX overflows when transmit size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z8cbTc7zdT58J4Br@black.fi.intel.com>
Date: Tue, 4 Mar 2025 17:25:01 +0200
From: Andy Shevchenko <andriy.shevchenko@...el.com>
To: Conor Dooley <conor.dooley@...rochip.com>
Cc: linux-spi@...r.kernel.org, stable@...r.kernel.org,
	Daire McNamara <daire.mcnamara@...rochip.com>,
	Mark Brown <broonie@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] spi: microchip-core: prevent RX overflows when
 transmit size > FIFO size

On Mon, Mar 03, 2025 at 10:47:40AM +0000, Conor Dooley wrote:
> When the size of a transfer exceeds the size of the FIFO (32 bytes), RX
> overflows will be generated and receive data will be corrupted and
> warnings will be produced. For example, here's an error generated by a
> transfer of 36 bytes:
> 
>   spi_master spi0: mchp_corespi_interrupt: RX OVERFLOW: rxlen: 4, txlen: 0
> 
> The driver is currently split between handling receiving in the
> interrupt handler, and sending outside of it. Move all handling out of
> the interrupt handling, and explicitly link the number of bytes read of
> of the RX FIFO to the number written into the TX one. This both resolves
> the overflow problems as well as simplifying the flow of the driver.

...

> +static inline void mchp_corespi_read_fifo(struct mchp_corespi *spi, int fifo_max)
>  {
> +	for (int i = 0; i < fifo_max; i++) {
> +		u32 data;

> +		while (mchp_corespi_read(spi, REG_STATUS) & STATUS_RXFIFO_EMPTY)
> +			;

What may go wrong with this code? :-)
I think limiting the infinite loop by a timeout is a good thing to have.

> +		data = mchp_corespi_read(spi, REG_RX_DATA);
>  
>  		spi->rx_len -= spi->n_bytes;
>  

>  	mchp_corespi_write(spi, REG_FRAMESUP, len);
>  }

-- 
With Best Regards,
Andy Shevchenko