Skip to content

Commit

Permalink
nrf52: SPI transfer failure and corruption
Browse files Browse the repository at this point in the history
The current EasyDMA implementation will fail if a transfer of over
255 bytes is requested with no warning.

Also we do not set the RX and TX transfer lengths to 0 if the
buffer is NULL which can cause data to be written to the old
address as well as cause unexpected transaction lenghts.
Example:
  transfer 1:
   rx_len  = 10
   rx_buff != NULL
   tx_len  = 10
   tx_buff != NULL
  transfer 2:
   rx_len = 2
   rx_buff != NULL
   tx_buff == NULL
  Total transaction length for the second would be 10 because it
  would still be using the old rx length of 10 and would
  corrupt data in the old rx buffer.

Signed-off-by: Brennan Ashton <bashton@brennanashton.com>
  • Loading branch information
btashton authored and raiden00pl committed Sep 14, 2020
1 parent 3d11590 commit 93eeecf
Showing 1 changed file with 23 additions and 1 deletion.
24 changes: 23 additions & 1 deletion arch/arm/src/nrf52/nrf52_spi.c
Original file line number Diff line number Diff line change
Expand Up @@ -858,7 +858,7 @@ static void nrf52_spi_1b_workaround(FAR struct spi_dev_s *dev, bool enable)
* dev - Device-specific state data
* txbuffer - A pointer to the buffer of data to be sent
* rxbuffer - A pointer to a buffer in which to receive data
* nwords - the length of data to be exchaned in units of words.
* nwords - the length of data to be exchanged in units of words.
* The wordsize is determined by the number of bits-per-word
* selected for the SPI interface.
*
Expand All @@ -874,6 +874,15 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
FAR struct nrf52_spidev_s *priv = (FAR struct nrf52_spidev_s *)dev;
uint32_t regval = 0;

if (nwords > 0xff)
{
/* MAXCNT register can only hold 8bits */

spierr("SPI transfer max of 255 bytes, %d requested\n")
DEBUGASSERT(false);
return;
}

#ifdef CONFIG_NRF52_SPI_MASTER_WORKAROUND_1BYTE_TRANSFER
if (nwords <= 1)
{
Expand All @@ -893,6 +902,10 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
regval = nwords;
nrf52_spi_putreg(priv, NRF52_SPIM_RXDMAXCNT_OFFSET, regval);
}
else
{
nrf52_spi_putreg(priv, NRF52_SPIM_RXDMAXCNT_OFFSET, 0);
}

if (txbuffer != NULL)
{
Expand All @@ -906,6 +919,10 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
regval = nwords;
nrf52_spi_putreg(priv, NRF52_SPIM_TXDMAXCNT_OFFSET, regval);
}
else
{
nrf52_spi_putreg(priv, NRF52_SPIM_TXDMAXCNT_OFFSET, 0);
}

/* SPI start */

Expand All @@ -925,6 +942,11 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
nxsem_wait(&priv->sem_isr);
#endif

if (nrf52_spi_getreg(priv, NRF52_SPIM_TXDAMOUNT_OFFSET) != nwords)
{
spierr("Incomplete transfer wrote %d expected %d\n", regval, nwords);
}

/* SPI stop */

nrf52_spi_putreg(priv, NRF52_SPIM_TASK_STOP_OFFSET, SPIM_TASKS_STOP);
Expand Down

0 comments on commit 93eeecf

Please sign in to comment.