[incubator-nuttx] branch master updated: nrf52: SPI transfer failure and corruption

[ra...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

raiden00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 93eeecf  nrf52: SPI transfer failure and corruption
93eeecf is described below

commit 93eeecff6ab5de1a9ab5593bbf556142d00f32c0
Author: Brennan Ashton <ba...@brennanashton.com>
AuthorDate: Sun Sep 13 15:43:57 2020 -0700

    nrf52: SPI transfer failure and corruption
    
    The current EasyDMA implementation will fail if a transfer of over
    255 bytes is requested with no warning.
    
    Also we do not set the RX and TX transfer lengths to 0 if the
    buffer is NULL which can cause data to be written to the old
    address as well as cause unexpected transaction lenghts.
    Example:
      transfer 1:
       rx_len  = 10
       rx_buff != NULL
       tx_len  = 10
       tx_buff != NULL
      transfer 2:
       rx_len = 2
       rx_buff != NULL
       tx_buff == NULL
      Total transaction length for the second would be 10 because it
      would still be using the old rx length of 10 and would
      corrupt data in the old rx buffer.
    
    Signed-off-by: Brennan Ashton <ba...@brennanashton.com>
---
 arch/arm/src/nrf52/nrf52_spi.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/arch/arm/src/nrf52/nrf52_spi.c b/arch/arm/src/nrf52/nrf52_spi.c
index 3127ceb..12ad103 100644
--- a/arch/arm/src/nrf52/nrf52_spi.c
+++ b/arch/arm/src/nrf52/nrf52_spi.c
@@ -858,7 +858,7 @@ static void nrf52_spi_1b_workaround(FAR struct spi_dev_s *dev, bool enable)
  *   dev      - Device-specific state data
  *   txbuffer - A pointer to the buffer of data to be sent
  *   rxbuffer - A pointer to a buffer in which to receive data
- *   nwords   - the length of data to be exchaned in units of words.
+ *   nwords   - the length of data to be exchanged in units of words.
  *              The wordsize is determined by the number of bits-per-word
  *              selected for the SPI interface.
  *
@@ -874,6 +874,15 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
   FAR struct nrf52_spidev_s *priv = (FAR struct nrf52_spidev_s *)dev;
   uint32_t regval = 0;
 
+  if (nwords > 0xff)
+    {
+      /* MAXCNT register can only hold 8bits */
+
+      spierr("SPI transfer max of 255 bytes, %d requested\n")
+      DEBUGASSERT(false);
+      return;
+    }
+
 #ifdef CONFIG_NRF52_SPI_MASTER_WORKAROUND_1BYTE_TRANSFER
   if (nwords <= 1)
     {
@@ -893,6 +902,10 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
       regval = nwords;
       nrf52_spi_putreg(priv, NRF52_SPIM_RXDMAXCNT_OFFSET, regval);
     }
+  else
+    {
+      nrf52_spi_putreg(priv, NRF52_SPIM_RXDMAXCNT_OFFSET, 0);
+    }
 
   if (txbuffer != NULL)
     {
@@ -906,6 +919,10 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
       regval = nwords;
       nrf52_spi_putreg(priv, NRF52_SPIM_TXDMAXCNT_OFFSET, regval);
     }
+  else
+    {
+      nrf52_spi_putreg(priv, NRF52_SPIM_TXDMAXCNT_OFFSET, 0);
+    }
 
   /* SPI start */
 
@@ -925,6 +942,11 @@ static void nrf52_spi_exchange(FAR struct spi_dev_s *dev,
   nxsem_wait(&priv->sem_isr);
 #endif
 
+  if (nrf52_spi_getreg(priv, NRF52_SPIM_TXDAMOUNT_OFFSET) != nwords)
+    {
+      spierr("Incomplete transfer wrote %d expected %d\n", regval, nwords);
+    }
+
   /* SPI stop */
 
   nrf52_spi_putreg(priv, NRF52_SPIM_TASK_STOP_OFFSET, SPIM_TASKS_STOP);