spi: spi-ti-qspi: Handle truncated frames properly

We clamp frame_len_words to a maximum of 4096, but do not actually
limit the number of words written or read through the DATA registers
or the length added to spi_message::actual_length.  This results in
silent data corruption for commands longer than this maximum.

Recalculate the length of each transfer, taking frame_len_words into
account.  Use this length in qspi_{read,write}_msg(), and to increment
spi_message::actual_length.

Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org

1 files changed, 20 insertions, 12 deletions

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 0ee4139dec48..443f664534e1 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -236,16 +236,16 @@ static inline int ti_qspi_poll_wc(struct ti_qspi *qspi)
         return  -ETIMEDOUT;
 }
 
-static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
+static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t,
+                          int count)
 {
-        int wlen, count, xfer_len;
+        int wlen, xfer_len;
         unsigned int cmd;
         const u8 *txbuf;
         u32 data;
 
         txbuf = t->tx_buf;
         cmd = qspi->cmd | QSPI_WR_SNGL;
-        count = t->len;
         wlen = t->bits_per_word >> 3;   /* in bytes */
         xfer_len = wlen;
 
@@ -305,9 +305,10 @@ static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
         return 0;
 }
 
-static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
+static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t,
+                         int count)
 {
-        int wlen, count;
+        int wlen;
         unsigned int cmd;
         u8 *rxbuf;
 
@@ -324,7 +325,6 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
                 cmd |= QSPI_RD_SNGL;
                 break;
         }
-        count = t->len;
         wlen = t->bits_per_word >> 3;   /* in bytes */
 
         while (count) {
@@ -355,12 +355,13 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
         return 0;
 }
 
-static int qspi_transfer_msg(struct ti_qspi *qspi, struct spi_transfer *t)
+static int qspi_transfer_msg(struct ti_qspi *qspi, struct spi_transfer *t,
+                             int count)
 {
         int ret;
 
         if (t->tx_buf) {
-                ret = qspi_write_msg(qspi, t);
+                ret = qspi_write_msg(qspi, t, count);
                 if (ret) {
                         dev_dbg(qspi->dev, "Error while writing\n");
                         return ret;
@@ -368,7 +369,7 @@ static int qspi_transfer_msg(struct ti_qspi *qspi, struct spi_transfer *t)
         }
 
         if (t->rx_buf) {
-                ret = qspi_read_msg(qspi, t);
+                ret = qspi_read_msg(qspi, t, count);
                 if (ret) {
                         dev_dbg(qspi->dev, "Error while reading\n");
                         return ret;
@@ -451,7 +452,8 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,
         struct spi_device *spi = m->spi;
         struct spi_transfer *t;
         int status = 0, ret;
-        unsigned int frame_len_words;
+        unsigned int frame_len_words, transfer_len_words;
+        int wlen;
 
         /* setup device control reg */
         qspi->dc = 0;
@@ -484,14 +486,20 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,
                 qspi->cmd = ((qspi->cmd & ~QSPI_WLEN_MASK) |
                              QSPI_WLEN(t->bits_per_word));
 
-                ret = qspi_transfer_msg(qspi, t);
+                wlen = t->bits_per_word >> 3;
+                transfer_len_words = min(t->len / wlen, frame_len_words);
+
+                ret = qspi_transfer_msg(qspi, t, transfer_len_words * wlen);
                 if (ret) {
                         dev_dbg(qspi->dev, "transfer message failed\n");
                         mutex_unlock(&qspi->list_lock);
                         return -EINVAL;
                 }
 
-                m->actual_length += t->len;
+                m->actual_length += transfer_len_words * wlen;
+                frame_len_words -= transfer_len_words;
+                if (frame_len_words == 0)
+                        break;
         }
 
         mutex_unlock(&qspi->list_lock);