Skip to content

Commit a290e7b

Browse files
committed
spi: atmel-quadspi: fix possible MMIO window size overrun
The QSPI controller memory space is limited to 128MB: 0x9000_00000-0x9800_00000/0XD000_0000--0XD800_0000. There are nor flashes that are bigger in size than the memory size supported by the controller: Micron MT25QL02G (256 MB). Check if the address exceeds the MMIO window size. An improvement would be to add support for regular SPI mode and fall back to it when the flash memories overrun the controller's memory space. Fixes: 0e6aae0 ("spi: Add QuadSPI driver for Atmel SAMA5D2") Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> [claudiu.beznea@microchip.com: adapt it to current code base] Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com> Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
1 parent 6ce956d commit a290e7b

1 file changed

Lines changed: 10 additions & 0 deletions

File tree

drivers/spi/atmel-quadspi.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ struct atmel_qspi {
154154
void __iomem *mem;
155155
struct clk *clk;
156156
struct platform_device *pdev;
157+
resource_size_t mmap_size;
157158
u32 pending;
158159
u32 scr;
159160
struct completion cmd_completion;
@@ -235,6 +236,14 @@ static int atmel_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
235236
u32 iar, icr, ifr, sr;
236237
int err = 0;
237238

239+
/*
240+
* Check if the address exceeds the MMIO window size. An improvement
241+
* would be to add support for regular SPI mode and fall back to it
242+
* when the flash memories overrun the controller's memory space.
243+
*/
244+
if (op->addr.val + op->data.nbytes > aq->mmap_size)
245+
return -EADDRNOTAVAIL;
246+
238247
iar = 0;
239248
icr = QSPI_ICR_INST(op->cmd.opcode);
240249
ifr = QSPI_IFR_INSTEN;
@@ -446,6 +455,7 @@ static int atmel_qspi_probe(struct platform_device *pdev)
446455
err = PTR_ERR(aq->mem);
447456
goto exit;
448457
}
458+
aq->mmap_size = resource_size(res);
449459

450460
/* Get the peripheral clock */
451461
aq->clk = devm_clk_get(&pdev->dev, NULL);

0 commit comments

Comments
 (0)