From c5ee35ff861fe4447fd80119f645fba7bfd3a184 Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Tue, 21 Aug 2018 11:46:31 -0400 Subject: [PATCH] drivers/spi/spi_flash: don't allocate unbounded stack memory This open-codes flash_cmd, but until the API is fixed for real, it uses xfer's existing scatter-gather ability to write command and data in one go. BUG=chromium:446201 TEST=emerge-coral coreboot succeeds Change-Id: Ic81b7c9f7e0f2647e59b81d61abd68d36051e578 Signed-off-by: Patrick Georgi Reviewed-on: https://review.coreboot.org/28254 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel Reviewed-by: Aaron Durbin --- src/drivers/spi/spi_flash.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/src/drivers/spi/spi_flash.c b/src/drivers/spi/spi_flash.c index f2714791db..82333e9b0f 100644 --- a/src/drivers/spi/spi_flash.c +++ b/src/drivers/spi/spi_flash.c @@ -82,24 +82,29 @@ static int spi_flash_cmd_read(const struct spi_slave *spi, const u8 *cmd, return ret; } -/* TODO: This code is quite possibly broken and overflowing stacks. Fix ASAP! */ -#pragma GCC diagnostic push -#if defined(__GNUC__) && !defined(__clang__) -#pragma GCC diagnostic ignored "-Wstack-usage=" -#endif int spi_flash_cmd_write(const struct spi_slave *spi, const u8 *cmd, size_t cmd_len, const void *data, size_t data_len) { - int ret; - u8 buff[cmd_len + data_len]; - memcpy(buff, cmd, cmd_len); - memcpy(buff + cmd_len, data, data_len); + int ret = 1; + struct spi_op vectors[] = { + [0] = { .dout = cmd, .bytesout = cmd_len, + .din = NULL, .bytesin = 0, }, + [1] = { .dout = data, .bytesout = data_len, + .din = NULL, .bytesin = 0, } + }; + size_t count = ARRAY_SIZE(vectors); + + if (spi_claim_bus(spi)) + return ret; + + if (spi_xfer_vector(spi, vectors, count) == 0) + ret = 0; - ret = do_spi_flash_cmd(spi, buff, cmd_len + data_len, NULL, 0); if (ret) { printk(BIOS_WARNING, "SF: Failed to send write command (%zu bytes): %d\n", data_len, ret); } + spi_release_bus(spi); return ret; }