Skip to content

Commit a466997

Browse files
[nrf fromlist] drivers: i2s: nrf_tdm: Add guards for buffers size
TDM peripheral requires TXD.MAXCNT and RXD.MAXCNT registers to be: - multiple of 4 bytes - larger than 8 bytes Upstream PR #: 100288 Signed-off-by: Adam Kondraciuk <[email protected]>
1 parent 56fbb4f commit a466997

File tree

1 file changed

+16
-4
lines changed

1 file changed

+16
-4
lines changed

drivers/i2s/i2s_nrf_tdm.c

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ LOG_MODULE_REGISTER(tdm_nrf, CONFIG_I2S_LOG_LEVEL);
3232
*/
3333
#define NRFX_TDM_STATUS_TRANSFER_STOPPED BIT(1)
3434

35+
/* Minimum value of the MAXCNT register. */
36+
#define NRFX_TDM_MAXCNT_MIN_VALUE 8
37+
3538
/* Maximum clock divider value. Corresponds to CKDIV2. */
3639
#define NRFX_TDM_MAX_SCK_DIV_VALUE TDM_CONFIG_SCK_DIV_SCKDIV_Max
3740
#define NRFX_TDM_MAX_MCK_DIV_VALUE TDM_CONFIG_MCK_DIV_DIV_Max
@@ -475,9 +478,11 @@ static int tdm_nrf_configure(const struct device *dev, enum i2s_dir dir,
475478

476479
__ASSERT_NO_MSG(tdm_cfg->mem_slab != NULL && tdm_cfg->block_size != 0);
477480

478-
if ((tdm_cfg->block_size % sizeof(uint32_t)) != 0) {
479-
LOG_ERR("This device can transfer only full 32-bit words");
480-
return -EINVAL;
481+
if ((tdm_cfg->block_size % sizeof(uint32_t)) != 0 ||
482+
tdm_cfg->block_size < NRFX_TDM_MAXCNT_MIN_VALUE) {
483+
LOG_ERR("This device can only transmit full 32-bit words greater than %u bytes length.",
484+
NRFX_TDM_MAXCNT_MIN_VALUE);
485+
return -EIO;
481486
}
482487

483488
switch (tdm_cfg->word_size) {
@@ -673,11 +678,18 @@ static int tdm_nrf_write(const struct device *dev, void *mem_block, size_t size)
673678
return -EIO;
674679
}
675680

676-
if (size > drv_data->tx.cfg.block_size || size < sizeof(uint32_t)) {
681+
if (size > drv_data->tx.cfg.block_size) {
677682
LOG_ERR("This device can only write blocks up to %u bytes",
678683
drv_data->tx.cfg.block_size);
679684
return -EIO;
680685
}
686+
687+
if ((size % sizeof(uint32_t)) != 0 || size < NRFX_TDM_MAXCNT_MIN_VALUE) {
688+
LOG_ERR("This device can only write full 32-bit words greater than %u bytes length.",
689+
NRFX_TDM_MAXCNT_MIN_VALUE);
690+
return -EIO;
691+
}
692+
681693
ret = dmm_buffer_out_prepare(drv_cfg->mem_reg, buf.mem_block, buf.size,
682694
(void **)&buf.dmm_buf);
683695
ret = k_msgq_put(&drv_data->tx_queue, &buf, SYS_TIMEOUT_MS(drv_data->tx.cfg.timeout));

0 commit comments

Comments
 (0)