diff mbox

[03/17] mmc: tmio: Fix odd size access

Message ID 87fvqzz3hk.wl%kuninori.morimoto.gx@renesas.com (mailing list archive)
State New, archived
Headers show

Commit Message

Kuninori Morimoto Nov. 14, 2013, 10:23 a.m. UTC
From: Shinobu Uehara <shinobu.uehara.xc@renesas.com>

Current sd_ctrl_read/write16_rep() doesn't care odd size

Signed-off-by: Shinobu Uehara <shinobu.uehara.xc@renesas.com>
Signed-off-by: Ryo Kataoka <ryo.kataoka.wt@renesas.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
---
 drivers/mmc/host/tmio_mmc_pio.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Laurent Pinchart Nov. 14, 2013, 1:32 p.m. UTC | #1
Hi Morimoto-san,

Thank you for the patch.

On Thursday 14 November 2013 02:23:23 Kuninori Morimoto wrote:
> From: Shinobu Uehara <shinobu.uehara.xc@renesas.com>
> 
> Current sd_ctrl_read/write16_rep() doesn't care odd size
> 
> Signed-off-by: Shinobu Uehara <shinobu.uehara.xc@renesas.com>
> Signed-off-by: Ryo Kataoka <ryo.kataoka.wt@renesas.com>
> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
> ---
>  drivers/mmc/host/tmio_mmc_pio.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/mmc/host/tmio_mmc_pio.c
> b/drivers/mmc/host/tmio_mmc_pio.c index b380225..05ae15c 100644
> --- a/drivers/mmc/host/tmio_mmc_pio.c
> +++ b/drivers/mmc/host/tmio_mmc_pio.c
> @@ -386,9 +386,11 @@ static void tmio_mmc_pio_irq(struct tmio_mmc_host
> *host)
> 
>  	/* Transfer the data */
>  	if (data->flags & MMC_DATA_READ)
> -		sd_ctrl_read16_rep(host, CTL_SD_DATA_PORT, buf, count >> 1);
> +		sd_ctrl_read16_rep(host,
> +			CTL_SD_DATA_PORT, buf, (count + 1) >> 1);
>  	else
> -		sd_ctrl_write16_rep(host, CTL_SD_DATA_PORT, buf, count >> 1);
> +		sd_ctrl_write16_rep(host,
> +			CTL_SD_DATA_PORT, buf, (count + 1) >> 1);

This means that the hardware will transfer one more byte than the requested 
value. Have you verified that the buffer will always have room for that extra 
byte (when reading from the hardware), and that the extra byte will not have 
any side effect (when writing to the hardware) ? I'm also a bit surprised, do 
upper layers transfer data to/from the card using odd number of bytes ?

>  	host->sg_off += count;
diff mbox

Patch

diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c
index b380225..05ae15c 100644
--- a/drivers/mmc/host/tmio_mmc_pio.c
+++ b/drivers/mmc/host/tmio_mmc_pio.c
@@ -386,9 +386,11 @@  static void tmio_mmc_pio_irq(struct tmio_mmc_host *host)
 
 	/* Transfer the data */
 	if (data->flags & MMC_DATA_READ)
-		sd_ctrl_read16_rep(host, CTL_SD_DATA_PORT, buf, count >> 1);
+		sd_ctrl_read16_rep(host,
+			CTL_SD_DATA_PORT, buf, (count + 1) >> 1);
 	else
-		sd_ctrl_write16_rep(host, CTL_SD_DATA_PORT, buf, count >> 1);
+		sd_ctrl_write16_rep(host,
+			CTL_SD_DATA_PORT, buf, (count + 1) >> 1);
 
 	host->sg_off += count;