From mboxrd@z Thu Jan  1 00:00:00 1970
From: Qianyu Gong <qianyu.gong@nxp.com>
Date: Wed, 20 Jan 2016 03:28:47 +0000
Subject: [U-Boot] [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy
	issue
In-Reply-To: <AM4PR0401MB1732C21C2B7A1CFD9AE5B7729AC10@AM4PR0401MB1732.eurprd04.prod.outlook.com>
References: <1452478010-5958-1-git-send-email-Qianyu.Gong@nxp.com>
 <AM4PR0401MB1732C21C2B7A1CFD9AE5B7729AC10@AM4PR0401MB1732.eurprd04.prod.outlook.com>
Message-ID: <AM2PR04MB096415AAACEB250F5422CC04E7C20@AM2PR04MB0964.eurprd04.prod.outlook.com>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de


> -----Original Message-----
> From: york sun
> Sent: Wednesday, January 20, 2016 2:47 AM
> To: Qianyu Gong <qianyu.gong@nxp.com>; u-boot at lists.denx.de
> Cc: Mingkai Hu <mingkai.hu@nxp.com>; jteki at openedev.com; Yao Yuan
> <yao.yuan@nxp.com>; R58495 at freescale.com; Gong Qianyu
> <Qianyu.Gong@freescale.com>
> Subject: Re: [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue
> 
> On 01/10/2016 06:15 PM, Gong Qianyu wrote:
> > From: Gong Qianyu <Qianyu.Gong@freescale.com>
> >
> > In current driver everytime we memcpy 4 bytes to the dest memory
> > regardless of the remaining length.
> > This patch adds checking the remaining length before memcpy.
> > If the length is shorter than 4 bytes, memcpy the actual length of
> > data to the dest memory.
> >
> > Signed-off-by: Gong Qianyu <Qianyu.Gong@freescale.com>
> > ---
> > V2-V4:
> >  - No change.
> >
> >  drivers/spi/fsl_qspi.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c index
> > 9f23c10..4d58211 100644
> > --- a/drivers/spi/fsl_qspi.c
> > +++ b/drivers/spi/fsl_qspi.c
> > @@ -500,7 +500,10 @@ static void qspi_op_rdid(struct fsl_qspi_priv *priv, u32
> *rxbuf, u32 len)
> >  		if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
> >  			data = qspi_read32(priv->flags, &regs->rbdr[i]);
> >  			data = qspi_endian_xchg(data);
> > -			memcpy(rxbuf, &data, 4);
> > +			if (size < 4)
> > +				memcpy(rxbuf, &data, size);
> > +			else
> > +				memcpy(rxbuf, &data, 4);
> >  			rxbuf++;
> >  			size -= 4;
> >  			i++;
> >
> 
> Doesn't the line "size -= 4" need a fix as well? I guess it runs OK for checking (size >
> 0), but it looks odd.
> 
> York

I paste the related code. It checks (size > 0) in the while loop:

        i = 0;
        size = len;
        while ((RX_BUFFER_SIZE >= size) && (size > 0)) {
                rbsr_reg = qspi_read32(priv->flags, &regs->rbsr);
                if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
                        data = qspi_read32(priv->flags, &regs->rbdr[i]);
                        data = qspi_endian_xchg(data);
                        if (size < 4)
                                memcpy(rxbuf, &data, size);
                        else
                                memcpy(rxbuf, &data, 4);
                        rxbuf++;
                        size -= 4;
                        i++;
                }
        }