[U-Boot] [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue

[U-Boot] [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue

[Gong Qianyu]

From: Gong Qianyu <Qianyu.Gong@freescale.com>

In current driver everytime we memcpy 4 bytes to the dest memory
regardless of the remaining length.
This patch adds checking the remaining length before memcpy.
If the length is shorter than 4 bytes, memcpy the actual length of data
to the dest memory.

Signed-off-by: Gong Qianyu <Qianyu.Gong@freescale.com>
---
V2-V4:
 - No change.
 
 drivers/spi/fsl_qspi.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c
index 9f23c10..4d58211 100644
--- a/drivers/spi/fsl_qspi.c
+++ b/drivers/spi/fsl_qspi.c
@@ -500,7 +500,10 @@ static void qspi_op_rdid(struct fsl_qspi_priv *priv, u32 *rxbuf, u32 len)
 		if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
 			data = qspi_read32(priv->flags, &regs->rbdr[i]);
 			data = qspi_endian_xchg(data);
-			memcpy(rxbuf, &data, 4);
+			if (size < 4)
+				memcpy(rxbuf, &data, size);
+			else
+				memcpy(rxbuf, &data, 4);
 			rxbuf++;
 			size -= 4;
 			i++;
-- 
2.1.0.27.g96db324

[U-Boot] [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue

[york sun]

On 01/10/2016 06:15 PM, Gong Qianyu wrote:
> From: Gong Qianyu <Qianyu.Gong@freescale.com>
> 
> In current driver everytime we memcpy 4 bytes to the dest memory
> regardless of the remaining length.
> This patch adds checking the remaining length before memcpy.
> If the length is shorter than 4 bytes, memcpy the actual length of data
> to the dest memory.
> 
> Signed-off-by: Gong Qianyu <Qianyu.Gong@freescale.com>
> ---
> V2-V4:
>  - No change.
>  
>  drivers/spi/fsl_qspi.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c
> index 9f23c10..4d58211 100644
> --- a/drivers/spi/fsl_qspi.c
> +++ b/drivers/spi/fsl_qspi.c
> @@ -500,7 +500,10 @@ static void qspi_op_rdid(struct fsl_qspi_priv *priv, u32 *rxbuf, u32 len)
>  		if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
>  			data = qspi_read32(priv->flags, &regs->rbdr[i]);
>  			data = qspi_endian_xchg(data);
> -			memcpy(rxbuf, &data, 4);
> +			if (size < 4)
> +				memcpy(rxbuf, &data, size);
> +			else
> +				memcpy(rxbuf, &data, 4);
>  			rxbuf++;
>  			size -= 4;
>  			i++;
> 

Doesn't the line "size -= 4" need a fix as well? I guess it runs OK for checking
(size > 0), but it looks odd.

York

[U-Boot] [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue

[Qianyu Gong]

> -----Original Message-----
> From: york sun
> Sent: Wednesday, January 20, 2016 2:47 AM
> To: Qianyu Gong <qianyu.gong@nxp.com>; u-boot at lists.denx.de
> Cc: Mingkai Hu <mingkai.hu@nxp.com>; jteki at openedev.com; Yao Yuan
> <yao.yuan@nxp.com>; R58495 at freescale.com; Gong Qianyu
> <Qianyu.Gong@freescale.com>
> Subject: Re: [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue
> 
> On 01/10/2016 06:15 PM, Gong Qianyu wrote:
> > From: Gong Qianyu <Qianyu.Gong@freescale.com>
> >
> > In current driver everytime we memcpy 4 bytes to the dest memory
> > regardless of the remaining length.
> > This patch adds checking the remaining length before memcpy.
> > If the length is shorter than 4 bytes, memcpy the actual length of
> > data to the dest memory.
> >
> > Signed-off-by: Gong Qianyu <Qianyu.Gong@freescale.com>
> > ---
> > V2-V4:
> >  - No change.
> >
> >  drivers/spi/fsl_qspi.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c index
> > 9f23c10..4d58211 100644
> > --- a/drivers/spi/fsl_qspi.c
> > +++ b/drivers/spi/fsl_qspi.c
> > @@ -500,7 +500,10 @@ static void qspi_op_rdid(struct fsl_qspi_priv *priv, u32
> *rxbuf, u32 len)
> >  		if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
> >  			data = qspi_read32(priv->flags, &regs->rbdr[i]);
> >  			data = qspi_endian_xchg(data);
> > -			memcpy(rxbuf, &data, 4);
> > +			if (size < 4)
> > +				memcpy(rxbuf, &data, size);
> > +			else
> > +				memcpy(rxbuf, &data, 4);
> >  			rxbuf++;
> >  			size -= 4;
> >  			i++;
> >
> 
> Doesn't the line "size -= 4" need a fix as well? I guess it runs OK for checking (size >
> 0), but it looks odd.
> 
> York

I paste the related code. It checks (size > 0) in the while loop:

        i = 0;
        size = len;
        while ((RX_BUFFER_SIZE >= size) && (size > 0)) {
                rbsr_reg = qspi_read32(priv->flags, &regs->rbsr);
                if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
                        data = qspi_read32(priv->flags, &regs->rbdr[i]);
                        data = qspi_endian_xchg(data);
                        if (size < 4)
                                memcpy(rxbuf, &data, size);
                        else
                                memcpy(rxbuf, &data, 4);
                        rxbuf++;
                        size -= 4;
                        i++;
                }
        }