-----Original Message----- From: york sun Sent: Wednesday, January 20, 2016 2:47 AM To: Qianyu Gong qianyu.gong@nxp.com; u-boot@lists.denx.de Cc: Mingkai Hu mingkai.hu@nxp.com; jteki@openedev.com; Yao Yuan yao.yuan@nxp.com; R58495@freescale.com; Gong Qianyu Qianyu.Gong@freescale.com Subject: Re: [Patch V4 2/4] spi: fsl_qspi: Fix qspi_op_rdid memcpy issue

On 01/10/2016 06:15 PM, Gong Qianyu wrote:

...

From: Gong Qianyu Qianyu.Gong@freescale.com

In current driver everytime we memcpy 4 bytes to the dest memory regardless of the remaining length. This patch adds checking the remaining length before memcpy. If the length is shorter than 4 bytes, memcpy the actual length of data to the dest memory.

Signed-off-by: Gong Qianyu Qianyu.Gong@freescale.com

V2-V4:

• No change.

drivers/spi/fsl_qspi.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/fsl_qspi.c b/drivers/spi/fsl_qspi.c index 9f23c10..4d58211 100644 --- a/drivers/spi/fsl_qspi.c +++ b/drivers/spi/fsl_qspi.c @@ -500,7 +500,10 @@ static void qspi_op_rdid(struct fsl_qspi_priv *priv, u32

*rxbuf, u32 len)

...

if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) {
	data = qspi_read32(priv->flags, &regs->rbdr[i]);
	data = qspi_endian_xchg(data);

• 	memcpy(rxbuf, &data, 4);
  

• 	if (size < 4)
  

• 		memcpy(rxbuf, &data, size);
  

• 	else
  

• 		memcpy(rxbuf, &data, 4);
  rxbuf++;
  size -= 4;
  i++;
  
  

Doesn't the line "size -= 4" need a fix as well? I guess it runs OK for checking (size > 0), but it looks odd.

York

I paste the related code. It checks (size > 0) in the while loop:

i = 0; size = len; while ((RX_BUFFER_SIZE >= size) && (size > 0)) { rbsr_reg = qspi_read32(priv->flags, &regs->rbsr); if (rbsr_reg & QSPI_RBSR_RDBFL_MASK) { data = qspi_read32(priv->flags, &regs->rbdr[i]); data = qspi_endian_xchg(data); if (size < 4) memcpy(rxbuf, &data, size); else memcpy(rxbuf, &data, 4); rxbuf++; size -= 4; i++; } }