Skip to content

Commit 75b53ae

Browse files
Paul Walmsleycjb
authored andcommitted
mmc: omap: fix broken PIO mode
After commit 26b8852 ("mmc: omap_hsmmc: remove private DMA API implementation"), the Nokia N800 here stopped booting: [ 2.086181] Waiting for root device /dev/mmcblk0p1... [ 2.324066] Unhandled fault: imprecise external abort (0x406) at 0x00000000 [ 2.331451] Internal error: : 406 [#1] ARM [ 2.335784] Modules linked in: [ 2.339050] CPU: 0 Not tainted (3.6.0-rc3 #60) [ 2.344146] PC is at default_idle+0x28/0x30 [ 2.348602] LR is at trace_hardirqs_on_caller+0x15c/0x1b0 ... This turned out to be due to memory corruption caused by long-broken PIO code in drivers/mmc/host/omap.c. (Previously, this driver had been using DMA; but the above commit caused the MMC driver to fall back to PIO mode with an unmodified Kconfig.) The PIO code, added with the rest of the driver in commit 730c9b7 ("[MMC] Add OMAP MMC host driver"), confused bytes with 16-bit words. This bug caused memory located after the PIO transfer buffer to be corrupted with transfers larger than 32 bytes. The driver also did not increment the buffer pointer after the transfer occurred. This bug resulted in data corruption during any transfer larger than 64 bytes. Signed-off-by: Paul Walmsley <[email protected]> Reviewed-by: Felipe Balbi <[email protected]> Tested-by: Tony Lindgren <[email protected]> Signed-off-by: Chris Ball <[email protected]>
1 parent 3550ccd commit 75b53ae

File tree

1 file changed

+11
-3
lines changed

1 file changed

+11
-3
lines changed

drivers/mmc/host/omap.c

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -668,7 +668,7 @@ mmc_omap_clk_timer(unsigned long data)
668668
static void
669669
mmc_omap_xfer_data(struct mmc_omap_host *host, int write)
670670
{
671-
int n;
671+
int n, nwords;
672672

673673
if (host->buffer_bytes_left == 0) {
674674
host->sg_idx++;
@@ -678,15 +678,23 @@ mmc_omap_xfer_data(struct mmc_omap_host *host, int write)
678678
n = 64;
679679
if (n > host->buffer_bytes_left)
680680
n = host->buffer_bytes_left;
681+
682+
nwords = n / 2;
683+
nwords += n & 1; /* handle odd number of bytes to transfer */
684+
681685
host->buffer_bytes_left -= n;
682686
host->total_bytes_left -= n;
683687
host->data->bytes_xfered += n;
684688

685689
if (write) {
686-
__raw_writesw(host->virt_base + OMAP_MMC_REG(host, DATA), host->buffer, n);
690+
__raw_writesw(host->virt_base + OMAP_MMC_REG(host, DATA),
691+
host->buffer, nwords);
687692
} else {
688-
__raw_readsw(host->virt_base + OMAP_MMC_REG(host, DATA), host->buffer, n);
693+
__raw_readsw(host->virt_base + OMAP_MMC_REG(host, DATA),
694+
host->buffer, nwords);
689695
}
696+
697+
host->buffer += nwords;
690698
}
691699

692700
static inline void mmc_omap_report_irq(u16 status)

0 commit comments

Comments
 (0)