From 143eb1d3b413bcabe4fa1029d5cfb2c987719ed4 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Tue, 21 Apr 2015 16:25:02 -0700 Subject: [PATCH] firmware: socfpga: Fix a bug in fpgamgr_program_write_buf() Fix a bug in fpgamgr_program_write_buf() where .rbf file whose length is not a multiple of 4 would cause an integer overflow which would result in infinite loop. Signed-off-by: Andrey Smirnov Signed-off-by: Sascha Hauer --- drivers/firmware/socfpga.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/socfpga.c b/drivers/firmware/socfpga.c index a5dc6072a..14a7a14c6 100644 --- a/drivers/firmware/socfpga.c +++ b/drivers/firmware/socfpga.c @@ -324,13 +324,27 @@ static int fpgamgr_program_write_buf(struct firmware_handler *fh, const void *bu const uint32_t *buf32 = buf; /* write to FPGA Manager AXI data */ - while (size) { + while (size >= sizeof(uint32_t)) { writel(*buf32, mgr->regs_data); readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS); buf32++; size -= sizeof(uint32_t); } + if (size) { + const uint8_t *buf8 = (const uint8_t *)buf32; + uint32_t word = 0; + + while (size--) { + word |= *buf8; + word <<= 8; + buf8++; + } + + writel(word, mgr->regs_data); + readl(mgr->regs + FPGAMGRREGS_MON_GPIO_EXT_PORTA_ADDRESS); + } + return 0; }