[src/netbsd-1-6]: src/sys/dev/ic pullup-1-6 ticket #201:

[thorpej <thorpej%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/44adde37f52b
branches:  netbsd-1-6
changeset: 527797:44adde37f52b
user:      thorpej <thorpej%NetBSD.org@localhost>
date:      Fri Jun 07 19:37:06 2002 +0000

description:
pullup-1-6 ticket #201:

syssrc/sys/dev/ic/seeq8005.c 1.33

When copying a block with an odd size to or from the card, be very careful
not to overrun the end of it on the host side, since that might just slip over
a page boundary and cause an embarrassing kernel panic.

diffstat:

 sys/dev/ic/seeq8005.c |  20 ++++++++++----------
 1 files changed, 10 insertions(+), 10 deletions(-)

diffs (62 lines):

diff -r f355bbe06fa0 -r 44adde37f52b sys/dev/ic/seeq8005.c
--- a/sys/dev/ic/seeq8005.c     Fri Jun 07 19:34:49 2002 +0000
+++ b/sys/dev/ic/seeq8005.c     Fri Jun 07 19:37:06 2002 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: seeq8005.c,v 1.32 2001/11/15 09:48:07 lukem Exp $ */
+/* $NetBSD: seeq8005.c,v 1.32.10.1 2002/06/07 19:37:06 thorpej Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Ben Harris
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: seeq8005.c,v 1.32 2001/11/15 09:48:07 lukem Exp $");
+__KERNEL_RCSID(0, "$NetBSD: seeq8005.c,v 1.32.10.1 2002/06/07 19:37:06 thorpej Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -595,10 +595,6 @@
                panic("%s: writebuf out of range", sc->sc_dev.dv_xname);
 #endif
 
-       /* Assume that copying too much is safe. */
-       if (len % 2 != 0)
-               len++;
-
        if (addr != -1) {
                ea_await_fifo_empty(sc);
 
@@ -616,6 +612,10 @@
                        bus_space_write_multi_2(iot, ioh, SEEQ_BUFWIN,
                            (u_int16_t *)buf, len / 2);
        }
+       if (!(sc->sc_flags & SF_8BIT) && len % 2) {
+               /* Write the last byte */
+               bus_space_write_2(iot, ioh, SEEQ_BUFWIN, buf[len - 1]);
+       }
        /* Leave FIFO to empty in the background */
 }
 
@@ -647,10 +647,6 @@
                panic("%s: readbuf out of range", sc->sc_dev.dv_xname);
 #endif
 
-       /* Assume that copying too much is safe. */
-       if (len % 2 != 0)
-               len++;
-
        if (addr != -1) {
                /*
                 * SEEQ 80C04 bug:
@@ -696,6 +692,10 @@
                        bus_space_read_multi_2(iot, ioh, SEEQ_BUFWIN,
                            (u_int16_t *)buf, len / 2);
        }
+       if (!(sc->sc_flags & SF_8BIT) && len % 2) {
+               /* Read the last byte */
+               buf[len - 1] = bus_space_read_2(iot, ioh, SEEQ_BUFWIN);
+       }
 }
 
 static void