From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1LSblQ-0004ec-I7
	for qemu-devel@nongnu.org; Thu, 29 Jan 2009 13:37:20 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1LSblO-0004dC-VA
	for qemu-devel@nongnu.org; Thu, 29 Jan 2009 13:37:20 -0500
Received: from [199.232.76.173] (port=54814 helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1LSblO-0004ct-JR
	for qemu-devel@nongnu.org; Thu, 29 Jan 2009 13:37:18 -0500
Received: from csmtp2.b-one.net ([195.47.247.206]:33199)
	by monty-python.gnu.org with esmtp (Exim 4.60)
	(envelope-from <hans-erik.floryd@rt-labs.com>) id 1LSblN-0000EE-K7
	for qemu-devel@nongnu.org; Thu, 29 Jan 2009 13:37:18 -0500
Received: from [192.168.10.151] (static-213-115-7-226.sme.bredbandsbolaget.se
	[213.115.7.226])
	by csmtp2.b-one.net (Postfix) with ESMTP id A6F3D1600187A
	for <qemu-devel@nongnu.org>; Thu, 29 Jan 2009 19:37:14 +0100 (CET)
Message-ID: <4981F759.2040803@rt-labs.com>
Date: Thu, 29 Jan 2009 19:37:13 +0100
From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] PL181 write problem
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

Hello,

The PL181 sdcard module (hw/pl181.c) doesn't seem to handle writes 
correctly. Only every fourth byte gets written to the card. I've tracked 
the problem down to the following loop in pl181_fifo_run():

         limit = is_read ? PL181_FIFO_LEN : 0;
         n = 0;
         value = 0;
         while (s->datacnt && s->fifo_len != limit) {
             if (is_read) {
                 value |= (uint32_t)sd_read_data(s->card) << (n * 8);
                 n++;
                 if (n == 4) {
                     pl181_fifo_push(s, value);
                     value = 0;
                     n = 0;
                 }
             } else {
                 if (n == 0) {
                     value = pl181_fifo_pop(s);
                     n = 4;
                 }
                 sd_write_data(s->card, value & 0xff);
                 value >>= 8;
                 n--;
             }
             s->datacnt--;
         }

When writing, a 32-bit value is popped from the fifo, followed by a 
write of 1 byte. If there was only one value in the fifo, fifo_len will 
now be 0. This causes the loop to terminate and the remaining three 
bytes will not be written.

The following patch fixes this by writing all four bytes before checking 
fifo_len.

Let me know if there's anything else I need to do to get the patch accepted.

Thanks

Index: hw/pl181.c
===================================================================
--- hw/pl181.c  (revision 5648)
+++ hw/pl181.c  (working copy)
@@ -202,16 +202,20 @@
                      value = 0;
                      n = 0;
                  }
+                s->datacnt--;
              } else {
                  if (n == 0) {
                      value = pl181_fifo_pop(s);
                      n = 4;
                  }
-                sd_write_data(s->card, value & 0xff);
-                value >>= 8;
-                n--;
+                while (s->datacnt && n != 0)
+                {
+                   sd_write_data(s->card, value & 0xff);
+                   value >>= 8;
+                   n--;
+                   s->datacnt--;
+                }
              }
-            s->datacnt--;
          }
          if (n && is_read) {
              pl181_fifo_push(s, value);