[lkml]   [2017]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.18 1/9] i2c: ismt: Dont duplicate the receive length for block reads
3.18-stable review patch.  If anyone has any objections, please let me know.


From: Stephen Douthit <>

commit b6c159a9cb69c2cf0bf59d4e12c3a2da77e4d994 upstream.

According to Table 15-14 of the C2000 EDS (Intel doc #510524) the
rx data pointed to by the descriptor dptr contains the byte count.

desc->rxbytes reports all bytes read on the wire, including the
"byte count" byte. So if a device sends 4 bytes in response to a
block read, on the wire and in the DMA buffer we see:

count data1 data2 data3 data4
0x04 0xde 0xad 0xbe 0xef

That's what we want to return in data->block to the next level.

Instead we were actually prefixing that with desc->rxbytes:

count count data1 data2 data3 data4
0x05 0x04 0xde 0xad 0xbe 0xef

This was discovered while developing a BMC solution relying on the
ipmi_ssif.c driver which was trying to interpret the bogus length
field as part of the IPMI response.

Signed-off-by: Stephen Douthit <>
Tested-by: Dan Priamo <>
Acked-by: Neil Horman <>
Signed-off-by: Wolfram Sang <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/i2c/busses/i2c-ismt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -340,8 +340,8 @@ static int ismt_process_desc(const struc
- memcpy(&data->block[1], dma_buffer, desc->rxbytes);
- data->block[0] = desc->rxbytes;
+ memcpy(data->block, dma_buffer, desc->rxbytes);
+ data->block[0] = desc->rxbytes - 1;
return 0;

 \ /
  Last update: 2017-09-05 09:10    [W:0.115 / U:2.980 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site