Re: [PATCH-for-10.1 02/11] hw/sd/sdbus: Provide buffer size to sdbus_do_command()

[Richard Henderson]

On 8/1/25 07:27, Philippe Mathieu-Daudé wrote:

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 226ff133ff9..f1e149f46f3 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -346,7 +346,7 @@ static void sdhci_send_command(SDHCIState *s)
      request.arg = s->argument;

trace_sdhci_send_command(request.cmd, request.arg);

-    rlen = sdbus_do_command(&s->sdbus, &request, response);
+    rlen = sdbus_do_command(&s->sdbus, &request, response, sizeof(response));

Change rlen to size_t to match.

diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index 6c90a86ab41..3aba0e08ffe 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -146,7 +146,8 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, 
uint32_t val)
              /* manually issue cmd12 to stop the transfer */
              request.cmd = 12;
              request.arg = 0;
-            s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
+            s->arglen = sdbus_do_command(&s->sdbus, &request,
+                                         longresp, sizeof(longresp));
              if (s->arglen <= 0) {
                  s->arglen = 1;
                  /* a zero value indicates the card is busy */
@@ -171,8 +172,9 @@ static uint32_t ssi_sd_transfer(SSIPeripheral *dev, 
uint32_t val)
              request.cmd = s->cmd;
              request.arg = ldl_be_p(s->cmdarg);
              DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
-            s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
-            if (s->arglen <= 0) {
+            s->arglen = sdbus_do_command(&s->sdbus, &request,
+                                         longresp, sizeof(longresp));
+            if (s->arglen == 0) {
                  s->arglen = 1;
                  s->response[0] = 4;
                  DPRINTF("SD command failed\n");

arglen is int32_t, and the comparison <= 0 is now wrong.


r~