DM320: Fix buffer overrun in sdmmc driver

Modify count, buffer and start address only after successful transfer.
This makes the retry operation to use the same address and buffer as the
just failed transfer.

Change-Id: I4f49bbdc861d634e33ea5e939a9693474411d24d

1 files changed, 4 insertions, 5 deletions

diff --git a/firmware/target/arm/tms320dm320/sdmmc-dm320.c b/firmware/target/arm/tms320dm320/sdmmc-dm320.c
index 8818d645d8..f479b54a91 100644
--- a/firmware/target/arm/tms320dm320/sdmmc-dm320.c
+++ b/firmware/target/arm/tms320dm320/sdmmc-dm320.c
@@ -713,8 +713,6 @@ sd_transfer_retry:
             goto sd_transfer_error;
         }
 
-        count -= count_per_dma;
-
         if (write == false)
         {
             discard_dcache_range(use_direct_dma ? buffer : aligned_buffer,
@@ -726,9 +724,6 @@ sd_transfer_retry:
             }
         }
 
-        buffer += count_per_dma*SD_BLOCK_SIZE;
-        start_addr += count_per_dma;
-
         last_disk_activity = current_tick;
 
         ret = sd_command(SD_STOP_TRANSMISSION, 0, SDHC_RESP_FMT_1, NULL);
@@ -742,6 +737,10 @@ sd_transfer_retry:
         {
             goto sd_transfer_error;
         }
+
+        count -= count_per_dma;
+        buffer += count_per_dma*SD_BLOCK_SIZE;
+        start_addr += count_per_dma;
     } while (count > 0);
 
     while (1)