Commit 6e86d903 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Peter Maydell
Browse files

sd: sdhci: check transfer mode register in multi block transfer 



In the SDHCI protocol, the transfer mode register value
is used during multi block transfer to check if block count
register is enabled and should be updated. Transfer mode
register could be set such that, block count register would
not be updated, thus leading to an infinite loop. Add check
to avoid it.

Reported-by: default avatarWjjzhang <wjjzhang@tencent.com>
Reported-by: default avatarJiang Xin <jiangxin1@huawei.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170214185225.7994-3-ppandit@redhat.com
Reviewed-by: default avatarAlistair Francis <alistair.francis@xilinx.com>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 8b20aefa

hw/sd/sdhci.c

+5 −5
Original line number Diff line number Diff line
@@ -487,6 +487,11 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) 
    uint32_t boundary_chk = 1 << (((s->blksize & 0xf000) >> 12) + 12);

    uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);



    if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) {

        qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n");

        return;

    }



    /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for

     * possible stop at page boundary if initial address is not page aligned,

     * allow them to work properly */
@@ -798,11 +803,6 @@ static void sdhci_data_transfer(void *opaque) 
    if (s->trnmod & SDHC_TRNS_DMA) {

        switch (SDHC_DMA_TYPE(s->hostctl)) {

        case SDHC_CTRL_SDMA:

            if ((s->trnmod & SDHC_TRNS_MULTI) &&

                    (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt == 0)) {

                break;

            }



            if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {

                sdhci_sdma_transfer_single_block(s);

            } else {