aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPrasad J Pandit <pjp@fedoraproject.org>2017-02-28 12:08:14 +0000
committerPeter Maydell <peter.maydell@linaro.org>2017-02-28 12:08:14 +0000
commit6e86d90352adf6cb08295255220295cf23c4286e (patch)
treec1cb502bf997466041be926b4d320636b73be167
parent8b20aefac4ee8874bb9c8826e4b30e1dc8cd7511 (diff)
downloadqemu-arm-6e86d90352adf6cb08295255220295cf23c4286e.tar.gz
sd: sdhci: check transfer mode register in multi block transfer
In the SDHCI protocol, the transfer mode register value is used during multi block transfer to check if block count register is enabled and should be updated. Transfer mode register could be set such that, block count register would not be updated, thus leading to an infinite loop. Add check to avoid it. Reported-by: Wjjzhang <wjjzhang@tencent.com> Reported-by: Jiang Xin <jiangxin1@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20170214185225.7994-3-ppandit@redhat.com Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r--hw/sd/sdhci.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index a65c77dbd3..5adeab6b4b 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -487,6 +487,11 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
uint32_t boundary_chk = 1 << (((s->blksize & 0xf000) >> 12) + 12);
uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);
+ if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) {
+ qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n");
+ return;
+ }
+
/* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
* possible stop at page boundary if initial address is not page aligned,
* allow them to work properly */
@@ -798,11 +803,6 @@ static void sdhci_data_transfer(void *opaque)
if (s->trnmod & SDHC_TRNS_DMA) {
switch (SDHC_DMA_TYPE(s->hostctl)) {
case SDHC_CTRL_SDMA:
- if ((s->trnmod & SDHC_TRNS_MULTI) &&
- (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt == 0)) {
- break;
- }
-
if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {
sdhci_sdma_transfer_single_block(s);
} else {