Block Size Register bits [14:12] is SDMA Buffer Boundary, it is missed
in register write, but it is needed in SDMA transfer. e.g. it will be
used in sdhci_sdma_transfer_multi_blocks to calculate boundary_ variables.

Missing this field will cause wrong operation for different SDMA Buffer
Boundary settings.

Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
Fixes: dfba99f17f ("hw/sdhci: Fix DMA Transfer Block Size field")

Signed-off-by: Lu Gao <lu.gao@verisilicon.com>
Signed-off-by: Jianxian Wen <jianxian.wen@verisilicon.com>
Reviewed-by: Philippe Mathieu-Daudé? <f4bug@amsat.org>
---
v2:
 - Add fixes information and reviewed-by information

 hw/sd/sdhci.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 5564765a9b..40473b0db0 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -321,6 +321,8 @@ static void sdhci_poweron_reset(DeviceState *dev)
 
 static void sdhci_data_transfer(void *opaque);
 
+#define BLOCK_SIZE_MASK (4 * KiB - 1)
+
 static void sdhci_send_command(SDHCIState *s)
 {
     SDRequest request;
@@ -371,7 +373,8 @@ static void sdhci_send_command(SDHCIState *s)
 
     sdhci_update_irq(s);
 
-    if (!timeout && s->blksize && (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
+    if (!timeout && (s->blksize & BLOCK_SIZE_MASK) &&
+        (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
         s->data_count = 0;
         sdhci_data_transfer(s);
     }
@@ -406,7 +409,6 @@ static void sdhci_end_transfer(SDHCIState *s)
 /*
  * Programmed i/o data transfer
  */
-#define BLOCK_SIZE_MASK (4 * KiB - 1)
 
 /* Fill host controller's read buffer with BLKSIZE bytes of data from card */
 static void sdhci_read_block_from_card(SDHCIState *s)
@@ -1154,7 +1156,8 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
             s->sdmasysad = (s->sdmasysad & mask) | value;
             MASKED_WRITE(s->sdmasysad, mask, value);
             /* Writing to last byte of sdmasysad might trigger transfer */
-            if (!(mask & 0xFF000000) && s->blkcnt && s->blksize &&
+            if (!(mask & 0xFF000000) && s->blkcnt &&
+                (s->blksize & BLOCK_SIZE_MASK) &&
                 SDHC_DMA_TYPE(s->hostctl1) == SDHC_CTRL_SDMA) {
                 if (s->trnmod & SDHC_TRNS_MULTI) {
                     sdhci_sdma_transfer_multi_blocks(s);
@@ -1168,7 +1171,11 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         if (!TRANSFERRING_DATA(s->prnsts)) {
             uint16_t blksize = s->blksize;
 
-            MASKED_WRITE(s->blksize, mask, extract32(value, 0, 12));
+            /*
+             * [14:12] SDMA Buffer Boundary
+             * [11:00] Transfer Block Size
+             */
+            MASKED_WRITE(s->blksize, mask, extract32(value, 0, 15));
             MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
 
             /* Limit block size to the maximum buffer size */
-- 
2.17.1

22.09.2023 05:03, Lu Gao:
> Block Size Register bits [14:12] is SDMA Buffer Boundary, it is missed
> in register write, but it is needed in SDMA transfer. e.g. it will be
> used in sdhci_sdma_transfer_multi_blocks to calculate boundary_ variables.
> 
> Missing this field will cause wrong operation for different SDMA Buffer
> Boundary settings.
> 
> Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
> Fixes: dfba99f17f ("hw/sdhci: Fix DMA Transfer Block Size field")

Is this change stable-worthy?  Not understanding the implications, so
have to ask :)

Thanks,

/mjt

On 22/9/23 04:03, Lu Gao wrote:
> Block Size Register bits [14:12] is SDMA Buffer Boundary, it is missed
> in register write, but it is needed in SDMA transfer. e.g. it will be
> used in sdhci_sdma_transfer_multi_blocks to calculate boundary_ variables.
> 
> Missing this field will cause wrong operation for different SDMA Buffer
> Boundary settings.
> 
> Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
> Fixes: dfba99f17f ("hw/sdhci: Fix DMA Transfer Block Size field")
> 
> Signed-off-by: Lu Gao <lu.gao@verisilicon.com>
> Signed-off-by: Jianxian Wen <jianxian.wen@verisilicon.com>
> Reviewed-by: Philippe Mathieu-Daudé? <f4bug@amsat.org>
> ---
> v2:
>   - Add fixes information and reviewed-by information
> 
>   hw/sd/sdhci.c | 15 +++++++++++----
>   1 file changed, 11 insertions(+), 4 deletions(-)

Thank you, queued (pull request will be next week).