From nobody Mon Feb 9 00:26:57 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 148822044344632.536224831804816; Mon, 27 Feb 2017 10:34:03 -0800 (PST) Received: from localhost ([::1]:55642 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ciQ7V-000213-8l for importer@patchew.org; Mon, 27 Feb 2017 13:34:01 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52233) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ciPfk-0002RX-DI for qemu-devel@nongnu.org; Mon, 27 Feb 2017 13:05:23 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ciPfh-0001x4-Bj for qemu-devel@nongnu.org; Mon, 27 Feb 2017 13:05:20 -0500 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:48678) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ciPfh-0001qs-2E for qemu-devel@nongnu.org; Mon, 27 Feb 2017 13:05:17 -0500 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.84_2) (envelope-from ) id 1ciPfS-0002Jd-FP for qemu-devel@nongnu.org; Mon, 27 Feb 2017 18:05:02 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 27 Feb 2017 18:04:33 +0000 Message-Id: <1488218699-31035-5-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488218699-31035-1-git-send-email-peter.maydell@linaro.org> References: <1488218699-31035-1-git-send-email-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PULL 04/30] sd: sdhci: check transfer mode register in multi block transfer X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Prasad J Pandit In the SDHCI protocol, the transfer mode register value is used during multi block transfer to check if block count register is enabled and should be updated. Transfer mode register could be set such that, block count register would not be updated, thus leading to an infinite loop. Add check to avoid it. Reported-by: Wjjzhang Reported-by: Jiang Xin Signed-off-by: Prasad J Pandit Message-id: 20170214185225.7994-3-ppandit@redhat.com Reviewed-by: Alistair Francis Signed-off-by: Peter Maydell --- hw/sd/sdhci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index a65c77d..5adeab6 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -487,6 +487,11 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIStat= e *s) uint32_t boundary_chk =3D 1 << (((s->blksize & 0xf000) >> 12) + 12); uint32_t boundary_count =3D boundary_chk - (s->sdmasysad % boundary_ch= k); =20 + if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) { + qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n"); + return; + } + /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account f= or * possible stop at page boundary if initial address is not page align= ed, * allow them to work properly */ @@ -798,11 +803,6 @@ static void sdhci_data_transfer(void *opaque) if (s->trnmod & SDHC_TRNS_DMA) { switch (SDHC_DMA_TYPE(s->hostctl)) { case SDHC_CTRL_SDMA: - if ((s->trnmod & SDHC_TRNS_MULTI) && - (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt =3D= =3D 0)) { - break; - } - if ((s->blkcnt =3D=3D 1) || !(s->trnmod & SDHC_TRNS_MULTI)) { sdhci_sdma_transfer_single_block(s); } else { --=20 2.7.4