[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 6/8] hw/sd/sdhci: Honor failed DMA transactions
From: |
Thomas Huth |
Subject: |
[PULL 6/8] hw/sd/sdhci: Honor failed DMA transactions |
Date: |
Mon, 21 Mar 2022 18:03:18 +0100 |
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
DMA transactions might fail. The DMA API returns a MemTxResult,
indicating such failures. Do not ignore it. On failure, raise
the ADMA error flag and eventually triggering an IRQ (see spec
chapter 1.13.5: "ADMA2 States").
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20211215205656.488940-2-philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
hw/sd/sdhci.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index e0bbc90344..fe2f21f0c3 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -742,6 +742,7 @@ static void sdhci_do_adma(SDHCIState *s)
unsigned int begin, length;
const uint16_t block_size = s->blksize & BLOCK_SIZE_MASK;
ADMADescr dscr = {};
+ MemTxResult res;
int i;
if (s->trnmod & SDHC_TRNS_BLK_CNT_EN && !s->blkcnt) {
@@ -790,10 +791,13 @@ static void sdhci_do_adma(SDHCIState *s)
s->data_count = block_size;
length -= block_size - begin;
}
- dma_memory_write(s->dma_as, dscr.addr,
- &s->fifo_buffer[begin],
- s->data_count - begin,
- MEMTXATTRS_UNSPECIFIED);
+ res = dma_memory_write(s->dma_as, dscr.addr,
+ &s->fifo_buffer[begin],
+ s->data_count - begin,
+ MEMTXATTRS_UNSPECIFIED);
+ if (res != MEMTX_OK) {
+ break;
+ }
dscr.addr += s->data_count - begin;
if (s->data_count == block_size) {
s->data_count = 0;
@@ -816,10 +820,13 @@ static void sdhci_do_adma(SDHCIState *s)
s->data_count = block_size;
length -= block_size - begin;
}
- dma_memory_read(s->dma_as, dscr.addr,
- &s->fifo_buffer[begin],
- s->data_count - begin,
- MEMTXATTRS_UNSPECIFIED);
+ res = dma_memory_read(s->dma_as, dscr.addr,
+ &s->fifo_buffer[begin],
+ s->data_count - begin,
+ MEMTXATTRS_UNSPECIFIED);
+ if (res != MEMTX_OK) {
+ break;
+ }
dscr.addr += s->data_count - begin;
if (s->data_count == block_size) {
sdbus_write_data(&s->sdbus, s->fifo_buffer,
block_size);
@@ -833,7 +840,16 @@ static void sdhci_do_adma(SDHCIState *s)
}
}
}
- s->admasysaddr += dscr.incr;
+ if (res != MEMTX_OK) {
+ if (s->errintstsen & SDHC_EISEN_ADMAERR) {
+ trace_sdhci_error("Set ADMA error flag");
+ s->errintsts |= SDHC_EIS_ADMAERR;
+ s->norintsts |= SDHC_NIS_ERR;
+ }
+ sdhci_update_irq(s);
+ } else {
+ s->admasysaddr += dscr.incr;
+ }
break;
case SDHC_ADMA_ATTR_ACT_LINK: /* link to next descriptor table */
s->admasysaddr = dscr.addr;
--
2.27.0
- [PULL 0/8] Fix CVE-2021-3611 and heap overflow in sdhci code, Thomas Huth, 2022/03/21
- [PULL 2/8] softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR, Thomas Huth, 2022/03/21
- [PULL 3/8] hw/audio/intel-hda: Do not ignore DMA overrun errors, Thomas Huth, 2022/03/21
- [PULL 1/8] softmmu/physmem: Simplify flatview_write and address_space_access_valid, Thomas Huth, 2022/03/21
- [PULL 4/8] hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices), Thomas Huth, 2022/03/21
- [PULL 5/8] tests/qtest/intel-hda-test: Add reproducer for issue #542, Thomas Huth, 2022/03/21
- [PULL 6/8] hw/sd/sdhci: Honor failed DMA transactions,
Thomas Huth <=
- [PULL 8/8] tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue 29225), Thomas Huth, 2022/03/21
- [PULL 7/8] hw/sd/sdhci: Prohibit DMA accesses to devices, Thomas Huth, 2022/03/21
- Re: [PULL 0/8] Fix CVE-2021-3611 and heap overflow in sdhci code, Peter Maydell, 2022/03/22