diff options
| -rw-r--r-- | hw/sd/sdhci.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 7f9d814706..7f73527d44 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1009,6 +1009,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) MASKED_WRITE(s->blksize, mask, value); MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16); } + + /* Limit block size to the maximum buffer size */ + if (extract32(s->blksize, 0, 12) > s->buf_maxsz) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \ + "the maximum buffer 0x%x", __func__, s->blksize, + s->buf_maxsz); + + s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz); + } + break; case SDHC_ARGUMENT: MASKED_WRITE(s->argument, mask, value); |