qemu/include/hw/sd/sdhci.h
Philippe Mathieu-Daudé 02e57e1c14 sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object
missed in 60765b6cee.

  Thread 1 "qemu-system-aarch64" received signal SIGSEGV, Segmentation fault.
  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
  3050	    as->root = root;
  (gdb) bt
  #0  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
  #1  0x0000555555af62c3 in sdhci_sysbus_realize (dev=<optimized out>, errp=0x7fff7f931150) at hw/sd/sdhci.c:1564
  #2  0x00005555558b25e5 in zynqmp_sdhci_realize (dev=0x555557051520, errp=0x7fff7f931150) at hw/sd/zynqmp-sdhci.c:151
  #3  0x0000555555a2e7f3 in device_set_realized (obj=0x555557051520, value=<optimized out>, errp=0x7fff7f931270) at hw/core/qdev.c:966
  #4  0x0000555555ba3f74 in property_set_bool (obj=0x555557051520, v=<optimized out>, name=<optimized out>, opaque=0x555556e04a20,
      errp=0x7fff7f931270) at qom/object.c:1906
  #5  0x0000555555ba51f4 in object_property_set (obj=obj@entry=0x555557051520, v=v@entry=0x5555576dbd60,
      name=name@entry=0x555555dd6306 "realized", errp=errp@entry=0x7fff7f931270) at qom/object.c:1102

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180123132051.24448-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25 11:45:30 +00:00

104 lines
4.1 KiB
C

/*
* SD Association Host Standard Specification v2.0 controller emulation
*
* Copyright (c) 2011 Samsung Electronics Co., Ltd.
* Mitsyanko Igor <i.mitsyanko@samsung.com>
* Peter A.G. Crosthwaite <peter.crosthwaite@petalogix.com>
*
* Based on MMC controller for Samsung S5PC1xx-based board emulation
* by Alexey Merkulov and Vladimir Monakhov.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the GNU General Public License for more details.
*
* You should have received a copy of the GNU _General Public License along
* with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#ifndef SDHCI_H
#define SDHCI_H
#include "qemu-common.h"
#include "hw/pci/pci.h"
#include "hw/sysbus.h"
#include "hw/sd/sd.h"
/* SD/MMC host controller state */
typedef struct SDHCIState {
/*< private >*/
union {
PCIDevice pcidev;
SysBusDevice busdev;
};
/*< public >*/
SDBus sdbus;
MemoryRegion iomem;
AddressSpace sysbus_dma_as;
AddressSpace *dma_as;
MemoryRegion *dma_mr;
QEMUTimer *insert_timer; /* timer for 'changing' sd card. */
QEMUTimer *transfer_timer;
qemu_irq irq;
/* Registers cleared on reset */
uint32_t sdmasysad; /* SDMA System Address register */
uint16_t blksize; /* Host DMA Buff Boundary and Transfer BlkSize Reg */
uint16_t blkcnt; /* Blocks count for current transfer */
uint32_t argument; /* Command Argument Register */
uint16_t trnmod; /* Transfer Mode Setting Register */
uint16_t cmdreg; /* Command Register */
uint32_t rspreg[4]; /* Response Registers 0-3 */
uint32_t prnsts; /* Present State Register */
uint8_t hostctl; /* Host Control Register */
uint8_t pwrcon; /* Power control Register */
uint8_t blkgap; /* Block Gap Control Register */
uint8_t wakcon; /* WakeUp Control Register */
uint16_t clkcon; /* Clock control Register */
uint8_t timeoutcon; /* Timeout Control Register */
uint8_t admaerr; /* ADMA Error Status Register */
uint16_t norintsts; /* Normal Interrupt Status Register */
uint16_t errintsts; /* Error Interrupt Status Register */
uint16_t norintstsen; /* Normal Interrupt Status Enable Register */
uint16_t errintstsen; /* Error Interrupt Status Enable Register */
uint16_t norintsigen; /* Normal Interrupt Signal Enable Register */
uint16_t errintsigen; /* Error Interrupt Signal Enable Register */
uint16_t acmd12errsts; /* Auto CMD12 error status register */
uint64_t admasysaddr; /* ADMA System Address Register */
/* Read-only registers */
uint64_t capareg; /* Capabilities Register */
uint64_t maxcurr; /* Maximum Current Capabilities Register */
uint8_t *fifo_buffer; /* SD host i/o FIFO buffer */
uint32_t buf_maxsz;
uint16_t data_count; /* current element in FIFO buffer */
uint8_t stopped_state;/* Current SDHC state */
bool pending_insert_state;
/* Buffer Data Port Register - virtual access point to R and W buffers */
/* Software Reset Register - always reads as 0 */
/* Force Event Auto CMD12 Error Interrupt Reg - write only */
/* Force Event Error Interrupt Register- write only */
/* RO Host Controller Version Register always reads as 0x2401 */
/* Configurable properties */
bool pending_insert_quirk; /* Quirk for Raspberry Pi card insert int */
} SDHCIState;
#define TYPE_PCI_SDHCI "sdhci-pci"
#define PCI_SDHCI(obj) OBJECT_CHECK(SDHCIState, (obj), TYPE_PCI_SDHCI)
#define TYPE_SYSBUS_SDHCI "generic-sdhci"
#define SYSBUS_SDHCI(obj) \
OBJECT_CHECK(SDHCIState, (obj), TYPE_SYSBUS_SDHCI)
#endif /* SDHCI_H */