LPC18xx SD write DMA buffer overrun

Discussion created by lpcware Employee on Jun 15, 2016
Latest reply on Jun 15, 2016 by lpcware
Content originally posted in LPCWare by joepbrown on Thu Oct 22 13:27:06 MST 2015
This is directly related to this topic on the lpc43xx: https://www.lpcware.com/content/forum/lpcopen-v202-sdmmcspeedc-hard-faults.

This is also all in the current LPCOpen library.

There a bug in the DMA setup of the SDMMC card write handling where if the number of bytes exceeds 4096*17 the function that sets up the DMA for the SD write will overrun and corrupt the callback function pointers (and a bunch of other stuff) and cause the device to hardfault.

The SDMMC card info struct contains an array that is passed to the SDMMC DMA for data transfer. The array is defined as

typedef struct _sdif_device {
pSDMMC_DMA_T mci_dma_dd[1 + (0x10000 / MCI_DMADES1_MAXTR)];
} sdif_device;

MCI_DMADES1_MAXTR is defined as 4096, so the array length is 17. In Chip_SDIF_DmaSetup, if the size passed in is greater than 17*4096, the psdif_dev[] array will overrun and corrupt the callback pointers in the g_card_info structure.

The way I found this issue was using the USB masstorage driver from LPCOpen on a linux machine. Windows seems to never write more than 128 blocks at a time (128*512B), but once I plugged my device into a linux machine it attempted to write 240 blocks, which caused the overrun.

I'm not quite sure how to fix this problem. I've tried hardcoding a larger array size for mci_dma_dd, but it causes the SD card writes to hang (the DMA write complete interrupt never fires?).

Has anyone else run into this problem on the lpx18xx?