From 922b943356f5dff146f26d9e9a5fd2d33f8bd232 Mon Sep 17 00:00:00 2001 From: Jerzy Kasenberg Date: Fri, 3 Jul 2026 16:10:21 +0200 Subject: [PATCH 1/2] drivers/mmc: Read crc for data commands Code was not reading CRC for commands with data other then CMD17/CMD18. It could result in strange behavior for some cards that send CRC on subsequent clocks that belong to other requests and synchronization was lost. Now CRC is read after data block is received. Signed-off-by: Jerzy Kasenberg --- hw/drivers/mmc/src/mmc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/drivers/mmc/src/mmc.c b/hw/drivers/mmc/src/mmc.c index 098d93c8c8..4577020427 100644 --- a/hw/drivers/mmc/src/mmc.c +++ b/hw/drivers/mmc/src/mmc.c @@ -360,6 +360,7 @@ mmc_cmd_receive_data(mmc_disk_t *mmc, uint8_t cmd, uint32_t payload, { int status; uint8_t res; + uint8_t crc[2]; mmc_spi_set_cs(mmc, 0); @@ -372,6 +373,8 @@ mmc_cmd_receive_data(mmc_disk_t *mmc, uint8_t cmd, uint32_t payload, } } + mmc_spi_rx(mmc, crc, 2); + mmc_spi_set_cs(mmc, 1); mmc_send_extra_clocks(mmc); From 95f87c4b988647def4a55d5b298ce436d4b65002 Mon Sep 17 00:00:00 2001 From: Jerzy Kasenberg Date: Fri, 3 Jul 2026 16:13:25 +0200 Subject: [PATCH 2/2] driver/mmc: Fix stack corruption on error formating When all bits were set in R1 response formated text was longer then 30 characters. Now buffer is extended to aviod stack corruption during error print. Signed-off-by: Jerzy Kasenberg --- hw/drivers/mmc/src/mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/drivers/mmc/src/mmc.c b/hw/drivers/mmc/src/mmc.c index 4577020427..75da12bfff 100644 --- a/hw/drivers/mmc/src/mmc.c +++ b/hw/drivers/mmc/src/mmc.c @@ -250,7 +250,7 @@ send_mmc_cmd(mmc_disk_t *mmc, sd_cmd_t cmd, uint32_t payload) uint16_t status; uint8_t crc; uint8_t buf[6]; - char strbuf[30]; + char strbuf[90]; mmc_led_on();