Re: [Qemu-devel] [PATCH v4 2/4] sd: sdhci: check transfer mode register in multi block transfer

[Peter Maydell]

On 15 February 2017 at 04:58, P J P  wrote:
>   Hello Alistair,
>
> +-- On Tue, 14 Feb 2017, Alistair Francis wrote --+
> | On Tue, Feb 14, 2017 at 10:52 AM, P J P  wrote:
> | > From: Prasad J Pandit 
> | >
> | > In the SDHCI protocol, the transfer mode register value
> | > is used during multi block transfer to check if block count
> | > register is enabled and should be updated. Transfer mode
> | > register could be set such that, block count register would
> | > not be updated, thus leading to an infinite loop. Add check
> | > to avoid it.
> | >
> | > Reported-by: Wjjzhang 
> | > Reported-by: Jiang Xin 
> | > Signed-off-by: Prasad J Pandit 
> |
> | Didn't I already review this?
>
> Yes, you did. I resent it owing to thread
>
>   -> https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg02898.html

Alistair's point is that when you resend a patchset where
some patches have got reviews/acks and those patches haven't
changed significantly, you should include the Reviewed-by:
or Acked-by: tags in the commit messages on the resent patches,
so that people know they don't need to reexamine those patches.

thanks
-- PMM

Re: [Qemu-devel] [PATCH v4 2/4] sd: sdhci: check transfer mode register in multi block transfer

[P J P]

  Hello Alistair,

+-- On Tue, 14 Feb 2017, Alistair Francis wrote --+
| On Tue, Feb 14, 2017 at 10:52 AM, P J P  wrote:
| > From: Prasad J Pandit 
| >
| > In the SDHCI protocol, the transfer mode register value
| > is used during multi block transfer to check if block count
| > register is enabled and should be updated. Transfer mode
| > register could be set such that, block count register would
| > not be updated, thus leading to an infinite loop. Add check
| > to avoid it.
| >
| > Reported-by: Wjjzhang 
| > Reported-by: Jiang Xin 
| > Signed-off-by: Prasad J Pandit 
| 
| Didn't I already review this?

Yes, you did. I resent it owing to thread

  -> https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg02898.html

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

[Qemu-devel] [PATCH v4 2/4] sd: sdhci: check transfer mode register in multi block transfer

[P J P]

From: Prasad J Pandit 

In the SDHCI protocol, the transfer mode register value
is used during multi block transfer to check if block count
register is enabled and should be updated. Transfer mode
register could be set such that, block count register would
not be updated, thus leading to an infinite loop. Add check
to avoid it.

Reported-by: Wjjzhang 
Reported-by: Jiang Xin 
Signed-off-by: Prasad J Pandit 
---
 hw/sd/sdhci.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index cf647fa..f8220c0 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -487,6 +487,11 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
 uint32_t boundary_chk = 1 << (((s->blksize & 0xf000) >> 12) + 12);
 uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);
 
+if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) {
+qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n");
+return;
+}
+
 /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
  * possible stop at page boundary if initial address is not page aligned,
  * allow them to work properly */
@@ -798,11 +803,6 @@ static void sdhci_data_transfer(void *opaque)
 if (s->trnmod & SDHC_TRNS_DMA) {
 switch (SDHC_DMA_TYPE(s->hostctl)) {
 case SDHC_CTRL_SDMA:
-if ((s->trnmod & SDHC_TRNS_MULTI) &&
-(!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt == 0)) {
-break;
-}
-
 if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {
 sdhci_sdma_transfer_single_block(s);
 } else {
-- 
2.9.3