All of lore.kernel.org
 help / color / mirror / Atom feed
From: Bin Meng <bmeng.cn@gmail.com>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Cc: Mauro Matteo Cascella <mcascell@redhat.com>,
	Qemu-block <qemu-block@nongnu.org>,
	qemu-stable@nongnu.org, Li Qiang <liq3ea@163.com>,
	"qemu-devel@nongnu.org Developers" <qemu-devel@nongnu.org>,
	Prasad J Pandit <ppandit@redhat.com>,
	Alexander Bulekov <alxndr@bu.edu>, Bandan Das <bsd@redhat.com>,
	Alistair Francis <alistair.francis@wdc.com>
Subject: Re: [PATCH v2 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable
Date: Sat, 20 Feb 2021 14:55:57 +0800	[thread overview]
Message-ID: <CAEUhbmXLTUNzHqHgvsmPKaWMVbRvJZk2-kgd0Ph0+C0o0Nf2zw@mail.gmail.com> (raw)
In-Reply-To: <53f50f67-90c9-4c6c-c42a-d2eab7bccecb@amsat.org>

Hi Philippe,

On Fri, Feb 19, 2021 at 2:03 AM Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
>
> On 2/18/21 6:09 PM, Philippe Mathieu-Daudé wrote:
> > On 2/16/21 4:46 AM, Bin Meng wrote:
> >> The codes to limit the maximum block size is only necessary when
> >> SDHC_BLKSIZE register is writable.
>
> Per "SD Command Generation":
>
>   The Host Driver should not read the SDMA System Address, Block Size
>   and Block Count registers during a data transaction unless the
>   transfer is stopped because the value is changing and not stable.
>   To prevent destruction of registers using data transfer when issuing
>   command, the 32-bit Block Count, Block Size, 16-bit Block Count and
>   Transfer Mode registers shall be write protected by the Host
>   Controller while Command Inhibit (DAT) is set to 1 in the Present
>   State register.
>
> Shouldn't we check for !(s->prnsts & SDHC_DATA_INHIBIT) instead?

Yes, for accurate emulation I think we should.

Current implementation uses !(s->prnsts & (SDHC_DOING_READ |
SDHC_DOING_WRITE)) which eventually is correct, because:

SDHC_DATA_INHIBIT bit is set if either SDHC_DAT_LINE_ACTIVE or
SDHC_DOING_READ is set (SD Host Controller Spec v7.00 chapter 2.2.9
Present State Register)

SDHC_DAT_LINE_ACTIVE bit is set after the end bit of read or write
command, and after end bit of read or write command will generate
SDHC_DOING_READ or SDHC_DOING_WRITE (SD Host Controller Spec v7.00
chapter 2.2.9 Present State Register)

Regards,
Bin


  reply	other threads:[~2021-02-20  6:57 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-16  3:46 [PATCH v2 0/6] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409 Bin Meng
2021-02-16  3:46 ` [PATCH v2 1/6] hw/sd: sdhci: Don't transfer any data when command time out Bin Meng
2021-02-18 16:25   ` Philippe Mathieu-Daudé
2021-02-18 16:46     ` Philippe Mathieu-Daudé
2021-02-18 23:33     ` Bin Meng
2021-02-16  3:46 ` [PATCH v2 2/6] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress Bin Meng
2021-02-18 16:33   ` Philippe Mathieu-Daudé
2021-02-18 18:23   ` Philippe Mathieu-Daudé
2021-02-18 20:31     ` Philippe Mathieu-Daudé
2021-02-16  3:46 ` [PATCH v2 3/6] hw/sd: sdhci: Correctly set the controller status for ADMA Bin Meng
2021-02-18 16:50   ` Philippe Mathieu-Daudé
2021-02-16  3:46 ` [PATCH v2 4/6] hw/sd: sdhci: Simplify updating s->prnsts in sdhci_sdma_transfer_multi_blocks() Bin Meng
2021-02-17 15:39   ` Alexander Bulekov
2021-02-18 16:51   ` Philippe Mathieu-Daudé
2021-02-19 23:15   ` Philippe Mathieu-Daudé
2021-02-16  3:46 ` [PATCH v2 5/6] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable Bin Meng
2021-02-18 17:09   ` Philippe Mathieu-Daudé
2021-02-18 18:03     ` Philippe Mathieu-Daudé
2021-02-20  6:55       ` Bin Meng [this message]
2021-02-16  3:46 ` [PATCH v2 6/6] hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a different block size is programmed Bin Meng
2021-02-18 18:06   ` Philippe Mathieu-Daudé
2021-02-20  3:28     ` Bin Meng
2021-02-16 16:13 ` [PATCH v2 0/6] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409 Alexander Bulekov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAEUhbmXLTUNzHqHgvsmPKaWMVbRvJZk2-kgd0Ph0+C0o0Nf2zw@mail.gmail.com \
    --to=bmeng.cn@gmail.com \
    --cc=alistair.francis@wdc.com \
    --cc=alxndr@bu.edu \
    --cc=bsd@redhat.com \
    --cc=f4bug@amsat.org \
    --cc=liq3ea@163.com \
    --cc=mcascell@redhat.com \
    --cc=ppandit@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.