| Andrew Geissler | c926e17 | 2021-05-07 16:11:35 -0500 | [diff] [blame^] | 1 | From c01ae9a35b3c6b4a8e1f1bfa0a0caafe394f8b5c Mon Sep 17 00:00:00 2001 |
| 2 | From: Bin Meng <bmeng.cn@gmail.com> |
| 3 | Date: Tue, 16 Feb 2021 11:46:52 +0800 |
| 4 | Subject: [PATCH 1/6] hw/sd: sdhci: Simplify updating s->prnsts in |
| 5 | sdhci_sdma_transfer_multi_blocks() |
| 6 | MIME-Version: 1.0 |
| 7 | Content-Type: text/plain; charset=UTF-8 |
| 8 | Content-Transfer-Encoding: 8bit |
| 9 | |
| 10 | s->prnsts is updated in both branches of the if () else () statement. |
| 11 | Move the common bits outside so that it is cleaner. |
| 12 | |
| 13 | Signed-off-by: Bin Meng <bmeng.cn@gmail.com> |
| 14 | Tested-by: Alexander Bulekov <alxndr@bu.edu> |
| 15 | Reviewed-by: Alexander Bulekov <alxndr@bu.edu> |
| 16 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
| 17 | Message-Id: <1613447214-81951-5-git-send-email-bmeng.cn@gmail.com> |
| 18 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
| 19 | |
| 20 | Upstream-Status: Backport [8bc1f1aa51d32c3184e7b19d5b94c35ecc06f056] |
| 21 | CVE: CVE-2021-3409 |
| 22 | |
| 23 | Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> |
| 24 | --- |
| 25 | hw/sd/sdhci.c | 7 +++---- |
| 26 | 1 file changed, 3 insertions(+), 4 deletions(-) |
| 27 | |
| 28 | diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c |
| 29 | index 2f8b74a84..f83c5e295 100644 |
| 30 | --- a/hw/sd/sdhci.c |
| 31 | +++ b/hw/sd/sdhci.c |
| 32 | @@ -596,9 +596,9 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) |
| 33 | page_aligned = true; |
| 34 | } |
| 35 | |
| 36 | + s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE; |
| 37 | if (s->trnmod & SDHC_TRNS_READ) { |
| 38 | - s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT | |
| 39 | - SDHC_DAT_LINE_ACTIVE; |
| 40 | + s->prnsts |= SDHC_DOING_READ; |
| 41 | while (s->blkcnt) { |
| 42 | if (s->data_count == 0) { |
| 43 | sdbus_read_data(&s->sdbus, s->fifo_buffer, block_size); |
| 44 | @@ -625,8 +625,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) |
| 45 | } |
| 46 | } |
| 47 | } else { |
| 48 | - s->prnsts |= SDHC_DOING_WRITE | SDHC_DATA_INHIBIT | |
| 49 | - SDHC_DAT_LINE_ACTIVE; |
| 50 | + s->prnsts |= SDHC_DOING_WRITE; |
| 51 | while (s->blkcnt) { |
| 52 | begin = s->data_count; |
| 53 | if (((boundary_count + begin) < block_size) && page_aligned) { |
| 54 | -- |
| 55 | 2.29.2 |
| 56 | |