| Message ID | 20210728181728.2012952-4-f4bug@amsat.org |
|---|---|
| State | New |
| Headers | show |
| Series | hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30 | expand |
On 210728 2017, Philippe Mathieu-Daudé wrote: > 'wp_groups' holds a bitmap, rename it as 'wp_group_bmap'. > 'wpgrps_size' is the bitmap size (in bits), rename it as > 'wp_group_bits'. > > Patch created mechanically using: > > $ sed -i -e s/wp_groups/wp_group_bmap/ \ > -e s/wpgrps_size/wp_group_bits/ hw/sd/sd.c > > Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> -Alex > --- > hw/sd/sd.c | 28 ++++++++++++++-------------- > 1 file changed, 14 insertions(+), 14 deletions(-) > > diff --git a/hw/sd/sd.c b/hw/sd/sd.c > index 273af75c1be..75dcd3f7f65 100644 > --- a/hw/sd/sd.c > +++ b/hw/sd/sd.c > @@ -116,8 +116,8 @@ struct SDState { > int32_t state; /* current card state, one of SDCardStates */ > uint32_t vhs; > bool wp_switch; > - unsigned long *wp_groups; > - int32_t wpgrps_size; > + unsigned long *wp_group_bmap; > + int32_t wp_group_bits; > uint64_t size; > uint32_t blk_len; > uint32_t multi_blk_cnt; > @@ -567,10 +567,10 @@ static void sd_reset(DeviceState *dev) > sd_set_cardstatus(sd); > sd_set_sdstatus(sd); > > - g_free(sd->wp_groups); > + g_free(sd->wp_group_bmap); > sd->wp_switch = sd->blk ? !blk_is_writable(sd->blk) : false; > - sd->wpgrps_size = sect; > - sd->wp_groups = bitmap_new(sd->wpgrps_size); > + sd->wp_group_bits = sect; > + sd->wp_group_bmap = bitmap_new(sd->wp_group_bits); > memset(sd->function_group, 0, sizeof(sd->function_group)); > sd->erase_start = INVALID_ADDRESS; > sd->erase_end = INVALID_ADDRESS; > @@ -673,7 +673,7 @@ static const VMStateDescription sd_vmstate = { > VMSTATE_UINT32(card_status, SDState), > VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1), > VMSTATE_UINT32(vhs, SDState), > - VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size), > + VMSTATE_BITMAP(wp_group_bmap, SDState, 0, wp_group_bits), > VMSTATE_UINT32(blk_len, SDState), > VMSTATE_UINT32(multi_blk_cnt, SDState), > VMSTATE_UINT32(erase_start, SDState), > @@ -803,8 +803,8 @@ static void sd_erase(SDState *sd) > if (sdsc) { > /* Only SDSC cards support write protect groups */ > wpnum = sd_addr_to_wpnum(erase_addr); > - assert(wpnum < sd->wpgrps_size); > - if (test_bit(wpnum, sd->wp_groups)) { > + assert(wpnum < sd->wp_group_bits); > + if (test_bit(wpnum, sd->wp_group_bmap)) { > sd->card_status |= WP_ERASE_SKIP; > continue; > } > @@ -820,7 +820,7 @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr) > > wpnum = sd_addr_to_wpnum(addr); > > - for (i = 0; i < 32 && wpnum < sd->wpgrps_size - 1; > + for (i = 0; i < 32 && wpnum < sd->wp_group_bits - 1; > i++, wpnum++, addr += WPGROUP_SIZE) { > if (addr >= sd->size) { > /* > @@ -829,7 +829,7 @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr) > */ > continue; > } > - if (test_bit(wpnum, sd->wp_groups)) { > + if (test_bit(wpnum, sd->wp_group_bmap)) { > ret |= (1 << i); > } > } > @@ -869,7 +869,7 @@ static void sd_function_switch(SDState *sd, uint32_t arg) > > static inline bool sd_wp_addr(SDState *sd, uint64_t addr) > { > - return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups); > + return test_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap); > } > > static void sd_lock_command(SDState *sd) > @@ -897,7 +897,7 @@ static void sd_lock_command(SDState *sd) > sd->card_status |= LOCK_UNLOCK_FAILED; > return; > } > - bitmap_zero(sd->wp_groups, sd->wpgrps_size); > + bitmap_zero(sd->wp_group_bmap, sd->wp_group_bits); > sd->csd[14] &= ~0x10; > sd->card_status &= ~CARD_IS_LOCKED; > sd->pwd_len = 0; > @@ -1348,7 +1348,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req) > } > > sd->state = sd_programming_state; > - set_bit(sd_addr_to_wpnum(addr), sd->wp_groups); > + set_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap); > /* Bzzzzzzztt .... Operation complete. */ > sd->state = sd_transfer_state; > return sd_r1b; > @@ -1370,7 +1370,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req) > } > > sd->state = sd_programming_state; > - clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups); > + clear_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap); > /* Bzzzzzzztt .... Operation complete. */ > sd->state = sd_transfer_state; > return sd_r1b; > -- > 2.31.1 >
diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 273af75c1be..75dcd3f7f65 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -116,8 +116,8 @@ struct SDState { int32_t state; /* current card state, one of SDCardStates */ uint32_t vhs; bool wp_switch; - unsigned long *wp_groups; - int32_t wpgrps_size; + unsigned long *wp_group_bmap; + int32_t wp_group_bits; uint64_t size; uint32_t blk_len; uint32_t multi_blk_cnt; @@ -567,10 +567,10 @@ static void sd_reset(DeviceState *dev) sd_set_cardstatus(sd); sd_set_sdstatus(sd); - g_free(sd->wp_groups); + g_free(sd->wp_group_bmap); sd->wp_switch = sd->blk ? !blk_is_writable(sd->blk) : false; - sd->wpgrps_size = sect; - sd->wp_groups = bitmap_new(sd->wpgrps_size); + sd->wp_group_bits = sect; + sd->wp_group_bmap = bitmap_new(sd->wp_group_bits); memset(sd->function_group, 0, sizeof(sd->function_group)); sd->erase_start = INVALID_ADDRESS; sd->erase_end = INVALID_ADDRESS; @@ -673,7 +673,7 @@ static const VMStateDescription sd_vmstate = { VMSTATE_UINT32(card_status, SDState), VMSTATE_PARTIAL_BUFFER(sd_status, SDState, 1), VMSTATE_UINT32(vhs, SDState), - VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size), + VMSTATE_BITMAP(wp_group_bmap, SDState, 0, wp_group_bits), VMSTATE_UINT32(blk_len, SDState), VMSTATE_UINT32(multi_blk_cnt, SDState), VMSTATE_UINT32(erase_start, SDState), @@ -803,8 +803,8 @@ static void sd_erase(SDState *sd) if (sdsc) { /* Only SDSC cards support write protect groups */ wpnum = sd_addr_to_wpnum(erase_addr); - assert(wpnum < sd->wpgrps_size); - if (test_bit(wpnum, sd->wp_groups)) { + assert(wpnum < sd->wp_group_bits); + if (test_bit(wpnum, sd->wp_group_bmap)) { sd->card_status |= WP_ERASE_SKIP; continue; } @@ -820,7 +820,7 @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr) wpnum = sd_addr_to_wpnum(addr); - for (i = 0; i < 32 && wpnum < sd->wpgrps_size - 1; + for (i = 0; i < 32 && wpnum < sd->wp_group_bits - 1; i++, wpnum++, addr += WPGROUP_SIZE) { if (addr >= sd->size) { /* @@ -829,7 +829,7 @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr) */ continue; } - if (test_bit(wpnum, sd->wp_groups)) { + if (test_bit(wpnum, sd->wp_group_bmap)) { ret |= (1 << i); } } @@ -869,7 +869,7 @@ static void sd_function_switch(SDState *sd, uint32_t arg) static inline bool sd_wp_addr(SDState *sd, uint64_t addr) { - return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups); + return test_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap); } static void sd_lock_command(SDState *sd) @@ -897,7 +897,7 @@ static void sd_lock_command(SDState *sd) sd->card_status |= LOCK_UNLOCK_FAILED; return; } - bitmap_zero(sd->wp_groups, sd->wpgrps_size); + bitmap_zero(sd->wp_group_bmap, sd->wp_group_bits); sd->csd[14] &= ~0x10; sd->card_status &= ~CARD_IS_LOCKED; sd->pwd_len = 0; @@ -1348,7 +1348,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req) } sd->state = sd_programming_state; - set_bit(sd_addr_to_wpnum(addr), sd->wp_groups); + set_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap); /* Bzzzzzzztt .... Operation complete. */ sd->state = sd_transfer_state; return sd_r1b; @@ -1370,7 +1370,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req) } sd->state = sd_programming_state; - clear_bit(sd_addr_to_wpnum(addr), sd->wp_groups); + clear_bit(sd_addr_to_wpnum(addr), sd->wp_group_bmap); /* Bzzzzzzztt .... Operation complete. */ sd->state = sd_transfer_state; return sd_r1b;
'wp_groups' holds a bitmap, rename it as 'wp_group_bmap'. 'wpgrps_size' is the bitmap size (in bits), rename it as 'wp_group_bits'. Patch created mechanically using: $ sed -i -e s/wp_groups/wp_group_bmap/ \ -e s/wpgrps_size/wp_group_bits/ hw/sd/sd.c Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> --- hw/sd/sd.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)