hw/intc/arm_gicv3_its: Fix event ID bounds checks
In process_its_cmd() and process_mapti() we must check the event ID against a limit defined by the size field in the DTE, which specifies the number of ID bits minus one. Convert this code to our num_foo convention: * change the variable names * use uint64_t and 1ULL when calculating the number of valid event IDs, because DTE.SIZE is 5 bits and so num_eventids may be up to 2^32 * fix the off-by-one error in the comparison Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20220111171048.3545974-2-peter.maydell@linaro.org
This commit is contained in:
parent
3222165dcb
commit
8f809f6992
@ -225,7 +225,7 @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
|
|||||||
MemTxResult res = MEMTX_OK;
|
MemTxResult res = MEMTX_OK;
|
||||||
bool dte_valid;
|
bool dte_valid;
|
||||||
uint64_t dte = 0;
|
uint64_t dte = 0;
|
||||||
uint32_t max_eventid;
|
uint64_t num_eventids;
|
||||||
uint16_t icid = 0;
|
uint16_t icid = 0;
|
||||||
uint32_t pIntid = 0;
|
uint32_t pIntid = 0;
|
||||||
bool ite_valid = false;
|
bool ite_valid = false;
|
||||||
@ -258,7 +258,7 @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
|
|||||||
dte_valid = FIELD_EX64(dte, DTE, VALID);
|
dte_valid = FIELD_EX64(dte, DTE, VALID);
|
||||||
|
|
||||||
if (dte_valid) {
|
if (dte_valid) {
|
||||||
max_eventid = 1UL << (FIELD_EX64(dte, DTE, SIZE) + 1);
|
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
|
||||||
|
|
||||||
ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
|
ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
|
||||||
|
|
||||||
@ -299,10 +299,11 @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
|
|||||||
dte_valid ? "valid" : "invalid",
|
dte_valid ? "valid" : "invalid",
|
||||||
ite_valid ? "valid" : "invalid",
|
ite_valid ? "valid" : "invalid",
|
||||||
cte_valid ? "valid" : "invalid");
|
cte_valid ? "valid" : "invalid");
|
||||||
} else if (eventid > max_eventid) {
|
} else if (eventid >= num_eventids) {
|
||||||
qemu_log_mask(LOG_GUEST_ERROR,
|
qemu_log_mask(LOG_GUEST_ERROR,
|
||||||
"%s: invalid command attributes: eventid %d > %d\n",
|
"%s: invalid command attributes: eventid %d >= %"
|
||||||
__func__, eventid, max_eventid);
|
PRId64 "\n",
|
||||||
|
__func__, eventid, num_eventids);
|
||||||
} else {
|
} else {
|
||||||
/*
|
/*
|
||||||
* Current implementation only supports rdbase == procnum
|
* Current implementation only supports rdbase == procnum
|
||||||
@ -336,7 +337,8 @@ static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
|
|||||||
AddressSpace *as = &s->gicv3->dma_as;
|
AddressSpace *as = &s->gicv3->dma_as;
|
||||||
uint32_t devid, eventid;
|
uint32_t devid, eventid;
|
||||||
uint32_t pIntid = 0;
|
uint32_t pIntid = 0;
|
||||||
uint32_t max_eventid, max_Intid;
|
uint64_t num_eventids;
|
||||||
|
uint32_t max_Intid;
|
||||||
bool dte_valid;
|
bool dte_valid;
|
||||||
MemTxResult res = MEMTX_OK;
|
MemTxResult res = MEMTX_OK;
|
||||||
uint16_t icid = 0;
|
uint16_t icid = 0;
|
||||||
@ -376,11 +378,11 @@ static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
|
|||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
dte_valid = FIELD_EX64(dte, DTE, VALID);
|
dte_valid = FIELD_EX64(dte, DTE, VALID);
|
||||||
max_eventid = 1UL << (FIELD_EX64(dte, DTE, SIZE) + 1);
|
num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
|
||||||
max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
|
max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
|
||||||
|
|
||||||
if ((devid >= s->dt.num_ids) || (icid >= s->ct.num_ids)
|
if ((devid >= s->dt.num_ids) || (icid >= s->ct.num_ids)
|
||||||
|| !dte_valid || (eventid > max_eventid) ||
|
|| !dte_valid || (eventid >= num_eventids) ||
|
||||||
(((pIntid < GICV3_LPI_INTID_START) || (pIntid > max_Intid)) &&
|
(((pIntid < GICV3_LPI_INTID_START) || (pIntid > max_Intid)) &&
|
||||||
(pIntid != INTID_SPURIOUS))) {
|
(pIntid != INTID_SPURIOUS))) {
|
||||||
qemu_log_mask(LOG_GUEST_ERROR,
|
qemu_log_mask(LOG_GUEST_ERROR,
|
||||||
|
Loading…
Reference in New Issue
Block a user