From nobody Tue May 6 11:34:00 2025
Delivered-To: importer@patchew.org
Authentication-Results: mx.zohomail.com;
dkim=pass;
spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as
permitted sender)
smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org;
dmarc=pass(p=none dis=none) header.from=linaro.org
ARC-Seal: i=1; a=rsa-sha256; t=1642703654; cv=none;
d=zohomail.com; s=zohoarc;
b=FCvXD8jPly4+FqUl1OLtHtdRXco1dD+8cZvpHDN93PGmTqq7hu6dcI72IKtJHfnqgsUo5zwqa/UiO7qbEl9rlfvJ8iKRh8cN60mzSn35bZ9oBCmmT7518mDfZ3FT5zmDy0C7zNzRMJybY+skXhoPp8L6BAclk3eC+mSvDIKLVq8=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com;
s=zohoarc;
t=1642703654;
h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To;
bh=7ld23nK8ASvRkvHvhF0mF43an93w9LT5/+5RX+ASHV8=;
b=nNE5dyN6eyjXgahC8/2urkXs2q+ojdC9kopK0xVB/jMjwncuHOP2qLG+z+78duLCKef33RlBlzOaMu2SbPi3ESvZQ/yika8pc5JKN1vzX68yIYB8Y0GtHb3fUaH8gMR3n7PhXHoh40ZvXqfMlXyNfPDaZKe8q521c2mo+4e4oZI=
ARC-Authentication-Results: i=1; mx.zohomail.com;
dkim=pass;
spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as
permitted sender)
smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org;
dmarc=pass header.from=<peter.maydell@linaro.org> (p=none dis=none)
Return-Path: <qemu-devel-bounces+importer=patchew.org@nongnu.org>
Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by
mx.zohomail.com
with SMTPS id 1642703654264654.3220819326793;
Thu, 20 Jan 2022 10:34:14 -0800 (PST)
Received: from localhost ([::1]:54100 helo=lists1p.gnu.org)
by lists.gnu.org with esmtp (Exim 4.90_1)
(envelope-from <qemu-devel-bounces+importer=patchew.org@nongnu.org>)
id 1nAcGC-0001P9-O5
for importer@patchew.org; Thu, 20 Jan 2022 13:34:12 -0500
Received: from eggs.gnu.org ([209.51.188.92]:43000)
by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1) (envelope-from <peter.maydell@linaro.org>)
id 1nAWgi-0004JE-MO
for qemu-devel@nongnu.org; Thu, 20 Jan 2022 07:37:14 -0500
Received: from [2a00:1450:4864:20::331] (port=39742
helo=mail-wm1-x331.google.com)
by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
(Exim 4.90_1) (envelope-from <peter.maydell@linaro.org>)
id 1nAWgZ-0003If-Vf
for qemu-devel@nongnu.org; Thu, 20 Jan 2022 07:37:06 -0500
Received: by mail-wm1-x331.google.com with SMTP id
o1-20020a1c4d01000000b0034d95625e1fso7093441wmh.4
for <qemu-devel@nongnu.org>; Thu, 20 Jan 2022 04:37:02 -0800 (PST)
Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2])
by smtp.gmail.com with ESMTPSA id t8sm7993324wmq.43.2022.01.20.04.37.01
for <qemu-devel@nongnu.org>
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 20 Jan 2022 04:37:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google;
h=from:to:subject:date:message-id:in-reply-to:references:mime-version
:content-transfer-encoding;
bh=7ld23nK8ASvRkvHvhF0mF43an93w9LT5/+5RX+ASHV8=;
b=UkCm0ouCWr1ircHMZxZt1SqEXs3CvnwnMiwtFBTjAUwkJcDIPhiqqT1o610KED6R63
Zl4gXo6wW/2czneIOU1xEUBy5o/CKgFERY0cf4xyZrR5D9gDOZf9OEI86Evzy4v7f3Li
51bX2f6TXHYPZ8xtRit5apxYY5jep8MnQPp1ASkkZefKnV6sKAxq35iG4Tg7f4LW1cIp
uJrVVm5GyQWfkfz6HKAmalSw4muKHvpXVj0L8glSahSS3WexVr5qOyT5fDPFWThaLbe+
JLsUiu71NUcSOWVR0Uh7LbvysM2BJ5GDMtNYJiC6s3AIWEHlPTqqmQC4jpfDEwPJJzFZ
O74Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
:references:mime-version:content-transfer-encoding;
bh=7ld23nK8ASvRkvHvhF0mF43an93w9LT5/+5RX+ASHV8=;
b=1ta0FZD6VM4zzGfwlddzIA5LNuL2Kak5LoDPY/r1+BJh+ASqtYsV4xPKpGQHIhoxLK
TcVDVMGVw3y7tpFq5TN6pi2R4ua6OqtkUkjrlaqbeXepVbsBhTGy7b8suraHl/Nfrmu2
6vbasKuLKt8ytU1Ug0vIXWN0q3/CpGacFjos4CwAlt46xtMB9P/zlvroMIfr6/3AXnI+
Rjy+kBR1wziUpJSu5PO+Z2Ixx7CBbD0ZzaIkKWnZc2vCwFu0kI0MwQ3Ag+dT93IkYYQd
5lyzokG7lzRnhnvabAAHrAhx3/2ViY9+9OulLGwdl1WfqINRuL5Ev/hRgw/0r6a0FY1J
WX3A==
X-Gm-Message-State: AOAM531tuF78CW66Le6paKjPGv7sei6SgaVfcgozHF7y4e6S2fpNIcH+
X3EwiH+iu1wRlEW51P4y6XXphi1zl5JeeQ==
X-Google-Smtp-Source:
ABdhPJxFJ4/jsKc1uxBaKS7helVkyhMZP/P69NeXdFbyOODNkpAuvy9ekO0V1f7SUwwr7dley5YXnA==
X-Received: by 2002:adf:e2cc:: with SMTP id
d12mr33056925wrj.107.1642682221896;
Thu, 20 Jan 2022 04:37:01 -0800 (PST)
From: Peter Maydell <peter.maydell@linaro.org>
To: qemu-devel@nongnu.org
Subject: [PULL 25/38] hw/intc/arm_gicv3_its: Fix event ID bounds checks
Date: Thu, 20 Jan 2022 12:36:17 +0000
Message-Id: <20220120123630.267975-26-peter.maydell@linaro.org>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220120123630.267975-1-peter.maydell@linaro.org>
References: <20220120123630.267975-1-peter.maydell@linaro.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Host-Lookup-Failed: Reverse DNS lookup failed for 2a00:1450:4864:20::331
(failed)
Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17
as permitted sender) client-ip=209.51.188.17;
envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org;
helo=lists.gnu.org;
Received-SPF: pass client-ip=2a00:1450:4864:20::331;
envelope-from=peter.maydell@linaro.org; helo=mail-wm1-x331.google.com
X-Spam_score_int: -12
X-Spam_score: -1.3
X-Spam_bar: -
X-Spam_report: (-1.3 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
PDS_HP_HELO_NORDNS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RDNS_NONE=0.793,
SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no
X-Spam_action: no action
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org
Sender: "Qemu-devel" <qemu-devel-bounces+importer=patchew.org@nongnu.org>
X-ZohoMail-DKIM: pass (identity @linaro.org)
X-ZM-MESSAGEID: 1642703656405100001
In process_its_cmd() and process_mapti() we must check the
event ID against a limit defined by the size field in the DTE,
which specifies the number of ID bits minus one. Convert
this code to our num_foo convention:
* change the variable names
* use uint64_t and 1ULL when calculating the number
of valid event IDs, because DTE.SIZE is 5 bits and
so num_eventids may be up to 2^32
* fix the off-by-one error in the comparison
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Benn=C3=A9e <alex.bennee@linaro.org>
Message-id: 20220111171048.3545974-2-peter.maydell@linaro.org
---
hw/intc/arm_gicv3_its.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index fa3cdb57554..6d11fa02040 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -225,7 +225,7 @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t =
value, uint32_t offset,
MemTxResult res =3D MEMTX_OK;
bool dte_valid;
uint64_t dte =3D 0;
- uint32_t max_eventid;
+ uint64_t num_eventids;
uint16_t icid =3D 0;
uint32_t pIntid =3D 0;
bool ite_valid =3D false;
@@ -258,7 +258,7 @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t =
value, uint32_t offset,
dte_valid =3D FIELD_EX64(dte, DTE, VALID);
=20
if (dte_valid) {
- max_eventid =3D 1UL << (FIELD_EX64(dte, DTE, SIZE) + 1);
+ num_eventids =3D 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
=20
ite_valid =3D get_ite(s, eventid, dte, &icid, &pIntid, &res);
=20
@@ -299,10 +299,11 @@ static bool process_its_cmd(GICv3ITSState *s, uint64_=
t value, uint32_t offset,
dte_valid ? "valid" : "invalid",
ite_valid ? "valid" : "invalid",
cte_valid ? "valid" : "invalid");
- } else if (eventid > max_eventid) {
+ } else if (eventid >=3D num_eventids) {
qemu_log_mask(LOG_GUEST_ERROR,
- "%s: invalid command attributes: eventid %d > %d\n",
- __func__, eventid, max_eventid);
+ "%s: invalid command attributes: eventid %d >=3D %"
+ PRId64 "\n",
+ __func__, eventid, num_eventids);
} else {
/*
* Current implementation only supports rdbase =3D=3D procnum
@@ -336,7 +337,8 @@ static bool process_mapti(GICv3ITSState *s, uint64_t va=
lue, uint32_t offset,
AddressSpace *as =3D &s->gicv3->dma_as;
uint32_t devid, eventid;
uint32_t pIntid =3D 0;
- uint32_t max_eventid, max_Intid;
+ uint64_t num_eventids;
+ uint32_t max_Intid;
bool dte_valid;
MemTxResult res =3D MEMTX_OK;
uint16_t icid =3D 0;
@@ -376,11 +378,11 @@ static bool process_mapti(GICv3ITSState *s, uint64_t =
value, uint32_t offset,
return result;
}
dte_valid =3D FIELD_EX64(dte, DTE, VALID);
- max_eventid =3D 1UL << (FIELD_EX64(dte, DTE, SIZE) + 1);
+ num_eventids =3D 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
max_Intid =3D (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
=20
if ((devid >=3D s->dt.num_ids) || (icid >=3D s->ct.num_ids)
- || !dte_valid || (eventid > max_eventid) ||
+ || !dte_valid || (eventid >=3D num_eventids) ||
(((pIntid < GICV3_LPI_INTID_START) || (pIntid > max_Intid)) &&
(pIntid !=3D INTID_SPURIOUS))) {
qemu_log_mask(LOG_GUEST_ERROR,
--=20
2.25.1