From nobody Wed Aug 26 20:44:00 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1779408361; cv=none; d=zohomail.com; s=zohoarc; b=c9POqpTPADX1NV8bKLXnE+USeplowXZl7BR3QR+kAzSTXOgEj1g6UvtF5VGB8GlpvyB0A4ZCvtV70HTQPQITqHIK65IpBLvtCyyPMuHuGeE3gyS8CG1pMv9IM2V+SJYrFtlfB2Y9uC3r5n2bnGeO97x6sn8++c0suySb/d1v4xI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779408361; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Oexc3WaCAOy/tuwIEhfKj7IUvhj6ywE8pLBhOUrwZYI=; b=Or2o0rzTiz076AnbvkyAWHyoPMXHcsIvAReIYMJqKCkoEgaqp+WpgY3xYL6DTpKKj82oDi/enT3xDUqntL/KeGmZ81ED3QEyp+YOHojQunIoq6snRHVSIu8iZ8pi2GMa5v9Pm1vZB8c544W66MyCeAo9Cg6yY6TiJwtQS2bPang= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779408361678312.0734034317627; Thu, 21 May 2026 17:06:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQDNT-0001mC-K8; Thu, 21 May 2026 20:04:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQDNR-0001l8-Um for qemu-devel@nongnu.org; Thu, 21 May 2026 20:04:33 -0400 Received: from mail-pl1-x62f.google.com ([2607:f8b0:4864:20::62f]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wQDNQ-0003Pu-9H for qemu-devel@nongnu.org; Thu, 21 May 2026 20:04:33 -0400 Received: by mail-pl1-x62f.google.com with SMTP id d9443c01a7336-2ba17c8cfacso65844455ad.2 for ; Thu, 21 May 2026 17:04:31 -0700 (PDT) Received: from toolbx.alistair23.me ([2403:581e:fdf9:0:6209:4521:6813:45b7]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2beb114b54csm3915475ad.42.2026.05.21.17.04.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 17:04:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779408270; x=1780013070; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Oexc3WaCAOy/tuwIEhfKj7IUvhj6ywE8pLBhOUrwZYI=; b=OF3wMNJGTygaP4i3rkV9xJklzWqLAZkhhs2aDFS13IGZdum+n+g/+BsO5KdEvlZUE6 dRHeGsXDoMAJG2pXPB0q7xg0lCiO7/oBliWSaWy6Yw3BZrGyHZz/L/OlzkfPMvPiN8iy AlSbX7mRUMtX8P+qgCjN9V7zWjwzy0O2Gi0yzUwOb0wb7zrKQTqlERDm4zezVP/NG5PJ yhjbVV4sjvIeS/4bPokXXtaOMsppTKFe6tkz0FMMq+Aolrhn3OCOzapbpiZ7TGfMAoTM jONntK+QjGgwEO/2DM1+YfTdgXbFLKO4T4ehqH4aJT0SRD+dbaMEMA3kujwkKFBl3sqU /DUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779408270; x=1780013070; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Oexc3WaCAOy/tuwIEhfKj7IUvhj6ywE8pLBhOUrwZYI=; b=n8Af5TejrkGbkqdFkr0989qL0nBazfL0nXQVhU5ensOZmXZVoOXIdnnsv4d8nD+rTh ZZFe1VO3dDQVOan37bhLlPdKgo0+rDvHc4rMxYIrrYFC8VYaVQPHRKRcvEeqpaRVMDnp sFlKVebnMhdJuPCVmezSkekBUSnMJKqpoEUsULNiAL+Qc33gevr7G0mQgUS1XpywcD/C gS/yS6fjQMSH3voNmSTmp+00em8QZphLs9sxMj2+X9aYVpTgyEYGMIP7iAKW2phBsjLv PLfVlCqR2zcWyQKDCuYFffND+bfSZ6iStapATYTD4SFtgA1mHO54tkmHLUMOx4ORWAW6 PR2A== X-Gm-Message-State: AOJu0Yy5qOBhel+DFJo9jkQaF+551Xg8OdKFRHjLx4XNNoVL4pjWdakM QU6mPXkFze8QNb3uiepWob/i96+rpJ6fwN2SHVUtYB4upFP0+yobFjXwG/Batd03 X-Gm-Gg: Acq92OHepHOJtb3Ur8eoqAO+l1k1E91tE2AlS28JI1Wk94rElM3ImDuaqvWTt8TCNz/ QlqSDEpG7xhTdo8CZTu+MX5S/9TgfGoJNSEpBLzu7uF+OxznRWyyr0HdAZKdz2BIja8C+SpKEXZ 3KwAsv4p2PJAYwDdYtAq7bEFxYRYTXw50DDnjsUeuopEsPwxzZY+D92LogrdvUrcmgkyUnQzP7A CJpi4KlXIXraWvNiEA3rjCVYuoz9bed1Ie3syHb51R2hVrby9Q/Wp/5sot3FOsMjmTlbQmsq5xX 7S3YmEzGbTs2nboA0eHrDq6qnALpHYiVJEhjFfvnfaktZ3qXVMpUZwdCMU1TZBUet1W9m5UOwuu jJcvi/dEXZ9CZy1ltFCDd0/wgc5OBDyto+Xoc2AOiM+ozrSo0bdhtbxJGEZCn4pP00vHolTHwR3 OSIPRVK1peDiHHprjiRhGOqreE/rkAsePLHSBBpzurHg== X-Received: by 2002:a17:903:1ac3:b0:2bc:7d1d:b677 with SMTP id d9443c01a7336-2beb065f97fmr11187665ad.36.1779408270581; Thu, 21 May 2026 17:04:30 -0700 (PDT) From: alistair23@gmail.com X-Google-Original-From: alistair.francis@wdc.com To: qemu-devel@nongnu.org Cc: alistair23@gmail.com, Zishun Yi , Alistair Francis , Daniel Henrique Barboza Subject: [PULL 17/48] target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation Date: Fri, 22 May 2026 10:02:53 +1000 Message-ID: <20260522000324.23255-18-alistair.francis@wdc.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260522000324.23255-1-alistair.francis@wdc.com> References: <20260522000324.23255-1-alistair.francis@wdc.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2607:f8b0:4864:20::62f; envelope-from=alistair23@gmail.com; helo=mail-pl1-x62f.google.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1779408362118158500 Content-Type: text/plain; charset="utf-8" From: Zishun Yi According to the RISC-V Privileged Manual: "The Sv32 page-based virtual-memory scheme described in sv32 supports 34-bit physical addresses for RV32, so the PMP scheme must support addresses wider than XLEN for RV32." However, the current QEMU implementation uses `target_ulong` (which resolves to `uint32_t` on RV32) for PMP address variables. When shifting these addresses left (e.g., `this_addr << 2`), an integer overflow occurs, truncating the high bits of the 34-bit physical address. Fix this issue by changing the types of PMP address variables (`this_addr` and `prev_addr`) to `hwaddr`. This issue was discovered and reported by SpecHunter, an AI-driven architecture specification analysis tool. Link: https://github.com/yizishun/rv-isa-sec/blob/master/output/riscv-isa-m= anual/pr-2472/qemu.txt Signed-off-by: Zishun Yi Reviewed-by: Alistair Francis Reviewed-by: Daniel Henrique Barboza Message-ID: <20260511102627.3120140-1-vulab@iscas.ac.cn> Signed-off-by: Alistair Francis --- target/riscv/pmp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c index 5391caa59c..a71091a316 100644 --- a/target/riscv/pmp.c +++ b/target/riscv/pmp.c @@ -227,8 +227,8 @@ static void pmp_decode_napot(hwaddr a, hwaddr *sa, hwad= dr *ea) void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index) { uint8_t this_cfg =3D env->pmp_state.pmp[pmp_index].cfg_reg; - target_ulong this_addr =3D env->pmp_state.pmp[pmp_index].addr_reg; - target_ulong prev_addr =3D 0u; + hwaddr this_addr =3D env->pmp_state.pmp[pmp_index].addr_reg; + hwaddr prev_addr =3D 0u; hwaddr sa =3D 0u; hwaddr ea =3D 0u; int g =3D pmp_get_granularity_g(env); --=20 2.53.0