[Qemu-devel] [PATCH v3] strongarm: mask off high[31:28] bits from dir and state registers

[Qemu-devel] [PATCH v3] strongarm: mask off high[31:28] bits from dir and state registers

[P J P]

From: Prasad J Pandit <pjp@fedoraproject.org>

The high[31:28] bits of 'direction' and 'state' registers of
SA-1100/SA-1110 device are reserved. Setting them may lead to
OOB 's->handler[]' array access issue. Mask off [31:28] bits to
avoid it.

Reported-by: Moguofang <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/arm/strongarm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Update v3: fix the mask value to 0x0fffffff
  -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06088.html

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index ec2627374d..644a9c45b4 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -587,12 +587,12 @@ static void strongarm_gpio_write(void *opaque, hwaddr offset,
 
     switch (offset) {
     case GPDR:        /* GPIO Pin-Direction registers */
-        s->dir = value;
+        s->dir = value & 0x0fffffff;
         strongarm_gpio_handler_update(s);
         break;
 
     case GPSR:        /* GPIO Pin-Output Set registers */
-        s->olevel |= value;
+        s->olevel |= value & 0x0fffffff;
         strongarm_gpio_handler_update(s);
         break;
 
-- 
2.17.2

Re: [Qemu-devel] [PATCH v3] strongarm: mask off high[31:28] bits from dir and state registers

[Peter Maydell]

On 30 October 2018 at 11:46, P J P <ppandit@redhat.com> wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> The high[31:28] bits of 'direction' and 'state' registers of
> SA-1100/SA-1110 device are reserved. Setting them may lead to
> OOB 's->handler[]' array access issue. Mask off [31:28] bits to
> avoid it.
>
> Reported-by: Moguofang <moguofang@huawei.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>  hw/arm/strongarm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> Update v3: fix the mask value to 0x0fffffff
>   -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06088.html
>
> diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
> index ec2627374d..644a9c45b4 100644
> --- a/hw/arm/strongarm.c
> +++ b/hw/arm/strongarm.c
> @@ -587,12 +587,12 @@ static void strongarm_gpio_write(void *opaque, hwaddr offset,
>
>      switch (offset) {
>      case GPDR:        /* GPIO Pin-Direction registers */
> -        s->dir = value;
> +        s->dir = value & 0x0fffffff;
>          strongarm_gpio_handler_update(s);
>          break;
>
>      case GPSR:        /* GPIO Pin-Output Set registers */
> -        s->olevel |= value;
> +        s->olevel |= value & 0x0fffffff;
>          strongarm_gpio_handler_update(s);
>          break;




Applied to target-arm.next, thanks.

-- PMM