xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2025-02-25 15:14:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

hw/intc: sifive_plic: Fix the pending register range check

Browse Source 
The pending register upper limit is currently set to
plic->num_sources >> 3, which is wrong, e.g.: considering
plic->num_sources is 7, the upper limit becomes 0 which fails
the range check if reading the pending register at pending_base.

Fixes: 1e24429e40df ("SiFive RISC-V PLIC Block")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-16-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
This commit is contained in:
Bin Meng 2022-12-11 11:08:29 +08:00 committed by Alistair Francis
parent a984e2b32f
commit bc92f26151
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/intc/sifive_plic.c
View File

@ -143,7 +143,8 @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
uint32_t irq = (addr - plic->priority_base) >> 2; uint32_t irq = (addr - plic->priority_base) >> 2;
return plic->source_priority[irq]; return plic->source_priority[irq];
} else if (addr_between(addr, plic->pending_base, plic->num_sources >> 3)) { } else if (addr_between(addr, plic->pending_base,
(plic->num_sources + 31) >> 3)) {
uint32_t word = (addr - plic->pending_base) >> 2; uint32_t word = (addr - plic->pending_base) >> 2;
return plic->pending[word]; return plic->pending[word];
@ -202,7 +203,7 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
sifive_plic_update(plic); sifive_plic_update(plic);
} }
} else if (addr_between(addr, plic->pending_base, } else if (addr_between(addr, plic->pending_base,
plic->num_sources >> 3)) { (plic->num_sources + 31) >> 3)) {
qemu_log_mask(LOG_GUEST_ERROR, qemu_log_mask(LOG_GUEST_ERROR,
"%s: invalid pending write: 0x%" HWADDR_PRIx "", "%s: invalid pending write: 0x%" HWADDR_PRIx "",
__func__, addr); __func__, addr);