strongarm: mask off high[31:28] bits from dir and state registers
PATCH v3 1/1 strongarm: mask off high[31:28] bits from dir and state registers
From: Prasad J Pandit <[email protected]>
The high[31:28] bits of 'direction' and 'state' registers of SA-1100/SA-1110 device are reserved. Setting them may lead to OOB 's->handler[]' array access issue. Mask off [31:28] bits to avoid it.
--- hw/arm/strongarm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Update v3: fix the mask value to 0x0fffffff
-> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06088.html
hw/arm/strongarm.c +2 -2
@@ -587,12 +587,12 @@ static void strongarm_gpio_write(void *opaque, hwaddr offset,switch (offset) {case GPDR :/* GPIO Pin-Direction registers */ - s->dir = value; + s->dir = value &0x0fffffff ;strongarm_gpio_handler_update (s);break ;case GPSR :/* GPIO Pin-Output Set registers */ - s->olevel |= value; + s->olevel |= value &0x0fffffff ;strongarm_gpio_handler_update (s);break ;
Signature · 1 line
2.17.2
Peter Maydell
AppliedQuoted 24 lines · P J P
From: Prasad J Pandit <[email protected]>
The high[31:28] bits of 'direction' and 'state' registers of SA-1100/SA-1110 device are reserved. Setting them may lead to OOB 's->handler[]' array access issue. Mask off [31:28] bits to avoid it.
Reported-by Moguofang <[email protected]>Signed-off-by Prasad J Pandit <[email protected]>--- hw/arm/strongarm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)Update v3: fix the mask value to
0x0fffffff
-> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06088.htmlhw/arm/strongarm.c +0
-0@@ -587,12 +587,12 @@ static void strongarm_gpio_write(void *opaque, hwaddr offset,switch (offset) {case GPDR :/* GPIO Pin-Direction registers */
hw/arm/strongarm.c static void strongarm_gpio_write(void *opaque, hwaddr offset, · line 597
Quoted 10 lines
hw/arm/strongarm.c +2
-2- s->dir = value; + s->dir = value &0x0fffffff ;strongarm_gpio_handler_update (s);break ;case GPSR :/* GPIO Pin-Output Set registers */ - s->olevel |= value; + s->olevel |= value &0x0fffffff ;strongarm_gpio_handler_update (s);break ;
Applied to target-arm.next, thanks.
-- PMM