diff options
| author | Bin Meng <bmeng@tinylab.org> | 2022-12-11 11:08:29 +0800 |
|---|---|---|
| committer | Alistair Francis <alistair.francis@wdc.com> | 2023-01-06 10:42:55 +1000 |
| commit | bc92f261519d5c77c70cf2ebcf0a3b9a414d82d0 (patch) | |
| tree | 09e863bfecd790203d782813258b0afee4ff1688 /hw/intc/sifive_plic.c | |
| parent | a984e2b32f6da127f3b9ee1a72bde9b68effaa80 (diff) | |
| download | focaccia-qemu-bc92f261519d5c77c70cf2ebcf0a3b9a414d82d0.tar.gz focaccia-qemu-bc92f261519d5c77c70cf2ebcf0a3b9a414d82d0.zip | |
hw/intc: sifive_plic: Fix the pending register range check
The pending register upper limit is currently set to
plic->num_sources >> 3, which is wrong, e.g.: considering
plic->num_sources is 7, the upper limit becomes 0 which fails
the range check if reading the pending register at pending_base.
Fixes: 1e24429e40df ("SiFive RISC-V PLIC Block")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-16-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Diffstat (limited to 'hw/intc/sifive_plic.c')
| -rw-r--r-- | hw/intc/sifive_plic.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c index 1a792cc3f5..5522ede2cf 100644 --- a/hw/intc/sifive_plic.c +++ b/hw/intc/sifive_plic.c @@ -143,7 +143,8 @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size) uint32_t irq = (addr - plic->priority_base) >> 2; return plic->source_priority[irq]; - } else if (addr_between(addr, plic->pending_base, plic->num_sources >> 3)) { + } else if (addr_between(addr, plic->pending_base, + (plic->num_sources + 31) >> 3)) { uint32_t word = (addr - plic->pending_base) >> 2; return plic->pending[word]; @@ -202,7 +203,7 @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value, sifive_plic_update(plic); } } else if (addr_between(addr, plic->pending_base, - plic->num_sources >> 3)) { + (plic->num_sources + 31) >> 3)) { qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid pending write: 0x%" HWADDR_PRIx "", __func__, addr); |