From f4ec71d07cd2375c9080fbd4e85beffd05d73a11 Mon Sep 17 00:00:00 2001 From: Ricardo Koller Date: Fri, 2 Jul 2021 16:37:01 -0700 Subject: hw/intc/arm_gicv3_cpuif: Fix virtual irq number check in icv_[dir|eoir]_write icv_eoir_write() and icv_dir_write() ignore invalid virtual IRQ numbers (like LPIs). The issue is that these functions check against the number of implemented IRQs (QEMU's default is num_irq=288) which can be lower than the maximum virtual IRQ number (1020 - 1). The consequence is that if a hypervisor creates an LR for an IRQ between 288 and 1020, then the guest is unable to deactivate the resulting IRQ. Note that other functions that deal with large IRQ numbers, like icv_iar_read, check against 1020 and not against num_irq. Fix the checks by using GICV3_MAXIRQ (1020) instead of the number of implemented IRQs. Signed-off-by: Ricardo Koller Message-id: 20210702233701.3369-1-ricarkol@google.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/intc/arm_gicv3_cpuif.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'hw/intc') diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c index 3e0641aff9..a032d505f5 100644 --- a/hw/intc/arm_gicv3_cpuif.c +++ b/hw/intc/arm_gicv3_cpuif.c @@ -1227,7 +1227,7 @@ static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri, trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value); - if (irq >= cs->gic->num_irq) { + if (irq >= GICV3_MAXIRQ) { /* Also catches special interrupt numbers and LPIs */ return; } @@ -1262,7 +1262,7 @@ static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri, trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1, gicv3_redist_affid(cs), value); - if (irq >= cs->gic->num_irq) { + if (irq >= GICV3_MAXIRQ) { /* Also catches special interrupt numbers and LPIs */ return; } -- cgit 1.4.1 From 05449abb1d4c5f0c69ceb3d8d03cbc75de39b646 Mon Sep 17 00:00:00 2001 From: Rebecca Cran Date: Tue, 6 Jul 2021 15:14:32 -0600 Subject: hw/intc: Improve formatting of MEMTX_ERROR guest error message MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a space in the message printed when gicr_read*/gicr_write* returns MEMTX_ERROR in arm_gicv3_redist.c. Signed-off-by: Rebecca Cran Reviewed-by: Philippe Mathieu-Daudé Message-id: 20210706211432.31902-1-rebecca@nuviainc.com Signed-off-by: Peter Maydell --- hw/intc/arm_gicv3_redist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'hw/intc') diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c index 8645220d61..53da703ed8 100644 --- a/hw/intc/arm_gicv3_redist.c +++ b/hw/intc/arm_gicv3_redist.c @@ -453,7 +453,7 @@ MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data, if (r == MEMTX_ERROR) { qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid guest read at offset " TARGET_FMT_plx - "size %u\n", __func__, offset, size); + " size %u\n", __func__, offset, size); trace_gicv3_redist_badread(gicv3_redist_affid(cs), offset, size, attrs.secure); /* The spec requires that reserved registers are RAZ/WI; @@ -510,7 +510,7 @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data, if (r == MEMTX_ERROR) { qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid guest write at offset " TARGET_FMT_plx - "size %u\n", __func__, offset, size); + " size %u\n", __func__, offset, size); trace_gicv3_redist_badwrite(gicv3_redist_affid(cs), offset, data, size, attrs.secure); /* The spec requires that reserved registers are RAZ/WI; -- cgit 1.4.1