motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-07-29 13:23:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

ppc/pnv: Add a PNOR address and size sanity checks

Browse source 
The BMC HIOMAP PNOR access protocol has certain limits on PNOR addresses
and sizes. Add some sanity checks for these so we don't get strange
behaviour.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
This commit is contained in:
Nicholas Piggin 2025-03-01 01:07:57 +10:00
parent b899de9a3d
commit 4c84a0a4a6
1 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
hw/ppc/pnv_bmc.c
View file

@ -251,10 +251,38 @@ static const IPMINetfn hiomap_netfn = {
void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor)
{
uint32_t pnor_size = pnor->size;
uint32_t pnor_addr = PNOR_SPI_OFFSET;
if (!pnv_bmc_is_simulator(bmc)) {
return;
}
/*
* The HIOMAP protocol uses block units and 16-bit addressing.
* Prevent overflow or misalign.
*/
if (pnor_addr >= 1U << (BLOCK_SHIFT + 16)) {
warn_report("PNOR address is larger than 2^%d, disabling PNOR",
BLOCK_SHIFT + 16);
return;
}
if (pnor_addr & ((1U << BLOCK_SHIFT) - 1)) {
warn_report("PNOR address is not aligned to 2^%d, disabling PNOR",
BLOCK_SHIFT);
return;
}
if (pnor_size > 1U << (BLOCK_SHIFT + 16)) {
warn_report("PNOR size is larger than 2^%d, disabling PNOR",
BLOCK_SHIFT + 16);
return;
}
if (pnor_size & ((1U << BLOCK_SHIFT) - 1)) {
warn_report("PNOR size is not aligned to 2^%d, disabling PNOR",
BLOCK_SHIFT);
return;
}
object_ref(OBJECT(pnor));
object_property_add_const_link(OBJECT(bmc), "pnor", OBJECT(pnor));