[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 2/9] hw/i2c: pmbus: guard against out of range accesses
From: |
Titus Rwantare |
Subject: |
[PATCH v3 2/9] hw/i2c: pmbus: guard against out of range accesses |
Date: |
Tue, 1 Mar 2022 17:50:46 -0800 |
Signed-off-by: Titus Rwantare <titusr@google.com>
---
hw/i2c/pmbus_device.c | 41 ++++++++++++++++++++++++++++++++++++++++-
1 file changed, 40 insertions(+), 1 deletion(-)
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index 07a45c99f9..93c746bab3 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -243,18 +243,47 @@ void pmbus_check_limits(PMBusDevice *pmdev)
}
}
+/* assert the status_cml error upon receipt of malformed command */
+static void pmbus_cml_error(PMBusDevice *pmdev)
+{
+ for (int i = 0; i < pmdev->num_pages; i++) {
+ pmdev->pages[i].status_word |= PMBUS_STATUS_CML;
+ pmdev->pages[i].status_cml |= PB_CML_FAULT_INVALID_CMD;
+ }
+}
+
static uint8_t pmbus_receive_byte(SMBusDevice *smd)
{
PMBusDevice *pmdev = PMBUS_DEVICE(smd);
PMBusDeviceClass *pmdc = PMBUS_DEVICE_GET_CLASS(pmdev);
uint8_t ret = 0xFF;
- uint8_t index = pmdev->page;
+ uint8_t index;
if (pmdev->out_buf_len != 0) {
ret = pmbus_out_buf_pop(pmdev);
return ret;
}
+ /*
+ * Reading from all pages will return the value from page 0,
+ * this is unspecified behaviour in general.
+ */
+ if (pmdev->page == PB_ALL_PAGES) {
+ index = 0;
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: tried to read from all pages\n",
+ __func__);
+ pmbus_cml_error(pmdev);
+ } else if (pmdev->page > pmdev->num_pages - 1) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: page %d is out of range\n",
+ __func__, pmdev->page);
+ pmbus_cml_error(pmdev);
+ return -1;
+ } else {
+ index = pmdev->page;
+ }
+
switch (pmdev->code) {
case PMBUS_PAGE:
pmbus_send8(pmdev, pmdev->page);
@@ -1038,6 +1067,7 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t
*buf, uint8_t len)
pmdev->page = pmbus_receive8(pmdev);
return 0;
}
+
/* loop through all the pages when 0xFF is received */
if (pmdev->page == PB_ALL_PAGES) {
for (int i = 0; i < pmdev->num_pages; i++) {
@@ -1048,6 +1078,15 @@ static int pmbus_write_data(SMBusDevice *smd, uint8_t
*buf, uint8_t len)
return 0;
}
+ if (pmdev->page > pmdev->num_pages - 1) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: page %u is out of range\n",
+ __func__, pmdev->page);
+ pmdev->page = 0; /* undefined behaviour - reset to page 0 */
+ pmbus_cml_error(pmdev);
+ return -1;
+ }
+
index = pmdev->page;
switch (pmdev->code) {
--
2.35.1.616.g0bdcbb4464-goog
- Re: [PATCH v3 1/9] hw/i2c: pmbus: add registers, (continued)
- [PATCH v3 3/9] hw/i2c: pmbus: add PEC unsupported warning, Titus Rwantare, 2022/03/01
- [PATCH v3 4/9] hw/i2c: pmbus: refactor uint handling, Titus Rwantare, 2022/03/01
- [PATCH v3 6/9] hw/i2c: Added linear mode translation for pmbus devices, Titus Rwantare, 2022/03/01
- [PATCH v3 8/9] hw/sensor: add Renesas raa229004 PMBus device, Titus Rwantare, 2022/03/01
- [PATCH v3 2/9] hw/i2c: pmbus: guard against out of range accesses,
Titus Rwantare <=
- [PATCH v3 9/9] hw/sensor: add Renesas raa228000 device, Titus Rwantare, 2022/03/01
- [PATCH v3 5/9] hw/i2c: pmbus: update MAINTAINERS, Titus Rwantare, 2022/03/01
- [PATCH v3 7/9] hw/sensor: add Intersil ISL69260 device model, Titus Rwantare, 2022/03/01
- Re: [PATCH v3 0/9] This patch series contains updates to PMBus in QEMU along with some PMBus device models for Renesas regulators. I have also added myself to MAINTAINERS as this code is in use daily, where I am responsible for it., Corey Minyard, 2022/03/04