Commit deb18901 authored by Heyi Guo's avatar Heyi Guo Committed by Manish Pandey
Browse files

drivers/gicv3: fix potential GICD context override with ESPI enabled



RESTORE/SAVE_GICD_EREGS uses (int_id - (MIN_ESPI_ID - MIN_SPI_ID)) to
get the context array index for ESPI, which will override the space of
standard SPI starting from (MIN_SPI_ID + MIN_SPI_ID).

However, using TOTAL_SPI_INTR_NUM to replace the above MIN_SPI_ID
cannot totally fix the issue, for TOTAL_SPI_INTR_NUM is not well
aligned and the array index will be rounded down by the shifting
operation if being shifted more than 2 bits. It will cause buffer
override again when the existing maximum SPI reaches 1019.

So round up TOTAL_SPI_INTR_NUM with (1 << REG##R_SHIFT) for GICD
context arrays.
Signed-off-by: default avatarHeyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I5be2837c42f381a62f8d46a4ecd778009b1fe059
parent 60cd8030
...@@ -70,7 +70,8 @@ static bool is_sgi_ppi(unsigned int id); ...@@ -70,7 +70,8 @@ static bool is_sgi_ppi(unsigned int id);
for (unsigned int int_id = MIN_ESPI_ID; int_id < (intr_num);\ for (unsigned int int_id = MIN_ESPI_ID; int_id < (intr_num);\
int_id += (1U << REG##R_SHIFT)) { \ int_id += (1U << REG##R_SHIFT)) { \
gicd_write_##reg((base), int_id, \ gicd_write_##reg((base), int_id, \
(ctx)->gicd_##reg[(int_id - (MIN_ESPI_ID - MIN_SPI_ID))\ (ctx)->gicd_##reg[(int_id - (MIN_ESPI_ID - \
round_up(TOTAL_SPI_INTR_NUM, 1U << REG##R_SHIFT)))\
>> REG##R_SHIFT]); \ >> REG##R_SHIFT]); \
} \ } \
} while (false) } while (false)
...@@ -79,7 +80,8 @@ static bool is_sgi_ppi(unsigned int id); ...@@ -79,7 +80,8 @@ static bool is_sgi_ppi(unsigned int id);
do { \ do { \
for (unsigned int int_id = MIN_ESPI_ID; int_id < (intr_num);\ for (unsigned int int_id = MIN_ESPI_ID; int_id < (intr_num);\
int_id += (1U << REG##R_SHIFT)) { \ int_id += (1U << REG##R_SHIFT)) { \
(ctx)->gicd_##reg[(int_id - (MIN_ESPI_ID - MIN_SPI_ID))\ (ctx)->gicd_##reg[(int_id - (MIN_ESPI_ID - \
round_up(TOTAL_SPI_INTR_NUM, 1U << REG##R_SHIFT)))\
>> REG##R_SHIFT] = gicd_read_##reg((base), int_id);\ >> REG##R_SHIFT] = gicd_read_##reg((base), int_id);\
} \ } \
} while (false) } while (false)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment