From 7db7bd0f319fe7f19a6904e75c53adf891fa2dac Mon Sep 17 00:00:00 2001 From: Volodymyr Babchuk Date: Thu, 23 May 2024 10:17:30 +0200 Subject: [PATCH] arm/vpci: honor access size when returning an error Guest can try to read config space using different access sizes: 8, 16, 32, 64 bits. We need to take this into account when we are returning an error back to MMIO handler, otherwise it is possible to provide more data than requested: i.e. guest issues LDRB instruction to read one byte, but we are writing 0xFFFFFFFFFFFFFFFF in the target register. Signed-off-by: Volodymyr Babchuk Signed-off-by: Stewart Hildebrand Acked-by: Julien Grall --- xen/arch/arm/vpci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/vpci.c b/xen/arch/arm/vpci.c index 3bc4bb5508..b63a356bb4 100644 --- a/xen/arch/arm/vpci.c +++ b/xen/arch/arm/vpci.c @@ -29,6 +29,8 @@ static int vpci_mmio_read(struct vcpu *v, mmio_info_t *info, { struct pci_host_bridge *bridge = p; pci_sbdf_t sbdf = vpci_sbdf_from_gpa(bridge, info->gpa); + const unsigned int access_size = (1U << info->dabt.size) * 8; + const register_t invalid = GENMASK_ULL(access_size - 1, 0); /* data is needed to prevent a pointer cast on 32bit */ unsigned long data; @@ -39,7 +41,7 @@ static int vpci_mmio_read(struct vcpu *v, mmio_info_t *info, return 1; } - *r = ~0ul; + *r = invalid; return 0; }