From 4d84bb6c8b42cc781a02e1ac6648875966abc877 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Wed, 25 May 2022 08:59:04 -0400 Subject: [PATCH 1/2] hw/tpm/tpm_tis_common.c: Assert that locty is in range MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In tpm_tis_mmio_read(), tpm_tis_mmio_write() and tpm_tis_dump_state(), we calculate a locality index with tpm_tis_locality_from_addr() and then use it as an index into the s->loc[] array. In all these cases, the array index can't overflow because the MemoryRegion is sized to be TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT bytes. However, Coverity can't see that, and it complains (CID 1487138, 1487180, 1487188, 1487198, 1487240). Add an assertion to tpm_tis_locality_from_addr() that the calculated locality index is valid, which will help Coverity and also catch any potential future bug where the MemoryRegion isn't sized exactly. Signed-off-by: Peter Maydell Signed-off-by: Stefan Berger Reviewed-by: Marc-André Lureau Message-id: 20220525125904.483075-1-stefanb@linux.ibm.com --- hw/tpm/tpm_tis_common.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c index e700d82181..503be2a541 100644 --- a/hw/tpm/tpm_tis_common.c +++ b/hw/tpm/tpm_tis_common.c @@ -50,7 +50,12 @@ static uint64_t tpm_tis_mmio_read(void *opaque, hwaddr addr, static uint8_t tpm_tis_locality_from_addr(hwaddr addr) { - return (uint8_t)((addr >> TPM_TIS_LOCALITY_SHIFT) & 0x7); + uint8_t locty; + + locty = (uint8_t)((addr >> TPM_TIS_LOCALITY_SHIFT) & 0x7); + assert(TPM_TIS_IS_VALID_LOCTY(locty)); + + return locty; } From e37a0ef4605e5d2041785ff3fc89ca6021faf7a0 Mon Sep 17 00:00:00 2001 From: Anthony PERARD Date: Mon, 11 Apr 2022 15:47:49 +0100 Subject: [PATCH 2/2] tpm_crb: mark command buffer as dirty on request completion At the moment, there doesn't seems to be any way to know that QEMU made modification to the command buffer. This is potentially an issue on Xen while migrating a guest, as modification to the buffer after the migration as started could be ignored and not transfered to the destination. Mark the memory region of the command buffer as dirty once a request is completed. Signed-off-by: Anthony PERARD Reviewed-by: Stefan Berger Signed-off-by: Stefan Berger Message-id: 20220411144749.47185-1-anthony.perard@citrix.com --- hw/tpm/tpm_crb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c index aa9c00aad3..67db594c48 100644 --- a/hw/tpm/tpm_crb.c +++ b/hw/tpm/tpm_crb.c @@ -197,6 +197,7 @@ static void tpm_crb_request_completed(TPMIf *ti, int ret) ARRAY_FIELD_DP32(s->regs, CRB_CTRL_STS, tpmSts, 1); /* fatal error */ } + memory_region_set_dirty(&s->cmdmem, 0, CRB_CTRL_CMD_SIZE); } static enum TPMVersion tpm_crb_get_version(TPMIf *ti)