On 8/31/26 11:17, Bin Guo wrote:
The FIQ_CONTROL register accepts a 7-bit source selector, but only
sources 0..71 (64 GPU + 8 ARM IRQs) exist. Values 96..127 cause
bcm2835_ic_update() to call extract32(arm_irq_level, start, 1) with
start >= 32, which trips the assertion in bitops.h and aborts QEMU.
Reject writes that select a non-existent source and log a guest error,
so that a malicious or buggy guest cannot kill the emulator.
Add a qtest that verifies both valid and out-of-range FIQ source
selections on raspi3b.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4368
Signed-off-by: Bin Guo <[email protected]>
---
hw/intc/bcm2835_ic.c | 13 +++++--
tests/qtest/bcm2835-ic-test.c | 66 +++++++++++++++++++++++++++++++++++
tests/qtest/meson.build | 2 +-
3 files changed, 78 insertions(+), 3 deletions(-)
create mode 100644 tests/qtest/bcm2835-ic-test.c
I'm picking this up for currently active stable qemu series.
Please let me know if I shouldn't.
Thanks,
/mjt
