aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZenghui Yu <zenghui.yu@linux.dev>2025-07-15 00:01:38 +0800
committerPeter Maydell <peter.maydell@linaro.org>2025-07-21 11:19:56 +0100
commitf19310b23a00b5c19f930e4d57fc298744d11740 (patch)
treeef4d383228899a45ca93fa21cffc3164a8090a48
parent082933a1f7d3c8e4a9e999c3d284928ef866c67d (diff)
downloadqemu-f19310b23a00b5c19f930e4d57fc298744d11740.zip
qemu-f19310b23a00b5c19f930e4d57fc298744d11740.tar.gz
qemu-f19310b23a00b5c19f930e4d57fc298744d11740.tar.bz2
hvf: arm: Add permission check in GIC sysreg handlers
Quoting Peter Maydell: " hvf_sysreg_read_cp() and hvf_sysreg_write_cp() do not check the .access field of the ARMCPRegInfo to ensure that they forbid writes to registers that are marked with a .access field that says they're read-only (and ditto reads to write-only registers). " Before we add more registers in GIC sysreg handlers, let's get it correct by adding the .access checks to hvf_sysreg_read_cp() and hvf_sysreg_write_cp(). With that, a sysreg access with invalid permission will result in an UNDEFINED exception. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250714160139.10404-2-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r--target/arm/hvf/hvf.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8f93e42..861657d 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1263,6 +1263,9 @@ static bool hvf_sysreg_read_cp(CPUState *cpu, uint32_t reg, uint64_t *val)
ri = get_arm_cp_reginfo(arm_cpu->cp_regs, hvf_reg2cp_reg(reg));
if (ri) {
+ if (!cp_access_ok(1, ri, true)) {
+ return false;
+ }
if (ri->accessfn) {
if (ri->accessfn(env, ri, true) != CP_ACCESS_OK) {
return false;
@@ -1543,6 +1546,9 @@ static bool hvf_sysreg_write_cp(CPUState *cpu, uint32_t reg, uint64_t val)
ri = get_arm_cp_reginfo(arm_cpu->cp_regs, hvf_reg2cp_reg(reg));
if (ri) {
+ if (!cp_access_ok(1, ri, false)) {
+ return false;
+ }
if (ri->accessfn) {
if (ri->accessfn(env, ri, false) != CP_ACCESS_OK) {
return false;