62 lines
2.6 KiB
Diff
62 lines
2.6 KiB
Diff
|
From 20541823659dc78a6a7be427f8fc03ccc58c88d1 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Andrey Shumilin <shum.sdl@nppct.ru>
|
||
|
|
Date: Thu, 23 May 2024 16:06:20 +0100
|
||
|
|
Subject: [PATCH] hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
In gic_cpu_read() and gic_cpu_write(), we delegate the handling of
|
||
|
|
reading and writing the Non-Secure view of the GICC_APR<n> registers
|
||
|
|
to functions gic_apr_ns_view() and gic_apr_write_ns_view().
|
||
|
|
Unfortunately we got the order of the arguments wrong, swapping the
|
||
|
|
CPU number and the register number (which the compiler doesn't catch
|
||
|
|
because they're both integers).
|
||
|
|
|
||
|
|
Most guests probably didn't notice this bug because directly
|
||
|
|
accessing the APR registers is typically something only done by
|
||
|
|
firmware when it is doing state save for going into a sleep mode.
|
||
|
|
|
||
|
|
Correct the mismatched call arguments.
|
||
|
|
|
||
|
|
Found by Linux Verification Center (linuxtesting.org) with SVACE.
|
||
|
|
|
||
|
|
Cc: qemu-stable@nongnu.org
|
||
|
|
Fixes: 51fd06e0ee ("hw/intc/arm_gic: Fix handling of GICC_APR<n>, GICC_NSAPR<n> registers")
|
||
|
|
Signed-off-by: Andrey Shumilin <shum.sdl@nppct.ru>
|
||
|
|
[PMM: Rewrote commit message]
|
||
|
|
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
||
|
|
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
||
|
|
Reviewed-by: Alex Bennée<alex.bennee@linaro.org>
|
||
|
|
(cherry picked from commit daafa78b297291fea36fb4daeed526705fa7c035)
|
||
|
|
Signed-off-by: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/intc/arm_gic.c | 4 ++--
|
||
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
|
||
|
|
index dfe7a0a729..f0582f7a49 100644
|
||
|
|
--- a/hw/intc/arm_gic.c
|
||
|
|
+++ b/hw/intc/arm_gic.c
|
||
|
|
@@ -1663,7 +1663,7 @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
|
||
|
|
*data = s->h_apr[gic_get_vcpu_real_id(cpu)];
|
||
|
|
} else if (gic_cpu_ns_access(s, cpu, attrs)) {
|
||
|
|
/* NS view of GICC_APR<n> is the top half of GIC_NSAPR<n> */
|
||
|
|
- *data = gic_apr_ns_view(s, regno, cpu);
|
||
|
|
+ *data = gic_apr_ns_view(s, cpu, regno);
|
||
|
|
} else {
|
||
|
|
*data = s->apr[regno][cpu];
|
||
|
|
}
|
||
|
|
@@ -1751,7 +1751,7 @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
|
||
|
|
s->h_apr[gic_get_vcpu_real_id(cpu)] = value;
|
||
|
|
} else if (gic_cpu_ns_access(s, cpu, attrs)) {
|
||
|
|
/* NS view of GICC_APR<n> is the top half of GIC_NSAPR<n> */
|
||
|
|
- gic_apr_write_ns_view(s, regno, cpu, value);
|
||
|
|
+ gic_apr_write_ns_view(s, cpu, regno, value);
|
||
|
|
} else {
|
||
|
|
s->apr[regno][cpu] = value;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|