[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 14/20] ARM: PL061: Checking register r/w accesses to
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 14/20] ARM: PL061: Checking register r/w accesses to reserved area |
Date: |
Fri, 26 Feb 2016 15:20:19 +0000 |
From: Wei Huang <address@hidden>
pl061.c emulates two GPIO devices, ARM PL061 and TI Stellaris, which
share the same read/write functions (pl061_read and pl061_write).
However PL061 and Stellaris have different GPIO register definitions
and pl061_read()/pl061_write() doesn't check it. This patch enforces
checking on offset, preventing R/W into the reserved memory area.
Signed-off-by: Wei Huang <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
---
hw/gpio/pl061.c | 30 ++++++++++++++++++++++--------
1 file changed, 22 insertions(+), 8 deletions(-)
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index 5ece8b0..29dc7fc 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -60,6 +60,7 @@ typedef struct PL061State {
qemu_irq irq;
qemu_irq out[8];
const unsigned char *id;
+ uint32_t rsvd_start; /* reserved area: [rsvd_start, 0xfcc] */
} PL061State;
static const VMStateDescription vmstate_pl061 = {
@@ -152,12 +153,15 @@ static uint64_t pl061_read(void *opaque, hwaddr offset,
{
PL061State *s = (PL061State *)opaque;
- if (offset >= 0xfd0 && offset < 0x1000) {
- return s->id[(offset - 0xfd0) >> 2];
- }
if (offset < 0x400) {
return s->data & (offset >> 2);
}
+ if (offset >= s->rsvd_start && offset <= 0xfcc) {
+ goto err_out;
+ }
+ if (offset >= 0xfd0 && offset < 0x1000) {
+ return s->id[(offset - 0xfd0) >> 2];
+ }
switch (offset) {
case 0x400: /* Direction */
return s->dir;
@@ -198,10 +202,12 @@ static uint64_t pl061_read(void *opaque, hwaddr offset,
case 0x528: /* Analog mode select */
return s->amsel;
default:
- qemu_log_mask(LOG_GUEST_ERROR,
- "pl061_read: Bad offset %x\n", (int)offset);
- return 0;
+ break;
}
+err_out:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "pl061_read: Bad offset %x\n", (int)offset);
+ return 0;
}
static void pl061_write(void *opaque, hwaddr offset,
@@ -216,6 +222,9 @@ static void pl061_write(void *opaque, hwaddr offset,
pl061_update(s);
return;
}
+ if (offset >= s->rsvd_start) {
+ goto err_out;
+ }
switch (offset) {
case 0x400: /* Direction */
s->dir = value & 0xff;
@@ -274,10 +283,13 @@ static void pl061_write(void *opaque, hwaddr offset,
s->amsel = value & 0xff;
break;
default:
- qemu_log_mask(LOG_GUEST_ERROR,
- "pl061_write: Bad offset %x\n", (int)offset);
+ goto err_out;
}
pl061_update(s);
+ return;
+err_out:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "pl061_write: Bad offset %x\n", (int)offset);
}
static void pl061_reset(DeviceState *dev)
@@ -347,6 +359,7 @@ static void pl061_luminary_init(Object *obj)
PL061State *s = PL061(obj);
s->id = pl061_id_luminary;
+ s->rsvd_start = 0x52c;
}
static void pl061_init(Object *obj)
@@ -354,6 +367,7 @@ static void pl061_init(Object *obj)
PL061State *s = PL061(obj);
s->id = pl061_id;
+ s->rsvd_start = 0x424;
}
static void pl061_class_init(ObjectClass *klass, void *data)
--
1.9.1
- [Qemu-devel] [PULL 10/20] target-arm: Make mode switches from Hyp via CPS and MRS illegal, (continued)
- [Qemu-devel] [PULL 10/20] target-arm: Make mode switches from Hyp via CPS and MRS illegal, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 05/20] target-arm: In cpsr_write() ignore mode switches from User mode, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 08/20] target-arm: Forbid mode switch to Mon from Secure EL1, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 02/20] target-arm: Add write_type argument to cpsr_write(), Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 17/20] sdhci: Revert "add optional quirk property to disable card insertion/removal interrupts", Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 12/20] target-arm: Fix handling of SDCR for 32-bit code, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 04/20] linux-user: Use restrictive mask when calling cpsr_write(), Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 11/20] target-arm: Make Monitor->NS PL1 mode changes illegal if HCR.TGE is 1, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 20/20] target-arm: Make reserved ranges in ID_AA64* spaces RAZ, not UNDEF, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 13/20] target-arm: Implement MDCR_EL3.TPM and MDCR_EL2.TPM traps, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 14/20] ARM: PL061: Checking register r/w accesses to reserved area,
Peter Maydell <=
- [Qemu-devel] [PULL 07/20] target-arm: Add Hyp mode checks to bad_mode_switch(), Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 15/20] raspi: fix SD card with recent sdhci changes, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 09/20] target-arm: In v8, make illegal AArch32 mode changes set PSTATE.IL, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 16/20] MAINTAINERS: Add some missing ARM related header files, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 19/20] target-arm: Mark CNTHP_TVAL_EL2 as ARM_CP_NO_RAW, Peter Maydell, 2016/02/26
- [Qemu-devel] [PULL 18/20] sdhci: add quirk property for card insert interrupt status on Raspberry Pi, Peter Maydell, 2016/02/26
- Re: [Qemu-devel] [PULL 00/20] target-arm queue, Peter Maydell, 2016/02/26