| Message ID | 1485285380-10565-9-git-send-email-peter.maydell@linaro.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | More M profile bugfixes | expand |
Peter Maydell <peter.maydell@linaro.org> writes: > From: Michael Davidsaver <mdavidsaver@gmail.com> > > The CCR.USERSETMPEND bit has to be set to permit unprivileged code to > write to the Software Triggered Interrupt register; honour this bit > rather than letting any code write to the register. > > Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com> > [PMM: Tweak commit message, comment, phrasing of condition] > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> > --- > hw/intc/armv7m_nvic.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c > index 60e72d7..fe5c303 100644 > --- a/hw/intc/armv7m_nvic.c > +++ b/hw/intc/armv7m_nvic.c > @@ -409,7 +409,10 @@ static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) > "NVIC: Aux fault status registers unimplemented\n"); > break; > case 0xf00: /* Software Triggered Interrupt Register */ > - if ((value & 0x1ff) < s->num_irq) { > + /* user mode can only write to STIR if CCR.USERSETMPEND permits it */ > + if ((value & 0x1ff) < s->num_irq && > + (arm_current_el(&cpu->env) || > + (cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK))) { > gic_set_pending_private(&s->gic, 0, value & 0x1ff); > } > break; -- Alex Bennée
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index 60e72d7..fe5c303 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -409,7 +409,10 @@ static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value) "NVIC: Aux fault status registers unimplemented\n"); break; case 0xf00: /* Software Triggered Interrupt Register */ - if ((value & 0x1ff) < s->num_irq) { + /* user mode can only write to STIR if CCR.USERSETMPEND permits it */ + if ((value & 0x1ff) < s->num_irq && + (arm_current_el(&cpu->env) || + (cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK))) { gic_set_pending_private(&s->gic, 0, value & 0x1ff); } break;