From: Joel Stanley <[email protected]>
rmw_xireg_aia() and rmw_xtopei() were changed to store the IMSIC
callback's value in a local before passing it back to the caller.
For write only CSR accesses that pointer is NULL, causing a crash when
guest programs write to xireg or xtopei, such as when the guest sets up
the IMSIC.
This only happens when setting aia=aplic-imsic so none of the existing
boot tests caught it.
Fix it by guarding the pointer dereference as done for other CSRs.
Fixes: 63469ad75dcc ("target/riscv: Fix arguments to board IMSIC emulation
callbacks")
Signed-off-by: Joel Stanley <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Anton Johansson <[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
---
target/riscv/csr.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index dd9726fcf4..dd790d5bef 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -2733,7 +2733,9 @@ static RISCVException rmw_xireg_aia(CPURISCVState *env,
int csrno,
AIA_MAKE_IREG(isel, priv, virt, vgein,
riscv_cpu_mxl_bits(env)),
&wide_val, new_val, wr_mask);
- *val = wide_val;
+ if (val) {
+ *val = wide_val;
+ }
}
} else {
isel_reserved = true;
@@ -3009,7 +3011,9 @@ static RISCVException rmw_xtopei(CPURISCVState *env, int
csrno,
AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, priv, virt, vgein,
riscv_cpu_mxl_bits(env)),
&wide_val, new_val, wr_mask);
- *val = wide_val;
+ if (val) {
+ *val = wide_val;
+ }
done:
if (ret) {
--
2.54.0
