[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 8/9] target/arm: Check addresses for disabled regimes
From: |
Richard Henderson |
Subject: |
[PATCH v2 8/9] target/arm: Check addresses for disabled regimes |
Date: |
Mon, 2 Mar 2020 09:58:28 -0800 |
We fail to validate the upper bits of a virtual address on a
translation disabled regime, as per AArch64.TranslateAddressS1Off.
Signed-off-by: Richard Henderson <address@hidden>
---
target/arm/helper.c | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index addbec91d8..0ef32d3c24 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -11634,7 +11634,38 @@ bool get_phys_addr(CPUARMState *env, target_ulong
address,
/* Definitely a real MMU, not an MPU */
if (regime_translation_disabled(env, mmu_idx)) {
- /* MMU disabled. */
+ /*
+ * MMU disabled. S1 addresses are still checked for bounds.
+ * C.f. AArch64.TranslateAddressS1Off.
+ */
+ if (is_a64(env) && mmu_idx != ARMMMUIdx_Stage2) {
+ int pamax = arm_pamax(env_archcpu(env));
+ uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+ int addrtop, tbi;
+
+ tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
+ if (access_type == MMU_INST_FETCH) {
+ tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
+ }
+ tbi = (tbi >> extract64(address, 55, 1)) & 1;
+ addrtop = (tbi ? 55 : 63);
+
+ if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
+ fi->type = ARMFault_AddressSize;
+ fi->level = 0;
+ fi->stage2 = false;
+ return 1;
+ }
+
+ /*
+ * The ARM pseudocode copies bits [51:0] to addrdesc.paddress.
+ * Except for TBI, we've just validated everything above PAMax
+ * is zero. So we only need to drop TBI.
+ */
+ if (tbi) {
+ address = extract64(address, 0, 56);
+ }
+ }
*phys_ptr = address;
*prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
*page_size = TARGET_PAGE_SIZE;
--
2.20.1
- [PATCH v2 0/9] target/arm: Misc cleanups surrounding TBI, Richard Henderson, 2020/03/02
- [PATCH v2 1/9] target/arm: Replicate TBI/TBID bits for single range regimes, Richard Henderson, 2020/03/02
- [PATCH v2 2/9] target/arm: Optimize cpu_mmu_index, Richard Henderson, 2020/03/02
- [PATCH v2 3/9] target/arm: Introduce core_to_aa64_mmu_idx, Richard Henderson, 2020/03/02
- [PATCH v2 4/9] target/arm: Apply TBI to ESR_ELx in helper_exception_return, Richard Henderson, 2020/03/02
- [PATCH v2 8/9] target/arm: Check addresses for disabled regimes,
Richard Henderson <=
- [PATCH v2 6/9] target/arm: Use DEF_HELPER_FLAGS for helper_dc_zva, Richard Henderson, 2020/03/02
- [PATCH v2 5/9] target/arm: Move helper_dc_zva to helper-a64.c, Richard Henderson, 2020/03/02
- [PATCH v2 7/9] target/arm: Clean address for DC ZVA, Richard Henderson, 2020/03/02
- [PATCH v2 9/9] target/arm: Disable clean_data_tbi for system mode, Richard Henderson, 2020/03/02
- Re: [PATCH v2 0/9] target/arm: Misc cleanups surrounding TBI, Peter Maydell, 2020/03/05