[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 07/36] target/arm: Check addresses for disabled regimes
From: |
Peter Maydell |
Subject: |
[PULL 07/36] target/arm: Check addresses for disabled regimes |
Date: |
Thu, 12 Mar 2020 16:44:30 +0000 |
From: Richard Henderson <address@hidden>
We fail to validate the upper bits of a virtual address on a
translation disabled regime, as per AArch64.TranslateAddressS1Off.
Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
---
target/arm/helper.c | 35 ++++++++++++++++++++++++++++++++++-
1 file changed, 34 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index fc1192d1204..b61ee73d18a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -11780,7 +11780,40 @@ bool get_phys_addr(CPUARMState *env, target_ulong
address,
/* Definitely a real MMU, not an MPU */
if (regime_translation_disabled(env, mmu_idx)) {
- /* MMU disabled. */
+ /*
+ * MMU disabled. S1 addresses within aa64 translation regimes are
+ * still checked for bounds -- see AArch64.TranslateAddressS1Off.
+ */
+ if (mmu_idx != ARMMMUIdx_Stage2) {
+ int r_el = regime_el(env, mmu_idx);
+ if (arm_el_is_aa64(env, r_el)) {
+ int pamax = arm_pamax(env_archcpu(env));
+ uint64_t tcr = env->cp15.tcr_el[r_el].raw_tcr;
+ int addrtop, tbi;
+
+ tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
+ if (access_type == MMU_INST_FETCH) {
+ tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
+ }
+ tbi = (tbi >> extract64(address, 55, 1)) & 1;
+ addrtop = (tbi ? 55 : 63);
+
+ if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
+ fi->type = ARMFault_AddressSize;
+ fi->level = 0;
+ fi->stage2 = false;
+ return 1;
+ }
+
+ /*
+ * When TBI is disabled, we've just validated that all of the
+ * bits above PAMax are zero, so logically we only need to
+ * clear the top byte for TBI. But it's clearer to follow
+ * the pseudocode set of addrdesc.paddress.
+ */
+ address = extract64(address, 0, 52);
+ }
+ }
*phys_ptr = address;
*prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
*page_size = TARGET_PAGE_SIZE;
--
2.20.1
- [PULL 00/36] target-arm queue, Peter Maydell, 2020/03/12
- [PULL 01/36] hw/intc/armv7m_nvic: Rebuild hflags on reset, Peter Maydell, 2020/03/12
- [PULL 02/36] target/arm: Update hflags in trans_CPS_v7m(), Peter Maydell, 2020/03/12
- [PULL 03/36] target/arm: Recalculate hflags correctly after writes to CONTROL, Peter Maydell, 2020/03/12
- [PULL 04/36] target/arm: Fix some comment typos, Peter Maydell, 2020/03/12
- [PULL 05/36] aspeed/smc: Add some tracing, Peter Maydell, 2020/03/12
- [PULL 06/36] aspeed/smc: Fix User mode select/unselect scheme, Peter Maydell, 2020/03/12
- [PULL 07/36] target/arm: Check addresses for disabled regimes,
Peter Maydell <=
- [PULL 08/36] target/arm: Disable clean_data_tbi for system mode, Peter Maydell, 2020/03/12
- [PULL 09/36] hw/arm/cubieboard: make sure SOC object isn't leaked, Peter Maydell, 2020/03/12
- [PULL 11/36] hw/arm/fsl-imx25: Wire up USB controllers, Peter Maydell, 2020/03/12
- [PULL 10/36] hw/arm/fsl-imx25: Wire up eSDHC controllers, Peter Maydell, 2020/03/12
- [PULL 13/36] hw/arm: add Xunlong Orange Pi PC machine, Peter Maydell, 2020/03/12
- [PULL 12/36] hw/arm: add Allwinner H3 System-on-Chip, Peter Maydell, 2020/03/12
- [PULL 15/36] hw/arm/allwinner-h3: add USB host controller, Peter Maydell, 2020/03/12
- [PULL 16/36] hw/arm/allwinner-h3: add System Control module, Peter Maydell, 2020/03/12
- [PULL 14/36] hw/arm/allwinner-h3: add Clock Control Unit, Peter Maydell, 2020/03/12
- [PULL 17/36] hw/arm/allwinner: add CPU Configuration module, Peter Maydell, 2020/03/12