| Message ID | 1399356506-5609-19-git-send-email-edgar.iglesias@gmail.com |
|---|---|
| State | New |
| Headers | show |
On Tue, May 6, 2014 at 4:08 PM, Edgar E. Iglesias <edgar.iglesias@gmail.com> wrote: > From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com> > > Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> > --- > target-arm/internals.h | 11 +++++------ > 1 file changed, 5 insertions(+), 6 deletions(-) > > diff --git a/target-arm/internals.h b/target-arm/internals.h > index 7c39946..5d802db 100644 > --- a/target-arm/internals.h > +++ b/target-arm/internals.h > @@ -107,6 +107,7 @@ int arm_rmode_to_sf(int rmode); > > static inline void update_spsel(CPUARMState *env, uint32_t imm) > { > + unsigned int cur_el = arm_current_pl(env); > /* Update PSTATE SPSel bit; this requires us to update the > * working stack pointer in xregs[31]. > */ > @@ -115,17 +116,15 @@ static inline void update_spsel(CPUARMState *env, uint32_t imm) > } > env->pstate = deposit32(env->pstate, 0, 1, imm); > > - /* EL0 has no access rights to update SPSel, and this code > - * assumes we are updating SP for EL1 while running as EL1. > - */ > - assert(arm_current_pl(env) == 1); > + /* EL0 has no access rights to update SPSel. */ > + assert(cur_el >= 1 && cur_el <= 3); > if (env->pstate & PSTATE_SP) { > /* Switch from using SP_EL0 to using SP_ELx */ > env->sp_el[0] = env->xregs[31]; > - env->xregs[31] = env->sp_el[1]; > + env->xregs[31] = env->sp_el[cur_el]; > } else { > /* Switch from SP_EL0 to SP_ELx */ > - env->sp_el[1] = env->xregs[31]; > + env->sp_el[cur_el] = env->xregs[31]; > env->xregs[31] = env->sp_el[0]; > } > } > -- > 1.8.3.2 > >
On 05/05/2014 11:08 PM, Edgar E. Iglesias wrote: > - /* EL0 has no access rights to update SPSel, and this code > - * assumes we are updating SP for EL1 while running as EL1. > - */ > - assert(arm_current_pl(env) == 1); > + /* EL0 has no access rights to update SPSel. */ > + assert(cur_el >= 1 && cur_el <= 3); The old comment makes it clear that we're not supposed to get here when running as EL0. The new comment makes this look like a possible DoS attack. r~
On Tue, May 13, 2014 at 10:32:09AM -0700, Richard Henderson wrote: > On 05/05/2014 11:08 PM, Edgar E. Iglesias wrote: > > - /* EL0 has no access rights to update SPSel, and this code > > - * assumes we are updating SP for EL1 while running as EL1. > > - */ > > - assert(arm_current_pl(env) == 1); > > + /* EL0 has no access rights to update SPSel. */ > > + assert(cur_el >= 1 && cur_el <= 3); > > The old comment makes it clear that we're not supposed to get here when running > as EL0. The new comment makes this look like a possible DoS attack. I've changed it to the following for next version: /* We rely on illegal updates to SPsel from EL0 to get trapped * at translation time. */ If you have better suggestions I'm happy to update. Thanks, Edgar
On 05/13/2014 06:18 PM, Edgar E. Iglesias wrote: > I've changed it to the following for next version: > /* We rely on illegal updates to SPsel from EL0 to get trapped > * at translation time. > */ > > If you have better suggestions I'm happy to update. Excellent, thanks. r~
diff --git a/target-arm/internals.h b/target-arm/internals.h index 7c39946..5d802db 100644 --- a/target-arm/internals.h +++ b/target-arm/internals.h @@ -107,6 +107,7 @@ int arm_rmode_to_sf(int rmode); static inline void update_spsel(CPUARMState *env, uint32_t imm) { + unsigned int cur_el = arm_current_pl(env); /* Update PSTATE SPSel bit; this requires us to update the * working stack pointer in xregs[31]. */ @@ -115,17 +116,15 @@ static inline void update_spsel(CPUARMState *env, uint32_t imm) } env->pstate = deposit32(env->pstate, 0, 1, imm); - /* EL0 has no access rights to update SPSel, and this code - * assumes we are updating SP for EL1 while running as EL1. - */ - assert(arm_current_pl(env) == 1); + /* EL0 has no access rights to update SPSel. */ + assert(cur_el >= 1 && cur_el <= 3); if (env->pstate & PSTATE_SP) { /* Switch from using SP_EL0 to using SP_ELx */ env->sp_el[0] = env->xregs[31]; - env->xregs[31] = env->sp_el[1]; + env->xregs[31] = env->sp_el[cur_el]; } else { /* Switch from SP_EL0 to SP_ELx */ - env->sp_el[1] = env->xregs[31]; + env->sp_el[cur_el] = env->xregs[31]; env->xregs[31] = env->sp_el[0]; } }