From: Peter Maydell <peter.maydell@linaro.org>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] [PULL 3/7] target/arm: Don't allow guest to make System space executable for M profile
Date: Mon, 31 Jul 2017 13:22:41 +0100 [thread overview]
Message-ID: <1501503765-15639-4-git-send-email-peter.maydell@linaro.org> (raw)
In-Reply-To: <1501503765-15639-1-git-send-email-peter.maydell@linaro.org>
For an M profile v7PMSA, the system space (0xe0000000 - 0xffffffff) can
never be executable, even if the guest tries to set the MPU registers
up that way. Enforce this restriction.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1501153150-19984-3-git-send-email-peter.maydell@linaro.org
---
target/arm/helper.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3d60575..f0299c5 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8251,6 +8251,14 @@ static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
extract32(address, 20, 12) == 0xe00;
}
+static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
+{
+ /* True if address is in the M profile system region
+ * 0xe0000000 - 0xffffffff
+ */
+ return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
+}
+
static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
int access_type, ARMMMUIdx mmu_idx,
hwaddr *phys_ptr, int *prot, uint32_t *fsr)
@@ -8354,6 +8362,12 @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
} else { /* a MPU hit! */
uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
+ uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
+
+ if (m_is_system_region(env, address)) {
+ /* System space is always execute never */
+ xn = 1;
+ }
if (is_user) { /* User mode AP bit decoding */
switch (ap) {
@@ -8394,7 +8408,7 @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
}
/* execute never */
- if (env->pmsav7.dracr[n] & (1 << 12)) {
+ if (xn) {
*prot &= ~PAGE_EXEC;
}
}
--
2.7.4
next prev parent reply other threads:[~2017-07-31 12:23 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-31 12:22 [Qemu-devel] [PULL 0/7] target-arm queue Peter Maydell
2017-07-31 12:22 ` [Qemu-devel] [PULL 1/7] target/arm: Correct MPU trace handling of write vs execute Peter Maydell
2017-07-31 12:22 ` [Qemu-devel] [PULL 2/7] target/arm: Don't do MPU lookups for addresses in M profile PPB region Peter Maydell
2017-07-31 12:22 ` Peter Maydell [this message]
2017-07-31 12:22 ` [Qemu-devel] [PULL 4/7] target/arm: Rename cp15.c6_rgnr to pmsav7.rnr Peter Maydell
2017-07-31 12:22 ` [Qemu-devel] [PULL 5/7] target/arm: Move PMSAv7 reset into arm_cpu_reset() so M profile MPUs get reset Peter Maydell
2017-07-31 12:22 ` [Qemu-devel] [PULL 6/7] target/arm: Migrate MPU_RNR register state for M profile cores Peter Maydell
2017-07-31 12:22 ` [Qemu-devel] [PULL 7/7] hw/mps2_scc: fix incorrect properties Peter Maydell
2017-07-31 15:40 ` [Qemu-devel] [PULL 0/7] target-arm queue Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1501503765-15639-4-git-send-email-peter.maydell@linaro.org \
--to=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.