[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 2/4] xen/arm: guest_walk: refuse an address outside both halves of the range
- To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Stefano Stabellini <stefano.stabellini@xxxxxxx>
- Date: Fri, 6 Nov 2026 18:14:39 -0800
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=lists.xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IBxdKwWMhnQrWEpD0g4Fhaowq9waeLjtwAV1Ocf+/3s=; b=AIWiocHDUt5JOJgNFiNSmyXrvzTBcjwE1oIlwvJM9bWLM+GC1a0N13pptRtTsSENbuNnv1S8pxTE/Nr1HPmdwuG9mb88dp8RmZaJa1VKd8/7kCUIuPwYjx3ORQY8hxB3MBivrIqSqZUaWwRtfJbUF8CcB/xkYKEGdDBlwKyFJ/2SP57fhKnqaQzekK3lUk9gCC37Q+Xme7fUGxldNzECzcKIYAiC16kavpbEAeq6VaEhqsFU4fVqq031xG29eQoc9OtBzKEvkfye8mVt0mF9UeX1KeyVL8x3K1GsXO3QrMcyFPuFTz8VKYKwfou1H8cF5vszEP+VMNwFQV53FMDfag==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SKrWA+jouTBv9VgZTgoSP+9LbpXncoIvS9Mr8pdss9jJkrGZ5zk/lI8voJeurqV0t9S0t9kPYQCko3rCerBV5fPkBdRvVfP25ffSodWPbvGLMQXPO1SaJ2DdIDaza5jH7Zaig7vUrZftGh6Pri/9pDaKp0TyDWIkc1C4CxAHFagPvjBoA0xJBES3il1cCHg1qx/gLSrLZD5HZV91qazBG/vKK82A92L456XlNd7EZCfIQiLYHNwqrQkIhXXXFgV0aXO27DYuZ+kBUPR6AxILLa+bsQn2ntLJh7JqNq6qcN7a51O1B6mAhhjeVt2BOwlOtiz2jKiw6HKLGWHSJF7kRQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck"
- Cc: <stefano.stabellini@xxxxxxx>, Julien Grall <julien@xxxxxxx>, "Bertrand Marquis" <bertrand.marquis@xxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
- Delivery-date: Sat, 07 Nov 2026 02:15:11 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
The bits of an input address from its top bit (bit 63, or bit 55 with
the top byte ignored) down to the input address size must be all 0 for
TTBR0 and all 1 for TTBR1, else the walk faults (ARM DDI 0487A.k
J1.1.5). guest_walk_ld() chose the base from the top bit alone and
translated such an address. Refuse it before reading any table.
Fixes: 7d623b358a45 ("arm/mem_access: Add long-descriptor based gpt")
Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
Cc: Julien Grall <julien@xxxxxxx>
Cc: Bertrand Marquis <bertrand.marquis@xxxxxxx>
Cc: Michal Orzel <michal.orzel@xxxxxxx>
Cc: Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
---
xen/arch/arm/guest_walk.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/xen/arch/arm/guest_walk.c b/xen/arch/arm/guest_walk.c
index e23457869b..a8f8530683 100644
--- a/xen/arch/arm/guest_walk.c
+++ b/xen/arch/arm/guest_walk.c
@@ -407,6 +407,15 @@ static bool guest_walk_ld(const struct vcpu *v,
if ( (input_size > TCR_EL1_IPS_48_BIT_VAL) ||
(input_size < TCR_EL1_IPS_MIN_VAL) )
return false;
+
+ /*
+ * The bits of the GVA from the top bit down to the input size must
+ * all be 0 for TTBR0 and all 1 for TTBR1, or the translation faults
+ * (ARM DDI 0487A.k AArch64.TranslationTableWalk(), J1.1.5).
+ */
+ mask = GENMASK_ULL(topbit, input_size);
+ if ( (gva & mask) != ((gva & BIT(topbit, ULL)) ? mask : 0) )
+ return false;
}
else
{
--
2.43.0
|
