From nobody Tue Feb 10 16:06:10 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1655327630; cv=none; d=zohomail.com; s=zohoarc; b=hW0X1Gi9hxfslXe+wPtBJ8mrQlFoAzPQ+OBWUfP5LPz05EjC4Yk/9y3ar4HfQOinWCdN56G9RPc5G0o00fSRRF0qJsZBwm5X8sjGq9LkIvr4bSdHgcG+IGY2gnSqP25QOM82v82Tg0eGH2ytN56389jhajT4w1n81TLyHDj7oPo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1655327630; h=Content-Type:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=yILoX1zmCdlVITMUCjBJ4efzazoD6rNnppr0y6J94Bo=; b=K6u8L2bNPMSfGvTO73wJO2w5aYAYXbTR1ZFrx43cLnQar//vty0kXDkRvRfuUvfWGnEqxoO1gFDbzR71htU40GEQlAjbKuzrLJnVck2f7cJ+Qop56m0sXkCkVfLkT2vY8j8YfyMed2ZpGT16PD/lneyku4FZrxEBoaVjWfEcSSk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1655327629734338.9082712888379; Wed, 15 Jun 2022 14:13:49 -0700 (PDT) Received: from localhost ([::1]:54726 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1o1aKh-00030q-Vq for importer@patchew.org; Wed, 15 Jun 2022 17:13:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33596) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1o1aJ1-0001I5-DS; Wed, 15 Jun 2022 17:12:03 -0400 Received: from pb-smtp20.pobox.com ([173.228.157.52]:57458) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1o1aIz-0005R1-BQ; Wed, 15 Jun 2022 17:12:03 -0400 Received: from pb-smtp20.pobox.com (unknown [127.0.0.1]) by pb-smtp20.pobox.com (Postfix) with ESMTP id 1331A1A83BA; Wed, 15 Jun 2022 17:11:58 -0400 (EDT) (envelope-from nico@fluxnic.net) Received: from pb-smtp20.sea.icgroup.com (unknown [127.0.0.1]) by pb-smtp20.pobox.com (Postfix) with ESMTP id 0BD891A83B9; Wed, 15 Jun 2022 17:11:58 -0400 (EDT) (envelope-from nico@fluxnic.net) Received: from yoda.home (unknown [96.21.170.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pb-smtp20.pobox.com (Postfix) with ESMTPSA id D7D5D1A83B7; Wed, 15 Jun 2022 17:11:53 -0400 (EDT) (envelope-from nico@fluxnic.net) Received: from xanadu.home (xanadu.home [192.168.2.2]) by yoda.home (Postfix) with ESMTPSA id 70A862DF4B8; Wed, 15 Jun 2022 17:11:51 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=pobox.com; h=date:from :to:cc:subject:message-id:mime-version:content-type; s=sasl; bh= X2NeBToT0LEImInR0fiKCPjXexxbY8sZgQAWrigkCVc=; b=WLacvZPmlrijWCC9 /8/hqdH/5UfDYU3LsznH3apTp9FpfpNomI1ku1LJUF7lOpLGJO+MnLgdX448XDKP aj6BQjTSAbSiNnybARQ6/p4rEX9IbxtmxTj8ZUwkpLP4soXOH2PSCjsd09D7w3n6 u+ISFEu7znRwwh3h2sqj42vRkmQ= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=fluxnic.net; h=date:from:to:cc:subject:message-id:mime-version:content-type; s=2016-12.pbsmtp; bh=X2NeBToT0LEImInR0fiKCPjXexxbY8sZgQAWrigkCVc=; b=LYTCHixJ/iXzag+JzmKGpQ58tvm0Sj2lfLGB6FdbgcGYc00PgA11zYWjsvuyb3jomei0Oua2uwSdI/m5IncM42D+btfHf1rdDUlAhXPVfbeokvkdn3LS4ZVVzOZkXl6uh22r5IolddL2IVgBgbxMUHFYgnQ9ytzOAkbqOZq2gYA= Date: Wed, 15 Jun 2022 17:11:51 -0400 (EDT) From: Nicolas Pitre To: qemu-devel@nongnu.org, qemu-riscv@nongnu.org cc: Palmer Dabbelt , Alistair Francis , Bin Meng Subject: [PATCH] target/riscv/pmp: guard against PMP ranges with a negative size Message-ID: <3oq0sqs1-67o0-145-5n1s-453o118804q@syhkavp.arg> MIME-Version: 1.0 X-Pobox-Relay-ID: C8088CB4-ECEF-11EC-A7B3-C85A9F429DF0-78420484!pb-smtp20.pobox.com Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=173.228.157.52; envelope-from=nico@fluxnic.net; helo=pb-smtp20.pobox.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_CSS=0.1 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @fluxnic.net) X-ZM-MESSAGEID: 1655327631637100001 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For a TOR entry to match, the stard address must be lower than the end address. Normally this is always the case, but correct code might still run into the following scenario: Initial state: pmpaddr3 =3D 0x2000 pmp3cfg =3D OFF pmpaddr4 =3D 0x3000 pmp4cfg =3D TOR Execution: 1. write 0x40ff to pmpaddr3 2. write 0x32ff to pmpaddr4 3. set pmp3cfg to NAPOT with a read-modify-write on pmpcfg0 4. set pmp4cfg to NAPOT with a read-modify-write on pmpcfg1 When (2) is emulated, a call to pmp_update_rule() creates a negative range for pmp4 as pmp4cfg is still set to TOR. And when (3) is emulated, a call to tlb_flush() is performed, causing pmp_get_tlb_size() to return a very creatively large TLB size for pmp4. This, in turn, may result in accesses to non-existent/unitialized memory regions and a fault, so that (4) ends up never being executed. This is in m-mode with MPRV unset, meaning that unlocked PMP entries should have no effect. Therefore such a behavior based on PMP content is very unexpected. Make sure no negative PMP range can be created, whether explicitly by the emulated code or implicitly like the above. Signed-off-by: Nicolas Pitre diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c index 151da3fa08..ea2b67d947 100644 Reviewed-by: Alistair Francis --- a/target/riscv/pmp.c +++ b/target/riscv/pmp.c @@ -167,6 +167,9 @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t = pmp_index) case PMP_AMATCH_TOR: sa =3D prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ ea =3D (this_addr << 2) - 1u; + if (sa > ea) { + sa =3D ea =3D 0u; + } break; =20 case PMP_AMATCH_NA4: