mirror of
https://github.com/riscv-software-src/opensbi.git
synced 2026-01-03 02:51:19 +00:00
fbb5fe811d
Expected trap must always clear MPRV. Currently it doesn't. There is a security issue here where if firmware was doing ld/st with MPRV=1 and since there would be a expected trap, opensbi will continue to run as MPRV=1. Security impact is DoS where opensbi will just keep trapping. Signed-off-by: Deepak Gupta <debug@rivosinc.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20251124220339.3695940-1-debug@rivosinc.com Signed-off-by: Anup Patel <anup@brainfault.org>
70 lines
1.6 KiB
ArmAsm
70 lines
1.6 KiB
ArmAsm
/*
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
|
*
|
|
* Copyright (c) 2020 Western Digital Corporation or its affiliates.
|
|
*
|
|
* Authors:
|
|
* Anup Patel <anup.patel@wdc.com>
|
|
*/
|
|
|
|
#include <sbi/riscv_asm.h>
|
|
#include <sbi/sbi_trap.h>
|
|
|
|
/*
|
|
* We assume that faulting instruction is 4-byte long and blindly
|
|
* increment SEPC by 4.
|
|
*
|
|
* The trap info will be saved as follows:
|
|
* A3 <- pointer struct sbi_trap_info
|
|
* A4 <- temporary
|
|
*/
|
|
|
|
.align 3
|
|
.global __sbi_expected_trap
|
|
__sbi_expected_trap:
|
|
/* Without H-extension so, MTVAL2 and MTINST CSRs and GVA not available */
|
|
li a4, MSTATUS_MPRV
|
|
csrc CSR_MSTATUS, a4
|
|
csrr a4, CSR_MCAUSE
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(cause)(a3)
|
|
csrr a4, CSR_MTVAL
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(tval)(a3)
|
|
REG_S zero, SBI_TRAP_INFO_OFFSET(tval2)(a3)
|
|
REG_S zero, SBI_TRAP_INFO_OFFSET(tinst)(a3)
|
|
REG_S zero, SBI_TRAP_INFO_OFFSET(gva)(a3)
|
|
csrr a4, CSR_MEPC
|
|
addi a4, a4, 4
|
|
csrw CSR_MEPC, a4
|
|
mret
|
|
|
|
.align 3
|
|
.global __sbi_expected_trap_hext
|
|
__sbi_expected_trap_hext:
|
|
/* With H-extension so, MTVAL2 and MTINST CSRs and GVA available */
|
|
li a4, MSTATUS_MPRV
|
|
csrc CSR_MSTATUS, a4
|
|
csrr a4, CSR_MCAUSE
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(cause)(a3)
|
|
csrr a4, CSR_MTVAL
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(tval)(a3)
|
|
csrr a4, CSR_MTVAL2
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(tval2)(a3)
|
|
csrr a4, CSR_MTINST
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(tinst)(a3)
|
|
|
|
/* Extract GVA bit from MSTATUS or MSTATUSH */
|
|
#if __riscv_xlen == 32
|
|
csrr a4, CSR_MSTATUSH
|
|
srli a4, a4, MSTATUSH_GVA_SHIFT
|
|
#else
|
|
csrr a4, CSR_MSTATUS
|
|
srli a4, a4, MSTATUS_GVA_SHIFT
|
|
#endif
|
|
andi a4, a4, 1
|
|
REG_S a4, SBI_TRAP_INFO_OFFSET(gva)(a3)
|
|
|
|
csrr a4, CSR_MEPC
|
|
addi a4, a4, 4
|
|
csrw CSR_MEPC, a4
|
|
mret
|