Page MenuHomeFreeBSD
Files F149657416

D49119.1790657372.diff
No OneTemporary
Actions

Size
2 KB
Referenced Files
None
Subscribers
None

D49119.1790657372.diff
View Options

diff --git a/sys/arm64/arm64/copyinout.S b/sys/arm64/arm64/copyinout.S
--- a/sys/arm64/arm64/copyinout.S
+++ b/sys/arm64/arm64/copyinout.S
@@ -37,7 +37,14 @@
#include "assym.inc"
.macro check_user_access user_arg, size_arg, bad_access_func
- adds x6, x\user_arg, x\size_arg
+ /*
+ * TBI is enabled from 15.0. Clear the top byte of the userspace
+ * address before checking whether it's within the given limit.
+ * The later load/store instructions will fault if TBI is disabled
+ * for the current process.
+ */
+ and x6, x\user_arg, #(~TBI_ADDR_MASK)
+ adds x6, x6, x\size_arg
b.cs \bad_access_func
ldr x7, =VM_MAXUSER_ADDRESS
cmp x6, x7
@@ -100,13 +107,20 @@
adr x6, copyio_fault /* Get the handler address */
SET_FAULT_HANDLER(x6, x7) /* Set the handler */
+ /*
+ * As in check_user_access mask off the TBI bits for the cmp
+ * instruction. The load will fail trap if TBI is disabled, but we
+ * need to check the address didn't wrap.
+ */
+ and x6, x0, #(~TBI_ADDR_MASK)
ldr x7, =VM_MAXUSER_ADDRESS
-1: cmp x0, x7
+1: cmp x6, x7
b.cs copyio_fault
ldtrb w4, [x0] /* Load from uaddr */
add x0, x0, #1 /* Next char */
strb w4, [x1], #1 /* Store in kaddr */
add x5, x5, #1 /* count++ */
+ add x6, x6, #1 /* Increment masked address */
cbz w4, 2f /* Break when NUL-terminated */
sub x2, x2, #1 /* len-- */
cbnz x2, 1b
diff --git a/sys/arm64/arm64/support.S b/sys/arm64/arm64/support.S
--- a/sys/arm64/arm64/support.S
+++ b/sys/arm64/arm64/support.S
@@ -39,8 +39,15 @@
#include "assym.inc"
.macro check_user_access user_arg, limit, bad_addr_func
+ /*
+ * TBI is enabled from 15.0. Clear the top byte of the userspace
+ * address before checking whether it's within the given limit.
+ * The later load/store instructions will fault if TBI is disabled
+ * for the current process.
+ */
+ and x6, x\user_arg, #(~TBI_ADDR_MASK)
ldr x7, =(\limit)
- cmp x\user_arg, x7
+ cmp x6, x7
b.cs \bad_addr_func
.endm
diff --git a/sys/arm64/include/vmparam.h b/sys/arm64/include/vmparam.h
--- a/sys/arm64/include/vmparam.h
+++ b/sys/arm64/include/vmparam.h
@@ -211,6 +211,9 @@
/* The address bits that hold a pointer authentication code */
#define PAC_ADDR_MASK (0xff7f000000000000UL)
+/* The top-byte ignore address bits */
+#define TBI_ADDR_MASK 0xff00000000000000UL
+
/* If true addr is in the kernel address space */
#define ADDR_IS_KERNEL(addr) (((addr) & (1ul << 55)) == (1ul << 55))
/* If true addr is in the user address space */

File Metadata

Mime Type
text/plain
Expires
Tue, Sep 29, 4:49 AM (17 h, 10 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29999627
Default Alt Text
D49119.1790657372.diff (2 KB)

Event Timeline