From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41610) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YGyuu-0004y4-QN for qemu-devel@nongnu.org; Thu, 29 Jan 2015 18:54:33 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YGyur-0001hr-DQ for qemu-devel@nongnu.org; Thu, 29 Jan 2015 18:54:32 -0500 Received: from mail-ie0-f175.google.com ([209.85.223.175]:61998) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YGyur-0001gv-5d for qemu-devel@nongnu.org; Thu, 29 Jan 2015 18:54:29 -0500 Received: by mail-ie0-f175.google.com with SMTP id ar1so378085iec.6 for ; Thu, 29 Jan 2015 15:53:41 -0800 (PST) Date: Fri, 30 Jan 2015 09:49:39 +1000 From: "Edgar E. Iglesias" Message-ID: <20150129234939.GA8636@toto> References: <1422557717-19120-1-git-send-email-peter.maydell@linaro.org> <1422557717-19120-4-git-send-email-peter.maydell@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1422557717-19120-4-git-send-email-peter.maydell@linaro.org> Subject: Re: [Qemu-devel] [PATCH v2 03/11] target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STT List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell Cc: Andrew Jones , Greg Bellows , Alex =?iso-8859-1?Q?Benn=E9e?= , qemu-devel@nongnu.org, patches@linaro.org On Thu, Jan 29, 2015 at 06:55:09PM +0000, Peter Maydell wrote: > The LDT/STT (load/store unprivileged) instruction decode was using > the wrong MMU index value. This meant that instead of these insns > being "always access as if user-mode regardless of current privilege" > they were "always access as if kernel-mode regardless of current > privilege". This went unnoticed because AArch64 Linux doesn't use > these instructions. > > Cc: qemu-stable@nongnu.org > > Signed-off-by: Peter Maydell > Reviewed-by: Greg Bellows Reviewed-by: Edgar E. Iglesias > --- > I'm not counting this as a security issue because I'm assuming > nobody treats TCG guests as a security boundary (certainly I > would not recommend doing so...) > --- > target-arm/translate-a64.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/target-arm/translate-a64.c b/target-arm/translate-a64.c > index 80d2359..dac2f63 100644 > --- a/target-arm/translate-a64.c > +++ b/target-arm/translate-a64.c > @@ -2107,7 +2107,7 @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn) > } > } else { > TCGv_i64 tcg_rt = cpu_reg(s, rt); > - int memidx = is_unpriv ? 1 : get_mem_index(s); > + int memidx = is_unpriv ? MMU_USER_IDX : get_mem_index(s); > > if (is_store) { > do_gpr_st_memidx(s, tcg_rt, tcg_addr, size, memidx); > -- > 1.9.1 >