blob: 37858c723c78b15ff4afd416c25b7ad4e8bf26d4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
device: 0.810
performance: 0.795
graphic: 0.737
network: 0.702
other: 0.637
socket: 0.633
semantic: 0.594
permissions: 0.587
PID: 0.539
vnc: 0.513
files: 0.432
debug: 0.409
KVM: 0.330
boot: 0.301
Non-Executable PMP regions of size less than 4K trigger instruction access faults non-deterministically
Description of problem:
When a non-executable PMP region of size less than 4K (page size) with a start address that is not 4K-aligned is created, QEMU will non-deterministically dispatch instruction access faults when instructions are executed from the PMP-covered region (will in some cases, won't in others, based on the current TLB state)
Steps to reproduce:
1. Create a PMP region of size less than 4K, that is not aligned to the start of the page, make it non-executable
2. Flush TLB with `sfence.vma x0, x0`
3. Jump to the start of the pmp-protected page and start executing instructions
4. Notice that no instruction access fault is reported once we reach the protected region inside the page
Additional information:
@rth7680 I believe this is at least partially an unintentional result of this commit that you authored: 7e0d9973ea665bf459b2dbd173d0e51bc6ca5216, which modified the behavior of `get_page_addr_code_hostp` probes to probe a single byte, instead of a full page size (signaled by passing 0).
This means that we initially probe the first byte of the page, see that no PMP faults are raised, and then assume that no other bytes in the page can cause a PMP fault.
Note that I believe that simply changing this back to 0 from 1 is not enough, as this will likely simply reintroduce the issue I originally reported in #1053.
|