commit f2a6e44590c7d36876ad28d67073852dbdffe43f
author Pierre-Clément Tosi <ptosi@google.com> Fri Jun 28 10:33:52 2024 +0100
committer Pierre-Clément Tosi <ptosi@google.com> Tue Jul 09 17:30:09 2024 +0100
tree 1ec19ebff267b81fa4072c68ee752d0511cf3db4
parent c84449c5817907bdbe64078f5cbd21f7c49c5f24

vmbase: bionic: Make FILE* non-dereferencable

In C, it is legal (albeit impl-defined) to dereference a FILE*. However,
treating our CFilePtr variants as valid pointers would be unsafe (from a
Rust perspective) as they are not actual (Rust) pointers. Currently, we
have no need for an actual FILE struct so there is no proper way to
construct valid pointers.

Instead, ensure that C never tries to dereference the FILE* values we
pass it for stdout and stderr. As vmbase never uses TTBR1_EL1 (entry.S
sets TCR_EL1.EPD1), addresses in the "upper" VA range can't be mapped
and can therefore be used as FILE* for this purpose. As a result, C
dereferencing these pointers would trigger a synchronous exception (mem
abort caused by invalid translation) leading to a system crash, keeping
the Rust environment safe. To reduce the risk of this bitrotting if/when
vmbase starts using TTBR1_EL1, use an address that requires 52-bit VA
range (TCR_EL1.T1SZ = 12), which we currently don't use even with TTBR0.

However, as those addresses use more than 32 bits, Rust warn about them
not being portable as usize. Therefore, enforce that the code be only
compiled for AArch64, rendering moot the portability concern, which can
then be silenced. This approach will force other targets to re-evaluate
the assumption and/or define their own addresses.

Test: m pvmfw librialto libvmbase_example
Change-Id: Ic4e373fa86db03728f92cd522fdb089462c11f83