vmbase: bionic: Make FILE* non-dereferencable
In C, it is legal (albeit impl-defined) to dereference a FILE*. However,
treating our CFilePtr variants as valid pointers would be unsafe (from a
Rust perspective) as they are not actual (Rust) pointers. Currently, we
have no need for an actual FILE struct so there is no proper way to
construct valid pointers.
Instead, ensure that C never tries to dereference the FILE* values we
pass it for stdout and stderr. As vmbase never uses TTBR1_EL1 (entry.S
sets TCR_EL1.EPD1), addresses in the "upper" VA range can't be mapped
and can therefore be used as FILE* for this purpose. As a result, C
dereferencing these pointers would trigger a synchronous exception (mem
abort caused by invalid translation) leading to a system crash, keeping
the Rust environment safe. To reduce the risk of this bitrotting if/when
vmbase starts using TTBR1_EL1, use an address that requires 52-bit VA
range (TCR_EL1.T1SZ = 12), which we currently don't use even with TTBR0.
However, as those addresses use more than 32 bits, Rust warn about them
not being portable as usize. Therefore, enforce that the code be only
compiled for AArch64, rendering moot the portability concern, which can
then be silenced. This approach will force other targets to re-evaluate
the assumption and/or define their own addresses.
Test: m pvmfw librialto libvmbase_example
Change-Id: Ic4e373fa86db03728f92cd522fdb089462c11f83
diff --git a/vmbase/src/bionic.rs b/vmbase/src/bionic.rs
index c4b7ccc..8b40dae 100644
--- a/vmbase/src/bionic.rs
+++ b/vmbase/src/bionic.rs
@@ -123,11 +123,16 @@
}
}
+#[cfg(target_arch = "aarch64")]
+#[allow(clippy::enum_clike_unportable_variant)] // No risk if AArch64 only.
#[repr(usize)]
/// Fake FILE* values used by C to refer to the default streams.
+///
+/// These values are intentionally invalid pointers so that dereferencing them will be caught.
enum CFilePtr {
- Stdout = 0x7670cf00,
- Stderr = 0x9d118200,
+ // On AArch64 with TCR_EL1.EPD1 set or TCR_EL1.T1SZ > 12, these VAs can't be mapped.
+ Stdout = 0xfff0_badf_badf_bad0,
+ Stderr = 0xfff0_badf_badf_bad1,
}
impl CFilePtr {