From 3e2f573e707e78c7e00a977b28ce917ff051e69d Mon Sep 17 00:00:00 2001 From: Himanshu Chauhan Date: Mon, 9 Jan 2023 05:20:41 +0000 Subject: lib: utils: Disallow non-root domains from adding M-mode regions The M-mode regions can only be added to the root domain. The non-root domains shouldn't be able to add them from FDT. Signed-off-by: Himanshu Chauhan Reviewed-by: Anup Patel Tested-by: Anup Patel --- lib/utils/fdt/fdt_domain.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'lib') diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c index 45612ef6..2b51a8eb 100644 --- a/lib/utils/fdt/fdt_domain.c +++ b/lib/utils/fdt/fdt_domain.c @@ -239,6 +239,20 @@ static int __fdt_parse_region(void *fdt, int domain_offset, u32 *region_count = opaque; struct sbi_domain_memregion *region; + /* + * Non-root domains cannot add a region with only M-mode + * access permissions. M-mode regions can only be part of + * root domain. + * + * SU permission bits can't be all zeroes and M-mode permission + * bits must be all set. + */ + if (!((region_access & SBI_DOMAIN_MEMREGION_SU_ACCESS_MASK) + & SBI_DOMAIN_MEMREGION_SU_RWX) + && ((region_access & SBI_DOMAIN_MEMREGION_M_ACCESS_MASK) + & SBI_DOMAIN_MEMREGION_M_RWX)) + return SBI_EINVAL; + /* Find next region of the domain */ if (FDT_DOMAIN_REGION_MAX_COUNT <= *region_count) return SBI_EINVAL; -- cgit v1.2.3