From 176be2386dbd0e54a2aae57cc1a1272139764758 Mon Sep 17 00:00:00 2001
From: TuxSH <1922548+TuxSH@users.noreply.github.com>
Date: Wed, 14 Aug 2019 15:48:07 +0200
Subject: [PATCH] thermosphere: also trap GICH (to deny access)

---
 thermosphere/src/data_abort.c                | 9 ++++++---
 thermosphere/src/platform/qemu/memory_map.c  | 5 +++--
 thermosphere/src/platform/tegra/memory_map.c | 4 +++-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/thermosphere/src/data_abort.c b/thermosphere/src/data_abort.c
index 6d2a6c758..0f42831dd 100644
--- a/thermosphere/src/data_abort.c
+++ b/thermosphere/src/data_abort.c
@@ -46,6 +46,7 @@ void handleLowerElDataAbortException(ExceptionStackFrame *frame, ExceptionSyndro
     memcpy(&dabtIss, &esr, 4);
 
     u64 far = GET_SYSREG(far_el2);
+    u64 farpg = far & ~0xFFFull;
 
     if (!dabtIss.isv || dabtIss.fnv) {
         dumpUnhandledDataAbort(dabtIss, far, "");
@@ -53,9 +54,11 @@ void handleLowerElDataAbortException(ExceptionStackFrame *frame, ExceptionSyndro
 
     // TODO
 
-    if ((far & ~0xFFFull) == (uintptr_t)g_irqManager.gic.gicd) {
+    if (farpg == (uintptr_t)g_irqManager.gic.gicd) {
         // TODO
+    } else if (farpg == (uintptr_t)g_irqManager.gic.gich) {
+        dumpUnhandledDataAbort(dabtIss, far, "GICH");
+    } else {
+        dumpUnhandledDataAbort(dabtIss, far, "(fallback)");
     }
-
-    dumpUnhandledDataAbort(dabtIss, far, "(fallback)");
 }
\ No newline at end of file
diff --git a/thermosphere/src/platform/qemu/memory_map.c b/thermosphere/src/platform/qemu/memory_map.c
index 95af2393d..fd5064dc1 100644
--- a/thermosphere/src/platform/qemu/memory_map.c
+++ b/thermosphere/src/platform/qemu/memory_map.c
@@ -72,8 +72,9 @@ uintptr_t configureStage2MemoryMap(u32 *addrSpaceSize)
 
         identityMapL3(g_vttbl_l3_0, 0x08000000ull, BITL(21), unchanged);
 
-        // GICD -> trapped, GICv2 CPU -> vCPU interface
-        mmu_unmap_range(3, g_vttbl_l3_0, 0x08000000, 0x10000ull);
+        // GICD -> trapped, GICv2 CPU -> vCPU interface, GICH -> trapped (deny access)
+        mmu_unmap_range(3, g_vttbl_l3_0, 0x08000000ull, 0x10000ull);
+        mmu_unmap_range(3, g_vttbl_l3_0, 0x08030000ull, 0x10000ull);
         mmu_map_page_range(g_vttbl_l3_0, 0x08010000ull, 0x08040000ull, 0x10000ull, devattrs);
     }
 
diff --git a/thermosphere/src/platform/tegra/memory_map.c b/thermosphere/src/platform/tegra/memory_map.c
index 4f846012f..f9eaf66f1 100644
--- a/thermosphere/src/platform/tegra/memory_map.c
+++ b/thermosphere/src/platform/tegra/memory_map.c
@@ -71,8 +71,10 @@ uintptr_t configureStage2MemoryMap(u32 *addrSpaceSize)
 
         identityMapL3(g_vttbl_l3_0, 0x00000000ull, BITL(21), unchanged);
 
-        // GICD -> trapped, GICv2 CPU -> vCPU interface
+        // GICD -> trapped, GICv2 CPU -> vCPU interface, GICH -> trapped (access denied including for the unused view)
         mmu_unmap_page(g_vttbl_l3_0, 0x50401000ull);
+        mmu_unmap_page(g_vttbl_l3_0, 0x50404000ull);
+        mmu_unmap_page(g_vttbl_l3_0, 0x50405000ull);
         mmu_map_page_range(g_vttbl_l3_0, 0x50042000ull, 0x50046000ull, 0x2000ull, devattrs);
     }