From patchwork Wed Apr 6 08:24:41 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 8759141 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 142119F39A for ; Wed, 6 Apr 2016 08:25:10 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5A52420149 for ; Wed, 6 Apr 2016 08:25:08 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A080D2013A for ; Wed, 6 Apr 2016 08:25:07 +0000 (UTC) Received: from localhost ([::1]:41597 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anilu-0007py-GU for patchwork-qemu-devel@patchwork.kernel.org; Wed, 06 Apr 2016 04:25:06 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39471) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anili-0007hS-Jt for qemu-devel@nongnu.org; Wed, 06 Apr 2016 04:24:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1anilf-0004uW-BO for qemu-devel@nongnu.org; Wed, 06 Apr 2016 04:24:54 -0400 Received: from mail-wm0-x244.google.com ([2a00:1450:400c:c09::244]:34702) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anilf-0004uM-3I for qemu-devel@nongnu.org; Wed, 06 Apr 2016 04:24:51 -0400 Received: by mail-wm0-x244.google.com with SMTP id n3so10989026wmn.1 for ; Wed, 06 Apr 2016 01:24:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id; bh=ag3eKpK3I4PTwBfl0jL+ZoEoXZjiyZaFXypjW2TaFNE=; b=fShIbjJ08GDbm197QX+rrtSrieaLlUSUPYrQnxpOiqs7lfy9iSLmaGdVaGMKNJthGI faepWCHcPENifT+cUV918sa6AyUlHDDiuLp/QBdSzGHryti39+n7u5k07lDjUnr22Wu8 CgPfq1g99vK2HBs65MWIpd9DFqkjxOol/HmeZYpLPoJmVGIi2ivoFeyGMaL/jgjZcKcA i4jicmC1CaTo3SuT1SrFEhWBVQOhL9FDLwkzwfdxyUCmmACumCt16SMVa7vQFaCOa0lz mEPu/3xAwaMYjkdTmicxPUZbwoel9xbTbCEORPHIurYn4OVp36tynZvb4Gx9HOe0gNW3 b7gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=ag3eKpK3I4PTwBfl0jL+ZoEoXZjiyZaFXypjW2TaFNE=; b=R5UC7AU2UQWBzZlkpttKxad6HVsB0e8IAhHVjsMfpYryiS1oI1Rq/So18MpE4Ljv+1 InbpI7OZEP89yaioNm1MSOwyaNbnAJkxvOdTBB7FNZ38E+b2O5fbcc+6ZAJlJenZQCYP RCNNxSz7KJ89jqZLn8wUgsiJiKFSCykm5snb32LG/IWOGMITJyBmJ8F3MLH2FE8SJVpM ok/PP9daOX6uyCfWytTl1cWTZrBePMWsHIxEym0tRlgG+knf0kCxWp5cIYc375Qz2RAu 94Kv1pNF512zSSmnUyfW5gAJ+Ya85A0UeMZY1qLS2TLJQbushuIVecgGX7nV0ytVJx7F VGqQ== X-Gm-Message-State: AD7BkJIJGgzgoHPyWjQjKWio1VadtCpnfnJWgbjG/XTgotmivXM3sKF0imboaYE5sAknmw== X-Received: by 10.28.184.194 with SMTP id i185mr22730646wmf.90.1459931090518; Wed, 06 Apr 2016 01:24:50 -0700 (PDT) Received: from donizetti.lan (94-39-141-76.adsl-ull.clienti.tiscali.it. [94.39.141.76]) by smtp.gmail.com with ESMTPSA id v206sm2401356wmv.12.2016.04.06.01.24.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 06 Apr 2016 01:24:49 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Wed, 6 Apr 2016 10:24:41 +0200 Message-Id: <1459931081-26870-1-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 2.5.5 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2a00:1450:400c:c09::244 Cc: guangrong.xiao@linux.intel.com Subject: [Qemu-devel] [PATCH] target-i386: check for PKU even for non-writable pages X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Xiao Guangrong ran kvm-unit-tests on an actual machine with PKU and found that it fails: test pte.p pte.user pde.p pde.user pde.a pde.pse pkru.wd pkey=1 user write efer.nx cr4.pke: FAIL: error code 27 expected 7 Dump mapping: address: 0x123400000000 ------L4: 2ebe007 ------L3: 2ebf007 ------L2: 8000000020000a5 (All failures are combinations of "pde.user pde.p pkru.wd pkey=1", plus either "pde.pse" or "pte.p pte.user", plus one of "user cr0.wp", "cr0.wp" or "user", plus unimportant bits such as accessed/dirty or efer.nx). So PFEC.PKEY is set even if the ordinary check failed (which it did because pde.w is zero). Adjust QEMU to match behavior of silicon. Signed-off-by: Paolo Bonzini --- target-i386/helper.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/target-i386/helper.c b/target-i386/helper.c index 5755839..bf3e762 100644 --- a/target-i386/helper.c +++ b/target-i386/helper.c @@ -919,29 +919,31 @@ do_check_protect_pse36: !((env->cr[4] & CR4_SMEP_MASK) && (ptep & PG_USER_MASK)))) { prot |= PAGE_EXEC; } - - if ((prot & (1 << is_write1)) == 0) { - goto do_fault_protect; - } - if ((env->cr[4] & CR4_PKE_MASK) && (env->hflags & HF_LMA_MASK) && (ptep & PG_USER_MASK) && env->pkru) { uint32_t pk = (pte & PG_PKRU_MASK) >> PG_PKRU_BIT; uint32_t pkru_ad = (env->pkru >> pk * 2) & 1; uint32_t pkru_wd = (env->pkru >> pk * 2) & 2; + uint32_t pkru_prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; if (pkru_ad) { - prot &= ~(PAGE_READ | PAGE_WRITE); + pkru_prot &= ~(PAGE_READ | PAGE_WRITE); } else if (pkru_wd && (is_user || env->cr[0] & CR0_WP_MASK)) { - prot &= ~PAGE_WRITE; + pkru_prot &= ~PAGE_WRITE; } - if ((prot & (1 << is_write1)) == 0) { + + prot &= pkru_prot; + if ((pkru_prot & (1 << is_write1)) == 0) { assert(is_write1 != 2); error_code |= PG_ERROR_PK_MASK; goto do_fault_protect; } } + if ((prot & (1 << is_write1)) == 0) { + goto do_fault_protect; + } + /* yes, it can! */ is_dirty = is_write && !(pte & PG_DIRTY_MASK); if (!(pte & PG_ACCESSED_MASK) || is_dirty) {