From patchwork Thu Jul 27 15:48:42 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Halil Pasic X-Patchwork-Id: 9867179 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C391260382 for ; Thu, 27 Jul 2017 15:59:34 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B4E5D2881E for ; Thu, 27 Jul 2017 15:59:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A93BF28842; Thu, 27 Jul 2017 15:59:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7E7D428845 for ; Thu, 27 Jul 2017 15:59:33 +0000 (UTC) Received: from localhost ([::1]:43718 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dalBZ-0006GE-0a for patchwork-qemu-devel@patchwork.kernel.org; Thu, 27 Jul 2017 11:58:49 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56513) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dal2O-0006HP-7Y for qemu-devel@nongnu.org; Thu, 27 Jul 2017 11:49:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dal2K-0005Bv-VM for qemu-devel@nongnu.org; Thu, 27 Jul 2017 11:49:20 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:52362 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dal2K-0005Bg-QL for qemu-devel@nongnu.org; Thu, 27 Jul 2017 11:49:16 -0400 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v6RFn3uq024518 for ; Thu, 27 Jul 2017 11:49:16 -0400 Received: from e06smtp14.uk.ibm.com (e06smtp14.uk.ibm.com [195.75.94.110]) by mx0b-001b2d01.pphosted.com with ESMTP id 2byg9s91pg-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 27 Jul 2017 11:49:12 -0400 Received: from localhost by e06smtp14.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 27 Jul 2017 16:48:49 +0100 Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197) by e06smtp14.uk.ibm.com (192.168.101.144) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 27 Jul 2017 16:48:46 +0100 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v6RFmk8x16122090; Thu, 27 Jul 2017 15:48:46 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 69A6BAE051; Thu, 27 Jul 2017 16:45:05 +0100 (BST) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 39DECAE045; Thu, 27 Jul 2017 16:45:05 +0100 (BST) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.152.85.9]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTPS; Thu, 27 Jul 2017 16:45:05 +0100 (BST) From: Halil Pasic To: Christian Borntraeger , Cornelia Huck , "Dong Jia Shi" Date: Thu, 27 Jul 2017 17:48:42 +0200 X-Mailer: git-send-email 2.11.2 X-TM-AS-GCONF: 00 x-cbid: 17072715-0016-0000-0000-000004DB2A6E X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17072715-0017-0000-0000-00002811B1CC Message-Id: <20170727154842.23427-1-pasic@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-07-27_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1706020000 definitions=main-1707270249 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PATCH v2 1/1] s390x/css: check ccw address validity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Halil Pasic , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP According to the PoP channel command words (CCW) must be doubleword aligned and 31 bit addressable for format 1 and 24 bit addressable for format 0 CCWs. If the channel subsystem encounters ccw address which does not satisfy this alignment requirement a program-check condition is recognised. The situation with 31 bit addressable is a bit more complicated: both the ORB and a format 1 CCW TIC hold the address of (the rest of) the channel program, that is the address of the next CCW in a word, and the PoP mandates that bit 0 of that word shall be zero -- or a program-check condition is to be recognized -- and does not belong to the field holding the ccw address. Since in code the corresponding fields span across the whole word (unlike in PoP where these are defined as 31 bit wide) we can check this by applying a mask. The 24 addressable case isn't affecting TIC because the address is composed of a halfword and a byte portion (no additional zero bit requirements) and just slightly complicates the ORB case where also bits 1-7 need to be zero. The same requirements (especially n-bit addressability) apply to the ccw addresses generated while chaining. Let's make our CSS implementation follow the AR more closely. Signed-off-by: Halil Pasic Reviewed-by: Dong Jia Shi --- This patch used to be a patch used to be a part of the series 'ccw interpretation AR compliance improvements' but the other patch was already applied. I would still like this one being in front of '390x/css: fix bits must be zero check for TIC' as the commit message of that change relies the changes done in this patch. v1 -> v2 * fixed condition (precedence was wrong -- thanks Dong Jia) * check on each iteration when chaining (every ccw of the channel program needs to be 31 or 24 bit addressable (if touched), not only the addresses in TIC and ORB) --- hw/s390x/css.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 6a42b95cee..177cbfc92d 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -795,6 +795,10 @@ static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr, if (!ccw_addr) { return -EIO; } + /* Check doubleword aligned and 31 or 24 (fmt 0) bit addressable. */ + if (ccw_addr & (sch->ccw_fmt_1 ? 0x80000007 : 0xff000007)) { + return -EINVAL; + } /* Translate everything to format-1 ccws - the information is the same. */ ccw = copy_ccw_from_guest(ccw_addr, sch->ccw_fmt_1);