From patchwork Tue Sep 6 11:03:39 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Hogan X-Patchwork-Id: 9316377 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 969EA60752 for ; Tue, 6 Sep 2016 11:05:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 89DCB28C85 for ; Tue, 6 Sep 2016 11:05:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7E90628C87; Tue, 6 Sep 2016 11:05:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 1FCD728C85 for ; Tue, 6 Sep 2016 11:05:00 +0000 (UTC) Received: from localhost ([::1]:60668 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhEBX-0004WM-77 for patchwork-qemu-devel@patchwork.kernel.org; Tue, 06 Sep 2016 07:04:59 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52983) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhEAt-0004Rz-3v for qemu-devel@nongnu.org; Tue, 06 Sep 2016 07:04:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bhEAl-00021q-Oc for qemu-devel@nongnu.org; Tue, 06 Sep 2016 07:04:18 -0400 Received: from mailapp01.imgtec.com ([195.59.15.196]:26680) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bhEAl-00021b-Is for qemu-devel@nongnu.org; Tue, 06 Sep 2016 07:04:11 -0400 Received: from HHMAIL01.hh.imgtec.org (unknown [10.100.10.19]) by Forcepoint Email with ESMTPS id 24A5AB7B2A3F8; Tue, 6 Sep 2016 12:03:57 +0100 (IST) Received: from jhogan-linux.le.imgtec.org (192.168.154.110) by HHMAIL01.hh.imgtec.org (10.100.10.21) with Microsoft SMTP Server (TLS) id 14.3.294.0; Tue, 6 Sep 2016 12:03:59 +0100 From: James Hogan To: Leon Alrae Date: Tue, 6 Sep 2016 12:03:39 +0100 Message-ID: X-Mailer: git-send-email 2.9.2 In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [192.168.154.110] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 195.59.15.196 Subject: [Qemu-devel] [PATCH 4/9] target-mips: Check memory permissions with mem_idx X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: James Hogan , qemu-devel@nongnu.org, Aurelien Jarno Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP When performing virtual to physical address translation, check the required privilege level based on the mem_idx rather than the mode in the hflags. This will allow EVA loads & stores to operate safely only on user memory from kernel mode. For the cases where the mmu_idx doesn't need to be overridden (mips_cpu_get_phys_page_debug() and cpu_mips_translate_address()), we calculate the required mmu_idx using cpu_mmu_index(). Note that this only tests the MIPS_HFLAG_KSU bits rather than MIPS_HFLAG_MODE, so we don't test the debug mode hflag MIPS_HFLAG_DM any longer. This should be fine as get_physical_address() only compares against MIPS_HFLAG_UM and MIPS_HFLAG_SM, neither of which should get set by compute_hflags() when MIPS_HFLAG_DM is set. Signed-off-by: James Hogan Cc: Leon Alrae Cc: Aurelien Jarno Reviewed-by: Yongbok Kim --- target-mips/helper.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/target-mips/helper.c b/target-mips/helper.c index 29ebf391cb94..2065fc3ec119 100644 --- a/target-mips/helper.c +++ b/target-mips/helper.c @@ -109,11 +109,11 @@ int r4k_map_address (CPUMIPSState *env, hwaddr *physical, int *prot, static int get_physical_address (CPUMIPSState *env, hwaddr *physical, int *prot, target_ulong real_address, - int rw, int access_type) + int rw, int access_type, int mmu_idx) { /* User mode can only access useg/xuseg */ - int user_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM; - int supervisor_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_SM; + int user_mode = mmu_idx == MIPS_HFLAG_UM; + int supervisor_mode = mmu_idx == MIPS_HFLAG_SM; int kernel_mode = !user_mode && !supervisor_mode; #if defined(TARGET_MIPS64) int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0; @@ -413,11 +413,12 @@ static void raise_mmu_exception(CPUMIPSState *env, target_ulong address, hwaddr mips_cpu_get_phys_page_debug(CPUState *cs, vaddr addr) { MIPSCPU *cpu = MIPS_CPU(cs); + CPUMIPSState *env = &cpu->env; hwaddr phys_addr; int prot; - if (get_physical_address(&cpu->env, &phys_addr, &prot, addr, 0, - ACCESS_INT) != 0) { + if (get_physical_address(env, &phys_addr, &prot, addr, 0, ACCESS_INT, + cpu_mmu_index(env, false)) != 0) { return -1; } return phys_addr; @@ -449,7 +450,7 @@ int mips_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw, correctly */ access_type = ACCESS_INT; ret = get_physical_address(env, &physical, &prot, - address, rw, access_type); + address, rw, access_type, mmu_idx); qemu_log_mask(CPU_LOG_MMU, "%s address=%" VADDR_PRIx " ret %d physical " TARGET_FMT_plx " prot %d\n", @@ -479,8 +480,8 @@ hwaddr cpu_mips_translate_address(CPUMIPSState *env, target_ulong address, int r /* data access */ access_type = ACCESS_INT; - ret = get_physical_address(env, &physical, &prot, - address, rw, access_type); + ret = get_physical_address(env, &physical, &prot, address, rw, access_type, + cpu_mmu_index(env, false)); if (ret != TLBRET_MATCH) { raise_mmu_exception(env, address, rw, ret); return -1LL;