From patchwork Thu May 30 13:51:30 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hesham Almatary X-Patchwork-Id: 10968775 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5E3BA1398 for ; Thu, 30 May 2019 13:54:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 50364286D5 for ; Thu, 30 May 2019 13:54:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4405F28961; Thu, 30 May 2019 13:54:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id CC0E2286D5 for ; Thu, 30 May 2019 13:54:10 +0000 (UTC) Received: from localhost ([127.0.0.1]:54375 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLVS-0002ke-52 for patchwork-qemu-devel@patchwork.kernel.org; Thu, 30 May 2019 09:54:10 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43721) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLTS-00017d-0a for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hWLTR-0005wU-18 for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:05 -0400 Received: from mta2.cl.cam.ac.uk ([2001:630:212:200::25:2]:55992) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hWLTO-0005jc-Pf; Thu, 30 May 2019 09:52:02 -0400 Received: from cassia.cl.cam.ac.uk ([2001:630:212:238:b26e:bfff:fe2f:c7d9]) by mta2.cl.cam.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1hWLTB-000GcU-Os; Thu, 30 May 2019 14:51:49 +0100 Received: from hmka2 by cassia.cl.cam.ac.uk with local (Exim 4.90_1) (envelope-from ) id 1hWLTB-0005Nh-NK; Thu, 30 May 2019 14:51:49 +0100 From: Hesham Almatary To: qemu-riscv@nongnu.org Date: Thu, 30 May 2019 14:51:30 +0100 Message-Id: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> X-Mailer: git-send-email 2.17.1 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:630:212:200::25:2 Subject: [Qemu-devel] [PATCHv4 1/6] RISC-V: Only Check PMP if MMU translation succeeds X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sagar Karandikar , Bastian Koppelmann , Palmer Dabbelt , qemu-devel@nongnu.org, Alistair Francis , Hesham Almatary Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The current implementation unnecessarily checks for PMP even if MMU translation failed. This may trigger a wrong PMP access exception instead of a page exception. For example, the very first instruction fetched after the first satp write in S-Mode will trigger a PMP access fault instead of an instruction fetch page fault. This patch prioritises MMU exceptions over PMP exceptions and only checks for PMP if MMU translation succeeds. This patch is required for future commits that properly report PMP exception violations if PTW succeeds. Signed-off-by: Hesham Almatary Reviewed-by: Alistair Francis --- target/riscv/cpu_helper.c | 1 + 1 file changed, 1 insertion(+) -- 2.17.1 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 41d6db41c3..40fb47e794 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -401,6 +401,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, " prot %d\n", __func__, address, ret, pa, prot); if (riscv_feature(env, RISCV_FEATURE_PMP) && + (ret == TRANSLATE_SUCCESS) && !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << access_type)) { ret = TRANSLATE_FAIL; } From patchwork Thu May 30 13:51:31 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hesham Almatary X-Patchwork-Id: 10968769 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 783C9912 for ; Thu, 30 May 2019 13:53:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 65AA628830 for ; Thu, 30 May 2019 13:53:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5994D28B24; Thu, 30 May 2019 13:53:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C0C7A28830 for ; Thu, 30 May 2019 13:53:27 +0000 (UTC) Received: from localhost ([127.0.0.1]:54369 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLUk-0002Ce-I4 for patchwork-qemu-devel@patchwork.kernel.org; Thu, 30 May 2019 09:53:26 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43631) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLTN-000147-RY for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hWLTM-0005qF-Q3 for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:01 -0400 Received: from mta2.cl.cam.ac.uk ([2001:630:212:200::25:2]:55766) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hWLTK-0005lP-Ek; Thu, 30 May 2019 09:51:58 -0400 Received: from cassia.cl.cam.ac.uk ([2001:630:212:238:b26e:bfff:fe2f:c7d9]) by mta2.cl.cam.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1hWLTI-000Gcc-9v; Thu, 30 May 2019 14:51:56 +0100 Received: from hmka2 by cassia.cl.cam.ac.uk with local (Exim 4.90_1) (envelope-from ) id 1hWLTI-0005Tw-8G; Thu, 30 May 2019 14:51:56 +0100 From: Hesham Almatary To: qemu-riscv@nongnu.org Date: Thu, 30 May 2019 14:51:31 +0100 Message-Id: <20190530135135.19715-2-Hesham.Almatary@cl.cam.ac.uk> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> References: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:630:212:200::25:2 Subject: [Qemu-devel] [PATCHv4 2/6] RISC-V: Raise access fault exceptions on PMP violations X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sagar Karandikar , Bastian Koppelmann , Palmer Dabbelt , qemu-devel@nongnu.org, Alistair Francis , Hesham Almatary Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP Section 3.6 in RISC-V v1.10 privilege specification states that PMP violations report "access exceptions." The current PMP implementation has a bug which wrongly reports "page exceptions" on PMP violations. This patch fixes this bug by reporting the correct PMP access exceptions trap values. Signed-off-by: Hesham Almatary Reviewed-by: Alistair Francis --- target/riscv/cpu_helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 2.17.1 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 40fb47e794..7c7282c680 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -318,12 +318,13 @@ restart: } static void raise_mmu_exception(CPURISCVState *env, target_ulong address, - MMUAccessType access_type) + MMUAccessType access_type, bool pmp_violation) { CPUState *cs = CPU(riscv_env_get_cpu(env)); int page_fault_exceptions = (env->priv_ver >= PRIV_VERSION_1_10_0) && - get_field(env->satp, SATP_MODE) != VM_1_10_MBARE; + get_field(env->satp, SATP_MODE) != VM_1_10_MBARE && + !pmp_violation; switch (access_type) { case MMU_INST_FETCH: cs->exception_index = page_fault_exceptions ? @@ -389,6 +390,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, CPURISCVState *env = &cpu->env; hwaddr pa = 0; int prot; + bool pmp_violation = false; int ret = TRANSLATE_FAIL; qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n", @@ -403,6 +405,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, if (riscv_feature(env, RISCV_FEATURE_PMP) && (ret == TRANSLATE_SUCCESS) && !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << access_type)) { + pmp_violation = true; ret = TRANSLATE_FAIL; } if (ret == TRANSLATE_SUCCESS) { @@ -412,7 +415,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, } else if (probe) { return false; } else { - raise_mmu_exception(env, address, access_type); + raise_mmu_exception(env, address, access_type, pmp_violation); riscv_raise_exception(env, cs->exception_index, retaddr); } #else From patchwork Thu May 30 13:51:32 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hesham Almatary X-Patchwork-Id: 10968773 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3F2B51398 for ; Thu, 30 May 2019 13:53:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 30E8D284D2 for ; Thu, 30 May 2019 13:53:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 24417289EE; Thu, 30 May 2019 13:53:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A5CF6284D2 for ; Thu, 30 May 2019 13:53:37 +0000 (UTC) Received: from localhost ([127.0.0.1]:54373 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLUu-0002LI-V1 for patchwork-qemu-devel@patchwork.kernel.org; Thu, 30 May 2019 09:53:37 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43675) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLTQ-00015o-5u for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hWLTP-0005t7-1N for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:04 -0400 Received: from mta2.cl.cam.ac.uk ([2001:630:212:200::25:2]:32905) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hWLTM-0005ox-F2; Thu, 30 May 2019 09:52:00 -0400 Received: from cassia.cl.cam.ac.uk ([2001:630:212:238:b26e:bfff:fe2f:c7d9]) by mta2.cl.cam.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1hWLTL-000Gck-O5; Thu, 30 May 2019 14:51:59 +0100 Received: from hmka2 by cassia.cl.cam.ac.uk with local (Exim 4.90_1) (envelope-from ) id 1hWLTL-0005Zy-Md; Thu, 30 May 2019 14:51:59 +0100 From: Hesham Almatary To: qemu-riscv@nongnu.org Date: Thu, 30 May 2019 14:51:32 +0100 Message-Id: <20190530135135.19715-3-Hesham.Almatary@cl.cam.ac.uk> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> References: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:630:212:200::25:2 Subject: [Qemu-devel] [PATCHv4 3/6] RISC-V: Check for the effective memory privilege mode during PMP checks X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sagar Karandikar , Bastian Koppelmann , Palmer Dabbelt , qemu-devel@nongnu.org, Alistair Francis , Hesham Almatary Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The current PMP check function checks for env->priv which is not the effective memory privilege mode. For example, mstatus.MPRV could be set while executing in M-Mode, and in that case the privilege mode for the PMP check should be S-Mode rather than M-Mode (in env->priv) if mstatus.MPP == PRV_S. This patch passes the effective memory privilege mode to the PMP check. Functions that call the PMP check should pass the correct memory privilege mode after reading mstatus' MPRV/MPP or hstatus.SPRV (if Hypervisor mode exists). Suggested-by: Alistair Francis Signed-off-by: Hesham Almatary Reviewed-by: Alistair Francis --- target/riscv/cpu_helper.c | 10 +++++++++- target/riscv/pmp.c | 6 +++--- target/riscv/pmp.h | 2 +- 3 files changed, 13 insertions(+), 5 deletions(-) -- 2.17.1 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 7c7282c680..5a1cd7cf96 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -392,19 +392,27 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, int prot; bool pmp_violation = false; int ret = TRANSLATE_FAIL; + int mode = mmu_idx; qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n", __func__, address, access_type, mmu_idx); ret = get_physical_address(env, &pa, &prot, address, access_type, mmu_idx); + if (mode == PRV_M && access_type != MMU_INST_FETCH) { + if (get_field(env->mstatus, MSTATUS_MPRV)) { + mode = get_field(env->mstatus, MSTATUS_MPP); + } + } + qemu_log_mask(CPU_LOG_MMU, "%s address=%" VADDR_PRIx " ret %d physical " TARGET_FMT_plx " prot %d\n", __func__, address, ret, pa, prot); if (riscv_feature(env, RISCV_FEATURE_PMP) && (ret == TRANSLATE_SUCCESS) && - !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << access_type)) { + !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << access_type, + mode)) { pmp_violation = true; ret = TRANSLATE_FAIL; } diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c index b11c4ae22f..89170bc11d 100644 --- a/target/riscv/pmp.c +++ b/target/riscv/pmp.c @@ -229,7 +229,7 @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr) * Check if the address has required RWX privs to complete desired operation */ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, - target_ulong size, pmp_priv_t privs) + target_ulong size, pmp_priv_t privs, target_ulong mode) { int i = 0; int ret = -1; @@ -265,7 +265,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, } allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; - if ((env->priv != PRV_M) || pmp_is_locked(env, i)) { + if ((mode != PRV_M) || pmp_is_locked(env, i)) { allowed_privs &= env->pmp_state.pmp[i].cfg_reg; } @@ -281,7 +281,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, /* No rule matched */ if (ret == -1) { - if (env->priv == PRV_M) { + if (mode == PRV_M) { ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an * M-Mode access, the access succeeds */ } else { diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h index 66790950eb..8e19793132 100644 --- a/target/riscv/pmp.h +++ b/target/riscv/pmp.h @@ -59,6 +59,6 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index, target_ulong val); target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index); bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, - target_ulong size, pmp_priv_t priv); + target_ulong size, pmp_priv_t priv, target_ulong mode); #endif From patchwork Thu May 30 13:51:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hesham Almatary X-Patchwork-Id: 10968771 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 76EE3912 for ; Thu, 30 May 2019 13:53:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 67EE7285C9 for ; Thu, 30 May 2019 13:53:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5CA5C28896; Thu, 30 May 2019 13:53:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 0A9A8285C9 for ; Thu, 30 May 2019 13:53:34 +0000 (UTC) Received: from localhost ([127.0.0.1]:54348 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLUs-000190-3G for patchwork-qemu-devel@patchwork.kernel.org; Thu, 30 May 2019 09:53:34 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43701) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLTR-00016m-5z for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hWLTQ-0005v0-4g for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:05 -0400 Received: from mta2.cl.cam.ac.uk ([2001:630:212:200::25:2]:42845) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hWLTN-0005r9-WF; Thu, 30 May 2019 09:52:02 -0400 Received: from cassia.cl.cam.ac.uk ([2001:630:212:238:b26e:bfff:fe2f:c7d9]) by mta2.cl.cam.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1hWLTN-000Gct-9f; Thu, 30 May 2019 14:52:01 +0100 Received: from hmka2 by cassia.cl.cam.ac.uk with local (Exim 4.90_1) (envelope-from ) id 1hWLTN-0005bt-7y; Thu, 30 May 2019 14:52:01 +0100 From: Hesham Almatary To: qemu-riscv@nongnu.org Date: Thu, 30 May 2019 14:51:33 +0100 Message-Id: <20190530135135.19715-4-Hesham.Almatary@cl.cam.ac.uk> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> References: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:630:212:200::25:2 Subject: [Qemu-devel] [PATCHv4 4/6] RISC-V: Check PMP during Page Table Walks X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sagar Karandikar , Bastian Koppelmann , Palmer Dabbelt , qemu-devel@nongnu.org, Alistair Francis , Hesham Almatary Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The PMP should be checked when doing a page table walk, and report access fault exception if the to-be-read PTE failed the PMP check. Suggested-by: Jonathan Behrens Signed-off-by: Hesham Almatary Reviewed-by: Alistair Francis --- target/riscv/cpu.h | 1 + target/riscv/cpu_helper.c | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) -- 2.17.1 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index c17184f4e4..ab3ba3f15a 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -94,6 +94,7 @@ enum { #define PRIV_VERSION_1_09_1 0x00010901 #define PRIV_VERSION_1_10_0 0x00011000 +#define TRANSLATE_PMP_FAIL 2 #define TRANSLATE_FAIL 1 #define TRANSLATE_SUCCESS 0 #define NB_MMU_MODES 4 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 5a1cd7cf96..00bc4f1712 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -211,6 +211,12 @@ restart: /* check that physical address of PTE is legal */ target_ulong pte_addr = base + idx * ptesize; + + if (riscv_feature(env, RISCV_FEATURE_PMP) && + !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong), + 1 << MMU_DATA_LOAD, PRV_S)) { + return TRANSLATE_PMP_FAIL; + } #if defined(TARGET_RISCV32) target_ulong pte = ldl_phys(cs->as, pte_addr); #elif defined(TARGET_RISCV64) @@ -413,8 +419,10 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, (ret == TRANSLATE_SUCCESS) && !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << access_type, mode)) { + ret = TRANSLATE_PMP_FAIL; + } + if (ret == TRANSLATE_PMP_FAIL) { pmp_violation = true; - ret = TRANSLATE_FAIL; } if (ret == TRANSLATE_SUCCESS) { tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK, From patchwork Thu May 30 13:51:34 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hesham Almatary X-Patchwork-Id: 10968777 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 566781398 for ; Thu, 30 May 2019 13:55:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 46CC4284D2 for ; Thu, 30 May 2019 13:55:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3ACF5289E0; Thu, 30 May 2019 13:55:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C6C00284D2 for ; Thu, 30 May 2019 13:55:57 +0000 (UTC) Received: from localhost ([127.0.0.1]:54431 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLXB-000497-1Y for patchwork-qemu-devel@patchwork.kernel.org; Thu, 30 May 2019 09:55:57 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43735) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLTS-00018I-JF for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hWLTR-0005xI-M6 for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:06 -0400 Received: from mta2.cl.cam.ac.uk ([2001:630:212:200::25:2]:38134) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hWLTP-0005sQ-60; Thu, 30 May 2019 09:52:03 -0400 Received: from cassia.cl.cam.ac.uk ([2001:630:212:238:b26e:bfff:fe2f:c7d9]) by mta2.cl.cam.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1hWLTO-000Gd1-En; Thu, 30 May 2019 14:52:02 +0100 Received: from hmka2 by cassia.cl.cam.ac.uk with local (Exim 4.90_1) (envelope-from ) id 1hWLTO-0005dr-D5; Thu, 30 May 2019 14:52:02 +0100 From: Hesham Almatary To: qemu-riscv@nongnu.org Date: Thu, 30 May 2019 14:51:34 +0100 Message-Id: <20190530135135.19715-5-Hesham.Almatary@cl.cam.ac.uk> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> References: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:630:212:200::25:2 Subject: [Qemu-devel] [PATCHv4 5/6] RISC-V: Fix a PMP bug where it succeeds even if PMP entry is off X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sagar Karandikar , Bastian Koppelmann , Palmer Dabbelt , qemu-devel@nongnu.org, Alistair Francis , Hesham Almatary Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The current implementation returns 1 (PMP check success) if the address is in range even if the PMP entry is off. This is a bug. For example, if there is a PMP check in S-Mode which is in range, but its PMP entry is off, this will succeed, which it should not. The patch fixes this bug by only checking the PMP permissions if the address is in range and its corresponding PMP entry it not off. Otherwise, it will keep the ret = -1 which will be checked and handled correctly at the end of the function. Signed-off-by: Hesham Almatary Reviewed-by: Alistair Francis --- target/riscv/pmp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.17.1 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c index 89170bc11d..0a8e7a2dc4 100644 --- a/target/riscv/pmp.c +++ b/target/riscv/pmp.c @@ -259,11 +259,12 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, /* fully inside */ const uint8_t a_field = pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); - if ((s + e) == 2) { - if (PMP_AMATCH_OFF == a_field) { - return 1; - } + /* + * If the PMP entry is not off and the address is in range, do the priv + * check + */ + if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) { allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; if ((mode != PRV_M) || pmp_is_locked(env, i)) { allowed_privs &= env->pmp_state.pmp[i].cfg_reg; From patchwork Thu May 30 13:51:35 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hesham Almatary X-Patchwork-Id: 10968779 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B37B31398 for ; Thu, 30 May 2019 13:56:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A555B28830 for ; Thu, 30 May 2019 13:56:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 999DE289A5; Thu, 30 May 2019 13:56:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 47D13285CE for ; Thu, 30 May 2019 13:56:17 +0000 (UTC) Received: from localhost ([127.0.0.1]:54433 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLXU-0004Lk-IC for patchwork-qemu-devel@patchwork.kernel.org; Thu, 30 May 2019 09:56:16 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43746) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hWLTT-00018g-00 for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hWLTS-0005xu-3a for qemu-devel@nongnu.org; Thu, 30 May 2019 09:52:06 -0400 Received: from mta2.cl.cam.ac.uk ([2001:630:212:200::25:2]:36650) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hWLTP-0005tr-TE; Thu, 30 May 2019 09:52:04 -0400 Received: from cassia.cl.cam.ac.uk ([2001:630:212:238:b26e:bfff:fe2f:c7d9]) by mta2.cl.cam.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.86_2) (envelope-from ) id 1hWLTP-000Gd7-5n; Thu, 30 May 2019 14:52:03 +0100 Received: from hmka2 by cassia.cl.cam.ac.uk with local (Exim 4.90_1) (envelope-from ) id 1hWLTP-0005fw-43; Thu, 30 May 2019 14:52:03 +0100 From: Hesham Almatary To: qemu-riscv@nongnu.org Date: Thu, 30 May 2019 14:51:35 +0100 Message-Id: <20190530135135.19715-6-Hesham.Almatary@cl.cam.ac.uk> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> References: <20190530135135.19715-1-Hesham.Almatary@cl.cam.ac.uk> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:630:212:200::25:2 Subject: [Qemu-devel] [PATCHv4 6/6] RISC-V: Fix a PMP check with the correct access size X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sagar Karandikar , Bastian Koppelmann , Palmer Dabbelt , qemu-devel@nongnu.org, Alistair Francis , Hesham Almatary Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The PMP check should be of the memory access size rather than TARGET_PAGE_SIZE. Signed-off-by: Hesham Almatary Reviewed-by: Alistair Francis --- target/riscv/cpu_helper.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) -- 2.17.1 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 00bc4f1712..64c12d83dc 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -417,8 +417,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, if (riscv_feature(env, RISCV_FEATURE_PMP) && (ret == TRANSLATE_SUCCESS) && - !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << access_type, - mode)) { + !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) { ret = TRANSLATE_PMP_FAIL; } if (ret == TRANSLATE_PMP_FAIL) {