[Qemu-devel] [PATCH v1 0/3] target-arm: Add a few more S2 MMU input checks

[Qemu-devel] [PATCH v1 0/3] target-arm: Add a few more S2 MMU input checks

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

This adds the inputsize < pamax check and also fixes the
startlevel checks to apply to the 64bit translations.

Comments welcome!

Cheers,
Edgar

Edgar E. Iglesias (3):
  target-arm: Apply S2 MMU startlevel table size check to AArch64
  target-arm: Make pamax an argument to check_s2_startlevel
  target-arm: Implement the S2 MMU inputsize < pamax check

 target-arm/helper.c | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

-- 
1.9.1

[Qemu-devel] [PATCH v1 1/3] target-arm: Apply S2 MMU startlevel table size check to AArch64

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

The S2 starting level table size check applies to both AArch32
and AArch64. Move it to common code.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target-arm/helper.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index f956b67..8aedce9 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -6581,11 +6581,19 @@ typedef enum {
 static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
                                 int inputsize, int stride)
 {
+    const int grainsize = stride + 3;
+    int startsizecheck;
+
     /* Negative levels are never allowed.  */
     if (level < 0) {
         return false;
     }
 
+    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
+    if (startsizecheck < 1 || startsizecheck > stride + 4) {
+        return false;
+    }
+
     if (is_aa64) {
         unsigned int pamax = arm_pamax(cpu);
 
@@ -6609,20 +6617,12 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
             g_assert_not_reached();
         }
     } else {
-        const int grainsize = stride + 3;
-        int startsizecheck;
-
         /* AArch32 only supports 4KB pages. Assert on that.  */
         assert(stride == 9);
 
         if (level == 0) {
             return false;
         }
-
-        startsizecheck = inputsize - ((3 - level) * stride + grainsize);
-        if (startsizecheck < 1 || startsizecheck > stride + 4) {
-            return false;
-        }
     }
     return true;
 }
-- 
1.9.1

[Qemu-devel] [PATCH v1 2/3] target-arm: Make pamax an argument to check_s2_startlevel

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Make pamax an argument to check_s2_startlevel in preparation
for future reuse.

No functional change.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target-arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 8aedce9..4abeb4d 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -6579,7 +6579,8 @@ typedef enum {
  * Returns true if the suggested starting level is OK and false otherwise.
  */
 static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
-                                int inputsize, int stride)
+                                int inputsize, int stride,
+                                unsigned int pamax)
 {
     const int grainsize = stride + 3;
     int startsizecheck;
@@ -6595,8 +6596,6 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
     }
 
     if (is_aa64) {
-        unsigned int pamax = arm_pamax(cpu);
-
         switch (stride) {
         case 13: /* 64KB Pages.  */
             if (level == 0 || (level == 1 && pamax <= 42)) {
@@ -6808,6 +6807,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
          */
         int startlevel = extract32(tcr->raw_tcr, 6, 2);
+        unsigned int pamax = arm_pamax(cpu);
         bool ok;
 
         if (va_size == 32 || stride == 9) {
@@ -6820,7 +6820,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
 
         /* Check that the starting level is valid. */
         ok = check_s2_startlevel(cpu, va_size == 64, level,
-                                 inputsize, stride);
+                                 inputsize, stride, pamax);
         if (!ok) {
             /* AArch64 reports these as level 0 faults.
              * AArch32 reports these as level 1 faults.
-- 
1.9.1

[Qemu-devel] [PATCH v1 3/3] target-arm: Implement the S2 MMU inputsize < pamax check

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Implement the inputsize < pamax check for Stage 2 translations.
We have multiple choices for how to respond to errors and
choose to fault.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target-arm/helper.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 4abeb4d..e1fa209 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -6808,7 +6808,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          */
         int startlevel = extract32(tcr->raw_tcr, 6, 2);
         unsigned int pamax = arm_pamax(cpu);
-        bool ok;
+        bool ok = true;
 
         if (va_size == 32 || stride == 9) {
             /* AArch32 or 4KB pages */
@@ -6818,9 +6818,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
             level = 3 - startlevel;
         }
 
-        /* Check that the starting level is valid. */
-        ok = check_s2_startlevel(cpu, va_size == 64, level,
-                                 inputsize, stride, pamax);
+        if (inputsize > pamax &&
+            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
+            /* We have multiple choices but choose to fault.  */
+            ok = false;
+        }
+        if (ok) {
+            /* Check that the starting level is valid. */
+            ok = check_s2_startlevel(cpu, va_size == 64, level,
+                                     inputsize, stride, pamax);
+        }
         if (!ok) {
             /* AArch64 reports these as level 0 faults.
              * AArch32 reports these as level 1 faults.
-- 
1.9.1

Re: [Qemu-devel] [PATCH v1 3/3] target-arm: Implement the S2 MMU inputsize < pamax check

[Edgar E. Iglesias]

On Wed, Jan 20, 2016 at 02:49:40PM +0100, Edgar E. Iglesias wrote:
> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
> 
> Implement the inputsize < pamax check for Stage 2 translations.
> We have multiple choices for how to respond to errors and
> choose to fault.
> 
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> ---
>  target-arm/helper.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index 4abeb4d..e1fa209 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -6808,7 +6808,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>           */
>          int startlevel = extract32(tcr->raw_tcr, 6, 2);
>          unsigned int pamax = arm_pamax(cpu);
> -        bool ok;
> +        bool ok = true;
>  
>          if (va_size == 32 || stride == 9) {
>              /* AArch32 or 4KB pages */
> @@ -6818,9 +6818,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>              level = 3 - startlevel;
>          }
>  
> -        /* Check that the starting level is valid. */
> -        ok = check_s2_startlevel(cpu, va_size == 64, level,
> -                                 inputsize, stride, pamax);
> +        if (inputsize > pamax &&
> +            (arm_el_is_aa64(env, 1) || inputsize > 40)) {

I realized that this check should only be done for AArch64...
Will fix that for v2.

Something like the following:

        if (arm_el_is_aa64(env, el) &&
            inputsize > pamax &&
            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
            /* We have multiple choices but choose to fault.  */
            ok = false;
        }


Cheers,
Edgar


> +            /* We have multiple choices but choose to fault.  */
> +            ok = false;
> +        }
> +        if (ok) {
> +            /* Check that the starting level is valid. */
> +            ok = check_s2_startlevel(cpu, va_size == 64, level,
> +                                     inputsize, stride, pamax);
> +        }
>          if (!ok) {
>              /* AArch64 reports these as level 0 faults.
>               * AArch32 reports these as level 1 faults.
> -- 
> 1.9.1
> 

Re: [Qemu-devel] [PATCH v1 1/3] target-arm: Apply S2 MMU startlevel table size check to AArch64

[Alex Bennée]

Edgar E. Iglesias <edgar.iglesias@gmail.com> writes:

> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
>
> The S2 starting level table size check applies to both AArch32
> and AArch64. Move it to common code.
>
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> ---
>  target-arm/helper.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index f956b67..8aedce9 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -6581,11 +6581,19 @@ typedef enum {
>  static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
>                                  int inputsize, int stride)
>  {
> +    const int grainsize = stride + 3;
> +    int startsizecheck;
> +
>      /* Negative levels are never allowed.  */
>      if (level < 0) {
>          return false;
>      }
>
> +    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
> +    if (startsizecheck < 1 || startsizecheck > stride + 4) {
> +        return false;
> +    }
> +
>      if (is_aa64) {
>          unsigned int pamax = arm_pamax(cpu);
>
> @@ -6609,20 +6617,12 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
>              g_assert_not_reached();
>          }
>      } else {
> -        const int grainsize = stride + 3;
> -        int startsizecheck;
> -
>          /* AArch32 only supports 4KB pages. Assert on that.  */
>          assert(stride == 9);
>
>          if (level == 0) {
>              return false;
>          }
> -
> -        startsizecheck = inputsize - ((3 - level) * stride + grainsize);
> -        if (startsizecheck < 1 || startsizecheck > stride + 4) {
> -            return false;
> -        }
>      }
>      return true;
>  }

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

--
Alex Bennée

Re: [Qemu-devel] [PATCH v1 2/3] target-arm: Make pamax an argument to check_s2_startlevel

[Alex Bennée]

Edgar E. Iglesias <edgar.iglesias@gmail.com> writes:

> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
>
> Make pamax an argument to check_s2_startlevel in preparation
> for future reuse.
>
> No functional change.
>
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> ---
>  target-arm/helper.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index 8aedce9..4abeb4d 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -6579,7 +6579,8 @@ typedef enum {
>   * Returns true if the suggested starting level is OK and false otherwise.
>   */
>  static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
> -                                int inputsize, int stride)
> +                                int inputsize, int stride,
> +                                unsigned int pamax)

I'm not convinced about this as we only use pamax in one leg and we can
get it via *cpu when needed. If it will eventually be used you would
also have to update the docstring above.

>  {
>      const int grainsize = stride + 3;
>      int startsizecheck;
> @@ -6595,8 +6596,6 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
>      }
>
>      if (is_aa64) {
> -        unsigned int pamax = arm_pamax(cpu);
> -
>          switch (stride) {
>          case 13: /* 64KB Pages.  */
>              if (level == 0 || (level == 1 && pamax <= 42)) {
> @@ -6808,6 +6807,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>           * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
>           */
>          int startlevel = extract32(tcr->raw_tcr, 6, 2);
> +        unsigned int pamax = arm_pamax(cpu);
>          bool ok;
>
>          if (va_size == 32 || stride == 9) {
> @@ -6820,7 +6820,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>
>          /* Check that the starting level is valid. */
>          ok = check_s2_startlevel(cpu, va_size == 64, level,
> -                                 inputsize, stride);
> +                                 inputsize, stride, pamax);
>          if (!ok) {
>              /* AArch64 reports these as level 0 faults.
>               * AArch32 reports these as level 1 faults.


--
Alex Bennée

Re: [Qemu-devel] [PATCH v1 3/3] target-arm: Implement the S2 MMU inputsize < pamax check

[Alex Bennée]

Edgar E. Iglesias <edgar.iglesias@gmail.com> writes:

> On Wed, Jan 20, 2016 at 02:49:40PM +0100, Edgar E. Iglesias wrote:
>> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
>>
>> Implement the inputsize < pamax check for Stage 2 translations.
>> We have multiple choices for how to respond to errors and
>> choose to fault.
>>
>> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
>> ---
>>  target-arm/helper.c | 15 +++++++++++----
>>  1 file changed, 11 insertions(+), 4 deletions(-)
>>
>> diff --git a/target-arm/helper.c b/target-arm/helper.c
>> index 4abeb4d..e1fa209 100644
>> --- a/target-arm/helper.c
>> +++ b/target-arm/helper.c
>> @@ -6808,7 +6808,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>>           */
>>          int startlevel = extract32(tcr->raw_tcr, 6, 2);
>>          unsigned int pamax = arm_pamax(cpu);
>> -        bool ok;
>> +        bool ok = true;
>>
>>          if (va_size == 32 || stride == 9) {
>>              /* AArch32 or 4KB pages */
>> @@ -6818,9 +6818,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>>              level = 3 - startlevel;
>>          }
>>
>> -        /* Check that the starting level is valid. */
>> -        ok = check_s2_startlevel(cpu, va_size == 64, level,
>> -                                 inputsize, stride, pamax);
>> +        if (inputsize > pamax &&
>> +            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
>
> I realized that this check should only be done for AArch64...
> Will fix that for v2.
>
> Something like the following:
>
>         if (arm_el_is_aa64(env, el) &&
>             inputsize > pamax &&
>             (arm_el_is_aa64(env, 1) || inputsize > 40)) {
>             /* We have multiple choices but choose to fault.  */
>             ok = false;
>         }
>

OK, I'll await the next revision.

>
> Cheers,
> Edgar
>
>
>> +            /* We have multiple choices but choose to fault.  */
>> +            ok = false;
>> +        }
>> +        if (ok) {
>> +            /* Check that the starting level is valid. */
>> +            ok = check_s2_startlevel(cpu, va_size == 64, level,
>> +                                     inputsize, stride, pamax);
>> +        }
>>          if (!ok) {
>>              /* AArch64 reports these as level 0 faults.
>>               * AArch32 reports these as level 1 faults.
>> --
>> 1.9.1
>>


--
Alex Bennée

Re: [Qemu-devel] [PATCH v1 2/3] target-arm: Make pamax an argument to check_s2_startlevel

[Edgar E. Iglesias]

On Thu, Jan 21, 2016 at 12:26:47PM +0000, Alex Bennée wrote:
> 
> Edgar E. Iglesias <edgar.iglesias@gmail.com> writes:
> 
> > From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
> >
> > Make pamax an argument to check_s2_startlevel in preparation
> > for future reuse.
> >
> > No functional change.
> >
> > Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> > ---
> >  target-arm/helper.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/target-arm/helper.c b/target-arm/helper.c
> > index 8aedce9..4abeb4d 100644
> > --- a/target-arm/helper.c
> > +++ b/target-arm/helper.c
> > @@ -6579,7 +6579,8 @@ typedef enum {
> >   * Returns true if the suggested starting level is OK and false otherwise.
> >   */
> >  static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
> > -                                int inputsize, int stride)
> > +                                int inputsize, int stride,
> > +                                unsigned int pamax)
> 
> I'm not convinced about this as we only use pamax in one leg and we can
> get it via *cpu when needed. If it will eventually be used you would
> also have to update the docstring above.

The reusing of pamax comes in the next patch 3/3.
I did it this way to avoid doing the decoding in arm_pamax()
twice for S2 translations...

> 
> >  {
> >      const int grainsize = stride + 3;
> >      int startsizecheck;
> > @@ -6595,8 +6596,6 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
> >      }
> >
> >      if (is_aa64) {
> > -        unsigned int pamax = arm_pamax(cpu);
> > -
> >          switch (stride) {
> >          case 13: /* 64KB Pages.  */
> >              if (level == 0 || (level == 1 && pamax <= 42)) {
> > @@ -6808,6 +6807,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> >           * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
> >           */
> >          int startlevel = extract32(tcr->raw_tcr, 6, 2);
> > +        unsigned int pamax = arm_pamax(cpu);
> >          bool ok;
> >
> >          if (va_size == 32 || stride == 9) {
> > @@ -6820,7 +6820,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> >
> >          /* Check that the starting level is valid. */
> >          ok = check_s2_startlevel(cpu, va_size == 64, level,
> > -                                 inputsize, stride);
> > +                                 inputsize, stride, pamax);
> >          if (!ok) {
> >              /* AArch64 reports these as level 0 faults.
> >               * AArch32 reports these as level 1 faults.
> 
> 
> --
> Alex Bennée

Re: [Qemu-devel] [PATCH v1 3/3] target-arm: Implement the S2 MMU inputsize < pamax check

[Edgar E. Iglesias]

On Thu, Jan 21, 2016 at 12:52:54PM +0000, Alex Bennée wrote:
> 
> Edgar E. Iglesias <edgar.iglesias@gmail.com> writes:
> 
> > On Wed, Jan 20, 2016 at 02:49:40PM +0100, Edgar E. Iglesias wrote:
> >> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
> >>
> >> Implement the inputsize < pamax check for Stage 2 translations.
> >> We have multiple choices for how to respond to errors and
> >> choose to fault.
> >>
> >> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> >> ---
> >>  target-arm/helper.c | 15 +++++++++++----
> >>  1 file changed, 11 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/target-arm/helper.c b/target-arm/helper.c
> >> index 4abeb4d..e1fa209 100644
> >> --- a/target-arm/helper.c
> >> +++ b/target-arm/helper.c
> >> @@ -6808,7 +6808,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> >>           */
> >>          int startlevel = extract32(tcr->raw_tcr, 6, 2);
> >>          unsigned int pamax = arm_pamax(cpu);
> >> -        bool ok;
> >> +        bool ok = true;
> >>
> >>          if (va_size == 32 || stride == 9) {
> >>              /* AArch32 or 4KB pages */
> >> @@ -6818,9 +6818,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> >>              level = 3 - startlevel;
> >>          }
> >>
> >> -        /* Check that the starting level is valid. */
> >> -        ok = check_s2_startlevel(cpu, va_size == 64, level,
> >> -                                 inputsize, stride, pamax);
> >> +        if (inputsize > pamax &&
> >> +            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
> >
> > I realized that this check should only be done for AArch64...
> > Will fix that for v2.
> >
> > Something like the following:
> >
> >         if (arm_el_is_aa64(env, el) &&
> >             inputsize > pamax &&
> >             (arm_el_is_aa64(env, 1) || inputsize > 40)) {
> >             /* We have multiple choices but choose to fault.  */
> >             ok = false;
> >         }
> >
> 
> OK, I'll await the next revision.

I posted a v2 earlier today, let me know if you didn't
receive it!

Cheers,
Edgar

> 
> >
> > Cheers,
> > Edgar
> >
> >
> >> +            /* We have multiple choices but choose to fault.  */
> >> +            ok = false;
> >> +        }
> >> +        if (ok) {
> >> +            /* Check that the starting level is valid. */
> >> +            ok = check_s2_startlevel(cpu, va_size == 64, level,
> >> +                                     inputsize, stride, pamax);
> >> +        }
> >>          if (!ok) {
> >>              /* AArch64 reports these as level 0 faults.
> >>               * AArch32 reports these as level 1 faults.
> >> --
> >> 1.9.1
> >>
> 
> 
> --
> Alex Bennée