[Qemu-devel] [PATCH v3 0/3] target-arm: Add a few more S2 MMU input checks

[Qemu-devel] [PATCH v3 0/3] target-arm: Add a few more S2 MMU input checks

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

This adds the inputsize > pamax check and also fixes the
startlevel checks to apply to the 64bit translations.

Comments welcome!

Cheers,
Edgar

ChangeLog:
v2 -> v3:
* Document pamax arg to check_s2_startlevel

v1 -> v2:
* inputsize > pmax check only applies to AArch64
* Fix commit message typo < should be >

Edgar E. Iglesias (3):
  target-arm: Apply S2 MMU startlevel table size check to AArch64
  target-arm: Make pamax an argument to check_s2_startlevel
  target-arm: Implement the S2 MMU inputsize > pamax check

 target-arm/helper.c | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

-- 
1.9.1

[Qemu-devel] [PATCH v3 1/3] target-arm: Apply S2 MMU startlevel table size check to AArch64

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

The S2 starting level table size check applies to both AArch32
and AArch64. Move it to common code.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target-arm/helper.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index f956b67..8aedce9 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -6581,11 +6581,19 @@ typedef enum {
 static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
                                 int inputsize, int stride)
 {
+    const int grainsize = stride + 3;
+    int startsizecheck;
+
     /* Negative levels are never allowed.  */
     if (level < 0) {
         return false;
     }
 
+    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
+    if (startsizecheck < 1 || startsizecheck > stride + 4) {
+        return false;
+    }
+
     if (is_aa64) {
         unsigned int pamax = arm_pamax(cpu);
 
@@ -6609,20 +6617,12 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
             g_assert_not_reached();
         }
     } else {
-        const int grainsize = stride + 3;
-        int startsizecheck;
-
         /* AArch32 only supports 4KB pages. Assert on that.  */
         assert(stride == 9);
 
         if (level == 0) {
             return false;
         }
-
-        startsizecheck = inputsize - ((3 - level) * stride + grainsize);
-        if (startsizecheck < 1 || startsizecheck > stride + 4) {
-            return false;
-        }
     }
     return true;
 }
-- 
1.9.1

[Qemu-devel] [PATCH v3 2/3] target-arm: Make pamax an argument to check_s2_startlevel

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Make pamax an argument to check_s2_startlevel in preparation
for future reuse.

No functional change.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target-arm/helper.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 8aedce9..2a6fa94 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -6575,11 +6575,13 @@ typedef enum {
  * @startlevel: Suggested starting level
  * @inputsize:  Bitsize of IPAs
  * @stride:     Page-table stride (See the ARM ARM)
+ * @pamax:      Implementation defined bit-width of physical addresses
  *
  * Returns true if the suggested starting level is OK and false otherwise.
  */
 static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
-                                int inputsize, int stride)
+                                int inputsize, int stride,
+                                unsigned int pamax)
 {
     const int grainsize = stride + 3;
     int startsizecheck;
@@ -6595,8 +6597,6 @@ static bool check_s2_startlevel(ARMCPU *cpu, bool is_aa64, int level,
     }
 
     if (is_aa64) {
-        unsigned int pamax = arm_pamax(cpu);
-
         switch (stride) {
         case 13: /* 64KB Pages.  */
             if (level == 0 || (level == 1 && pamax <= 42)) {
@@ -6808,6 +6808,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
          */
         int startlevel = extract32(tcr->raw_tcr, 6, 2);
+        unsigned int pamax = arm_pamax(cpu);
         bool ok;
 
         if (va_size == 32 || stride == 9) {
@@ -6820,7 +6821,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
 
         /* Check that the starting level is valid. */
         ok = check_s2_startlevel(cpu, va_size == 64, level,
-                                 inputsize, stride);
+                                 inputsize, stride, pamax);
         if (!ok) {
             /* AArch64 reports these as level 0 faults.
              * AArch32 reports these as level 1 faults.
-- 
1.9.1

[Qemu-devel] [PATCH v3 3/3] target-arm: Implement the S2 MMU inputsize > pamax check

[Edgar E. Iglesias]

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Implement the inputsize > pamax check for Stage 2 translations.
We have multiple choices for how to respond to errors and
choose to fault.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
---
 target-arm/helper.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target-arm/helper.c b/target-arm/helper.c
index 2a6fa94..8901762 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -6809,7 +6809,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          */
         int startlevel = extract32(tcr->raw_tcr, 6, 2);
         unsigned int pamax = arm_pamax(cpu);
-        bool ok;
+        bool ok = true;
 
         if (va_size == 32 || stride == 9) {
             /* AArch32 or 4KB pages */
@@ -6819,9 +6819,17 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
             level = 3 - startlevel;
         }
 
-        /* Check that the starting level is valid. */
-        ok = check_s2_startlevel(cpu, va_size == 64, level,
-                                 inputsize, stride, pamax);
+        if (va_size == 64 &&
+            inputsize > pamax &&
+            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
+            /* We have multiple choices but choose to fault.  */
+            ok = false;
+        }
+        if (ok) {
+            /* Check that the starting level is valid. */
+            ok = check_s2_startlevel(cpu, va_size == 64, level,
+                                     inputsize, stride, pamax);
+        }
         if (!ok) {
             /* AArch64 reports these as level 0 faults.
              * AArch32 reports these as level 1 faults.
-- 
1.9.1

Re: [Qemu-devel] [PATCH v3 3/3] target-arm: Implement the S2 MMU inputsize > pamax check

[Alex Bennée]

Edgar E. Iglesias <edgar.iglesias@gmail.com> writes:

> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
>
> Implement the inputsize > pamax check for Stage 2 translations.
> We have multiple choices for how to respond to errors and
> choose to fault.
>
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
<snip>

Too fast ;-)

I'm awaiting v4.

--
Alex Bennée

Re: [Qemu-devel] [PATCH v3 1/3] target-arm: Apply S2 MMU startlevel table size check to AArch64

[Peter Maydell]

On 22 January 2016 at 09:50, Edgar E. Iglesias <edgar.iglesias@gmail.com> wrote:
> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
>
> The S2 starting level table size check applies to both AArch32
> and AArch64. Move it to common code.
>
> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

Re: [Qemu-devel] [PATCH v3 3/3] target-arm: Implement the S2 MMU inputsize > pamax check

[Peter Maydell]

On 22 January 2016 at 09:50, Edgar E. Iglesias <edgar.iglesias@gmail.com> wrote:
> From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
>
> Implement the inputsize > pamax check for Stage 2 translations.
> We have multiple choices for how to respond to errors and
> choose to fault.
>
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> ---
>  target-arm/helper.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index 2a6fa94..8901762 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -6809,7 +6809,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>           */
>          int startlevel = extract32(tcr->raw_tcr, 6, 2);
>          unsigned int pamax = arm_pamax(cpu);
> -        bool ok;
> +        bool ok = true;
>
>          if (va_size == 32 || stride == 9) {
>              /* AArch32 or 4KB pages */
> @@ -6819,9 +6819,17 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>              level = 3 - startlevel;
>          }
>
> -        /* Check that the starting level is valid. */
> -        ok = check_s2_startlevel(cpu, va_size == 64, level,
> -                                 inputsize, stride, pamax);
> +        if (va_size == 64 &&
> +            inputsize > pamax &&
> +            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
> +            /* We have multiple choices but choose to fault.  */

Can we say specifically "This is CONSTRAINED UNPREDICTABLE and
we choose...", please?

thanks
-- PMM

Re: [Qemu-devel] [PATCH v3 3/3] target-arm: Implement the S2 MMU inputsize > pamax check

[Edgar E. Iglesias]

On Mon, Jan 25, 2016 at 12:57:41PM +0000, Peter Maydell wrote:
> On 22 January 2016 at 09:50, Edgar E. Iglesias <edgar.iglesias@gmail.com> wrote:
> > From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
> >
> > Implement the inputsize > pamax check for Stage 2 translations.
> > We have multiple choices for how to respond to errors and
> > choose to fault.
> >
> > Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
> > ---
> >  target-arm/helper.c | 16 ++++++++++++----
> >  1 file changed, 12 insertions(+), 4 deletions(-)
> >
> > diff --git a/target-arm/helper.c b/target-arm/helper.c
> > index 2a6fa94..8901762 100644
> > --- a/target-arm/helper.c
> > +++ b/target-arm/helper.c
> > @@ -6809,7 +6809,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> >           */
> >          int startlevel = extract32(tcr->raw_tcr, 6, 2);
> >          unsigned int pamax = arm_pamax(cpu);
> > -        bool ok;
> > +        bool ok = true;
> >
> >          if (va_size == 32 || stride == 9) {
> >              /* AArch32 or 4KB pages */
> > @@ -6819,9 +6819,17 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> >              level = 3 - startlevel;
> >          }
> >
> > -        /* Check that the starting level is valid. */
> > -        ok = check_s2_startlevel(cpu, va_size == 64, level,
> > -                                 inputsize, stride, pamax);
> > +        if (va_size == 64 &&
> > +            inputsize > pamax &&
> > +            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
> > +            /* We have multiple choices but choose to fault.  */
> 
> Can we say specifically "This is CONSTRAINED UNPREDICTABLE and
> we choose...", please?

I'll change this for v4.

Thanks!
Edgar