Re: [Qemu-devel] [PATCH 4/5] target-arm: get_phys_addr_lpae: more xn control

[Andrew Jones <drjones@redhat.com>]

On Thu, Feb 12, 2015 at 04:05:06PM +0100, Andrew Jones wrote:
> This patch makes the following changes to the determination of
> whether an address is executable, when translating addresses
> using LPAE.
> 
> 1. No longer assumes that PL0 can't execute when it can't read.
>    It can in AArch64, a difference from AArch32.
> 2. Use va_size == 64 to determine we're in AArch64, rather than
>    arm_feature(env, ARM_FEATURE_V8), which is insufficient.
> 3. Add additional XN determinants
>    - NS && is_secure && (SCR & SCR_SIF)
>    - WXN && (prot & PAGE_WRITE)
>    - AArch64: (prot_PL0 & PAGE_WRITE)
>    - AArch32: UWXN && (prot_PL0 & PAGE_WRITE)
>    - XN determination should also work in secure mode (untested)
>    - XN may even work in EL2 (currently impossible to test)
> 4. Cleans up the bloated PAGE_EXEC condition - by removing it.
> 
> The helper get_S1prot is introduced, which also handles short-
> descriptors and v6 XN determination. It may even work in EL2,
> when support for that comes, but, as the function name implies,
> it only works for stage 1 translations.
> 
> Signed-off-by: Andrew Jones <drjones@redhat.com>
> ---
>  target-arm/helper.c | 111 ++++++++++++++++++++++++++++++++++++++++------------
>  1 file changed, 86 insertions(+), 25 deletions(-)
> 
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index df78f481e92f4..20e5753bd216d 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -4695,8 +4695,8 @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
>  /* Translate section/page access permissions to page
>   * R/W protection flags
>   */
> -static inline int get_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
> -                              bool is_user, int ap, int domain_prot)
> +static int get_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
> +                       bool is_user, int ap, int domain_prot)
>  {
>      bool simple_ap = regime_using_lpae_format(env, mmu_idx)
>                           || (regime_sctlr(env, mmu_idx) & SCTLR_AFE);
> @@ -4762,6 +4762,84 @@ static inline int get_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
>      }
>  }
>  
> +/* Translate section/page access permissions to protection flags */
> +static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
> +                      int ap, int domain_prot, int ns, int xn, int pxn)
> +{
> +    bool domain_prot_valid = !regime_using_lpae_format(env, mmu_idx);
> +    bool is_user = regime_is_user(env, mmu_idx);
> +    bool have_wxn;
> +    int prot_rw, user_rw;
> +    int wxn = 0;
> +
> +    assert(mmu_idx != ARMMMUIdx_S2NS);
> +
> +    if (domain_prot_valid && domain_prot == 3) {
> +        return PAGE_READ | PAGE_WRITE | PAGE_EXEC;
> +    }
> +
> +    user_rw = get_rw_prot(env, mmu_idx, true, ap, domain_prot);
> +    if (is_user) {
> +        prot_rw = user_rw;
> +    } else {
> +        prot_rw = get_rw_prot(env, mmu_idx, false, ap, domain_prot);
> +    }
> +
> +    if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
> +        return prot_rw;
> +    }
> +
> +    /* TODO have_wxn should be replaced with arm_feature(env, ARM_FEATURE_EL2),
> +     * when ARM_FEATURE_EL2 starts getting set. For now we assume all v7
> +     * compatible processors have EL2, which is required for [U]WXN.
> +     */
> +    have_wxn = arm_feature(env, ARM_FEATURE_V7);
> +
> +    if (have_wxn) {
> +        wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
> +    }
> +
> +    if (is_aa64) {
> +        assert(arm_feature(env, ARM_FEATURE_V8));
> +        switch (regime_el(env, mmu_idx)) {
> +        case 1:
> +            if (is_user && !user_rw) {
> +                wxn = 0;
> +            } else if (!is_user) {
> +                xn = pxn || (user_rw & PAGE_WRITE);
> +            }
> +            break;
> +        case 2:
> +        case 3:
> +            break;
> +        }
> +    } else if (arm_feature(env, ARM_FEATURE_V6K)) {
> +        switch (regime_el(env, mmu_idx)) {
> +        case 1:
> +        case 3:
> +            if (is_user) {
> +                xn = xn || !user_rw;
> +            } else {
> +                int uwxn = 0;
> +                if (have_wxn) {
> +                    uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
> +                }
> +                xn = xn || !prot_rw || pxn || (uwxn && (user_rw & PAGE_WRITE));
> +            }
> +            break;
> +        case 2:
> +            break;
> +        }
> +    } else {
> +        xn = wxn = 0;
> +    }
> +
> +    if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
> +        return prot_rw;
> +    }
> +    return prot_rw | PAGE_EXEC;
> +}
> +
>  static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
>                                       uint32_t *table, uint32_t address)
>  {
> @@ -5047,7 +5125,6 @@ static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>      int32_t granule_sz = 9;
>      int32_t va_size = 32;
>      int32_t tbi = 0;
> -    bool is_user;
>      TCR *tcr = regime_tcr(env, mmu_idx);
>  
>      /* TODO:
> @@ -5220,31 +5297,15 @@ static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>          /* Access flag */
>          goto do_fault;
>      }

I just realized that I somehow dropped hunk 2 of patch 2 of the initial
post, http://lists.gnu.org/archive/html/qemu-devel/2015-01/msg01435.html

-        /* Since we're always in the Non-secure state, NSTable is ignored. */
+        attrs |= extract32(tableattrs, 4, 1) << 3; /* NS */

Unfortunately that's also missing from the v2 of this series, that I posted
yesterday. I'll wait for other comments before sending a v3 though.

> +
> +    *prot = get_S1prot(env, mmu_idx, va_size == 64, extract32(attrs, 4, 2), 0,
> +                       extract32(attrs, 3, 1), extract32(attrs, 12, 1),
> +                       extract32(attrs, 11, 1));
> +
>      fault_type = permission_fault;
> -    is_user = regime_is_user(env, mmu_idx);
> -    if (is_user && !(attrs & (1 << 4))) {
> -        /* Unprivileged access not enabled */
> +    if (!(*prot & (1 << access_type))) {
>          goto do_fault;
>      }
> -    *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
> -    if ((arm_feature(env, ARM_FEATURE_V8) && is_user && (attrs & (1 << 12))) ||
> -        (!arm_feature(env, ARM_FEATURE_V8) && (attrs & (1 << 12))) ||
> -        (!is_user && (attrs & (1 << 11)))) {
> -        /* XN/UXN or PXN. Since we only implement EL0/EL1 we unconditionally
> -         * treat XN/UXN as UXN for v8.
> -         */
> -        if (access_type == 2) {
> -            goto do_fault;
> -        }
> -        *prot &= ~PAGE_EXEC;
> -    }
> -    if (attrs & (1 << 5)) {
> -        /* Write access forbidden */
> -        if (access_type == 1) {
> -            goto do_fault;
> -        }
> -        *prot &= ~PAGE_WRITE;
> -    }
>  
>      *phys_ptr = descaddr;
>      *page_size_ptr = page_size;
> -- 
> 1.9.3
>