* [Qemu-devel] [PATCH] spapr_iommu: fix erroneous sanity check in h_put_tce_indirect()
@ 2015-06-15 17:28 Greg Kurz
2015-06-16 8:53 ` [Qemu-devel] [Qemu-ppc] " Alexey Kardashevskiy
0 siblings, 1 reply; 4+ messages in thread
From: Greg Kurz @ 2015-06-15 17:28 UTC (permalink / raw)
To: David Gibson; +Cc: qemu-ppc, qemu-devel
According to PAPR+ 3.2.2.2, the TCE is implemented as follows:
bits 0-51: real page number
bits 52-61: reserved for future use
bits 62-63: page protection (read-only, write-only, read-write)
Possible values for the protection bits are necessarly non-zero and thus
H_PUT_TCE_INDIRECT currently always fails and returns H_PARAMETER.
The code explicitly clears the protection bits when computing the TCE offset,
a few lines below (tce_list & ~SPAPR_TCE_RW)... The sanity check is obviously
wrong for these bits.
Moreover, I could find no indication in PAPR+ that using the other reserved
bits should error out with H_PARAMETER.
This patch simply drops the offending check.
Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
---
hw/ppc/spapr_iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 8cd9dba9ac4d..37a1110c9d87 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -258,7 +258,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
return H_PARAMETER;
}
- if ((npages > 512) || (tce_list & SPAPR_TCE_PAGE_MASK)) {
+ if (npages > 512) {
return H_PARAMETER;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [Qemu-ppc] [PATCH] spapr_iommu: fix erroneous sanity check in h_put_tce_indirect()
2015-06-15 17:28 [Qemu-devel] [PATCH] spapr_iommu: fix erroneous sanity check in h_put_tce_indirect() Greg Kurz
@ 2015-06-16 8:53 ` Alexey Kardashevskiy
2015-06-16 9:24 ` Greg Kurz
0 siblings, 1 reply; 4+ messages in thread
From: Alexey Kardashevskiy @ 2015-06-16 8:53 UTC (permalink / raw)
To: Greg Kurz, David Gibson; +Cc: qemu-ppc, qemu-devel
On 06/16/2015 03:28 AM, Greg Kurz wrote:
> According to PAPR+ 3.2.2.2, the TCE is implemented as follows:
> bits 0-51: real page number
> bits 52-61: reserved for future use
> bits 62-63: page protection (read-only, write-only, read-write)
tce_list is not a TCE, it is "The logical address of a page of (4 K long on
a 4 K boundary) of TCE contents to be stored in the TCE table (contains
logical address of storage page to be mapped)" so we rather want to remove
(tce_list & ~SPAPR_TCE_RW) below.
> Possible values for the protection bits are necessarly non-zero and thus
> H_PUT_TCE_INDIRECT currently always fails and returns H_PARAMETER.
>
> The code explicitly clears the protection bits when computing the TCE offset,
> a few lines below (tce_list & ~SPAPR_TCE_RW)... The sanity check is obviously
> wrong for these bits.
>
> Moreover, I could find no indication in PAPR+ that using the other reserved
> bits should error out with H_PARAMETER.
>
> This patch simply drops the offending check.
>
> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
> ---
> hw/ppc/spapr_iommu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
> index 8cd9dba9ac4d..37a1110c9d87 100644
> --- a/hw/ppc/spapr_iommu.c
> +++ b/hw/ppc/spapr_iommu.c
> @@ -258,7 +258,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
> return H_PARAMETER;
> }
>
> - if ((npages > 512) || (tce_list & SPAPR_TCE_PAGE_MASK)) {
> + if (npages > 512) {
> return H_PARAMETER;
> }
>
>
>
--
Alexey
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [Qemu-ppc] [PATCH] spapr_iommu: fix erroneous sanity check in h_put_tce_indirect()
2015-06-16 8:53 ` [Qemu-devel] [Qemu-ppc] " Alexey Kardashevskiy
@ 2015-06-16 9:24 ` Greg Kurz
2015-06-16 14:32 ` Alexey Kardashevskiy
0 siblings, 1 reply; 4+ messages in thread
From: Greg Kurz @ 2015-06-16 9:24 UTC (permalink / raw)
To: Alexey Kardashevskiy; +Cc: qemu-ppc, qemu-devel, David Gibson
On Tue, 16 Jun 2015 18:53:51 +1000
Alexey Kardashevskiy <aik@ozlabs.ru> wrote:
> On 06/16/2015 03:28 AM, Greg Kurz wrote:
> > According to PAPR+ 3.2.2.2, the TCE is implemented as follows:
> > bits 0-51: real page number
> > bits 52-61: reserved for future use
> > bits 62-63: page protection (read-only, write-only, read-write)
>
>
>
> tce_list is not a TCE, it is "The logical address of a page of (4 K long on
> a 4 K boundary) of TCE contents to be stored in the TCE table (contains
> logical address of storage page to be mapped)" so we rather want to remove
> (tce_list & ~SPAPR_TCE_RW) below.
>
Oops my bad for the confustion... :-\
Then it looks like SPAPR_TCE_RW can be dropped as well since put_tce_emu() uses
IOMMU_RW instead.
>
> > Possible values for the protection bits are necessarly non-zero and thus
> > H_PUT_TCE_INDIRECT currently always fails and returns H_PARAMETER.
> >
> > The code explicitly clears the protection bits when computing the TCE offset,
> > a few lines below (tce_list & ~SPAPR_TCE_RW)... The sanity check is obviously
> > wrong for these bits.
> >
> > Moreover, I could find no indication in PAPR+ that using the other reserved
> > bits should error out with H_PARAMETER.
> >
> > This patch simply drops the offending check.
> >
> > Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
> > ---
> > hw/ppc/spapr_iommu.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
> > index 8cd9dba9ac4d..37a1110c9d87 100644
> > --- a/hw/ppc/spapr_iommu.c
> > +++ b/hw/ppc/spapr_iommu.c
> > @@ -258,7 +258,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
> > return H_PARAMETER;
> > }
> >
> > - if ((npages > 512) || (tce_list & SPAPR_TCE_PAGE_MASK)) {
> > + if (npages > 512) {
> > return H_PARAMETER;
> > }
> >
> >
> >
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [Qemu-ppc] [PATCH] spapr_iommu: fix erroneous sanity check in h_put_tce_indirect()
2015-06-16 9:24 ` Greg Kurz
@ 2015-06-16 14:32 ` Alexey Kardashevskiy
0 siblings, 0 replies; 4+ messages in thread
From: Alexey Kardashevskiy @ 2015-06-16 14:32 UTC (permalink / raw)
To: Greg Kurz; +Cc: qemu-ppc, qemu-devel, David Gibson
On 06/16/2015 07:24 PM, Greg Kurz wrote:
> On Tue, 16 Jun 2015 18:53:51 +1000
> Alexey Kardashevskiy <aik@ozlabs.ru> wrote:
>
>> On 06/16/2015 03:28 AM, Greg Kurz wrote:
>>> According to PAPR+ 3.2.2.2, the TCE is implemented as follows:
>>> bits 0-51: real page number
>>> bits 52-61: reserved for future use
>>> bits 62-63: page protection (read-only, write-only, read-write)
>>
>>
>>
>> tce_list is not a TCE, it is "The logical address of a page of (4 K long on
>> a 4 K boundary) of TCE contents to be stored in the TCE table (contains
>> logical address of storage page to be mapped)" so we rather want to remove
>> (tce_list & ~SPAPR_TCE_RW) below.
>>
>
> Oops my bad for the confustion... :-\
>
> Then it looks like SPAPR_TCE_RW can be dropped as well since put_tce_emu() uses
> IOMMU_RW instead.
Well, spapr_tce_translate_iommu() should actually translate SPAPR_TCE_xxx
(PAPR defined flags) to IOMMU_xxx (QEMU IOMMUTLBEntry permission bits), not
just rely on the fact that they match.
>
>>
>>> Possible values for the protection bits are necessarly non-zero and thus
>>> H_PUT_TCE_INDIRECT currently always fails and returns H_PARAMETER.
>>>
>>> The code explicitly clears the protection bits when computing the TCE offset,
>>> a few lines below (tce_list & ~SPAPR_TCE_RW)... The sanity check is obviously
>>> wrong for these bits.
>>>
>>> Moreover, I could find no indication in PAPR+ that using the other reserved
>>> bits should error out with H_PARAMETER.
>>>
>>> This patch simply drops the offending check.
>>>
>>> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
>>> ---
>>> hw/ppc/spapr_iommu.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
>>> index 8cd9dba9ac4d..37a1110c9d87 100644
>>> --- a/hw/ppc/spapr_iommu.c
>>> +++ b/hw/ppc/spapr_iommu.c
>>> @@ -258,7 +258,7 @@ static target_ulong h_put_tce_indirect(PowerPCCPU *cpu,
>>> return H_PARAMETER;
>>> }
>>>
>>> - if ((npages > 512) || (tce_list & SPAPR_TCE_PAGE_MASK)) {
>>> + if (npages > 512) {
>>> return H_PARAMETER;
>>> }
>>>
>>>
>>>
>>
>>
>
--
Alexey
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-06-16 14:33 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-15 17:28 [Qemu-devel] [PATCH] spapr_iommu: fix erroneous sanity check in h_put_tce_indirect() Greg Kurz
2015-06-16 8:53 ` [Qemu-devel] [Qemu-ppc] " Alexey Kardashevskiy
2015-06-16 9:24 ` Greg Kurz
2015-06-16 14:32 ` Alexey Kardashevskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).