* Re: [PATCH v2] target/riscv: Fix Guest Physical Address Translation
2023-04-07 15:32 [PATCH v2] target/riscv: Fix Guest Physical Address Translation Irina Ryapolova
@ 2023-04-08 12:30 ` liweiwei
2023-04-17 3:49 ` Alistair Francis
2023-04-17 4:57 ` Alistair Francis
2 siblings, 0 replies; 4+ messages in thread
From: liweiwei @ 2023-04-08 12:30 UTC (permalink / raw)
To: Irina Ryapolova, qemu-devel
Cc: liweiwei, palmer, alistair.francis, bin.meng, dbarboza,
zhiwei_liu, qemu-riscv
On 2023/4/7 23:32, Irina Ryapolova wrote:
> Before changing the flow check for sv39/48/57.
>
> According to specification (for Supervisor mode):
> Sv39 implementations support a 39-bit virtual address space, divided into 4 KiB pages.
> Instruction fetch addresses and load and store effective addresses, which are 64 bits,
> must have bits 63–39 all equal to bit 38, or else a page-fault exception will occur.
> Likewise for Sv48 and Sv57.
>
> So the high bits are equal to bit 38 for sv39.
>
> According to specification (for Hypervisor mode):
> For Sv39x4, address bits of the guest physical address 63:41 must all be zeros, or else a
> guest-page-fault exception occurs.
>
> Likewise for Sv48x4 and Sv57x4.
> For Sv48x4 address bits 63:50 must all be zeros, or else a guest-page-fault exception occurs.
> For Sv57x4 address bits 63:59 must all be zeros, or else a guest-page-fault exception occurs.
>
> For example we are trying to access address 0xffff_ffff_ff01_0000 with only G-translation enabled.
> So expected behavior is to generate exception. But qemu doesn't generate such exception.
>
> For the old check, we get
> va_bits == 41, mask == (1 << 24) - 1, masked_msbs == (0xffff_ffff_ff01_0000 >> 40) & mask == mask.
> Accordingly, the condition masked_msbs != 0 && masked_msbs != mask is not fulfilled
> and the check passes.
>
> Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
> ---
> Changes for v2:
> -Add more detailed commit message
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
I remember I have sent Reviewed-by for last version of this patch. And
it seems no change in following code.
Weiwei Li
> ---
> target/riscv/cpu_helper.c | 25 ++++++++++++++++---------
> 1 file changed, 16 insertions(+), 9 deletions(-)
>
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> index f88c503cf4..27289f2305 100644
> --- a/target/riscv/cpu_helper.c
> +++ b/target/riscv/cpu_helper.c
> @@ -863,17 +863,24 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
>
> CPUState *cs = env_cpu(env);
> int va_bits = PGSHIFT + levels * ptidxbits + widened;
> - target_ulong mask, masked_msbs;
>
> - if (TARGET_LONG_BITS > (va_bits - 1)) {
> - mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
> - } else {
> - mask = 0;
> - }
> - masked_msbs = (addr >> (va_bits - 1)) & mask;
> + if (first_stage == true) {
> + target_ulong mask, masked_msbs;
> +
> + if (TARGET_LONG_BITS > (va_bits - 1)) {
> + mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
> + } else {
> + mask = 0;
> + }
> + masked_msbs = (addr >> (va_bits - 1)) & mask;
>
> - if (masked_msbs != 0 && masked_msbs != mask) {
> - return TRANSLATE_FAIL;
> + if (masked_msbs != 0 && masked_msbs != mask) {
> + return TRANSLATE_FAIL;
> + }
> + } else {
> + if (vm != VM_1_10_SV32 && addr >> va_bits != 0) {
> + return TRANSLATE_FAIL;
> + }
> }
>
> int ptshift = (levels - 1) * ptidxbits;
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] target/riscv: Fix Guest Physical Address Translation
2023-04-07 15:32 [PATCH v2] target/riscv: Fix Guest Physical Address Translation Irina Ryapolova
2023-04-08 12:30 ` liweiwei
@ 2023-04-17 3:49 ` Alistair Francis
2023-04-17 4:57 ` Alistair Francis
2 siblings, 0 replies; 4+ messages in thread
From: Alistair Francis @ 2023-04-17 3:49 UTC (permalink / raw)
To: Irina Ryapolova
Cc: qemu-devel, palmer, alistair.francis, bin.meng, liweiwei,
dbarboza, zhiwei_liu, qemu-riscv
On Sat, Apr 8, 2023 at 1:34 AM Irina Ryapolova
<irina.ryapolova@syntacore.com> wrote:
>
> Before changing the flow check for sv39/48/57.
>
> According to specification (for Supervisor mode):
> Sv39 implementations support a 39-bit virtual address space, divided into 4 KiB pages.
> Instruction fetch addresses and load and store effective addresses, which are 64 bits,
> must have bits 63–39 all equal to bit 38, or else a page-fault exception will occur.
> Likewise for Sv48 and Sv57.
>
> So the high bits are equal to bit 38 for sv39.
>
> According to specification (for Hypervisor mode):
> For Sv39x4, address bits of the guest physical address 63:41 must all be zeros, or else a
> guest-page-fault exception occurs.
>
> Likewise for Sv48x4 and Sv57x4.
> For Sv48x4 address bits 63:50 must all be zeros, or else a guest-page-fault exception occurs.
> For Sv57x4 address bits 63:59 must all be zeros, or else a guest-page-fault exception occurs.
>
> For example we are trying to access address 0xffff_ffff_ff01_0000 with only G-translation enabled.
> So expected behavior is to generate exception. But qemu doesn't generate such exception.
>
> For the old check, we get
> va_bits == 41, mask == (1 << 24) - 1, masked_msbs == (0xffff_ffff_ff01_0000 >> 40) & mask == mask.
> Accordingly, the condition masked_msbs != 0 && masked_msbs != mask is not fulfilled
> and the check passes.
>
> Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> Changes for v2:
> -Add more detailed commit message
> ---
> target/riscv/cpu_helper.c | 25 ++++++++++++++++---------
> 1 file changed, 16 insertions(+), 9 deletions(-)
>
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> index f88c503cf4..27289f2305 100644
> --- a/target/riscv/cpu_helper.c
> +++ b/target/riscv/cpu_helper.c
> @@ -863,17 +863,24 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
>
> CPUState *cs = env_cpu(env);
> int va_bits = PGSHIFT + levels * ptidxbits + widened;
> - target_ulong mask, masked_msbs;
>
> - if (TARGET_LONG_BITS > (va_bits - 1)) {
> - mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
> - } else {
> - mask = 0;
> - }
> - masked_msbs = (addr >> (va_bits - 1)) & mask;
> + if (first_stage == true) {
> + target_ulong mask, masked_msbs;
> +
> + if (TARGET_LONG_BITS > (va_bits - 1)) {
> + mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
> + } else {
> + mask = 0;
> + }
> + masked_msbs = (addr >> (va_bits - 1)) & mask;
>
> - if (masked_msbs != 0 && masked_msbs != mask) {
> - return TRANSLATE_FAIL;
> + if (masked_msbs != 0 && masked_msbs != mask) {
> + return TRANSLATE_FAIL;
> + }
> + } else {
> + if (vm != VM_1_10_SV32 && addr >> va_bits != 0) {
> + return TRANSLATE_FAIL;
> + }
> }
>
> int ptshift = (levels - 1) * ptidxbits;
> --
> 2.25.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] target/riscv: Fix Guest Physical Address Translation
2023-04-07 15:32 [PATCH v2] target/riscv: Fix Guest Physical Address Translation Irina Ryapolova
2023-04-08 12:30 ` liweiwei
2023-04-17 3:49 ` Alistair Francis
@ 2023-04-17 4:57 ` Alistair Francis
2 siblings, 0 replies; 4+ messages in thread
From: Alistair Francis @ 2023-04-17 4:57 UTC (permalink / raw)
To: Irina Ryapolova
Cc: qemu-devel, palmer, alistair.francis, bin.meng, liweiwei,
dbarboza, zhiwei_liu, qemu-riscv
On Sat, Apr 8, 2023 at 1:34 AM Irina Ryapolova
<irina.ryapolova@syntacore.com> wrote:
>
> Before changing the flow check for sv39/48/57.
>
> According to specification (for Supervisor mode):
> Sv39 implementations support a 39-bit virtual address space, divided into 4 KiB pages.
> Instruction fetch addresses and load and store effective addresses, which are 64 bits,
> must have bits 63–39 all equal to bit 38, or else a page-fault exception will occur.
> Likewise for Sv48 and Sv57.
>
> So the high bits are equal to bit 38 for sv39.
>
> According to specification (for Hypervisor mode):
> For Sv39x4, address bits of the guest physical address 63:41 must all be zeros, or else a
> guest-page-fault exception occurs.
>
> Likewise for Sv48x4 and Sv57x4.
> For Sv48x4 address bits 63:50 must all be zeros, or else a guest-page-fault exception occurs.
> For Sv57x4 address bits 63:59 must all be zeros, or else a guest-page-fault exception occurs.
>
> For example we are trying to access address 0xffff_ffff_ff01_0000 with only G-translation enabled.
> So expected behavior is to generate exception. But qemu doesn't generate such exception.
>
> For the old check, we get
> va_bits == 41, mask == (1 << 24) - 1, masked_msbs == (0xffff_ffff_ff01_0000 >> 40) & mask == mask.
> Accordingly, the condition masked_msbs != 0 && masked_msbs != mask is not fulfilled
> and the check passes.
>
> Signed-off-by: Irina Ryapolova <irina.ryapolova@syntacore.com>
Do you mind rebasing this patch on
https://github.com/alistair23/qemu/tree/riscv-to-apply.next and
sending a v3?
Alistair
> ---
> Changes for v2:
> -Add more detailed commit message
> ---
> target/riscv/cpu_helper.c | 25 ++++++++++++++++---------
> 1 file changed, 16 insertions(+), 9 deletions(-)
>
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> index f88c503cf4..27289f2305 100644
> --- a/target/riscv/cpu_helper.c
> +++ b/target/riscv/cpu_helper.c
> @@ -863,17 +863,24 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
>
> CPUState *cs = env_cpu(env);
> int va_bits = PGSHIFT + levels * ptidxbits + widened;
> - target_ulong mask, masked_msbs;
>
> - if (TARGET_LONG_BITS > (va_bits - 1)) {
> - mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
> - } else {
> - mask = 0;
> - }
> - masked_msbs = (addr >> (va_bits - 1)) & mask;
> + if (first_stage == true) {
> + target_ulong mask, masked_msbs;
> +
> + if (TARGET_LONG_BITS > (va_bits - 1)) {
> + mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
> + } else {
> + mask = 0;
> + }
> + masked_msbs = (addr >> (va_bits - 1)) & mask;
>
> - if (masked_msbs != 0 && masked_msbs != mask) {
> - return TRANSLATE_FAIL;
> + if (masked_msbs != 0 && masked_msbs != mask) {
> + return TRANSLATE_FAIL;
> + }
> + } else {
> + if (vm != VM_1_10_SV32 && addr >> va_bits != 0) {
> + return TRANSLATE_FAIL;
> + }
> }
>
> int ptshift = (levels - 1) * ptidxbits;
> --
> 2.25.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread