From: Daniel Henrique Barboza <[email protected]>
All IOMMU accesses are assumed to be user mode unless told otherwise,
i.e. we have a process_id. In case we have a non-user mode leaf PTE
(PTE_U isn't set) and we are running in user mode, we need to throw a
fault.
This also reflects on qos-riscv-iommu tests: the tests always run in
user mode so our PTEs must have PTE_U (bit 0x10) set.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3553
Signed-off-by: Daniel Henrique Barboza <[email protected]>
Reviewed-by: Nutty Liu <[email protected]>
Reviewed-by: Chao Liu <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
---
tests/qtest/libqos/qos-riscv-iommu.h | 4 ++--
hw/riscv/riscv-iommu.c | 8 ++++++++
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/tests/qtest/libqos/qos-riscv-iommu.h
b/tests/qtest/libqos/qos-riscv-iommu.h
index 90e69a5d73..c218e9d66d 100644
--- a/tests/qtest/libqos/qos-riscv-iommu.h
+++ b/tests/qtest/libqos/qos-riscv-iommu.h
@@ -54,8 +54,8 @@
* PTE masks for RISC-V IOMMU page tables.
* Values match PTE_V, PTE_R, PTE_W, PTE_A, PTE_D in target/riscv/cpu_bits.h
*/
-#define QRIOMMU_NON_LEAF_PTE_MASK 0x001 /* PTE_V */
-#define QRIOMMU_LEAF_PTE_RW_MASK 0x0c7 /* V|R|W|A|D */
+#define QRIOMMU_NON_LEAF_PTE_MASK 0x011 /* PTE_V | PTE_U */
+#define QRIOMMU_LEAF_PTE_RW_MASK 0x0d7 /* V | R | W | A | D | PTE_U */
#define QRIOMMU_PTE_PPN_MASK 0x003ffffffffffc00ull
/* Address-space base offset for test tables */
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 6665ad9f7c..c35e9f0119 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -298,6 +298,7 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s,
RISCVIOMMUContext *ctx,
G_STAGE = 1,
} pass;
MemTxResult ret;
+ bool pv = !!ctx->process_id;
satp = get_field(ctx->satp, RISCV_IOMMU_ATP_MODE_FIELD);
gatp = get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD);
@@ -471,6 +472,13 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s,
RISCVIOMMUContext *ctx,
break; /* Invalid PTE */
} else if (pte & PTE_RESERVED(false)) {
break; /* Reserved PTE bits set */
+ } else if (!(pte & PTE_U) && !pv) {
+ /*
+ * All accesses are assumed to be User mode unless
+ * process_id is valid (pv). In case we have a
+ * non-user mode PTE and !pv we need to fault.
+ */
+ break;
} else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
base = PPN_PHYS(ppn); /* Inner PTE, continue walking */
} else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
--
2.54.0
