From: Daniel Henrique Barboza <[email protected]>
All IOMMU accesses are assumed to be user mode unless told otherwise,
i.e. we have a process_id. In case we have a non-user mode leaf PTE
(PTE_U isn't set) and we are running in user mode, we need to throw a
fault.
This also reflects on qos-riscv-iommu tests: the tests always run in
user mode so our PTEs must have PTE_U (bit 0x10) set.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3553
Signed-off-by: Daniel Henrique Barboza <[email protected]>
Reviewed-by: Nutty Liu <[email protected]>
Reviewed-by: Chao Liu <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit b795ea0ba4715182805994db0cdabd2650a553a7)
(Mjt: omit changes in tests/qtest/libqos/qos-riscv-iommu.h which was added
later)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index ca2c6f93572..d25f7a74259 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -285,6 +285,7 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s,
RISCVIOMMUContext *ctx,
G_STAGE = 1,
} pass;
MemTxResult ret;
+ bool pv = !!ctx->process_id;
satp = get_field(ctx->satp, RISCV_IOMMU_ATP_MODE_FIELD);
gatp = get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD);
@@ -458,6 +459,13 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s,
RISCVIOMMUContext *ctx,
break; /* Invalid PTE */
} else if (pte & PTE_RESERVED) {
break; /* Reserved PTE bits set */
+ } else if (!(pte & PTE_U) && !pv) {
+ /*
+ * All accesses are assumed to be User mode unless
+ * process_id is valid (pv). In case we have a
+ * non-user mode PTE and !pv we need to fault.
+ */
+ break;
} else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
base = PPN_PHYS(ppn); /* Inner PTE, continue walking */
} else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
--
2.47.3
