From patchwork Sun May 24 23:47:23 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aurelien Jarno X-Patchwork-Id: 476030 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id B6FB214029C for ; Mon, 25 May 2015 09:50:12 +1000 (AEST) Received: from localhost ([::1]:41212 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ywfek-0007k2-Jk for incoming@patchwork.ozlabs.org; Sun, 24 May 2015 19:50:10 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58294) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YwfcL-00038Z-Sm for qemu-devel@nongnu.org; Sun, 24 May 2015 19:47:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YwfcJ-000814-A8 for qemu-devel@nongnu.org; Sun, 24 May 2015 19:47:41 -0400 Received: from hall.aurel32.net ([2001:bc8:30d7:101::1]:40639) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YwfcJ-00080F-53 for qemu-devel@nongnu.org; Sun, 24 May 2015 19:47:39 -0400 Received: from weber.rr44.fr ([2001:470:d4ed:0:7e05:7ff:fe0d:f152]) by hall.aurel32.net with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84) (envelope-from ) id 1YwfcG-0006oB-G6; Mon, 25 May 2015 01:47:36 +0200 Received: from aurel32 by weber.rr44.fr with local (Exim 4.85) (envelope-from ) id 1YwfcF-0005sy-Kw; Mon, 25 May 2015 01:47:35 +0200 From: Aurelien Jarno To: qemu-devel@nongnu.org Date: Mon, 25 May 2015 01:47:23 +0200 Message-Id: <1432511251-22515-3-git-send-email-aurelien@aurel32.net> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1432511251-22515-1-git-send-email-aurelien@aurel32.net> References: <1432511251-22515-1-git-send-email-aurelien@aurel32.net> X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2001:bc8:30d7:101::1 Cc: Alexander Graf , Aurelien Jarno , Richard Henderson Subject: [Qemu-devel] [PATCH 02/10] target-s390x: fix MMU index computation X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The cpu_mmu_index function wrongly looks at PSW P bit to determine the MMU index, while this bit actually only control the use of priviledge instructions. The addressing mode is detected by looking at the PSW ASC bits instead. This used to work more or less correctly up to kernel 3.6 as the kernel was running in primary space and userland in secondary space. Since kernel 3.7 the default is to run the kernel in home space and userland in primary space. While the current QEMU code seems to work it open some security issues, like accessing the lowcore memory in R/W mode from a userspace process once it has been accessed by the kernel (it is then cached by the QEMU TLB). At the same time change the MMU_USER_IDX value so that it matches the value used in recent kernels. Cc: Alexander Graf Cc: Richard Henderson Signed-off-by: Aurelien Jarno --- target-s390x/cpu.h | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h index 71ef847..99773e0 100644 --- a/target-s390x/cpu.h +++ b/target-s390x/cpu.h @@ -48,7 +48,7 @@ #define MMU_MODE1_SUFFIX _secondary #define MMU_MODE2_SUFFIX _home -#define MMU_USER_IDX 1 +#define MMU_USER_IDX 0 #define MAX_EXT_QUEUE 16 #define MAX_IO_QUEUE 16 @@ -295,11 +295,18 @@ typedef struct CPUS390XState { static inline int cpu_mmu_index (CPUS390XState *env) { - if (env->psw.mask & PSW_MASK_PSTATE) { + switch (env->psw.mask & PSW_MASK_ASC) { + case PSW_ASC_PRIMARY: + return 0; + case PSW_ASC_SECONDARY: return 1; + case PSW_ASC_HOME: + return 2; + case PSW_ASC_ACCREG: + /* Fallthrough: access register mode is not yet supported */ + default: + abort(); } - - return 0; } static inline void cpu_get_tb_cpu_state(CPUS390XState* env, target_ulong *pc,