Unverified Commit 9667e535 authored by Dayeol Lee's avatar Dayeol Lee Committed by Palmer Dabbelt
Browse files

target/riscv: PMP violation due to wrong size parameter 



riscv_cpu_tlb_fill() uses the `size` parameter to check PMP violation
using pmp_hart_has_privs().
However, if the size is unknown (=0), the ending address will be
`addr - 1` as it is `addr + size - 1` in `pmp_hart_has_privs()`.
This always causes a false PMP violation on the starting address of the
range, as `addr - 1` is not in the range.

In order to fix, we just assume that all bytes from addr to the end of
the page will be accessed if the size is unknown.

Signed-off-by: default avatarDayeol Lee <dayeol@berkeley.edu>
Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: default avatarPalmer Dabbelt <palmer@sifive.com>
parent 3aa9004f

target/riscv/pmp.c

+12 −1
Original line number Diff line number Diff line
@@ -223,6 +223,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, 
{

    int i = 0;

    int ret = -1;

    int pmp_size = 0;

    target_ulong s = 0;

    target_ulong e = 0;

    pmp_priv_t allowed_privs = 0;
@@ -232,11 +233,21 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, 
        return true;

    }



    /*

     * if size is unknown (0), assume that all bytes

     * from addr to the end of the page will be accessed.

     */

    if (size == 0) {

        pmp_size = -(addr | TARGET_PAGE_MASK);

    } else {

        pmp_size = size;

    }



    /* 1.10 draft priv spec states there is an implicit order

         from low to high */

    for (i = 0; i < MAX_RISCV_PMPS; i++) {

        s = pmp_is_in_range(env, i, addr);

        e = pmp_is_in_range(env, i, addr + size - 1);

        e = pmp_is_in_range(env, i, addr + pmp_size - 1);



        /* partially inside */

        if ((s + e) == 1) {