Re: [PATCH v3 3/3] powerpc: Book3S 64-bit "heavyweight" KASAN support

From: Daniel Axtens
Date: Wed Dec 18 2019 - 02:01:52 EST



>> [For those not immersed in ppc64, in real mode, the top nibble or 2 bits
>> (depending on radix/hash mmu) of the address is ignored. The linear
>> mapping is placed at 0xc000000000000000. This means that a pointer to
>> part of the linear mapping will work both in real mode, where it will be
>> interpreted as a physical address of the form 0x000..., and out of real
>> mode, where it will go via the linear mapping.]
>>
>
> How does hash or radix mmu mode effect how many bits are ignored in real mode?

Bah, you're picking on details that I picked up from random
conversations in the office rather than from reading the spec! :P

The ISA suggests that real addresses space is limited to at most 64
bits. ISAv3, Book III s5.7:

| * Host real address space size is 2^m bytes, m <= 60;
| see Note 1.
| * Guest real address space size is 2 m bytes, m <= 60;
| see Notes 1 and 2.
...
| Notes:
| 1. The value of m is implementation-dependent (sub-
| ject to the maximum given above). When used to
| address storage or to represent a guest real
| address, the high-order 60-m bits of the â60-bitâ
| real address must be zeros.
| 2. The hypervisor may assign a guest real address
| space size for each partition that uses Radix Tree
| translation. Accesses to guest real storage out-
| side this range but still mappable by the second
| level Radix Tree will cause an HISI or HDSI.
| Accesses to storage outside the mappable range
| will have boundedly undefined results.

However, it doesn't follow from that passage that the top 4 bits are
always ignored when translations are off ('real mode'): see for example
the discussion of the HRMOR in s 5.7.3 and s 5.7.3.1.

I think I got the 'top 2 bits on radix' thing from the discussion of
'quadrants' in arch/powerpc/include/asm/book3s/64/radix.h, which in turn
is discussed in s 5.7.5.1. Table 20 in particular is really helpful for
understanding it. But it's not especially relevant to what I'm actually
doing here.

I think to fully understand all of what's going on I would need to spend
some serious time with the entirety of s5.7, because there a lot of
quirks about how storage works! But I think for our purposes it suffices
to say:

The kernel installs a linear mapping at effective address
c000... onward. This is a one-to-one mapping with physical memory from
0000... onward. Because of how memory accesses work on powerpc 64-bit
Book3S, a kernel pointer in the linear map accesses the same memory
both with translations on (accessing as an 'effective address'), and
with translations off (accessing as a 'real address'). This works in
both guests and the hypervisor. For more details, see s5.7 of Book III
of version 3 of the ISA, in particular the Storage Control Overview,
s5.7.3, and s5.7.5 - noting that this KASAN implementation currently
only supports Radix.

Thanks for your attention to detail!

Regards,
Daniel