From patchwork Sat Mar 15 06:17:07 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873847 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1063213wrq; Fri, 14 Mar 2025 23:31:14 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWpXny26AR0hS+EFNc8kvIqgy88eJSVdqzyiO8rVhkevPV7v6mKrz2Gv0oJV2m/1x+jA+K+fA==@linaro.org X-Google-Smtp-Source: AGHT+IFu5di2neBraeOKuLGMsOvQs1PRj7UfPx/IfIvy+fNZ8iL+Ts7BH3mQe6+NlGl+fWyQDDpy X-Received: by 2002:a05:620a:1d09:b0:7c5:3da4:5bcb with SMTP id af79cd13be357-7c57c570b35mr763272385a.10.1742020274602; Fri, 14 Mar 2025 23:31:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020274; cv=none; d=google.com; s=arc-20240605; b=Cu9rQYG7n2BLe1BJnCoWArCAWRASlt1+ztdgBKjexGP0JUdH4JS3+qrUdnYbl541u4 Zsc1tDRPP+YHs1GVL8lgemGQXKRCQSwaHuB0sfparFIwBTJK9BkZdlTnWMp2lkA3Dhkk DwR4FFxHckGvCWQ99vPAoEcLXeOgnnONOfW3mTiAtmj+Zys2aF2aB0fO2EHN8/rjpLB7 9VsVlLMFy1aqj0NuPLHULUdbn7fau04mH0NOoFIgr0y2C+Ya2QELKi/DX3dE2DSID0IB q9jxfQm7PLl027z2r/ZOJuROzOYvn2XX4ptodPqWGKF11odhsGdvnOgwlMbi+43cJVcY N00w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=H/SrwLlqUsOE7foSWGp7eYcpprvqsozcYXPISZ+DOyM=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=htbmIJGfpw7ShKwczsoe1VzyhEwJpGzhI5H7868bNV0bR08PBRXw//mUBqIC2HD+AJ uj/9P8PsTe0OTyuJ1clbl+o0nFpBV9LaSO2a2ImN0lJLc+AOhTElwxRz2IVM5Q6dEf3G EstsGTESrzq6rjyXoBlz1MNmca9xVZOzoE1cDBCZ0SH/yrL0wq+D+H+BSD9CrOW0B4GQ pG7enpAjEEIql8Rmp9wfoPMNC2JryyvcoktwtDquxMi91ed8ACpB3aoHxm/nQMk5JfTm D6xp4X6k9Oq+Gs0ZGHz24fqflkzQycifpPKnm4ZV2yV1JnMp3lmNhrMYHT972AZcSCgK YEAQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573d329dcsi521332685a.604.2025.03.14.23.31.14 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:31:14 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttL0S-0005r4-0s; Sat, 15 Mar 2025 02:28:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttL05-0005ZN-AI for qemu-devel@nongnu.org; Sat, 15 Mar 2025 02:28:06 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttL03-0004d4-KN for qemu-devel@nongnu.org; Sat, 15 Mar 2025 02:28:00 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6911FFF9CD; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 4066C1CAC36; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 2D30D558B1; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 01/51] target/arm: Report correct syndrome for UNDEFINED CNTPS_*_EL1 from EL2 and NS EL1 Date: Sat, 15 Mar 2025 09:17:07 +0300 Message-Id: <20250315061801.622606-1-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The access pseudocode for the CNTPS_TVAL_EL1, CNTPS_CTL_EL1 and CNTPS_CVAL_EL1 secure timer registers says that they are UNDEFINED from EL2 or NS EL1. We incorrectly return CP_ACCESS_TRAP from the access function in these cases, which means that we report the wrong syndrome value to the target EL. Use CP_ACCESS_TRAP_UNCATEGORIZED, which reports the correct syndrome value for an UNDEFINED instruction. Cc: qemu-stable@nongnu.org Fixes: b4d3978c2fd ("target-arm: Add the AArch64 view of the Secure physical timer") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-2-peter.maydell@linaro.org (cherry picked from commit b819fd6994243aee6f9613edbbacedce4f511c32) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index fcb13fe87e..8a0065ef60 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2652,7 +2652,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, switch (arm_current_el(env)) { case 1: if (!arm_is_secure(env)) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } if (!(env->cp15.scr_el3 & SCR_ST)) { return CP_ACCESS_TRAP_EL3; @@ -2660,7 +2660,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, return CP_ACCESS_OK; case 0: case 2: - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; case 3: return CP_ACCESS_OK; default: From patchwork Sat Mar 15 06:17:08 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873826 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1060797wrq; Fri, 14 Mar 2025 23:19:23 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW9C9qfd8eBJG1H5nGpSIi+0r0l807vF1E3QN3P0RFu3jyTFBheWz34cQcY/gpwdLonP2v+mw==@linaro.org X-Google-Smtp-Source: AGHT+IEdXF7TATeV105aRmgvaCaRMPgBv0mqv7iVSlM3Shmew/w82qlDPmwNXqUsj496jJuqkTYs X-Received: by 2002:a05:620a:600d:b0:7c5:5756:298b with SMTP id af79cd13be357-7c57c832030mr642713585a.29.1742019562915; Fri, 14 Mar 2025 23:19:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019562; cv=none; d=google.com; s=arc-20240605; b=WE9pvWQtECZfa9uflxaJm3JI8PaJMXk+EqBvcsIXARLzDIicXDzM1kEMRJ7+Z3hcP0 ZSxK87A7Scd/YfQq0fBe7NLMSH7Lu4yr2nYr74ETyDoUH5LHo1WanLHo0wqdTmhDUDb5 jzMHdzOl/02h/0mNvRLpmhURMqk2Qay6pKnAhcdip6R7m0A/R/JmAiK2f2ASyVsWDsH6 /jrRnuCDsmVWg+1YyWhVYizhN0XDPn8+Xz4kIpyszSH5KM4hAxLBycfXMiOY6aDPUMtg T2HLL6MU4V0dHZ7A+C5RYkldiD3nBvCtw+mMW1wXEVTOwv5kCXZtOZ7bszdZuvjov2Hp 6aWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=tUljbdrUoa6DVY3jQVF9kAUSE+VPiwmpPvX/64Bm/ic=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=R1InW+WRWiCOErxoLFpAFqgvoTm1syeP4UtjiZPoFhsBQl0ckjwMIyzGl6F4aiyiSs 5Bq+iJ/UqyuP80GDO6CuvKcNBcfzqq/ovfOZUraOCe32s7ZnCXWQiyrqxHKi1HOoBZZI caxKBrlp5nBB0TSVh4BYtTFRw/spsjLZlHXp7/BzhUEXDCIjvVsv6LL0+oe5OSJ5p2F/ NaAdjtzmCEctMAUjljPGrhCFyqYid1H/l2BNo6vqN8wbfEbn7fUv4+z0POAFLwpYVapm VgtaKly0skVMuxOqWkyX7umdOLxAup4vBQksORTGKkyny4TlgOMtdAkDT2pP1sLWP5jF CPXQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573cf003fsi521945985a.449.2025.03.14.23.19.22 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:19:22 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKr8-000330-3U; Sat, 15 Mar 2025 02:18:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKqu-0002va-Rn; Sat, 15 Mar 2025 02:18:39 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKqr-0003Bb-CQ; Sat, 15 Mar 2025 02:18:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6CCBBFF9CE; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 444B81CAC37; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 2FCF3558B3; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 02/51] target/arm: Report correct syndrome for UNDEFINED AT ops with wrong NSE, NS Date: Sat, 15 Mar 2025 09:17:08 +0300 Message-Id: <20250315061801.622606-2-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell R_NYXTL says that these AT insns should be UNDEFINED if they would operate on an EL lower than EL3 and SCR_EL3.{NSE,NS} is set to the Reserved {1, 0}. We were incorrectly reporting them with the wrong syndrome; use CP_ACCESS_TRAP_UNCATEGORIZED so they are reported as UNDEFINED. Cc: qemu-stable@nongnu.org Fixes: 1acd00ef1410 ("target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for AT instructions") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-3-peter.maydell@linaro.org (cherry picked from commit 1960d9701ef7ed8d24e98def767bbf05d63e6992) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 8a0065ef60..32cf6039e3 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -3868,7 +3868,7 @@ static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri, * scr_write() ensures that the NSE bit is not set otherwise. */ if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } return CP_ACCESS_OK; } From patchwork Sat Mar 15 06:17:09 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873828 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1060793wrq; Fri, 14 Mar 2025 23:19:23 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW2n3vNkgX64vJc8nS29pNv8XZIj4d0u7mwJI1vhtCnVhzX777h0TX/1ipM7peHuZ2jqkfTwQ==@linaro.org X-Google-Smtp-Source: AGHT+IHHFv1qDw7UrFIrYdnHIDL+6jIe/1r4E8TTthZRj/ysDBMfyJ7La3sWeUeEFqs29cKnbL/7 X-Received: by 2002:a05:6214:2426:b0:6e8:99bb:f061 with SMTP id 6a1803df08f44-6eaeaa081b8mr82332516d6.18.1742019562784; Fri, 14 Mar 2025 23:19:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019562; cv=none; d=google.com; s=arc-20240605; b=e1DHd+WrcnFPIj9vg1QyLUd1o5QRlTpiekbg3VMGhCSjeETOZkK8AmgkpRzG3ui8fX G/tJoMl4jyxaNa6R8yNRzF/tQsMghHqShKrrraAYOq53yRjz7OX7dbuluPbr4P7LUXVc QNdQZ6dHj5uiAiNVcwTFElUuSzquVSktyofAXa/qWU1aUBI13uPlgml6KSv3pdawrKJp mXBemmeUbSyzgASaDXXNkcRMoXM3mdGzBsTTTEe7M8OWhO8JhjOWXTGfzvsX0g8KPkJH d/mJfCOK/aZQbvBXSs2hrbsJcJBpBKam36G0hIhc9Pc/euOKqoRC1N1WHJUQLCNuFSV1 3/TA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=/0F7BKysQg+nVNyWIlwVhSrR8YE3fya29IUlHxWU8cM=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=C9AQFZ4+inVB3d7S9YNy6sej080EErS04ITs1eDlNWtVBjzmPH9B1vBomhPMaGleAM iJUHGwLGksPhhonHHqTXnsa+uaU+Q90VRs1Tws/XbVcT6IwLOCwLNCDxJ0sqFvqkxTZr cYi50ApeTce+jwHpbQvql7lj85QfulQO5oY5YYV72sVCP605/tEP7ZoHhpkETndA0L5k mQVkXUVWjKfwPOzgG+HQvEGTuT5pj9S8riku5XWmlqnnOP5YLiFzBWwpALDR9ZygiQv2 ZJmNrEIPJuRf/O3UyWzXyo/bOHfwzJ8T7AVXfDR8Vl856iDrruf0jJnaMlGKccWzuvR3 A7Jg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade35509fsi51726136d6.301.2025.03.14.23.19.22 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:19:22 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKr9-00033U-JJ; Sat, 15 Mar 2025 02:18:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKr1-0002ya-DT; Sat, 15 Mar 2025 02:18:41 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKqu-0003CE-F6; Sat, 15 Mar 2025 02:18:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 70805FF9CF; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 4806A1CAC38; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3219B558B5; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 03/51] target/arm: Report correct syndrome for UNDEFINED S1E2 AT ops at EL3 Date: Sat, 15 Mar 2025 09:17:09 +0300 Message-Id: <20250315061801.622606-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The pseudocode for AT S1E2R and AT S1E2W says that they should be UNDEFINED if executed at EL3 when EL2 is not enabled. We were incorrectly using CP_ACCESS_TRAP and reporting the wrong exception syndrome as a result. Use CP_ACCESS_TRAP_UNCATEGORIZED. Cc: qemu-stable@nongnu.org Fixes: 2a47df953202e1 ("target-arm: Wire up AArch64 EL2 and EL3 address translation ops") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-4-peter.maydell@linaro.org (cherry picked from commit ccda792945d650bce4609c8dbce8814a220df1bb) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 32cf6039e3..63cdb29510 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -3878,7 +3878,7 @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, { if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } return at_e012_access(env, ri, isread); } From patchwork Sat Mar 15 06:17:10 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873832 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1061198wrq; Fri, 14 Mar 2025 23:21:18 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUjtwzfIGVuLIjia8Pe/ONvee5yHfrF7b2ILjFWeY6lDQLkxkNIzadpbKHL7dQvouRSKfpGew==@linaro.org X-Google-Smtp-Source: AGHT+IHkJBfQB9p5E+ny3VXc/dGxVhtYAyWZ7VR5ltKvV8oZvjJqO9MFAZ1mOr9UU9gHaYYvtlKF X-Received: by 2002:a05:622a:6bca:b0:476:add4:d2cf with SMTP id d75a77b69052e-476c813ef05mr61514041cf.16.1742019678631; Fri, 14 Mar 2025 23:21:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019678; cv=none; d=google.com; s=arc-20240605; b=RO8gNh5mDQvrGoYalFzXJUXNaIrv4LP/SfIz/olNo1yyON3HOkLDrMxJz+jwYoxZyf DNoA/nBxo5f8pZCKHUIAhMsEQqGkpzM3Q0cKd6YWvtiqhKsE5gZi5JKWJNHC4JQZZW4w TczBYuLMFghLj2I3uVx27b3U1p7zLoc2h3LWY+5LPkAlgCIRwS33yBWrQo0bP2TAHAKQ e/h6cYPitHyzKYqh7fyiAuvOyAer3j8UYKw9kO5OkbmYY4HIvXIPtq3xtB6C28ZsqpGW pC7LSQKfnc52FJQvbQmD5WL9o7PGNDxQ2iaacaOixt1TJsDy6Ee8cdWYTjJQCKdd1ugD PnzQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=kBJYZ0wBHDOM55ndMIEUhAvQhVNFtBV6p3mmV+mUG7Y=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=FukMTAV+iPCGZw8MFBgOtfCR4WBRTUQaMqwWL641yXx9T3sJvVpkyQDhwqc/D1NAFz mn55wQH2UDxY/l30UhMRVBRZ+xiNeUm2lddZUu7yB2vGzXvIuDuZ9eiT57ZMx7p4YmvS htLYPIRdMipKc3riJsaxlPq6Q2Iv2aLqHT30QhWl4u9Amh2BkV07LgkY6mx2HO5apHs6 CEKD8rXvFRLU/grZAk+KngWzJ0OP9Q0IwvP9H/q0eSz0KPwku6w0COPoxm1ZG0ROmJj0 CmZ5ArYYsIgju3XZuMgqc+0vw8V2l/9pGmmQHqUTXWnIlryBfUGwuL+0wGtrEanNvTUU qsHQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb856c5csi50499271cf.495.2025.03.14.23.21.18 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:21:18 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKrC-00038B-8A; Sat, 15 Mar 2025 02:18:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKr0-0002xu-4Q; Sat, 15 Mar 2025 02:18:41 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKqw-0003Cr-AY; Sat, 15 Mar 2025 02:18:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 743CEFF9D0; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 4BC0A1CAC39; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 346EB558B7; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 04/51] target/arm: Report correct syndrome for UNDEFINED LOR sysregs when NS=0 Date: Sat, 15 Mar 2025 09:17:10 +0300 Message-Id: <20250315061801.622606-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The pseudocode for the accessors for the LOR sysregs says they are UNDEFINED if SCR_EL3.NS is 0. We were reporting the wrong syndrome value here; use CP_ACCESS_TRAP_UNCATEGORIZED. Cc: qemu-stable@nongnu.org Fixes: 2d7137c10faf ("target/arm: Implement the ARMv8.1-LOR extension") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-5-peter.maydell@linaro.org (cherry picked from commit 707d478ed8f2da6f2327e5af780890c1fd9c371a) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 63cdb29510..0e386c9ae5 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -7737,8 +7737,8 @@ static CPAccessResult access_lor_other(CPUARMState *env, const ARMCPRegInfo *ri, bool isread) { if (arm_is_secure_below_el3(env)) { - /* Access denied in secure mode. */ - return CP_ACCESS_TRAP; + /* UNDEF if SCR_EL3.NS == 0 */ + return CP_ACCESS_TRAP_UNCATEGORIZED; } return access_lor_ns(env, ri, isread); } From patchwork Sat Mar 15 06:17:11 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873827 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1060791wrq; Fri, 14 Mar 2025 23:19:22 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUYM1bGoI/tTyc1OyvIXK+++1HPQLIO69cLcOn1/9rBcr0OO0sHdqyYbyeo/K5n4P/8dZuuZg==@linaro.org X-Google-Smtp-Source: AGHT+IGXuPng0FB/9NmDxdi2GdJ3ewXwxrogMLm1w3N0TR8nxTg+GKlQwnG+445pUdD2ZYkndjBu X-Received: by 2002:a05:622a:5d0a:b0:467:6563:8b1d with SMTP id d75a77b69052e-476ba8c45f5mr86512161cf.6.1742019562636; Fri, 14 Mar 2025 23:19:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019562; cv=none; d=google.com; s=arc-20240605; b=i3WIE9tjEVMJ7sRgOpj9JOoLWxY+ri7kRxSHhOoMQhPXxrD2wlof5rikpvwr6fhZqs dR8H53dBKVj+oNTRkshEpKgg/RGVwA90nMNzQ3gkvGcUFZ+l62SPOoBJUAbno4o68/Di iHamaJ6vWmBfE2+KfksHeBpYIBr4bWAYuFKpMUYUyizR5vQSZkdqPQ2ADJ/NFUA8nXrK C8fCisPd0Cz39mCJgvYPmFMGPNs6VvnXxqpzjPHeVNmwCsvd3Eeu6GAIcgGZixaJUdjk TLrzo1vngCxxEU7O3ubFSIFH8v1OPF8vOfto1t436G1uIS5d3CTfwA6Xp11fyt7Q9HSQ GX0Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=cN9kdLVVlyHiwgzMOGPq78tHrHRJIOK150FIck1wGxY=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=IwGw4M8DRR/vITptKmgWE1kwxf+xrJljMAeuwD89fq5XY8m/xc6PnqglOy7C46a0w0 klfb5dtLmfBPaMwLVhGCsvpSSTde9t1LnSF3YRtMk9Rc+mmNFieKCNH8oIdkGLUR2i5Q YqDNeN93bksNlHeyiTdLZTfFDw3gzRBPbuqguQlipKDSSVHUh+o2lJXVpmK+GfrE+T69 xWLNC567LHwkGZ55sqw3o1vEXkkFE6kmXnzumhOvxn0hwuBvR5X+RZ+NcTEKT8TzxdpP OzNcBoM/1RkLiu73jSY352kTvaBdSVZ8RLUS4r8ob3o32/AJVuagDAxVASxkBo5rLvpe ea4A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb61b448si52360151cf.73.2025.03.14.23.19.22 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:19:22 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKrJ-0003Bs-T9; Sat, 15 Mar 2025 02:18:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKr9-000340-Kd; Sat, 15 Mar 2025 02:18:47 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKr3-0003Di-Se; Sat, 15 Mar 2025 02:18:47 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 78CC7FF9D1; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 502FA1CAC3A; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 36E91558B9; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 05/51] target/arm: Make CP_ACCESS_TRAPs to AArch32 EL3 be Monitor traps Date: Sat, 15 Mar 2025 09:17:11 +0300 Message-Id: <20250315061801.622606-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In system register access pseudocode the common pattern for AArch32 registers with access traps to EL3 is: at EL1 and EL2: if HaveEL(EL3) && !ELUsingAArch32(EL3) && (SCR_EL3.TERR == 1) then AArch64.AArch32SystemAccessTrap(EL3, 0x03); elsif HaveEL(EL3) && ELUsingAArch32(EL3) && (SCR.TERR == 1) then AArch32.TakeMonitorTrapException(); at EL3: if (PSTATE.M != M32_Monitor) && (SCR.TERR == 1) then AArch32.TakeMonitorTrapException(); (taking as an example the ERRIDR access pseudocode). This implements the behaviour of (in this case) SCR.TERR that "Accesses to the specified registers from modes other than Monitor mode generate a Monitor Trap exception" and of SCR_EL3.TERR that "Accesses of the specified Error Record registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception". In QEMU we don't implement this pattern correctly in two ways: * in access_check_cp_reg() we turn the CP_ACCESS_TRAP_EL3 into an UNDEF, not a trap to Monitor mode * in the access functions, we check trap bits like SCR.TERR only when arm_current_el(env) < 3 -- this is correct for AArch64 EL3, but misses the "trap non-Monitor-mode execution at EL3 into Monitor mode" case for AArch32 EL3 In this commit we fix the first of these two issues, by making access_check_cp_reg() handle CP_ACCESS_TRAP_EL3 as a Monitor trap. This is a kind of exception that we haven't yet implemented(!), so we need a new EXCP_MON_TRAP for it. This diverges from the pseudocode approach, where every access check function explicitly checks for "if EL3 is AArch32" and takes a monitor trap; if we wanted to be closer to the pseudocode we could add a new CP_ACCESS_TRAP_MONITOR and make all the accessfns use it when appropriate. But because there are no non-standard cases in the pseudocode (i.e. where either it raises a Monitor trap that doesn't correspond to an AArch64 SystemAccessTrap or where it raises a SystemAccessTrap that doesn't correspond to a Monitor trap), handling this all in one place seems less likely to result in future bugs where we forgot again about this special case when writing an accessor. (The cc of stable here is because "hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3" which is also cc:stable will implicitly use the new EXCP_MON_TRAP code path.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-6-peter.maydell@linaro.org (cherry picked from commit 4cf4948651615181c5bc3d0e4a9f5c46be576bb2) Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index d86e641280..e3416cd435 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -62,6 +62,7 @@ #define EXCP_NMI 26 #define EXCP_VINMI 27 #define EXCP_VFNMI 28 +#define EXCP_MON_TRAP 29 /* AArch32 trap to Monitor mode */ /* NB: add new EXCP_ defines to the array in arm_log_exception() too */ #define ARMV7M_EXCP_RESET 1 diff --git a/target/arm/helper.c b/target/arm/helper.c index 0e386c9ae5..fe255ccb43 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -10858,6 +10858,7 @@ void arm_log_exception(CPUState *cs) [EXCP_NMI] = "NMI", [EXCP_VINMI] = "Virtual IRQ NMI", [EXCP_VFNMI] = "Virtual FIQ NMI", + [EXCP_MON_TRAP] = "Monitor Trap", }; if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { @@ -11424,6 +11425,16 @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs) mask = CPSR_A | CPSR_I | CPSR_F; offset = 0; break; + case EXCP_MON_TRAP: + new_mode = ARM_CPU_MODE_MON; + addr = 0x04; + mask = CPSR_A | CPSR_I | CPSR_F; + if (env->thumb) { + offset = 2; + } else { + offset = 4; + } + break; default: cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); return; /* Never happens. Keep compiler happy. */ diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index 1ecb465988..7cde2337ac 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -758,6 +758,7 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, key); CPAccessResult res = CP_ACCESS_OK; int target_el; + uint32_t excp; assert(ri != NULL); @@ -842,8 +843,18 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, } fail: + excp = EXCP_UDEF; switch (res & ~CP_ACCESS_EL_MASK) { case CP_ACCESS_TRAP: + /* + * If EL3 is AArch32 then there's no syndrome register; the cases + * where we would raise a SystemAccessTrap to AArch64 EL3 all become + * raising a Monitor trap exception. (Because there's no visible + * syndrome it doesn't matter what we pass to raise_exception().) + */ + if ((res & CP_ACCESS_EL_MASK) == 3 && !arm_el_is_aa64(env, 3)) { + excp = EXCP_MON_TRAP; + } break; case CP_ACCESS_TRAP_UNCATEGORIZED: /* Only CP_ACCESS_TRAP traps are direct to a specified EL */ @@ -879,7 +890,7 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, g_assert_not_reached(); } - raise_exception(env, EXCP_UDEF, syndrome, target_el); + raise_exception(env, excp, syndrome, target_el); } const void *HELPER(lookup_cp_reg)(CPUARMState *env, uint32_t key) From patchwork Sat Mar 15 06:17:12 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873831 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1061145wrq; Fri, 14 Mar 2025 23:20:58 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUiXHBOYTO6FfK1PmHceZDpcjk05gnBZf3a2q2IB0FUkCGapONucbxoKdYw8W+mcmL3u4gLnA==@linaro.org X-Google-Smtp-Source: AGHT+IH8XSi7QhXStQpG8wM/zu4pRQdo7538wTpVVIlFvsm5/L7vVFof3o3Wo5YorJE64zNY59Di X-Received: by 2002:a05:622a:205:b0:476:6db0:338a with SMTP id d75a77b69052e-476c813bc78mr83144911cf.13.1742019658490; Fri, 14 Mar 2025 23:20:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019658; cv=none; d=google.com; s=arc-20240605; b=RqCXdTtRgCEGDrSV9mxFUX3iJwORn859ATZx2RO+o+pKbe7mw95tys4nbWvOiB5BDq abUKaMUhTe7Tsl/5kwZDAhZynpzgRapEPuu8x8dTJr0tDs9o6rf7zAq57z6ZaLkhPiui 7oIfwsvHBmyIxBd2R8ErlxUIVdrHzL47NKpVyp/zyil5RE/UIK3Hg7wxdN0zs8Gq/wZ6 CNdKH45sO+jFBbMVI3HVnpdszxX03Cq2m2zkE6IuRKFHWJxd5syA9ICPf3kp1DvGMFwS 3/fycnpa6Li8s76l5NnP87yUnEjCIjov85FfXh2dqACnRFOnAhWcs78tj07uV4zAe1uY 3R5w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=qvxCxF1on+6xdJxI8cBVRfua/JxHtft7EM0ZW8Juj0c=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=OosqU3i6Qr+1jpPtvHrdEovsbiT3e9V3gm7cV8YdVGBvuOJGp9Vcdj/8ZJtumiwcX6 d4HVd2khMbgsRfcq8Td52yAxKjkzKl/2OJVFpKN1Wz9dlfY0ulk/LeUCO53EgXI+swMX GVLFQ2qiW4cLRuYpq36HDW5p94XcFAE8ubaEgAYDETAeDCm60XM58RLZXhKqNaE1GF2P 8VYgivTCSLb3Euvg+pdv6IoyXYiiGlFSQR9Izh9TZbq1yZJo0aP5ujNzbQ6YDI3kKnwH 74ZWi7RgyIX71X12NaECs+uDFJdgbwTNISnXf7537D0JZxdR8TGgFRNFMYx1AyKuj9BM 3Hmg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb7e18fdsi56217941cf.261.2025.03.14.23.20.58 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:20:58 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKrH-0003B6-S3; Sat, 15 Mar 2025 02:18:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKr9-00033s-DE; Sat, 15 Mar 2025 02:18:47 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKr3-0003Dw-UH; Sat, 15 Mar 2025 02:18:47 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7C975FF9D2; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 5406A1CAC3B; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3951B558BB; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 06/51] hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3 Date: Sat, 15 Mar 2025 09:17:12 +0300 Message-Id: <20250315061801.622606-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In the gicv3_{irq,fiq,irqfiq}_access() functions, there is a check which downgrades a CP_ACCESS_TRAP_EL3 to CP_ACCESS_TRAP if EL3 is not AArch64. This has been there since the GIC was first implemented, but it isn't right: if we are trapping because of SCR.IRQ or SCR.FIQ then we definitely want to be going to EL3 (doing AArch32.TakeMonitorTrapException() in pseudocode terms). We might want to not take a trap at all, but we don't ever want to go to the default target EL, because that would mean, for instance, taking a trap to Hyp mode if the trapped access was made from Hyp mode. (This might have been an attempt to work around our failure to properly implement Monitor Traps.) Remove the bogus check. Cc: qemu-stable@nongnu.org Fixes: 359fbe65e01e ("hw/intc/arm_gicv3: Implement GICv3 CPU interface registers") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-7-peter.maydell@linaro.org (cherry picked from commit d04c6c3c000ab3e588a2b91641310aeea89408f7) Signed-off-by: Michael Tokarev diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c index ea1d1b3455..886a1dd6a0 100644 --- a/hw/intc/arm_gicv3_cpuif.c +++ b/hw/intc/arm_gicv3_cpuif.c @@ -2300,9 +2300,6 @@ static CPAccessResult gicv3_irqfiq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } @@ -2365,9 +2362,6 @@ static CPAccessResult gicv3_fiq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } @@ -2404,9 +2398,6 @@ static CPAccessResult gicv3_irq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } From patchwork Sat Mar 15 06:17:13 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873830 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1061134wrq; Fri, 14 Mar 2025 23:20:55 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW+FtiMWokWWOFgk990EIJvp3D7zB6UwdPtkW/YrY0T9IeJei535hsJOxWC0cVT8TPysEq1Xw==@linaro.org X-Google-Smtp-Source: AGHT+IFS/Onv7iLOzIYBQGReytODeAx9MCSm7Gc2eAiyTTDLoBXYM3Vcjf0jn4ojzJe/3P5077ES X-Received: by 2002:a05:620a:469e:b0:7c5:4b91:6a42 with SMTP id af79cd13be357-7c57c79be62mr717308185a.17.1742019654910; Fri, 14 Mar 2025 23:20:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019654; cv=none; d=google.com; s=arc-20240605; b=DFf7YAwbWsPytNr1q1G/Y+Eh5VnX+sazg0Hofhc/MkiOynj5GPZC+5/sn8ln/ounEv FdEVdJRRl1+akKP3H9VaOP5QSSMv46b6IH+vF9lo/W0yvxONJm85Xrqov62Ad7o+uzsn 0sCHmnZ/AZOgNtYJ85h4Aq+5kFIsOC1R0/BOFOV/FWtndX4cp1hHVYvQdE+qHBVbiIXB qFQ0M3gShmXooD4He+EGDQCD92YIKTo3f64T8iLobQYhRalgSOwADwmlN8dOdOyP63Pm 1sRVvDWMnaAFPuC+Q152ycXs+WLn8wf+YIuKAKgw9TQwMslbV1L6mljKSvEa4b1XUWO6 +PJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=lpifW4uvNvL3En5A6Bf0udLz8wolh2sBBWjJpc2oJSs=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=fi8qyqLYG4kj6RHd/IN63RyekKXxO3VZp2qZfph1kBSFTEzhHcfEzH3W/wvXZ4lnPI wQwNVUOngxgxP4aFQRq7Rg0TM6uANfAM090BdtUY1d+2zr4jBTdQPDoVKSFB3ugUhLb5 QhsKQYxpj4iZ3CakiEMuw7DceIMOqEQDhtqTGyqStm9iyYrUkrT9qXc712B3eYITpI4L iYoUOGWnIij2r4AQ1xTvZoRFyAEMhoo2zRlPCiOr8J3D8dzu7GR+MgTE5q01VSDr9lBZ Cy3t5eLul2utjjr+DitqDV6OaKkr4sJH8evdpcjy/D5khPkHB2juUTnii+fV8XMZVCP6 fwFw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b7638fsi536081885a.74.2025.03.14.23.20.54 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:20:54 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKs0-0003oE-9F; Sat, 15 Mar 2025 02:19:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKrF-00039q-3m; Sat, 15 Mar 2025 02:18:53 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKrC-0003FG-QE; Sat, 15 Mar 2025 02:18:52 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 80712FF9D3; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 57DFB1CAC3C; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3BBE4558BD; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 07/51] target/arm: Honour SDCR.TDCC and SCR.TERR in AArch32 EL3 non-Monitor modes Date: Sat, 15 Mar 2025 09:17:13 +0300 Message-Id: <20250315061801.622606-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell There are not many traps in AArch32 which should trap to Monitor mode, but these trap bits should trap not just lower ELs to Monitor mode but also the non-Monitor modes running at EL3 (i.e. Secure System, Secure Undef, etc). We get this wrong because the relevant access functions implement the AArch64-style logic of if (el < 3 && trap_bit_set) { return CP_ACCESS_TRAP_EL3; } which won't trap the non-Monitor modes at EL3. Correct this error by using arm_is_el3_or_mon() instead, which returns true when the CPU is at AArch64 EL3 or AArch32 Monitor mode. (Since the new callsites are compiled also for the linux-user mode, we need to provide a dummy implementation for CONFIG_USER_ONLY.) This affects only: * trapping of ERRIDR via SCR.TERR * trapping of the debug channel registers via SDCR.TDCC * trapping of GICv3 registers via SCR.IRQ and SCR.FIQ (which we already used arm_is_el3_or_mon() for) This patch changes the handling of SCR.TERR and SDCR.TDCC. This patch only changes guest-visible behaviour for "-cpu max" on the qemu-system-arm binary, because SCR.TERR and SDCR.TDCC (and indeed the entire SDCR register) only arrived in Armv8, and the only guest CPU we support which has any v8 features and also starts in AArch32 EL3 is the 32-bit 'max'. Other uses of CP_ACCESS_TRAP_EL3 don't need changing: * uses in code paths that can't happen when EL3 is AArch32: access_trap_aa32s_el1, cpacr_access, cptr_access, nsacr_access * uses which are in accessfns for AArch64-only registers: gt_stimer_access, gt_cntpoff_access, access_hxen, access_tpidr2, access_smpri, access_smprimap, access_lor_ns, access_pauth, access_mte, access_tfsr_el2, access_scxtnum, access_fgt * trap bits which exist only in the AArch64 version of the trap register, not the AArch32 one: access_tpm, pmreg_access, access_dbgvcr32, access_tdra, access_tda, access_tdosa (TPM, TDA and TDOSA exist only in MDCR_EL3, not in SDCR, and we enforce this in sdcr_write()) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-8-peter.maydell@linaro.org (cherry picked from commit 4d436fb05c2a1fff7befc815ebcbb04a14977448) Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index e3416cd435..b005f93735 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -2562,6 +2562,11 @@ static inline bool arm_is_secure_below_el3(CPUARMState *env) return false; } +static inline bool arm_is_el3_or_mon(CPUARMState *env) +{ + return false; +} + static inline ARMSecuritySpace arm_security_space(CPUARMState *env) { return ARMSS_NonSecure; diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c index 7d856acddf..019b2b6f97 100644 --- a/target/arm/debug_helper.c +++ b/target/arm/debug_helper.c @@ -880,7 +880,8 @@ static CPAccessResult access_tdcc(CPUARMState *env, const ARMCPRegInfo *ri, if (el < 2 && (mdcr_el2_tda || mdcr_el2_tdcc)) { return CP_ACCESS_TRAP_EL2; } - if (el < 3 && ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { + if (!arm_is_el3_or_mon(env) && + ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { return CP_ACCESS_TRAP_EL3; } return CP_ACCESS_OK; diff --git a/target/arm/helper.c b/target/arm/helper.c index fe255ccb43..8df38a30a1 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -7052,7 +7052,7 @@ static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri, if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) { return CP_ACCESS_TRAP_EL2; } - if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) { + if (!arm_is_el3_or_mon(env) && (env->cp15.scr_el3 & SCR_TERR)) { return CP_ACCESS_TRAP_EL3; } return CP_ACCESS_OK; From patchwork Sat Mar 15 06:17:14 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873829 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1060953wrq; Fri, 14 Mar 2025 23:20:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUR+4gPvfIlopGbbgnZW8v0HC4DxNy+u87B33m7PbTh2gDho0Ftz3eQBk0GYMCAPma8PFOJXQ==@linaro.org X-Google-Smtp-Source: AGHT+IE5/g7MRZ4DOZA/bTslgihRRPN3w3yYg0w+8i9S15E3GRSAIAIYgNpvTUtKBOzODkB8+pJy X-Received: by 2002:a05:622a:7ace:b0:476:8825:99bd with SMTP id d75a77b69052e-476c811d298mr74627501cf.5.1742019606744; Fri, 14 Mar 2025 23:20:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019606; cv=none; d=google.com; s=arc-20240605; b=Fr6yBVd3Yq+Xr/Ric/8TQtJYRF3P8x2nt9X+LGqhdXuSkZQxyRLzU++8IUsvHIjzS1 cHHFyMzDfDqF5Az3xewQW/Xhd9n5DYTb5PS//Bi90S4Ua9FOjcnb0vMMCNIWmrF+zthA 32IzU/UGtBvkmjuH+VY2wWLgt25NQ0bOX07rM0ZhWCDyBMPEvwWAqobQzw71XmGboE6q iThAxjiVMMJdW5qWnGMz4YEgYjPLMQzLGp2yluPQt0JMewFFauSNstTISJe0VcQMQDIh jNBvgccUq3vVJXOeH2dzx4TIA4YGFbueZ2NHn4vIGb+vG7RJfuWcXhWysTtR3+Kmh5ei 8FIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=hDB1NU52fuMJ4oO0jRdRVzAVyuZ3q0Zqp0rEnfuF20Y=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=evHJcXOh5CC9aMSapdHGYBnw8hGBsefPEQXlNktvji+gvL32LPOdQk2u0hFgwMyRe/ OTAzuWCh8KS8acLEUAJBP5UBbUhterwhwHITFbkwndhJxJUGxIThfzEPfjsDV0RM+Qm4 tzezjySwKo7hklrSaDRjWo/LIdZZNEzjf8/oYC7PxHIWOMFKw1DOgo0TOCPe8NT3qOTt pW1bni2dHwEOEbq4w6fYj2nl4JQioQTj8PsHEMeAM0ObYyDKzD6EK+JI7Ce1S/sDmdd9 oBUw4ofIHvTXyykLmjyMAHN2dm7izPlTTf4lkYksQf7riM4tnbj4IbhKBjpUsRuogsHx BWhQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb8153c9si54364521cf.372.2025.03.14.23.20.06 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:20:06 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKrj-0003TY-Ut; Sat, 15 Mar 2025 02:19:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKrF-00039p-3Q; Sat, 15 Mar 2025 02:18:53 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKrC-0003FO-4K; Sat, 15 Mar 2025 02:18:52 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 844F8FF9D4; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 5BBC81CAC3D; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3E38F558BF; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 08/51] target/arm: Correct errors in WFI/WFE trapping Date: Sat, 15 Mar 2025 09:17:14 +0300 Message-Id: <20250315061801.622606-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The code for WFI/WFE trapping has several errors: * it wasn't using arm_sctlr(), so it would look at SCTLR_EL1 even if the CPU was in the EL2&0 translation regime * it was raising UNDEF, not Monitor Trap, for traps to AArch32 EL3 because of SCR.{TWE,TWI} * it was not honouring SCR.{TWE,TWI} when running in AArch32 at EL3 not in Monitor mode * it checked SCR.{TWE,TWI} even on v7 CPUs which don't have those bits Fix these bugs. Cc: qemu-stable@nongnu.org Fixes: b1eced713d99 ("target-arm: Add WFx instruction trap support") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-15-peter.maydell@linaro.org (cherry picked from commit 2b95a2d01b04afadf510a49ac14b38a59be8c5f5) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index 7cde2337ac..5aef45d9c4 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -313,15 +313,19 @@ void HELPER(check_bxj_trap)(CPUARMState *env, uint32_t rm) } #ifndef CONFIG_USER_ONLY -/* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped. +/* + * Function checks whether WFx (WFI/WFE) instructions are set up to be trapped. * The function returns the target EL (1-3) if the instruction is to be trapped; * otherwise it returns 0 indicating it is not trapped. + * For a trap, *excp is updated with the EXCP_* trap type to use. */ -static inline int check_wfx_trap(CPUARMState *env, bool is_wfe) +static inline int check_wfx_trap(CPUARMState *env, bool is_wfe, uint32_t *excp) { int cur_el = arm_current_el(env); uint64_t mask; + *excp = EXCP_UDEF; + if (arm_feature(env, ARM_FEATURE_M)) { /* M profile cores can never trap WFI/WFE. */ return 0; @@ -331,18 +335,9 @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe) * WFx instructions being trapped to EL1. These trap bits don't exist in v7. */ if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) { - int target_el; - mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI; - if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) { - /* Secure EL0 and Secure PL1 is at EL3 */ - target_el = 3; - } else { - target_el = 1; - } - - if (!(env->cp15.sctlr_el[target_el] & mask)) { - return target_el; + if (!(arm_sctlr(env, cur_el) & mask)) { + return exception_target_el(env); } } @@ -358,9 +353,12 @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe) } /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */ - if (cur_el < 3) { + if (arm_feature(env, ARM_FEATURE_V8) && !arm_is_el3_or_mon(env)) { mask = (is_wfe) ? SCR_TWE : SCR_TWI; if (env->cp15.scr_el3 & mask) { + if (!arm_el_is_aa64(env, 3)) { + *excp = EXCP_MON_TRAP; + } return 3; } } @@ -383,7 +381,8 @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len) return; #else CPUState *cs = env_cpu(env); - int target_el = check_wfx_trap(env, false); + uint32_t excp; + int target_el = check_wfx_trap(env, false, &excp); if (cpu_has_work(cs)) { /* Don't bother to go into our "low power state" if @@ -399,7 +398,7 @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len) env->regs[15] -= insn_len; } - raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2), + raise_exception(env, excp, syn_wfx(1, 0xe, 0, insn_len == 2), target_el); } @@ -424,7 +423,8 @@ void HELPER(wfit)(CPUARMState *env, uint64_t timeout) #else ARMCPU *cpu = env_archcpu(env); CPUState *cs = env_cpu(env); - int target_el = check_wfx_trap(env, false); + uint32_t excp; + int target_el = check_wfx_trap(env, false, &excp); /* The WFIT should time out when CNTVCT_EL0 >= the specified value. */ uint64_t cntval = gt_get_countervalue(env); uint64_t offset = gt_virt_cnt_offset(env); @@ -441,8 +441,7 @@ void HELPER(wfit)(CPUARMState *env, uint64_t timeout) if (target_el) { env->pc -= 4; - raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, false), - target_el); + raise_exception(env, excp, syn_wfx(1, 0xe, 0, false), target_el); } if (uadd64_overflow(timeout, offset, &nexttick)) { From patchwork Sat Mar 15 06:17:37 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873834 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062017wrq; Fri, 14 Mar 2025 23:25:14 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUqwahtzy5NS0jGUzTXQFffmpJGFIyKv1aBsx/j9iVG1oD/WOhXSfpZriMNcl375/6yX1OXAw==@linaro.org X-Google-Smtp-Source: AGHT+IE8jgxmOIUpzv93ZHcKMVTLevgJzDycXlJJZcUmKd80sX8YlDpXSbCtFPUShWEbeLzndoVt X-Received: by 2002:a05:622a:47ca:b0:476:af54:5038 with SMTP id d75a77b69052e-476c8151059mr60007781cf.22.1742019914078; Fri, 14 Mar 2025 23:25:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019914; cv=none; d=google.com; s=arc-20240605; b=iY+x6jVjIdvMz4uBdvEkzwOVco+v/FArn7rUkqCmy0+d26twb7AqttbXORRCxAas3x 1o8q1DSZDKEPhQpY0WoTEa5nIjGEQy4Xhc5wbrlitCEg/y822+z43kCcdCBqgz7xJSDr yWFfDulkwNT61mrqutlkzB8GupVz3LMIlYS4WqIiS94HEf7DNpjSzmvzZg/OGueV96KM wRhqbA1nulI7+3U2zkVKLAsYXMFIlWuTUcxklLc4HqW6pUgZSbQn7SzDqbbTTG0djv/d uOJHecAuWa0EN2BWERUo0k2EDFkpUe0KlGzms1AJxASThwKti0zTJOWXXxSx3cEVI0e7 Rwyg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=QjoEBZlu07MD3YBKJz0Lrwya5FoRF4zhqTFnuAOsXjo=; fh=AguBzhNxG2iiwyQKHwF5YtCZ+FV/izMb9THQLjUeXjw=; b=I6GENltTRrmk6SrT2fpNqFsEiISK9xgq+93mmQm0I8Q96FSkpM562wkn2QI+G+V8X4 TYRZF6zbx1gYhYQjeoN8qhz7pGMdFuW4MzF+oavTr6g1YRfkQjKYu1a9GmFW2wWms/1T b6D3R8gHKDrdReokkMPXR1t6qCvs9Mzk9ebJljJY7rcPGkEKLY9MYebDqVxkaFZYhFWe 8qCcmBQM7hOYv7+O2TVpbDB82ZJci7cx7I2aIGO/QyM0pajj2f99oofYIrmNMPesyf4i /i6YabHb8MaszgQ0qU4jNfn13J52AamDPbJqmLUzpbHAKxtyqSi35Hflxbg6fQV3yaeC Ax/A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb856bffsi54946491cf.521.2025.03.14.23.25.13 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:25:14 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKu3-0000dM-11; Sat, 15 Mar 2025 02:21:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtS-0007I3-Sn; Sat, 15 Mar 2025 02:21:11 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtQ-0003hE-GK; Sat, 15 Mar 2025 02:21:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id DFC29FF9EB; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id B73811CAC54; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 75523558ED; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Michael Tokarev Subject: [Stable-9.2.3 31/51] target/arm: Apply correct timer offset when calculating deadlines Date: Sat, 15 Mar 2025 09:17:37 +0300 Message-Id: <20250315061801.622606-31-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When we are calculating timer deadlines, the correct definition of whether or not to apply an offset to the physical count is described in the Arm ARM DDI4087 rev L.a section D12.2.4.1. This is different from when the offset should be applied for a direct read of the counter sysreg. We got this right for the EL1 physical timer and for the EL1 virtual timer, but got all the rest wrong: they should be using a zero offset always. Factor the offset calculation out into a function that has a comment documenting exactly which offset it is calculating and which gets the HYP, SEC, and HYPVIRT cases right. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Message-id: 20250204125009.2281315-2-peter.maydell@linaro.org (cherry picked from commit db6c2192839ee0282d38f6f6666a87e0629fcd13) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 8df38a30a1..417801d9c3 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2727,6 +2727,32 @@ static uint64_t gt_phys_cnt_offset(CPUARMState *env) return gt_phys_raw_cnt_offset(env); } +static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx) +{ + /* + * Return the timer offset to use for indirect accesses to the timer. + * This is the Offset value as defined in D12.2.4.1 "Operation of the + * CompareValue views of the timers". + * + * The condition here is not always the same as the condition for + * whether to apply an offset register when doing a direct read of + * the counter sysreg; those conditions are described in the + * access pseudocode for each counter register. + */ + switch (timeridx) { + case GTIMER_PHYS: + return gt_phys_raw_cnt_offset(env); + case GTIMER_VIRT: + return env->cp15.cntvoff_el2; + case GTIMER_HYP: + case GTIMER_SEC: + case GTIMER_HYPVIRT: + return 0; + default: + g_assert_not_reached(); + } +} + static void gt_recalc_timer(ARMCPU *cpu, int timeridx) { ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; @@ -2736,8 +2762,7 @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx) * Timer enabled: calculate and set current ISTATUS, irq, and * reset timer to when ISTATUS next has to change */ - uint64_t offset = timeridx == GTIMER_VIRT ? - cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env); + uint64_t offset = gt_indirect_access_timer_offset(&cpu->env, timeridx); uint64_t count = gt_get_countervalue(&cpu->env); /* Note that this must be unsigned 64 bit arithmetic: */ int istatus = count - offset >= gt->cval; From patchwork Sat Mar 15 06:17:38 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873836 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062216wrq; Fri, 14 Mar 2025 23:26:14 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUDQDU1vUve/hSf5JFIQBWp3miNlCgPmsIC41nBLLlEpgEMSEjZmKPhcCQkxmHtfLPMFcsxTQ==@linaro.org X-Google-Smtp-Source: AGHT+IH2nindLgjIB+9Zqp+w+iNfQouPvDBfroNNpOindwZefXoUIK6fZO9fAO3OUBhtYLOVYWBi X-Received: by 2002:a05:620a:2a12:b0:7c5:43c2:a8fd with SMTP id af79cd13be357-7c57c73e605mr666033885a.9.1742019974312; Fri, 14 Mar 2025 23:26:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019974; cv=none; d=google.com; s=arc-20240605; b=XURyVwAjBiMMeIezmfV5iDlbZ7DksWJ0K+VtuDhwYohFMu3uyBE0qXfvxJjnKofJF2 QdhngIVxO4YykS6X93FgvnPnkbun5LJt3MiHhtJxL+f7/1J6995A4NCXKSvs8iGHaXIz suD+VNiwhVEmXKBotMsCibqZguFMqnp7JJxdhHQRfidBVFKotIiE7KlVJYi3hiVBwMiW c0qGdIPMDG2nDP0jZjY0QvdQCcWmfwJFrjTh3NSCqn1tlfBT2+Ah5cOQWsLPVglickpJ +egIg5TJC3VChvImGDPy4uzMIQXbOgZD94rqsKK4iy6TgLhMW7//k+qhgRhJ+oTMgRS7 y+sA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=CTOq0g2ez89omu1dZUX3y7WhKzJIewBYrnlLWodS2KQ=; fh=AguBzhNxG2iiwyQKHwF5YtCZ+FV/izMb9THQLjUeXjw=; b=Jvt7xSZsc/KY0/6OhmSV7/jmZy8TXIF7Ewr6VjxlPp9jFXA0izNQp5JQ3hgTKy6NI3 m7jxUFqFGqGooaXDI3J/KBznzMrSa+nqCk+j7J9E0bCkbC3PyIqlDXdjkjKqoLV5bSUO gQ8OXeYYK9XBnaCS0x7Mxs5//yTAbU7EwJKF8f6WxmvELWbQAT212tOXFmXf4FrrCi1e HQoNfdEz0fDXxw3RYbXmZ6i1dcMIfsGUF1gMiL8RwQdDLnA3kb0pQCtuApnqMTIQhCQr zZqJKohmiZJkKVabAQ1OgKTIDrDc1bozP/iaOUm/UkNjTZbd0+pphg3k0wGQA60VDG6H 8syg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb856974si49604291cf.501.2025.03.14.23.26.14 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:26:14 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKvY-0004MM-Sq; Sat, 15 Mar 2025 02:23:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtW-0007Xu-29; Sat, 15 Mar 2025 02:21:15 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtT-0003iq-Vo; Sat, 15 Mar 2025 02:21:13 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E3A3DFF9EC; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id BB1C61CAC55; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 77938558EF; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Michael Tokarev Subject: [Stable-9.2.3 32/51] target/arm: Don't apply CNTVOFF_EL2 for EL2_VIRT timer Date: Sat, 15 Mar 2025 09:17:38 +0300 Message-Id: <20250315061801.622606-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The CNTVOFF_EL2 offset register should only be applied for accessses to CNTVCT_EL0 and for the EL1 virtual timer (CNTV_*). We were incorrectly applying it for the EL2 virtual timer (CNTHV_*). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Message-id: 20250204125009.2281315-3-peter.maydell@linaro.org (cherry picked from commit 5709038aa8b4d58b8c201ed53c327074173a35c6) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 417801d9c3..404ef983f3 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2871,7 +2871,6 @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, switch (timeridx) { case GTIMER_VIRT: - case GTIMER_HYPVIRT: offset = gt_virt_cnt_offset(env); break; case GTIMER_PHYS: @@ -2891,7 +2890,6 @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, switch (timeridx) { case GTIMER_VIRT: - case GTIMER_HYPVIRT: offset = gt_virt_cnt_offset(env); break; case GTIMER_PHYS: From patchwork Sat Mar 15 06:17:39 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873838 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062487wrq; Fri, 14 Mar 2025 23:27:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVA+ge+9+E9b/CIDflmLnhiZo+MTzIfQiw3u0ap4VmO8fpvdZ1uCJE7Lu6nRTT7CkTgv5w5RA==@linaro.org X-Google-Smtp-Source: AGHT+IGy6crw0jszgmjJz1S6sS1n7/x38QZ4t8akFwT0QlHTo50zBNBmcUTm2kFdVpVzaqBlMbBv X-Received: by 2002:a05:622a:11c9:b0:476:95dd:520e with SMTP id d75a77b69052e-476c8149c0amr80031181cf.16.1742020053047; Fri, 14 Mar 2025 23:27:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020053; cv=none; d=google.com; s=arc-20240605; b=MedAvwn90ptBH2nWDjQtTODgYjJ9QtcgLHYw20cGumfXFtA9JNVX+eRVckUEDm9c09 RpW5032vyldTqAQ0jBpBQ3l8dmaY4pKbh0LpTDlXBSJUT4FxNeRoGBdMtf8c5dwM1J0G gnHIav8sqxmmM64aeIFPgUDqoHb4xmP5WByxgGSWH9Fwz1FRsG9++bQhVFMUjQr9Ryod d7D/cMREdQ7okfY7ULgU8wcVxrAEwmic3tXns2Uz7oupcvoFucvf01zlpXUXExn6fVPE 5+AgjPJMpMXUheyXJNOmXayP9SjVMtOErc9pH1xrrqfWKCFcyoVyEtJm4bpANNOT7FIb JecA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=Ec8FPpK+rtzezAa506DRtpAHmgC5e3vVEeCK2i1JZbc=; fh=AguBzhNxG2iiwyQKHwF5YtCZ+FV/izMb9THQLjUeXjw=; b=hLJ08pKK+W/0G+7VniJT+ED7Z5WU9MXqXpDxtrtJrH+QFsVgn/dEODmtyEAjbEKWqb FYoBk/8gDsuF7ylLo3aOXBGlnnPeXWj7AMIjKyw6JCaPaa9M+hDZUMRrmXp/5YzUeS5M PnboA5rkmVg/XJUcrhO/SPHKhktbBARIjoGvfd4ZhZMPszNF5bMArfNCsS+wOompiSN0 GwqG1QakJjJpAvdWEY1CLF5p0jRFrOpOQv2zgo0DpiFJrOBw+OrUQ3X0uhYzfmuZFwCf 5oLP2ukrxhzVsmpIKzbC4cDTUNJd1dowf6MBLW+HDaituqwxXM0qrIm4cb0l2UWvDrRc K5Ag==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb64cad7si49656221cf.141.2025.03.14.23.27.32 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:27:33 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKvi-00054H-G2; Sat, 15 Mar 2025 02:23:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtW-0007cJ-Ng; Sat, 15 Mar 2025 02:21:16 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtU-0003iw-Ds; Sat, 15 Mar 2025 02:21:14 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E74FAFF9ED; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id BEDEA1CAC56; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 79E4B558F1; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Michael Tokarev Subject: [Stable-9.2.3 33/51] target/arm: Make CNTPS_* UNDEF from Secure EL1 when Secure EL2 is enabled Date: Sat, 15 Mar 2025 09:17:39 +0300 Message-Id: <20250315061801.622606-33-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When we added Secure EL2 support, we missed that this needs an update to the access code for the EL3 physical timer registers. These are supposed to UNDEF from Secure EL1 when Secure EL2 is enabled. (Note for stable backporting: for backports to branches where CP_ACCESS_UNDEFINED is not defined, the old name to use instead is CP_ACCESS_TRAP_UNCATEGORIZED.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Message-id: 20250204125009.2281315-4-peter.maydell@linaro.org (cherry picked from commit bdd641541fbef0a27bf9f60e7eba6f8a31d4706c) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 404ef983f3..a881e890e9 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2654,6 +2654,9 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, if (!arm_is_secure(env)) { return CP_ACCESS_TRAP_UNCATEGORIZED; } + if (arm_is_el2_enabled(env)) { + return CP_ACCESS_UNDEFINED; + } if (!(env->cp15.scr_el3 & SCR_ST)) { return CP_ACCESS_TRAP_EL3; } From patchwork Sat Mar 15 06:17:40 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873843 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062906wrq; Fri, 14 Mar 2025 23:29:57 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXx+N3nztvcFTY1CdZgBTY9fOhe/WmJDmYEPg4+tCw6fuqokC3pDEQZ2a7qZMXQQtjU03uWtA==@linaro.org X-Google-Smtp-Source: AGHT+IFqCB7v9nM7c9pHP17nLvLcyboIzHZdrrVLBG9PAqA0GwFBwlpHCm6oRJMFs65iiZQ8wr+C X-Received: by 2002:a05:6214:4803:b0:6ea:d604:9e4f with SMTP id 6a1803df08f44-6eaddfe4fb5mr166177756d6.19.1742020197278; Fri, 14 Mar 2025 23:29:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020197; cv=none; d=google.com; s=arc-20240605; b=khtNdoAh/xT4k2sSFLUrlrh3Nd2fXtLQ65okvWSUOxWPepcjbOjLczhH/ytoSBkEqC hF1SDStexnWyUcQJAcWVUwGMcC3TxVqyEFK5QIdkQR6FJj64rvDzHJn4s1UVMQi0Jli9 boiHu9Dgv/uCfzgec+G8rsPIboOuQMBGNWSAraFM5oJ8V420LTwdbRia0CCaZ9v2y/Dh DAE4KnxWjndl58AXwRXPaOjcq17r4mS0bas53qD1oyoW6S/gqusqk3tGfCK096su9/Ah zC2k9gyswrDYILQ7CcOVBkg9+M0pepKBhaWmtuCRz1OSb5gYf5ijDWCJ1fXJQd/1wdq7 jCdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=MH2hpAbJyZmqeyVpQd+UbaddX5muU/3QypgDTVFW4yc=; fh=AguBzhNxG2iiwyQKHwF5YtCZ+FV/izMb9THQLjUeXjw=; b=RWH1ePJ++MQnaTJW+bWnfyKQJfBa1U/x2DmwvsA/J3NqDt16rMtVDuSTURT+9XhdZQ RFnjuJB0c5USf9ZSIZQaqdCpU0v7dx2/+FC1dvbFRjQUeX9uzsJ118QGPXQfAtrG9k2a zZqCAJSmUV326bwndp+ewZxDosf+G3257AWhBR0BlKpZpTpPmiEA9yVjd/3tlop/nzP1 WwbNlZzizGQI3fR4vVbLzE864P9fPLtRTVKBrqlT089USex4JiSbOUeP+Sa3dOcWmcmB nRRBVJKotjOupUUn31N8dv7NzWGfQu3MW1tfqLQYjirdRj2+YLvvs8E385oF8eGvcQws Gimg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade2112a5si54159856d6.128.2025.03.14.23.29.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:29:57 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKuf-00029k-4M; Sat, 15 Mar 2025 02:22:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKta-0007mU-3F; Sat, 15 Mar 2025 02:21:26 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtX-0003jR-GW; Sat, 15 Mar 2025 02:21:17 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id EBD26FF9EE; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C327A1CAC57; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7C493558F3; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Michael Tokarev Subject: [Stable-9.2.3 34/51] target/arm: Always apply CNTVOFF_EL2 for CNTV_TVAL_EL02 accesses Date: Sat, 15 Mar 2025 09:17:40 +0300 Message-Id: <20250315061801.622606-34-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Currently we handle CNTV_TVAL_EL02 by calling gt_tval_read() for the EL1 virt timer. This is almost correct, but the underlying CNTV_TVAL_EL0 register behaves slightly differently. CNTV_TVAL_EL02 always applies the CNTVOFF_EL2 offset; CNTV_TVAL_EL0 doesn't do so if we're at EL2 and HCR_EL2.E2H is 1. We were getting this wrong, because we ended up in gt_virt_cnt_offset() and did the E2H check. Factor out the tval read/write calculation from the selection of the offset, so that we can special case gt_virt_tval_read() and gt_virt_tval_write() to unconditionally pass CNTVOFF_EL2. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Message-id: 20250204125009.2281315-5-peter.maydell@linaro.org (cherry picked from commit 4aecd4b442d7abb4355896d878ffc9b028625b01) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index a881e890e9..6f741f5c00 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2867,6 +2867,12 @@ static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, gt_recalc_timer(env_archcpu(env), timeridx); } +static uint64_t do_tval_read(CPUARMState *env, int timeridx, uint64_t offset) +{ + return (uint32_t)(env->cp15.c14_timer[timeridx].cval - + (gt_get_countervalue(env) - offset)); +} + static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, int timeridx) { @@ -2881,8 +2887,16 @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, break; } - return (uint32_t)(env->cp15.c14_timer[timeridx].cval - - (gt_get_countervalue(env) - offset)); + return do_tval_read(env, timeridx, offset); +} + +static void do_tval_write(CPUARMState *env, int timeridx, uint64_t value, + uint64_t offset) +{ + trace_arm_gt_tval_write(timeridx, value); + env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + + sextract64(value, 0, 32); + gt_recalc_timer(env_archcpu(env), timeridx); } static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, @@ -2899,11 +2913,7 @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, offset = gt_phys_cnt_offset(env); break; } - - trace_arm_gt_tval_write(timeridx, value); - env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + - sextract64(value, 0, 32); - gt_recalc_timer(env_archcpu(env), timeridx); + do_tval_write(env, timeridx, value, offset); } static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, @@ -3035,13 +3045,21 @@ static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) { - return gt_tval_read(env, ri, GTIMER_VIRT); + /* + * This is CNTV_TVAL_EL02; unlike the underlying CNTV_TVAL_EL0 + * we always apply CNTVOFF_EL2. Special case that here rather + * than going into the generic gt_tval_read() and then having + * to re-detect that it's this register. + * Note that the accessfn/perms mean we know we're at EL2 or EL3 here. + */ + return do_tval_read(env, GTIMER_VIRT, env->cp15.cntvoff_el2); } static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { - gt_tval_write(env, ri, GTIMER_VIRT, value); + /* Similarly for writes to CNTV_TVAL_EL02 */ + do_tval_write(env, GTIMER_VIRT, value, env->cp15.cntvoff_el2); } static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, From patchwork Sat Mar 15 06:17:41 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873846 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1063210wrq; Fri, 14 Mar 2025 23:31:14 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUykIWQrQhMEQr5qOGACj9t2UUeOv8EfRQM4x6To6k4ymfY2nyCBP/g0wlWw/6a1Cfd8vnhMg==@linaro.org X-Google-Smtp-Source: AGHT+IEz4jW2ZQWWDyJStAPPxexxNHM+OcGScMhLMSwFKJLpWxCgndBuvUu49/10KC660fpVStDl X-Received: by 2002:a05:620a:45aa:b0:7b6:cb3c:cb81 with SMTP id af79cd13be357-7c57387033fmr1443613585a.18.1742020274498; Fri, 14 Mar 2025 23:31:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020274; cv=none; d=google.com; s=arc-20240605; b=Qka2EaJmikd51DgfUuxQiMeGB8K/UTFk91f7OmcfReLk3GViTvNvi92Ekn1QUbzogM qqhkpAKCaK6v/YzqTNgcbLblZAgTwScNp8EAihCcO6237Wte2aYjFnJwV5/8IYtF8pjv 9Z7BVWe1VtL00jjgoQZDkvzrNTE+qjsF3cEOELK48w68wZGBLH+C27/7Wb/8v0HniLK6 njmx37crAEV8UDQ+0Jua0GDqrwTBqNq8ul7UvNjj1/eq3cOefJymo6uSh5t0uC8QnWg4 jFJvMn6C7VJ8DQ7KZ2VBkNpLMgdqJuF70mg/yKie3HZ39AOHVnkRQmipClwsBAlp/jMJ JKLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=NW5PP9zpFLo/jB0+Dc3x8JWV0JbTbNlVFrhgclJy3zk=; fh=AguBzhNxG2iiwyQKHwF5YtCZ+FV/izMb9THQLjUeXjw=; b=DzITomhDpD8czV0Ty2NGcTxDTZEuytW3JVVHeLmmCcsp0WgvsmyM0O3FiJQMmuXDoX u1ArtUIM30nMSSJYo8eiK4x0/Ghf6+WoOwWbhigqtTMG78jJGrnuR8wixyffH04cTAd/ ebUAZ4UvzqqPIg7zbdPW6PnvZ7SOzqauiA0BpazQ3ZUobv3psxGwauQJX5Ke2MgbQZJs hgr0or3vMt8qK9WAfph8m9SHxEpFMolXaHIiTAHj7yCFardW9RlHzQqflDZI9IPKAyYB zPvHbbdyK8izCV9poGlu3lWHs8vtkn+8i6QK5ioyWxBjLzew3oR5jl43B2niFwWkD2ko +2nA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb7deb5fsi51660971cf.329.2025.03.14.23.31.13 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:31:14 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKwd-00066D-GZ; Sat, 15 Mar 2025 02:24:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtu-0008Un-Ma; Sat, 15 Mar 2025 02:21:38 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKts-0003jY-EH; Sat, 15 Mar 2025 02:21:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id EFCA9FF9EF; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C72171CAC58; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7EBA3558F5; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Michael Tokarev Subject: [Stable-9.2.3 35/51] target/arm: Refactor handling of timer offset for direct register accesses Date: Sat, 15 Mar 2025 09:17:41 +0300 Message-Id: <20250315061801.622606-35-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When reading or writing the timer registers, sometimes we need to apply one of the timer offsets. Specifically, this happens for direct reads of the counter registers CNTPCT_EL0 and CNTVCT_EL0 (and their self-synchronized variants CNTVCTSS_EL0 and CNTPCTSS_EL0). It also applies for direct reads and writes of the CNT*_TVAL_EL* registers that provide the 32-bit downcounting view of each timer. We currently do this with duplicated code in gt_tval_read() and gt_tval_write() and a special-case in gt_virt_cnt_read() and gt_cnt_read(). Refactor this so that we handle it all in a single function gt_direct_access_timer_offset(), to parallel how we handle the offset for indirect accesses. The call in the WFIT helper previously to gt_virt_cnt_offset() is now to gt_direct_access_timer_offset(); this is the correct behaviour, but it's not immediately obvious that it shouldn't be considered an indirect access, so we add an explanatory comment. This commit should make no behavioural changes. (Cc to stable because the following bugfix commit will depend on this one.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Message-id: 20250204125009.2281315-6-peter.maydell@linaro.org (cherry picked from commit 02c648a0a103a1a7b2c077ec5a81da9907f45544) (Mjt: context fix in target/arm/internals.h) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 6f741f5c00..2dbd308ed2 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2722,14 +2722,6 @@ static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env) return 0; } -static uint64_t gt_phys_cnt_offset(CPUARMState *env) -{ - if (arm_current_el(env) >= 2) { - return 0; - } - return gt_phys_raw_cnt_offset(env); -} - static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx) { /* @@ -2756,6 +2748,52 @@ static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx) } } +uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx) +{ + /* + * Return the timer offset to use for direct accesses to the + * counter registers CNTPCT and CNTVCT, and for direct accesses + * to the CNT*_TVAL registers. + * + * This isn't exactly the same as the indirect-access offset, + * because here we also care about what EL the register access + * is being made from. + * + * This corresponds to the access pseudocode for the registers. + */ + uint64_t hcr; + + switch (timeridx) { + case GTIMER_PHYS: + if (arm_current_el(env) >= 2) { + return 0; + } + return gt_phys_raw_cnt_offset(env); + case GTIMER_VIRT: + switch (arm_current_el(env)) { + case 2: + hcr = arm_hcr_el2_eff(env); + if (hcr & HCR_E2H) { + return 0; + } + break; + case 0: + hcr = arm_hcr_el2_eff(env); + if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { + return 0; + } + break; + } + return env->cp15.cntvoff_el2; + case GTIMER_HYP: + case GTIMER_SEC: + case GTIMER_HYPVIRT: + return 0; + default: + g_assert_not_reached(); + } +} + static void gt_recalc_timer(ARMCPU *cpu, int timeridx) { ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; @@ -2828,34 +2866,14 @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) { - return gt_get_countervalue(env) - gt_phys_cnt_offset(env); -} - -uint64_t gt_virt_cnt_offset(CPUARMState *env) -{ - uint64_t hcr; - - switch (arm_current_el(env)) { - case 2: - hcr = arm_hcr_el2_eff(env); - if (hcr & HCR_E2H) { - return 0; - } - break; - case 0: - hcr = arm_hcr_el2_eff(env); - if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { - return 0; - } - break; - } - - return env->cp15.cntvoff_el2; + uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_PHYS); + return gt_get_countervalue(env) - offset; } static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) { - return gt_get_countervalue(env) - gt_virt_cnt_offset(env); + uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT); + return gt_get_countervalue(env) - offset; } static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, @@ -2876,16 +2894,7 @@ static uint64_t do_tval_read(CPUARMState *env, int timeridx, uint64_t offset) static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, int timeridx) { - uint64_t offset = 0; - - switch (timeridx) { - case GTIMER_VIRT: - offset = gt_virt_cnt_offset(env); - break; - case GTIMER_PHYS: - offset = gt_phys_cnt_offset(env); - break; - } + uint64_t offset = gt_direct_access_timer_offset(env, timeridx); return do_tval_read(env, timeridx, offset); } @@ -2903,16 +2912,8 @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, int timeridx, uint64_t value) { - uint64_t offset = 0; + uint64_t offset = gt_direct_access_timer_offset(env, timeridx); - switch (timeridx) { - case GTIMER_VIRT: - offset = gt_virt_cnt_offset(env); - break; - case GTIMER_PHYS: - offset = gt_phys_cnt_offset(env); - break; - } do_tval_write(env, timeridx, value, offset); } diff --git a/target/arm/internals.h b/target/arm/internals.h index e37f459af3..d2a9cc9aa7 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -1814,7 +1814,8 @@ int delete_hw_watchpoint(target_ulong addr, target_ulong len, int type); uint64_t gt_get_countervalue(CPUARMState *env); /* * Return the currently applicable offset between the system counter - * and CNTVCT_EL0 (this will be either 0 or the value of CNTVOFF_EL2). + * and the counter for the specified timer, as used for direct register + * accesses. */ -uint64_t gt_virt_cnt_offset(CPUARMState *env); +uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx); #endif diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index 5aef45d9c4..3aa709ceff 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -427,7 +427,13 @@ void HELPER(wfit)(CPUARMState *env, uint64_t timeout) int target_el = check_wfx_trap(env, false, &excp); /* The WFIT should time out when CNTVCT_EL0 >= the specified value. */ uint64_t cntval = gt_get_countervalue(env); - uint64_t offset = gt_virt_cnt_offset(env); + /* + * We want the value that we would get if we read CNTVCT_EL0 from + * the current exception level, so the direct_access offset, not + * the indirect_access one. Compare the pseudocode LocalTimeoutEvent(), + * which calls VirtualCounterTimer(). + */ + uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT); uint64_t cntvct = cntval - offset; uint64_t nexttick; From patchwork Sat Mar 15 06:17:42 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873842 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062846wrq; Fri, 14 Mar 2025 23:29:42 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW1Mduj2OQ2a+4XDqlJtDMi7bMJ1z/4l7BR3hcVTmoGaP3tp5AYoJGI37MrdjzDQru91MEukg==@linaro.org X-Google-Smtp-Source: AGHT+IFaOxjU05btMFUlT/eJYJW6rmn+d4yFRctLpP8wo1EWy2TU0SgbIna8130NmLwViQ9O9AVg X-Received: by 2002:ac8:57d1:0:b0:475:16db:b911 with SMTP id d75a77b69052e-476c81e8eaemr82544411cf.52.1742020182129; Fri, 14 Mar 2025 23:29:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020182; cv=none; d=google.com; s=arc-20240605; b=PMTqdXsReRmXbouiWi/AFgEHzOdtXIK2Q7jzyugU8BL02peeWfi9p57LotAJZcLbXc DYs7S6axXAJEdJHlKdJfKxVK/8lQ/zLFUDKiGRs/eSyTyoLkcgKPdOn5w4ciEs44/NGt hBHjnO8K3K0X/nbkzvi7lZ+MQuVJxx5gUrDVG8BmSKBO3f6iWAgeBFkHufSOvcMDOoWb bCtyXaZ/Lxa1wKHum1tP4CZggEFSrDb2Yv9tFAUtQKuQbNB6CzJzgvwLUbLLoZFvc1d0 YdNHHzoOVuGutxdDjVVAKfze7xXK43G65vbgyrXn5OtAkasI0Blvyqla7qbtsqaYuhij 4ATA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=d2LNxKIZPRUQRyIhu8hmBnOJrcFAdBxWO1ca9vHWI/c=; fh=JHBoteX4l8eaqA8BjCvC6lYXlRyDLcAh8PYd2u9U3gk=; b=EILnbGbprCrGsKfNKnt/x3NfvNobcGfCUpg9dxPDkE/FL/hFOPy2GEYlDjfOnWvG2V wkMo6Vg/yJthgjt7SunkLfWsqvOktWMnHwt4iGhAKmlGYlgO0PrVOOWRggpKvsrJdzeh AmJC1L1x1F2puafgoYP5EG7CorG5ZjbvB0qJTEsjXCdx8J5b2NzbxUTFs8Gj0oLLz4cB R/m86iPxVB91RChbSRc4ilP4WjVm3FnBvMEnrAzSfPf8G3u1wVxhlbmoTuIPB9EpU5FP NWz6W3KLayPpC1cM4KvIQMuSqJDymZMeMfIIw60KT51UOclp93i5E3AZFZ4KpCjDxqrx 4kVA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb8812b6si56066961cf.636.2025.03.14.23.29.41 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:29:42 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKvA-0003eu-Kg; Sat, 15 Mar 2025 02:22:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKu0-0000Zj-Va; Sat, 15 Mar 2025 02:21:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKty-0003jw-CQ; Sat, 15 Mar 2025 02:21:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F3E3FFF9F0; Sat, 15 Mar 2025 09:17:07 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id CB0591CAC59; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 81845558F7; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Maydell , Andrei Homescu , =?utf-8?q?Arve_Hj=C3=B8nnev=C3=A5g?= , =?utf-8?q?R=C3=A9mi?= =?utf-8?q?_Denis-Courmont?= , Michael Tokarev Subject: [Stable-9.2.3 36/51] target/arm: Implement SEL2 physical and virtual timers Date: Sat, 15 Mar 2025 09:17:42 +0300 Message-Id: <20250315061801.622606-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Alex Bennée When FEAT_SEL2 was implemented the SEL2 timers were missed. This shows up when building the latest Hafnium with SPMC_AT_EL=2. The actual implementation utilises the same logic as the rest of the timers so all we need to do is: - define the timers and their access functions - conditionally add the correct system registers - create a new accessfn as the rules are subtly different to the existing secure timer Fixes: e9152ee91c (target/arm: add ARMv8.4-SEL2 system registers) Signed-off-by: Alex Bennée Signed-off-by: Peter Maydell Reviewed-by: Peter Maydell Message-id: 20250204125009.2281315-7-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Cc: Andrei Homescu Cc: Arve Hjønnevåg Cc: Rémi Denis-Courmont [PMM: CP_ACCESS_TRAP_UNCATEGORIZED -> CP_ACCESS_UNDEFINED; offset logic now in gt_{indirect,direct}_access_timer_offset() ] Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit f9f99d7ca522339c1de2292f132bb8ddc3471c39) (Mjt: CP_ACCESS_UNDEFINED -> CP_ACCESS_TRAP_UNCATEGORIZED) Signed-off-by: Michael Tokarev diff --git a/include/hw/arm/bsa.h b/include/hw/arm/bsa.h index 8eaab603c0..13ed2d2ac1 100644 --- a/include/hw/arm/bsa.h +++ b/include/hw/arm/bsa.h @@ -22,6 +22,8 @@ #define QEMU_ARM_BSA_H /* These are architectural INTID values */ +#define ARCH_TIMER_S_EL2_VIRT_IRQ 19 +#define ARCH_TIMER_S_EL2_IRQ 20 #define VIRTUAL_PMU_IRQ 23 #define ARCH_GIC_MAINT_IRQ 25 #define ARCH_TIMER_NS_EL2_IRQ 26 diff --git a/target/arm/cpu.c b/target/arm/cpu.c index 6938161b95..da1c46e158 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -2078,6 +2078,10 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp) arm_gt_stimer_cb, cpu); cpu->gt_timer[GTIMER_HYPVIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale, arm_gt_hvtimer_cb, cpu); + cpu->gt_timer[GTIMER_S_EL2_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale, + arm_gt_sel2timer_cb, cpu); + cpu->gt_timer[GTIMER_S_EL2_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale, + arm_gt_sel2vtimer_cb, cpu); } #endif diff --git a/target/arm/cpu.h b/target/arm/cpu.h index b005f93735..39ce5ae629 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -1140,6 +1140,8 @@ void arm_gt_vtimer_cb(void *opaque); void arm_gt_htimer_cb(void *opaque); void arm_gt_stimer_cb(void *opaque); void arm_gt_hvtimer_cb(void *opaque); +void arm_gt_sel2timer_cb(void *opaque); +void arm_gt_sel2vtimer_cb(void *opaque); unsigned int gt_cntfrq_period_ns(ARMCPU *cpu); void gt_rme_post_el_change(ARMCPU *cpu, void *opaque); diff --git a/target/arm/gtimer.h b/target/arm/gtimer.h index b992941bef..0e89b8e58d 100644 --- a/target/arm/gtimer.h +++ b/target/arm/gtimer.h @@ -15,7 +15,9 @@ enum { GTIMER_HYP = 2, GTIMER_SEC = 3, GTIMER_HYPVIRT = 4, -#define NUM_GTIMERS 5 + GTIMER_S_EL2_PHYS = 5, /* CNTHPS_* ; only if FEAT_SEL2 */ + GTIMER_S_EL2_VIRT = 6, /* CNTHVS_* ; only if FEAT_SEL2 */ +#define NUM_GTIMERS 7 }; #endif diff --git a/target/arm/helper.c b/target/arm/helper.c index 2dbd308ed2..67870182de 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2655,7 +2655,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, return CP_ACCESS_TRAP_UNCATEGORIZED; } if (arm_is_el2_enabled(env)) { - return CP_ACCESS_UNDEFINED; + return CP_ACCESS_TRAP_UNCATEGORIZED; } if (!(env->cp15.scr_el3 & SCR_ST)) { return CP_ACCESS_TRAP_EL3; @@ -2671,6 +2671,45 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, } } +static CPAccessResult gt_sel2timer_access(CPUARMState *env, + const ARMCPRegInfo *ri, + bool isread) +{ + /* + * The AArch64 register view of the secure EL2 timers are mostly + * accessible from EL3 and EL2 although can also be trapped to EL2 + * from EL1 depending on nested virt config. + */ + switch (arm_current_el(env)) { + case 0: /* UNDEFINED */ + return CP_ACCESS_TRAP_UNCATEGORIZED; + case 1: + if (!arm_is_secure(env)) { + /* UNDEFINED */ + return CP_ACCESS_TRAP_UNCATEGORIZED; + } else if (arm_hcr_el2_eff(env) & HCR_NV) { + /* Aarch64.SystemAccessTrap(EL2, 0x18) */ + return CP_ACCESS_TRAP_EL2; + } + /* UNDEFINED */ + return CP_ACCESS_TRAP_UNCATEGORIZED; + case 2: + if (!arm_is_secure(env)) { + /* UNDEFINED */ + return CP_ACCESS_TRAP_UNCATEGORIZED; + } + return CP_ACCESS_OK; + case 3: + if (env->cp15.scr_el3 & SCR_EEL2) { + return CP_ACCESS_OK; + } else { + return CP_ACCESS_TRAP_UNCATEGORIZED; + } + default: + g_assert_not_reached(); + } +} + uint64_t gt_get_countervalue(CPUARMState *env) { ARMCPU *cpu = env_archcpu(env); @@ -2742,6 +2781,8 @@ static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx) case GTIMER_HYP: case GTIMER_SEC: case GTIMER_HYPVIRT: + case GTIMER_S_EL2_PHYS: + case GTIMER_S_EL2_VIRT: return 0; default: g_assert_not_reached(); @@ -2788,6 +2829,8 @@ uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx) case GTIMER_HYP: case GTIMER_SEC: case GTIMER_HYPVIRT: + case GTIMER_S_EL2_PHYS: + case GTIMER_S_EL2_VIRT: return 0; default: g_assert_not_reached(); @@ -3220,6 +3263,62 @@ static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, gt_ctl_write(env, ri, GTIMER_SEC, value); } +static void gt_sec_pel2_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) +{ + gt_timer_reset(env, ri, GTIMER_S_EL2_PHYS); +} + +static void gt_sec_pel2_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, + uint64_t value) +{ + gt_cval_write(env, ri, GTIMER_S_EL2_PHYS, value); +} + +static uint64_t gt_sec_pel2_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) +{ + return gt_tval_read(env, ri, GTIMER_S_EL2_PHYS); +} + +static void gt_sec_pel2_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, + uint64_t value) +{ + gt_tval_write(env, ri, GTIMER_S_EL2_PHYS, value); +} + +static void gt_sec_pel2_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, + uint64_t value) +{ + gt_ctl_write(env, ri, GTIMER_S_EL2_PHYS, value); +} + +static void gt_sec_vel2_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) +{ + gt_timer_reset(env, ri, GTIMER_S_EL2_VIRT); +} + +static void gt_sec_vel2_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, + uint64_t value) +{ + gt_cval_write(env, ri, GTIMER_S_EL2_VIRT, value); +} + +static uint64_t gt_sec_vel2_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) +{ + return gt_tval_read(env, ri, GTIMER_S_EL2_VIRT); +} + +static void gt_sec_vel2_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, + uint64_t value) +{ + gt_tval_write(env, ri, GTIMER_S_EL2_VIRT, value); +} + +static void gt_sec_vel2_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, + uint64_t value) +{ + gt_ctl_write(env, ri, GTIMER_S_EL2_VIRT, value); +} + static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) { gt_timer_reset(env, ri, GTIMER_HYPVIRT); @@ -3276,6 +3375,20 @@ void arm_gt_stimer_cb(void *opaque) gt_recalc_timer(cpu, GTIMER_SEC); } +void arm_gt_sel2timer_cb(void *opaque) +{ + ARMCPU *cpu = opaque; + + gt_recalc_timer(cpu, GTIMER_S_EL2_PHYS); +} + +void arm_gt_sel2vtimer_cb(void *opaque) +{ + ARMCPU *cpu = opaque; + + gt_recalc_timer(cpu, GTIMER_S_EL2_VIRT); +} + void arm_gt_hvtimer_cb(void *opaque) { ARMCPU *cpu = opaque; @@ -6658,6 +6771,56 @@ static const ARMCPRegInfo el2_sec_cp_reginfo[] = { .access = PL2_RW, .accessfn = sel2_access, .nv2_redirect_offset = 0x48, .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) }, +#ifndef CONFIG_USER_ONLY + /* Secure EL2 Physical Timer */ + { .name = "CNTHPS_TVAL_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 0, + .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, + .accessfn = gt_sel2timer_access, + .readfn = gt_sec_pel2_tval_read, + .writefn = gt_sec_pel2_tval_write, + .resetfn = gt_sec_pel2_timer_reset, + }, + { .name = "CNTHPS_CTL_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 1, + .type = ARM_CP_IO, .access = PL2_RW, + .accessfn = gt_sel2timer_access, + .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].ctl), + .resetvalue = 0, + .writefn = gt_sec_pel2_ctl_write, .raw_writefn = raw_write, + }, + { .name = "CNTHPS_CVAL_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 2, + .type = ARM_CP_IO, .access = PL2_RW, + .accessfn = gt_sel2timer_access, + .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].cval), + .writefn = gt_sec_pel2_cval_write, .raw_writefn = raw_write, + }, + /* Secure EL2 Virtual Timer */ + { .name = "CNTHVS_TVAL_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 0, + .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, + .accessfn = gt_sel2timer_access, + .readfn = gt_sec_vel2_tval_read, + .writefn = gt_sec_vel2_tval_write, + .resetfn = gt_sec_vel2_timer_reset, + }, + { .name = "CNTHVS_CTL_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 1, + .type = ARM_CP_IO, .access = PL2_RW, + .accessfn = gt_sel2timer_access, + .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].ctl), + .resetvalue = 0, + .writefn = gt_sec_vel2_ctl_write, .raw_writefn = raw_write, + }, + { .name = "CNTHVS_CVAL_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 2, + .type = ARM_CP_IO, .access = PL2_RW, + .accessfn = gt_sel2timer_access, + .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].cval), + .writefn = gt_sec_vel2_cval_write, .raw_writefn = raw_write, + }, +#endif }; static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, From patchwork Sat Mar 15 06:17:43 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873833 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062016wrq; Fri, 14 Mar 2025 23:25:14 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUgYgOECXuGyWM/UefWZsTOzN+WVjGqSojNQYH+IS9zDTq854uZVNx6mIcJ8qHD1sSbUqA0Og==@linaro.org X-Google-Smtp-Source: AGHT+IEMOhGrMgSC67zYoxv1H6rJhLl/oGbdShUq+mtNc0r+o0lGE1fOl7FQO/ZYdGVYE4ckgMZe X-Received: by 2002:a05:620a:179e:b0:7c5:6140:734f with SMTP id af79cd13be357-7c57c7d2912mr665432085a.18.1742019914066; Fri, 14 Mar 2025 23:25:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019914; cv=none; d=google.com; s=arc-20240605; b=NFNvw8srQuKrJl2r9FXBc0pWb0g3qmG3CBkNVudes/359qLeQX90ryyxaijfbyt7nB Xh7eXuE6V/nDCGkFxQ8N7bu0W1xd4WWJvG0DauNfAK9UeOML0ihfaYkIYvIouSc7cOOH JOGi7fX+qnzDr5sBs4MfbORis6VXVc8d2p+mWVKmHmBrk5CmjPta9GaRlDPeBLJHaUYQ CHLnKQcBfQNGRSIvBuf5k4DDnCX+RuToxo8TyOjypgKNh1dEcFgvlKzfRIARZmxyLvt/ Al2s+nH5ehcENuvLGJ5L0h8eq4jpprUZlDjKrmpILwQjR55OhUq2xL0tpygdyd15amxT QyaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=rEu137HdRPgUqRFQt4nW9mXkLUjqiOW5Fp1pDPyIHI8=; fh=NGVuZBn7g66YiPxb27StIj6QsnNGDLJIVpwneOIze74=; b=c5r6Ci9ogCrSGDGSKOZikHXAEIcDkV2GO2RJiv6Wa+M5o85HaIqi1FtBJraCKwHWA3 tWsE010qQ0X2RQMX/rOAA9GTRlvrkyKBx4nSpVTydJBXr3j1dFX9lLo4A7I24pGho4t8 312QvZV0JTp1LekCMa3L90F9E7kYg2Mjfgm8Ncv+cNg02mj5Hlih8kuknaFxvy3CkMUj Tlff42cmjvTM1P8G/m36GDQdjvPgk3k8RZJfVv+2cMPvIv9pksRwNw/g4pFFSyIaSvL4 uYIojUaKJ36v2j/zx4iPjWmHBSYnGr+cUQs5Bx458A8kdmKCRzO7u0+bPcjWQFELtycX jAbg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573d1abeasi520797685a.587.2025.03.14.23.25.13 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:25:14 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKv4-00038i-PT; Sat, 15 Mar 2025 02:22:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKty-0000Qk-Cl; Sat, 15 Mar 2025 02:21:43 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtw-0003kx-GM; Sat, 15 Mar 2025 02:21:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 036F9FF9F1; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id CF11C1CAC5A; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 83F3E558F9; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Maydell , Michael Tokarev Subject: [Stable-9.2.3 37/51] hw/arm: enable secure EL2 timers for virt machine Date: Sat, 15 Mar 2025 09:17:43 +0300 Message-Id: <20250315061801.622606-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Alex Bennée Signed-off-by: Alex Bennée Signed-off-by: Peter Maydell Reviewed-by: Peter Maydell Message-id: 20250204125009.2281315-9-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 5dcaea8bcd82972add29eef350547f922fb4caa2) Signed-off-by: Michael Tokarev diff --git a/hw/arm/virt.c b/hw/arm/virt.c index 1a381e9a2b..5fa045cc21 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -873,6 +873,8 @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem) [GTIMER_HYP] = ARCH_TIMER_NS_EL2_IRQ, [GTIMER_SEC] = ARCH_TIMER_S_EL1_IRQ, [GTIMER_HYPVIRT] = ARCH_TIMER_NS_EL2_VIRT_IRQ, + [GTIMER_S_EL2_PHYS] = ARCH_TIMER_S_EL2_IRQ, + [GTIMER_S_EL2_VIRT] = ARCH_TIMER_S_EL2_VIRT_IRQ, }; for (unsigned irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) { From patchwork Sat Mar 15 06:17:44 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873839 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062488wrq; Fri, 14 Mar 2025 23:27:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUeF/klT3jnfO5ltciaFNxRgvAvzphKYhyfM6Dhf0o5c2KrbXabgg5yFA4btnH57CKmbwvFsg==@linaro.org X-Google-Smtp-Source: AGHT+IE77dtvKIH5LnijA+aqU4ZBF5y5Hdc2bhOU2sQR91tpgdnSXy7H6nMLIBnIFWpH0GDRVT0f X-Received: by 2002:a05:6214:d8d:b0:6e8:c713:321f with SMTP id 6a1803df08f44-6eaeaafe44dmr59502186d6.35.1742020053151; Fri, 14 Mar 2025 23:27:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020053; cv=none; d=google.com; s=arc-20240605; b=ifyGdKPIx6zzIo0w+Mqe+TjHWux2OFvHxg7vjrQyWsMKfb48WkSRrEv8lHTA1stFTN wu12dmaIdbwejXtgsWCMNqJxPe1E4sjR0G67ChxRbLUOTJIBis1zxCvBEabyIdxD9F/P efELgXZrFv1nCy7QMcmO1GuM7mPZAnZ+5fKeDaJWEliuHi8iPNzpwrrxwZ70pVyr1K4i X9pGq8vVP5OjHVMPJsmnu9aeEA9ZrMPt820SQo47q8YgnEBP1Hbb2KLK6X3ji+vc3Rf2 zZyq2z43+2PCUMUoTszLsOWB1oo+iJ/576lkj+6bOOVpKGh9b/ApV9p2YAlm51IQGi2I 82Bw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=EdXOrOP3ipdRV5TnIiOV5EjkQQdmyB2QvsQ+2A0QZdQ=; fh=NGVuZBn7g66YiPxb27StIj6QsnNGDLJIVpwneOIze74=; b=OXwjZEcGhZrXY+0+xEBotPf+MMeUyb/gEi4kdJ7d7bfL6B40B+vSR7yhrVL3RWF/af mGxe9GrG1Gl1XQKcYg4OMUU9epz92KpkfbOJBjnM7w6BEMvjazMlWHVtiXxwKjjz6NuM ybll7IEbZsky8yrjB09Ee4J/vFRiq22rKhsC+/7Vw06drMz9pptzRZhL1KJSb9Iylyyf ikhi0kVd+oEVGlUlJ7rt1r0+wNIkOmO1NJo+qz+HOjt57NnupPiQFnyHoLl1ujK+jnVv IWMONvzbCBz5+H6xJ4YdacMHgYpwf7oW/wyh/TPh8YXyIylo4TDm7aWr3fEDowYKfzSZ tR6g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eaf4c5186dsi12880726d6.366.2025.03.14.23.27.33 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:27:33 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKx0-0006qN-4H; Sat, 15 Mar 2025 02:24:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKu2-0000gu-1l; Sat, 15 Mar 2025 02:21:46 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKtz-0003lR-SR; Sat, 15 Mar 2025 02:21:45 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 07438FF9F2; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D2F281CAC5B; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 8658B558FB; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Maydell , Michael Tokarev Subject: [Stable-9.2.3 38/51] hw/arm: enable secure EL2 timers for sbsa machine Date: Sat, 15 Mar 2025 09:17:44 +0300 Message-Id: <20250315061801.622606-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Alex Bennée Signed-off-by: Alex Bennée Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell Message-id: 20250204125009.2281315-10-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell (cherry picked from commit 9a9d9e82093efa22e3e2bdaac0f24c823f8786f7) Signed-off-by: Michael Tokarev diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c index e3195d5449..e9985a5e3b 100644 --- a/hw/arm/sbsa-ref.c +++ b/hw/arm/sbsa-ref.c @@ -484,6 +484,8 @@ static void create_gic(SBSAMachineState *sms, MemoryRegion *mem) [GTIMER_HYP] = ARCH_TIMER_NS_EL2_IRQ, [GTIMER_SEC] = ARCH_TIMER_S_EL1_IRQ, [GTIMER_HYPVIRT] = ARCH_TIMER_NS_EL2_VIRT_IRQ, + [GTIMER_S_EL2_PHYS] = ARCH_TIMER_S_EL2_IRQ, + [GTIMER_S_EL2_VIRT] = ARCH_TIMER_S_EL2_VIRT_IRQ, }; for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) { From patchwork Sat Mar 15 06:17:45 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873837 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062360wrq; Fri, 14 Mar 2025 23:27:01 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWLe36UibIbggHZoh1aK0+/lEGFHDlxsjLbgyIrTQncRZGnABq1CQgc/m4WNph1swqGz3Rxig==@linaro.org X-Google-Smtp-Source: AGHT+IGsmpVWBfmziQeyAxeAyIqNxMzo72LzojSvtip6gvLHFSORxRgnvXWJnSUSv+053A4VBi+9 X-Received: by 2002:a05:620a:454d:b0:7c5:3d0b:a565 with SMTP id af79cd13be357-7c57c8abc0emr674499985a.46.1742020021543; Fri, 14 Mar 2025 23:27:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020021; cv=none; d=google.com; s=arc-20240605; b=Y/qpVy2NOdwv9D3m151+rV4ZWESGDmCiZroYEJ84IhfemhAiacHP1pfIM2Nr9XQHr9 2moU4syErOoDt61SZ4I/LALJbsiaJfZtkESPQ6zwlZ0OoLEQY9fOSPE+i3vpfLyMwtZS GwcYnZzXL8JsC+QEB2ygN9dkuxZnjmY6c7qBspgU13LAzibyHdS9D2Y3DgUITfH/XCpJ zJoq6p8dUQ/Dtg2z/CnUXFhOrh2JeVriHJpEis81oJ0AsOsn7FGmjBpr6L0LXuTcdY4a ECkC0UwFC7+JePWEQH8uHfMaDmY+BzevIcTTmrHNqSO58Me6zcv0UA0O9MXnMYfxazZD smDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=UGc+QGcbHISSBqV7NC4YPwkjEzDSGKkJWLn0DbnifsY=; fh=Iucn2sB5qVZfRGgZGrLj0rflcdBmTbFcpQYc4ERoywQ=; b=JOSiINwOdncJL3YKcmJcBxC6+qhJ4jaWeLYB+mUyBHTtLw1demHUZR5FacKTYVtD/E D82MrciyrZl6AaauMhJuhSu+KZDZi9zc1nBKT23H83HocjPN57AC2naBZ2WOwyt/8ykf EOlfXEXJom/0LrnbFSF1Jcm247N0NnmgYVEnaaeQG6wVI9bRnrGjBLrfVWS70IQ2NDvy sqwjxv9y1StSFhj6sibzEnu7PlEU6W3Ni+LoyfLnHMBw7FTo4kr5HDhLcPHaK5dWDotC riHlhtC0B0E6b+NNbidVr8N5Dq/JFZ19SFDR0aIE0+0OquTK1vuIyfVIHbHqwH1gBFKe hE2w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b93569si510804885a.141.2025.03.14.23.27.01 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:27:01 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKve-0004j3-Me; Sat, 15 Mar 2025 02:23:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKu5-0000xV-2W; Sat, 15 Mar 2025 02:21:49 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKu2-0003ln-IG; Sat, 15 Mar 2025 02:21:48 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0B22CFF9F3; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D6ABA1CAC5C; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 89037558FD; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Stu Grossman , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 39/51] target/arm: Correct LDRD atomicity and fault behaviour Date: Sat, 15 Mar 2025 09:17:45 +0300 Message-Id: <20250315061801.622606-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Our LDRD implementation is wrong in two respects: * if the address is 4-aligned and the load crosses a page boundary and the second load faults and the first load was to the base register (as in cases like "ldrd r2, r3, [r2]", then we must not update the base register before taking the fault * if the address is 8-aligned the access must be a 64-bit single-copy atomic access, not two 32-bit accesses Rewrite the handling of the loads in LDRD to use a single tcg_gen_qemu_ld_i64() and split the result into the destination registers. This allows us to get the atomicity requirements right, and also implicitly means that we won't update the base register too early for the page-crossing case. Note that because we no longer increment 'addr' by 4 in the course of performing the LDRD we must change the adjustment value we pass to op_addr_ri_post() and op_addr_rr_post(): it no longer needs to subtract 4 to get the correct value to use if doing base register writeback. STRD has the same problem with not getting the atomicity right; we will deal with that in the following commit. Cc: qemu-stable@nongnu.org Reported-by: Stu Grossman Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250227142746.1698904-2-peter.maydell@linaro.org (cherry picked from commit cde3247651dc998da5dc1005148302a90d72f21f) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c index 9ee761fc64..a2933f1c36 100644 --- a/target/arm/tcg/translate.c +++ b/target/arm/tcg/translate.c @@ -5003,10 +5003,49 @@ static bool op_store_rr(DisasContext *s, arg_ldst_rr *a, return true; } -static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) +static void do_ldrd_load(DisasContext *s, TCGv_i32 addr, int rt, int rt2) { + /* + * LDRD is required to be an atomic 64-bit access if the + * address is 8-aligned, two atomic 32-bit accesses if + * it's only 4-aligned, and to give an alignment fault + * if it's not 4-aligned. This is MO_ALIGN_4 | MO_ATOM_SUBALIGN. + * Rt is always the word from the lower address, and Rt2 the + * data from the higher address, regardless of endianness. + * So (like gen_load_exclusive) we avoid gen_aa32_ld_i64() + * so we don't get its SCTLR_B check, and instead do a 64-bit access + * using MO_BE if appropriate and then split the two halves. + * + * For M-profile, and for A-profile before LPAE, the 64-bit + * atomicity is not required. We could model that using + * the looser MO_ATOM_IFALIGN_PAIR, but providing a higher + * level of atomicity than required is harmless (we would not + * currently generate better code for IFALIGN_PAIR here). + * + * This also gives us the correct behaviour of not updating + * rt if the load of rt2 faults; this is required for cases + * like "ldrd r2, r3, [r2]" where rt is also the base register. + */ int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + MemOp opc = MO_64 | MO_ALIGN_4 | MO_ATOM_SUBALIGN | s->be_data; + TCGv taddr = gen_aa32_addr(s, addr, opc); + TCGv_i64 t64 = tcg_temp_new_i64(); + TCGv_i32 tmp = tcg_temp_new_i32(); + TCGv_i32 tmp2 = tcg_temp_new_i32(); + + tcg_gen_qemu_ld_i64(t64, taddr, mem_idx, opc); + if (s->be_data == MO_BE) { + tcg_gen_extr_i64_i32(tmp2, tmp, t64); + } else { + tcg_gen_extr_i64_i32(tmp, tmp2, t64); + } + store_reg(s, rt, tmp); + store_reg(s, rt2, tmp2); +} + +static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) +{ + TCGv_i32 addr; if (!ENABLE_ARCH_5TE) { return false; @@ -5017,18 +5056,10 @@ static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) } addr = op_addr_rr_pre(s, a); - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, a->rt, tmp); - - tcg_gen_addi_i32(addr, addr, 4); - - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, a->rt + 1, tmp); + do_ldrd_load(s, addr, a->rt, a->rt + 1); /* LDRD w/ base writeback is undefined if the registers overlap. */ - op_addr_rr_post(s, a, addr, -4); + op_addr_rr_post(s, a, addr, 0); return true; } @@ -5152,23 +5183,14 @@ static bool op_store_ri(DisasContext *s, arg_ldst_ri *a, static bool op_ldrd_ri(DisasContext *s, arg_ldst_ri *a, int rt2) { - int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + TCGv_i32 addr; addr = op_addr_ri_pre(s, a); - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, a->rt, tmp); - - tcg_gen_addi_i32(addr, addr, 4); - - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, rt2, tmp); + do_ldrd_load(s, addr, a->rt, rt2); /* LDRD w/ base writeback is undefined if the registers overlap. */ - op_addr_ri_post(s, a, addr, -4); + op_addr_ri_post(s, a, addr, 0); return true; } From patchwork Sat Mar 15 06:17:46 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873840 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062519wrq; Fri, 14 Mar 2025 23:27:40 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWOE9J2KLAA+ja1fn0vTSJR7qSBYOzaFa5nxzRdt0kPg740V6COLRtzGL/9MM0sKS/6GuwbTQ==@linaro.org X-Google-Smtp-Source: AGHT+IEsSqY+D5KbM2LqJ6rwjOv1PmbHe1iqionxroPw0kz/0NHU1AJ+E+UnuFUUHydsvI78jY/X X-Received: by 2002:a05:6214:1250:b0:6e4:2e12:3a0c with SMTP id 6a1803df08f44-6eaeaabd2bcmr76066536d6.39.1742020060647; Fri, 14 Mar 2025 23:27:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020060; cv=none; d=google.com; s=arc-20240605; b=d1KMIg2TAQvtzgkJei3HGFsR1F8LMx3s69grQimjcjKs4YWThu0N/RD3DdBcTZpQOM qyTLVv8RFf3weJ9fiKTEbFeSlF2pd8PCjSK0B7HzUHHUu4krTO0+XlNEKnXjAjNuzpoR 4wWs3aP9qHl9WvERkMuSokc24C73P/tvJQESPExa290UbHJihubpWXj/1cW9YiQV61vO 4mJqrQJP3RbDQeG0TUzqwmav6dNCjoA1t7Z6PL6Nhfc5Vw1lIJsGW87VfAgezAA6ZIOQ NRGE4nBD5q98+RONRlQd2NRgdC9nmAbS5UK51FQA2fQavilBt5eie3aG59IntfzcL+7f PyYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=3Cw1aDEMv4h5pQLkvbB+PEQP4Ao0RzUyrZef507q7JY=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=UJi8Hk8iROlxuZyMbYxPObk2JDPSENx++rDwxTBRR+AafO7uvd5djVTbt35ncpils1 8mX9oKZ51NWwjdnKbBY6oEENrUaG6qtpGP5NFI8npmrubDbJKRWMgX3ulbYRVthb4t45 thhyxspiFHPB6pveTZsOrFhIr3dwLVYd6ubbTfCnXq3wmizPpznkFZPOg25PJFFfsr1a LlUPkF/jc5GkILBnC+y3o1fJJnFYiiRvSuOTHqtlvJcx0sdT+qqW3l6ZHcF1awEUwcxE bVPipAH3Tqvjf1An6I8nzftQ++TZ2Rfb6jvbFcmqVV5LiJnUACqQC9ueyCG9IgrlSEf1 kfXQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb856775si54544061cf.507.2025.03.14.23.27.40 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:27:40 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKy2-0008EX-RY; Sat, 15 Mar 2025 02:25:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKuQ-0001DI-Ou; Sat, 15 Mar 2025 02:22:11 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKuN-0003ly-Fu; Sat, 15 Mar 2025 02:22:09 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0F080FF9F4; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id DA9C51CAC5D; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 8B6CE558FF; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 40/51] target/arm: Correct STRD atomicity Date: Sat, 15 Mar 2025 09:17:46 +0300 Message-Id: <20250315061801.622606-40-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Our STRD implementation doesn't correctly implement the requirement: * if the address is 8-aligned the access must be a 64-bit single-copy atomic access, not two 32-bit accesses Rewrite the handling of STRD to use a single tcg_gen_qemu_st_i64() of a value produced by concatenating the two 32 bit source registers. This allows us to get the atomicity right. As with the LDRD change, now that we don't update 'addr' in the course of performing the store we need to adjust the offset we pass to op_addr_ri_post() and op_addr_rr_post(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250227142746.1698904-3-peter.maydell@linaro.org (cherry picked from commit ee786ca115045a2b7e86ac3073b0761cb99e0d49) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c index a2933f1c36..4eba3d1c8d 100644 --- a/target/arm/tcg/translate.c +++ b/target/arm/tcg/translate.c @@ -5063,10 +5063,42 @@ static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) return true; } -static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr *a) +static void do_strd_store(DisasContext *s, TCGv_i32 addr, int rt, int rt2) { + /* + * STRD is required to be an atomic 64-bit access if the + * address is 8-aligned, two atomic 32-bit accesses if + * it's only 4-aligned, and to give an alignment fault + * if it's not 4-aligned. + * Rt is always the word from the lower address, and Rt2 the + * data from the higher address, regardless of endianness. + * So (like gen_store_exclusive) we avoid gen_aa32_ld_i64() + * so we don't get its SCTLR_B check, and instead do a 64-bit access + * using MO_BE if appropriate, using a value constructed + * by putting the two halves together in the right order. + * + * As with LDRD, the 64-bit atomicity is not required for + * M-profile, or for A-profile before LPAE, and we provide + * the higher guarantee always for simplicity. + */ int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + MemOp opc = MO_64 | MO_ALIGN_4 | MO_ATOM_SUBALIGN | s->be_data; + TCGv taddr = gen_aa32_addr(s, addr, opc); + TCGv_i32 t1 = load_reg(s, rt); + TCGv_i32 t2 = load_reg(s, rt2); + TCGv_i64 t64 = tcg_temp_new_i64(); + + if (s->be_data == MO_BE) { + tcg_gen_concat_i32_i64(t64, t2, t1); + } else { + tcg_gen_concat_i32_i64(t64, t1, t2); + } + tcg_gen_qemu_st_i64(t64, taddr, mem_idx, opc); +} + +static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr *a) +{ + TCGv_i32 addr; if (!ENABLE_ARCH_5TE) { return false; @@ -5077,15 +5109,9 @@ static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr *a) } addr = op_addr_rr_pre(s, a); - tmp = load_reg(s, a->rt); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); + do_strd_store(s, addr, a->rt, a->rt + 1); - tcg_gen_addi_i32(addr, addr, 4); - - tmp = load_reg(s, a->rt + 1); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - - op_addr_rr_post(s, a, addr, -4); + op_addr_rr_post(s, a, addr, 0); return true; } @@ -5213,20 +5239,13 @@ static bool trans_LDRD_ri_t32(DisasContext *s, arg_ldst_ri2 *a) static bool op_strd_ri(DisasContext *s, arg_ldst_ri *a, int rt2) { - int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + TCGv_i32 addr; addr = op_addr_ri_pre(s, a); - tmp = load_reg(s, a->rt); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - - tcg_gen_addi_i32(addr, addr, 4); - - tmp = load_reg(s, rt2); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); + do_strd_store(s, addr, a->rt, rt2); - op_addr_ri_post(s, a, addr, -4); + op_addr_ri_post(s, a, addr, 0); return true; } From patchwork Sat Mar 15 06:17:47 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873841 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062548wrq; Fri, 14 Mar 2025 23:27:46 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWQ9/SHLncwhWhmSchV2FsIUAebyvaU9y0YPaBu1LQRQZ/CmPUMUjntTD0awT1F6uwLHz45Cg==@linaro.org X-Google-Smtp-Source: AGHT+IG7ile7M+jlRHKSZQerxTuzemPn3duF0ogGxA/fov8qgekCEyySvJqRPkuPZNG6RHrj75Ku X-Received: by 2002:a05:620a:4450:b0:7c5:619e:c096 with SMTP id af79cd13be357-7c57c90d49bmr589947285a.38.1742020066760; Fri, 14 Mar 2025 23:27:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020066; cv=none; d=google.com; s=arc-20240605; b=jflTQZ397Wd01V2K0EuMh0GAOX6v0nMeq7HrVzEIcf+S20444xbeOFgqFdMhLltOJ1 67k9MsknnnJ1/AoWVFZ/mG6lnDqtolBbums1AI65Em6z5POPAOrKNTIUb0tbdnD/u/rW xHskHbd4kqsm/lfvHIPRmtSQwGsfE30l0eBrIA+d7a3FUe9znPGI6Jv0E9LnEmPM+9Wt v029jv+FbpRXDg8BJTDi5smoAXAwoE63lWB2pofGmVHouRdbiLOejgmkTCz81eBHn8aL cYafKU6SN5S12vVJ5EY22Bzd6qtXPeQslKmjuZWd7pD076OFRLJIVzdQjHdfMR/wHxaf pLyg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=dGt5CAx+x7EGmAiqRvIxnt5b33tYD/dNbed7K4Auq3I=; fh=GanseRjrcQuAMREH5dzTEIrzdKej3kFdmGlqcUMu4ko=; b=WFC0IFWEdWsyoAPmowAP6ZOpIwwi7zOVGl74QJLsjEwiwgCNRJ+A9n4JckRYzDZpfY JIA+7MMqWK0QvVplsYBvlyvJfBPpVeq8By19eIayGe5Vm6ivWh/GBCdFhRWotSseu53/ gmAr2hStSE1Aa/cvMIA+yxZkIw4os9NcTLdu3M0avLjAUxeSYsKRVOSlVltJZl4nyTr1 8/sHX9iLDn84GDM8OoahJTWiaM0af1yZaPs/lUqn+zz2s25O7GBXZbKiTV8LCUJFV1Kd ifz1BBL4s7MU7Nk0lkbf4SbrtS7K5CHF2Xa0unYPKfp6I2v+fyxB7JzBhqN3XeU5amOk V14w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b73064si516080785a.68.2025.03.14.23.27.46 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:27:46 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKxN-0007Jr-0Q; Sat, 15 Mar 2025 02:25:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKuS-0001Qk-RC; Sat, 15 Mar 2025 02:22:13 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKuQ-0003mR-FW; Sat, 15 Mar 2025 02:22:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 13119FF9F5; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id DEA421CAC5E; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 8DC2955901; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , =?utf-8?q?Alex_Benn=C3=A9?= =?utf-8?q?e?= , Michael Tokarev Subject: [Stable-9.2.3 41/51] util/qemu-timer.c: Don't warp timer from timerlist_rearm() Date: Sat, 15 Mar 2025 09:17:47 +0300 Message-Id: <20250315061801.622606-41-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Currently we call icount_start_warp_timer() from timerlist_rearm(). This produces incorrect behaviour, because timerlist_rearm() is called, for instance, when a timer callback modifies its timer. We cannot decide here to warp the timer forwards to the next timer deadline merely because all_cpu_threads_idle() is true, because the timer callback we were called from (or some other callback later in the list of callbacks being invoked) may be about to raise a CPU interrupt and move a CPU from idle to ready. The only valid place to choose to warp the timer forward is from the main loop, when we know we have no outstanding IO or timer callbacks that might be about to wake up a CPU. For Arm guests, this bug was mostly latent until the refactoring commit f6fc36deef6abc ("target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK"), which exposed it because it refactored a timer callback so that it happened to call timer_mod() first and raise the interrupt second, when it had previously raised the interrupt first and called timer_mod() afterwards. This call seems to have originally derived from the pre-record-and-replay icount code, which (as of e.g. commit db1a49726c3c in 2010) in this location did a call to qemu_notify_event(), necessary to get the icount code in the vCPU round-robin thread to stop and recalculate the icount deadline when a timer was reprogrammed from the IO thread. In current QEMU, everything is done on the vCPU thread when we are in icount mode, so there's no need to try to notify another thread here. I suspect that the other reason why this call was doing icount timer warping is that it pre-dates commit efab87cf79077a from 2015, which added a call to icount_start_warp_timer() to main_loop_wait(). Once the call in timerlist_rearm() has been removed, if the timer callbacks don't cause any CPU to be woken up then we will end up calling icount_start_warp_timer() from main_loop_wait() when the rr main loop code calls rr_wait_io_event(). Remove the incorrect call from timerlist_rearm(). Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2703 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Reviewed-by: Alex Bennée Tested-by: Alex Bennée Message-id: 20250210135804.3526943-1-peter.maydell@linaro.org (cherry picked from commit 02ae315467cee589d02dfb89e13a2a6a8de09fc5) Signed-off-by: Michael Tokarev diff --git a/util/qemu-timer.c b/util/qemu-timer.c index ffe9a3c5c1..dfa444b132 100644 --- a/util/qemu-timer.c +++ b/util/qemu-timer.c @@ -409,10 +409,6 @@ static bool timer_mod_ns_locked(QEMUTimerList *timer_list, static void timerlist_rearm(QEMUTimerList *timer_list) { - /* Interrupt execution to force deadline recalculation. */ - if (icount_enabled() && timer_list->clock->type == QEMU_CLOCK_VIRTUAL) { - icount_start_warp_timer(); - } timerlist_notify(timer_list); } From patchwork Sat Mar 15 06:17:52 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873845 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1063206wrq; Fri, 14 Mar 2025 23:31:13 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXsf7M0Xyc4nkfQPGelCZJIxtixOY2esuh/V7sjY4wLrWJDF0B4c49dk6gE09OpQViDZd+XSQ==@linaro.org X-Google-Smtp-Source: AGHT+IH8F1WQDaq0xAMPQZ+E/aBglUvF+bvc2zbWvkfOK9K4QbO0f0BHoMuojKNChet7RmC7UsGr X-Received: by 2002:a05:620a:4386:b0:7c3:d5c6:d34f with SMTP id af79cd13be357-7c57c80ef9dmr781600385a.32.1742020273580; Fri, 14 Mar 2025 23:31:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020273; cv=none; d=google.com; s=arc-20240605; b=Ksvw7ct7/g2kfzeTQEMxy8Yfl3uOMJdu+LECmlaNo57nDTMMj37L/TTvGsotwZ87X1 8X5Q42C4Zt9ai5yIQdxj2lNq0hd4c0rvxVgzzlrcmOWpYGzTspJLgz07BhZ6J6NVk8Xo Sim10k7O8DiYyTunZ+tPG5Y4zXqUzoYEHWWLY5wJk1FOFMBSU0p8/r1URsxREMg5AX5c IF14mK6f7g3AsZOrs49O9bVswY+nCuDrOwJC8T81BOZd2d27LKPZ4D5v4cJyriREvwiU rBPI2vdn89IFDFuF/OACOKzx17Tf7ZOlsJ8IOInjRALYVLn3NHwVFwj8dgPKpMvECIUy /LbQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=BK9rz3f+jeEbtQ6WA0mksTRzVAzF4zbXtjrVTxctGhM=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=QwxXSAHNUOLKjcdpspxPxNXzuup9KvBer9159a7RDDv76OX5EbRQrZt2VNSV0bfx+a D10bFX0MGtPbdIXg1WBT06UKNFne/3254L5djI6JXRx8fbE96LtulTxC50lxXeYa8PXb nqis+MNF+uNrfgNuA8pgrlZcRIjnmS4pPiqKPudNVAoQj/NhyHLpjaRoHD/ZgqwEGO/x 43NeFhkvJ+tlubwy8br2sqhiAEk/+CpuHgaIpE7pVOCYPwiBr+bm1y0VImNl94YuJGGl tAjPgPOtaj9CdH0XGnylx/aYNOuQbfHTMuDLBkX9rj7NvvBC9SgktrJL2ZU7CBgwnMu+ XEMw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b9532esi216682685a.171.2025.03.14.23.31.13 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:31:13 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKyZ-0000sO-2U; Sat, 15 Mar 2025 02:26:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKv2-00036E-QX; Sat, 15 Mar 2025 02:22:49 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKuu-0003pj-6K; Sat, 15 Mar 2025 02:22:48 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 29ADBFF9FA; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id F36481CAC63; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 99E1E5590B; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.2.3 46/51] hw/net/smc91c111: Sanitize packet numbers Date: Sat, 15 Mar 2025 09:17:52 +0300 Message-Id: <20250315061801.622606-46-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The smc91c111 uses packet numbers as an index into its internal s->data[][] array. Valid packet numbers are between 0 and 3, but the code does not generally check this, and there are various places where the guest can hand us an arbitrary packet number and cause an out-of-bounds access to the data array. Add validation of packet numbers. The datasheet is not very helpful about how guest errors like this should be handled: it says nothing on the subject, and none of the documented error conditions are relevant. We choose to log the situation with LOG_GUEST_ERROR and silently ignore the attempted operation. In the places where we are about to access the data[][] array using a packet number and we know the number is valid because we got it from somewhere that has already validated, we add an assert() to document that belief. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228174802.1945417-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 2fa3a5b9469615d06091cf473d172794148e1248) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 2a652885c9..48a6b3fb0d 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -118,6 +118,11 @@ static const VMStateDescription vmstate_smc91c111 = { #define RS_TOOSHORT 0x0400 #define RS_MULTICAST 0x0001 +static inline bool packetnum_valid(int packet_num) +{ + return packet_num >= 0 && packet_num < NUM_PACKETS; +} + /* Update interrupt status. */ static void smc91c111_update(smc91c111_state *s) { @@ -218,6 +223,17 @@ static void smc91c111_pop_tx_fifo_done(smc91c111_state *s) /* Release the memory allocated to a packet. */ static void smc91c111_release_packet(smc91c111_state *s, int packet) { + if (!packetnum_valid(packet)) { + /* + * Data sheet doesn't document behaviour in this guest error + * case, and there is no error status register to report it. + * Log and ignore the attempt. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to release invalid packet %d\n", + packet); + return; + } s->allocated &= ~(1 << packet); if (s->tx_alloc == 0x80) smc91c111_tx_alloc(s); @@ -239,6 +255,8 @@ static void smc91c111_do_tx(smc91c111_state *s) return; for (i = 0; i < s->tx_fifo_len; i++) { packetnum = s->tx_fifo[i]; + /* queue_tx checked the packet number was valid */ + assert(packetnum_valid(packetnum)); p = &s->data[packetnum][0]; /* Set status word. */ *(p++) = 0x01; @@ -287,6 +305,17 @@ static void smc91c111_do_tx(smc91c111_state *s) /* Add a packet to the TX FIFO. */ static void smc91c111_queue_tx(smc91c111_state *s, int packet) { + if (!packetnum_valid(packet)) { + /* + * Datasheet doesn't document behaviour in this error case, and + * there's no error status register we could report it in. + * Log and ignore. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to queue invalid packet %d\n", + packet); + return; + } if (s->tx_fifo_len == NUM_PACKETS) return; s->tx_fifo[s->tx_fifo_len++] = packet; @@ -457,6 +486,13 @@ static void smc91c111_writeb(void *opaque, hwaddr offset, n = s->rx_fifo[0]; else n = s->packet_num; + if (!packetnum_valid(n)) { + /* Datasheet doesn't document what to do here */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to write data to invalid packet %d\n", + n); + return; + } p = s->ptr & 0x07ff; if (s->ptr & 0x4000) { s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); @@ -605,6 +641,13 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset) n = s->rx_fifo[0]; else n = s->packet_num; + if (!packetnum_valid(n)) { + /* Datasheet doesn't document what to do here */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to read data from invalid packet %d\n", + n); + return 0; + } p = s->ptr & 0x07ff; if (s->ptr & 0x4000) { s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); @@ -713,6 +756,8 @@ static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t return -1; s->rx_fifo[s->rx_fifo_len++] = packetnum; + /* allocate_packet() will not hand us back an invalid packet number */ + assert(packetnum_valid(packetnum)); p = &s->data[packetnum][0]; /* ??? Multicast packets? */ status = 0; From patchwork Sat Mar 15 06:17:53 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873848 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1063756wrq; Fri, 14 Mar 2025 23:33:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXojcs2rVEFI9/ppgoukGKjGx1hUCkeJNM3F730VTRc+g4v4orTsjPkBrmRsgohsIj+BprY7Q==@linaro.org X-Google-Smtp-Source: AGHT+IFjYfAJxCWPNRJEz9Rj0NwFXe4wAWfMRB/m9bbWfvAmDbGw2P87M449a1+T4YSrD7IBc1bK X-Received: by 2002:a05:6214:518e:b0:6e8:fcc9:a291 with SMTP id 6a1803df08f44-6eaeaa577e8mr66733036d6.23.1742020427273; Fri, 14 Mar 2025 23:33:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020427; cv=none; d=google.com; s=arc-20240605; b=hrZRdYKIR83R93nTdUD20LbGe38jnUsTwvmFxV6SP7vWocG3G1923MH9iOGvqn+Vlp 8lDS9FulNnsC8QHXwOhhuO8Y5LDSZllL8hxf3wNCOayNwJoMOaZCISYG8Zdqon5ogIrX 5+58QCKEMTm1G6wEeyp47JKLnZ1x+njG7Q+lIJUcM38aWh6yowO58mFYgyKalZDbue0+ 1qLPfGR/W9tyKYQHA8Sww5yYaD0gwUOyp+Bmb2yVggQxqyMFnRdBrI3xgWAjURAVk3RM 9cVVysIQFYj44zXkMXJifSLj1mToOl9oRsWidQM9qa+PBvOnAGwTQh0WnlszBIzPh945 zWkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=nmcAxKikSulRVz3kfnvdsmfLS3OmmDecDj8+CmC1PbY=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=RFnZw/y0kLdv+tt1Xd6UOxloj2s21Xf+opT9RiFUrSr7sOKVRjQABoqgkpGpE/a6sk V633opD/ZGV3t3BduhZ//hBDkKyYDtPpJUChMQOgERYMh5WoLVCmFQMhiB71w98uCkck glcz4YZJZsQXrg7wUFRdVCdyDjVdhiUqX3c6bPUz5icRc+ekXyzQ3R6Imri0aATnEQRD RHvOMkfPlwaKFCV2oCoVeqboTbmzL/DptP6D4yPRsn7iiMJ5Ev7Pwujl7uqYc8t3ZbtY xnZkV5LgDn9h+9RZXzjZlIzCF1ko2+Z/y0NdfcoM3zP1uC+chJXOAq11yq4Oi2tEB7mV 3Kjw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade35744bsi52642186d6.353.2025.03.14.23.33.47 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:33:47 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKwv-0006hc-Vq; Sat, 15 Mar 2025 02:24:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKv6-0003Rm-O9; Sat, 15 Mar 2025 02:22:53 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKv4-0003ro-Bh; Sat, 15 Mar 2025 02:22:52 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2FDA8FF9FB; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 02FCC1CAC64; Sat, 15 Mar 2025 09:18:02 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9C3E35590D; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.2.3 47/51] hw/net/smc91c111: Sanitize packet length on tx Date: Sat, 15 Mar 2025 09:17:53 +0300 Message-Id: <20250315061801.622606-47-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When the smc91c111 transmits a packet, it must read a control byte which is at the end of the data area and CRC. However, we don't sanitize the length field in the packet buffer, so if the guest sets the length field to something large we will try to read past the end of the packet data buffer when we access the control byte. As usual, the datasheet says nothing about the behaviour of the hardware if the guest misprograms it in this way. It says only that the maximum valid length is 2048 bytes. We choose to log the guest error and silently drop the packet. This requires us to factor out the "mark the tx packet as complete" logic, so we can call it for this "drop packet" case as well as at the end of the loop when we send a valid packet. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2742 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228174802.1945417-3-peter.maydell@linaro.org> [PMD: Update smc91c111_do_tx() as len > MAX_PACKET_SIZE] Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit aad6f264add3f2be72acb660816588fe09110069) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 48a6b3fb0d..aef5477d03 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -22,6 +22,13 @@ /* Number of 2k memory pages available. */ #define NUM_PACKETS 4 +/* + * Maximum size of a data frame, including the leading status word + * and byte count fields and the trailing CRC, last data byte + * and control byte (per figure 8-1 in the Microchip Technology + * LAN91C111 datasheet). + */ +#define MAX_PACKET_SIZE 2048 #define TYPE_SMC91C111 "smc91c111" OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111) @@ -240,6 +247,16 @@ static void smc91c111_release_packet(smc91c111_state *s, int packet) smc91c111_flush_queued_packets(s); } +static void smc91c111_complete_tx_packet(smc91c111_state *s, int packetnum) +{ + if (s->ctr & CTR_AUTO_RELEASE) { + /* Race? */ + smc91c111_release_packet(s, packetnum); + } else if (s->tx_fifo_done_len < NUM_PACKETS) { + s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; + } +} + /* Flush the TX FIFO. */ static void smc91c111_do_tx(smc91c111_state *s) { @@ -263,6 +280,17 @@ static void smc91c111_do_tx(smc91c111_state *s) *(p++) = 0x40; len = *(p++); len |= ((int)*(p++)) << 8; + if (len > MAX_PACKET_SIZE) { + /* + * Datasheet doesn't say what to do here, and there is no + * relevant tx error condition listed. Log, and drop the packet. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: tx packet with bad length %d, dropping\n", + len); + smc91c111_complete_tx_packet(s, packetnum); + continue; + } len -= 6; control = p[len + 1]; if (control & 0x20) @@ -291,11 +319,7 @@ static void smc91c111_do_tx(smc91c111_state *s) } } #endif - if (s->ctr & CTR_AUTO_RELEASE) - /* Race? */ - smc91c111_release_packet(s, packetnum); - else if (s->tx_fifo_done_len < NUM_PACKETS) - s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; + smc91c111_complete_tx_packet(s, packetnum); qemu_send_packet(qemu_get_queue(s->nic), p, len); } s->tx_fifo_len = 0; From patchwork Sat Mar 15 06:17:54 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873835 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062170wrq; Fri, 14 Mar 2025 23:25:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXCGVFGzq7jm8MBaw2hbWih8NR8PabnIbjNH3dNkfUcq5Q8t4G+iDmVlYm5jCDFU71BBhdwRg==@linaro.org X-Google-Smtp-Source: AGHT+IHOUMbuq5PRawuxI+Fxu2h77qpqDsYLIKLnu8l4p5Bt4I5kY0g3S/I6J5I8InwMB4urrAVL X-Received: by 2002:a05:622a:13c8:b0:472:167a:6dad with SMTP id d75a77b69052e-476c81e6da4mr82419541cf.47.1742019959511; Fri, 14 Mar 2025 23:25:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742019959; cv=none; d=google.com; s=arc-20240605; b=MFpGv+tHT2AABmR4JRN+S7vVOPmMbQOaN8D4q/FivK0XWMhk7e1DyoV/0TvNYM/xr1 qyTgTW9yx6jGxRBZTEibndaIOR8zGCsnhO5cmIfhYYL9LLTeil2KjOwc+Ht3ggmVy4wn QZXHEJ1ZxT2/t7kBwEFoER+OlKCHGASWIRi02AO+ftHGI0+UI2GgiY+ZZPXrncGL/xz2 4EfYKrOzEsUEk2GkcXsp7WXpq2a8GL4GQcAH95SXMwzDyMPcztzJWamXe1Dgb2zqbhCU fc/jmR/pp4EZa1Yt/U7+P4pZxSK0N3pLMxS59P1waEO0s+rg4Mf+Qu25RR33e+X1icjk rRCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=ruYdHUWzFV5T39wR6A5vuVg0y/fDxtw1/KjWVo3OJ10=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=Pf5PQOoOcDtcZJRDROGDYCsJZpTIVTo9v2JyYoPtlPhD8N7KnjTf4NLZrVY75SN55w 8OA+lZ/bkR19KUzyDmNIYJ61dV5d+5YqtWNBAk1wjyQ5RZUMD2eU21MNrOtX/SlcBPy1 nLt5TWAu+6GOOGxeD7Q/Ucvs0LU7ivhijTZlEMgzAC6F3wSCr0SN+zkVgWZXt4RJbG1F uhV4VP5vbyWSbVVVNeNsjofWtC15RAVESufYHI156SLytCb46/Jlo1OAUXs/OxFh9CuW YSvdBIPaqJ4qjyuW3RKZrGq7kABEqrlmngaQlqNaekbQTFouLfRlf57aySSLZb//GdlN 8kNg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb619b89si50242521cf.127.2025.03.14.23.25.59 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:25:59 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKxJ-00079X-Ne; Sat, 15 Mar 2025 02:25:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKv7-0003T0-2u; Sat, 15 Mar 2025 02:22:53 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKv4-0003s0-Mq; Sat, 15 Mar 2025 02:22:52 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 339BEFF9FC; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 079D81CAC65; Sat, 15 Mar 2025 09:18:02 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9EB7E5590F; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.2.3 48/51] hw/net/smc91c111: Don't allow data register access to overrun buffer Date: Sat, 15 Mar 2025 09:17:54 +0300 Message-Id: <20250315061801.622606-48-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell For accesses to the 91c111 data register, the address within the packet's data frame is determined by a combination of the pointer register and the offset used to access the data register, so that you can access data at effectively wider than byte width. The pointer register's pointer field is 11 bits wide, which is exactly the size to index a 2048-byte data frame. We weren't quite getting the logic right for ensuring that we end up with a pointer value to use in the s->data[][] array that isn't out of bounds: * we correctly mask when getting the initial pointer value * for the "autoincrement the pointer register" case, we correctly mask after adding 1 so that the pointer register wraps back around at the 2048 byte mark * but for the non-autoincrement case where we have to add the low 2 bits of the data register offset, we don't account for the possibility that the pointer register is 0x7ff and the addition should wrap Fix this bug by factoring out the "get the p value to use as an array index" into a function, making it use FIELD macro names rather than hard-coded constants, and having a utility function that does "add a value and wrap it" that we can use both for the "autoincrement" and "add the offset bits" codepaths. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2758 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228191652.1957208-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 700d3d6dd41de3bd3f1153e3cfe00b93f99b1441) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index aef5477d03..60a252d01a 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -13,6 +13,7 @@ #include "net/net.h" #include "hw/irq.h" #include "hw/net/smc91c111.h" +#include "hw/registerfields.h" #include "hw/qdev-properties.h" #include "qapi/error.h" #include "qemu/log.h" @@ -125,6 +126,13 @@ static const VMStateDescription vmstate_smc91c111 = { #define RS_TOOSHORT 0x0400 #define RS_MULTICAST 0x0001 +FIELD(PTR, PTR, 0, 11) +FIELD(PTR, NOT_EMPTY, 11, 1) +FIELD(PTR, RESERVED, 12, 1) +FIELD(PTR, READ, 13, 1) +FIELD(PTR, AUTOINCR, 14, 1) +FIELD(PTR, RCV, 15, 1) + static inline bool packetnum_valid(int packet_num) { return packet_num >= 0 && packet_num < NUM_PACKETS; @@ -371,6 +379,49 @@ static void smc91c111_reset(DeviceState *dev) #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8) +/* + * The pointer register's pointer is an 11 bit value (so it exactly + * indexes a 2048-byte data frame). Add the specified offset to it, + * wrapping around at the 2048 byte mark, and return the resulting + * wrapped value. There are flag bits in the top part of the register, + * but we can ignore them here as the mask will mask them out. + */ +static int ptr_reg_add(smc91c111_state *s, int offset) +{ + return (s->ptr + offset) & R_PTR_PTR_MASK; +} + +/* + * For an access to the Data Register at @offset, return the + * required offset into the packet's data frame. This will + * perform the pointer register autoincrement if required, and + * guarantees to return an in-bounds offset. + */ +static int data_reg_ptr(smc91c111_state *s, int offset) +{ + int p; + + if (s->ptr & R_PTR_AUTOINCR_MASK) { + /* + * Autoincrement: use the current pointer value, and + * increment the pointer register's pointer field. + */ + p = FIELD_EX32(s->ptr, PTR, PTR); + s->ptr = FIELD_DP32(s->ptr, PTR, PTR, ptr_reg_add(s, 1)); + } else { + /* + * No autoincrement: register offset determines which + * byte we're addressing. Setting the pointer to the top + * of the data buffer and then using the pointer wrapping + * to read the bottom byte of the buffer is not something + * sensible guest software will do, but the datasheet + * doesn't say what the behaviour is, so we don't forbid it. + */ + p = ptr_reg_add(s, offset & 3); + } + return p; +} + static void smc91c111_writeb(void *opaque, hwaddr offset, uint32_t value) { @@ -517,12 +568,7 @@ static void smc91c111_writeb(void *opaque, hwaddr offset, n); return; } - p = s->ptr & 0x07ff; - if (s->ptr & 0x4000) { - s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); - } else { - p += (offset & 3); - } + p = data_reg_ptr(s, offset); s->data[n][p] = value; } return; @@ -672,12 +718,7 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset) n); return 0; } - p = s->ptr & 0x07ff; - if (s->ptr & 0x4000) { - s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); - } else { - p += (offset & 3); - } + p = data_reg_ptr(s, offset); return s->data[n][p]; } case 12: /* Interrupt status. */ From patchwork Sat Mar 15 06:17:55 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873844 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1062995wrq; Fri, 14 Mar 2025 23:30:20 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUkTZfPx4MNL3iEV9uT/FmjfTI4p9ZsbyVq2RG4qVb6C0ZdZNKX5SGYNYC/pGuHb4hqfyqxIg==@linaro.org X-Google-Smtp-Source: AGHT+IHP30llt+/8Fa/JO2eWFW+yorx0cZsq+W3I1y2dGmwSku6J4jMqbg/qJizmX4kGwVNeyxqo X-Received: by 2002:a05:6214:e48:b0:6e8:9394:cbbe with SMTP id 6a1803df08f44-6eaeaa2d10amr68455856d6.20.1742020220008; Fri, 14 Mar 2025 23:30:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742020219; cv=none; d=google.com; s=arc-20240605; b=YyfAZYVGHItv0cIr13k3VPbodTInJXiyaB/t4t2X5BBoLKljlsFwp2/0yo4NXJFGwW hIuK9HeElIVjxlz/QFITeloVSXHQd/4krDKvdY1QaOd0/LsuVex2c2oaFiNjfmVfTbef AgBxDPgzzjUxdGBNp3kskQIWNpDnpJvLymMEFcIsYldjNWd+d95GrUQISVtpxsgz2tD1 v5EdSMIsuWTX7fsME0FASPClwL7Fanfeeuz+luKkS3i6yz1dygiG+8gBPkCupOM1q1AR isu68Pi0CAco4VSXxuEmvZ3Eo1d/wsG4QofMzogOI0errtbiMD70+yB/FtLgJPakx8H9 Qggg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=uK2VWVCcjUT6XG8AvCzRCURo35eF/LydgZUNC+/RupQ=; fh=inIU3bgjueJc/0tVVGuzaeZ4IMkZrXwNnxEmi4ce+ts=; b=jyR937c6UjKAU0Mhq2FYtBlvewPtxb7wjU+xaDAiLbr3Zqa35csstNh8ouiDwyjFdV gLoFstHAZSNsvGHnDwX/YVeIvmjKvgjUIZrZGole91bFA9ky3fOp1/8hCiH/q5oTz3oB +eDxmyBFObIe4uoZjeTyKasSee24189gLxSv4ncSMced7dWOhSdblfFfl4tOtRgsjKZ+ oZi7PSmprIVrXH/nyzbVjcrz0tW1jcK8DzpHR+8o1gday2HdPT17BTOa2relZS3rFQVA auM8JcLtU6Bwn22q3yGW7od+9GrqFwOK6B9aSu17ahWlO3GgIq8DC7nZsSMd5oAwd6ld dbFQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade33cb3asi53434106d6.204.2025.03.14.23.30.19 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 14 Mar 2025 23:30:19 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttKxd-0007jt-UC; Sat, 15 Mar 2025 02:25:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKvA-0003fZ-6G; Sat, 15 Mar 2025 02:22:56 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttKv8-0003t8-8Q; Sat, 15 Mar 2025 02:22:55 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3590CFF9FD; Sat, 15 Mar 2025 09:17:08 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 0C12A1CAC66; Sat, 15 Mar 2025 09:18:02 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A100F55911; Sat, 15 Mar 2025 09:18:01 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Pierrick Bouvier , Richard Henderson , Michael Tokarev Subject: [Stable-9.2.3 49/51] hw/xen/hvm: Fix Aarch64 typo Date: Sat, 15 Mar 2025 09:17:55 +0300 Message-Id: <20250315061801.622606-49-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé There is no TARGET_ARM_64 definition. Luckily enough, when TARGET_AARCH64 is defined, TARGET_ARM also is. Fixes: 733766cd373 ("hw/arm: introduce xenpvh machine") Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Reviewed-by: Richard Henderson Message-Id: <20250305153929.43687-2-philmd@linaro.org> (cherry picked from commit 3a11b653a63fee0e43f4ab84b93f068b961d8fe7) Signed-off-by: Michael Tokarev diff --git a/include/hw/xen/arch_hvm.h b/include/hw/xen/arch_hvm.h index c7c515220d..df39c819c8 100644 --- a/include/hw/xen/arch_hvm.h +++ b/include/hw/xen/arch_hvm.h @@ -1,5 +1,5 @@ #if defined(TARGET_I386) || defined(TARGET_X86_64) #include "hw/i386/xen_arch_hvm.h" -#elif defined(TARGET_ARM) || defined(TARGET_ARM_64) +#elif defined(TARGET_ARM) || defined(TARGET_AARCH64) #include "hw/arm/xen_arch_hvm.h" #endif