From patchwork Sat Mar 15 07:42:17 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873853 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080545wrq; Sat, 15 Mar 2025 00:44:57 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWzWXlnm1ew1wd01VbGm3z+kSB2Z2tIXAzQB5/T9EAHeMbok2M02XRlMnzIJKHX+r9xLSePmQ==@linaro.org X-Google-Smtp-Source: AGHT+IGhaVvnwLDlfwAdnL4um8+kVhOLRrl3uyIZ2uV6C87as9AZbtvTp2Y1dM34N+nqv7ddU5/u X-Received: by 2002:a05:620a:2624:b0:7c5:4be5:b0b3 with SMTP id af79cd13be357-7c57c91ee37mr869510885a.48.1742024697576; Sat, 15 Mar 2025 00:44:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024697; cv=none; d=google.com; s=arc-20240605; b=ZrGhjCJOA7H3onvHxsquvy0XkZ7S0CrfatUAEUoH5MIgSELNG3mjvmBb2mWZewqMN3 LsdVgU+RAghuqZLMTMGBG36D4CrzZR49IAAOamhMqXigs4FpdWK5Ergn7LRb3QMFgRfh 2zUOp4vj9QplkEskOA8Xke4aACRd5p8qcBsw5Vgj3LEt/UQDHsX0dHwUKh786NGYAIY7 BVB6aVAbfdMqlctW0KgooqGqdis5ElUmssgca+vLaoeVpeBygY2dezY7xJdqJp9Ywjmw 54G+LzPlzO76rl4bkQcglyyxUlswLiFyHZCsWdAnZZsbdArnnVHJbEGGq/9SJenRPPnx PxAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=RHl52CdB2+xY3fCHNTgGM0+e06yUqAAVJ9bDXeyhh20=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=cLdu4zAspR4APz0M+nvT2urAHJhCPPowgHa+P2aZz+ME8odCrnQ36e+eXH2yKAnfvS N6rZcxfJaYfDRglJwK3PzFhjGniGNsyQL5SHq7oM/ijjsEjdRDipz1PeOxKj6qY8d+Td IhI7XPKKCTjV83S9jOrx7prac37u9M2q9S9k8YY/IUziUUUZPRsnNaG3Vhh46XU++0w/ 8YtZpb4tPthrtSedOUyRs09hwDzpKI3go5FFBRYwNRrHsVSz088UEbuEsGGz/+q9goP5 gRS9Z24tGr569BI36x+TkDIiR1xIArfy0o59/39zPjy5WofMRRhSRXyFxDS2dqPGUmtO csAA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573d18d7asi524799085a.554.2025.03.15.00.44.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:44:57 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMBN-0002ms-5J; Sat, 15 Mar 2025 03:43:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBK-0002k0-Fe; Sat, 15 Mar 2025 03:43:42 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBI-0004xB-85; Sat, 15 Mar 2025 03:43:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BBAF8FFB03; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A8B141CACCD; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7C142559F2; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 15/42] target/arm: Honour SDCR.TDCC and SCR.TERR in AArch32 EL3 non-Monitor modes Date: Sat, 15 Mar 2025 10:42:17 +0300 Message-Id: <20250315074249.634718-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell There are not many traps in AArch32 which should trap to Monitor mode, but these trap bits should trap not just lower ELs to Monitor mode but also the non-Monitor modes running at EL3 (i.e. Secure System, Secure Undef, etc). We get this wrong because the relevant access functions implement the AArch64-style logic of if (el < 3 && trap_bit_set) { return CP_ACCESS_TRAP_EL3; } which won't trap the non-Monitor modes at EL3. Correct this error by using arm_is_el3_or_mon() instead, which returns true when the CPU is at AArch64 EL3 or AArch32 Monitor mode. (Since the new callsites are compiled also for the linux-user mode, we need to provide a dummy implementation for CONFIG_USER_ONLY.) This affects only: * trapping of ERRIDR via SCR.TERR * trapping of the debug channel registers via SDCR.TDCC * trapping of GICv3 registers via SCR.IRQ and SCR.FIQ (which we already used arm_is_el3_or_mon() for) This patch changes the handling of SCR.TERR and SDCR.TDCC. This patch only changes guest-visible behaviour for "-cpu max" on the qemu-system-arm binary, because SCR.TERR and SDCR.TDCC (and indeed the entire SDCR register) only arrived in Armv8, and the only guest CPU we support which has any v8 features and also starts in AArch32 EL3 is the 32-bit 'max'. Other uses of CP_ACCESS_TRAP_EL3 don't need changing: * uses in code paths that can't happen when EL3 is AArch32: access_trap_aa32s_el1, cpacr_access, cptr_access, nsacr_access * uses which are in accessfns for AArch64-only registers: gt_stimer_access, gt_cntpoff_access, access_hxen, access_tpidr2, access_smpri, access_smprimap, access_lor_ns, access_pauth, access_mte, access_tfsr_el2, access_scxtnum, access_fgt * trap bits which exist only in the AArch64 version of the trap register, not the AArch32 one: access_tpm, pmreg_access, access_dbgvcr32, access_tdra, access_tda, access_tdosa (TPM, TDA and TDOSA exist only in MDCR_EL3, not in SDCR, and we enforce this in sdcr_write()) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-8-peter.maydell@linaro.org (cherry picked from commit 4d436fb05c2a1fff7befc815ebcbb04a14977448) Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index 3a45c35b75..c1b18b8478 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -2630,6 +2630,11 @@ static inline bool arm_is_secure_below_el3(CPUARMState *env) return false; } +static inline bool arm_is_el3_or_mon(CPUARMState *env) +{ + return false; +} + static inline ARMSecuritySpace arm_security_space(CPUARMState *env) { return ARMSS_NonSecure; diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c index cbfba532f5..d0666500fa 100644 --- a/target/arm/debug_helper.c +++ b/target/arm/debug_helper.c @@ -870,7 +870,8 @@ static CPAccessResult access_tdcc(CPUARMState *env, const ARMCPRegInfo *ri, if (el < 2 && (mdcr_el2_tda || mdcr_el2_tdcc)) { return CP_ACCESS_TRAP_EL2; } - if (el < 3 && ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { + if (!arm_is_el3_or_mon(env) && + ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { return CP_ACCESS_TRAP_EL3; } return CP_ACCESS_OK; diff --git a/target/arm/helper.c b/target/arm/helper.c index 0d092bc99b..eff8563527 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6664,7 +6664,7 @@ static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri, if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) { return CP_ACCESS_TRAP_EL2; } - if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) { + if (!arm_is_el3_or_mon(env) && (env->cp15.scr_el3 & SCR_TERR)) { return CP_ACCESS_TRAP_EL3; } return CP_ACCESS_OK;