Re: [Qemu-devel] [PATCH v2 1/6] target-arm: correct CNTFRQ access rights

[Edgar E. Iglesias]

On Thu, Feb 11, 2016 at 04:03:24PM +, Peter Maydell wrote:
> Correct some corner cases we were getting wrong for
> CNTFRQ access rights:
>  * should UNDEF from 32-bit Secure EL1
>  * only writable from the highest implemented exception level,
>which might not be EL1 now
> 
> To clarify the code, provide a new utility function
> arm_highest_el() which returns the highest implemented
> exception level.

Reviewed-by: Edgar E. Iglesias 


> 
> Signed-off-by: Peter Maydell 
> ---
> Rewritten to use arm_highest_el() to improve clarity
> ---
>  target-arm/cpu.h| 12 
>  target-arm/helper.c | 29 ++---
>  2 files changed, 38 insertions(+), 3 deletions(-)
> 
> diff --git a/target-arm/cpu.h b/target-arm/cpu.h
> index 5137632..afbf366 100644
> --- a/target-arm/cpu.h
> +++ b/target-arm/cpu.h
> @@ -1255,6 +1255,18 @@ static inline bool cptype_valid(int cptype)
>  #define PL1_RW (PL1_R | PL1_W)
>  #define PL0_RW (PL0_R | PL0_W)
>  
> +/* Return the highest implemented Exception Level */
> +static inline int arm_highest_el(CPUARMState *env)
> +{
> +if (arm_feature(env, ARM_FEATURE_EL3)) {
> +return 3;
> +}
> +if (arm_feature(env, ARM_FEATURE_EL2)) {
> +return 2;
> +}
> +return 1;
> +}
> +
>  /* Return the current Exception Level (as per ARMv8; note that this differs
>   * from the ARMv7 Privilege Level).
>   */
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index 2f9db72..4d27c00 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -1218,10 +1218,33 @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
>  static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo 
> *ri,
> bool isread)
>  {
> -/* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
> -if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) 
> {
> -return CP_ACCESS_TRAP;
> +/* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
> + * Writable only at the highest implemented exception level.
> + */
> +int el = arm_current_el(env);
> +
> +switch (el) {
> +case 0:
> +if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
> +return CP_ACCESS_TRAP;
> +}
> +break;
> +case 1:
> +if (!isread && ri->state == ARM_CP_STATE_AA32 &&
> +arm_is_secure_below_el3(env)) {
> +/* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
> +return CP_ACCESS_TRAP_UNCATEGORIZED;
> +}
> +break;
> +case 2:
> +case 3:
> +break;
>  }
> +
> +if (!isread && el < arm_highest_el(env)) {
> +return CP_ACCESS_TRAP_UNCATEGORIZED;
> +}
> +
>  return CP_ACCESS_OK;
>  }
>  
> -- 
> 1.9.1
> 

[Qemu-devel] [PATCH v2 1/6] target-arm: correct CNTFRQ access rights

[Peter Maydell]

Correct some corner cases we were getting wrong for
CNTFRQ access rights:
 * should UNDEF from 32-bit Secure EL1
 * only writable from the highest implemented exception level,
   which might not be EL1 now

To clarify the code, provide a new utility function
arm_highest_el() which returns the highest implemented
exception level.

Signed-off-by: Peter Maydell 
---
Rewritten to use arm_highest_el() to improve clarity
---
 target-arm/cpu.h| 12 
 target-arm/helper.c | 29 ++---
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 5137632..afbf366 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -1255,6 +1255,18 @@ static inline bool cptype_valid(int cptype)
 #define PL1_RW (PL1_R | PL1_W)
 #define PL0_RW (PL0_R | PL0_W)
 
+/* Return the highest implemented Exception Level */
+static inline int arm_highest_el(CPUARMState *env)
+{
+if (arm_feature(env, ARM_FEATURE_EL3)) {
+return 3;
+}
+if (arm_feature(env, ARM_FEATURE_EL2)) {
+return 2;
+}
+return 1;
+}
+
 /* Return the current Exception Level (as per ARMv8; note that this differs
  * from the ARMv7 Privilege Level).
  */
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 2f9db72..4d27c00 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1218,10 +1218,33 @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo 
*ri,
bool isread)
 {
-/* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
-if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
-return CP_ACCESS_TRAP;
+/* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
+ * Writable only at the highest implemented exception level.
+ */
+int el = arm_current_el(env);
+
+switch (el) {
+case 0:
+if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
+return CP_ACCESS_TRAP;
+}
+break;
+case 1:
+if (!isread && ri->state == ARM_CP_STATE_AA32 &&
+arm_is_secure_below_el3(env)) {
+/* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
+return CP_ACCESS_TRAP_UNCATEGORIZED;
+}
+break;
+case 2:
+case 3:
+break;
 }
+
+if (!isread && el < arm_highest_el(env)) {
+return CP_ACCESS_TRAP_UNCATEGORIZED;
+}
+
 return CP_ACCESS_OK;
 }
 
-- 
1.9.1

Re: [Qemu-devel] [PATCH v2 1/6] target-arm: correct CNTFRQ access rights

[Sergey Fedorov]

On 11.02.2016 19:03, Peter Maydell wrote:
> Correct some corner cases we were getting wrong for
> CNTFRQ access rights:
>  * should UNDEF from 32-bit Secure EL1
>  * only writable from the highest implemented exception level,
>which might not be EL1 now
>
> To clarify the code, provide a new utility function
> arm_highest_el() which returns the highest implemented
> exception level.
>
> Signed-off-by: Peter Maydell 

Reviewed-by: Sergey Fedorov 

> ---
> Rewritten to use arm_highest_el() to improve clarity
> ---
>  target-arm/cpu.h| 12 
>  target-arm/helper.c | 29 ++---
>  2 files changed, 38 insertions(+), 3 deletions(-)
>
> diff --git a/target-arm/cpu.h b/target-arm/cpu.h
> index 5137632..afbf366 100644
> --- a/target-arm/cpu.h
> +++ b/target-arm/cpu.h
> @@ -1255,6 +1255,18 @@ static inline bool cptype_valid(int cptype)
>  #define PL1_RW (PL1_R | PL1_W)
>  #define PL0_RW (PL0_R | PL0_W)
>  
> +/* Return the highest implemented Exception Level */
> +static inline int arm_highest_el(CPUARMState *env)
> +{
> +if (arm_feature(env, ARM_FEATURE_EL3)) {
> +return 3;
> +}
> +if (arm_feature(env, ARM_FEATURE_EL2)) {
> +return 2;
> +}
> +return 1;
> +}
> +
>  /* Return the current Exception Level (as per ARMv8; note that this differs
>   * from the ARMv7 Privilege Level).
>   */
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index 2f9db72..4d27c00 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -1218,10 +1218,33 @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
>  static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo 
> *ri,
> bool isread)
>  {
> -/* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
> -if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) 
> {
> -return CP_ACCESS_TRAP;
> +/* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
> + * Writable only at the highest implemented exception level.
> + */
> +int el = arm_current_el(env);
> +
> +switch (el) {
> +case 0:
> +if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
> +return CP_ACCESS_TRAP;
> +}
> +break;
> +case 1:
> +if (!isread && ri->state == ARM_CP_STATE_AA32 &&
> +arm_is_secure_below_el3(env)) {
> +/* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
> +return CP_ACCESS_TRAP_UNCATEGORIZED;
> +}
> +break;
> +case 2:
> +case 3:
> +break;
>  }
> +
> +if (!isread && el < arm_highest_el(env)) {
> +return CP_ACCESS_TRAP_UNCATEGORIZED;
> +}
> +
>  return CP_ACCESS_OK;
>  }
>