Re: [PATCH] target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0

2023-09-28 Thread Michal Orzel 
Hi,

On 27/09/2023 17:49, Peter Maydell wrote:
> 
> 
> On Fri, 22 Sept 2023 at 14:21, Michal Orzel  wrote:
>>
>> On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
>> of Xen, a trap from EL2 was observed which is something not reproducible
>> on HW (also, Xen does not trap accesses to physical counter).
>>
>> This is because gt_counter_access() checks for an incorrect bit (1
>> instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
>> physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
>> When HCR_EL2.E2H is 0:
>>  - EL1PCTEN, bit [0]: refers to physical counter
>>  - EL1PCEN, bit [1]: refers to physical timer registers
>>
>> Fix it by checking for the right bit (i.e. 0) and update the comment
>> referring to incorrect bit name.
>>
>> Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
>> Signed-off-by: Michal Orzel 
>> ---
>> This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode:
>> if PSTATE.EL == EL0 then
>> ...
>> elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' 
>> then
>> AArch64.SystemAccessTrap(EL2, 0x18);
>> ---
>>  target/arm/helper.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/target/arm/helper.c b/target/arm/helper.c
>> index 3b22596eabf3..3a2d77b3f81e 100644
>> --- a/target/arm/helper.c
>> +++ b/target/arm/helper.c
>> @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState 
>> *env, int timeridx,
>>  return CP_ACCESS_TRAP_EL2;
>>  }
>>  } else {
>> -/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCEN. */
>> +/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCTEN. */
>>  if (has_el2 && timeridx == GTIMER_PHYS &&
>> -!extract32(env->cp15.cnthctl_el2, 1, 1)) {
>> +!extract32(env->cp15.cnthctl_el2, 0, 1)) {
>>  return CP_ACCESS_TRAP_EL2;
>>  }
>>  }
> 
> I agree that the current logic is not correct, but this change
> makes this code identical to the "case 1" handling, so we
> can delete the whole "if (hcr & HCR_E2H) { ... } else { ...  }"
> block and instead fall through, as we already do in gt_timer_access().
Ok, will do.

~Michal

Re: [PATCH] target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0

2023-09-27 Thread Peter Maydell 
On Fri, 22 Sept 2023 at 14:21, Michal Orzel  wrote:
>
> On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
> of Xen, a trap from EL2 was observed which is something not reproducible
> on HW (also, Xen does not trap accesses to physical counter).
>
> This is because gt_counter_access() checks for an incorrect bit (1
> instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
> physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
> When HCR_EL2.E2H is 0:
>  - EL1PCTEN, bit [0]: refers to physical counter
>  - EL1PCEN, bit [1]: refers to physical timer registers
>
> Fix it by checking for the right bit (i.e. 0) and update the comment
> referring to incorrect bit name.
>
> Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
> Signed-off-by: Michal Orzel 
> ---
> This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode:
> if PSTATE.EL == EL0 then
> ...
> elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' 
> then
> AArch64.SystemAccessTrap(EL2, 0x18);
> ---
>  target/arm/helper.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 3b22596eabf3..3a2d77b3f81e 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState 
> *env, int timeridx,
>  return CP_ACCESS_TRAP_EL2;
>  }
>  } else {
> -/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCEN. */
> +/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCTEN. */
>  if (has_el2 && timeridx == GTIMER_PHYS &&
> -!extract32(env->cp15.cnthctl_el2, 1, 1)) {
> +!extract32(env->cp15.cnthctl_el2, 0, 1)) {
>  return CP_ACCESS_TRAP_EL2;
>  }
>  }

I agree that the current logic is not correct, but this change
makes this code identical to the "case 1" handling, so we
can delete the whole "if (hcr & HCR_E2H) { ... } else { ...  }"
block and instead fall through, as we already do in gt_timer_access().

thanks
-- PMM

Re: [PATCH] target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0

2023-09-22 Thread Oleksandr Tyshchenko 


On 22.09.23 16:21, Michal Orzel wrote:

Hello Michal


> On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
> of Xen, a trap from EL2 was observed which is something not reproducible
> on HW (also, Xen does not trap accesses to physical counter).
> 
> This is because gt_counter_access() checks for an incorrect bit (1
> instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
> physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
> When HCR_EL2.E2H is 0:
>   - EL1PCTEN, bit [0]: refers to physical counter
>   - EL1PCEN, bit [1]: refers to physical timer registers
> 
> Fix it by checking for the right bit (i.e. 0) and update the comment
> referring to incorrect bit name.
> 
> Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
> Signed-off-by: Michal Orzel 


You can add my:

[with Zephyr running as Xen guest and accessing CNTPCT_EL0 from EL0 ]

Tested-by: Oleksandr Tyshchenko 

> ---
> This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode:
> if PSTATE.EL == EL0 then
> ...
>  elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' 
> then
>  AArch64.SystemAccessTrap(EL2, 0x18);
> ---
>   target/arm/helper.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 3b22596eabf3..3a2d77b3f81e 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState 
> *env, int timeridx,
>   return CP_ACCESS_TRAP_EL2;
>   }
>   } else {
> -/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCEN. */
> +/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCTEN. */
>   if (has_el2 && timeridx == GTIMER_PHYS &&
> -!extract32(env->cp15.cnthctl_el2, 1, 1)) {
> +!extract32(env->cp15.cnthctl_el2, 0, 1)) {
>   return CP_ACCESS_TRAP_EL2;
>   }
>   }

[PATCH] target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0

2023-09-22 Thread Michal Orzel 
On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
of Xen, a trap from EL2 was observed which is something not reproducible
on HW (also, Xen does not trap accesses to physical counter).

This is because gt_counter_access() checks for an incorrect bit (1
instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
When HCR_EL2.E2H is 0:
 - EL1PCTEN, bit [0]: refers to physical counter
 - EL1PCEN, bit [1]: refers to physical timer registers

Fix it by checking for the right bit (i.e. 0) and update the comment
referring to incorrect bit name.

Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
Signed-off-by: Michal Orzel 
---
This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode:
if PSTATE.EL == EL0 then
...
elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' then
AArch64.SystemAccessTrap(EL2, 0x18);
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3b22596eabf3..3a2d77b3f81e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState *env, 
int timeridx,
 return CP_ACCESS_TRAP_EL2;
 }
 } else {
-/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCEN. */
+/* If HCR_EL2. == 0: check CNTHCTL_EL2.EL1PCTEN. */
 if (has_el2 && timeridx == GTIMER_PHYS &&
-!extract32(env->cp15.cnthctl_el2, 1, 1)) {
+!extract32(env->cp15.cnthctl_el2, 0, 1)) {
 return CP_ACCESS_TRAP_EL2;
 }
 }
-- 
2.25.1