Arm patches for rc3 : just a handful of bug fixes.

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

* handle FTYPE flag correctly in v7M exception return

for v7M CPUs with an FPU (v8M CPUs were already correct)

* versal: Add the CRP as unimplemented

* Fix ISR_EL1 tracking when executing at EL2

* Honor HCR_EL2.TID3 trapping requirements

Edgar E. Iglesias (1):

hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):

target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):

target/arm: Fix ISR_EL1 tracking when executing at EL2

target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h | 3 ++

hw/arm/xlnx-versal.c | 2 ++

target/arm/helper.c | 83 ++++++++++++++++++++++++++++++++++++++++++--

target/arm/m_helper.c | 7 ++--

4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,

bit 4 of the LR should be set to NOT(CONTROL.PFCA) when

an FPU is present. Current implementation is doing it for

armv8, but not for armv7. This patch makes the existing

logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>

target/arm/m_helper.c | 7 +++----

1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

if (env->v7m.secure) {

lr |= R_V7M_EXCRET_S_MASK;

}

- if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {

- lr |= R_V7M_EXCRET_FTYPE_MASK;

- }

} else {

lr = R_V7M_EXCRET_RES1_MASK |

R_V7M_EXCRET_S_MASK |

R_V7M_EXCRET_DCRS_MASK |

- R_V7M_EXCRET_FTYPE_MASK |

R_V7M_EXCRET_ES_MASK;

if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {

lr |= R_V7M_EXCRET_SPSEL_MASK;

}

}

+ if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {

+ lr |= R_V7M_EXCRET_FTYPE_MASK;

if (!arm_v7m_is_handler_mode(env)) {

lr |= R_V7M_EXCRET_MODE_MASK;

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when

guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com

include/hw/arm/xlnx-versal.h | 3 +++

hw/arm/xlnx-versal.c | 2 ++

2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

#define MM_IOU_SCNTRS_SIZE 0x10000

#define MM_FPD_CRF 0xfd1a0000U

#define MM_FPD_CRF_SIZE 0x140000

+

+#define MM_PMC_CRP 0xf1260000U

+#define MM_PMC_CRP_SIZE 0x10000

#endif

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)

MM_CRL, MM_CRL_SIZE);

versal_unimp_area(s, "crf", &s->mr_ps,

MM_FPD_CRF, MM_FPD_CRF_SIZE);

+ versal_unimp_area(s, "crp", &s->mr_ps,

+ MM_PMC_CRP, MM_PMC_CRP_SIZE);

versal_unimp_area(s, "iou-scntr", &s->mr_ps,

MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);

versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,

2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,

ISR_EL1 shows the pending status of the physical IRQ, FIQ, or

SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2

bits, and ignores the current exception level. This means a hypervisor

trying to look at its own interrupt state actually sees the guest

state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits

if not running in a virtualized context.

Fixes: 636540e9c40b

Cc: qemu-stable@nongnu.org

Reported-by: Quentin Perret <qperret@google.com>

Signed-off-by: Marc Zyngier <maz@kernel.org>

Message-id: 20191122135833.28953-1-maz@kernel.org

target/arm/helper.c | 7 +++++--

1 file changed, 5 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)

CPUState *cs = env_cpu(env);

uint64_t hcr_el2 = arm_hcr_el2_eff(env);

uint64_t ret = 0;

+ bool allow_virt = (arm_current_el(env) == 1 &&

+ (!arm_is_secure_below_el3(env) ||

+ (env->cp15.scr_el3 & SCR_EEL2)));

- if (hcr_el2 & HCR_IMO) {

+ if (allow_virt && (hcr_el2 & HCR_IMO)) {

if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {

ret |= CPSR_I;

}

@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)

}

}

- if (hcr_el2 & HCR_FMO) {

+ if (allow_virt && (hcr_el2 & HCR_FMO)) {

if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {

ret |= CPSR_F;

}

2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id

registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,

while the hypervisor doesn't want to expose the feature to its guest.

To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this

case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes

that the feature is present in the HW, starts using it, and dies

a horrible death when KVM injects an UNDEF, because the feature

*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR

registers from AArch32 (they are accessed via the VMRS

instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>

Signed-off-by: Marc Zyngier <maz@kernel.org>

Tested-by: Will Deacon <will@kernel.org>

Message-id: 20191123115618.29230-1-maz@kernel.org

[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;

changed names of access functions to include _tid3]

target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 76 insertions(+)

+ .accessfn = access_aa64_tid3,

.resetvalue = cpu->id_aa64dfr0 },

2.20.1