Series comparison

 [PATCH v5 0/2] target/loongarch: fix 'make check-functional' failed
 ...
    value may  has been initialized to 0. we need just check the tlb_e
    skip the function and check tlb_ps write a guest log.
 . csrwr instructions.
    to make sure CSR_PWCL.PTBASE and CSR_STLBPS.PS bits are avalable,
    cheke theses bits and set a default value from CSR_PRCFG2.
+v7:
+  clean code and rebase.
+v6:
+clean code. fix code style.
+rebase and R-b.
 V5:
 Add add chek_ps() function to check tlb_ps with CSR_PRCFG2;
 Some tlb instuctions, just check tlb_ps, do't rewrite the tlb_ps
   bits  just write a guest log;
 ...

-[PATCH v5 1/2] target/loongarch: fix 'make check-functional' failed
+[PATCH v7 1/2] target/loongarch: fix 'make check-functional' failed
  some tlb instructions get  the tlb_ps from tlb->misc but the
  value may has been initialized to 0,just check the tlb_ps skip
  the function and write a log.
 Signed-off-by: Song Gao <gaosong@loongson.cn>
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
 ---
- target/loongarch/tcg/tlb_helper.c | 8 ++++++++
+ target/loongarch/tcg/tlb_helper.c | 12 ++++++++++++
-file changed, 8 insertions(+)
+file changed, 12 insertions(+)
 diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/tcg/tlb_helper.c
 +++ b/target/loongarch/tcg/tlb_helper.c
+@@ -XXX,XX +XXX,XX @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
+     uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
+     uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
+     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
++    uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
++    if (!tlb_e) {
++        return;
++    }
+     if (index >= LOONGARCH_STLB) {
+         tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
+     } else {
 @@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
          uint16_t tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
          uint64_t vpn, tlb_vppn;
          uint8_t tlb_ps, compare_shift;
 +        uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-+        if (!tlb_e){
++        if (!tlb_e) {
 +            continue;
 +        }
          if (i >= LOONGARCH_STLB) {
              tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
          } else {
 @@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
          uint16_t tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
          uint64_t vpn, tlb_vppn;
          uint8_t tlb_ps, compare_shift;
 +        uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-+        if (!tlb_e){
++        if (!tlb_e) {
 +            continue;
 +        }
          if (i >= LOONGARCH_STLB) {
              tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
          } else {
 --
 .34.1

-[PATCH v5 2/2] target/loongarch: check tlb_ps
+[PATCH v7 2/2] target/loongarch: check tlb_ps
 ...
    to make sure CSR_PWCL.PTBASE and CSR_STLBPS.PS bits are avalable,
    cheke theses bits and set a default value from CSR_PRCFG2.
 Signed-off-by: Song Gao <gaosong@loongson.cn>
 ---
- target/loongarch/cpu.c                        | 10 ++--
+ target/loongarch/cpu.c                        | 11 +++++---
  target/loongarch/cpu_helper.c                 |  8 +++-
  target/loongarch/helper.h                     |  1 +
- target/loongarch/internals.h                  |  2 +
+ target/loongarch/internals.h                  |  2 ++
- target/loongarch/tcg/csr_helper.c             | 30 +++++++++++-
+ target/loongarch/tcg/csr_helper.c             | 27 +++++++++++++++++--
  .../tcg/insn_trans/trans_privileged.c.inc     |  1 +
- target/loongarch/tcg/tlb_helper.c             | 46 ++++++++++++++++++-
+ target/loongarch/tcg/tlb_helper.c             | 23 ++++++++++++++--
-files changed, 90 insertions(+), 8 deletions(-)
+files changed, 58 insertions(+), 7 deletions(-)
 diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/cpu.c
 +++ b/target/loongarch/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void loongarch_max_initfn(Object *obj)
+ static void loongarch_cpu_reset_hold(Object *obj, ResetType type)
+ {
++    uint8_t tlb_ps;
+     CPUState *cs = CPU(obj);
+     LoongArchCPUClass *lacc = LOONGARCH_CPU_GET_CLASS(obj);
+     CPULoongArchState *env = cpu_env(cs);
 @@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_reset_hold(Object *obj, ResetType type)
       */
      env->CSR_PGDH = 0;
      env->CSR_PGDL = 0;
 -    env->CSR_PWCL = 0;
 ...
      env->CSR_TLBRENTRY = 0;
      env->CSR_MERRENTRY = 0;
 -
 +    /* set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits from CSR_PRCFG2 */
 +    if (env->CSR_PRCFG2 == 0) {
-+        env->CSR_PRCFG2 =0x3fffff000;
++        env->CSR_PRCFG2 = 0x3fffff000;
 +    }
-+    int tlb_ps = clz32(env->CSR_PRCFG2);
++    tlb_ps = ctz32(env->CSR_PRCFG2);
 +    env->CSR_STLBPS = FIELD_DP64(env->CSR_STLBPS, CSR_STLBPS, PS, tlb_ps);
 +    env->CSR_PWCL = FIELD_DP64(env->CSR_PWCL, CSR_PWCL, PTBASE, tlb_ps);
      for (n = 0; n < 4; n++) {
          env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV0, 0);
          env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV1, 0);
-diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/loongarch/cpu_helper.c
-+++ b/target/loongarch/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
-                 *index = i * 256 + stlb_idx;
-                 return true;
-             }
--        }
-+        } else {
-+        continue;
-+    }
-     }
-     /* Search MTLB */
-@@ -XXX,XX +XXX,XX @@ bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
-                 *index = i;
-                 return true;
-             }
--        }
-+        } else {
-+        continue;
-+    }
-     }
-     return false;
- }
 diff --git a/target/loongarch/helper.h b/target/loongarch/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/helper.h
 +++ b/target/loongarch/helper.h
 @@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(rdtime_d, i64, env)
 ...
 +++ b/target/loongarch/tcg/csr_helper.c
 @@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "cpu-csr.h"
-+
-+
 +target_ulong helper_csrwr_stlbps(CPULoongArchState *env, target_ulong val)
 +{
 +    int64_t old_v = env->CSR_STLBPS;
-+    uint8_t default_ps = ctz32(env->CSR_PRCFG2);
 +
 +    /*
 +     * The real hardware only supports the min tlb_ps is 12
 +     * tlb_ps=0 may cause undefined-behavior.
 +     */
 +    uint8_t tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
 +    if (!check_ps(env, tlb_ps)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "Attempted set ps %d\n",tlb_ps);
++                      "Attempted set ps %d\n", tlb_ps);
-+        val = FIELD_DP64(val, CSR_STLBPS, PS, default_ps);
++        return old_v;
 +    }
 +    env->CSR_STLBPS = val;
 +    return old_v;
 +}
 +
  target_ulong helper_csrrd_pgd(CPULoongArchState *env)
  {
 ...
  target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
  {
 -    int shift;
 +    int shift, ptbase;
      int64_t old_v = env->CSR_PWCL;
-+    uint8_t default_ps = ctz32(env->CSR_PRCFG2);
      /*
-      * The real hardware only supports 64bit PTE width now, 128bit or others
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
       * treated as illegal.
       */
      shift = FIELD_EX64(val, CSR_PWCL, PTEWIDTH);
 +    ptbase = FIELD_EX64(val, CSR_PWCL, PTBASE);
      if (shift) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "Attempted set pte width with %d bit\n", 64 << shift);
          val = FIELD_DP64(val, CSR_PWCL, PTEWIDTH, 0);
      }
++    env->CSR_PWCL =val;
 +    if (!check_ps(env, ptbase)) {
 +         qemu_log_mask(LOG_GUEST_ERROR,
 +                      "Attrmpted set ptbase 2^%d\n", ptbase);
-+         val = FIELD_DP64(val, CSR_PWCL, PTBASE, default_ps);
++         return old_v;
 +    }
-     env->CSR_PWCL = val;
+-    env->CSR_PWCL = val;
      return old_v;
+ }
 diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
 +++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
 @@ -XXX,XX +XXX,XX @@ static bool set_csr_trans_func(unsigned int csr_num, GenCSRRead readfn,
 ...
  #include "exec/log.h"
  #include "cpu-csr.h"
 +bool check_ps(CPULoongArchState *env, int tlb_ps)
 +{
-+     if(tlb_ps > 64){
++     if (tlb_ps > 64) {
 +         return false;
 +     }
-+     return BIT_ULL(tlb_ps) && (env->CSR_PRCFG2);
++     return BIT_ULL(tlb_ps) & (env->CSR_PRCFG2);
 +}
 +
  void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                                 uint64_t *dir_width, target_ulong level)
  {
-@@ -XXX,XX +XXX,XX @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
-     uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
-     uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
-     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-+    uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-+
-+    if (!tlb_e){
-+        return;
-+    }
-     if (index >= LOONGARCH_STLB) {
-         tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-     } else {
-         tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-     }
-+    if (!check_ps(env,tlb_ps)) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
-+        return;
-+    }
-     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
-     mask = MAKE_64BIT_MASK(0, tlb_ps + 1);
 @@ -XXX,XX +XXX,XX @@ static void fill_tlb_entry(CPULoongArchState *env, int index)
          lo1 = env->CSR_TLBELO1;
      }
 -    if (csr_ps == 0) {
 ...
 +        qemu_log_mask(LOG_GUEST_ERROR, "csr_ps %d is illegal\n", csr_ps);
 +        return;
      }
      /* Only MTLB has the ps fields */
-@@ -XXX,XX +XXX,XX @@ void helper_tlbrd(CPULoongArchState *env)
-     }
-     tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-+    if (!check_ps(env, tlb_ps)) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
-+        return;
-+    }
-     if (!tlb_e) {
-         /* Invalid TLB entry */
-         env->CSR_TLBIDX = FIELD_DP64(env->CSR_TLBIDX, CSR_TLBIDX, NE, 1);
 @@ -XXX,XX +XXX,XX @@ void helper_tlbfill(CPULoongArchState *env)
          pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
      }
 +    if (!check_ps(env, pagesize)) {
 ...
 +        return;
 +    }
      if (pagesize == stlb_ps) {
          /* Only write into STLB bits [47:13] */
-@@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
-         } else {
-             tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-         }
-+        if (!check_ps(env, tlb_ps)) {
-+            qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
-+            return;
-+        }
-         tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-         vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
-         compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
-@@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
-         } else {
-             tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-         }
-+        if (!check_ps(env, tlb_ps)) {
-+            qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
-+            return;
-+        }
-+
-+
-         tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-         vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
-         compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
 --
 .34.1

Some tlb instructions get the tlb_ps from tlb->misc but the
 value may has been initialized to 0,just check the tlb_e skip
 the function and check_tlb_ps write a log.

For LoongArch th min tlb_ps is 12(4KB), for TLB code,
the tlb_ps may be 0,this may case UndefinedBehavior
Add a check-tlb_ps fuction to check tlb_ps,
to make sure the tlb_ps is avalablie. we check tlb_ps
when get the tlb_ps from tlb->misc or CSR bits.
1. cpu reset.
   set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits a default value
   from CSR_PRCFG2;
2. tlb instructions.
   some tlb instructions get  the tlb_ps from tlb->misc but the
   value may  has been initialized to 0. we need just check the tlb_e
   skip the function and check tlb_ps write a guest log.
3. csrwr instructions.
   to make sure CSR_PWCL.PTBASE and CSR_STLBPS.PS bits are avalable,
   cheke theses bits and set a default value from CSR_PRCFG2.

V5:
  1 Add add chek_ps() function to check tlb_ps with CSR_PRCFG2;
  2 Some tlb instuctions, just check tlb_ps, do't rewrite the tlb_ps
  bits  just write a guest log;
  3 remove csrwr crmd helper function and crmd check PWCL and check CSR_STLBPS.just
chcek PWCL and STLBPS when csrwr CSR_PWCL and CSR_STLBPS;
  4 set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits a default value
   from CSR_PRCFG2 when cpu reset.
V4:
1.Get the default tlb_ps value from env->CSR_PRCFG2.
2.Some tlb  instrucions check the tlb_ps such as tlbfill/tlbwr/invtlb.
3.check_tlb_ps()just check CSR_PWCL.PTBASE bits and CSR_STLBPS.PS bits.
don't check all tlb->misc.

v3:
remove some tlb instruction chek MMU on PG model, because on DA model
also can use tlb instructions.

v2:
check-tlb_ps when write CSR_PWCL and CSR_STLBPS;
some tlb instructions check CRMD PG model when clear/read/write the tlb.
link to patch: https://patchew.org/QEMU/20250220012226.2182174-1-gaosong@loongson.cn/

Thanks.
Song Gao

Song Gao (2):
  target/loongarch: fix 'make check-functional' failed
  target/loongarch: check tlb_ps

target/loongarch/cpu.c                        | 10 +++-
 target/loongarch/cpu_helper.c                 |  8 ++-
 target/loongarch/helper.h                     |  1 +
 target/loongarch/internals.h                  |  2 +
 target/loongarch/tcg/csr_helper.c             | 30 +++++++++-
 .../tcg/insn_trans/trans_privileged.c.inc     |  1 +
 target/loongarch/tcg/tlb_helper.c             | 55 ++++++++++++++++++-
 7 files changed, 99 insertions(+), 8 deletions(-)

-- 
2.34.1

some tlb instructions get  the tlb_ps from tlb->misc but the
 value may has been initialized to 0,just check the tlb_ps skip
 the function and write a log.

Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

For LoongArch th min tlb_ps is 12(4KB), for TLB code,
the tlb_ps may be 0,this may case UndefinedBehavior
Add a check-tlb_ps fuction to check tlb_ps,
to make sure the tlb_ps is avalablie. we check tlb_ps
when get the tlb_ps from tlb->misc or CSR bits.
1. cpu reset
   set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits a default value
   from CSR_PRCFG2;
2. tlb instructions.
   some tlb instructions get  the tlb_ps from tlb->misc but the
   value may  has been initialized to 0. we need just check the tlb_ps
   skip the function and write a guest log.
3. csrwr instructions.
   to make sure CSR_PWCL.PTBASE and CSR_STLBPS.PS bits are avalable,
   cheke theses bits and set a default value from CSR_PRCFG2.

Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c                        | 10 ++--
 target/loongarch/cpu_helper.c                 |  8 +++-
 target/loongarch/helper.h                     |  1 +
 target/loongarch/internals.h                  |  2 +
 target/loongarch/tcg/csr_helper.c             | 30 +++++++++++-
 .../tcg/insn_trans/trans_privileged.c.inc     |  1 +
 target/loongarch/tcg/tlb_helper.c             | 46 ++++++++++++++++++-
 7 files changed, 90 insertions(+), 8 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_reset_hold(Object *obj, ResetType type)
      */
     env->CSR_PGDH = 0;
     env->CSR_PGDL = 0;
-    env->CSR_PWCL = 0;
     env->CSR_PWCH = 0;
-    env->CSR_STLBPS = 0;
     env->CSR_EENTRY = 0;
     env->CSR_TLBRENTRY = 0;
     env->CSR_MERRENTRY = 0;
-
+    /* set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits from CSR_PRCFG2 */
+    if (env->CSR_PRCFG2 == 0) {
+        env->CSR_PRCFG2 =0x3fffff000;
+    }
+    int tlb_ps = clz32(env->CSR_PRCFG2);
+    env->CSR_STLBPS = FIELD_DP64(env->CSR_STLBPS, CSR_STLBPS, PS, tlb_ps);
+    env->CSR_PWCL = FIELD_DP64(env->CSR_PWCL, CSR_PWCL, PTBASE, tlb_ps);
     for (n = 0; n < 4; n++) {
         env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV0, 0);
         env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV1, 0);
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
                 *index = i * 256 + stlb_idx;
                 return true;
             }
-        }
+        } else {
+	    continue;
+	}
     }
 
     /* Search MTLB */
@@ -XXX,XX +XXX,XX @@ bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
                 *index = i;
                 return true;
             }
-        }
+        } else {
+	    continue;
+	}
     }
     return false;
 }
diff --git a/target/loongarch/helper.h b/target/loongarch/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/helper.h
+++ b/target/loongarch/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(rdtime_d, i64, env)
 DEF_HELPER_1(csrrd_pgd, i64, env)
 DEF_HELPER_1(csrrd_cpuid, i64, env)
 DEF_HELPER_1(csrrd_tval, i64, env)
+DEF_HELPER_2(csrwr_stlbps, i64, env, tl)
 DEF_HELPER_2(csrwr_estat, i64, env, tl)
 DEF_HELPER_2(csrwr_asid, i64, env, tl)
 DEF_HELPER_2(csrwr_tcfg, i64, env, tl)
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -XXX,XX +XXX,XX @@ enum {
     TLBRET_PE = 7,
 };
 
+bool check_ps(CPULoongArchState *ent, int ps);
+
 extern const VMStateDescription vmstate_loongarch_cpu;
 
 void loongarch_cpu_set_irq(void *opaque, int irq, int level);
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "cpu-csr.h"
 
+
+
+target_ulong helper_csrwr_stlbps(CPULoongArchState *env, target_ulong val)
+{
+    int64_t old_v = env->CSR_STLBPS;
+    uint8_t default_ps = ctz32(env->CSR_PRCFG2);
+
+    /*
+     * The real hardware only supports the min tlb_ps is 12
+     * tlb_ps=0 may cause undefined-behavior.
+     */
+    uint8_t tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    if (!check_ps(env, tlb_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Attempted set ps %d\n",tlb_ps);
+        val = FIELD_DP64(val, CSR_STLBPS, PS, default_ps);
+    }
+    env->CSR_STLBPS = val;
+    return old_v;
+}
+
 target_ulong helper_csrrd_pgd(CPULoongArchState *env)
 {
     int64_t v;
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrwr_ticlr(CPULoongArchState *env, target_ulong val)
 
 target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
 {
-    int shift;
+    int shift, ptbase;
     int64_t old_v = env->CSR_PWCL;
+    uint8_t default_ps = ctz32(env->CSR_PRCFG2);
 
     /*
      * The real hardware only supports 64bit PTE width now, 128bit or others
      * treated as illegal.
      */
     shift = FIELD_EX64(val, CSR_PWCL, PTEWIDTH);
+    ptbase = FIELD_EX64(val, CSR_PWCL, PTBASE);
     if (shift) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "Attempted set pte width with %d bit\n", 64 << shift);
         val = FIELD_DP64(val, CSR_PWCL, PTEWIDTH, 0);
     }
+    if (!check_ps(env, ptbase)) {
+         qemu_log_mask(LOG_GUEST_ERROR,
+                      "Attrmpted set ptbase 2^%d\n", ptbase);
+         val = FIELD_DP64(val, CSR_PWCL, PTBASE, default_ps);
+    }
 
     env->CSR_PWCL = val;
     return old_v;
diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool set_csr_trans_func(unsigned int csr_num, GenCSRRead readfn,
 
 void loongarch_csr_translate_init(void)
 {
+    SET_CSR_FUNC(STLBPS, NULL, gen_helper_csrwr_stlbps);
     SET_CSR_FUNC(ESTAT, NULL, gen_helper_csrwr_estat);
     SET_CSR_FUNC(ASID,  NULL, gen_helper_csrwr_asid);
     SET_CSR_FUNC(PGD,   gen_helper_csrrd_pgd, NULL);
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/log.h"
 #include "cpu-csr.h"
 
+bool check_ps(CPULoongArchState *env, int tlb_ps)
+{
+     if(tlb_ps > 64){
+         return false;
+     }
+     return BIT_ULL(tlb_ps) && (env->CSR_PRCFG2);
+}
+
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                                uint64_t *dir_width, target_ulong level)
 {
@@ -XXX,XX +XXX,XX @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
     uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
+    uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
+
+    if (!tlb_e){
+        return;
+    }
 
     if (index >= LOONGARCH_STLB) {
         tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     } else {
         tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
     }
+    if (!check_ps(env,tlb_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
+        return;
+    }
     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
     mask = MAKE_64BIT_MASK(0, tlb_ps + 1);
 
@@ -XXX,XX +XXX,XX @@ static void fill_tlb_entry(CPULoongArchState *env, int index)
         lo1 = env->CSR_TLBELO1;
     }
 
-    if (csr_ps == 0) {
-        qemu_log_mask(CPU_LOG_MMU, "page size is 0\n");
+    /*check csr_ps */
+    if (!check_ps(env, csr_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "csr_ps %d is illegal\n", csr_ps);
+        return;
     }
 
     /* Only MTLB has the ps fields */
@@ -XXX,XX +XXX,XX @@ void helper_tlbrd(CPULoongArchState *env)
     }
     tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
 
+    if (!check_ps(env, tlb_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
+        return;
+    }
     if (!tlb_e) {
         /* Invalid TLB entry */
         env->CSR_TLBIDX = FIELD_DP64(env->CSR_TLBIDX, CSR_TLBIDX, NE, 1);
@@ -XXX,XX +XXX,XX @@ void helper_tlbfill(CPULoongArchState *env)
         pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
     }
 
+    if (!check_ps(env, pagesize)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "pagesize %d is illegal\n", pagesize);
+        return;
+    }
+
     stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    if (!check_ps(env, stlb_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "stlb_ps %d is illegal\n", stlb_ps);
+        return;
+    }
 
     if (pagesize == stlb_ps) {
         /* Only write into STLB bits [47:13] */
@@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
         } else {
             tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
         }
+        if (!check_ps(env, tlb_ps)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
+            return;
+        }
         tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
         vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
         compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
@@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
         } else {
             tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
         }
+        if (!check_ps(env, tlb_ps)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "tlb_ps %d is illegal\n", tlb_ps);
+            return;
+        }
+
+
         tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
         vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
         compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
-- 
2.34.1

Some tlb instructions get the tlb_ps from tlb->misc but the
 value may has been initialized to 0,just check the tlb_e skip
 the function and check_tlb_ps write a log.

v7:
  clean code and rebase.

v6:
  1 clean code. fix code style.
  2 rebase and R-b.

v3:
remove some tlb instruction chek MMU on PG model, because on DA model
also can use tlb instructions.

Thanks.
Song Gao

Song Gao (2):
  target/loongarch: fix 'make check-functional' failed
  target/loongarch: check tlb_ps

-- 
2.34.1

some tlb instructions get  the tlb_ps from tlb->misc but the
 value may has been initialized to 0,just check the tlb_ps skip
 the function and write a log.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
     uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
+    uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
 
+    if (!tlb_e) {
+        return;
+    }
     if (index >= LOONGARCH_STLB) {
         tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     } else {
@@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
         uint16_t tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
         uint64_t vpn, tlb_vppn;
         uint8_t tlb_ps, compare_shift;
+        uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
 
+        if (!tlb_e) {
+            continue;
+        }
         if (i >= LOONGARCH_STLB) {
             tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
         } else {
@@ -XXX,XX +XXX,XX @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
         uint16_t tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
         uint64_t vpn, tlb_vppn;
         uint8_t tlb_ps, compare_shift;
+        uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
 
+        if (!tlb_e) {
+            continue;
+        }
         if (i >= LOONGARCH_STLB) {
             tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
         } else {
-- 
2.34.1

For LoongArch th min tlb_ps is 12(4KB), for TLB code,
the tlb_ps may be 0,this may case UndefinedBehavior
Add a check-tlb_ps fuction to check tlb_ps,
to make sure the tlb_ps is avalablie. we check tlb_ps
when get the tlb_ps from tlb->misc or CSR bits.
1. cpu reset
   set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits a default value
   from CSR_PRCFG2;
2. tlb instructions.
   some tlb instructions get  the tlb_ps from tlb->misc but the
   value may  has been initialized to 0. we need just check the tlb_ps
   skip the function and write a guest log.
3. csrwr instructions.
   to make sure CSR_PWCL.PTBASE and CSR_STLBPS.PS bits are avalable,
   cheke theses bits and set a default value from CSR_PRCFG2.

Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c                        | 11 +++++---
 target/loongarch/helper.h                     |  1 +
 target/loongarch/internals.h                  |  2 ++
 target/loongarch/tcg/csr_helper.c             | 27 +++++++++++++++++--
 .../tcg/insn_trans/trans_privileged.c.inc     |  1 +
 target/loongarch/tcg/tlb_helper.c             | 23 ++++++++++++++--
 6 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -XXX,XX +XXX,XX @@ static void loongarch_max_initfn(Object *obj)
 
 static void loongarch_cpu_reset_hold(Object *obj, ResetType type)
 {
+    uint8_t tlb_ps;
     CPUState *cs = CPU(obj);
     LoongArchCPUClass *lacc = LOONGARCH_CPU_GET_CLASS(obj);
     CPULoongArchState *env = cpu_env(cs);
@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_reset_hold(Object *obj, ResetType type)
      */
     env->CSR_PGDH = 0;
     env->CSR_PGDL = 0;
-    env->CSR_PWCL = 0;
     env->CSR_PWCH = 0;
-    env->CSR_STLBPS = 0;
     env->CSR_EENTRY = 0;
     env->CSR_TLBRENTRY = 0;
     env->CSR_MERRENTRY = 0;
-
+    /* set CSR_PWCL.PTBASE and CSR_STLBPS.PS bits from CSR_PRCFG2 */
+    if (env->CSR_PRCFG2 == 0) {
+        env->CSR_PRCFG2 = 0x3fffff000;
+    }
+    tlb_ps = ctz32(env->CSR_PRCFG2);
+    env->CSR_STLBPS = FIELD_DP64(env->CSR_STLBPS, CSR_STLBPS, PS, tlb_ps);
+    env->CSR_PWCL = FIELD_DP64(env->CSR_PWCL, CSR_PWCL, PTBASE, tlb_ps);
     for (n = 0; n < 4; n++) {
         env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV0, 0);
         env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV1, 0);
diff --git a/target/loongarch/helper.h b/target/loongarch/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/helper.h
+++ b/target/loongarch/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(rdtime_d, i64, env)
 DEF_HELPER_1(csrrd_pgd, i64, env)
 DEF_HELPER_1(csrrd_cpuid, i64, env)
 DEF_HELPER_1(csrrd_tval, i64, env)
+DEF_HELPER_2(csrwr_stlbps, i64, env, tl)
 DEF_HELPER_2(csrwr_estat, i64, env, tl)
 DEF_HELPER_2(csrwr_asid, i64, env, tl)
 DEF_HELPER_2(csrwr_tcfg, i64, env, tl)
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -XXX,XX +XXX,XX @@ enum {
     TLBRET_PE = 7,
 };
 
+bool check_ps(CPULoongArchState *ent, int ps);
+
 extern const VMStateDescription vmstate_loongarch_cpu;
 
 void loongarch_cpu_set_irq(void *opaque, int irq, int level);
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "cpu-csr.h"
 
+target_ulong helper_csrwr_stlbps(CPULoongArchState *env, target_ulong val)
+{
+    int64_t old_v = env->CSR_STLBPS;
+
+    /*
+     * The real hardware only supports the min tlb_ps is 12
+     * tlb_ps=0 may cause undefined-behavior.
+     */
+    uint8_t tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    if (!check_ps(env, tlb_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Attempted set ps %d\n", tlb_ps);
+        return old_v;
+    }
+    return old_v;
+}
+
 target_ulong helper_csrrd_pgd(CPULoongArchState *env)
 {
     int64_t v;
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrwr_ticlr(CPULoongArchState *env, target_ulong val)
 
 target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
 {
-    int shift;
+    int shift, ptbase;
     int64_t old_v = env->CSR_PWCL;
 
     /*
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
      * treated as illegal.
      */
     shift = FIELD_EX64(val, CSR_PWCL, PTEWIDTH);
+    ptbase = FIELD_EX64(val, CSR_PWCL, PTBASE);
     if (shift) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "Attempted set pte width with %d bit\n", 64 << shift);
         val = FIELD_DP64(val, CSR_PWCL, PTEWIDTH, 0);
     }
+    env->CSR_PWCL =val;
+    if (!check_ps(env, ptbase)) {
+         qemu_log_mask(LOG_GUEST_ERROR,
+                      "Attrmpted set ptbase 2^%d\n", ptbase);
+         return old_v;
+    }
 
-    env->CSR_PWCL = val;
     return old_v;
 }
diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool set_csr_trans_func(unsigned int csr_num, GenCSRRead readfn,
 
 void loongarch_csr_translate_init(void)
 {
+    SET_CSR_FUNC(STLBPS, NULL, gen_helper_csrwr_stlbps);
     SET_CSR_FUNC(ESTAT, NULL, gen_helper_csrwr_estat);
     SET_CSR_FUNC(ASID,  NULL, gen_helper_csrwr_asid);
     SET_CSR_FUNC(PGD,   gen_helper_csrrd_pgd, NULL);
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/log.h"
 #include "cpu-csr.h"
 
+bool check_ps(CPULoongArchState *env, int tlb_ps)
+{
+     if (tlb_ps > 64) {
+         return false;
+     }
+     return BIT_ULL(tlb_ps) & (env->CSR_PRCFG2);
+}
+
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                                uint64_t *dir_width, target_ulong level)
 {
@@ -XXX,XX +XXX,XX @@ static void fill_tlb_entry(CPULoongArchState *env, int index)
         lo1 = env->CSR_TLBELO1;
     }
 
-    if (csr_ps == 0) {
-        qemu_log_mask(CPU_LOG_MMU, "page size is 0\n");
+    /*check csr_ps */
+    if (!check_ps(env, csr_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "csr_ps %d is illegal\n", csr_ps);
+        return;
     }
 
     /* Only MTLB has the ps fields */
@@ -XXX,XX +XXX,XX @@ void helper_tlbfill(CPULoongArchState *env)
         pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
     }
 
+    if (!check_ps(env, pagesize)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "pagesize %d is illegal\n", pagesize);
+        return;
+    }
+
     stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    if (!check_ps(env, stlb_ps)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "stlb_ps %d is illegal\n", stlb_ps);
+        return;
+    }
 
     if (pagesize == stlb_ps) {
         /* Only write into STLB bits [47:13] */
-- 
2.34.1