[PULL,57/89] target/riscv: fix H extension TVM trap

Message ID	20230505010241.21812-58-alistair.francis@wdc.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org> From: Alistair Francis <alistair23@gmail.com> To: qemu-devel@nongnu.org Cc: alistair23@gmail.com, Yi Chen <chenyi2000@zju.edu.cn>, Weiwei Li <liweiwei@iscas.ac.cn>, LIU Zhiwei <zhiwei_liu@linux.alibaba.com>, Alistair Francis <alistair.francis@wdc.com> Subject: [PULL 57/89] target/riscv: fix H extension TVM trap Date: Fri, 5 May 2023 11:02:09 +1000 Message-Id: <20230505010241.21812-58-alistair.francis@wdc.com> In-Reply-To: <20230505010241.21812-1-alistair.francis@wdc.com> References: <20230505010241.21812-1-alistair.francis@wdc.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::430; envelope-from=alistair23@gmail.com; helo=mail-pf1-x430.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action Precedence: list Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org
Series	[PULL,01/89] target/riscv: Avoid env_archcpu() when reading RISCVCPUConfig \| expand [PULL,01/89] target/riscv: Avoid env_archcpu() when reading RISCVCPUConfig [PULL,02/89] target/riscv: Fix priv version dependency for vector and zfh [PULL,03/89] target/riscv: Simplify getting RISCVCPU pointer from env [PULL,04/89] target/riscv: Simplify type conversion for CPURISCVState [PULL,05/89] target/riscv: Simplify arguments for riscv_csrrw_check [PULL,06/89] target/riscv: refactor Zicond support [PULL,07/89] target/riscv: redirect XVentanaCondOps to use the Zicond functions [PULL,08/89] target/riscv: fix invalid riscv, event-to-mhpmcounters entry [PULL,09/89] target/riscv: add cfg properties for Zc* extension [PULL,10/89] target/riscv: add support for Zca extension [PULL,11/89] target/riscv: add support for Zcf extension [PULL,12/89] target/riscv: add support for Zcd extension [PULL,13/89] target/riscv: add support for Zcb extension [PULL,14/89] target/riscv: add support for Zcmp extension [PULL,15/89] target/riscv: add support for Zcmt extension [PULL,16/89] target/riscv: expose properties for Zc* extension [PULL,17/89] disas/riscv.c: add disasm support for Zc* [PULL,18/89] target/riscv: Add support for Zce [PULL,19/89] target/riscv: Fix itrigger when icount is used [PULL,20/89] target/riscv: Remove redundant call to riscv_cpu_virt_enabled [PULL,21/89] target/riscv: Remove redundant check on RVH [PULL,22/89] target/riscv: Remove check on RVH for riscv_cpu_virt_enabled [PULL,23/89] target/riscv: Remove check on RVH for riscv_cpu_set_virt_enabled [PULL,24/89] target/riscv: Convert env->virt to a bool env->virt_enabled [PULL,25/89] target/riscv: Remove redundant parentheses [PULL,26/89] target/riscv: Fix addr type for get_physical_address [PULL,27/89] target/riscv: Set opcode to env->bins for illegal/virtual instruction fault [PULL,28/89] target/riscv: Remove riscv_cpu_virt_enabled() [PULL,29/89] target/riscv: Fix format for indentation [PULL,30/89] target/riscv: Fix format for comments [PULL,31/89] target/riscv: Fix lines with over 80 characters [PULL,32/89] hw/riscv: Add signature dump function for spike to run ACT tests [PULL,33/89] target/riscv: sync env->misa_ext* with cpu->cfg in realize() [PULL,34/89] target/riscv: remove MISA properties from isa_edata_arr[] [PULL,35/89] target/riscv/cpu.c: remove 'multi_letter' from isa_ext_data [PULL,36/89] target/riscv: introduce riscv_cpu_add_misa_properties() [PULL,37/89] target/riscv: remove cpu->cfg.ext_a [PULL,38/89] target/riscv: remove cpu->cfg.ext_c [PULL,39/89] target/riscv: remove cpu->cfg.ext_d [PULL,40/89] target/riscv: remove cpu->cfg.ext_f [PULL,41/89] target/riscv: remove cpu->cfg.ext_i [PULL,42/89] target/riscv: remove cpu->cfg.ext_e [PULL,43/89] target/riscv: remove cpu->cfg.ext_m [PULL,44/89] target/riscv: remove cpu->cfg.ext_s [PULL,45/89] target/riscv: remove cpu->cfg.ext_u [PULL,46/89] target/riscv: remove cpu->cfg.ext_h [PULL,47/89] target/riscv: remove cpu->cfg.ext_j [PULL,48/89] target/riscv: remove cpu->cfg.ext_v [PULL,49/89] target/riscv: remove riscv_cpu_sync_misa_cfg() [PULL,50/89] target/riscv: remove cfg.ext_g setup from rv64_thead_c906_cpu_init() [PULL,51/89] target/riscv: add RVG and remove cpu->cfg.ext_g [PULL,52/89] target/riscv/cpu.c: redesign register_cpu_props() [PULL,53/89] target/riscv: Fix the mstatus.MPP value after executing MRET [PULL,54/89] target/riscv: Use PRV_RESERVED instead of PRV_H [PULL,55/89] target/riscv: Legalize MPP value in write_mstatus [PULL,56/89] target/riscv: Use check for relationship between Zdinx/Zhinx{min} and Zfinx [PULL,57/89] target/riscv: fix H extension TVM trap [PULL,58/89] target/riscv: Extract virt enabled state from tb flags [PULL,59/89] target/riscv: Add a general status enum for extensions [PULL,60/89] target/riscv: Encode the FS and VS on a normal way for tb flags [PULL,61/89] target/riscv: Remove mstatus_hs_{fs, vs} from tb_flags [PULL,62/89] target/riscv: Add a tb flags field for vstart [PULL,63/89] target/riscv: Separate priv from mmu_idx [PULL,64/89] target/riscv: Reduce overhead of MSTATUS_SUM change [PULL,65/89] target/riscv: Use cpu_ld*_code_mmu for HLVX [PULL,66/89] target/riscv: Handle HLV, HSV via helpers [PULL,67/89] target/riscv: Rename MMU_HYP_ACCESS_BIT to MMU_2STAGE_BIT [PULL,68/89] target/riscv: Introduce mmuidx_sum [PULL,69/89] target/riscv: Introduce mmuidx_priv [PULL,70/89] target/riscv: Introduce mmuidx_2stage [PULL,71/89] target/riscv: Move hstatus.spvp check to check_access_hlsv [PULL,72/89] target/riscv: Set MMU_2STAGE_BIT in riscv_cpu_mmu_index [PULL,73/89] target/riscv: Check SUM in the correct register [PULL,74/89] target/riscv: Hoist second stage mode change to callers [PULL,75/89] target/riscv: Hoist pbmte and hade out of the level loop [PULL,76/89] target/riscv: Move leaf pte processing out of level loop [PULL,77/89] target/riscv: Suppress pte update with is_debug [PULL,78/89] target/riscv: Don't modify SUM with is_debug [PULL,79/89] target/riscv: Merge checks for reserved pte flags [PULL,80/89] target/riscv: Reorg access check in get_physical_address [PULL,81/89] target/riscv: Reorg sum check in get_physical_address [PULL,82/89] hw/intc/riscv_aplic: Zero init APLIC internal state [PULL,83/89] target/riscv: add CPU QOM header [PULL,84/89] target/riscv: add query-cpy-definitions support [PULL,85/89] target/riscv: add TYPE_RISCV_DYNAMIC_CPU [PULL,86/89] target/riscv: Restore the predicate() NULL check behavior [PULL,87/89] target/riscv: Fix Guest Physical Address Translation [PULL,88/89] riscv: Make sure an exception is raised if a pte is malformed [PULL,89/89] target/riscv: add Ventana's Veyron V1 CPU

Message ID

20230505010241.21812-58-alistair.francis@wdc.com (mailing list archive)

State

New, archived

Headers

From: Alistair Francis <alistair23@gmail.com>
To: qemu-devel@nongnu.org
Cc: alistair23@gmail.com, Yi Chen <chenyi2000@zju.edu.cn>,
 Weiwei Li <liweiwei@iscas.ac.cn>,
 LIU Zhiwei <zhiwei_liu@linux.alibaba.com>,
 Alistair Francis <alistair.francis@wdc.com>
Subject: [PULL 57/89] target/riscv: fix H extension TVM trap
Date: Fri,  5 May 2023 11:02:09 +1000
Message-Id: <20230505010241.21812-58-alistair.francis@wdc.com>
In-Reply-To: <20230505010241.21812-1-alistair.francis@wdc.com>
References: <20230505010241.21812-1-alistair.francis@wdc.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=2607:f8b0:4864:20::430;
 envelope-from=alistair23@gmail.com; helo=mail-pf1-x430.google.com
X-Spam_score_int: -18
X-Spam_score: -1.9
X-Spam_bar: -
X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001,
 T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
 <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
 <mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org
Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org

Series

[PULL,01/89] target/riscv: Avoid env_archcpu() when reading RISCVCPUConfig | expand

Commit Message

Alistair Francis May 5, 2023, 1:02 a.m. UTC

From: Yi Chen <chenyi2000@zju.edu.cn>

- Trap satp/hgatp accesses from HS-mode when MSTATUS.TVM is enabled.
- Trap satp accesses from VS-mode when HSTATUS.VTVM is enabled.
- Raise RISCV_EXCP_ILLEGAL_INST when U-mode executes SFENCE.VMA/SINVAL.VMA.
- Raise RISCV_EXCP_VIRT_INSTRUCTION_FAULT when VU-mode executes
  SFENCE.VMA/SINVAL.VMA or VS-mode executes SFENCE.VMA/SINVAL.VMA with
  HSTATUS.VTVM enabled.
- Raise RISCV_EXCP_VIRT_INSTRUCTION_FAULT when VU-mode executes
  HFENCE.GVMA/HFENCE.VVMA/HINVAL.GVMA/HINVAL.VVMA.

Signed-off-by: Yi Chen <chenyi2000@zju.edu.cn>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230406101559.39632-1-chenyi2000@zju.edu.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c       | 56 +++++++++++++++++++++++++---------------
 target/riscv/op_helper.c | 12 ++++-----
 2 files changed, 41 insertions(+), 27 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index f4d2dcfdc8..d2271da137 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -449,6 +449,30 @@  static RISCVException sstc_32(CPURISCVState *env, int csrno)
     return sstc(env, csrno);
 }
 
+static RISCVException satp(CPURISCVState *env, int csrno)
+{
+    if (env->priv == PRV_S && !env->virt_enabled &&
+        get_field(env->mstatus, MSTATUS_TVM)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+    if (env->priv == PRV_S && env->virt_enabled &&
+        get_field(env->hstatus, HSTATUS_VTVM)) {
+        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+    }
+
+    return smode(env, csrno);
+}
+
+static RISCVException hgatp(CPURISCVState *env, int csrno)
+{
+    if (env->priv == PRV_S && !env->virt_enabled &&
+        get_field(env->mstatus, MSTATUS_TVM)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return hmode(env, csrno);
+}
+
 /* Checks if PointerMasking registers could be accessed */
 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
 {
@@ -2679,13 +2703,7 @@  static RISCVException read_satp(CPURISCVState *env, int csrno,
         *val = 0;
         return RISCV_EXCP_NONE;
     }
-
-    if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    } else {
-        *val = env->satp;
-    }
-
+    *val = env->satp;
     return RISCV_EXCP_NONE;
 }
 
@@ -2708,18 +2726,14 @@  static RISCVException write_satp(CPURISCVState *env, int csrno,
     }
 
     if (vm && mask) {
-        if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
-            return RISCV_EXCP_ILLEGAL_INST;
-        } else {
-            /*
-             * The ISA defines SATP.MODE=Bare as "no translation", but we still
-             * pass these through QEMU's TLB emulation as it improves
-             * performance.  Flushing the TLB on SATP writes with paging
-             * enabled avoids leaking those invalid cached mappings.
-             */
-            tlb_flush(env_cpu(env));
-            env->satp = val;
-        }
+        /*
+         * The ISA defines SATP.MODE=Bare as "no translation", but we still
+         * pass these through QEMU's TLB emulation as it improves
+         * performance.  Flushing the TLB on SATP writes with paging
+         * enabled avoids leaking those invalid cached mappings.
+         */
+        tlb_flush(env_cpu(env));
+        env->satp = val;
     }
     return RISCV_EXCP_NONE;
 }
@@ -4215,7 +4229,7 @@  riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                          .min_priv_ver = PRIV_VERSION_1_12_0 },
 
     /* Supervisor Protection and Translation */
-    [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
+    [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
 
     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
@@ -4252,7 +4266,7 @@  riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
-    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,   write_hgatp,
+    [CSR_HGATP]       = { "hgatp",       hgatp,   read_hgatp,   write_hgatp,
                           .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
                           write_htimedelta,
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index bd21c6eeef..0c10dd7a78 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -381,12 +381,12 @@  void helper_wfi(CPURISCVState *env)
 void helper_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
-    if (!(env->priv >= PRV_S) ||
-        (env->priv == PRV_S &&
-         get_field(env->mstatus, MSTATUS_TVM))) {
+    if (!env->virt_enabled &&
+        (env->priv == PRV_U ||
+         (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)))) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-    } else if (riscv_has_ext(env, RVH) && env->virt_enabled &&
-               get_field(env->hstatus, HSTATUS_VTVM)) {
+    } else if (env->virt_enabled &&
+               (env->priv == PRV_U || get_field(env->hstatus, HSTATUS_VTVM))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     } else {
         tlb_flush(cs);
@@ -403,7 +403,7 @@  void helper_hyp_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
 
-    if (env->priv == PRV_S && env->virt_enabled) {
+    if (env->virt_enabled) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     }

[PULL,57/89] target/riscv: fix H extension TVM trap

Commit Message

Patch