Message ID | 20230922132111.9149-1-michal.orzel@amd.com |
---|---|
State | New |
Headers | show |
Series | target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0 | expand |
On 22.09.23 16:21, Michal Orzel wrote: Hello Michal > On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top > of Xen, a trap from EL2 was observed which is something not reproducible > on HW (also, Xen does not trap accesses to physical counter). > > This is because gt_counter_access() checks for an incorrect bit (1 > instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to > physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2: > When HCR_EL2.E2H is 0: > - EL1PCTEN, bit [0]: refers to physical counter > - EL1PCEN, bit [1]: refers to physical timer registers > > Fix it by checking for the right bit (i.e. 0) and update the comment > referring to incorrect bit name. > > Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE") > Signed-off-by: Michal Orzel <michal.orzel@amd.com> You can add my: [with Zephyr running as Xen guest and accessing CNTPCT_EL0 from EL0 ] Tested-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> > --- > This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode: > if PSTATE.EL == EL0 then > ... > elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' then > AArch64.SystemAccessTrap(EL2, 0x18); > --- > target/arm/helper.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/target/arm/helper.c b/target/arm/helper.c > index 3b22596eabf3..3a2d77b3f81e 100644 > --- a/target/arm/helper.c > +++ b/target/arm/helper.c > @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, > return CP_ACCESS_TRAP_EL2; > } > } else { > - /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ > + /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCTEN. */ > if (has_el2 && timeridx == GTIMER_PHYS && > - !extract32(env->cp15.cnthctl_el2, 1, 1)) { > + !extract32(env->cp15.cnthctl_el2, 0, 1)) { > return CP_ACCESS_TRAP_EL2; > } > }
On Fri, 22 Sept 2023 at 14:21, Michal Orzel <michal.orzel@amd.com> wrote: > > On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top > of Xen, a trap from EL2 was observed which is something not reproducible > on HW (also, Xen does not trap accesses to physical counter). > > This is because gt_counter_access() checks for an incorrect bit (1 > instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to > physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2: > When HCR_EL2.E2H is 0: > - EL1PCTEN, bit [0]: refers to physical counter > - EL1PCEN, bit [1]: refers to physical timer registers > > Fix it by checking for the right bit (i.e. 0) and update the comment > referring to incorrect bit name. > > Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE") > Signed-off-by: Michal Orzel <michal.orzel@amd.com> > --- > This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode: > if PSTATE.EL == EL0 then > ... > elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' then > AArch64.SystemAccessTrap(EL2, 0x18); > --- > target/arm/helper.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/target/arm/helper.c b/target/arm/helper.c > index 3b22596eabf3..3a2d77b3f81e 100644 > --- a/target/arm/helper.c > +++ b/target/arm/helper.c > @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, > return CP_ACCESS_TRAP_EL2; > } > } else { > - /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ > + /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCTEN. */ > if (has_el2 && timeridx == GTIMER_PHYS && > - !extract32(env->cp15.cnthctl_el2, 1, 1)) { > + !extract32(env->cp15.cnthctl_el2, 0, 1)) { > return CP_ACCESS_TRAP_EL2; > } > } I agree that the current logic is not correct, but this change makes this code identical to the "case 1" handling, so we can delete the whole "if (hcr & HCR_E2H) { ... } else { ... }" block and instead fall through, as we already do in gt_timer_access(). thanks -- PMM
Hi, On 27/09/2023 17:49, Peter Maydell wrote: > > > On Fri, 22 Sept 2023 at 14:21, Michal Orzel <michal.orzel@amd.com> wrote: >> >> On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top >> of Xen, a trap from EL2 was observed which is something not reproducible >> on HW (also, Xen does not trap accesses to physical counter). >> >> This is because gt_counter_access() checks for an incorrect bit (1 >> instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to >> physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2: >> When HCR_EL2.E2H is 0: >> - EL1PCTEN, bit [0]: refers to physical counter >> - EL1PCEN, bit [1]: refers to physical timer registers >> >> Fix it by checking for the right bit (i.e. 0) and update the comment >> referring to incorrect bit name. >> >> Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE") >> Signed-off-by: Michal Orzel <michal.orzel@amd.com> >> --- >> This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode: >> if PSTATE.EL == EL0 then >> ... >> elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' then >> AArch64.SystemAccessTrap(EL2, 0x18); >> --- >> target/arm/helper.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/target/arm/helper.c b/target/arm/helper.c >> index 3b22596eabf3..3a2d77b3f81e 100644 >> --- a/target/arm/helper.c >> +++ b/target/arm/helper.c >> @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, >> return CP_ACCESS_TRAP_EL2; >> } >> } else { >> - /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ >> + /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCTEN. */ >> if (has_el2 && timeridx == GTIMER_PHYS && >> - !extract32(env->cp15.cnthctl_el2, 1, 1)) { >> + !extract32(env->cp15.cnthctl_el2, 0, 1)) { >> return CP_ACCESS_TRAP_EL2; >> } >> } > > I agree that the current logic is not correct, but this change > makes this code identical to the "case 1" handling, so we > can delete the whole "if (hcr & HCR_E2H) { ... } else { ... }" > block and instead fall through, as we already do in gt_timer_access(). Ok, will do. ~Michal
diff --git a/target/arm/helper.c b/target/arm/helper.c index 3b22596eabf3..3a2d77b3f81e 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, return CP_ACCESS_TRAP_EL2; } } else { - /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ + /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCTEN. */ if (has_el2 && timeridx == GTIMER_PHYS && - !extract32(env->cp15.cnthctl_el2, 1, 1)) { + !extract32(env->cp15.cnthctl_el2, 0, 1)) { return CP_ACCESS_TRAP_EL2; } }
On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top of Xen, a trap from EL2 was observed which is something not reproducible on HW (also, Xen does not trap accesses to physical counter). This is because gt_counter_access() checks for an incorrect bit (1 instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2: When HCR_EL2.E2H is 0: - EL1PCTEN, bit [0]: refers to physical counter - EL1PCEN, bit [1]: refers to physical timer registers Fix it by checking for the right bit (i.e. 0) and update the comment referring to incorrect bit name. Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE") Signed-off-by: Michal Orzel <michal.orzel@amd.com> --- This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode: if PSTATE.EL == EL0 then ... elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' then AArch64.SystemAccessTrap(EL2, 0x18); --- target/arm/helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)