[PULL 6/9] hexagon: raise imprecise exception for multi-TLB matches

[Brian Cain <brian.cain@oss.qualcomm.com>]

The TLB walk stopped at the first matching entry, so instruction and data
translations did not detect a second valid mapping for the same VA and ASID.

Scan the remaining entries after selecting the translation.  On a second
match, retain the first entry for the access but record
HEX_CAUSE_IMPRECISE_MULTI_TLB_MATCH as a pending imprecise exception.

Move that exception out of the synchronous TLB-fill result and check for it
after every packet, rather than only packets containing tlbp.  This delivers
the architectural imprecise exception after an ordinary memory access and
avoids treating it as a precise permission fault.  Clear the pending state
when starting a new translation and after delivering the exception.

The v0.2.14 mmu_multi_tlb systest uncovered this bug.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 hw/hexagon/hexagon_tlb.c   | 10 ++++++++++
 target/hexagon/hex_mmu.c   | 12 +++++++++---
 target/hexagon/hexswi.c    |  1 +
 target/hexagon/translate.c | 22 ++++++++--------------
 4 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/hw/hexagon/hexagon_tlb.c b/hw/hexagon/hexagon_tlb.c
index c76805abac9..157d03e51bf 100644
--- a/hw/hexagon/hexagon_tlb.c
+++ b/hw/hexagon/hexagon_tlb.c
@@ -326,6 +326,16 @@ bool hexagon_tlb_find_match(HexagonTLBState *tlb, uint32_t asid,
     for (uint32_t i = 0; i < tlb->num_entries; i++) {
         if (hex_tlb_entry_match(tlb->entries[i], asid, VA, access_type,
                                 PA, prot, size, excp, cause_code, mmu_idx)) {
+            if (*excp == 0) {
+                for (i++; i < tlb->num_entries; i++) {
+                    if (hex_tlb_entry_match_noperm(tlb->entries[i], asid,
+                                                   VA)) {
+                        *excp = HEX_EVENT_IMPRECISE;
+                        *cause_code = HEX_CAUSE_IMPRECISE_MULTI_TLB_MATCH;
+                        break;
+                    }
+                }
+            }
             return true;
         }
     }
diff --git a/target/hexagon/hex_mmu.c b/target/hexagon/hex_mmu.c
index d6258c673d1..d6ee7c40798 100644
--- a/target/hexagon/hex_mmu.c
+++ b/target/hexagon/hex_mmu.c
@@ -71,10 +71,16 @@ bool hex_tlb_find_match(CPUHexagonState *env, uint32_t VA,
     uint32_t ssr = env->t_sreg[HEX_SREG_SSR];
     uint8_t asid = GET_SSR_FIELD(SSR_ASID, ssr);
     int cause_code = 0;
+    bool found;
 
-    bool found = hexagon_tlb_find_match(cpu->tlb, asid, VA, access_type,
-                                        PA, prot, size, excp, &cause_code,
-                                        mmu_idx);
+    env->imprecise_exception = 0;
+    found = hexagon_tlb_find_match(cpu->tlb, asid, VA, access_type,
+                                   PA, prot, size, excp, &cause_code,
+                                   mmu_idx);
+    if (*excp == HEX_EVENT_IMPRECISE) {
+        env->imprecise_exception = *excp;
+        *excp = 0;
+    }
     if (cause_code) {
         env->cause_code = cause_code;
     }
diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c
index 75f0a9cc520..4705e915aea 100644
--- a/target/hexagon/hexswi.c
+++ b/target/hexagon/hexswi.c
@@ -934,6 +934,7 @@ void hexagon_cpu_do_interrupt(CPUState *cs)
         break;
 
     case HEX_EVENT_IMPRECISE:
+        env->imprecise_exception = 0;
         if (get_exe_mode(env) == HEX_EXE_MODE_WAIT) {
             env->gpr[HEX_REG_PC] = env->wait_next_pc - 4;
             clear_wait_mode(env);
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index be75e5fdeb8..5d3d67e5d3e 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -1065,20 +1065,14 @@ static void update_exec_counters(DisasContext *ctx)
  * A tlbp instruction may detect multiple TLB matches and set a pending
  * imprecise exception.  Raise it after the packet that ran the tlbp.
  */
-static void check_imprecise_exception(Packet *pkt)
+static void check_imprecise_exception(DisasContext *ctx)
 {
-    for (int i = 0; i < pkt->num_insns; i++) {
-        if (pkt->insn[i].opcode == Y2_tlbp) {
-            TCGv PC = tcg_constant_tl(pkt->pc);
-            TCGLabel *label = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, hex_imprecise_exception,
-                               0, label);
-            gen_helper_raise_exception(tcg_env,
-                                       hex_imprecise_exception, PC);
-            gen_set_label(label);
-            return;
-        }
-    }
+    TCGv PC = tcg_constant_tl(ctx->pkt.pc);
+    TCGLabel *label = gen_new_label();
+
+    tcg_gen_brcondi_tl(TCG_COND_EQ, hex_imprecise_exception, 0, label);
+    gen_helper_raise_exception(tcg_env, hex_imprecise_exception, PC);
+    gen_set_label(label);
 }
 #endif
 
@@ -1182,7 +1176,7 @@ static void gen_commit_packet(DisasContext *ctx)
     }
 
 #ifndef CONFIG_USER_ONLY
-    check_imprecise_exception(&ctx->pkt);
+    check_imprecise_exception(ctx);
 #endif
 
     if (ctx->pkt_ends_tb || ctx->base.is_jmp == DISAS_NORETURN) {
-- 
2.34.1