Re: [Qemu-devel] [PATCH v2 16/23] target-arm: Use arm_current_sctlr to access SCTLR

["Edgar E. Iglesias" <edgar.iglesias@gmail.com>]

On Thu, May 22, 2014 at 02:56:22PM +0000, Aggeler  Fabian wrote:
> 
> On 22 May 2014, at 09:33, Edgar E. Iglesias <edgar.iglesias@gmail.com> wrote:
> 
> > On Tue, May 13, 2014 at 06:16:01PM +0200, Fabian Aggeler wrote:
> >> Add SCTLR_EL3 and introduce new function to access correct
> >> instance of SCTLR in different modes/worlds.
> > 
> > Hi,
> > 
> > AArch64 has a couple of insn/regs that do address translation
> > as seen by other ELs. E.g, from EL3 you can perform address
> > translation as seen by EL0. See for example ATS12E0R.
> 
> Good point, didn’t know about them. 
> 
> > AArch32 has similar features, it can also lower S to NS when in S mode.
> 
> You mean other features than AT* operations?

Sorry, as in a similar set of AT* operations. If AArch32 is in S mode, it can
for example do address translation as seen by NS mode.

> Or do you mean the possibility
> to access both secure and non-secure instances from monitor mode by setting the
> SCR.NS bit? This is currently handled by using the A32_MAPPED_EL3_REG_GET
> which only gets the secure instance when the SCR.NS bit is clear.

Right, this should work.

Cheers,
Edgar

> 
> > 
> > With regards to arm_current_sctlr() and the use in get_phys_addr, I
> > don't think it is enough here.
> > 
> > I was planning to post was patches that add new args to get_phys_addr()
> > with the translation-EL and flags to control if stage-2 translation
> > should be done or not. That way ats_write() can keep reusing
> > get_phys_addr(). We would need to pass the security state as an argument
> > aswell to handle AArch32. Does that make sense?
> 
> From my view that makes sense. 
> 
> I went through my changes again and in most of the locations where I changed
> SCTLR access to use arm_current_sctlr() we should actually just access
> SCTLR_EL1 (aa64_*_access() or ctr_el0_access()).
> 
> And otherwise:
> 
> - arm_cpu_do_interrupt() we still need to get distinguish between EL3 using
>    - Aarch32 (get secure/non-secure instance depending on arm_is_secure) or 
>    - Aarch64 (get SCTLR_EL1).
> 
> - check_ap() is only used by get_phys_addr_v5/v6() so just return 
>   secure / non-secure instance.
> 
> - arm_cpu_reset() in cpu.c we only need to check the SCTLR.V bit [13] for CPUs
>   without Aarch64, but need to use secure or non-secure instance depending on 
>   the which world we are booting in.
> 
> If I didn’t miss or misinterpret something in this list I guess this does not really need 
> its own function then as we don’t have much duplication.
> 
> Best,
> Fabian
> 
> 
> > 
> > Cheers,
> > Edgar
> > 
> >> 
> >> Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
> >> ---
> >> hw/arm/pxa2xx.c        |  2 +-
> >> target-arm/cpu-qom.h   |  1 +
> >> target-arm/cpu.c       |  4 +--
> >> target-arm/cpu.h       | 14 ++++++++++-
> >> target-arm/helper.c    | 67 ++++++++++++++++++++++++++++++++++++++------------
> >> target-arm/op_helper.c |  2 +-
> >> 6 files changed, 69 insertions(+), 21 deletions(-)
> >> 
> >> diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
> >> index e0cd847..8b69e72 100644
> >> --- a/hw/arm/pxa2xx.c
> >> +++ b/hw/arm/pxa2xx.c
> >> @@ -274,7 +274,7 @@ static void pxa2xx_pwrmode_write(CPUARMState *env, const ARMCPRegInfo *ri,
> >>     case 3:
> >>         s->cpu->env.uncached_cpsr = ARM_CPU_MODE_SVC;
> >>         s->cpu->env.daif = PSTATE_A | PSTATE_F | PSTATE_I;
> >> -        s->cpu->env.cp15.c1_sys = 0;
> >> +        s->cpu->env.cp15.c1_sys_el1 = 0;
> >>         s->cpu->env.cp15.c1_coproc = 0;
> >>         s->cpu->env.cp15.ttbr0_el1 = 0;
> >>         s->cpu->env.cp15.c3 = 0;
> >> diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
> >> index edc7f26..38cbd43 100644
> >> --- a/target-arm/cpu-qom.h
> >> +++ b/target-arm/cpu-qom.h
> >> @@ -119,6 +119,7 @@ typedef struct ARMCPU {
> >>     uint32_t mvfr2;
> >>     uint32_t ctr;
> >>     uint32_t reset_sctlr;
> >> +    uint32_t reset_sctlr_el3;
> >>     uint32_t id_pfr0;
> >>     uint32_t id_pfr1;
> >>     uint32_t id_dfr0;
> >> diff --git a/target-arm/cpu.c b/target-arm/cpu.c
> >> index b0d4a9b..bdbdbb1 100644
> >> --- a/target-arm/cpu.c
> >> +++ b/target-arm/cpu.c
> >> @@ -100,7 +100,7 @@ static void arm_cpu_reset(CPUState *s)
> >> #if defined(CONFIG_USER_ONLY)
> >>         env->pstate = PSTATE_MODE_EL0t;
> >>         /* Userspace expects access to CTL_EL0 and the cache ops */
> >> -        env->cp15.c1_sys |= SCTLR_UCT | SCTLR_UCI;
> >> +        env->cp15.c1_sys_el1 |= SCTLR_UCT | SCTLR_UCI;
> >>         /* and to the FP/Neon instructions */
> >>         env->cp15.c1_coproc = deposit64(env->cp15.c1_coproc, 20, 2, 3);
> >> #else
> >> @@ -146,7 +146,7 @@ static void arm_cpu_reset(CPUState *s)
> >>         }
> >>     }
> >> 
> >> -    if (env->cp15.c1_sys & SCTLR_V) {
> >> +    if (arm_current_sctlr(env) & SCTLR_V) {
> >>             env->regs[15] = 0xFFFF0000;
> >>     }
> >> 
> >> diff --git a/target-arm/cpu.h b/target-arm/cpu.h
> >> index a4bb6bd..780c1f5 100644
> >> --- a/target-arm/cpu.h
> >> +++ b/target-arm/cpu.h
> >> @@ -180,7 +180,8 @@ typedef struct CPUARMState {
> >>     struct {
> >>         uint32_t c0_cpuid;
> >>         uint64_t c0_cssel; /* Cache size selection.  */
> >> -        uint64_t c1_sys; /* System control register.  */
> >> +        uint64_t c1_sys_el1; /* System control register (EL1). */
> >> +        uint64_t c1_sys_el3; /* System control register (EL3).  */
> >>         uint64_t c1_coproc; /* Coprocessor access register.  */
> >>         uint32_t c1_xscaleauxcr; /* XScale auxiliary control register.  */
> >>         uint32_t c1_scr; /* secure config register.  */
> >> @@ -971,6 +972,17 @@ static inline int arm_current_pl(CPUARMState *env)
> >>     return 1;
> >> }
> >> 
> >> +static inline uint64_t arm_current_sctlr(CPUARMState *env)
> >> +{
> >> +    if (is_a64(env) && arm_current_pl(env) == 3) {
> >> +        /* EL3 has its own SCTLR */
> >> +        return env->cp15.c1_sys_el3;
> >> +    } else {
> >> +        /* Only A32 with NS-bit clear accesses secure instance of SCTLR */
> >> +        return A32_MAPPED_EL3_REG_GET(env, c1_sys);
> >> +    }
> >> +}
> >> +
> >> typedef struct ARMCPRegInfo ARMCPRegInfo;
> >> 
> >> typedef enum CPAccessResult {
> >> diff --git a/target-arm/helper.c b/target-arm/helper.c
> >> index 98c3dc9..ac8b15a 100644
> >> --- a/target-arm/helper.c
> >> +++ b/target-arm/helper.c
> >> @@ -1767,7 +1767,7 @@ static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
> >> 
> >> static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
> >> {
> >> -    if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UMA)) {
> >> +    if (arm_current_pl(env) == 0 && !(arm_current_sctlr(env) & SCTLR_UMA)) {
> >>         return CP_ACCESS_TRAP;
> >>     }
> >>     return CP_ACCESS_OK;
> >> @@ -1785,7 +1785,7 @@ static CPAccessResult aa64_cacheop_access(CPUARMState *env,
> >>     /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
> >>      * SCTLR_EL1.UCI is set.
> >>      */
> >> -    if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCI)) {
> >> +    if (arm_current_pl(env) == 0 && !(arm_current_sctlr(env) & SCTLR_UCI)) {
> >>         return CP_ACCESS_TRAP;
> >>     }
> >>     return CP_ACCESS_OK;
> >> @@ -1823,7 +1823,7 @@ static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
> >>     /* We don't implement EL2, so the only control on DC ZVA is the
> >>      * bit in the SCTLR which can prohibit access for EL0.
> >>      */
> >> -    if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_DZE)) {
> >> +    if (arm_current_pl(env) == 0 && !(arm_current_sctlr(env) & SCTLR_DZE)) {
> >>         return CP_ACCESS_TRAP;
> >>     }
> >>     return CP_ACCESS_OK;
> >> @@ -2146,7 +2146,7 @@ static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
> >>     /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
> >>      * but the AArch32 CTR has its own reginfo struct)
> >>      */
> >> -    if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCT)) {
> >> +    if (arm_current_pl(env) == 0 && !(arm_current_sctlr(env) & SCTLR_UCT)) {
> >>         return CP_ACCESS_TRAP;
> >>     }
> >>     return CP_ACCESS_OK;
> >> @@ -2573,10 +2573,11 @@ void register_cp_regs_for_features(ARMCPU *cpu)
> >> 
> >>     /* Generic registers whose values depend on the implementation */
> >>     {
> >> -        ARMCPRegInfo sctlr = {
> >> -            .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
> >> -            .opc0 = 3, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
> >> -            .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_sys),
> >> +        ARMCPRegInfo sctlr_el1 = {
> >> +            .name = "SCTLR_EL1", .state = ARM_CP_STATE_BOTH,
> >> +            .type = ARM_CP_NONSECURE, .opc0 = 3, .crn = 1, .crm = 0, .opc1 = 0,
> >> +            .opc2 = 0, .access = PL1_RW,
> >> +            .fieldoffset = offsetof(CPUARMState, cp15.c1_sys_el1),
> >>             .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
> >>             .raw_writefn = raw_write,
> >>         };
> >> @@ -2585,9 +2586,43 @@ void register_cp_regs_for_features(ARMCPU *cpu)
> >>              * arch/arm/mach-pxa/sleep.S expects two instructions following
> >>              * an MMU enable to execute from cache.  Imitate this behaviour.
> >>              */
> >> -            sctlr.type |= ARM_CP_SUPPRESS_TB_END;
> >> +            sctlr_el1.type |= ARM_CP_SUPPRESS_TB_END;
> >>         }
> >> -        define_one_arm_cp_reg(cpu, &sctlr);
> >> +        define_one_arm_cp_reg(cpu, &sctlr_el1);
> >> +
> >> +        ARMCPRegInfo sctlr_el1_s = {
> >> +            .name = "SCTLR_EL1(S)", .type = ARM_CP_SECURE,
> >> +            .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
> >> +            .access = PL3_RW,
> >> +            .fieldoffset = offsetof(CPUARMState, cp15.c1_sys_el3),
> >> +            .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
> >> +            .raw_writefn = raw_write,
> >> +        };
> >> +        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
> >> +            /* Normally we would always end the TB on an SCTLR write, but Linux
> >> +             * arch/arm/mach-pxa/sleep.S expects two instructions following
> >> +             * an MMU enable to execute from cache.  Imitate this behaviour.
> >> +             */
> >> +            sctlr_el1_s.type |= ARM_CP_SUPPRESS_TB_END;
> >> +        }
> >> +        define_one_arm_cp_reg(cpu, &sctlr_el1_s);
> >> +
> >> +        ARMCPRegInfo sctlr_el3 = {
> >> +             .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
> >> +             .opc0 = 3, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
> >> +             .access = PL3_RW, .type = ARM_CP_SECURE,
> >> +             .fieldoffset = offsetof(CPUARMState, cp15.c1_sys_el3),
> >> +             .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr_el3,
> >> +             .raw_writefn = raw_write,
> >> +        };
> >> +        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
> >> +            /* Normally we would always end the TB on an SCTLR write, but Linux
> >> +             * arch/arm/mach-pxa/sleep.S expects two instructions following
> >> +             * an MMU enable to execute from cache.  Imitate this behaviour.
> >> +             */
> >> +            sctlr_el3.type |= ARM_CP_SUPPRESS_TB_END;
> >> +        }
> >> +        define_one_arm_cp_reg(cpu, &sctlr_el3);
> >>     }
> >> }
> >> 
> >> @@ -3475,7 +3510,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
> >>         return; /* Never happens.  Keep compiler happy.  */
> >>     }
> >>     /* High vectors.  */
> >> -    if (env->cp15.c1_sys & SCTLR_V) {
> >> +    if (arm_current_sctlr(env) & SCTLR_V) {
> >>         /* when enabled, base address cannot be remapped.  */
> >>         addr += 0xffff0000;
> >>     } else {
> >> @@ -3498,7 +3533,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
> >>     /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
> >>      * and we should just guard the thumb mode on V4 */
> >>     if (arm_feature(env, ARM_FEATURE_V4T)) {
> >> -        env->thumb = (env->cp15.c1_sys & SCTLR_TE) != 0;
> >> +        env->thumb = (arm_current_sctlr(env) & SCTLR_TE) != 0;
> >>     }
> >>     env->regs[14] = env->regs[15] + offset;
> >>     env->regs[15] = addr;
> >> @@ -3529,7 +3564,7 @@ static inline int check_ap(CPUARMState *env, int ap, int domain_prot,
> >>       }
> >>       if (access_type == 1)
> >>           return 0;
> >> -      switch (env->cp15.c1_sys & (SCTLR_S | SCTLR_R)) {
> >> +      switch (arm_current_sctlr(env) & (SCTLR_S | SCTLR_R)) {
> >>       case SCTLR_S:
> >>           return is_user ? 0 : PAGE_READ;
> >>       case SCTLR_R:
> >> @@ -3763,7 +3798,7 @@ static int get_phys_addr_v6(CPUARMState *env, uint32_t address, int access_type,
> >>             goto do_fault;
> >> 
> >>         /* The simplified model uses AP[0] as an access control bit.  */
> >> -        if ((env->cp15.c1_sys & SCTLR_AFE) && (ap & 1) == 0) {
> >> +        if ((arm_current_sctlr(env) & SCTLR_AFE) && (ap & 1) == 0) {
> >>             /* Access flag fault.  */
> >>             code = (code == 15) ? 6 : 3;
> >>             goto do_fault;
> >> @@ -4099,7 +4134,7 @@ static inline int get_phys_addr(CPUARMState *env, target_ulong address,
> >>     if (address < 0x02000000)
> >>         address += env->cp15.c13_fcse;
> >> 
> >> -    if ((env->cp15.c1_sys & SCTLR_M) == 0) {
> >> +    if ((arm_current_sctlr(env) & SCTLR_M) == 0) {
> >>         /* MMU/MPU disabled.  */
> >>         *phys_ptr = address;
> >>         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
> >> @@ -4112,7 +4147,7 @@ static inline int get_phys_addr(CPUARMState *env, target_ulong address,
> >>     } else if (extended_addresses_enabled(env)) {
> >>         return get_phys_addr_lpae(env, address, access_type, is_user, phys_ptr,
> >>                                   prot, page_size);
> >> -    } else if (env->cp15.c1_sys & SCTLR_XP) {
> >> +    } else if (arm_current_sctlr(env) & SCTLR_XP) {
> >>         return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
> >>                                 prot, page_size);
> >>     } else {
> >> diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c
> >> index fb90676..3eacea8 100644
> >> --- a/target-arm/op_helper.c
> >> +++ b/target-arm/op_helper.c
> >> @@ -365,7 +365,7 @@ void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
> >>      * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
> >>      * to catch that case at translate time.
> >>      */
> >> -    if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UMA)) {
> >> +    if (arm_current_pl(env) == 0 && !(arm_current_sctlr(env) & SCTLR_UMA)) {
> >>         raise_exception(env, EXCP_UDEF);
> >>     }
> >> 
> >> -- 
> >> 1.8.3.2
> >> 
>