[Qemu-devel] [PATCH] target-mips: Fix exceptions while UX=0

[Qemu-devel] [PATCH] target-mips: Fix exceptions while UX=0

[James Hogan]

Commit 01f728857941 ("target-mips: Status.UX/SX/KX enable 32-bit address
wrapping") added a new hflag MIPS_HFLAG_AWRAP, which indicates that
64-bit addressing is disallowed in the current mode, so hflag users
don't need to worry about the complexities of working that out, for
example checking both MIPS_HFLAG_KSU and MIPS_HFLAG_UX.

However when exceptions are taken outside of exception level,
mips_cpu_do_interrupt() manipulates the env->hflags directly rather than
using compute_hflags() to update them, and this code wasn't updated
accordingly. As a result, when UX is cleared, MIPS_HFLAG_AWRAP is set,
but it doesn't get cleared on entry back into kernel mode due to an
exception. Kernel mode then cannot access the 64-bit segments resulting
in a nested exception loop.

Fix by updating mips_cpu_do_interrupt() to clear the MIPS_HFLAG_WRAP
flag when necessary, according to compute_hflags().

Fixes: 01f728857941 ("target-mips: Status.UX/SX/KX enable 32-bit...")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Leon Alrae <leon.alrae@imgtec.com>
Cc: Aurelien Jarno <aurelien@aurel32.net>
---
Note, compute_hflags() doesn't seem to take KX into account pre-r6,
which seems wrong.
---
 target-mips/helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target-mips/helper.c b/target-mips/helper.c
index b3fe816fecf8..0625f610a015 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -725,6 +725,10 @@ void mips_cpu_do_interrupt(CPUState *cs)
             env->CP0_Status |= (1 << CP0St_EXL);
             if (env->insn_flags & ISA_MIPS3) {
                 env->hflags |= MIPS_HFLAG_64;
+                if (!(env->insn_flags & ISA_MIPS64R6) ||
+                    env->CP0_Status & (1 << CP0St_KX)) {
+                    env->hflags &= ~MIPS_HFLAG_AWRAP;
+                }
             }
             env->hflags |= MIPS_HFLAG_CP0;
             env->hflags &= ~(MIPS_HFLAG_KSU);
-- 
2.4.10

Re: [Qemu-devel] [PATCH] target-mips: Fix exceptions while UX=0

[Leon Alrae]

On 16/11/15 16:18, James Hogan wrote:
> However when exceptions are taken outside of exception level,
> mips_cpu_do_interrupt() manipulates the env->hflags directly rather than
> using compute_hflags() to update them, and this code wasn't updated
> accordingly. As a result, when UX is cleared, MIPS_HFLAG_AWRAP is set,
> but it doesn't get cleared on entry back into kernel mode due to an
> exception. Kernel mode then cannot access the 64-bit segments resulting
> in a nested exception loop.

Indeed, thanks for the fix.

> 
> Fix by updating mips_cpu_do_interrupt() to clear the MIPS_HFLAG_WRAP
> flag when necessary, according to compute_hflags().
> 
> Fixes: 01f728857941 ("target-mips: Status.UX/SX/KX enable 32-bit...")
> Signed-off-by: James Hogan <james.hogan@imgtec.com>
> Cc: Leon Alrae <leon.alrae@imgtec.com>
> Cc: Aurelien Jarno <aurelien@aurel32.net>
> ---
> Note, compute_hflags() doesn't seem to take KX into account pre-r6,
> which seems wrong.

Why does it seem wrong? According to PRA, prior to R6 (excluding the
R5+EVA case which we don’t support) this special behaviour for data
references (i.e. sign-extension of the effective address when 64-bit
addressing is disabled) is only in User Mode.

> ---
>  target-mips/helper.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/target-mips/helper.c b/target-mips/helper.c
> index b3fe816fecf8..0625f610a015 100644
> --- a/target-mips/helper.c
> +++ b/target-mips/helper.c
> @@ -725,6 +725,10 @@ void mips_cpu_do_interrupt(CPUState *cs)
>              env->CP0_Status |= (1 << CP0St_EXL);
>              if (env->insn_flags & ISA_MIPS3) {
>                  env->hflags |= MIPS_HFLAG_64;
> +                if (!(env->insn_flags & ISA_MIPS64R6) ||
> +                    env->CP0_Status & (1 << CP0St_KX)) {
> +                    env->hflags &= ~MIPS_HFLAG_AWRAP;
> +                }

Any reason you skipped set_error_EPC and enter_DEPC? The flag needs to
be cleared there as well I think.

Thanks,
Leon

>              }
>              env->hflags |= MIPS_HFLAG_CP0;
>              env->hflags &= ~(MIPS_HFLAG_KSU);
> 

Re: [Qemu-devel] [PATCH] target-mips: Fix exceptions while UX=0

[James Hogan]

[-- Attachment #1: Type: text/plain, Size: 2599 bytes --]

Hi Leon,

On Tue, Nov 17, 2015 at 04:09:24PM +0000, Leon Alrae wrote:
> On 16/11/15 16:18, James Hogan wrote:
> > However when exceptions are taken outside of exception level,
> > mips_cpu_do_interrupt() manipulates the env->hflags directly rather than
> > using compute_hflags() to update them, and this code wasn't updated
> > accordingly. As a result, when UX is cleared, MIPS_HFLAG_AWRAP is set,
> > but it doesn't get cleared on entry back into kernel mode due to an
> > exception. Kernel mode then cannot access the 64-bit segments resulting
> > in a nested exception loop.
> 
> Indeed, thanks for the fix.
> 
> > 
> > Fix by updating mips_cpu_do_interrupt() to clear the MIPS_HFLAG_WRAP
> > flag when necessary, according to compute_hflags().
> > 
> > Fixes: 01f728857941 ("target-mips: Status.UX/SX/KX enable 32-bit...")
> > Signed-off-by: James Hogan <james.hogan@imgtec.com>
> > Cc: Leon Alrae <leon.alrae@imgtec.com>
> > Cc: Aurelien Jarno <aurelien@aurel32.net>
> > ---
> > Note, compute_hflags() doesn't seem to take KX into account pre-r6,
> > which seems wrong.
> 
> Why does it seem wrong? According to PRA, prior to R6 (excluding the
> R5+EVA case which we don’t support) this special behaviour for data
> references (i.e. sign-extension of the effective address when 64-bit
> addressing is disabled) is only in User Mode.

Okay, i see that KX=0 is described as causing an address error exception
pre-r6, which seems to be handled correctly in get_physical_address.
Please ignore that comment.

> 
> > ---
> >  target-mips/helper.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/target-mips/helper.c b/target-mips/helper.c
> > index b3fe816fecf8..0625f610a015 100644
> > --- a/target-mips/helper.c
> > +++ b/target-mips/helper.c
> > @@ -725,6 +725,10 @@ void mips_cpu_do_interrupt(CPUState *cs)
> >              env->CP0_Status |= (1 << CP0St_EXL);
> >              if (env->insn_flags & ISA_MIPS3) {
> >                  env->hflags |= MIPS_HFLAG_64;
> > +                if (!(env->insn_flags & ISA_MIPS64R6) ||
> > +                    env->CP0_Status & (1 << CP0St_KX)) {
> > +                    env->hflags &= ~MIPS_HFLAG_AWRAP;
> > +                }
> 
> Any reason you skipped set_error_EPC and enter_DEPC? The flag needs to
> be cleared there as well I think.

Yes, I agree. That was an oversight. I will resubmit.

Thanks
James

> 
> Thanks,
> Leon
> 
> >              }
> >              env->hflags |= MIPS_HFLAG_CP0;
> >              env->hflags &= ~(MIPS_HFLAG_KSU);
> > 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]