From patchwork Thu May 28 20:14:45 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 49121 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-lb0-f200.google.com (mail-lb0-f200.google.com [209.85.217.200]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 8BE92218EC for ; Thu, 28 May 2015 20:14:49 +0000 (UTC) Received: by lbbti3 with SMTP id ti3sf13129797lbb.1 for ; Thu, 28 May 2015 13:14:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:x-original-sender:x-original-authentication-results :precedence:mailing-list:list-id:list-post:list-help:list-archive :list-unsubscribe; bh=s57WWxMb4USgqm0vQnHO0ufoT89xLIRyqeX2HxH9M0w=; b=IMXF4TSaeycj8rXS5c8WSxSuLz3dz+xqP+H2KfO+U1z34QP56QBzWPotQjYvh3WOrW V5CwuCQbtC8/QSlPPNVVblF3fzZS2EPE8+EnixoQL76yfPxSXymxI8/+wu8NJL3339dF 1InBfMGtqlu69VuEl+Qyhk3gTBeAzjIaRh2sDqTE/XQuiWbYlaS5nLzMfoAhdqh/y10L +Y+uXO4ekrySxsFxwqwS6jxSKDC0DDOcJ76KK6d02wU80SnSDbUfE573rSl8QMIqWSzB eLgyAhEKnWze9SSHn3Ym0qyk48F0gTr5qmMBqNRKxLLhaWh8zBC0TVQr0c5lqtZ+htPY JUmg== X-Gm-Message-State: ALoCoQkq0uVoXHJrasix2h4SJyo5ydLF6kGhjqrhGELhcKSmlEHzGFfZEdnFCJV2WquL8VQ4ORcm X-Received: by 10.180.216.12 with SMTP id om12mr9182035wic.1.1432844088536; Thu, 28 May 2015 13:14:48 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.163.65 with SMTP id yg1ls226620lab.26.gmail; Thu, 28 May 2015 13:14:48 -0700 (PDT) X-Received: by 10.152.36.65 with SMTP id o1mr4606554laj.55.1432844088377; Thu, 28 May 2015 13:14:48 -0700 (PDT) Received: from mail-lb0-f178.google.com (mail-lb0-f178.google.com. [209.85.217.178]) by mx.google.com with ESMTPS id js14si2745272lab.166.2015.05.28.13.14.47 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 28 May 2015 13:14:47 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.178 as permitted sender) client-ip=209.85.217.178; Received: by lbcmx3 with SMTP id mx3so35850289lbc.1 for ; Thu, 28 May 2015 13:14:47 -0700 (PDT) X-Received: by 10.112.93.37 with SMTP id cr5mr4604155lbb.106.1432844087596; Thu, 28 May 2015 13:14:47 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.112.108.230 with SMTP id hn6csp1429000lbb; Thu, 28 May 2015 13:14:47 -0700 (PDT) X-Received: by 10.194.235.4 with SMTP id ui4mr8598063wjc.0.1432844086787; Thu, 28 May 2015 13:14:46 -0700 (PDT) Received: from mnementh.archaic.org.uk (mnementh.archaic.org.uk. [2001:8b0:1d0::1]) by mx.google.com with ESMTPS id 16si5762380wjs.1.2015.05.28.13.14.46 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Thu, 28 May 2015 13:14:46 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 2001:8b0:1d0::1 as permitted sender) client-ip=2001:8b0:1d0::1; Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.80) (envelope-from ) id 1Yy4CT-0004He-Ih; Thu, 28 May 2015 21:14:45 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Cc: patches@linaro.org, Laurent Desnogues Subject: [PATCH] target-arm: Handle "extended small page" descriptors correctly Date: Thu, 28 May 2015 21:14:45 +0100 Message-Id: <1432844085-16441-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.10.4 X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: peter.maydell@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.178 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , The old ARMv5-style page table format includes a kind of second level descriptor named the "extended small page" format, whose primary purpose is to allow specification of the TEX memory attribute bits on a 4K page. This exists on ARMv6 and also (as an implementation extension) on XScale CPUs; it's UNPREDICTABLE on v5. We were mishandling this in two ways: (1) we weren't implementing it for v6 (probably never noticed because Linux will use the new-style v6 page table format there) (2) we were not correctly setting the page_size, which is 4K, not 1K The latter bug went unnoticed for years because the only thing which the page_size affects is which TLB entries get flushed when the guest does a TLB invalidate on an address in the page, and prior to commit 2f0d8631b7 we were doing a full TLB flush very frequently due to Linux's habit of writing the SCTLR pointlessly a lot. (We can assume that after commit 2f0d8631b7 the bug went unnoticed for a year because nobody's actually using the Zaurus/XScale emulation...) Report the correct page size for these descriptors, and permit them on ARMv6 CPUs. This fixes a problem where a kernel image for Zaurus can boot the kernel OK but gets random segfaults when it tries to run userspace programs. Signed-off-by: Peter Maydell --- This took me something like three weeks to track down, on and off... target-arm/helper.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index f8f8d76..238da3c 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -5227,20 +5227,25 @@ static int get_phys_addr_v5(CPUARMState *env, uint32_t address, int access_type, ap = (desc >> (4 + ((address >> 9) & 6))) & 3; *page_size = 0x1000; break; - case 3: /* 1k page. */ + case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ if (type == 1) { - if (arm_feature(env, ARM_FEATURE_XSCALE)) { + /* ARMv6/XScale extended small page format */ + if (arm_feature(env, ARM_FEATURE_XSCALE) + || arm_feature(env, ARM_FEATURE_V6)) { phys_addr = (desc & 0xfffff000) | (address & 0xfff); + *page_size = 0x1000; } else { - /* Page translation fault. */ + /* UNPREDICTABLE in ARMv5; we choose to take a + * page translation fault. + */ code = 7; goto do_fault; } } else { phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); + *page_size = 0x400; } ap = (desc >> 4) & 3; - *page_size = 0x400; break; default: /* Never happens, but compiler isn't smart enough to tell. */