From patchwork Mon Jun 15 17:24:31 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 49915 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-wi0-f199.google.com (mail-wi0-f199.google.com [209.85.212.199]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 73F8A211FD for ; Mon, 15 Jun 2015 17:39:41 +0000 (UTC) Received: by wifx6 with SMTP id x6sf23045628wif.1 for ; Mon, 15 Jun 2015 10:39:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:date :message-id:in-reply-to:references:subject:precedence:list-id :list-unsubscribe:list-archive:list-post:list-help:list-subscribe :errors-to:sender:x-original-sender :x-original-authentication-results:mailing-list; bh=nEBhe3oF1/4zhQU9rGq78GVtqVVZae7+CFlkkAAMDp8=; b=DtSGg7kPmb0eN32p8lytA3/DjJhuLFM/Y4FaAMjCUN5wxty4cgiIPrJ0G3kO+wNBrp g+AkyYxcg9+3YWIzwgEU0bUpvHXrXMNSTzO4W1IQji6niRQ8kg1IFLVZ0h6WNUQO/TPT ZkoEfevfuS3w00kb/nu99ejl1i8QkmJc5mqmLzUqMG8+Jjzrm3Dg14EqG+gYVBcbScHo Ptztjnl5UsYmknZYsC74JMxFXpUyvrBo+lu8h5+huFdu4kPHcBsQBQtQi/yIiKYBJeN6 RUF06j10/jti/q9Z+fAAQWUEpmBhZRFlSvXYjjN4ReQxDgR/+MRUkZtGw8j22nsyTOGf MMjQ== X-Gm-Message-State: ALoCoQmf8Ay2x8x4PfhfhVZrqynQMtIAlsovnjbCt2RgerUfb/DZyl2RC1a3Bw63s2renNFfbRY0 X-Received: by 10.180.37.198 with SMTP id a6mr20533383wik.7.1434389980796; Mon, 15 Jun 2015 10:39:40 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.43.36 with SMTP id t4ls939538lal.99.gmail; Mon, 15 Jun 2015 10:39:40 -0700 (PDT) X-Received: by 10.152.2.38 with SMTP id 6mr28655227lar.80.1434389980633; Mon, 15 Jun 2015 10:39:40 -0700 (PDT) Received: from mail-lb0-f177.google.com (mail-lb0-f177.google.com. [209.85.217.177]) by mx.google.com with ESMTPS id w10si10994875law.138.2015.06.15.10.39.40 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 15 Jun 2015 10:39:40 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.177 as permitted sender) client-ip=209.85.217.177; Received: by lbbti3 with SMTP id ti3so20716373lbb.1 for ; Mon, 15 Jun 2015 10:39:40 -0700 (PDT) X-Received: by 10.112.41.196 with SMTP id h4mr1337742lbl.36.1434389980480; Mon, 15 Jun 2015 10:39:40 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.108.230 with SMTP id hn6csp1570343lbb; Mon, 15 Jun 2015 10:39:39 -0700 (PDT) X-Received: by 10.55.23.23 with SMTP id i23mr5837675qkh.23.1434389978940; Mon, 15 Jun 2015 10:39:38 -0700 (PDT) Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id 63si11646175qhw.101.2015.06.15.10.39.38 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 15 Jun 2015 10:39:38 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Received: from localhost ([::1]:35733 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4YME-0007uV-4C for patch@linaro.org; Mon, 15 Jun 2015 13:39:38 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60995) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4Y8K-0007lO-5f for qemu-devel@nongnu.org; Mon, 15 Jun 2015 13:25:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z4Y8I-0001XY-G2 for qemu-devel@nongnu.org; Mon, 15 Jun 2015 13:25:16 -0400 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:34471) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4Y8I-0001AA-8O for qemu-devel@nongnu.org; Mon, 15 Jun 2015 13:25:14 -0400 Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.80) (envelope-from ) id 1Z4Y82-0003VF-BN for qemu-devel@nongnu.org; Mon, 15 Jun 2015 18:24:58 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 15 Jun 2015 18:24:31 +0100 Message-Id: <1434389098-13430-2-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1434389098-13430-1-git-send-email-peter.maydell@linaro.org> References: <1434389098-13430-1-git-send-email-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2001:8b0:1d0::1 Subject: [Qemu-devel] [PULL 01/28] target-arm: Handle "extended small page" descriptors correctly X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: , List-Help: , List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: peter.maydell@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.217.177 as permitted sender) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 The old ARMv5-style page table format includes a kind of second level descriptor named the "extended small page" format, whose primary purpose is to allow specification of the TEX memory attribute bits on a 4K page. This exists on ARMv6 and also (as an implementation extension) on XScale CPUs; it's UNPREDICTABLE on v5. We were mishandling this in two ways: (1) we weren't implementing it for v6 (probably never noticed because Linux will use the new-style v6 page table format there) (2) we were not correctly setting the page_size, which is 4K, not 1K The latter bug went unnoticed for years because the only thing which the page_size affects is which TLB entries get flushed when the guest does a TLB invalidate on an address in the page, and prior to commit 2f0d8631b7 we were doing a full TLB flush very frequently due to Linux's habit of writing the SCTLR pointlessly a lot. (We can assume that after commit 2f0d8631b7 the bug went unnoticed for a year because nobody's actually using the Zaurus/XScale emulation...) Report the correct page size for these descriptors, and permit them on ARMv6 CPUs. This fixes a problem where a kernel image for Zaurus can boot the kernel OK but gets random segfaults when it tries to run userspace programs. Signed-off-by: Peter Maydell Message-id: 1432844085-16441-1-git-send-email-peter.maydell@linaro.org --- target-arm/helper.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index 3da0c05..3ed2fc3 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -5302,20 +5302,25 @@ static int get_phys_addr_v5(CPUARMState *env, uint32_t address, int access_type, ap = (desc >> (4 + ((address >> 9) & 6))) & 3; *page_size = 0x1000; break; - case 3: /* 1k page. */ + case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ if (type == 1) { - if (arm_feature(env, ARM_FEATURE_XSCALE)) { + /* ARMv6/XScale extended small page format */ + if (arm_feature(env, ARM_FEATURE_XSCALE) + || arm_feature(env, ARM_FEATURE_V6)) { phys_addr = (desc & 0xfffff000) | (address & 0xfff); + *page_size = 0x1000; } else { - /* Page translation fault. */ + /* UNPREDICTABLE in ARMv5; we choose to take a + * page translation fault. + */ code = 7; goto do_fault; } } else { phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); + *page_size = 0x400; } ap = (desc >> 4) & 3; - *page_size = 0x400; break; default: /* Never happens, but compiler isn't smart enough to tell. */