From patchwork Sun Jan 28 23:15:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 126114 Delivered-To: patch@linaro.org Received: by 10.46.84.92 with SMTP id y28csp1984647ljd; Sun, 28 Jan 2018 15:38:14 -0800 (PST) X-Google-Smtp-Source: AH8x225MQv8Ma6uejjuqDaHvFChjwlXDrX7UCvklzFkwOL6QRBBZ5HHekln9fUqDs4w3M2NjAFCZ X-Received: by 10.129.108.196 with SMTP id h187mr16122327ywc.249.1517182694680; Sun, 28 Jan 2018 15:38:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1517182694; cv=none; d=google.com; s=arc-20160816; b=DEvyAUmu9DwsB3erTP8VpAz7GRDlwuwxWdizKpsZYIEh9Dl2h44ZuzJj8Sjqsj2hLl qqE8ZxuVyTOXY9pe63KZsj6MqbccggNzOcab3wqSeEetQbdLod7a/JGeDV8YbzisLwxx sBS4gfklSghtfir8HzTfOQVIanf7gPfU9t1mq5yIICCj8I8POX46lB7hjf9P2+pDYVVj ePFnU8Ubc4AN+rNkommRBt/ah0DtaD2jH57xV3zi/4qrrwx5pThMw15h/L+67wkoiMpP uzI/p9dl1ERXYTwEErqyGsagCkaNXMp4Zq/Lz3VAIZnFYwYb1+91gpRxCa7qa0pJVBs7 Zw0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject:references:in-reply-to :message-id:date:to:from:dkim-signature:arc-authentication-results; bh=Lmxx021oqyDawVc3ltFq2gT2Xgx8VzZKkkBQYyP4z80=; b=SXgVSZWV/HzSa6ITvLbB4TJNapk5sPcFVQGu2jToEawZvl1etRJF6Iff8/GtkKipng TpaRf/QVMFUVYYXDLEELaiM81lNT/UR7XhHY2hCJOTzSLxlNWgtjK9BwvhkcPQB8E8cR DdB/kXwR6sfuWAuZPFoNhgjRubeR8jKpOgCPibAvEmRzgr7hE7NnjuYhjIX56gOc8CDm aGbfS+jv7RCZFiGj1U/658VF60FLO2QtS+nBmDmOOEVDy3U1uogNxg9wFDDREqpd30DE EF0gpU+yiT99dih3G/3eZV5prcN1SY3FsM+cSdPUzUCrkYi9MSgiASQ6JESPMWkfzRYe ZQHg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=a1kOxfx7; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id 67si4510661ybg.81.2018.01.28.15.38.14 for (version=TLS1 cipher=AES128-SHA bits=128/128); Sun, 28 Jan 2018 15:38:14 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Authentication-Results: mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=a1kOxfx7; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1]:45055 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1efwWc-0002jR-1m for patch@linaro.org; Sun, 28 Jan 2018 18:38:14 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52295) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1efwBT-00036g-T8 for qemu-devel@nongnu.org; Sun, 28 Jan 2018 18:16:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1efwBR-0000JV-JI for qemu-devel@nongnu.org; Sun, 28 Jan 2018 18:16:23 -0500 Received: from mail-pf0-x243.google.com ([2607:f8b0:400e:c00::243]:40614) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1efwBR-0000IM-E4 for qemu-devel@nongnu.org; Sun, 28 Jan 2018 18:16:21 -0500 Received: by mail-pf0-x243.google.com with SMTP id i66so3257260pfd.7 for ; Sun, 28 Jan 2018 15:16:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Lmxx021oqyDawVc3ltFq2gT2Xgx8VzZKkkBQYyP4z80=; b=a1kOxfx7mmCEc58QblBMJwTY5S+0wWPmgs30yQje8TcudtVEK4p/BhxsGx2BSPBvAt 3Q7hGvuE5V9LrSVApgviXHnKvTb50/WQKLQoBAOkukVKR7heMv8VRQ7Hm0T0rvz1Ag3V bjdIgfwVHPnZPQ/UqX0o3CK3OxdCz2ecFGLSk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Lmxx021oqyDawVc3ltFq2gT2Xgx8VzZKkkBQYyP4z80=; b=mpQJ9JoC+G0+wWnWPB1D4DwUecECkoGGg+A65wf0iceBDjCwn5qSmQBmWprXceknR9 51C2rfgIPWPuCjPa5OroHwN4vE7i6OSoib6WR2BWLew6qbnVOxrpbOV1ZDejIQi/GsiS JLXt2I1WuBW7EeGftpynu3Q0k6GKDx0kNI27ylCRxzodAwhizqCN3Szm5GAAt9DfYwCr 68OL6FPwsYtxn2Z9AtnIUHmDK+iaoL/9CmyR4xpFLVGVC0swV5vV/o9Z2Yz2SpY4rIu5 aLRtzwAMDY9dnoj7iPreAsbL+7m0xgEYMmk4IWc1hzpAJpnkBBY6kDs6D7ac2B6BHHPt 5H8w== X-Gm-Message-State: AKwxytdMOKOy6fdibqzhlYd2PVCOc+SS/B5l+XmVoo7tHZbKg0cg/mvZ r91g61zY+7JaisJ5obbJ9nfmM0lbYOg= X-Received: by 2002:a17:902:848c:: with SMTP id c12-v6mr20640529plo.329.1517181378719; Sun, 28 Jan 2018 15:16:18 -0800 (PST) Received: from cloudburst.twiddle.net (174-21-6-47.tukw.qwest.net. [174.21.6.47]) by smtp.gmail.com with ESMTPSA id r27sm26949344pfj.75.2018.01.28.15.16.17 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sun, 28 Jan 2018 15:16:17 -0800 (PST) From: Richard Henderson To: qemu-devel@nongnu.org Date: Sun, 28 Jan 2018 15:15:16 -0800 Message-Id: <20180128231528.22719-32-richard.henderson@linaro.org> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180128231528.22719-1-richard.henderson@linaro.org> References: <20180128231528.22719-1-richard.henderson@linaro.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:400e:c00::243 Subject: [Qemu-devel] [PULL v4 31/43] target/hppa: Implement B,GATE insn X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" Signed-off-by: Richard Henderson --- target/hppa/cpu.h | 1 + target/hppa/mem_helper.c | 8 ++++++++ target/hppa/translate.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+) -- 2.14.3 diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h index 5fab9e1394..70af823a15 100644 --- a/target/hppa/cpu.h +++ b/target/hppa/cpu.h @@ -354,6 +354,7 @@ int hppa_get_physical_address(CPUHPPAState *env, vaddr addr, int mmu_idx, extern const MemoryRegionOps hppa_io_eir_ops; extern const struct VMStateDescription vmstate_hppa_cpu; void hppa_cpu_alarm_timer(void *); +int hppa_artype_for_page(CPUHPPAState *env, target_ulong vaddr); #endif void QEMU_NORETURN hppa_dynamic_excp(CPUHPPAState *env, int excp, uintptr_t ra); diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c index c2b2705869..a34c64cc4a 100644 --- a/target/hppa/mem_helper.c +++ b/target/hppa/mem_helper.c @@ -122,6 +122,7 @@ int hppa_get_physical_address(CPUHPPAState *env, vaddr addr, int mmu_idx, break; default: /* execute: promote to privilege level type & 3 */ prot = x_prot; + break; } /* ??? Check PSW_P and ent->access_prot. This can remove PROT_WRITE. */ @@ -335,4 +336,11 @@ target_ureg HELPER(lpa)(CPUHPPAState *env, target_ulong addr) } return phys; } + +/* Return the ar_type of the TLB at VADDR, or -1. */ +int hppa_artype_for_page(CPUHPPAState *env, target_ulong vaddr) +{ + hppa_tlb_entry *ent = hppa_find_tlb(env, vaddr); + return ent ? ent->ar_type : -1; +} #endif /* CONFIG_USER_ONLY */ diff --git a/target/hppa/translate.c b/target/hppa/translate.c index 24d357889e..5b7824f065 100644 --- a/target/hppa/translate.c +++ b/target/hppa/translate.c @@ -3782,6 +3782,53 @@ static DisasJumpType trans_bl(DisasContext *ctx, uint32_t insn, return do_dbranch(ctx, iaoq_dest(ctx, disp), link, n); } +static DisasJumpType trans_b_gate(DisasContext *ctx, uint32_t insn, + const DisasInsn *di) +{ + unsigned n = extract32(insn, 1, 1); + unsigned link = extract32(insn, 21, 5); + target_sreg disp = assemble_17(insn); + target_ureg dest = iaoq_dest(ctx, disp); + + /* Make sure the caller hasn't done something weird with the queue. + * ??? This is not quite the same as the PSW[B] bit, which would be + * expensive to track. Real hardware will trap for + * b gateway + * b gateway+4 (in delay slot of first branch) + * However, checking for a non-sequential instruction queue *will* + * diagnose the security hole + * b gateway + * b evil + * in which instructions at evil would run with increased privs. + */ + if (ctx->iaoq_b == -1 || ctx->iaoq_b != ctx->iaoq_f + 4) { + return gen_illegal(ctx); + } + +#ifndef CONFIG_USER_ONLY + if (ctx->tb_flags & PSW_C) { + CPUHPPAState *env = ctx->cs->env_ptr; + int type = hppa_artype_for_page(env, ctx->base.pc_next); + /* If we could not find a TLB entry, then we need to generate an + ITLB miss exception so the kernel will provide it. + The resulting TLB fill operation will invalidate this TB and + we will re-translate, at which point we *will* be able to find + the TLB entry and determine if this is in fact a gateway page. */ + if (type < 0) { + return gen_excp(ctx, EXCP_ITLB_MISS); + } + /* No change for non-gateway pages or for priv decrease. */ + if (type >= 4 && type - 4 < ctx->privilege) { + dest = deposit32(dest, 0, 2, type - 4); + } + } else { + dest &= -4; /* priv = 0 */ + } +#endif + + return do_dbranch(ctx, dest, link, n); +} + static DisasJumpType trans_bl_long(DisasContext *ctx, uint32_t insn, const DisasInsn *di) { @@ -3860,6 +3907,7 @@ static const DisasInsn table_branch[] = { { 0xe8004000u, 0xfc00fffdu, trans_blr }, { 0xe800c000u, 0xfc00fffdu, trans_bv }, { 0xe800d000u, 0xfc00dffcu, trans_bve }, + { 0xe8002000u, 0xfc00e000u, trans_b_gate }, }; static DisasJumpType trans_fop_wew_0c(DisasContext *ctx, uint32_t insn,