* [Qemu-devel] [Bug 1748434] Re: Possibly wrong GICv3 behavior when secure enabled
2018-02-09 12:08 [Qemu-devel] [Bug 1748434] [NEW] Possibly wrong GICv3 behavior when secure enabled Robert Pasz
@ 2018-02-09 14:08 ` Robert Pasz
2018-03-15 11:41 ` Peter Maydell
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Robert Pasz @ 2018-02-09 14:08 UTC (permalink / raw)
To: qemu-devel
see possible solution, in #if 0 is original code in #else see possible
fix
static uint64_t icc_pmr_read(CPUARMState *env, const ARMCPRegInfo *ri)
....
#if 0 // KIURCHER: bug - shall be opposite; see ARM specification
if (value & 0x80) {
/* Secure priorities not visible to NS */
value = 0;
} else if (value != 0xff) {
value = (value << 1) & 0xff;
}
#else
if (value & 0x80) {
value = (value << 1) & 0xff;
} else {
value = 0;
}
#endif
....
static void icc_pmr_write(CPUARMState *env, const ARMCPRegInfo *ri,
uint64_t value)
....
#if 0 //KIURCHER: bug
if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
(env->cp15.scr_el3 & SCR_FIQ)) {
/* NS access and Group 0 is inaccessible to NS: return the
* NS view of the current priority
*/
if (!(cs->icc_pmr_el1 & 0x80)) {
/* Current PMR in the secure range, don't allow NS to change it */
return;
}
value = (value >> 1) & 0x80;
}
#else
if (arm_feature(env, ARM_FEATURE_EL3) && !arm_is_secure(env) &&
(env->cp15.scr_el3 & SCR_FIQ)) {
/* NS access and Group 0 is inaccessible to NS: return the
* NS view of the current priority
*/
if (!(cs->icc_pmr_el1 & 0x80)) {
/* Current PMR in the secure range, don't allow NS to change it */
return;
}
value = (value >> 1) | 0x80;
}
#endif
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1748434
Title:
Possibly wrong GICv3 behavior when secure enabled
Status in QEMU:
New
Bug description:
I an tried arm-aarch64 interrupt routing to EL3, by SCR_EL3.FIQ=1. First I am started QEMU with secure=on and GICv3 support.
I programmed secure and non-secure timers and set-up appropriate interrupts.Secure timer to be GRP1_Secure and non-secure timer to be GRP1_NonSecure. ICC_PMR = 0xff. Then I switched CPU to EL1.
With that setup no interrupt was delivered to PE. GIC interface showed that non secure IRQ is pending. ICC_PMR read at EL1 returns 0 (shall return value ((PMR_(el3) << 1) & 0xff) according to GIC specification.
Than I tried to increase interrupt priority mask - so I set ICC_PMR = 0x7f (at EL3). Then I read at EL1 ICC_PMR=0xfe - (is shall be 0). With this setup IRQ of secure timer was taken at EL3, non secure timer didn't rise IRQ (as it is masked by PMR).
I dig to qemu code and see wrong condition in file arm_gicv3_cpuif.c in function icc_pmr_read(). This behavior is opposite of ARM specification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1748434/+subscriptions
^ permalink raw reply [flat|nested] 7+ messages in thread* [Qemu-devel] [Bug 1748434] Re: Possibly wrong GICv3 behavior when secure enabled
2018-02-09 12:08 [Qemu-devel] [Bug 1748434] [NEW] Possibly wrong GICv3 behavior when secure enabled Robert Pasz
2018-02-09 14:08 ` [Qemu-devel] [Bug 1748434] " Robert Pasz
@ 2018-03-15 11:41 ` Peter Maydell
2018-03-15 13:26 ` Peter Maydell
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2018-03-15 11:41 UTC (permalink / raw)
To: qemu-devel
** Tags added: arm
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1748434
Title:
Possibly wrong GICv3 behavior when secure enabled
Status in QEMU:
New
Bug description:
I an tried arm-aarch64 interrupt routing to EL3, by SCR_EL3.FIQ=1. First I am started QEMU with secure=on and GICv3 support.
I programmed secure and non-secure timers and set-up appropriate interrupts.Secure timer to be GRP1_Secure and non-secure timer to be GRP1_NonSecure. ICC_PMR = 0xff. Then I switched CPU to EL1.
With that setup no interrupt was delivered to PE. GIC interface showed that non secure IRQ is pending. ICC_PMR read at EL1 returns 0 (shall return value ((PMR_(el3) << 1) & 0xff) according to GIC specification.
Than I tried to increase interrupt priority mask - so I set ICC_PMR = 0x7f (at EL3). Then I read at EL1 ICC_PMR=0xfe - (is shall be 0). With this setup IRQ of secure timer was taken at EL3, non secure timer didn't rise IRQ (as it is masked by PMR).
I dig to qemu code and see wrong condition in file arm_gicv3_cpuif.c in function icc_pmr_read(). This behavior is opposite of ARM specification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1748434/+subscriptions
^ permalink raw reply [flat|nested] 7+ messages in thread* [Qemu-devel] [Bug 1748434] Re: Possibly wrong GICv3 behavior when secure enabled
2018-02-09 12:08 [Qemu-devel] [Bug 1748434] [NEW] Possibly wrong GICv3 behavior when secure enabled Robert Pasz
2018-02-09 14:08 ` [Qemu-devel] [Bug 1748434] " Robert Pasz
2018-03-15 11:41 ` Peter Maydell
@ 2018-03-15 13:26 ` Peter Maydell
2018-03-15 15:01 ` Peter Maydell
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2018-03-15 13:26 UTC (permalink / raw)
To: qemu-devel
Whoops, yes, we have the wrong condition for ICC_PMR non-secure reads
and writes. We also have the same bug in ICC_RPR reads. I'll put
together a patch and send it to the mailing list.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1748434
Title:
Possibly wrong GICv3 behavior when secure enabled
Status in QEMU:
New
Bug description:
I an tried arm-aarch64 interrupt routing to EL3, by SCR_EL3.FIQ=1. First I am started QEMU with secure=on and GICv3 support.
I programmed secure and non-secure timers and set-up appropriate interrupts.Secure timer to be GRP1_Secure and non-secure timer to be GRP1_NonSecure. ICC_PMR = 0xff. Then I switched CPU to EL1.
With that setup no interrupt was delivered to PE. GIC interface showed that non secure IRQ is pending. ICC_PMR read at EL1 returns 0 (shall return value ((PMR_(el3) << 1) & 0xff) according to GIC specification.
Than I tried to increase interrupt priority mask - so I set ICC_PMR = 0x7f (at EL3). Then I read at EL1 ICC_PMR=0xfe - (is shall be 0). With this setup IRQ of secure timer was taken at EL3, non secure timer didn't rise IRQ (as it is masked by PMR).
I dig to qemu code and see wrong condition in file arm_gicv3_cpuif.c in function icc_pmr_read(). This behavior is opposite of ARM specification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1748434/+subscriptions
^ permalink raw reply [flat|nested] 7+ messages in thread* [Qemu-devel] [Bug 1748434] Re: Possibly wrong GICv3 behavior when secure enabled
2018-02-09 12:08 [Qemu-devel] [Bug 1748434] [NEW] Possibly wrong GICv3 behavior when secure enabled Robert Pasz
` (2 preceding siblings ...)
2018-03-15 13:26 ` Peter Maydell
@ 2018-03-15 15:01 ` Peter Maydell
2018-04-10 13:57 ` Peter Maydell
2018-04-26 5:14 ` Thomas Huth
5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2018-03-15 15:01 UTC (permalink / raw)
To: qemu-devel
Patch which should fix this:
https://lists.gnu.org/archive/html/qemu-devel/2018-03/msg04537.html
** Changed in: qemu
Status: New => In Progress
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1748434
Title:
Possibly wrong GICv3 behavior when secure enabled
Status in QEMU:
In Progress
Bug description:
I an tried arm-aarch64 interrupt routing to EL3, by SCR_EL3.FIQ=1. First I am started QEMU with secure=on and GICv3 support.
I programmed secure and non-secure timers and set-up appropriate interrupts.Secure timer to be GRP1_Secure and non-secure timer to be GRP1_NonSecure. ICC_PMR = 0xff. Then I switched CPU to EL1.
With that setup no interrupt was delivered to PE. GIC interface showed that non secure IRQ is pending. ICC_PMR read at EL1 returns 0 (shall return value ((PMR_(el3) << 1) & 0xff) according to GIC specification.
Than I tried to increase interrupt priority mask - so I set ICC_PMR = 0x7f (at EL3). Then I read at EL1 ICC_PMR=0xfe - (is shall be 0). With this setup IRQ of secure timer was taken at EL3, non secure timer didn't rise IRQ (as it is masked by PMR).
I dig to qemu code and see wrong condition in file arm_gicv3_cpuif.c in function icc_pmr_read(). This behavior is opposite of ARM specification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1748434/+subscriptions
^ permalink raw reply [flat|nested] 7+ messages in thread* [Qemu-devel] [Bug 1748434] Re: Possibly wrong GICv3 behavior when secure enabled
2018-02-09 12:08 [Qemu-devel] [Bug 1748434] [NEW] Possibly wrong GICv3 behavior when secure enabled Robert Pasz
` (3 preceding siblings ...)
2018-03-15 15:01 ` Peter Maydell
@ 2018-04-10 13:57 ` Peter Maydell
2018-04-26 5:14 ` Thomas Huth
5 siblings, 0 replies; 7+ messages in thread
From: Peter Maydell @ 2018-04-10 13:57 UTC (permalink / raw)
To: qemu-devel
Now fixed in master in commit a2e2d7fc46fd8be, so will be in 2.12.0.
** Changed in: qemu
Status: In Progress => Fix Committed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1748434
Title:
Possibly wrong GICv3 behavior when secure enabled
Status in QEMU:
Fix Committed
Bug description:
I an tried arm-aarch64 interrupt routing to EL3, by SCR_EL3.FIQ=1. First I am started QEMU with secure=on and GICv3 support.
I programmed secure and non-secure timers and set-up appropriate interrupts.Secure timer to be GRP1_Secure and non-secure timer to be GRP1_NonSecure. ICC_PMR = 0xff. Then I switched CPU to EL1.
With that setup no interrupt was delivered to PE. GIC interface showed that non secure IRQ is pending. ICC_PMR read at EL1 returns 0 (shall return value ((PMR_(el3) << 1) & 0xff) according to GIC specification.
Than I tried to increase interrupt priority mask - so I set ICC_PMR = 0x7f (at EL3). Then I read at EL1 ICC_PMR=0xfe - (is shall be 0). With this setup IRQ of secure timer was taken at EL3, non secure timer didn't rise IRQ (as it is masked by PMR).
I dig to qemu code and see wrong condition in file arm_gicv3_cpuif.c in function icc_pmr_read(). This behavior is opposite of ARM specification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1748434/+subscriptions
^ permalink raw reply [flat|nested] 7+ messages in thread* [Qemu-devel] [Bug 1748434] Re: Possibly wrong GICv3 behavior when secure enabled
2018-02-09 12:08 [Qemu-devel] [Bug 1748434] [NEW] Possibly wrong GICv3 behavior when secure enabled Robert Pasz
` (4 preceding siblings ...)
2018-04-10 13:57 ` Peter Maydell
@ 2018-04-26 5:14 ` Thomas Huth
5 siblings, 0 replies; 7+ messages in thread
From: Thomas Huth @ 2018-04-26 5:14 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1748434
Title:
Possibly wrong GICv3 behavior when secure enabled
Status in QEMU:
Fix Released
Bug description:
I an tried arm-aarch64 interrupt routing to EL3, by SCR_EL3.FIQ=1. First I am started QEMU with secure=on and GICv3 support.
I programmed secure and non-secure timers and set-up appropriate interrupts.Secure timer to be GRP1_Secure and non-secure timer to be GRP1_NonSecure. ICC_PMR = 0xff. Then I switched CPU to EL1.
With that setup no interrupt was delivered to PE. GIC interface showed that non secure IRQ is pending. ICC_PMR read at EL1 returns 0 (shall return value ((PMR_(el3) << 1) & 0xff) according to GIC specification.
Than I tried to increase interrupt priority mask - so I set ICC_PMR = 0x7f (at EL3). Then I read at EL1 ICC_PMR=0xfe - (is shall be 0). With this setup IRQ of secure timer was taken at EL3, non secure timer didn't rise IRQ (as it is masked by PMR).
I dig to qemu code and see wrong condition in file arm_gicv3_cpuif.c in function icc_pmr_read(). This behavior is opposite of ARM specification.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1748434/+subscriptions
^ permalink raw reply [flat|nested] 7+ messages in thread