[Qemu-devel] [PATCHv2] target-arm: Use physical addresses for ldrex/strex

[Christopher Covington]

As different virtual addresses may end up aliasing by pointing to
the same physical address, modify load- and store-exclusive to
use physical addresses with the exclusive monitor.

Written by Derek Hower.

Signed-off-by: Christopher Covington <address@hidden>
---
 target-arm/helper-a64.h    |  2 ++
 target-arm/helper.c        | 25 +++++++++++++++++++++++++
 target-arm/translate-a64.c | 25 +++++++++++++++++++++++--
 3 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/target-arm/helper-a64.h b/target-arm/helper-a64.h
index 1d3d10f..a713d29 100644
--- a/target-arm/helper-a64.h
+++ b/target-arm/helper-a64.h
@@ -46,3 +46,5 @@ DEF_HELPER_FLAGS_2(frecpx_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, env)
 DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
 DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+
+DEF_HELPER_3(get_phys_addr64, i64, env, i64, i32)
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 12ea88f..7bcff98 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -24,6 +24,31 @@ static inline bool get_phys_addr(CPUARMState *env, 
target_ulong address,
 #define PMCRE   0x1
 #endif
 
+#ifdef TARGET_AARCH64
+
+uint64_t HELPER(get_phys_addr64)(CPUARMState *env,
+                                 uint64_t vaddr, uint32_t memidx)
+{
+#ifdef CONFIG_USER_ONLY
+  return vaddr;
+#else
+  hwaddr phys_addr;
+  int prot;               /* ignored */
+  target_ulong page_size; /* ignored */
+  MemTxAttrs attrs = {};  /* ignored */
+  uint32_t fsr;           /* ignored */
+
+  /* We just want the address from this function and don't care about faults.
+   * Therefore, we always assume the operation is a load.
+   */
+  get_phys_addr(env, vaddr, 0, memidx == 0, &phys_addr, &attrs, &prot,
+                &page_size, &fsr);
+  return phys_addr;
+#endif
+}
+
+#endif
+
 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
 {
     int nregs;
diff --git a/target-arm/translate-a64.c b/target-arm/translate-a64.c
index ec0936c..fb34de2 100644
--- a/target-arm/translate-a64.c
+++ b/target-arm/translate-a64.c
@@ -1708,7 +1708,17 @@ static void gen_load_exclusive(DisasContext *s, int rt, 
int rt2,
     tcg_gen_mov_i64(cpu_reg(s, rt), tmp);
 
     tcg_temp_free_i64(tmp);
-    tcg_gen_mov_i64(cpu_exclusive_addr, addr);
+
+    /* The monitor must be set on the physical address. We've already read the
+     * address at this point, so we know the translation won't fault.
+     */
+    TCGv_i64 physaddr = tcg_temp_new_i64();
+    TCGv_i32 idx = tcg_temp_new_i32();
+    tcg_gen_movi_i32(idx, get_mem_index(s));
+    gen_helper_get_phys_addr64(physaddr, cpu_env, addr, idx);
+    tcg_gen_mov_i64(cpu_exclusive_addr, physaddr);
+    tcg_temp_free_i64(physaddr);
+    tcg_temp_free_i32(idx);
 }
 
 #ifdef CONFIG_USER_ONLY
@@ -1745,13 +1755,24 @@ static void gen_store_exclusive(DisasContext *s, int 
rd, int rt, int rt2,
      * basic block ends at the branch insn.
      */
     tcg_gen_mov_i64(addr, inaddr);
-    tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
 
     tmp = tcg_temp_new_i64();
     tcg_gen_qemu_ld_i64(tmp, addr, get_mem_index(s), MO_TE + size);
     tcg_gen_brcond_i64(TCG_COND_NE, tmp, cpu_exclusive_val, fail_label);
     tcg_temp_free_i64(tmp);
 
+    /* The monitor must be checked on the physical address. We've alredy loaded
+     * this address, so we don't need to check for a fault condition.
+     */
+    TCGv_i64 physaddr = tcg_temp_new_i64();
+    TCGv_i32 idx = tcg_temp_new_i32();
+    tcg_gen_movi_i32(idx, get_mem_index(s));
+    gen_helper_get_phys_addr64(physaddr, cpu_env, addr, idx);
+
+    tcg_gen_brcond_i64(TCG_COND_NE, physaddr, cpu_exclusive_addr, fail_label);
+    tcg_temp_free_i64(physaddr);
+    tcg_temp_free_i32(idx);
+
     if (is_pair) {
         TCGv_i64 addrhi = tcg_temp_new_i64();
         TCGv_i64 tmphi = tcg_temp_new_i64();
-- 
Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project