The IRS_IST_BASER.ADDR documentation says:
For IRS_IST_CFGR.STRUCTURE = 0:
Bits[N:0] of the resulting address are 0 where N depends on the ISTSZ
and LPI_ID_BITS fields in IRS_IST_CFGR as follows:
N = Max(5, (ISTSZ + 1) + LPI_ID_BITS)
For IRS_IST_CFGR.STRUCTURE = 1:
Bits[N:0] of the resulting address are 0 where N depends on L2SZ,
ISTSZ, and LPI_ID_BITS in IRS_IST_CFGR as follows:
N = Max(5, LPI_ID_BITS - ((10 - ISTSZ) + (2 * L2SZ)) + 2)
This enforces that the IST is aligned to the size of the IST table,
or to a 64-byte boundary if the table is smaller than 64 bytes, even
if the guest programs the low bits in the ADDR field to specify an
insufficiently aligned address.
We were missing this check, and instead trusted the guest-provided
address to be sufficiently aligned already; add the alignment
enforcement.
The GICv5 spec defines the masking to be used with the expressions
quoted above, which work with the raw field values from the
IRS_IST_CFGR register; these simplify down to some straightforward
expressions based on the sanitized values we've already extracted
form those fields. You can get to the expressions we use here either
by working through the simplification of the GIC spec expressions, or
from first principles (the number of bits needed for the size of the
table in bytes is the number of bits that index it plus the number of
bits specifying the size of an individual table entry).
Signed-off-by: Peter Maydell <[email protected]>
---
hw/intc/arm_gicv5.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/hw/intc/arm_gicv5.c b/hw/intc/arm_gicv5.c
index 08878193dfc..cdc6c9d3466 100644
--- a/hw/intc/arm_gicv5.c
+++ b/hw/intc/arm_gicv5.c
@@ -1313,6 +1313,7 @@ static void irs_ist_baser_write(GICv5 *s, GICv5Domain
domain, uint64_t value)
*/
GICv5ISTConfig *cfg = &s->phys_lpi_config[domain];
uint8_t istbits, l2bits, l2_idx_bits;
+ int tableszbits;
uint8_t id_bits = FIELD_EX64(cs->irs_ist_cfgr[domain],
IRS_IST_CFGR, LPI_ID_BITS);
id_bits = MIN(MAX(id_bits, QEMU_GICV5_MIN_LPI_ID_BITS),
QEMU_GICV5_ID_BITS);
@@ -1359,6 +1360,33 @@ static void irs_ist_baser_write(GICv5 *s, GICv5Domain
domain, uint64_t value)
cfg->l2_idx_bits = l2_idx_bits;
cfg->structure = FIELD_EX64(cs->irs_ist_cfgr[domain],
IRS_IST_CFGR, STRUCTURE);
+
+ /*
+ * Bits [N:0] of the base addr are ignored, to enforce that in a
+ * 1-level IST it is aligned to the size of the ISTE array,
+ * and in a 2-level IST it is aligned to the size of the L1 table.
+ * The spec defines N in terms of the raw L2SZ, ISTSZ and LPI_ID_BITS
+ * fields, but we have already sanitized these to
+ * istbits = ISTSZ + 2
+ * l2bits = (L2SZ * 2) + 12
+ * id_bits = LPI_ID_BITS
+ * We have also already enforced the "bottom 6 bits are 0" via
+ * R_IRS_IST_BASER_ADDR_MASK, so can skip the Max() operation.
+ * We want tableszbits == the number of bits to zero, which is N + 1.
+ */
+ if (cfg->structure) {
+ /*
+ * L1 table is indexed by the (id_bits - l2_idx_bits) bits in
+ * the ID, so has 2^(id_bits - l2_idx_bits) entries, and each
+ * entry is 8 bytes == 2^3.
+ */
+ tableszbits = id_bits - l2_idx_bits + 3;
+ } else {
+ /* table has 2^id_bits entries of 2^istbits size each */
+ tableszbits = id_bits + istbits;
+ }
+ cfg->base &= MAKE_64BIT_MASK(0, tableszbits);
+
if (!cfg->lpi_cache) {
/*
* Keys are GINT_TO_POINTER(intid), so we want the g_direct_hash
--
2.43.0
