| Message ID | 20230414160413.549801-2-peter.maydell@linaro.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | target/arm: Fix handling of VSTCR_EL2.SW and VTCR_EL2.NSW | expand |
On 14/4/23 18:04, Peter Maydell wrote: > Bit 63 in a Table descriptor is only the NSTable bit for stage 1 > translations; in stage 2 it is RES0. We were incorrectly looking at > it all the time. > > This causes problems if: > * the stage 2 table descriptor was incorrectly setting the RES0 bit > * we are doing a stage 2 translation in Secure address space for > a NonSecure stage 1 regime -- in this case we would incorrectly > do an immediate downgrade to NonSecure > > A bug elsewhere in the code currently prevents us from getting > to the second situation, but when we fix that it will be possible. > > Cc: qemu-stable@nongnu.org > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > target/arm/ptw.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
On 4/14/23 18:04, Peter Maydell wrote: > Bit 63 in a Table descriptor is only the NSTable bit for stage 1 > translations; in stage 2 it is RES0. We were incorrectly looking at > it all the time. > > This causes problems if: > * the stage 2 table descriptor was incorrectly setting the RES0 bit > * we are doing a stage 2 translation in Secure address space for > a NonSecure stage 1 regime -- in this case we would incorrectly > do an immediate downgrade to NonSecure > > A bug elsewhere in the code currently prevents us from getting > to the second situation, but when we fix that it will be possible. > > Cc:qemu-stable@nongnu.org > Signed-off-by: Peter Maydell<peter.maydell@linaro.org> > --- > target/arm/ptw.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 6d72950a795..06865227642 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -1403,17 +1403,18 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, descaddrmask &= ~indexmask_grainsize; /* - * Secure accesses start with the page table in secure memory and + * Secure stage 1 accesses start with the page table in secure memory and * can be downgraded to non-secure at any step. Non-secure accesses * remain non-secure. We implement this by just ORing in the NSTable/NS * bits at each step. + * Stage 2 never gets this kind of downgrade. */ tableattrs = is_secure ? 0 : (1 << 4); next_level: descaddr |= (address >> (stride * (4 - level))) & indexmask; descaddr &= ~7ULL; - nstable = extract32(tableattrs, 4, 1); + nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1); if (nstable) { /* * Stage2_S -> Stage2 or Phys_S -> Phys_NS
Bit 63 in a Table descriptor is only the NSTable bit for stage 1 translations; in stage 2 it is RES0. We were incorrectly looking at it all the time. This causes problems if: * the stage 2 table descriptor was incorrectly setting the RES0 bit * we are doing a stage 2 translation in Secure address space for a NonSecure stage 1 regime -- in this case we would incorrectly do an immediate downgrade to NonSecure A bug elsewhere in the code currently prevents us from getting to the second situation, but when we fix that it will be possible. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/ptw.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)