mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

target/arm: Fix S1_ptw_translate() debug path

Browse Source 
In commit fe4a5472cc we rearranged the logic in S1_ptw_translate()
so that the debug-access "call get_phys_addr_*" codepath is used both
when S1 is doing ptw reads from stage 2 and when it is doing ptw
reads from physical memory.  However, we didn't update the
calculation of s2ptw->in_space and s2ptw->in_secure to account for
the "ptw reads from physical memory" case.  This meant that debug
accesses when in Secure state broke.

Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.

Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
Fixes: fe4a5472cc ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2023-07-17 11:05:08 +01:00
parent 34eed55127
commit 3f74da440d
1 changed files with 32 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
target/arm/ptw.c
View File

@ -485,11 +485,39 @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
}
}
static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
ARMMMUIdx s2_mmu_idx)
{
/*
* Return the security space to use for stage 2 when doing
* the S1 page table descriptor load.
*/
if (regime_is_stage2(s2_mmu_idx)) {
/*
* The security space for ptw reads is almost always the same
* as that of the security space of the stage 1 translation.
* The only exception is when stage 1 is Secure; in that case
* the ptw read might be to the Secure or the NonSecure space
* (but never Realm or Root), and the s2_mmu_idx tells us which.
* Root translations are always single-stage.
*/
if (s1_space == ARMSS_Secure) {
return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
} else {
assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
assert(s1_space != ARMSS_Root);
return s1_space;
}
} else {
/* ptw loads are from phys: the mmu idx itself says which space */
return arm_phys_to_space(s2_mmu_idx);
}
}
/* Translate a S1 pagetable walk through S2 if needed. */
static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
hwaddr addr, ARMMMUFaultInfo *fi)
{
ARMSecuritySpace space = ptw->in_space;
bool is_secure = ptw->in_secure;
ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@ -502,13 +530,12 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
* From gdbstub, do not use softmmu so that we don't modify the
* state of the cpu at all, including softmmu tlb contents.
*/
ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
S1Translate s2ptw = {
.in_mmu_idx = s2_mmu_idx,
.in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
.in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
.in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
: space == ARMSS_Realm ? ARMSS_Realm
: ARMSS_NonSecure),
.in_secure = arm_space_is_secure(s2_space),
.in_space = s2_space,
.in_debug = true,
};
GetPhysAddrResult s2 = { };