From: Daniel Henrique Barboza <[email protected]>
riscv-iommu spec 1.0 says:
"When checking the U bit in a second-stage PTE, the transaction
is treated as not requesting supervisor privilege."
We need to *always* fault in case we're on G_STAGE and PTE_U is cleared
since we can't be on supervisor mode at this point.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3555
Signed-off-by: Daniel Henrique Barboza <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
---
hw/riscv/riscv-iommu.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index c35e9f0119..6b20940b89 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -495,6 +495,16 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s,
RISCVIOMMUContext *ctx,
break; /* Access bit not set */
} else if ((iotlb->perm & IOMMU_WO) && !ade && !(pte & PTE_D)) {
break; /* Dirty bit not set */
+ } else if (pass == G_STAGE && !(pte & PTE_U)) {
+ /*
+ * riscv-iommu spec 1.0: "When checking the U bit in a
+ * second-stage PTE, the transaction is treated as
+ * not requesting supervisor privilege."
+ *
+ * I.e. we need to fault if this is a non-user PTE since
+ * we are always in user mode at this point.
+ */
+ break;
} else {
/* Leaf PTE, translation completed. */
sc[pass].step = sc[pass].levels;
--
2.54.0
