Re: [PATCH for-8.1 2/3] target/arm: Fix S1_ptw_translate() debug path
On 7/10/23 16:21, Peter Maydell wrote:
In commit XXX we rearranged the logic in S1_ptw_translate() so that
the debug-access "call get_phys_addr_*" codepath is used both when S1
is doing ptw reads from stage 2 and when it is doing ptw reads from
physical memory. However, we didn't update the calculation of
s2ptw->in_space and s2ptw->in_secure to account for the "ptw reads
from physical memory" case. This meant that debug accesses when in
Secure state broke.
Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.
Reported-by: Jean-Philippe Brucker
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in
S1_ptw_translate")
Signed-off-by: Peter Maydell
---
target/arm/ptw.c | 37 -
1 file changed, 32 insertions(+), 5 deletions(-)
Reviewed-by: Richard Henderson
r~
Re: [PATCH for-8.1 2/3] target/arm: Fix S1_ptw_translate() debug path
On Mon, Jul 10, 2023 at 04:21:29PM +0100, Peter Maydell wrote:
> In commit XXX we rearranged the logic in S1_ptw_translate() so that
> the debug-access "call get_phys_addr_*" codepath is used both when S1
> is doing ptw reads from stage 2 and when it is doing ptw reads from
> physical memory. However, we didn't update the calculation of
> s2ptw->in_space and s2ptw->in_secure to account for the "ptw reads
> from physical memory" case. This meant that debug accesses when in
> Secure state broke.
>
> Create a new function S2_security_space() which returns the
> correct security space to use for the ptw load, and use it to
> determine the correct .in_secure and .in_space fields for the
> stage 2 lookup for the ptw load.
>
> Reported-by: Jean-Philippe Brucker
> Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in
> S1_ptw_translate")
> Signed-off-by: Peter Maydell
Thanks, this fixes tf-a boot with semihosting
Tested-by: Jean-Philippe Brucker
> ---
> target/arm/ptw.c | 37 -
> 1 file changed, 32 insertions(+), 5 deletions(-)
>
> diff --git a/target/arm/ptw.c b/target/arm/ptw.c
> index 21749375f97..c0b9cee5843 100644
> --- a/target/arm/ptw.c
> +++ b/target/arm/ptw.c
> @@ -485,11 +485,39 @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t
> attrs)
> }
> }
>
> +static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
> + ARMMMUIdx s2_mmu_idx)
> +{
> +/*
> + * Return the security space to use for stage 2 when doing
> + * the S1 page table descriptor load.
> + */
> +if (regime_is_stage2(s2_mmu_idx)) {
> +/*
> + * The security space for ptw reads is almost always the same
> + * as that of the security space of the stage 1 translation.
> + * The only exception is when stage 1 is Secure; in that case
> + * the ptw read might be to the Secure or the NonSecure space
> + * (but never Realm or Root), and the s2_mmu_idx tells us which.
> + * Root translations are always single-stage.
> + */
> +if (s1_space == ARMSS_Secure) {
> +return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
> +} else {
> +assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
> +assert(s1_space != ARMSS_Root);
> +return s1_space;
> +}
> +} else {
> +/* ptw loads are from phys: the mmu idx itself says which space */
> +return arm_phys_to_space(s2_mmu_idx);
> +}
> +}
> +
> /* Translate a S1 pagetable walk through S2 if needed. */
> static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
> hwaddr addr, ARMMMUFaultInfo *fi)
> {
> -ARMSecuritySpace space = ptw->in_space;
> bool is_secure = ptw->in_secure;
> ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
> ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
> @@ -502,13 +530,12 @@ static bool S1_ptw_translate(CPUARMState *env,
> S1Translate *ptw,
> * From gdbstub, do not use softmmu so that we don't modify the
> * state of the cpu at all, including softmmu tlb contents.
> */
> +ARMSecuritySpace s2_space = S2_security_space(ptw->in_space,
> s2_mmu_idx);
> S1Translate s2ptw = {
> .in_mmu_idx = s2_mmu_idx,
> .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
> -.in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
> -.in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
> - : space == ARMSS_Realm ? ARMSS_Realm
> - : ARMSS_NonSecure),
> +.in_secure = arm_space_is_secure(s2_space),
> +.in_space = s2_space,
> .in_debug = true,
> };
> GetPhysAddrResult s2 = { };
> --
> 2.34.1
>
Re: [PATCH for-8.1 2/3] target/arm: Fix S1_ptw_translate() debug path
On Mon, 10 Jul 2023 at 16:21, Peter Maydell wrote:
>
> In commit XXX we rearranged the logic in S1_ptw_translate() so that
Should read "commit fe4a5472ccd6" -- I put in the Fixes:
tag below but forgot to update the placeholder in the
commit message text...
> the debug-access "call get_phys_addr_*" codepath is used both when S1
> is doing ptw reads from stage 2 and when it is doing ptw reads from
> physical memory. However, we didn't update the calculation of
> s2ptw->in_space and s2ptw->in_secure to account for the "ptw reads
> from physical memory" case. This meant that debug accesses when in
> Secure state broke.
>
> Create a new function S2_security_space() which returns the
> correct security space to use for the ptw load, and use it to
> determine the correct .in_secure and .in_space fields for the
> stage 2 lookup for the ptw load.
>
> Reported-by: Jean-Philippe Brucker
> Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in
> S1_ptw_translate")
> Signed-off-by: Peter Maydell
-- PMM
[PATCH for-8.1 2/3] target/arm: Fix S1_ptw_translate() debug path
In commit XXX we rearranged the logic in S1_ptw_translate() so that
the debug-access "call get_phys_addr_*" codepath is used both when S1
is doing ptw reads from stage 2 and when it is doing ptw reads from
physical memory. However, we didn't update the calculation of
s2ptw->in_space and s2ptw->in_secure to account for the "ptw reads
from physical memory" case. This meant that debug accesses when in
Secure state broke.
Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.
Reported-by: Jean-Philippe Brucker
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in
S1_ptw_translate")
Signed-off-by: Peter Maydell
---
target/arm/ptw.c | 37 -
1 file changed, 32 insertions(+), 5 deletions(-)
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 21749375f97..c0b9cee5843 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -485,11 +485,39 @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t
attrs)
}
}
+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
+ ARMMMUIdx s2_mmu_idx)
+{
+/*
+ * Return the security space to use for stage 2 when doing
+ * the S1 page table descriptor load.
+ */
+if (regime_is_stage2(s2_mmu_idx)) {
+/*
+ * The security space for ptw reads is almost always the same
+ * as that of the security space of the stage 1 translation.
+ * The only exception is when stage 1 is Secure; in that case
+ * the ptw read might be to the Secure or the NonSecure space
+ * (but never Realm or Root), and the s2_mmu_idx tells us which.
+ * Root translations are always single-stage.
+ */
+if (s1_space == ARMSS_Secure) {
+return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
+} else {
+assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
+assert(s1_space != ARMSS_Root);
+return s1_space;
+}
+} else {
+/* ptw loads are from phys: the mmu idx itself says which space */
+return arm_phys_to_space(s2_mmu_idx);
+}
+}
+
/* Translate a S1 pagetable walk through S2 if needed. */
static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
hwaddr addr, ARMMMUFaultInfo *fi)
{
-ARMSecuritySpace space = ptw->in_space;
bool is_secure = ptw->in_secure;
ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -502,13 +530,12 @@ static bool S1_ptw_translate(CPUARMState *env,
S1Translate *ptw,
* From gdbstub, do not use softmmu so that we don't modify the
* state of the cpu at all, including softmmu tlb contents.
*/
+ARMSecuritySpace s2_space = S2_security_space(ptw->in_space,
s2_mmu_idx);
S1Translate s2ptw = {
.in_mmu_idx = s2_mmu_idx,
.in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-.in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-.in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
- : space == ARMSS_Realm ? ARMSS_Realm
- : ARMSS_NonSecure),
+.in_secure = arm_space_is_secure(s2_space),
+.in_space = s2_space,
.in_debug = true,
};
GetPhysAddrResult s2 = { };
--
2.34.1
