diff options
author | Peter Maydell <peter.maydell@linaro.org> | 2023-08-22 17:31:05 +0100 |
---|---|---|
committer | Peter Maydell <peter.maydell@linaro.org> | 2023-08-22 17:31:05 +0100 |
commit | f6415660746fcf58d6baf8dd8da77cb08adb9970 (patch) | |
tree | ea2d863efe30bae4dfb40c4a223fee945fa7978c /target/arm/ptw.c | |
parent | c986d860398ff44c32a612b3d8dfc9f89ffe5e52 (diff) | |
download | qemu-f6415660746fcf58d6baf8dd8da77cb08adb9970.zip qemu-f6415660746fcf58d6baf8dd8da77cb08adb9970.tar.gz qemu-f6415660746fcf58d6baf8dd8da77cb08adb9970.tar.bz2 |
target/arm/ptw: Don't report GPC faults on stage 1 ptw as stage2 faults
In S1_ptw_translate() we set up the ARMMMUFaultInfo if the attempt to
translate the page descriptor address into a physical address fails.
This used to only be possible if we are doing a stage 2 ptw for that
descriptor address, and so the code always sets fi->stage2 and
fi->s1ptw to true. However, with FEAT_RME it is also possible for
the lookup of the page descriptor address to fail because of a
Granule Protection Check fault. These should not be reported as
stage 2, otherwise arm_deliver_fault() will incorrectly set
HPFAR_EL2. Similarly the s1ptw bit should only be set for stage 2
faults on stage 1 translation table walks, i.e. not for GPC faults.
Add a comment to the the other place where we might detect a
stage2-fault-on-stage-1-ptw, in arm_casq_ptw(), noting why we know in
that case that it must really be a stage 2 fault and not a GPC fault.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-3-peter.maydell@linaro.org
Diffstat (limited to 'target/arm/ptw.c')
-rw-r--r-- | target/arm/ptw.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/target/arm/ptw.c b/target/arm/ptw.c index bafeb87..eb57ebd 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -600,8 +600,8 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, fi->type = ARMFault_GPCFOnWalk; } fi->s2addr = addr; - fi->stage2 = true; - fi->s1ptw = true; + fi->stage2 = regime_is_stage2(s2_mmu_idx); + fi->s1ptw = fi->stage2; fi->s1ns = !is_secure; return false; } @@ -719,6 +719,12 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val, env->tlb_fi = NULL; if (unlikely(flags & TLB_INVALID_MASK)) { + /* + * We know this must be a stage 2 fault because the granule + * protection table does not separately track read and write + * permission, so all GPC faults are caught in S1_ptw_translate(): + * we only get here for "readable but not writeable". + */ assert(fi->type != ARMFault_None); fi->s2addr = ptw->out_virt; fi->stage2 = true; |