starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-04-27 00:23:01 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

target/arm: Implement get_S2prot_indirect

Browse Source 
Move the stage2 permissions for normal accesses to
GetPhysAddrResult.s2prot.  Put the stage2 permissions
for page table walking in CPUTLBEntryFull.prot.
This allows the permission checks in S1_ptw_translate
and arm_casq_ptw to see the right permission.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Richard Henderson
2025-10-08 14:55:09 -07:00
committed by Peter Maydell
parent 1cbaf63a10
commit a811c5dafb
2 changed files with 68 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
target/arm/internals.h
View File

@@ -1577,6 +1577,13 @@ typedef struct ARMCacheAttrs {
typedef struct GetPhysAddrResult {
CPUTLBEntryFull f;
ARMCacheAttrs cacheattrs;
/*
* For ARMMMUIdx_Stage2*, the protection installed into f.prot
* is the result for AccessType_TTW, i.e. the page table walk itself.
* The protection installed info s2prot is the one to be merged
* with the stage1 protection.
*/
int s2prot;
} GetPhysAddrResult;
/**

81
target/arm/ptw.c
View File

@@ -1316,7 +1316,7 @@ do_fault:
* @xn: XN (execute-never) bits
* @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
*/
static int get_S2prot_noexecute(int s2ap)
static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
{
int prot = 0;
@@ -1326,12 +1326,6 @@ static int get_S2prot_noexecute(int s2ap)
if (s2ap & 2) {
prot |= PAGE_WRITE;
}
return prot;
}
static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
{
int prot = get_S2prot_noexecute(s2ap);
if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
switch (xn) {
@@ -1363,6 +1357,44 @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
return prot;
}
static int get_S2prot_indirect(CPUARMState *env, GetPhysAddrResult *result,
int pi_index, int po_index, bool s1_is_el0)
{
/* Last index is (priv, unpriv, ttw) */
static const uint8_t perm_table[16][3] = {
/* 0 */ { 0, 0, 0 }, /* no access */
/* 1 */ { 0, 0, 0 }, /* reserved */
/* 2 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
/* 3 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
/* 4 */ { PAGE_WRITE, PAGE_WRITE, 0 },
/* 5 */ { 0, 0, 0 }, /* reserved */
/* 6 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
/* 7 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
/* 8 */ { PAGE_READ, PAGE_READ, PAGE_READ },
/* 9 */ { PAGE_READ, PAGE_READ | PAGE_EXEC, PAGE_READ },
/* A */ { PAGE_READ | PAGE_EXEC, PAGE_READ, PAGE_READ },
/* B */ { PAGE_READ | PAGE_EXEC, PAGE_READ | PAGE_EXEC, PAGE_READ },
/* C */ { PAGE_READ | PAGE_WRITE,
PAGE_READ | PAGE_WRITE,
PAGE_READ | PAGE_WRITE },
/* D */ { PAGE_READ | PAGE_WRITE,
PAGE_READ | PAGE_WRITE | PAGE_EXEC,
PAGE_READ | PAGE_WRITE },
/* E */ { PAGE_READ | PAGE_WRITE | PAGE_EXEC,
PAGE_READ | PAGE_WRITE,
PAGE_READ | PAGE_WRITE },
/* F */ { PAGE_READ | PAGE_WRITE | PAGE_EXEC,
PAGE_READ | PAGE_WRITE | PAGE_EXEC,
PAGE_READ | PAGE_WRITE },
};
uint64_t pir = (env->cp15.scr_el3 & SCR_PIEN ? env->cp15.s2pir_el2 : 0);
int s2pi = extract64(pir, pi_index * 4, 4);
result->f.prot = perm_table[s2pi][2];
return perm_table[s2pi][s1_is_el0];
}
/*
* Translate section/page access permissions to protection flags
* @env: CPUARMState
@@ -1813,7 +1845,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
int32_t stride;
int addrsize, inputsize, outputsize;
uint64_t tcr = regime_tcr(env, mmu_idx);
int ap;
int ap, prot;
uint32_t el = regime_el(env, mmu_idx);
uint64_t descaddrmask;
bool aarch64 = arm_el_is_aa64(env, el);
@@ -2137,6 +2169,18 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
ap = extract32(attrs, 6, 2);
out_space = ptw->cur_space;
if (regime_is_stage2(mmu_idx)) {
if (param.pie) {
int pi = extract64(attrs, 6, 1)
| (extract64(attrs, 51, 1) << 1)
| (extract64(attrs, 53, 2) << 2);
int po = extract64(attrs, 60, 3);
prot = get_S2prot_indirect(env, result, pi, po, ptw->in_s1_is_el0);
} else {
int xn = extract64(attrs, 53, 2);
prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
/* Install TTW permissions in f.prot. */
result->f.prot = prot & (PAGE_READ | PAGE_WRITE);
}
/*
* R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
* The bit remains ignored for other security states.
@@ -2145,11 +2189,9 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
*/
if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
out_space = ARMSS_NonSecure;
result->f.prot = get_S2prot_noexecute(ap);
} else {
int xn = extract64(attrs, 53, 2);
result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
prot &= ~PAGE_EXEC;
}
result->s2prot = prot;
result->cacheattrs.is_s2_format = true;
result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -2221,9 +2263,8 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
* Note that we modified ptw->in_space earlier for NSTable, but
* result->f.attrs retains a copy of the original security space.
*/
result->f.prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
result->f.attrs.space,
out_space);
prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
result->f.attrs.space, out_space);
} else {
int xn = extract64(attrs, 54, 1);
int pxn = extract64(attrs, 53, 1);
@@ -2248,10 +2289,10 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
user_rw = simple_ap_to_rw_prot_is_user(ap, true);
prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
result->f.prot = get_S1prot(env, mmu_idx, aarch64,
user_rw, prot_rw, xn, pxn,
ptw->in_space, out_space);
prot = get_S1prot(env, mmu_idx, aarch64, user_rw, prot_rw,
xn, pxn, ptw->in_space, out_space);
}
result->f.prot = prot;
/* Index into MAIR registers for cache attributes */
attrindx = extract32(attrs, 2, 3);
@@ -2297,7 +2338,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
result->f.tlb_fill_flags = 0;
}
if (ptw->in_prot_check & ~result->f.prot) {
if (ptw->in_prot_check & ~prot) {
fi->type = ARMFault_Permission;
goto do_fault;
}
@@ -3495,7 +3536,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
fi->s2addr = ipa;
/* Combine the S1 and S2 perms. */
result->f.prot &= s1_prot;
result->f.prot = s1_prot & result->s2prot;
/* If S2 fails, return early. */
if (ret) {