Skip to content

Commit

Permalink
target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3
Browse files Browse the repository at this point in the history
When we do an AT address translation operation, the page table walk
is supposed to be performed in the context of the EL we're doing the
walk for, so for instance an AT S1E2R walk is done for EL2.  In the
pseudocode an EL is passed to AArch64.AT(), which calls
SecurityStateAtEL() to find the security state that we should be
doing the walk with.

In ats_write64() we get this wrong, instead using the current
security space always.  This is fine for AT operations performed from
EL1 and EL2, because there the current security state and the
security state for the lower EL are the same.  But for AT operations
performed from EL3, the current security state is always either
Secure or Root, whereas we want to use the security state defined by
SCR_EL3.{NS,NSE} for the walk. This affects not just guests using
FEAT_RME but also ones where EL3 is Secure state and the EL3 code
is trying to do an AT for a NonSecure EL2 or EL1.

Use arm_security_space_below_el3() to get the SecuritySpace to
pass to do_ats_write() for all AT operations except the
AT S1E3* operations.

Cc: qemu-stable@nongnu.org
Fixes: e1ee56e ("target/arm: Pass security space rather than flag for AT instructions")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2250
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240405180232.3570066-1-peter.maydell@linaro.org
(cherry picked from commit 19b254e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
  • Loading branch information
pm215 authored and Michael Tokarev committed Apr 9, 2024
1 parent 6983d16 commit f7a1ff6
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions target/arm/helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -3703,6 +3703,8 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
ARMMMUIdx mmu_idx;
uint64_t hcr_el2 = arm_hcr_el2_eff(env);
bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
bool for_el3 = false;
ARMSecuritySpace ss;

switch (ri->opc2 & 6) {
case 0:
Expand All @@ -3720,6 +3722,7 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
break;
case 6: /* AT S1E3R, AT S1E3W */
mmu_idx = ARMMMUIdx_E3;
for_el3 = true;
break;
default:
g_assert_not_reached();
Expand All @@ -3738,8 +3741,8 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
g_assert_not_reached();
}

env->cp15.par_el[1] = do_ats_write(env, value, access_type,
mmu_idx, arm_security_space(env));
ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
#else
/* Handled by hardware accelerator. */
g_assert_not_reached();
Expand Down

0 comments on commit f7a1ff6

Please sign in to comment.