In the softmmu version of cpu_memory_rw_debug(), we ask the
CPU for the attributes to use for the virtual memory access,
and we correctly use those to identify the address space
index. However, we were not passing them in to the
address_space_write_rom() and address_space_rw() functions.

The effect of this was that a memory access from the gdbstub
to a device which had behaviour that was sensitive to the
memory attributes (such as some ARMv8M NVIC registers) was
incorrectly always performed as if non-secure, rather than
using the right security state for the CPU's current state.

Fixes: https://bugs.launchpad.net/qemu/+bug/1812091

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 exec.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/exec.c b/exec.c
index 6e875f0640a..2f0f40b0be6 100644
--- a/exec.c
+++ b/exec.c
@@ -3881,12 +3881,10 @@ int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
         phys_addr += (addr & ~TARGET_PAGE_MASK);
         if (is_write) {
             address_space_write_rom(cpu->cpu_ases[asidx].as, phys_addr,
-                                    MEMTXATTRS_UNSPECIFIED,
-                                    buf, l);
+                                    attrs, buf, l);
         } else {
             address_space_rw(cpu->cpu_ases[asidx].as, phys_addr,
-                             MEMTXATTRS_UNSPECIFIED,
-                             buf, l, 0);
+                             attrs, buf, l, 0);
         }
         len -= l;
         buf += l;
-- 
2.20.1

On Thu, Jan 17, 2019 at 01:38:34PM +0000, Peter Maydell wrote:
> In the softmmu version of cpu_memory_rw_debug(), we ask the
> CPU for the attributes to use for the virtual memory access,
> and we correctly use those to identify the address space
> index. However, we were not passing them in to the
> address_space_write_rom() and address_space_rw() functions.
> 
> The effect of this was that a memory access from the gdbstub
> to a device which had behaviour that was sensitive to the
> memory attributes (such as some ARMv8M NVIC registers) was
> incorrectly always performed as if non-secure, rather than
> using the right security state for the CPU's current state.
> 
> Fixes: https://bugs.launchpad.net/qemu/+bug/1812091
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  exec.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

On 1/17/19 2:38 PM, Peter Maydell wrote:
> In the softmmu version of cpu_memory_rw_debug(), we ask the
> CPU for the attributes to use for the virtual memory access,
> and we correctly use those to identify the address space
> index. However, we were not passing them in to the
> address_space_write_rom() and address_space_rw() functions.
> 
> The effect of this was that a memory access from the gdbstub
> to a device which had behaviour that was sensitive to the
> memory attributes (such as some ARMv8M NVIC registers) was
> incorrectly always performed as if non-secure, rather than
> using the right security state for the CPU's current state.
> 
> Fixes: https://bugs.launchpad.net/qemu/+bug/1812091
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> ---
>  exec.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/exec.c b/exec.c
> index 6e875f0640a..2f0f40b0be6 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3881,12 +3881,10 @@ int cpu_memory_rw_debug(CPUState *cpu, target_ulong addr,
>          phys_addr += (addr & ~TARGET_PAGE_MASK);
>          if (is_write) {
>              address_space_write_rom(cpu->cpu_ases[asidx].as, phys_addr,
> -                                    MEMTXATTRS_UNSPECIFIED,
> -                                    buf, l);
> +                                    attrs, buf, l);
>          } else {
>              address_space_rw(cpu->cpu_ases[asidx].as, phys_addr,
> -                             MEMTXATTRS_UNSPECIFIED,
> -                             buf, l, 0);
> +                             attrs, buf, l, 0);
>          }
>          len -= l;
>          buf += l;
>