Bug fixes related to secure 2 stage translation

[PATCH 1/3] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space

Posted by Idan Horowitz 3 years, 10 months ago

As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
PA space of the IPA is non secure, the output PA space is secure if and only
if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 812ca591f4..d0265b760f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12697,7 +12697,7 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 } else {
                     attrs->secure =
                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
-                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
                 }
             }
             return 0;
-- 
2.35.1

Re: [PATCH 1/3] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space

Posted by Richard Henderson 3 years, 10 months ago

On 3/27/22 03:34, Idan Horowitz wrote:
> As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
> PA space of the IPA is non secure, the output PA space is secure if and only
> if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
> 
> Signed-off-by: Idan Horowitz<idan.horowitz@gmail.com>
> ---
>   target/arm/helper.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~

Re: [PATCH 1/3] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space

Posted by Rémi Denis-Courmont 3 years, 10 months ago

Le sunnuntaina 27. maaliskuuta 2022, 12.34.26 EEST Idan Horowitz a écrit :
> As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
> PA space of the IPA is non secure, the output PA space is secure if and only
> if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
> 
> Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
> ---
>  target/arm/helper.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 812ca591f4..d0265b760f 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -12697,7 +12697,7 @@ bool get_phys_addr(CPUARMState *env, target_ulong
> address, } else {
>                      attrs->secure =
>                          !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA |
> VTCR_NSW)) -                        || (env->cp15.vstcr_el2.raw_tcr &
> VSTCR_SA)); +                        || (env->cp15.vstcr_el2.raw_tcr &
> (VSTCR_SA | VSTCR_SW))); }

The VTCR_EL2 specification says that the NSA bit "behaves as 1 for all purposes 
other than reading back the value of the bit when one of the following is true 
(...)
* The value of VTCR_EL2.NSW is 1.
* The value of VSTCR_EL2.SA is 1."

Sorry but I don't see any reason to check the SW bit here.

-- 
Реми Дёни-Курмон
http://www.remlab.net/

Re: [PATCH 1/3] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space

Posted by Richard Henderson 3 years, 10 months ago

On 3/27/22 08:24, Rémi Denis-Courmont wrote:
> Le sunnuntaina 27. maaliskuuta 2022, 12.34.26 EEST Idan Horowitz a écrit :
>> As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
>> PA space of the IPA is non secure, the output PA space is secure if and only
>> if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
>>
>> Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
>> ---
>>   target/arm/helper.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/target/arm/helper.c b/target/arm/helper.c
>> index 812ca591f4..d0265b760f 100644
>> --- a/target/arm/helper.c
>> +++ b/target/arm/helper.c
>> @@ -12697,7 +12697,7 @@ bool get_phys_addr(CPUARMState *env, target_ulong
>> address, } else {
>>                       attrs->secure =
>>                           !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA |
>> VTCR_NSW)) -                        || (env->cp15.vstcr_el2.raw_tcr &
>> VSTCR_SA)); +                        || (env->cp15.vstcr_el2.raw_tcr &
>> (VSTCR_SA | VSTCR_SW))); }
> 
> The VTCR_EL2 specification says that the NSA bit "behaves as 1 for all purposes
> other than reading back the value of the bit when one of the following is true
> (...)
> * The value of VTCR_EL2.NSW is 1.
> * The value of VSTCR_EL2.SA is 1."
> 
> Sorry but I don't see any reason to check the SW bit here.

Because the description of SA says that it behaves as 1 if SW is 1.


r~

[PATCH 1/3] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
[PATCH 2/3] target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
[PATCH 3/3] target/arm: Determine final stage 2 output PA space based on original IPA