Take the result of stage-1 and stage-2 page table walks and AND the two
protection flags together. This way we require both to set permissions
instead of just stage-2.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
target/riscv/cpu_helper.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index f36d184b7b..50e13a064f 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -707,7 +707,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
#ifndef CONFIG_USER_ONLY
vaddr im_address;
hwaddr pa = 0;
- int prot;
+ int prot, prot2;
bool pmp_violation = false;
bool m_mode_two_stage = false;
bool hs_mode_two_stage = false;
@@ -757,13 +757,15 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
/* Second stage lookup */
im_address = pa;
- ret = get_physical_address(env, &pa, &prot, im_address,
+ ret = get_physical_address(env, &pa, &prot2, im_address,
access_type, mmu_idx, false, true);
qemu_log_mask(CPU_LOG_MMU,
"%s 2nd-stage address=%" VADDR_PRIx " ret %d physical "
TARGET_FMT_plx " prot %d\n",
- __func__, im_address, ret, pa, prot);
+ __func__, im_address, ret, pa, prot2);
+
+ prot &= prot2;
if (riscv_feature(env, RISCV_FEATURE_PMP) &&
(ret == TRANSLATE_SUCCESS) &&
--
2.26.0
On 3/26/20 3:44 PM, Alistair Francis wrote: > Take the result of stage-1 and stage-2 page table walks and AND the two > protection flags together. This way we require both to set permissions > instead of just stage-2. > > Signed-off-by: Alistair Francis <alistair.francis@wdc.com> > --- > target/riscv/cpu_helper.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c > index f36d184b7b..50e13a064f 100644 > --- a/target/riscv/cpu_helper.c > +++ b/target/riscv/cpu_helper.c > @@ -707,7 +707,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, > #ifndef CONFIG_USER_ONLY > vaddr im_address; > hwaddr pa = 0; > - int prot; > + int prot, prot2; > bool pmp_violation = false; > bool m_mode_two_stage = false; > bool hs_mode_two_stage = false; > @@ -757,13 +757,15 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, > /* Second stage lookup */ > im_address = pa; > > - ret = get_physical_address(env, &pa, &prot, im_address, > + ret = get_physical_address(env, &pa, &prot2, im_address, > access_type, mmu_idx, false, true); > > qemu_log_mask(CPU_LOG_MMU, > "%s 2nd-stage address=%" VADDR_PRIx " ret %d physical " > TARGET_FMT_plx " prot %d\n", > - __func__, im_address, ret, pa, prot); > + __func__, im_address, ret, pa, prot2); > + > + prot &= prot2; > > if (riscv_feature(env, RISCV_FEATURE_PMP) && > (ret == TRANSLATE_SUCCESS) && > Whee! Yes, I think this is what you've been looking for. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
On Thu, Mar 26, 2020 at 4:32 PM Richard Henderson <richard.henderson@linaro.org> wrote: > > On 3/26/20 3:44 PM, Alistair Francis wrote: > > Take the result of stage-1 and stage-2 page table walks and AND the two > > protection flags together. This way we require both to set permissions > > instead of just stage-2. > > > > Signed-off-by: Alistair Francis <alistair.francis@wdc.com> > > --- > > target/riscv/cpu_helper.c | 8 +++++--- > > 1 file changed, 5 insertions(+), 3 deletions(-) > > > > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c > > index f36d184b7b..50e13a064f 100644 > > --- a/target/riscv/cpu_helper.c > > +++ b/target/riscv/cpu_helper.c > > @@ -707,7 +707,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, > > #ifndef CONFIG_USER_ONLY > > vaddr im_address; > > hwaddr pa = 0; > > - int prot; > > + int prot, prot2; > > bool pmp_violation = false; > > bool m_mode_two_stage = false; > > bool hs_mode_two_stage = false; > > @@ -757,13 +757,15 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, > > /* Second stage lookup */ > > im_address = pa; > > > > - ret = get_physical_address(env, &pa, &prot, im_address, > > + ret = get_physical_address(env, &pa, &prot2, im_address, > > access_type, mmu_idx, false, true); > > > > qemu_log_mask(CPU_LOG_MMU, > > "%s 2nd-stage address=%" VADDR_PRIx " ret %d physical " > > TARGET_FMT_plx " prot %d\n", > > - __func__, im_address, ret, pa, prot); > > + __func__, im_address, ret, pa, prot2); > > + > > + prot &= prot2; > > > > if (riscv_feature(env, RISCV_FEATURE_PMP) && > > (ret == TRANSLATE_SUCCESS) && > > > > Whee! Yes, I think this is what you've been looking for. Yep! I actually tried this ages ago, but it didn't work without the first path so it never fixed the problem. > Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Thanks Alistair > > > r~
© 2016 - 2026 Red Hat, Inc.