fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

target/arm: Implement get_S1prot_indirect

Browse source 
This approximately corresponds to AArch64.S1IndirectBasePermissions
and the tail of AArch64.S1ComputePermissions which applies WXN.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Richard Henderson 2025-10-08 14:55:08 -07:00 • committed by Peter Maydell
parent 1952f58f98
commit 1cbaf63a10
1 changed files with 139 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

161
target/arm/ptw.c
View file

@ -1484,6 +1484,106 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
return prot_rw | PAGE_EXEC;
}
/* Extra page permission bits, during get_S1prot_indirect only. */
#define PAGE_GCS (1 << 3)
#define PAGE_WXN (1 << 4)
#define PAGE_OVERLAY (1 << 5)
QEMU_BUILD_BUG_ON(PAGE_RWX & (PAGE_GCS | PAGE_WXN | PAGE_OVERLAY));
static int get_S1prot_indirect(CPUARMState *env, S1Translate *ptw,
ARMMMUIdx mmu_idx, int pi_index, int po_index,
ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
{
static const uint8_t perm_table[16] = {
/* 0 */ PAGE_OVERLAY, /* no access */
/* 1 */ PAGE_OVERLAY | PAGE_READ,
/* 2 */ PAGE_OVERLAY | PAGE_EXEC,
/* 3 */ PAGE_OVERLAY | PAGE_READ | PAGE_EXEC,
/* 4 */ PAGE_OVERLAY, /* reserved */
/* 5 */ PAGE_OVERLAY | PAGE_READ | PAGE_WRITE,
/* 6 */ PAGE_OVERLAY | PAGE_READ | PAGE_WRITE | PAGE_EXEC | PAGE_WXN,
/* 7 */ PAGE_OVERLAY | PAGE_READ | PAGE_WRITE | PAGE_EXEC,
/* 8 */ PAGE_READ,
/* 9 */ PAGE_READ | PAGE_GCS,
/* A */ PAGE_READ | PAGE_EXEC,
/* B */ 0, /* reserved */
/* C */ PAGE_READ | PAGE_WRITE,
/* D */ 0, /* reserved */
/* E */ PAGE_READ | PAGE_WRITE | PAGE_EXEC,
/* F */ 0, /* reserved */
};
uint32_t el = regime_el(env, mmu_idx);
uint64_t pir = env->cp15.pir_el[el];
uint64_t pire0 = 0;
int perm;
if (el < 3) {
if (arm_feature(env, ARM_FEATURE_EL3)
&& !(env->cp15.scr_el3 & SCR_PIEN)) {
pir = 0;
} else if (el == 2) {
pire0 = env->cp15.pire0_el2;
} else if (!ptw->in_nv1) {
pire0 = env->cp15.pir_el[0];
}
}
perm = perm_table[extract64(pir, pi_index * 4, 4)];
if (regime_has_2_ranges(mmu_idx)) {
int p_perm = perm;
int u_perm = perm_table[extract64(pire0, pi_index * 4, 4)];
if ((p_perm & (PAGE_EXEC | PAGE_GCS)) &&
(u_perm & (PAGE_WRITE | PAGE_GCS))) {
p_perm &= ~(PAGE_RWX | PAGE_GCS);
u_perm &= ~(PAGE_RWX | PAGE_GCS);
}
if ((u_perm & (PAGE_RWX | PAGE_GCS)) && regime_is_pan(env, mmu_idx)) {
p_perm &= ~(PAGE_READ | PAGE_WRITE);
}
perm = regime_is_user(env, mmu_idx) ? u_perm : p_perm;
}
if (in_pa != out_pa) {
switch (in_pa) {
case ARMSS_Root:
/*
* R_ZWRVD: permission fault for insn fetched from non-Root,
* I_WWBFB: SIF has no effect in EL3.
*/
perm &= ~(PAGE_EXEC | PAGE_GCS);
break;
case ARMSS_Realm:
/*
* R_PKTDS: permission fault for insn fetched from non-Realm,
* for Realm EL2 or EL2&0. The corresponding fault for EL1&0
* happens during any stage2 translation.
*/
if (el == 2) {
perm &= ~(PAGE_EXEC | PAGE_GCS);
}
break;
case ARMSS_Secure:
if (env->cp15.scr_el3 & SCR_SIF) {
perm &= ~(PAGE_EXEC | PAGE_GCS);
}
break;
default:
/* Input NonSecure must have output NonSecure. */
g_assert_not_reached();
}
}
if (perm & PAGE_WXN) {
perm &= ~PAGE_EXEC;
}
/* TODO: FEAT_GCS */
return perm & PAGE_RWX;
}
static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
ARMMMUIdx mmu_idx)
{
@ -1713,7 +1813,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
int32_t stride;
int addrsize, inputsize, outputsize;
uint64_t tcr = regime_tcr(env, mmu_idx);
int ap, xn, pxn;
int ap;
uint32_t el = regime_el(env, mmu_idx);
uint64_t descaddrmask;
bool aarch64 = arm_el_is_aa64(env, el);
@ -2047,7 +2147,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
out_space = ARMSS_NonSecure;
result->f.prot = get_S2prot_noexecute(ap);
} else {
xn = extract64(attrs, 53, 2);
int xn = extract64(attrs, 53, 2);
result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
}
@ -2063,7 +2163,6 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
int nse, ns = extract32(attrs, 5, 1);
uint8_t attrindx;
uint64_t mair;
int user_rw, prot_rw;
switch (out_space) {
case ARMSS_Root:
@ -2112,29 +2211,47 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
default:
g_assert_not_reached();
}
xn = extract64(attrs, 54, 1);
pxn = extract64(attrs, 53, 1);
if (el == 1 && ptw->in_nv1) {
if (param.pie) {
int pi = extract64(attrs, 6, 1)
| (extract64(attrs, 51, 1) << 1)
| (extract64(attrs, 53, 2) << 2);
int po = extract64(attrs, 60, 3);
/*
* With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1}, the block/page
* descriptor bit 54 holds PXN, 53 is RES0, and the effective value
* of UXN is 0. Similarly for bits 59 and 60 in table descriptors
* (which we have already folded into bits 53 and 54 of attrs).
* AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
* Similarly, APTable[0] from the table descriptor is treated as 0;
* we already folded this into AP[1] and squashing that to 0 does
* the right thing.
* Note that we modified ptw->in_space earlier for NSTable, but
* result->f.attrs retains a copy of the original security space.
*/
pxn = xn;
xn = 0;
ap &= ~1;
}
result->f.prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
result->f.attrs.space,
out_space);
} else {
int xn = extract64(attrs, 54, 1);
int pxn = extract64(attrs, 53, 1);
int user_rw, prot_rw;
user_rw = simple_ap_to_rw_prot_is_user(ap, true);
prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
result->f.prot = get_S1prot(env, mmu_idx, aarch64, user_rw, prot_rw,
xn, pxn, ptw->in_space, out_space);
if (el == 1 && ptw->in_nv1) {
/*
* With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1},
* the block/page descriptor bit 54 holds PXN,
* 53 is RES0, and the effective value of UXN is 0.
* Similarly for bits 59 and 60 in table descriptors
* (which we have already folded into bits 53 and 54 of attrs).
* AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
* Similarly, APTable[0] from the table descriptor is treated
* as 0; we already folded this into AP[1] and squashing
* that to 0 does the right thing.
*/
pxn = xn;
xn = 0;
ap &= ~1;
}
user_rw = simple_ap_to_rw_prot_is_user(ap, true);
prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
result->f.prot = get_S1prot(env, mmu_idx, aarch64,
user_rw, prot_rw, xn, pxn,
ptw->in_space, out_space);
}
/* Index into MAIR registers for cache attributes */
attrindx = extract32(attrs, 2, 3);