@samitouri / QOSamiQemu / commits / 32ebd6c09c

target/arm: fix s2prot not set for two-stage PMSA translations

Commit a811c5dafb7 ("target/arm: Implement get_S2prot_indirect") changed get_phys_addr_twostage() to combine stage 1 and stage 2 permissions using the new s2prot field: result->f.prot = s1_prot & result->s2prot; The LPAE stage 2 path sets result->s2prot explicitly, but the PMSA stage 2 path (get_phys_addr_pmsav8) only sets result->f.prot, leaving s2prot at zero. This causes the combined permission to be zero, resulting in addr_read being set to -1 in the TLB entry and triggering an assertion in atomic_mmu_lookup() when the guest executes an atomic instruction on a two-stage PMSA platform (e.g. Cortex-R52 with EL2). Set s2prot from f.prot after the PMSA stage 2 lookup, consistent with what the LPAE path does. Cc: qemu-stable@nongnu.org Fixes: a811c5dafb7 ("target/arm: Implement get_S2prot_indirect") Signed-off-by: Jose Martins <josemartins90@gmail.com> [PMM: refer to the right commit in the commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20260321231916.2852653-1-josemartins90@gmail.com Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Jose Martins committed Mar 24, 2026 at 14:02 UTC 32ebd6c09c18f860671030060cfedabd94c846fb

1 file changed +7

target/arm/ptw.c

@@ -3200,6 +3200,13 @@ static bool get_phys_addr_pmsav8(CPUARMState *env,

3200

3201 ret = pmsav8_mpu_lookup(env, address, access_type, ptw->in_prot_check,

3202 mmu_idx, secure, result, fi, NULL);

3203 + /*

3204 + * For two-stage PMSA translations, s2prot holds the stage 2

3205 + * permissions to be combined with stage 1 in get_phys_addr_twostage().

3206 + */

3207 + if (regime_is_stage2(mmu_idx)) {

3208 + result->s2prot = result->f.prot;

3209 + }

3210 if (sattrs.subpage) {

3211 result->f.lg_page_size = 0;

3212 }