@samitouri / QOSamiQemu / commits / 566594f108

target/arm: fix fault_s1ns for stage 2 faults

The computation of s1ns was simply wrong. For Stage 2 faults, it should indicate whether the faulting IPA is in the Non-Secure IPA space. Correct the logic to check for ARMSS_NonSecure and drop the extraneous s2_mmu_idx test. This is effectively a change in the intended semantics of the ARMMMUFaultInfo::s1ns field, so that we no longer try to make it exactly match HPFAR_EL2.NS but instead set it for any stage 2 fault on an NS IPA, relying on users of the field to check whether the fault is to be taken to Secure EL2 before propagating the field to the HPFAR_EL2.NS bit. Since the actual writing of HPFAR_EL2.NS is already gated by arm_is_secure_below_el3(env), we only need to update the comments to document this change of semantics. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2568 Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20260405112410.603223-1-alex.bennee@linaro.org [PMM: also update comments about the s1ns field] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Alex Bennée committed Apr 5, 2026 at 12:24 UTC 566594f10873723a179057a604d890bfaa1a9f0a

2 files changed +11 -6

target/arm/internals.h

+4 -1

@@ -740,7 +740,10 @@ typedef enum ARMGPCF {

740 * @paddr_space: physical address space that caused a fault for gpc

741 * @stage2: True if we faulted at stage 2

742 * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk

743 - * @s1ns: True if we faulted on a non-secure IPA while in secure state

743 + * @s1ns: True if we faulted on a non-secure IPA. Note that (unlike the

744 + * HPFAR_EL2.NS bit) this is set for any stage 2 fault for an NS IPA, so

745 + * code must check that this is for a fault taken to Secure EL2 before

746 + * propagating s1ns to HPFAR_EL2.NS.

747 * @ea: True if we should set the EA (external abort type) bit in syndrome

748 */

749 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;

target/arm/ptw.c

+7 -5

@@ -611,12 +611,14 @@ static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,

611 static bool fault_s1ns(ARMSecuritySpace space, ARMMMUIdx s2_mmu_idx)

612 {

613 /*

614 - * For stage 2 faults in Secure EL22, S1NS indicates

615 - * whether the faulting IPA is in the Secure or NonSecure

616 - * IPA space. For all other kinds of fault, it is false.

614 + * For stage 2 faults, S1NS indicates whether the faulting IPA is

615 + * in the Non-Secure (true) or Secure (false) IPA space. For all

616 + * other kinds of fault, it is false. Note that we do not

617 + * distinguish "s2 fault on NS IPA taken to Secure EL2" from

618 + * "s2 fault on NS IPA taken to NS EL2 or Realm EL2" here, but

619 + * instead do that when setting HPFAR_EL2.NS.

620 */

618 - return space == ARMSS_Secure && regime_is_stage2(s2_mmu_idx)

619 - && s2_mmu_idx == ARMMMUIdx_Stage2_S;

621 + return space == ARMSS_NonSecure && regime_is_stage2(s2_mmu_idx);

622 }

623

624 /* Translate a S1 pagetable walk through S2 if needed. */