Possible regression caused by "target/arm: Add ptw_idx to S1Translate"

[Jerome Forissier]

Hi,

I am troubleshooting a regression that seems related to commit
48da29e485af ("target/arm: Add ptw_idx to S1Translate"), at least that's
what git bisect says.

The following hunk looks weird to me:

@@ -1263,7 +1260,18 @@ static bool get_phys_addr_lpae(CPUARMState *env, 
S1Translate *ptw,
         descaddr |= (address >> (stride * (4 - level))) & indexmask;
         descaddr &= ~7ULL;
         nstable = extract32(tableattrs, 4, 1);
-        ptw->in_secure = !nstable;
+        if (!nstable) {
+            /*
+             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
+             * Assert that the non-secure idx are even, and relative order.
+             */
+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
+            ptw->in_ptw_idx &= ~1;
+            ptw->in_secure = false;
+        }
         descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;


Indeed when nstable == false it will set ptw->in_secure = false when
it would be set to true before. Should the test be 'if (nstable)'
instead?

That being said, inverting the test does not fix the regression, so I'm
tracing further.

Thanks,
-- 
Jerome