1 /*
2 * ARM page table walking.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/range.h"
12 #include "qemu/main-loop.h"
13 #include "exec/exec-all.h"
14 #include "exec/page-protection.h"
15 #include "cpu.h"
16 #include "internals.h"
17 #include "cpu-features.h"
18 #include "idau.h"
19 #ifdef CONFIG_TCG
20 # include "tcg/oversized-guest.h"
21 #endif
22
23 typedef struct S1Translate {
24 /*
25 * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
26 * Together with in_space, specifies the architectural translation regime.
27 */
28 ARMMMUIdx in_mmu_idx;
29 /*
30 * in_ptw_idx: specifies which mmuidx to use for the actual
31 * page table descriptor load operations. This will be one of the
32 * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
33 * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
34 * this field is updated accordingly.
35 */
36 ARMMMUIdx in_ptw_idx;
37 /*
38 * in_space: the security space for this walk. This plus
39 * the in_mmu_idx specify the architectural translation regime.
40 * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
41 * this field is updated accordingly.
42 *
43 * Note that the security space for the in_ptw_idx may be different
44 * from that for the in_mmu_idx. We do not need to explicitly track
45 * the in_ptw_idx security space because:
46 * - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
47 * itself specifies the security space
48 * - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
49 * space used for ptw reads is the same as that of the security
50 * space of the stage 1 translation for all cases except where
51 * stage 1 is Secure; in that case the only possibilities for
52 * the ptw read are Secure and NonSecure, and the in_ptw_idx
53 * value being Stage2 vs Stage2_S distinguishes those.
54 */
55 ARMSecuritySpace in_space;
56 /*
57 * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
58 * accesses will not update the guest page table access flags
59 * and will not change the state of the softmmu TLBs.
60 */
61 bool in_debug;
62 /*
63 * If this is stage 2 of a stage 1+2 page table walk, then this must
64 * be true if stage 1 is an EL0 access; otherwise this is ignored.
65 * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
66 */
67 bool in_s1_is_el0;
68 bool out_rw;
69 bool out_be;
70 ARMSecuritySpace out_space;
71 hwaddr out_virt;
72 hwaddr out_phys;
73 void *out_host;
74 } S1Translate;
75
76 static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
77 vaddr address,
78 MMUAccessType access_type,
79 GetPhysAddrResult *result,
80 ARMMMUFaultInfo *fi);
81
82 static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
83 vaddr address,
84 MMUAccessType access_type,
85 GetPhysAddrResult *result,
86 ARMMMUFaultInfo *fi);
87
88 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
89 static const uint8_t pamax_map[] = {
90 [0] = 32,
91 [1] = 36,
92 [2] = 40,
93 [3] = 42,
94 [4] = 44,
95 [5] = 48,
96 [6] = 52,
97 };
98
99 /*
100 * The cpu-specific constant value of PAMax; also used by hw/arm/virt.
101 * Note that machvirt_init calls this on a CPU that is inited but not realized!
102 */
arm_pamax(ARMCPU * cpu)103 unsigned int arm_pamax(ARMCPU *cpu)
104 {
105 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
106 unsigned int parange =
107 FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
108
109 /*
110 * id_aa64mmfr0 is a read-only register so values outside of the
111 * supported mappings can be considered an implementation error.
112 */
113 assert(parange < ARRAY_SIZE(pamax_map));
114 return pamax_map[parange];
115 }
116
117 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
118 /* v7 or v8 with LPAE */
119 return 40;
120 }
121 /* Anything else */
122 return 32;
123 }
124
125 /*
126 * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index
127 */
stage_1_mmu_idx(ARMMMUIdx mmu_idx)128 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
129 {
130 switch (mmu_idx) {
131 case ARMMMUIdx_E10_0:
132 return ARMMMUIdx_Stage1_E0;
133 case ARMMMUIdx_E10_1:
134 return ARMMMUIdx_Stage1_E1;
135 case ARMMMUIdx_E10_1_PAN:
136 return ARMMMUIdx_Stage1_E1_PAN;
137 default:
138 return mmu_idx;
139 }
140 }
141
arm_stage1_mmu_idx(CPUARMState * env)142 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
143 {
144 return stage_1_mmu_idx(arm_mmu_idx(env));
145 }
146
147 /*
148 * Return where we should do ptw loads from for a stage 2 walk.
149 * This depends on whether the address we are looking up is a
150 * Secure IPA or a NonSecure IPA, which we know from whether this is
151 * Stage2 or Stage2_S.
152 * If this is the Secure EL1&0 regime we need to check the NSW and SW bits.
153 */
ptw_idx_for_stage_2(CPUARMState * env,ARMMMUIdx stage2idx)154 static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx)
155 {
156 bool s2walk_secure;
157
158 /*
159 * We're OK to check the current state of the CPU here because
160 * (1) we always invalidate all TLBs when the SCR_EL3.NS or SCR_EL3.NSE bit
161 * changes.
162 * (2) there's no way to do a lookup that cares about Stage 2 for a
163 * different security state to the current one for AArch64, and AArch32
164 * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
165 * an NS stage 1+2 lookup while the NS bit is 0.)
166 */
167 if (!arm_el_is_aa64(env, 3)) {
168 return ARMMMUIdx_Phys_NS;
169 }
170
171 switch (arm_security_space_below_el3(env)) {
172 case ARMSS_NonSecure:
173 return ARMMMUIdx_Phys_NS;
174 case ARMSS_Realm:
175 return ARMMMUIdx_Phys_Realm;
176 case ARMSS_Secure:
177 if (stage2idx == ARMMMUIdx_Stage2_S) {
178 s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
179 } else {
180 s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
181 }
182 return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
183 default:
184 g_assert_not_reached();
185 }
186 }
187
regime_translation_big_endian(CPUARMState * env,ARMMMUIdx mmu_idx)188 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
189 {
190 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
191 }
192
193 /* Return the TTBR associated with this translation regime */
regime_ttbr(CPUARMState * env,ARMMMUIdx mmu_idx,int ttbrn)194 static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
195 {
196 if (mmu_idx == ARMMMUIdx_Stage2) {
197 return env->cp15.vttbr_el2;
198 }
199 if (mmu_idx == ARMMMUIdx_Stage2_S) {
200 return env->cp15.vsttbr_el2;
201 }
202 if (ttbrn == 0) {
203 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
204 } else {
205 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
206 }
207 }
208
209 /* Return true if the specified stage of address translation is disabled */
regime_translation_disabled(CPUARMState * env,ARMMMUIdx mmu_idx,ARMSecuritySpace space)210 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
211 ARMSecuritySpace space)
212 {
213 uint64_t hcr_el2;
214
215 if (arm_feature(env, ARM_FEATURE_M)) {
216 bool is_secure = arm_space_is_secure(space);
217 switch (env->v7m.mpu_ctrl[is_secure] &
218 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
219 case R_V7M_MPU_CTRL_ENABLE_MASK:
220 /* Enabled, but not for HardFault and NMI */
221 return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
222 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
223 /* Enabled for all cases */
224 return false;
225 case 0:
226 default:
227 /*
228 * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
229 * we warned about that in armv7m_nvic.c when the guest set it.
230 */
231 return true;
232 }
233 }
234
235
236 switch (mmu_idx) {
237 case ARMMMUIdx_Stage2:
238 case ARMMMUIdx_Stage2_S:
239 /* HCR.DC means HCR.VM behaves as 1 */
240 hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
241 return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
242
243 case ARMMMUIdx_E10_0:
244 case ARMMMUIdx_E10_1:
245 case ARMMMUIdx_E10_1_PAN:
246 /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
247 hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
248 if (hcr_el2 & HCR_TGE) {
249 return true;
250 }
251 break;
252
253 case ARMMMUIdx_Stage1_E0:
254 case ARMMMUIdx_Stage1_E1:
255 case ARMMMUIdx_Stage1_E1_PAN:
256 /* HCR.DC means SCTLR_EL1.M behaves as 0 */
257 hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
258 if (hcr_el2 & HCR_DC) {
259 return true;
260 }
261 break;
262
263 case ARMMMUIdx_E20_0:
264 case ARMMMUIdx_E20_2:
265 case ARMMMUIdx_E20_2_PAN:
266 case ARMMMUIdx_E2:
267 case ARMMMUIdx_E3:
268 case ARMMMUIdx_E30_0:
269 case ARMMMUIdx_E30_3_PAN:
270 break;
271
272 case ARMMMUIdx_Phys_S:
273 case ARMMMUIdx_Phys_NS:
274 case ARMMMUIdx_Phys_Root:
275 case ARMMMUIdx_Phys_Realm:
276 /* No translation for physical address spaces. */
277 return true;
278
279 default:
280 g_assert_not_reached();
281 }
282
283 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
284 }
285
granule_protection_check(CPUARMState * env,uint64_t paddress,ARMSecuritySpace pspace,ARMMMUFaultInfo * fi)286 static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
287 ARMSecuritySpace pspace,
288 ARMMMUFaultInfo *fi)
289 {
290 MemTxAttrs attrs = {
291 .secure = true,
292 .space = ARMSS_Root,
293 };
294 ARMCPU *cpu = env_archcpu(env);
295 uint64_t gpccr = env->cp15.gpccr_el3;
296 unsigned pps, pgs, l0gptsz, level = 0;
297 uint64_t tableaddr, pps_mask, align, entry, index;
298 AddressSpace *as;
299 MemTxResult result;
300 int gpi;
301
302 if (!FIELD_EX64(gpccr, GPCCR, GPC)) {
303 return true;
304 }
305
306 /*
307 * GPC Priority 1 (R_GMGRR):
308 * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
309 * the access fails as GPT walk fault at level 0.
310 */
311
312 /*
313 * Configuration of PPS to a value exceeding the implemented
314 * physical address size is invalid.
315 */
316 pps = FIELD_EX64(gpccr, GPCCR, PPS);
317 if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
318 goto fault_walk;
319 }
320 pps = pamax_map[pps];
321 pps_mask = MAKE_64BIT_MASK(0, pps);
322
323 switch (FIELD_EX64(gpccr, GPCCR, SH)) {
324 case 0b10: /* outer shareable */
325 break;
326 case 0b00: /* non-shareable */
327 case 0b11: /* inner shareable */
328 /* Inner and Outer non-cacheable requires Outer shareable. */
329 if (FIELD_EX64(gpccr, GPCCR, ORGN) == 0 &&
330 FIELD_EX64(gpccr, GPCCR, IRGN) == 0) {
331 goto fault_walk;
332 }
333 break;
334 default: /* reserved */
335 goto fault_walk;
336 }
337
338 switch (FIELD_EX64(gpccr, GPCCR, PGS)) {
339 case 0b00: /* 4KB */
340 pgs = 12;
341 break;
342 case 0b01: /* 64KB */
343 pgs = 16;
344 break;
345 case 0b10: /* 16KB */
346 pgs = 14;
347 break;
348 default: /* reserved */
349 goto fault_walk;
350 }
351
352 /* Note this field is read-only and fixed at reset. */
353 l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
354
355 /*
356 * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
357 * R_CPDSB: A NonSecure physical address input exceeding PPS
358 * does not experience any fault.
359 */
360 if (paddress & ~pps_mask) {
361 if (pspace == ARMSS_NonSecure) {
362 return true;
363 }
364 goto fault_size;
365 }
366
367 /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
368 tableaddr = env->cp15.gptbr_el3 << 12;
369 if (tableaddr & ~pps_mask) {
370 goto fault_size;
371 }
372
373 /*
374 * BADDR is aligned per a function of PPS and L0GPTSZ.
375 * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
376 * unlike the RES0 bits of the GPT entries (R_XNKFZ).
377 */
378 align = MAX(pps - l0gptsz + 3, 12);
379 align = MAKE_64BIT_MASK(0, align);
380 tableaddr &= ~align;
381
382 as = arm_addressspace(env_cpu(env), attrs);
383
384 /* Level 0 lookup. */
385 index = extract64(paddress, l0gptsz, pps - l0gptsz);
386 tableaddr += index * 8;
387 entry = address_space_ldq_le(as, tableaddr, attrs, &result);
388 if (result != MEMTX_OK) {
389 goto fault_eabt;
390 }
391
392 switch (extract32(entry, 0, 4)) {
393 case 1: /* block descriptor */
394 if (entry >> 8) {
395 goto fault_walk; /* RES0 bits not 0 */
396 }
397 gpi = extract32(entry, 4, 4);
398 goto found;
399 case 3: /* table descriptor */
400 tableaddr = entry & ~0xf;
401 align = MAX(l0gptsz - pgs - 1, 12);
402 align = MAKE_64BIT_MASK(0, align);
403 if (tableaddr & (~pps_mask | align)) {
404 goto fault_walk; /* RES0 bits not 0 */
405 }
406 break;
407 default: /* invalid */
408 goto fault_walk;
409 }
410
411 /* Level 1 lookup */
412 level = 1;
413 index = extract64(paddress, pgs + 4, l0gptsz - pgs - 4);
414 tableaddr += index * 8;
415 entry = address_space_ldq_le(as, tableaddr, attrs, &result);
416 if (result != MEMTX_OK) {
417 goto fault_eabt;
418 }
419
420 switch (extract32(entry, 0, 4)) {
421 case 1: /* contiguous descriptor */
422 if (entry >> 10) {
423 goto fault_walk; /* RES0 bits not 0 */
424 }
425 /*
426 * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
427 * and because we cannot invalidate by pa, and thus will always
428 * flush entire tlbs, we don't actually care about the range here
429 * and can simply extract the GPI as the result.
430 */
431 if (extract32(entry, 8, 2) == 0) {
432 goto fault_walk; /* reserved contig */
433 }
434 gpi = extract32(entry, 4, 4);
435 break;
436 default:
437 index = extract64(paddress, pgs, 4);
438 gpi = extract64(entry, index * 4, 4);
439 break;
440 }
441
442 found:
443 switch (gpi) {
444 case 0b0000: /* no access */
445 break;
446 case 0b1111: /* all access */
447 return true;
448 case 0b1000:
449 case 0b1001:
450 case 0b1010:
451 case 0b1011:
452 if (pspace == (gpi & 3)) {
453 return true;
454 }
455 break;
456 default:
457 goto fault_walk; /* reserved */
458 }
459
460 fi->gpcf = GPCF_Fail;
461 goto fault_common;
462 fault_eabt:
463 fi->gpcf = GPCF_EABT;
464 goto fault_common;
465 fault_size:
466 fi->gpcf = GPCF_AddressSize;
467 goto fault_common;
468 fault_walk:
469 fi->gpcf = GPCF_Walk;
470 fault_common:
471 fi->level = level;
472 fi->paddr = paddress;
473 fi->paddr_space = pspace;
474 return false;
475 }
476
S1_attrs_are_device(uint8_t attrs)477 static bool S1_attrs_are_device(uint8_t attrs)
478 {
479 /*
480 * This slightly under-decodes the MAIR_ELx field:
481 * 0b0000dd01 is Device with FEAT_XS, otherwise UNPREDICTABLE;
482 * 0b0000dd1x is UNPREDICTABLE.
483 */
484 return (attrs & 0xf0) == 0;
485 }
486
S2_attrs_are_device(uint64_t hcr,uint8_t attrs)487 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
488 {
489 /*
490 * For an S1 page table walk, the stage 1 attributes are always
491 * some form of "this is Normal memory". The combined S1+S2
492 * attributes are therefore only Device if stage 2 specifies Device.
493 * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00,
494 * ie when cacheattrs.attrs bits [3:2] are 0b00.
495 * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie
496 * when cacheattrs.attrs bit [2] is 0.
497 */
498 if (hcr & HCR_FWB) {
499 return (attrs & 0x4) == 0;
500 } else {
501 return (attrs & 0xc) == 0;
502 }
503 }
504
S2_security_space(ARMSecuritySpace s1_space,ARMMMUIdx s2_mmu_idx)505 static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
506 ARMMMUIdx s2_mmu_idx)
507 {
508 /*
509 * Return the security space to use for stage 2 when doing
510 * the S1 page table descriptor load.
511 */
512 if (regime_is_stage2(s2_mmu_idx)) {
513 /*
514 * The security space for ptw reads is almost always the same
515 * as that of the security space of the stage 1 translation.
516 * The only exception is when stage 1 is Secure; in that case
517 * the ptw read might be to the Secure or the NonSecure space
518 * (but never Realm or Root), and the s2_mmu_idx tells us which.
519 * Root translations are always single-stage.
520 */
521 if (s1_space == ARMSS_Secure) {
522 return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
523 } else {
524 assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
525 assert(s1_space != ARMSS_Root);
526 return s1_space;
527 }
528 } else {
529 /* ptw loads are from phys: the mmu idx itself says which space */
530 return arm_phys_to_space(s2_mmu_idx);
531 }
532 }
533
fault_s1ns(ARMSecuritySpace space,ARMMMUIdx s2_mmu_idx)534 static bool fault_s1ns(ARMSecuritySpace space, ARMMMUIdx s2_mmu_idx)
535 {
536 /*
537 * For stage 2 faults in Secure EL22, S1NS indicates
538 * whether the faulting IPA is in the Secure or NonSecure
539 * IPA space. For all other kinds of fault, it is false.
540 */
541 return space == ARMSS_Secure && regime_is_stage2(s2_mmu_idx)
542 && s2_mmu_idx == ARMMMUIdx_Stage2_S;
543 }
544
545 /* Translate a S1 pagetable walk through S2 if needed. */
S1_ptw_translate(CPUARMState * env,S1Translate * ptw,hwaddr addr,ARMMMUFaultInfo * fi)546 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
547 hwaddr addr, ARMMMUFaultInfo *fi)
548 {
549 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
550 ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
551 uint8_t pte_attrs;
552
553 ptw->out_virt = addr;
554
555 if (unlikely(ptw->in_debug)) {
556 /*
557 * From gdbstub, do not use softmmu so that we don't modify the
558 * state of the cpu at all, including softmmu tlb contents.
559 */
560 ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
561 S1Translate s2ptw = {
562 .in_mmu_idx = s2_mmu_idx,
563 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
564 .in_space = s2_space,
565 .in_debug = true,
566 };
567 GetPhysAddrResult s2 = { };
568
569 if (get_phys_addr_gpc(env, &s2ptw, addr, MMU_DATA_LOAD, &s2, fi)) {
570 goto fail;
571 }
572
573 ptw->out_phys = s2.f.phys_addr;
574 pte_attrs = s2.cacheattrs.attrs;
575 ptw->out_host = NULL;
576 ptw->out_rw = false;
577 ptw->out_space = s2.f.attrs.space;
578 } else {
579 #ifdef CONFIG_TCG
580 CPUTLBEntryFull *full;
581 int flags;
582
583 env->tlb_fi = fi;
584 flags = probe_access_full_mmu(env, addr, 0, MMU_DATA_LOAD,
585 arm_to_core_mmu_idx(s2_mmu_idx),
586 &ptw->out_host, &full);
587 env->tlb_fi = NULL;
588
589 if (unlikely(flags & TLB_INVALID_MASK)) {
590 goto fail;
591 }
592 ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK);
593 ptw->out_rw = full->prot & PAGE_WRITE;
594 pte_attrs = full->extra.arm.pte_attrs;
595 ptw->out_space = full->attrs.space;
596 #else
597 g_assert_not_reached();
598 #endif
599 }
600
601 if (regime_is_stage2(s2_mmu_idx)) {
602 uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
603
604 if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
605 /*
606 * PTW set and S1 walk touched S2 Device memory:
607 * generate Permission fault.
608 */
609 fi->type = ARMFault_Permission;
610 fi->s2addr = addr;
611 fi->stage2 = true;
612 fi->s1ptw = true;
613 fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
614 return false;
615 }
616 }
617
618 ptw->out_be = regime_translation_big_endian(env, mmu_idx);
619 return true;
620
621 fail:
622 assert(fi->type != ARMFault_None);
623 if (fi->type == ARMFault_GPCFOnOutput) {
624 fi->type = ARMFault_GPCFOnWalk;
625 }
626 fi->s2addr = addr;
627 fi->stage2 = regime_is_stage2(s2_mmu_idx);
628 fi->s1ptw = fi->stage2;
629 fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
630 return false;
631 }
632
633 /* All loads done in the course of a page table walk go through here. */
arm_ldl_ptw(CPUARMState * env,S1Translate * ptw,ARMMMUFaultInfo * fi)634 static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
635 ARMMMUFaultInfo *fi)
636 {
637 CPUState *cs = env_cpu(env);
638 void *host = ptw->out_host;
639 uint32_t data;
640
641 if (likely(host)) {
642 /* Page tables are in RAM, and we have the host address. */
643 data = qatomic_read((uint32_t *)host);
644 if (ptw->out_be) {
645 data = be32_to_cpu(data);
646 } else {
647 data = le32_to_cpu(data);
648 }
649 } else {
650 /* Page tables are in MMIO. */
651 MemTxAttrs attrs = {
652 .space = ptw->out_space,
653 .secure = arm_space_is_secure(ptw->out_space),
654 };
655 AddressSpace *as = arm_addressspace(cs, attrs);
656 MemTxResult result = MEMTX_OK;
657
658 if (ptw->out_be) {
659 data = address_space_ldl_be(as, ptw->out_phys, attrs, &result);
660 } else {
661 data = address_space_ldl_le(as, ptw->out_phys, attrs, &result);
662 }
663 if (unlikely(result != MEMTX_OK)) {
664 fi->type = ARMFault_SyncExternalOnWalk;
665 fi->ea = arm_extabort_type(result);
666 return 0;
667 }
668 }
669 return data;
670 }
671
arm_ldq_ptw(CPUARMState * env,S1Translate * ptw,ARMMMUFaultInfo * fi)672 static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
673 ARMMMUFaultInfo *fi)
674 {
675 CPUState *cs = env_cpu(env);
676 void *host = ptw->out_host;
677 uint64_t data;
678
679 if (likely(host)) {
680 /* Page tables are in RAM, and we have the host address. */
681 #ifdef CONFIG_ATOMIC64
682 data = qatomic_read__nocheck((uint64_t *)host);
683 if (ptw->out_be) {
684 data = be64_to_cpu(data);
685 } else {
686 data = le64_to_cpu(data);
687 }
688 #else
689 if (ptw->out_be) {
690 data = ldq_be_p(host);
691 } else {
692 data = ldq_le_p(host);
693 }
694 #endif
695 } else {
696 /* Page tables are in MMIO. */
697 MemTxAttrs attrs = {
698 .space = ptw->out_space,
699 .secure = arm_space_is_secure(ptw->out_space),
700 };
701 AddressSpace *as = arm_addressspace(cs, attrs);
702 MemTxResult result = MEMTX_OK;
703
704 if (ptw->out_be) {
705 data = address_space_ldq_be(as, ptw->out_phys, attrs, &result);
706 } else {
707 data = address_space_ldq_le(as, ptw->out_phys, attrs, &result);
708 }
709 if (unlikely(result != MEMTX_OK)) {
710 fi->type = ARMFault_SyncExternalOnWalk;
711 fi->ea = arm_extabort_type(result);
712 return 0;
713 }
714 }
715 return data;
716 }
717
arm_casq_ptw(CPUARMState * env,uint64_t old_val,uint64_t new_val,S1Translate * ptw,ARMMMUFaultInfo * fi)718 static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
719 uint64_t new_val, S1Translate *ptw,
720 ARMMMUFaultInfo *fi)
721 {
722 #if defined(TARGET_AARCH64) && defined(CONFIG_TCG)
723 uint64_t cur_val;
724 void *host = ptw->out_host;
725
726 if (unlikely(!host)) {
727 /* Page table in MMIO Memory Region */
728 CPUState *cs = env_cpu(env);
729 MemTxAttrs attrs = {
730 .space = ptw->out_space,
731 .secure = arm_space_is_secure(ptw->out_space),
732 };
733 AddressSpace *as = arm_addressspace(cs, attrs);
734 MemTxResult result = MEMTX_OK;
735 bool need_lock = !bql_locked();
736
737 if (need_lock) {
738 bql_lock();
739 }
740 if (ptw->out_be) {
741 cur_val = address_space_ldq_be(as, ptw->out_phys, attrs, &result);
742 if (unlikely(result != MEMTX_OK)) {
743 fi->type = ARMFault_SyncExternalOnWalk;
744 fi->ea = arm_extabort_type(result);
745 if (need_lock) {
746 bql_unlock();
747 }
748 return old_val;
749 }
750 if (cur_val == old_val) {
751 address_space_stq_be(as, ptw->out_phys, new_val, attrs, &result);
752 if (unlikely(result != MEMTX_OK)) {
753 fi->type = ARMFault_SyncExternalOnWalk;
754 fi->ea = arm_extabort_type(result);
755 if (need_lock) {
756 bql_unlock();
757 }
758 return old_val;
759 }
760 cur_val = new_val;
761 }
762 } else {
763 cur_val = address_space_ldq_le(as, ptw->out_phys, attrs, &result);
764 if (unlikely(result != MEMTX_OK)) {
765 fi->type = ARMFault_SyncExternalOnWalk;
766 fi->ea = arm_extabort_type(result);
767 if (need_lock) {
768 bql_unlock();
769 }
770 return old_val;
771 }
772 if (cur_val == old_val) {
773 address_space_stq_le(as, ptw->out_phys, new_val, attrs, &result);
774 if (unlikely(result != MEMTX_OK)) {
775 fi->type = ARMFault_SyncExternalOnWalk;
776 fi->ea = arm_extabort_type(result);
777 if (need_lock) {
778 bql_unlock();
779 }
780 return old_val;
781 }
782 cur_val = new_val;
783 }
784 }
785 if (need_lock) {
786 bql_unlock();
787 }
788 return cur_val;
789 }
790
791 /*
792 * Raising a stage2 Protection fault for an atomic update to a read-only
793 * page is delayed until it is certain that there is a change to make.
794 */
795 if (unlikely(!ptw->out_rw)) {
796 int flags;
797
798 env->tlb_fi = fi;
799 flags = probe_access_full_mmu(env, ptw->out_virt, 0,
800 MMU_DATA_STORE,
801 arm_to_core_mmu_idx(ptw->in_ptw_idx),
802 NULL, NULL);
803 env->tlb_fi = NULL;
804
805 if (unlikely(flags & TLB_INVALID_MASK)) {
806 /*
807 * We know this must be a stage 2 fault because the granule
808 * protection table does not separately track read and write
809 * permission, so all GPC faults are caught in S1_ptw_translate():
810 * we only get here for "readable but not writeable".
811 */
812 assert(fi->type != ARMFault_None);
813 fi->s2addr = ptw->out_virt;
814 fi->stage2 = true;
815 fi->s1ptw = true;
816 fi->s1ns = fault_s1ns(ptw->in_space, ptw->in_ptw_idx);
817 return 0;
818 }
819
820 /* In case CAS mismatches and we loop, remember writability. */
821 ptw->out_rw = true;
822 }
823
824 #ifdef CONFIG_ATOMIC64
825 if (ptw->out_be) {
826 old_val = cpu_to_be64(old_val);
827 new_val = cpu_to_be64(new_val);
828 cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
829 cur_val = be64_to_cpu(cur_val);
830 } else {
831 old_val = cpu_to_le64(old_val);
832 new_val = cpu_to_le64(new_val);
833 cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
834 cur_val = le64_to_cpu(cur_val);
835 }
836 #else
837 /*
838 * We can't support the full 64-bit atomic cmpxchg on the host.
839 * Because this is only used for FEAT_HAFDBS, which is only for AA64,
840 * we know that TCG_OVERSIZED_GUEST is set, which means that we are
841 * running in round-robin mode and could only race with dma i/o.
842 */
843 #if !TCG_OVERSIZED_GUEST
844 # error "Unexpected configuration"
845 #endif
846 bool locked = bql_locked();
847 if (!locked) {
848 bql_lock();
849 }
850 if (ptw->out_be) {
851 cur_val = ldq_be_p(host);
852 if (cur_val == old_val) {
853 stq_be_p(host, new_val);
854 }
855 } else {
856 cur_val = ldq_le_p(host);
857 if (cur_val == old_val) {
858 stq_le_p(host, new_val);
859 }
860 }
861 if (!locked) {
862 bql_unlock();
863 }
864 #endif
865
866 return cur_val;
867 #else
868 /* AArch32 does not have FEAT_HADFS; non-TCG guests only use debug-mode. */
869 g_assert_not_reached();
870 #endif
871 }
872
get_level1_table_address(CPUARMState * env,ARMMMUIdx mmu_idx,uint32_t * table,uint32_t address)873 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
874 uint32_t *table, uint32_t address)
875 {
876 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
877 uint64_t tcr = regime_tcr(env, mmu_idx);
878 int maskshift = extract32(tcr, 0, 3);
879 uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
880 uint32_t base_mask;
881
882 if (address & mask) {
883 if (tcr & TTBCR_PD1) {
884 /* Translation table walk disabled for TTBR1 */
885 return false;
886 }
887 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
888 } else {
889 if (tcr & TTBCR_PD0) {
890 /* Translation table walk disabled for TTBR0 */
891 return false;
892 }
893 base_mask = ~((uint32_t)0x3fffu >> maskshift);
894 *table = regime_ttbr(env, mmu_idx, 0) & base_mask;
895 }
896 *table |= (address >> 18) & 0x3ffc;
897 return true;
898 }
899
900 /*
901 * Translate section/page access permissions to page R/W protection flags
902 * @env: CPUARMState
903 * @mmu_idx: MMU index indicating required translation regime
904 * @ap: The 3-bit access permissions (AP[2:0])
905 * @domain_prot: The 2-bit domain access permissions
906 * @is_user: TRUE if accessing from PL0
907 */
ap_to_rw_prot_is_user(CPUARMState * env,ARMMMUIdx mmu_idx,int ap,int domain_prot,bool is_user)908 static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx,
909 int ap, int domain_prot, bool is_user)
910 {
911 if (domain_prot == 3) {
912 return PAGE_READ | PAGE_WRITE;
913 }
914
915 switch (ap) {
916 case 0:
917 if (arm_feature(env, ARM_FEATURE_V7)) {
918 return 0;
919 }
920 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
921 case SCTLR_S:
922 return is_user ? 0 : PAGE_READ;
923 case SCTLR_R:
924 return PAGE_READ;
925 default:
926 return 0;
927 }
928 case 1:
929 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
930 case 2:
931 if (is_user) {
932 return PAGE_READ;
933 } else {
934 return PAGE_READ | PAGE_WRITE;
935 }
936 case 3:
937 return PAGE_READ | PAGE_WRITE;
938 case 4: /* Reserved. */
939 return 0;
940 case 5:
941 return is_user ? 0 : PAGE_READ;
942 case 6:
943 return PAGE_READ;
944 case 7:
945 if (!arm_feature(env, ARM_FEATURE_V6K)) {
946 return 0;
947 }
948 return PAGE_READ;
949 default:
950 g_assert_not_reached();
951 }
952 }
953
954 /*
955 * Translate section/page access permissions to page R/W protection flags
956 * @env: CPUARMState
957 * @mmu_idx: MMU index indicating required translation regime
958 * @ap: The 3-bit access permissions (AP[2:0])
959 * @domain_prot: The 2-bit domain access permissions
960 */
ap_to_rw_prot(CPUARMState * env,ARMMMUIdx mmu_idx,int ap,int domain_prot)961 static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
962 int ap, int domain_prot)
963 {
964 return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
965 regime_is_user(env, mmu_idx));
966 }
967
968 /*
969 * Translate section/page access permissions to page R/W protection flags.
970 * @ap: The 2-bit simple AP (AP[2:1])
971 * @is_user: TRUE if accessing from PL0
972 */
simple_ap_to_rw_prot_is_user(int ap,bool is_user)973 static int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
974 {
975 switch (ap) {
976 case 0:
977 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
978 case 1:
979 return PAGE_READ | PAGE_WRITE;
980 case 2:
981 return is_user ? 0 : PAGE_READ;
982 case 3:
983 return PAGE_READ;
984 default:
985 g_assert_not_reached();
986 }
987 }
988
simple_ap_to_rw_prot(CPUARMState * env,ARMMMUIdx mmu_idx,int ap)989 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
990 {
991 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
992 }
993
get_phys_addr_v5(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)994 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
995 uint32_t address, MMUAccessType access_type,
996 GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
997 {
998 int level = 1;
999 uint32_t table;
1000 uint32_t desc;
1001 int type;
1002 int ap;
1003 int domain = 0;
1004 int domain_prot;
1005 hwaddr phys_addr;
1006 uint32_t dacr;
1007
1008 /* Pagetable walk. */
1009 /* Lookup l1 descriptor. */
1010 if (!get_level1_table_address(env, ptw->in_mmu_idx, &table, address)) {
1011 /* Section translation fault if page walk is disabled by PD0 or PD1 */
1012 fi->type = ARMFault_Translation;
1013 goto do_fault;
1014 }
1015 if (!S1_ptw_translate(env, ptw, table, fi)) {
1016 goto do_fault;
1017 }
1018 desc = arm_ldl_ptw(env, ptw, fi);
1019 if (fi->type != ARMFault_None) {
1020 goto do_fault;
1021 }
1022 type = (desc & 3);
1023 domain = (desc >> 5) & 0x0f;
1024 if (regime_el(env, ptw->in_mmu_idx) == 1) {
1025 dacr = env->cp15.dacr_ns;
1026 } else {
1027 dacr = env->cp15.dacr_s;
1028 }
1029 domain_prot = (dacr >> (domain * 2)) & 3;
1030 if (type == 0) {
1031 /* Section translation fault. */
1032 fi->type = ARMFault_Translation;
1033 goto do_fault;
1034 }
1035 if (type != 2) {
1036 level = 2;
1037 }
1038 if (domain_prot == 0 || domain_prot == 2) {
1039 fi->type = ARMFault_Domain;
1040 goto do_fault;
1041 }
1042 if (type == 2) {
1043 /* 1Mb section. */
1044 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1045 ap = (desc >> 10) & 3;
1046 result->f.lg_page_size = 20; /* 1MB */
1047 } else {
1048 /* Lookup l2 entry. */
1049 if (type == 1) {
1050 /* Coarse pagetable. */
1051 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1052 } else {
1053 /* Fine pagetable. */
1054 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
1055 }
1056 if (!S1_ptw_translate(env, ptw, table, fi)) {
1057 goto do_fault;
1058 }
1059 desc = arm_ldl_ptw(env, ptw, fi);
1060 if (fi->type != ARMFault_None) {
1061 goto do_fault;
1062 }
1063 switch (desc & 3) {
1064 case 0: /* Page translation fault. */
1065 fi->type = ARMFault_Translation;
1066 goto do_fault;
1067 case 1: /* 64k page. */
1068 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1069 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
1070 result->f.lg_page_size = 16;
1071 break;
1072 case 2: /* 4k page. */
1073 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1074 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
1075 result->f.lg_page_size = 12;
1076 break;
1077 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
1078 if (type == 1) {
1079 /* ARMv6/XScale extended small page format */
1080 if (arm_feature(env, ARM_FEATURE_XSCALE)
1081 || arm_feature(env, ARM_FEATURE_V6)) {
1082 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1083 result->f.lg_page_size = 12;
1084 } else {
1085 /*
1086 * UNPREDICTABLE in ARMv5; we choose to take a
1087 * page translation fault.
1088 */
1089 fi->type = ARMFault_Translation;
1090 goto do_fault;
1091 }
1092 } else {
1093 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
1094 result->f.lg_page_size = 10;
1095 }
1096 ap = (desc >> 4) & 3;
1097 break;
1098 default:
1099 /* Never happens, but compiler isn't smart enough to tell. */
1100 g_assert_not_reached();
1101 }
1102 }
1103 result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot);
1104 result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
1105 if (!(result->f.prot & (1 << access_type))) {
1106 /* Access permission fault. */
1107 fi->type = ARMFault_Permission;
1108 goto do_fault;
1109 }
1110 result->f.phys_addr = phys_addr;
1111 return false;
1112 do_fault:
1113 fi->domain = domain;
1114 fi->level = level;
1115 return true;
1116 }
1117
get_phys_addr_v6(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)1118 static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
1119 uint32_t address, MMUAccessType access_type,
1120 GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
1121 {
1122 ARMCPU *cpu = env_archcpu(env);
1123 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
1124 int level = 1;
1125 uint32_t table;
1126 uint32_t desc;
1127 uint32_t xn;
1128 uint32_t pxn = 0;
1129 int type;
1130 int ap;
1131 int domain = 0;
1132 int domain_prot;
1133 hwaddr phys_addr;
1134 uint32_t dacr;
1135 bool ns;
1136 int user_prot;
1137
1138 /* Pagetable walk. */
1139 /* Lookup l1 descriptor. */
1140 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
1141 /* Section translation fault if page walk is disabled by PD0 or PD1 */
1142 fi->type = ARMFault_Translation;
1143 goto do_fault;
1144 }
1145 if (!S1_ptw_translate(env, ptw, table, fi)) {
1146 goto do_fault;
1147 }
1148 desc = arm_ldl_ptw(env, ptw, fi);
1149 if (fi->type != ARMFault_None) {
1150 goto do_fault;
1151 }
1152 type = (desc & 3);
1153 if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
1154 /* Section translation fault, or attempt to use the encoding
1155 * which is Reserved on implementations without PXN.
1156 */
1157 fi->type = ARMFault_Translation;
1158 goto do_fault;
1159 }
1160 if ((type == 1) || !(desc & (1 << 18))) {
1161 /* Page or Section. */
1162 domain = (desc >> 5) & 0x0f;
1163 }
1164 if (regime_el(env, mmu_idx) == 1) {
1165 dacr = env->cp15.dacr_ns;
1166 } else {
1167 dacr = env->cp15.dacr_s;
1168 }
1169 if (type == 1) {
1170 level = 2;
1171 }
1172 domain_prot = (dacr >> (domain * 2)) & 3;
1173 if (domain_prot == 0 || domain_prot == 2) {
1174 /* Section or Page domain fault */
1175 fi->type = ARMFault_Domain;
1176 goto do_fault;
1177 }
1178 if (type != 1) {
1179 if (desc & (1 << 18)) {
1180 /* Supersection. */
1181 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
1182 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
1183 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
1184 result->f.lg_page_size = 24; /* 16MB */
1185 } else {
1186 /* Section. */
1187 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1188 result->f.lg_page_size = 20; /* 1MB */
1189 }
1190 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
1191 xn = desc & (1 << 4);
1192 pxn = desc & 1;
1193 ns = extract32(desc, 19, 1);
1194 } else {
1195 if (cpu_isar_feature(aa32_pxn, cpu)) {
1196 pxn = (desc >> 2) & 1;
1197 }
1198 ns = extract32(desc, 3, 1);
1199 /* Lookup l2 entry. */
1200 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1201 if (!S1_ptw_translate(env, ptw, table, fi)) {
1202 goto do_fault;
1203 }
1204 desc = arm_ldl_ptw(env, ptw, fi);
1205 if (fi->type != ARMFault_None) {
1206 goto do_fault;
1207 }
1208 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
1209 switch (desc & 3) {
1210 case 0: /* Page translation fault. */
1211 fi->type = ARMFault_Translation;
1212 goto do_fault;
1213 case 1: /* 64k page. */
1214 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1215 xn = desc & (1 << 15);
1216 result->f.lg_page_size = 16;
1217 break;
1218 case 2: case 3: /* 4k page. */
1219 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1220 xn = desc & 1;
1221 result->f.lg_page_size = 12;
1222 break;
1223 default:
1224 /* Never happens, but compiler isn't smart enough to tell. */
1225 g_assert_not_reached();
1226 }
1227 }
1228 if (domain_prot == 3) {
1229 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1230 } else {
1231 if (pxn && !regime_is_user(env, mmu_idx)) {
1232 xn = 1;
1233 }
1234 if (xn && access_type == MMU_INST_FETCH) {
1235 fi->type = ARMFault_Permission;
1236 goto do_fault;
1237 }
1238
1239 if (arm_feature(env, ARM_FEATURE_V6K) &&
1240 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
1241 /* The simplified model uses AP[0] as an access control bit. */
1242 if ((ap & 1) == 0) {
1243 /* Access flag fault. */
1244 fi->type = ARMFault_AccessFlag;
1245 goto do_fault;
1246 }
1247 result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
1248 user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1);
1249 } else {
1250 result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
1251 user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1);
1252 }
1253 if (result->f.prot && !xn) {
1254 result->f.prot |= PAGE_EXEC;
1255 }
1256 if (!(result->f.prot & (1 << access_type))) {
1257 /* Access permission fault. */
1258 fi->type = ARMFault_Permission;
1259 goto do_fault;
1260 }
1261 if (regime_is_pan(env, mmu_idx) &&
1262 !regime_is_user(env, mmu_idx) &&
1263 user_prot &&
1264 access_type != MMU_INST_FETCH) {
1265 /* Privileged Access Never fault */
1266 fi->type = ARMFault_Permission;
1267 goto do_fault;
1268 }
1269 }
1270 if (ns) {
1271 /* The NS bit will (as required by the architecture) have no effect if
1272 * the CPU doesn't support TZ or this is a non-secure translation
1273 * regime, because the attribute will already be non-secure.
1274 */
1275 result->f.attrs.secure = false;
1276 result->f.attrs.space = ARMSS_NonSecure;
1277 }
1278 result->f.phys_addr = phys_addr;
1279 return false;
1280 do_fault:
1281 fi->domain = domain;
1282 fi->level = level;
1283 return true;
1284 }
1285
1286 /*
1287 * Translate S2 section/page access permissions to protection flags
1288 * @env: CPUARMState
1289 * @s2ap: The 2-bit stage2 access permissions (S2AP)
1290 * @xn: XN (execute-never) bits
1291 * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
1292 */
get_S2prot_noexecute(int s2ap)1293 static int get_S2prot_noexecute(int s2ap)
1294 {
1295 int prot = 0;
1296
1297 if (s2ap & 1) {
1298 prot |= PAGE_READ;
1299 }
1300 if (s2ap & 2) {
1301 prot |= PAGE_WRITE;
1302 }
1303 return prot;
1304 }
1305
get_S2prot(CPUARMState * env,int s2ap,int xn,bool s1_is_el0)1306 static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
1307 {
1308 int prot = get_S2prot_noexecute(s2ap);
1309
1310 if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
1311 switch (xn) {
1312 case 0:
1313 prot |= PAGE_EXEC;
1314 break;
1315 case 1:
1316 if (s1_is_el0) {
1317 prot |= PAGE_EXEC;
1318 }
1319 break;
1320 case 2:
1321 break;
1322 case 3:
1323 if (!s1_is_el0) {
1324 prot |= PAGE_EXEC;
1325 }
1326 break;
1327 default:
1328 g_assert_not_reached();
1329 }
1330 } else {
1331 if (!extract32(xn, 1, 1)) {
1332 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
1333 prot |= PAGE_EXEC;
1334 }
1335 }
1336 }
1337 return prot;
1338 }
1339
1340 /*
1341 * Translate section/page access permissions to protection flags
1342 * @env: CPUARMState
1343 * @mmu_idx: MMU index indicating required translation regime
1344 * @is_aa64: TRUE if AArch64
1345 * @ap: The 2-bit simple AP (AP[2:1])
1346 * @xn: XN (execute-never) bit
1347 * @pxn: PXN (privileged execute-never) bit
1348 * @in_pa: The original input pa space
1349 * @out_pa: The output pa space, modified by NSTable, NS, and NSE
1350 */
get_S1prot(CPUARMState * env,ARMMMUIdx mmu_idx,bool is_aa64,int ap,int xn,int pxn,ARMSecuritySpace in_pa,ARMSecuritySpace out_pa)1351 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
1352 int ap, int xn, int pxn,
1353 ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
1354 {
1355 ARMCPU *cpu = env_archcpu(env);
1356 bool is_user = regime_is_user(env, mmu_idx);
1357 int prot_rw, user_rw;
1358 bool have_wxn;
1359 int wxn = 0;
1360
1361 assert(!regime_is_stage2(mmu_idx));
1362
1363 user_rw = simple_ap_to_rw_prot_is_user(ap, true);
1364 if (is_user) {
1365 prot_rw = user_rw;
1366 } else {
1367 /*
1368 * PAN controls can forbid data accesses but don't affect insn fetch.
1369 * Plain PAN forbids data accesses if EL0 has data permissions;
1370 * PAN3 forbids data accesses if EL0 has either data or exec perms.
1371 * Note that for AArch64 the 'user can exec' case is exactly !xn.
1372 * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0
1373 * do not affect EPAN.
1374 */
1375 if (user_rw && regime_is_pan(env, mmu_idx)) {
1376 prot_rw = 0;
1377 } else if (cpu_isar_feature(aa64_pan3, cpu) && is_aa64 &&
1378 regime_is_pan(env, mmu_idx) &&
1379 (regime_sctlr(env, mmu_idx) & SCTLR_EPAN) && !xn) {
1380 prot_rw = 0;
1381 } else {
1382 prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
1383 }
1384 }
1385
1386 if (in_pa != out_pa) {
1387 switch (in_pa) {
1388 case ARMSS_Root:
1389 /*
1390 * R_ZWRVD: permission fault for insn fetched from non-Root,
1391 * I_WWBFB: SIF has no effect in EL3.
1392 */
1393 return prot_rw;
1394 case ARMSS_Realm:
1395 /*
1396 * R_PKTDS: permission fault for insn fetched from non-Realm,
1397 * for Realm EL2 or EL2&0. The corresponding fault for EL1&0
1398 * happens during any stage2 translation.
1399 */
1400 switch (mmu_idx) {
1401 case ARMMMUIdx_E2:
1402 case ARMMMUIdx_E20_0:
1403 case ARMMMUIdx_E20_2:
1404 case ARMMMUIdx_E20_2_PAN:
1405 return prot_rw;
1406 default:
1407 break;
1408 }
1409 break;
1410 case ARMSS_Secure:
1411 if (env->cp15.scr_el3 & SCR_SIF) {
1412 return prot_rw;
1413 }
1414 break;
1415 default:
1416 /* Input NonSecure must have output NonSecure. */
1417 g_assert_not_reached();
1418 }
1419 }
1420
1421 /* TODO have_wxn should be replaced with
1422 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
1423 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
1424 * compatible processors have EL2, which is required for [U]WXN.
1425 */
1426 have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
1427
1428 if (have_wxn) {
1429 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
1430 }
1431
1432 if (is_aa64) {
1433 if (regime_has_2_ranges(mmu_idx) && !is_user) {
1434 xn = pxn || (user_rw & PAGE_WRITE);
1435 }
1436 } else if (arm_feature(env, ARM_FEATURE_V7)) {
1437 switch (regime_el(env, mmu_idx)) {
1438 case 1:
1439 case 3:
1440 if (is_user) {
1441 xn = xn || !(user_rw & PAGE_READ);
1442 } else {
1443 int uwxn = 0;
1444 if (have_wxn) {
1445 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
1446 }
1447 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
1448 (uwxn && (user_rw & PAGE_WRITE));
1449 }
1450 break;
1451 case 2:
1452 break;
1453 }
1454 } else {
1455 xn = wxn = 0;
1456 }
1457
1458 if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
1459 return prot_rw;
1460 }
1461 return prot_rw | PAGE_EXEC;
1462 }
1463
aa32_va_parameters(CPUARMState * env,uint32_t va,ARMMMUIdx mmu_idx)1464 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
1465 ARMMMUIdx mmu_idx)
1466 {
1467 uint64_t tcr = regime_tcr(env, mmu_idx);
1468 uint32_t el = regime_el(env, mmu_idx);
1469 int select, tsz;
1470 bool epd, hpd;
1471
1472 assert(mmu_idx != ARMMMUIdx_Stage2_S);
1473
1474 if (mmu_idx == ARMMMUIdx_Stage2) {
1475 /* VTCR */
1476 bool sext = extract32(tcr, 4, 1);
1477 bool sign = extract32(tcr, 3, 1);
1478
1479 /*
1480 * If the sign-extend bit is not the same as t0sz[3], the result
1481 * is unpredictable. Flag this as a guest error.
1482 */
1483 if (sign != sext) {
1484 qemu_log_mask(LOG_GUEST_ERROR,
1485 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
1486 }
1487 tsz = sextract32(tcr, 0, 4) + 8;
1488 select = 0;
1489 hpd = false;
1490 epd = false;
1491 } else if (el == 2) {
1492 /* HTCR */
1493 tsz = extract32(tcr, 0, 3);
1494 select = 0;
1495 hpd = extract64(tcr, 24, 1);
1496 epd = false;
1497 } else {
1498 int t0sz = extract32(tcr, 0, 3);
1499 int t1sz = extract32(tcr, 16, 3);
1500
1501 if (t1sz == 0) {
1502 select = va > (0xffffffffu >> t0sz);
1503 } else {
1504 /* Note that we will detect errors later. */
1505 select = va >= ~(0xffffffffu >> t1sz);
1506 }
1507 if (!select) {
1508 tsz = t0sz;
1509 epd = extract32(tcr, 7, 1);
1510 hpd = extract64(tcr, 41, 1);
1511 } else {
1512 tsz = t1sz;
1513 epd = extract32(tcr, 23, 1);
1514 hpd = extract64(tcr, 42, 1);
1515 }
1516 /* For aarch32, hpd0 is not enabled without t2e as well. */
1517 hpd &= extract32(tcr, 6, 1);
1518 }
1519
1520 return (ARMVAParameters) {
1521 .tsz = tsz,
1522 .select = select,
1523 .epd = epd,
1524 .hpd = hpd,
1525 };
1526 }
1527
1528 /*
1529 * check_s2_mmu_setup
1530 * @cpu: ARMCPU
1531 * @is_aa64: True if the translation regime is in AArch64 state
1532 * @tcr: VTCR_EL2 or VSTCR_EL2
1533 * @ds: Effective value of TCR.DS.
1534 * @iasize: Bitsize of IPAs
1535 * @stride: Page-table stride (See the ARM ARM)
1536 *
1537 * Decode the starting level of the S2 lookup, returning INT_MIN if
1538 * the configuration is invalid.
1539 */
check_s2_mmu_setup(ARMCPU * cpu,bool is_aa64,uint64_t tcr,bool ds,int iasize,int stride)1540 static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
1541 bool ds, int iasize, int stride)
1542 {
1543 int sl0, sl2, startlevel, granulebits, levels;
1544 int s1_min_iasize, s1_max_iasize;
1545
1546 sl0 = extract32(tcr, 6, 2);
1547 if (is_aa64) {
1548 /*
1549 * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
1550 * so interleave AArch64.S2StartLevel.
1551 */
1552 switch (stride) {
1553 case 9: /* 4KB */
1554 /* SL2 is RES0 unless DS=1 & 4KB granule. */
1555 sl2 = extract64(tcr, 33, 1);
1556 if (ds && sl2) {
1557 if (sl0 != 0) {
1558 goto fail;
1559 }
1560 startlevel = -1;
1561 } else {
1562 startlevel = 2 - sl0;
1563 switch (sl0) {
1564 case 2:
1565 if (arm_pamax(cpu) < 44) {
1566 goto fail;
1567 }
1568 break;
1569 case 3:
1570 if (!cpu_isar_feature(aa64_st, cpu)) {
1571 goto fail;
1572 }
1573 startlevel = 3;
1574 break;
1575 }
1576 }
1577 break;
1578 case 11: /* 16KB */
1579 switch (sl0) {
1580 case 2:
1581 if (arm_pamax(cpu) < 42) {
1582 goto fail;
1583 }
1584 break;
1585 case 3:
1586 if (!ds) {
1587 goto fail;
1588 }
1589 break;
1590 }
1591 startlevel = 3 - sl0;
1592 break;
1593 case 13: /* 64KB */
1594 switch (sl0) {
1595 case 2:
1596 if (arm_pamax(cpu) < 44) {
1597 goto fail;
1598 }
1599 break;
1600 case 3:
1601 goto fail;
1602 }
1603 startlevel = 3 - sl0;
1604 break;
1605 default:
1606 g_assert_not_reached();
1607 }
1608 } else {
1609 /*
1610 * Things are simpler for AArch32 EL2, with only 4k pages.
1611 * There is no separate S2InvalidSL function, but AArch32.S2Walk
1612 * begins with walkparms.sl0 in {'1x'}.
1613 */
1614 assert(stride == 9);
1615 if (sl0 >= 2) {
1616 goto fail;
1617 }
1618 startlevel = 2 - sl0;
1619 }
1620
1621 /* AArch{64,32}.S2InconsistentSL are functionally equivalent. */
1622 levels = 3 - startlevel;
1623 granulebits = stride + 3;
1624
1625 s1_min_iasize = levels * stride + granulebits + 1;
1626 s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
1627
1628 if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
1629 return startlevel;
1630 }
1631
1632 fail:
1633 return INT_MIN;
1634 }
1635
lpae_block_desc_valid(ARMCPU * cpu,bool ds,ARMGranuleSize gran,int level)1636 static bool lpae_block_desc_valid(ARMCPU *cpu, bool ds,
1637 ARMGranuleSize gran, int level)
1638 {
1639 /*
1640 * See pseudocode AArch46.BlockDescSupported(): block descriptors
1641 * are not valid at all levels, depending on the page size.
1642 */
1643 switch (gran) {
1644 case Gran4K:
1645 return (level == 0 && ds) || level == 1 || level == 2;
1646 case Gran16K:
1647 return (level == 1 && ds) || level == 2;
1648 case Gran64K:
1649 return (level == 1 && arm_pamax(cpu) == 52) || level == 2;
1650 default:
1651 g_assert_not_reached();
1652 }
1653 }
1654
nv_nv1_enabled(CPUARMState * env,S1Translate * ptw)1655 static bool nv_nv1_enabled(CPUARMState *env, S1Translate *ptw)
1656 {
1657 uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
1658 return (hcr & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1);
1659 }
1660
1661 /**
1662 * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
1663 *
1664 * Returns false if the translation was successful. Otherwise, phys_ptr,
1665 * attrs, prot and page_size may not be filled in, and the populated fsr
1666 * value provides information on why the translation aborted, in the format
1667 * of a long-format DFSR/IFSR fault register, with the following caveat:
1668 * the WnR bit is never set (the caller must do this).
1669 *
1670 * @env: CPUARMState
1671 * @ptw: Current and next stage parameters for the walk.
1672 * @address: virtual address to get physical address for
1673 * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
1674 * @result: set on translation success,
1675 * @fi: set to fault info if the translation fails
1676 */
get_phys_addr_lpae(CPUARMState * env,S1Translate * ptw,uint64_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)1677 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
1678 uint64_t address,
1679 MMUAccessType access_type,
1680 GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
1681 {
1682 ARMCPU *cpu = env_archcpu(env);
1683 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
1684 int32_t level;
1685 ARMVAParameters param;
1686 uint64_t ttbr;
1687 hwaddr descaddr, indexmask, indexmask_grainsize;
1688 uint32_t tableattrs;
1689 target_ulong page_size;
1690 uint64_t attrs;
1691 int32_t stride;
1692 int addrsize, inputsize, outputsize;
1693 uint64_t tcr = regime_tcr(env, mmu_idx);
1694 int ap, xn, pxn;
1695 uint32_t el = regime_el(env, mmu_idx);
1696 uint64_t descaddrmask;
1697 bool aarch64 = arm_el_is_aa64(env, el);
1698 uint64_t descriptor, new_descriptor;
1699 ARMSecuritySpace out_space;
1700 bool device;
1701
1702 /* TODO: This code does not support shareability levels. */
1703 if (aarch64) {
1704 int ps;
1705
1706 param = aa64_va_parameters(env, address, mmu_idx,
1707 access_type != MMU_INST_FETCH,
1708 !arm_el_is_aa64(env, 1));
1709 level = 0;
1710
1711 /*
1712 * If TxSZ is programmed to a value larger than the maximum,
1713 * or smaller than the effective minimum, it is IMPLEMENTATION
1714 * DEFINED whether we behave as if the field were programmed
1715 * within bounds, or if a level 0 Translation fault is generated.
1716 *
1717 * With FEAT_LVA, fault on less than minimum becomes required,
1718 * so our choice is to always raise the fault.
1719 */
1720 if (param.tsz_oob) {
1721 goto do_translation_fault;
1722 }
1723
1724 addrsize = 64 - 8 * param.tbi;
1725 inputsize = 64 - param.tsz;
1726
1727 /*
1728 * Bound PS by PARANGE to find the effective output address size.
1729 * ID_AA64MMFR0 is a read-only register so values outside of the
1730 * supported mappings can be considered an implementation error.
1731 */
1732 ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
1733 ps = MIN(ps, param.ps);
1734 assert(ps < ARRAY_SIZE(pamax_map));
1735 outputsize = pamax_map[ps];
1736
1737 /*
1738 * With LPA2, the effective output address (OA) size is at most 48 bits
1739 * unless TCR.DS == 1
1740 */
1741 if (!param.ds && param.gran != Gran64K) {
1742 outputsize = MIN(outputsize, 48);
1743 }
1744 } else {
1745 param = aa32_va_parameters(env, address, mmu_idx);
1746 level = 1;
1747 addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32);
1748 inputsize = addrsize - param.tsz;
1749 outputsize = 40;
1750 }
1751
1752 /*
1753 * We determined the region when collecting the parameters, but we
1754 * have not yet validated that the address is valid for the region.
1755 * Extract the top bits and verify that they all match select.
1756 *
1757 * For aa32, if inputsize == addrsize, then we have selected the
1758 * region by exclusion in aa32_va_parameters and there is no more
1759 * validation to do here.
1760 */
1761 if (inputsize < addrsize) {
1762 target_ulong top_bits = sextract64(address, inputsize,
1763 addrsize - inputsize);
1764 if (-top_bits != param.select) {
1765 /* The gap between the two regions is a Translation fault */
1766 goto do_translation_fault;
1767 }
1768 }
1769
1770 stride = arm_granule_bits(param.gran) - 3;
1771
1772 /*
1773 * Note that QEMU ignores shareability and cacheability attributes,
1774 * so we don't need to do anything with the SH, ORGN, IRGN fields
1775 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
1776 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
1777 * implement any ASID-like capability so we can ignore it (instead
1778 * we will always flush the TLB any time the ASID is changed).
1779 */
1780 ttbr = regime_ttbr(env, mmu_idx, param.select);
1781
1782 /*
1783 * Here we should have set up all the parameters for the translation:
1784 * inputsize, ttbr, epd, stride, tbi
1785 */
1786
1787 if (param.epd) {
1788 /*
1789 * Translation table walk disabled => Translation fault on TLB miss
1790 * Note: This is always 0 on 64-bit EL2 and EL3.
1791 */
1792 goto do_translation_fault;
1793 }
1794
1795 if (!regime_is_stage2(mmu_idx)) {
1796 /*
1797 * The starting level depends on the virtual address size (which can
1798 * be up to 48 bits) and the translation granule size. It indicates
1799 * the number of strides (stride bits at a time) needed to
1800 * consume the bits of the input address. In the pseudocode this is:
1801 * level = 4 - RoundUp((inputsize - grainsize) / stride)
1802 * where their 'inputsize' is our 'inputsize', 'grainsize' is
1803 * our 'stride + 3' and 'stride' is our 'stride'.
1804 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
1805 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
1806 * = 4 - (inputsize - 4) / stride;
1807 */
1808 level = 4 - (inputsize - 4) / stride;
1809 } else {
1810 int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
1811 inputsize, stride);
1812 if (startlevel == INT_MIN) {
1813 level = 0;
1814 goto do_translation_fault;
1815 }
1816 level = startlevel;
1817 }
1818
1819 indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3);
1820 indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level)));
1821
1822 /* Now we can extract the actual base address from the TTBR */
1823 descaddr = extract64(ttbr, 0, 48);
1824
1825 /*
1826 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
1827 *
1828 * Otherwise, if the base address is out of range, raise AddressSizeFault.
1829 * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
1830 * but we've just cleared the bits above 47, so simplify the test.
1831 */
1832 if (outputsize > 48) {
1833 descaddr |= extract64(ttbr, 2, 4) << 48;
1834 } else if (descaddr >> outputsize) {
1835 level = 0;
1836 fi->type = ARMFault_AddressSize;
1837 goto do_fault;
1838 }
1839
1840 /*
1841 * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
1842 * and also to mask out CnP (bit 0) which could validly be non-zero.
1843 */
1844 descaddr &= ~indexmask;
1845
1846 /*
1847 * For AArch32, the address field in the descriptor goes up to bit 39
1848 * for both v7 and v8. However, for v8 the SBZ bits [47:40] must be 0
1849 * or an AddressSize fault is raised. So for v8 we extract those SBZ
1850 * bits as part of the address, which will be checked via outputsize.
1851 * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
1852 * the highest bits of a 52-bit output are placed elsewhere.
1853 */
1854 if (param.ds) {
1855 descaddrmask = MAKE_64BIT_MASK(0, 50);
1856 } else if (arm_feature(env, ARM_FEATURE_V8)) {
1857 descaddrmask = MAKE_64BIT_MASK(0, 48);
1858 } else {
1859 descaddrmask = MAKE_64BIT_MASK(0, 40);
1860 }
1861 descaddrmask &= ~indexmask_grainsize;
1862 tableattrs = 0;
1863
1864 next_level:
1865 descaddr |= (address >> (stride * (4 - level))) & indexmask;
1866 descaddr &= ~7ULL;
1867
1868 /*
1869 * Process the NSTable bit from the previous level. This changes
1870 * the table address space and the output space from Secure to
1871 * NonSecure. With RME, the EL3 translation regime does not change
1872 * from Root to NonSecure.
1873 */
1874 if (ptw->in_space == ARMSS_Secure
1875 && !regime_is_stage2(mmu_idx)
1876 && extract32(tableattrs, 4, 1)) {
1877 /*
1878 * Stage2_S -> Stage2 or Phys_S -> Phys_NS
1879 * Assert the relative order of the secure/non-secure indexes.
1880 */
1881 QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
1882 QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
1883 ptw->in_ptw_idx += 1;
1884 ptw->in_space = ARMSS_NonSecure;
1885 }
1886
1887 if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
1888 goto do_fault;
1889 }
1890 descriptor = arm_ldq_ptw(env, ptw, fi);
1891 if (fi->type != ARMFault_None) {
1892 goto do_fault;
1893 }
1894 new_descriptor = descriptor;
1895
1896 restart_atomic_update:
1897 if (!(descriptor & 1) ||
1898 (!(descriptor & 2) &&
1899 !lpae_block_desc_valid(cpu, param.ds, param.gran, level))) {
1900 /* Invalid, or a block descriptor at an invalid level */
1901 goto do_translation_fault;
1902 }
1903
1904 descaddr = descriptor & descaddrmask;
1905
1906 /*
1907 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
1908 * of descriptor. For FEAT_LPA2 and effective DS, bits [51:50] of
1909 * descaddr are in [9:8]. Otherwise, if descaddr is out of range,
1910 * raise AddressSizeFault.
1911 */
1912 if (outputsize > 48) {
1913 if (param.ds) {
1914 descaddr |= extract64(descriptor, 8, 2) << 50;
1915 } else {
1916 descaddr |= extract64(descriptor, 12, 4) << 48;
1917 }
1918 } else if (descaddr >> outputsize) {
1919 fi->type = ARMFault_AddressSize;
1920 goto do_fault;
1921 }
1922
1923 if ((descriptor & 2) && (level < 3)) {
1924 /*
1925 * Table entry. The top five bits are attributes which may
1926 * propagate down through lower levels of the table (and
1927 * which are all arranged so that 0 means "no effect", so
1928 * we can gather them up by ORing in the bits at each level).
1929 */
1930 tableattrs |= extract64(descriptor, 59, 5);
1931 level++;
1932 indexmask = indexmask_grainsize;
1933 goto next_level;
1934 }
1935
1936 /*
1937 * Block entry at level 1 or 2, or page entry at level 3.
1938 * These are basically the same thing, although the number
1939 * of bits we pull in from the vaddr varies. Note that although
1940 * descaddrmask masks enough of the low bits of the descriptor
1941 * to give a correct page or table address, the address field
1942 * in a block descriptor is smaller; so we need to explicitly
1943 * clear the lower bits here before ORing in the low vaddr bits.
1944 *
1945 * Afterward, descaddr is the final physical address.
1946 */
1947 page_size = (1ULL << ((stride * (4 - level)) + 3));
1948 descaddr &= ~(hwaddr)(page_size - 1);
1949 descaddr |= (address & (page_size - 1));
1950
1951 if (likely(!ptw->in_debug)) {
1952 /*
1953 * Access flag.
1954 * If HA is enabled, prepare to update the descriptor below.
1955 * Otherwise, pass the access fault on to software.
1956 */
1957 if (!(descriptor & (1 << 10))) {
1958 if (param.ha) {
1959 new_descriptor |= 1 << 10; /* AF */
1960 } else {
1961 fi->type = ARMFault_AccessFlag;
1962 goto do_fault;
1963 }
1964 }
1965
1966 /*
1967 * Dirty Bit.
1968 * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
1969 * bit for writeback. The actual write protection test may still be
1970 * overridden by tableattrs, to be merged below.
1971 */
1972 if (param.hd
1973 && extract64(descriptor, 51, 1) /* DBM */
1974 && access_type == MMU_DATA_STORE) {
1975 if (regime_is_stage2(mmu_idx)) {
1976 new_descriptor |= 1ull << 7; /* set S2AP[1] */
1977 } else {
1978 new_descriptor &= ~(1ull << 7); /* clear AP[2] */
1979 }
1980 }
1981 }
1982
1983 /*
1984 * Extract attributes from the (modified) descriptor, and apply
1985 * table descriptors. Stage 2 table descriptors do not include
1986 * any attribute fields. HPD disables all the table attributes
1987 * except NSTable (which we have already handled).
1988 */
1989 attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
1990 if (!regime_is_stage2(mmu_idx)) {
1991 if (!param.hpd) {
1992 attrs |= extract64(tableattrs, 0, 2) << 53; /* XN, PXN */
1993 /*
1994 * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
1995 * means "force PL1 access only", which means forcing AP[1] to 0.
1996 */
1997 attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
1998 attrs |= extract32(tableattrs, 3, 1) << 7; /* APT[1] => AP[2] */
1999 }
2000 }
2001
2002 ap = extract32(attrs, 6, 2);
2003 out_space = ptw->in_space;
2004 if (regime_is_stage2(mmu_idx)) {
2005 /*
2006 * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
2007 * The bit remains ignored for other security states.
2008 * R_YMCSL: Executing an insn fetched from non-Realm causes
2009 * a stage2 permission fault.
2010 */
2011 if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
2012 out_space = ARMSS_NonSecure;
2013 result->f.prot = get_S2prot_noexecute(ap);
2014 } else {
2015 xn = extract64(attrs, 53, 2);
2016 result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
2017 }
2018 } else {
2019 int nse, ns = extract32(attrs, 5, 1);
2020 switch (out_space) {
2021 case ARMSS_Root:
2022 /*
2023 * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
2024 * R_XTYPW: NSE and NS together select the output pa space.
2025 */
2026 nse = extract32(attrs, 11, 1);
2027 out_space = (nse << 1) | ns;
2028 if (out_space == ARMSS_Secure &&
2029 !cpu_isar_feature(aa64_sel2, cpu)) {
2030 out_space = ARMSS_NonSecure;
2031 }
2032 break;
2033 case ARMSS_Secure:
2034 if (ns) {
2035 out_space = ARMSS_NonSecure;
2036 }
2037 break;
2038 case ARMSS_Realm:
2039 switch (mmu_idx) {
2040 case ARMMMUIdx_Stage1_E0:
2041 case ARMMMUIdx_Stage1_E1:
2042 case ARMMMUIdx_Stage1_E1_PAN:
2043 /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
2044 break;
2045 case ARMMMUIdx_E2:
2046 case ARMMMUIdx_E20_0:
2047 case ARMMMUIdx_E20_2:
2048 case ARMMMUIdx_E20_2_PAN:
2049 /*
2050 * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
2051 * NS changes the output to non-secure space.
2052 */
2053 if (ns) {
2054 out_space = ARMSS_NonSecure;
2055 }
2056 break;
2057 default:
2058 g_assert_not_reached();
2059 }
2060 break;
2061 case ARMSS_NonSecure:
2062 /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
2063 break;
2064 default:
2065 g_assert_not_reached();
2066 }
2067 xn = extract64(attrs, 54, 1);
2068 pxn = extract64(attrs, 53, 1);
2069
2070 if (el == 1 && nv_nv1_enabled(env, ptw)) {
2071 /*
2072 * With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1}, the block/page
2073 * descriptor bit 54 holds PXN, 53 is RES0, and the effective value
2074 * of UXN is 0. Similarly for bits 59 and 60 in table descriptors
2075 * (which we have already folded into bits 53 and 54 of attrs).
2076 * AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
2077 * Similarly, APTable[0] from the table descriptor is treated as 0;
2078 * we already folded this into AP[1] and squashing that to 0 does
2079 * the right thing.
2080 */
2081 pxn = xn;
2082 xn = 0;
2083 ap &= ~1;
2084 }
2085 /*
2086 * Note that we modified ptw->in_space earlier for NSTable, but
2087 * result->f.attrs retains a copy of the original security space.
2088 */
2089 result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, xn, pxn,
2090 result->f.attrs.space, out_space);
2091 }
2092
2093 if (!(result->f.prot & (1 << access_type))) {
2094 fi->type = ARMFault_Permission;
2095 goto do_fault;
2096 }
2097
2098 /* If FEAT_HAFDBS has made changes, update the PTE. */
2099 if (new_descriptor != descriptor) {
2100 new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
2101 if (fi->type != ARMFault_None) {
2102 goto do_fault;
2103 }
2104 /*
2105 * I_YZSVV says that if the in-memory descriptor has changed,
2106 * then we must use the information in that new value
2107 * (which might include a different output address, different
2108 * attributes, or generate a fault).
2109 * Restart the handling of the descriptor value from scratch.
2110 */
2111 if (new_descriptor != descriptor) {
2112 descriptor = new_descriptor;
2113 goto restart_atomic_update;
2114 }
2115 }
2116
2117 result->f.attrs.space = out_space;
2118 result->f.attrs.secure = arm_space_is_secure(out_space);
2119
2120 if (regime_is_stage2(mmu_idx)) {
2121 result->cacheattrs.is_s2_format = true;
2122 result->cacheattrs.attrs = extract32(attrs, 2, 4);
2123 /*
2124 * Security state does not really affect HCR_EL2.FWB;
2125 * we only need to filter FWB for aa32 or other FEAT.
2126 */
2127 device = S2_attrs_are_device(arm_hcr_el2_eff(env),
2128 result->cacheattrs.attrs);
2129 } else {
2130 /* Index into MAIR registers for cache attributes */
2131 uint8_t attrindx = extract32(attrs, 2, 3);
2132 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
2133 assert(attrindx <= 7);
2134 result->cacheattrs.is_s2_format = false;
2135 result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
2136
2137 /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
2138 if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
2139 result->f.extra.arm.guarded = extract64(attrs, 50, 1); /* GP */
2140 }
2141 device = S1_attrs_are_device(result->cacheattrs.attrs);
2142 }
2143
2144 /*
2145 * Enable alignment checks on Device memory.
2146 *
2147 * Per R_XCHFJ, this check is mis-ordered. The correct ordering
2148 * for alignment, permission, and stage 2 faults should be:
2149 * - Alignment fault caused by the memory type
2150 * - Permission fault
2151 * - A stage 2 fault on the memory access
2152 * but due to the way the TCG softmmu TLB operates, we will have
2153 * implicitly done the permission check and the stage2 lookup in
2154 * finding the TLB entry, so the alignment check cannot be done sooner.
2155 *
2156 * In v7, for a CPU without the Virtualization Extensions this
2157 * access is UNPREDICTABLE; we choose to make it take the alignment
2158 * fault as is required for a v7VE CPU. (QEMU doesn't emulate any
2159 * CPUs with ARM_FEATURE_LPAE but not ARM_FEATURE_V7VE anyway.)
2160 */
2161 if (device) {
2162 result->f.tlb_fill_flags |= TLB_CHECK_ALIGNED;
2163 }
2164
2165 /*
2166 * For FEAT_LPA2 and effective DS, the SH field in the attributes
2167 * was re-purposed for output address bits. The SH attribute in
2168 * that case comes from TCR_ELx, which we extracted earlier.
2169 */
2170 if (param.ds) {
2171 result->cacheattrs.shareability = param.sh;
2172 } else {
2173 result->cacheattrs.shareability = extract32(attrs, 8, 2);
2174 }
2175
2176 result->f.phys_addr = descaddr;
2177 result->f.lg_page_size = ctz64(page_size);
2178 return false;
2179
2180 do_translation_fault:
2181 fi->type = ARMFault_Translation;
2182 do_fault:
2183 if (fi->s1ptw) {
2184 /* Retain the existing stage 2 fi->level */
2185 assert(fi->stage2);
2186 } else {
2187 fi->level = level;
2188 fi->stage2 = regime_is_stage2(mmu_idx);
2189 }
2190 fi->s1ns = fault_s1ns(ptw->in_space, mmu_idx);
2191 return true;
2192 }
2193
get_phys_addr_pmsav5(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)2194 static bool get_phys_addr_pmsav5(CPUARMState *env,
2195 S1Translate *ptw,
2196 uint32_t address,
2197 MMUAccessType access_type,
2198 GetPhysAddrResult *result,
2199 ARMMMUFaultInfo *fi)
2200 {
2201 int n;
2202 uint32_t mask;
2203 uint32_t base;
2204 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2205 bool is_user = regime_is_user(env, mmu_idx);
2206
2207 if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
2208 /* MPU disabled. */
2209 result->f.phys_addr = address;
2210 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
2211 return false;
2212 }
2213
2214 result->f.phys_addr = address;
2215 for (n = 7; n >= 0; n--) {
2216 base = env->cp15.c6_region[n];
2217 if ((base & 1) == 0) {
2218 continue;
2219 }
2220 mask = 1 << ((base >> 1) & 0x1f);
2221 /* Keep this shift separate from the above to avoid an
2222 (undefined) << 32. */
2223 mask = (mask << 1) - 1;
2224 if (((base ^ address) & ~mask) == 0) {
2225 break;
2226 }
2227 }
2228 if (n < 0) {
2229 fi->type = ARMFault_Background;
2230 return true;
2231 }
2232
2233 if (access_type == MMU_INST_FETCH) {
2234 mask = env->cp15.pmsav5_insn_ap;
2235 } else {
2236 mask = env->cp15.pmsav5_data_ap;
2237 }
2238 mask = (mask >> (n * 4)) & 0xf;
2239 switch (mask) {
2240 case 0:
2241 fi->type = ARMFault_Permission;
2242 fi->level = 1;
2243 return true;
2244 case 1:
2245 if (is_user) {
2246 fi->type = ARMFault_Permission;
2247 fi->level = 1;
2248 return true;
2249 }
2250 result->f.prot = PAGE_READ | PAGE_WRITE;
2251 break;
2252 case 2:
2253 result->f.prot = PAGE_READ;
2254 if (!is_user) {
2255 result->f.prot |= PAGE_WRITE;
2256 }
2257 break;
2258 case 3:
2259 result->f.prot = PAGE_READ | PAGE_WRITE;
2260 break;
2261 case 5:
2262 if (is_user) {
2263 fi->type = ARMFault_Permission;
2264 fi->level = 1;
2265 return true;
2266 }
2267 result->f.prot = PAGE_READ;
2268 break;
2269 case 6:
2270 result->f.prot = PAGE_READ;
2271 break;
2272 default:
2273 /* Bad permission. */
2274 fi->type = ARMFault_Permission;
2275 fi->level = 1;
2276 return true;
2277 }
2278 result->f.prot |= PAGE_EXEC;
2279 return false;
2280 }
2281
get_phys_addr_pmsav7_default(CPUARMState * env,ARMMMUIdx mmu_idx,int32_t address,uint8_t * prot)2282 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx,
2283 int32_t address, uint8_t *prot)
2284 {
2285 if (!arm_feature(env, ARM_FEATURE_M)) {
2286 *prot = PAGE_READ | PAGE_WRITE;
2287 switch (address) {
2288 case 0xF0000000 ... 0xFFFFFFFF:
2289 if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
2290 /* hivecs execing is ok */
2291 *prot |= PAGE_EXEC;
2292 }
2293 break;
2294 case 0x00000000 ... 0x7FFFFFFF:
2295 *prot |= PAGE_EXEC;
2296 break;
2297 }
2298 } else {
2299 /* Default system address map for M profile cores.
2300 * The architecture specifies which regions are execute-never;
2301 * at the MPU level no other checks are defined.
2302 */
2303 switch (address) {
2304 case 0x00000000 ... 0x1fffffff: /* ROM */
2305 case 0x20000000 ... 0x3fffffff: /* SRAM */
2306 case 0x60000000 ... 0x7fffffff: /* RAM */
2307 case 0x80000000 ... 0x9fffffff: /* RAM */
2308 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
2309 break;
2310 case 0x40000000 ... 0x5fffffff: /* Peripheral */
2311 case 0xa0000000 ... 0xbfffffff: /* Device */
2312 case 0xc0000000 ... 0xdfffffff: /* Device */
2313 case 0xe0000000 ... 0xffffffff: /* System */
2314 *prot = PAGE_READ | PAGE_WRITE;
2315 break;
2316 default:
2317 g_assert_not_reached();
2318 }
2319 }
2320 }
2321
m_is_ppb_region(CPUARMState * env,uint32_t address)2322 static bool m_is_ppb_region(CPUARMState *env, uint32_t address)
2323 {
2324 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
2325 return arm_feature(env, ARM_FEATURE_M) &&
2326 extract32(address, 20, 12) == 0xe00;
2327 }
2328
m_is_system_region(CPUARMState * env,uint32_t address)2329 static bool m_is_system_region(CPUARMState *env, uint32_t address)
2330 {
2331 /*
2332 * True if address is in the M profile system region
2333 * 0xe0000000 - 0xffffffff
2334 */
2335 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
2336 }
2337
pmsav7_use_background_region(ARMCPU * cpu,ARMMMUIdx mmu_idx,bool is_secure,bool is_user)2338 static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx,
2339 bool is_secure, bool is_user)
2340 {
2341 /*
2342 * Return true if we should use the default memory map as a
2343 * "background" region if there are no hits against any MPU regions.
2344 */
2345 CPUARMState *env = &cpu->env;
2346
2347 if (is_user) {
2348 return false;
2349 }
2350
2351 if (arm_feature(env, ARM_FEATURE_M)) {
2352 return env->v7m.mpu_ctrl[is_secure] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
2353 }
2354
2355 if (mmu_idx == ARMMMUIdx_Stage2) {
2356 return false;
2357 }
2358
2359 return regime_sctlr(env, mmu_idx) & SCTLR_BR;
2360 }
2361
get_phys_addr_pmsav7(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)2362 static bool get_phys_addr_pmsav7(CPUARMState *env,
2363 S1Translate *ptw,
2364 uint32_t address,
2365 MMUAccessType access_type,
2366 GetPhysAddrResult *result,
2367 ARMMMUFaultInfo *fi)
2368 {
2369 ARMCPU *cpu = env_archcpu(env);
2370 int n;
2371 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2372 bool is_user = regime_is_user(env, mmu_idx);
2373 bool secure = arm_space_is_secure(ptw->in_space);
2374
2375 result->f.phys_addr = address;
2376 result->f.lg_page_size = TARGET_PAGE_BITS;
2377 result->f.prot = 0;
2378
2379 if (regime_translation_disabled(env, mmu_idx, ptw->in_space) ||
2380 m_is_ppb_region(env, address)) {
2381 /*
2382 * MPU disabled or M profile PPB access: use default memory map.
2383 * The other case which uses the default memory map in the
2384 * v7M ARM ARM pseudocode is exception vector reads from the vector
2385 * table. In QEMU those accesses are done in arm_v7m_load_vector(),
2386 * which always does a direct read using address_space_ldl(), rather
2387 * than going via this function, so we don't need to check that here.
2388 */
2389 get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
2390 } else { /* MPU enabled */
2391 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
2392 /* region search */
2393 uint32_t base = env->pmsav7.drbar[n];
2394 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
2395 uint32_t rmask;
2396 bool srdis = false;
2397
2398 if (!(env->pmsav7.drsr[n] & 0x1)) {
2399 continue;
2400 }
2401
2402 if (!rsize) {
2403 qemu_log_mask(LOG_GUEST_ERROR,
2404 "DRSR[%d]: Rsize field cannot be 0\n", n);
2405 continue;
2406 }
2407 rsize++;
2408 rmask = (1ull << rsize) - 1;
2409
2410 if (base & rmask) {
2411 qemu_log_mask(LOG_GUEST_ERROR,
2412 "DRBAR[%d]: 0x%" PRIx32 " misaligned "
2413 "to DRSR region size, mask = 0x%" PRIx32 "\n",
2414 n, base, rmask);
2415 continue;
2416 }
2417
2418 if (address < base || address > base + rmask) {
2419 /*
2420 * Address not in this region. We must check whether the
2421 * region covers addresses in the same page as our address.
2422 * In that case we must not report a size that covers the
2423 * whole page for a subsequent hit against a different MPU
2424 * region or the background region, because it would result in
2425 * incorrect TLB hits for subsequent accesses to addresses that
2426 * are in this MPU region.
2427 */
2428 if (ranges_overlap(base, rmask,
2429 address & TARGET_PAGE_MASK,
2430 TARGET_PAGE_SIZE)) {
2431 result->f.lg_page_size = 0;
2432 }
2433 continue;
2434 }
2435
2436 /* Region matched */
2437
2438 if (rsize >= 8) { /* no subregions for regions < 256 bytes */
2439 int i, snd;
2440 uint32_t srdis_mask;
2441
2442 rsize -= 3; /* sub region size (power of 2) */
2443 snd = ((address - base) >> rsize) & 0x7;
2444 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
2445
2446 srdis_mask = srdis ? 0x3 : 0x0;
2447 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
2448 /*
2449 * This will check in groups of 2, 4 and then 8, whether
2450 * the subregion bits are consistent. rsize is incremented
2451 * back up to give the region size, considering consistent
2452 * adjacent subregions as one region. Stop testing if rsize
2453 * is already big enough for an entire QEMU page.
2454 */
2455 int snd_rounded = snd & ~(i - 1);
2456 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
2457 snd_rounded + 8, i);
2458 if (srdis_mask ^ srdis_multi) {
2459 break;
2460 }
2461 srdis_mask = (srdis_mask << i) | srdis_mask;
2462 rsize++;
2463 }
2464 }
2465 if (srdis) {
2466 continue;
2467 }
2468 if (rsize < TARGET_PAGE_BITS) {
2469 result->f.lg_page_size = rsize;
2470 }
2471 break;
2472 }
2473
2474 if (n == -1) { /* no hits */
2475 if (!pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
2476 /* background fault */
2477 fi->type = ARMFault_Background;
2478 return true;
2479 }
2480 get_phys_addr_pmsav7_default(env, mmu_idx, address,
2481 &result->f.prot);
2482 } else { /* a MPU hit! */
2483 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
2484 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
2485
2486 if (m_is_system_region(env, address)) {
2487 /* System space is always execute never */
2488 xn = 1;
2489 }
2490
2491 if (is_user) { /* User mode AP bit decoding */
2492 switch (ap) {
2493 case 0:
2494 case 1:
2495 case 5:
2496 break; /* no access */
2497 case 3:
2498 result->f.prot |= PAGE_WRITE;
2499 /* fall through */
2500 case 2:
2501 case 6:
2502 result->f.prot |= PAGE_READ | PAGE_EXEC;
2503 break;
2504 case 7:
2505 /* for v7M, same as 6; for R profile a reserved value */
2506 if (arm_feature(env, ARM_FEATURE_M)) {
2507 result->f.prot |= PAGE_READ | PAGE_EXEC;
2508 break;
2509 }
2510 /* fall through */
2511 default:
2512 qemu_log_mask(LOG_GUEST_ERROR,
2513 "DRACR[%d]: Bad value for AP bits: 0x%"
2514 PRIx32 "\n", n, ap);
2515 }
2516 } else { /* Priv. mode AP bits decoding */
2517 switch (ap) {
2518 case 0:
2519 break; /* no access */
2520 case 1:
2521 case 2:
2522 case 3:
2523 result->f.prot |= PAGE_WRITE;
2524 /* fall through */
2525 case 5:
2526 case 6:
2527 result->f.prot |= PAGE_READ | PAGE_EXEC;
2528 break;
2529 case 7:
2530 /* for v7M, same as 6; for R profile a reserved value */
2531 if (arm_feature(env, ARM_FEATURE_M)) {
2532 result->f.prot |= PAGE_READ | PAGE_EXEC;
2533 break;
2534 }
2535 /* fall through */
2536 default:
2537 qemu_log_mask(LOG_GUEST_ERROR,
2538 "DRACR[%d]: Bad value for AP bits: 0x%"
2539 PRIx32 "\n", n, ap);
2540 }
2541 }
2542
2543 /* execute never */
2544 if (xn) {
2545 result->f.prot &= ~PAGE_EXEC;
2546 }
2547 }
2548 }
2549
2550 fi->type = ARMFault_Permission;
2551 fi->level = 1;
2552 return !(result->f.prot & (1 << access_type));
2553 }
2554
regime_rbar(CPUARMState * env,ARMMMUIdx mmu_idx,uint32_t secure)2555 static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx,
2556 uint32_t secure)
2557 {
2558 if (regime_el(env, mmu_idx) == 2) {
2559 return env->pmsav8.hprbar;
2560 } else {
2561 return env->pmsav8.rbar[secure];
2562 }
2563 }
2564
regime_rlar(CPUARMState * env,ARMMMUIdx mmu_idx,uint32_t secure)2565 static uint32_t *regime_rlar(CPUARMState *env, ARMMMUIdx mmu_idx,
2566 uint32_t secure)
2567 {
2568 if (regime_el(env, mmu_idx) == 2) {
2569 return env->pmsav8.hprlar;
2570 } else {
2571 return env->pmsav8.rlar[secure];
2572 }
2573 }
2574
pmsav8_mpu_lookup(CPUARMState * env,uint32_t address,MMUAccessType access_type,ARMMMUIdx mmu_idx,bool secure,GetPhysAddrResult * result,ARMMMUFaultInfo * fi,uint32_t * mregion)2575 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
2576 MMUAccessType access_type, ARMMMUIdx mmu_idx,
2577 bool secure, GetPhysAddrResult *result,
2578 ARMMMUFaultInfo *fi, uint32_t *mregion)
2579 {
2580 /*
2581 * Perform a PMSAv8 MPU lookup (without also doing the SAU check
2582 * that a full phys-to-virt translation does).
2583 * mregion is (if not NULL) set to the region number which matched,
2584 * or -1 if no region number is returned (MPU off, address did not
2585 * hit a region, address hit in multiple regions).
2586 * If the region hit doesn't cover the entire TARGET_PAGE the address
2587 * is within, then we set the result page_size to 1 to force the
2588 * memory system to use a subpage.
2589 */
2590 ARMCPU *cpu = env_archcpu(env);
2591 bool is_user = regime_is_user(env, mmu_idx);
2592 int n;
2593 int matchregion = -1;
2594 bool hit = false;
2595 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2596 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2597 int region_counter;
2598
2599 if (regime_el(env, mmu_idx) == 2) {
2600 region_counter = cpu->pmsav8r_hdregion;
2601 } else {
2602 region_counter = cpu->pmsav7_dregion;
2603 }
2604
2605 result->f.lg_page_size = TARGET_PAGE_BITS;
2606 result->f.phys_addr = address;
2607 result->f.prot = 0;
2608 if (mregion) {
2609 *mregion = -1;
2610 }
2611
2612 if (mmu_idx == ARMMMUIdx_Stage2) {
2613 fi->stage2 = true;
2614 }
2615
2616 /*
2617 * Unlike the ARM ARM pseudocode, we don't need to check whether this
2618 * was an exception vector read from the vector table (which is always
2619 * done using the default system address map), because those accesses
2620 * are done in arm_v7m_load_vector(), which always does a direct
2621 * read using address_space_ldl(), rather than going via this function.
2622 */
2623 if (regime_translation_disabled(env, mmu_idx, arm_secure_to_space(secure))) {
2624 /* MPU disabled */
2625 hit = true;
2626 } else if (m_is_ppb_region(env, address)) {
2627 hit = true;
2628 } else {
2629 if (pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
2630 hit = true;
2631 }
2632
2633 uint32_t bitmask;
2634 if (arm_feature(env, ARM_FEATURE_M)) {
2635 bitmask = 0x1f;
2636 } else {
2637 bitmask = 0x3f;
2638 fi->level = 0;
2639 }
2640
2641 for (n = region_counter - 1; n >= 0; n--) {
2642 /* region search */
2643 /*
2644 * Note that the base address is bits [31:x] from the register
2645 * with bits [x-1:0] all zeroes, but the limit address is bits
2646 * [31:x] from the register with bits [x:0] all ones. Where x is
2647 * 5 for Cortex-M and 6 for Cortex-R
2648 */
2649 uint32_t base = regime_rbar(env, mmu_idx, secure)[n] & ~bitmask;
2650 uint32_t limit = regime_rlar(env, mmu_idx, secure)[n] | bitmask;
2651
2652 if (!(regime_rlar(env, mmu_idx, secure)[n] & 0x1)) {
2653 /* Region disabled */
2654 continue;
2655 }
2656
2657 if (address < base || address > limit) {
2658 /*
2659 * Address not in this region. We must check whether the
2660 * region covers addresses in the same page as our address.
2661 * In that case we must not report a size that covers the
2662 * whole page for a subsequent hit against a different MPU
2663 * region or the background region, because it would result in
2664 * incorrect TLB hits for subsequent accesses to addresses that
2665 * are in this MPU region.
2666 */
2667 if (limit >= base &&
2668 ranges_overlap(base, limit - base + 1,
2669 addr_page_base,
2670 TARGET_PAGE_SIZE)) {
2671 result->f.lg_page_size = 0;
2672 }
2673 continue;
2674 }
2675
2676 if (base > addr_page_base || limit < addr_page_limit) {
2677 result->f.lg_page_size = 0;
2678 }
2679
2680 if (matchregion != -1) {
2681 /*
2682 * Multiple regions match -- always a failure (unlike
2683 * PMSAv7 where highest-numbered-region wins)
2684 */
2685 fi->type = ARMFault_Permission;
2686 if (arm_feature(env, ARM_FEATURE_M)) {
2687 fi->level = 1;
2688 }
2689 return true;
2690 }
2691
2692 matchregion = n;
2693 hit = true;
2694 }
2695 }
2696
2697 if (!hit) {
2698 if (arm_feature(env, ARM_FEATURE_M)) {
2699 fi->type = ARMFault_Background;
2700 } else {
2701 fi->type = ARMFault_Permission;
2702 }
2703 return true;
2704 }
2705
2706 if (matchregion == -1) {
2707 /* hit using the background region */
2708 get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
2709 } else {
2710 uint32_t matched_rbar = regime_rbar(env, mmu_idx, secure)[matchregion];
2711 uint32_t matched_rlar = regime_rlar(env, mmu_idx, secure)[matchregion];
2712 uint32_t ap = extract32(matched_rbar, 1, 2);
2713 uint32_t xn = extract32(matched_rbar, 0, 1);
2714 bool pxn = false;
2715
2716 if (arm_feature(env, ARM_FEATURE_V8_1M)) {
2717 pxn = extract32(matched_rlar, 4, 1);
2718 }
2719
2720 if (m_is_system_region(env, address)) {
2721 /* System space is always execute never */
2722 xn = 1;
2723 }
2724
2725 if (regime_el(env, mmu_idx) == 2) {
2726 result->f.prot = simple_ap_to_rw_prot_is_user(ap,
2727 mmu_idx != ARMMMUIdx_E2);
2728 } else {
2729 result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
2730 }
2731
2732 if (!arm_feature(env, ARM_FEATURE_M)) {
2733 uint8_t attrindx = extract32(matched_rlar, 1, 3);
2734 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
2735 uint8_t sh = extract32(matched_rlar, 3, 2);
2736
2737 if (regime_sctlr(env, mmu_idx) & SCTLR_WXN &&
2738 result->f.prot & PAGE_WRITE && mmu_idx != ARMMMUIdx_Stage2) {
2739 xn = 0x1;
2740 }
2741
2742 if ((regime_el(env, mmu_idx) == 1) &&
2743 regime_sctlr(env, mmu_idx) & SCTLR_UWXN && ap == 0x1) {
2744 pxn = 0x1;
2745 }
2746
2747 result->cacheattrs.is_s2_format = false;
2748 result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
2749 result->cacheattrs.shareability = sh;
2750 }
2751
2752 if (result->f.prot && !xn && !(pxn && !is_user)) {
2753 result->f.prot |= PAGE_EXEC;
2754 }
2755
2756 if (mregion) {
2757 *mregion = matchregion;
2758 }
2759 }
2760
2761 fi->type = ARMFault_Permission;
2762 if (arm_feature(env, ARM_FEATURE_M)) {
2763 fi->level = 1;
2764 }
2765 return !(result->f.prot & (1 << access_type));
2766 }
2767
v8m_is_sau_exempt(CPUARMState * env,uint32_t address,MMUAccessType access_type)2768 static bool v8m_is_sau_exempt(CPUARMState *env,
2769 uint32_t address, MMUAccessType access_type)
2770 {
2771 /*
2772 * The architecture specifies that certain address ranges are
2773 * exempt from v8M SAU/IDAU checks.
2774 */
2775 return
2776 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
2777 (address >= 0xe0000000 && address <= 0xe0002fff) ||
2778 (address >= 0xe000e000 && address <= 0xe000efff) ||
2779 (address >= 0xe002e000 && address <= 0xe002efff) ||
2780 (address >= 0xe0040000 && address <= 0xe0041fff) ||
2781 (address >= 0xe00ff000 && address <= 0xe00fffff);
2782 }
2783
v8m_security_lookup(CPUARMState * env,uint32_t address,MMUAccessType access_type,ARMMMUIdx mmu_idx,bool is_secure,V8M_SAttributes * sattrs)2784 void v8m_security_lookup(CPUARMState *env, uint32_t address,
2785 MMUAccessType access_type, ARMMMUIdx mmu_idx,
2786 bool is_secure, V8M_SAttributes *sattrs)
2787 {
2788 /*
2789 * Look up the security attributes for this address. Compare the
2790 * pseudocode SecurityCheck() function.
2791 * We assume the caller has zero-initialized *sattrs.
2792 */
2793 ARMCPU *cpu = env_archcpu(env);
2794 int r;
2795 bool idau_exempt = false, idau_ns = true, idau_nsc = true;
2796 int idau_region = IREGION_NOTVALID;
2797 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2798 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2799
2800 if (cpu->idau) {
2801 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
2802 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
2803
2804 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
2805 &idau_nsc);
2806 }
2807
2808 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
2809 /* 0xf0000000..0xffffffff is always S for insn fetches */
2810 return;
2811 }
2812
2813 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
2814 sattrs->ns = !is_secure;
2815 return;
2816 }
2817
2818 if (idau_region != IREGION_NOTVALID) {
2819 sattrs->irvalid = true;
2820 sattrs->iregion = idau_region;
2821 }
2822
2823 switch (env->sau.ctrl & 3) {
2824 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
2825 break;
2826 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
2827 sattrs->ns = true;
2828 break;
2829 default: /* SAU.ENABLE == 1 */
2830 for (r = 0; r < cpu->sau_sregion; r++) {
2831 if (env->sau.rlar[r] & 1) {
2832 uint32_t base = env->sau.rbar[r] & ~0x1f;
2833 uint32_t limit = env->sau.rlar[r] | 0x1f;
2834
2835 if (base <= address && limit >= address) {
2836 if (base > addr_page_base || limit < addr_page_limit) {
2837 sattrs->subpage = true;
2838 }
2839 if (sattrs->srvalid) {
2840 /*
2841 * If we hit in more than one region then we must report
2842 * as Secure, not NS-Callable, with no valid region
2843 * number info.
2844 */
2845 sattrs->ns = false;
2846 sattrs->nsc = false;
2847 sattrs->sregion = 0;
2848 sattrs->srvalid = false;
2849 break;
2850 } else {
2851 if (env->sau.rlar[r] & 2) {
2852 sattrs->nsc = true;
2853 } else {
2854 sattrs->ns = true;
2855 }
2856 sattrs->srvalid = true;
2857 sattrs->sregion = r;
2858 }
2859 } else {
2860 /*
2861 * Address not in this region. We must check whether the
2862 * region covers addresses in the same page as our address.
2863 * In that case we must not report a size that covers the
2864 * whole page for a subsequent hit against a different MPU
2865 * region or the background region, because it would result
2866 * in incorrect TLB hits for subsequent accesses to
2867 * addresses that are in this MPU region.
2868 */
2869 if (limit >= base &&
2870 ranges_overlap(base, limit - base + 1,
2871 addr_page_base,
2872 TARGET_PAGE_SIZE)) {
2873 sattrs->subpage = true;
2874 }
2875 }
2876 }
2877 }
2878 break;
2879 }
2880
2881 /*
2882 * The IDAU will override the SAU lookup results if it specifies
2883 * higher security than the SAU does.
2884 */
2885 if (!idau_ns) {
2886 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
2887 sattrs->ns = false;
2888 sattrs->nsc = idau_nsc;
2889 }
2890 }
2891 }
2892
get_phys_addr_pmsav8(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)2893 static bool get_phys_addr_pmsav8(CPUARMState *env,
2894 S1Translate *ptw,
2895 uint32_t address,
2896 MMUAccessType access_type,
2897 GetPhysAddrResult *result,
2898 ARMMMUFaultInfo *fi)
2899 {
2900 V8M_SAttributes sattrs = {};
2901 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2902 bool secure = arm_space_is_secure(ptw->in_space);
2903 bool ret;
2904
2905 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2906 v8m_security_lookup(env, address, access_type, mmu_idx,
2907 secure, &sattrs);
2908 if (access_type == MMU_INST_FETCH) {
2909 /*
2910 * Instruction fetches always use the MMU bank and the
2911 * transaction attribute determined by the fetch address,
2912 * regardless of CPU state. This is painful for QEMU
2913 * to handle, because it would mean we need to encode
2914 * into the mmu_idx not just the (user, negpri) information
2915 * for the current security state but also that for the
2916 * other security state, which would balloon the number
2917 * of mmu_idx values needed alarmingly.
2918 * Fortunately we can avoid this because it's not actually
2919 * possible to arbitrarily execute code from memory with
2920 * the wrong security attribute: it will always generate
2921 * an exception of some kind or another, apart from the
2922 * special case of an NS CPU executing an SG instruction
2923 * in S&NSC memory. So we always just fail the translation
2924 * here and sort things out in the exception handler
2925 * (including possibly emulating an SG instruction).
2926 */
2927 if (sattrs.ns != !secure) {
2928 if (sattrs.nsc) {
2929 fi->type = ARMFault_QEMU_NSCExec;
2930 } else {
2931 fi->type = ARMFault_QEMU_SFault;
2932 }
2933 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2934 result->f.phys_addr = address;
2935 result->f.prot = 0;
2936 return true;
2937 }
2938 } else {
2939 /*
2940 * For data accesses we always use the MMU bank indicated
2941 * by the current CPU state, but the security attributes
2942 * might downgrade a secure access to nonsecure.
2943 */
2944 if (sattrs.ns) {
2945 result->f.attrs.secure = false;
2946 result->f.attrs.space = ARMSS_NonSecure;
2947 } else if (!secure) {
2948 /*
2949 * NS access to S memory must fault.
2950 * Architecturally we should first check whether the
2951 * MPU information for this address indicates that we
2952 * are doing an unaligned access to Device memory, which
2953 * should generate a UsageFault instead. QEMU does not
2954 * currently check for that kind of unaligned access though.
2955 * If we added it we would need to do so as a special case
2956 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
2957 */
2958 fi->type = ARMFault_QEMU_SFault;
2959 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2960 result->f.phys_addr = address;
2961 result->f.prot = 0;
2962 return true;
2963 }
2964 }
2965 }
2966
2967 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
2968 result, fi, NULL);
2969 if (sattrs.subpage) {
2970 result->f.lg_page_size = 0;
2971 }
2972 return ret;
2973 }
2974
2975 /*
2976 * Translate from the 4-bit stage 2 representation of
2977 * memory attributes (without cache-allocation hints) to
2978 * the 8-bit representation of the stage 1 MAIR registers
2979 * (which includes allocation hints).
2980 *
2981 * ref: shared/translation/attrs/S2AttrDecode()
2982 * .../S2ConvertAttrsHints()
2983 */
convert_stage2_attrs(uint64_t hcr,uint8_t s2attrs)2984 static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs)
2985 {
2986 uint8_t hiattr = extract32(s2attrs, 2, 2);
2987 uint8_t loattr = extract32(s2attrs, 0, 2);
2988 uint8_t hihint = 0, lohint = 0;
2989
2990 if (hiattr != 0) { /* normal memory */
2991 if (hcr & HCR_CD) { /* cache disabled */
2992 hiattr = loattr = 1; /* non-cacheable */
2993 } else {
2994 if (hiattr != 1) { /* Write-through or write-back */
2995 hihint = 3; /* RW allocate */
2996 }
2997 if (loattr != 1) { /* Write-through or write-back */
2998 lohint = 3; /* RW allocate */
2999 }
3000 }
3001 }
3002
3003 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
3004 }
3005
3006 /*
3007 * Combine either inner or outer cacheability attributes for normal
3008 * memory, according to table D4-42 and pseudocode procedure
3009 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
3010 *
3011 * NB: only stage 1 includes allocation hints (RW bits), leading to
3012 * some asymmetry.
3013 */
combine_cacheattr_nibble(uint8_t s1,uint8_t s2)3014 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
3015 {
3016 if (s1 == 4 || s2 == 4) {
3017 /* non-cacheable has precedence */
3018 return 4;
3019 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
3020 /* stage 1 write-through takes precedence */
3021 return s1;
3022 } else if (extract32(s2, 2, 2) == 2) {
3023 /* stage 2 write-through takes precedence, but the allocation hint
3024 * is still taken from stage 1
3025 */
3026 return (2 << 2) | extract32(s1, 0, 2);
3027 } else { /* write-back */
3028 return s1;
3029 }
3030 }
3031
3032 /*
3033 * Combine the memory type and cacheability attributes of
3034 * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
3035 * combined attributes in MAIR_EL1 format.
3036 */
combined_attrs_nofwb(uint64_t hcr,ARMCacheAttrs s1,ARMCacheAttrs s2)3037 static uint8_t combined_attrs_nofwb(uint64_t hcr,
3038 ARMCacheAttrs s1, ARMCacheAttrs s2)
3039 {
3040 uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs;
3041
3042 if (s2.is_s2_format) {
3043 s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs);
3044 } else {
3045 s2_mair_attrs = s2.attrs;
3046 }
3047
3048 s1lo = extract32(s1.attrs, 0, 4);
3049 s2lo = extract32(s2_mair_attrs, 0, 4);
3050 s1hi = extract32(s1.attrs, 4, 4);
3051 s2hi = extract32(s2_mair_attrs, 4, 4);
3052
3053 /* Combine memory type and cacheability attributes */
3054 if (s1hi == 0 || s2hi == 0) {
3055 /* Device has precedence over normal */
3056 if (s1lo == 0 || s2lo == 0) {
3057 /* nGnRnE has precedence over anything */
3058 ret_attrs = 0;
3059 } else if (s1lo == 4 || s2lo == 4) {
3060 /* non-Reordering has precedence over Reordering */
3061 ret_attrs = 4; /* nGnRE */
3062 } else if (s1lo == 8 || s2lo == 8) {
3063 /* non-Gathering has precedence over Gathering */
3064 ret_attrs = 8; /* nGRE */
3065 } else {
3066 ret_attrs = 0xc; /* GRE */
3067 }
3068 } else { /* Normal memory */
3069 /* Outer/inner cacheability combine independently */
3070 ret_attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
3071 | combine_cacheattr_nibble(s1lo, s2lo);
3072 }
3073 return ret_attrs;
3074 }
3075
force_cacheattr_nibble_wb(uint8_t attr)3076 static uint8_t force_cacheattr_nibble_wb(uint8_t attr)
3077 {
3078 /*
3079 * Given the 4 bits specifying the outer or inner cacheability
3080 * in MAIR format, return a value specifying Normal Write-Back,
3081 * with the allocation and transient hints taken from the input
3082 * if the input specified some kind of cacheable attribute.
3083 */
3084 if (attr == 0 || attr == 4) {
3085 /*
3086 * 0 == an UNPREDICTABLE encoding
3087 * 4 == Non-cacheable
3088 * Either way, force Write-Back RW allocate non-transient
3089 */
3090 return 0xf;
3091 }
3092 /* Change WriteThrough to WriteBack, keep allocation and transient hints */
3093 return attr | 4;
3094 }
3095
3096 /*
3097 * Combine the memory type and cacheability attributes of
3098 * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
3099 * combined attributes in MAIR_EL1 format.
3100 */
combined_attrs_fwb(ARMCacheAttrs s1,ARMCacheAttrs s2)3101 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
3102 {
3103 assert(s2.is_s2_format && !s1.is_s2_format);
3104
3105 switch (s2.attrs) {
3106 case 7:
3107 /* Use stage 1 attributes */
3108 return s1.attrs;
3109 case 6:
3110 /*
3111 * Force Normal Write-Back. Note that if S1 is Normal cacheable
3112 * then we take the allocation hints from it; otherwise it is
3113 * RW allocate, non-transient.
3114 */
3115 if ((s1.attrs & 0xf0) == 0) {
3116 /* S1 is Device */
3117 return 0xff;
3118 }
3119 /* Need to check the Inner and Outer nibbles separately */
3120 return force_cacheattr_nibble_wb(s1.attrs & 0xf) |
3121 force_cacheattr_nibble_wb(s1.attrs >> 4) << 4;
3122 case 5:
3123 /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */
3124 if ((s1.attrs & 0xf0) == 0) {
3125 return s1.attrs;
3126 }
3127 return 0x44;
3128 case 0 ... 3:
3129 /* Force Device, of subtype specified by S2 */
3130 return s2.attrs << 2;
3131 default:
3132 /*
3133 * RESERVED values (including RES0 descriptor bit [5] being nonzero);
3134 * arbitrarily force Device.
3135 */
3136 return 0;
3137 }
3138 }
3139
3140 /*
3141 * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
3142 * and CombineS1S2Desc()
3143 *
3144 * @env: CPUARMState
3145 * @s1: Attributes from stage 1 walk
3146 * @s2: Attributes from stage 2 walk
3147 */
combine_cacheattrs(uint64_t hcr,ARMCacheAttrs s1,ARMCacheAttrs s2)3148 static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
3149 ARMCacheAttrs s1, ARMCacheAttrs s2)
3150 {
3151 ARMCacheAttrs ret;
3152 bool tagged = false;
3153
3154 assert(!s1.is_s2_format);
3155 ret.is_s2_format = false;
3156
3157 if (s1.attrs == 0xf0) {
3158 tagged = true;
3159 s1.attrs = 0xff;
3160 }
3161
3162 /* Combine shareability attributes (table D4-43) */
3163 if (s1.shareability == 2 || s2.shareability == 2) {
3164 /* if either are outer-shareable, the result is outer-shareable */
3165 ret.shareability = 2;
3166 } else if (s1.shareability == 3 || s2.shareability == 3) {
3167 /* if either are inner-shareable, the result is inner-shareable */
3168 ret.shareability = 3;
3169 } else {
3170 /* both non-shareable */
3171 ret.shareability = 0;
3172 }
3173
3174 /* Combine memory type and cacheability attributes */
3175 if (hcr & HCR_FWB) {
3176 ret.attrs = combined_attrs_fwb(s1, s2);
3177 } else {
3178 ret.attrs = combined_attrs_nofwb(hcr, s1, s2);
3179 }
3180
3181 /*
3182 * Any location for which the resultant memory type is any
3183 * type of Device memory is always treated as Outer Shareable.
3184 * Any location for which the resultant memory type is Normal
3185 * Inner Non-cacheable, Outer Non-cacheable is always treated
3186 * as Outer Shareable.
3187 * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC
3188 */
3189 if ((ret.attrs & 0xf0) == 0 || ret.attrs == 0x44) {
3190 ret.shareability = 2;
3191 }
3192
3193 /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */
3194 if (tagged && ret.attrs == 0xff) {
3195 ret.attrs = 0xf0;
3196 }
3197
3198 return ret;
3199 }
3200
3201 /*
3202 * MMU disabled. S1 addresses within aa64 translation regimes are
3203 * still checked for bounds -- see AArch64.S1DisabledOutput().
3204 */
get_phys_addr_disabled(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3205 static bool get_phys_addr_disabled(CPUARMState *env,
3206 S1Translate *ptw,
3207 vaddr address,
3208 MMUAccessType access_type,
3209 GetPhysAddrResult *result,
3210 ARMMMUFaultInfo *fi)
3211 {
3212 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
3213 uint8_t memattr = 0x00; /* Device nGnRnE */
3214 uint8_t shareability = 0; /* non-shareable */
3215 int r_el;
3216
3217 switch (mmu_idx) {
3218 case ARMMMUIdx_Stage2:
3219 case ARMMMUIdx_Stage2_S:
3220 case ARMMMUIdx_Phys_S:
3221 case ARMMMUIdx_Phys_NS:
3222 case ARMMMUIdx_Phys_Root:
3223 case ARMMMUIdx_Phys_Realm:
3224 break;
3225
3226 default:
3227 r_el = regime_el(env, mmu_idx);
3228 if (arm_el_is_aa64(env, r_el)) {
3229 int pamax = arm_pamax(env_archcpu(env));
3230 uint64_t tcr = env->cp15.tcr_el[r_el];
3231 int addrtop, tbi;
3232
3233 tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
3234 if (access_type == MMU_INST_FETCH) {
3235 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
3236 }
3237 tbi = (tbi >> extract64(address, 55, 1)) & 1;
3238 addrtop = (tbi ? 55 : 63);
3239
3240 if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
3241 fi->type = ARMFault_AddressSize;
3242 fi->level = 0;
3243 fi->stage2 = false;
3244 return 1;
3245 }
3246
3247 /*
3248 * When TBI is disabled, we've just validated that all of the
3249 * bits above PAMax are zero, so logically we only need to
3250 * clear the top byte for TBI. But it's clearer to follow
3251 * the pseudocode set of addrdesc.paddress.
3252 */
3253 address = extract64(address, 0, 52);
3254 }
3255
3256 /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
3257 if (r_el == 1) {
3258 uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
3259 if (hcr & HCR_DC) {
3260 if (hcr & HCR_DCT) {
3261 memattr = 0xf0; /* Tagged, Normal, WB, RWA */
3262 } else {
3263 memattr = 0xff; /* Normal, WB, RWA */
3264 }
3265 }
3266 }
3267 if (memattr == 0) {
3268 if (access_type == MMU_INST_FETCH) {
3269 if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
3270 memattr = 0xee; /* Normal, WT, RA, NT */
3271 } else {
3272 memattr = 0x44; /* Normal, NC, No */
3273 }
3274 }
3275 shareability = 2; /* outer shareable */
3276 }
3277 result->cacheattrs.is_s2_format = false;
3278 break;
3279 }
3280
3281 result->f.phys_addr = address;
3282 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
3283 result->f.lg_page_size = TARGET_PAGE_BITS;
3284 result->cacheattrs.shareability = shareability;
3285 result->cacheattrs.attrs = memattr;
3286 return false;
3287 }
3288
get_phys_addr_twostage(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3289 static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
3290 vaddr address,
3291 MMUAccessType access_type,
3292 GetPhysAddrResult *result,
3293 ARMMMUFaultInfo *fi)
3294 {
3295 hwaddr ipa;
3296 int s1_prot, s1_lgpgsz;
3297 ARMSecuritySpace in_space = ptw->in_space;
3298 bool ret, ipa_secure, s1_guarded;
3299 ARMCacheAttrs cacheattrs1;
3300 ARMSecuritySpace ipa_space;
3301 uint64_t hcr;
3302
3303 ret = get_phys_addr_nogpc(env, ptw, address, access_type, result, fi);
3304
3305 /* If S1 fails, return early. */
3306 if (ret) {
3307 return ret;
3308 }
3309
3310 ipa = result->f.phys_addr;
3311 ipa_secure = result->f.attrs.secure;
3312 ipa_space = result->f.attrs.space;
3313
3314 ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
3315 ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
3316 ptw->in_space = ipa_space;
3317 ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
3318
3319 /*
3320 * S1 is done, now do S2 translation.
3321 * Save the stage1 results so that we may merge prot and cacheattrs later.
3322 */
3323 s1_prot = result->f.prot;
3324 s1_lgpgsz = result->f.lg_page_size;
3325 s1_guarded = result->f.extra.arm.guarded;
3326 cacheattrs1 = result->cacheattrs;
3327 memset(result, 0, sizeof(*result));
3328
3329 ret = get_phys_addr_nogpc(env, ptw, ipa, access_type, result, fi);
3330 fi->s2addr = ipa;
3331
3332 /* Combine the S1 and S2 perms. */
3333 result->f.prot &= s1_prot;
3334
3335 /* If S2 fails, return early. */
3336 if (ret) {
3337 return ret;
3338 }
3339
3340 /*
3341 * If either S1 or S2 returned a result smaller than TARGET_PAGE_SIZE,
3342 * this means "don't put this in the TLB"; in this case, return a
3343 * result with lg_page_size == 0 to achieve that. Otherwise,
3344 * use the maximum of the S1 & S2 page size, so that invalidation
3345 * of pages > TARGET_PAGE_SIZE works correctly. (This works even though
3346 * we know the combined result permissions etc only cover the minimum
3347 * of the S1 and S2 page size, because we know that the common TLB code
3348 * never actually creates TLB entries bigger than TARGET_PAGE_SIZE,
3349 * and passing a larger page size value only affects invalidations.)
3350 */
3351 if (result->f.lg_page_size < TARGET_PAGE_BITS ||
3352 s1_lgpgsz < TARGET_PAGE_BITS) {
3353 result->f.lg_page_size = 0;
3354 } else if (result->f.lg_page_size < s1_lgpgsz) {
3355 result->f.lg_page_size = s1_lgpgsz;
3356 }
3357
3358 /* Combine the S1 and S2 cache attributes. */
3359 hcr = arm_hcr_el2_eff_secstate(env, in_space);
3360 if (hcr & HCR_DC) {
3361 /*
3362 * HCR.DC forces the first stage attributes to
3363 * Normal Non-Shareable,
3364 * Inner Write-Back Read-Allocate Write-Allocate,
3365 * Outer Write-Back Read-Allocate Write-Allocate.
3366 * Do not overwrite Tagged within attrs.
3367 */
3368 if (cacheattrs1.attrs != 0xf0) {
3369 cacheattrs1.attrs = 0xff;
3370 }
3371 cacheattrs1.shareability = 0;
3372 }
3373 result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1,
3374 result->cacheattrs);
3375
3376 /* No BTI GP information in stage 2, we just use the S1 value */
3377 result->f.extra.arm.guarded = s1_guarded;
3378
3379 /*
3380 * Check if IPA translates to secure or non-secure PA space.
3381 * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
3382 */
3383 if (in_space == ARMSS_Secure) {
3384 result->f.attrs.secure =
3385 !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
3386 && (ipa_secure
3387 || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
3388 result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
3389 }
3390
3391 return false;
3392 }
3393
get_phys_addr_nogpc(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3394 static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
3395 vaddr address,
3396 MMUAccessType access_type,
3397 GetPhysAddrResult *result,
3398 ARMMMUFaultInfo *fi)
3399 {
3400 ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
3401 ARMMMUIdx s1_mmu_idx;
3402
3403 /*
3404 * The page table entries may downgrade Secure to NonSecure, but
3405 * cannot upgrade a NonSecure translation regime's attributes
3406 * to Secure or Realm.
3407 */
3408 result->f.attrs.space = ptw->in_space;
3409 result->f.attrs.secure = arm_space_is_secure(ptw->in_space);
3410
3411 switch (mmu_idx) {
3412 case ARMMMUIdx_Phys_S:
3413 case ARMMMUIdx_Phys_NS:
3414 case ARMMMUIdx_Phys_Root:
3415 case ARMMMUIdx_Phys_Realm:
3416 /* Checking Phys early avoids special casing later vs regime_el. */
3417 return get_phys_addr_disabled(env, ptw, address, access_type,
3418 result, fi);
3419
3420 case ARMMMUIdx_Stage1_E0:
3421 case ARMMMUIdx_Stage1_E1:
3422 case ARMMMUIdx_Stage1_E1_PAN:
3423 /*
3424 * First stage lookup uses second stage for ptw; only
3425 * Secure has both S and NS IPA and starts with Stage2_S.
3426 */
3427 ptw->in_ptw_idx = (ptw->in_space == ARMSS_Secure) ?
3428 ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
3429 break;
3430
3431 case ARMMMUIdx_Stage2:
3432 case ARMMMUIdx_Stage2_S:
3433 /*
3434 * Second stage lookup uses physical for ptw; whether this is S or
3435 * NS may depend on the SW/NSW bits if this is a stage 2 lookup for
3436 * the Secure EL2&0 regime.
3437 */
3438 ptw->in_ptw_idx = ptw_idx_for_stage_2(env, mmu_idx);
3439 break;
3440
3441 case ARMMMUIdx_E10_0:
3442 s1_mmu_idx = ARMMMUIdx_Stage1_E0;
3443 goto do_twostage;
3444 case ARMMMUIdx_E10_1:
3445 s1_mmu_idx = ARMMMUIdx_Stage1_E1;
3446 goto do_twostage;
3447 case ARMMMUIdx_E10_1_PAN:
3448 s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
3449 do_twostage:
3450 /*
3451 * Call ourselves recursively to do the stage 1 and then stage 2
3452 * translations if mmu_idx is a two-stage regime, and EL2 present.
3453 * Otherwise, a stage1+stage2 translation is just stage 1.
3454 */
3455 ptw->in_mmu_idx = mmu_idx = s1_mmu_idx;
3456 if (arm_feature(env, ARM_FEATURE_EL2) &&
3457 !regime_translation_disabled(env, ARMMMUIdx_Stage2, ptw->in_space)) {
3458 return get_phys_addr_twostage(env, ptw, address, access_type,
3459 result, fi);
3460 }
3461 /* fall through */
3462
3463 default:
3464 /* Single stage uses physical for ptw. */
3465 ptw->in_ptw_idx = arm_space_to_phys(ptw->in_space);
3466 break;
3467 }
3468
3469 result->f.attrs.user = regime_is_user(env, mmu_idx);
3470
3471 /*
3472 * Fast Context Switch Extension. This doesn't exist at all in v8.
3473 * In v7 and earlier it affects all stage 1 translations.
3474 */
3475 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2
3476 && !arm_feature(env, ARM_FEATURE_V8)) {
3477 if (regime_el(env, mmu_idx) == 3) {
3478 address += env->cp15.fcseidr_s;
3479 } else {
3480 address += env->cp15.fcseidr_ns;
3481 }
3482 }
3483
3484 if (arm_feature(env, ARM_FEATURE_PMSA)) {
3485 bool ret;
3486 result->f.lg_page_size = TARGET_PAGE_BITS;
3487
3488 if (arm_feature(env, ARM_FEATURE_V8)) {
3489 /* PMSAv8 */
3490 ret = get_phys_addr_pmsav8(env, ptw, address, access_type,
3491 result, fi);
3492 } else if (arm_feature(env, ARM_FEATURE_V7)) {
3493 /* PMSAv7 */
3494 ret = get_phys_addr_pmsav7(env, ptw, address, access_type,
3495 result, fi);
3496 } else {
3497 /* Pre-v7 MPU */
3498 ret = get_phys_addr_pmsav5(env, ptw, address, access_type,
3499 result, fi);
3500 }
3501 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
3502 " mmu_idx %u -> %s (prot %c%c%c)\n",
3503 access_type == MMU_DATA_LOAD ? "reading" :
3504 (access_type == MMU_DATA_STORE ? "writing" : "execute"),
3505 (uint32_t)address, mmu_idx,
3506 ret ? "Miss" : "Hit",
3507 result->f.prot & PAGE_READ ? 'r' : '-',
3508 result->f.prot & PAGE_WRITE ? 'w' : '-',
3509 result->f.prot & PAGE_EXEC ? 'x' : '-');
3510
3511 return ret;
3512 }
3513
3514 /* Definitely a real MMU, not an MPU */
3515
3516 if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
3517 return get_phys_addr_disabled(env, ptw, address, access_type,
3518 result, fi);
3519 }
3520
3521 if (regime_using_lpae_format(env, mmu_idx)) {
3522 return get_phys_addr_lpae(env, ptw, address, access_type, result, fi);
3523 } else if (arm_feature(env, ARM_FEATURE_V7) ||
3524 regime_sctlr(env, mmu_idx) & SCTLR_XP) {
3525 return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
3526 } else {
3527 return get_phys_addr_v5(env, ptw, address, access_type, result, fi);
3528 }
3529 }
3530
get_phys_addr_gpc(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3531 static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
3532 vaddr address,
3533 MMUAccessType access_type,
3534 GetPhysAddrResult *result,
3535 ARMMMUFaultInfo *fi)
3536 {
3537 if (get_phys_addr_nogpc(env, ptw, address, access_type, result, fi)) {
3538 return true;
3539 }
3540 if (!granule_protection_check(env, result->f.phys_addr,
3541 result->f.attrs.space, fi)) {
3542 fi->type = ARMFault_GPCFOnOutput;
3543 return true;
3544 }
3545 return false;
3546 }
3547
get_phys_addr_with_space_nogpc(CPUARMState * env,vaddr address,MMUAccessType access_type,ARMMMUIdx mmu_idx,ARMSecuritySpace space,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3548 bool get_phys_addr_with_space_nogpc(CPUARMState *env, vaddr address,
3549 MMUAccessType access_type,
3550 ARMMMUIdx mmu_idx, ARMSecuritySpace space,
3551 GetPhysAddrResult *result,
3552 ARMMMUFaultInfo *fi)
3553 {
3554 S1Translate ptw = {
3555 .in_mmu_idx = mmu_idx,
3556 .in_space = space,
3557 };
3558 return get_phys_addr_nogpc(env, &ptw, address, access_type, result, fi);
3559 }
3560
get_phys_addr(CPUARMState * env,vaddr address,MMUAccessType access_type,ARMMMUIdx mmu_idx,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3561 bool get_phys_addr(CPUARMState *env, vaddr address,
3562 MMUAccessType access_type, ARMMMUIdx mmu_idx,
3563 GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
3564 {
3565 S1Translate ptw = {
3566 .in_mmu_idx = mmu_idx,
3567 };
3568 ARMSecuritySpace ss;
3569
3570 switch (mmu_idx) {
3571 case ARMMMUIdx_E10_0:
3572 case ARMMMUIdx_E10_1:
3573 case ARMMMUIdx_E10_1_PAN:
3574 case ARMMMUIdx_E20_0:
3575 case ARMMMUIdx_E20_2:
3576 case ARMMMUIdx_E20_2_PAN:
3577 case ARMMMUIdx_Stage1_E0:
3578 case ARMMMUIdx_Stage1_E1:
3579 case ARMMMUIdx_Stage1_E1_PAN:
3580 case ARMMMUIdx_E2:
3581 ss = arm_security_space_below_el3(env);
3582 break;
3583 case ARMMMUIdx_Stage2:
3584 /*
3585 * For Secure EL2, we need this index to be NonSecure;
3586 * otherwise this will already be NonSecure or Realm.
3587 */
3588 ss = arm_security_space_below_el3(env);
3589 if (ss == ARMSS_Secure) {
3590 ss = ARMSS_NonSecure;
3591 }
3592 break;
3593 case ARMMMUIdx_Phys_NS:
3594 case ARMMMUIdx_MPrivNegPri:
3595 case ARMMMUIdx_MUserNegPri:
3596 case ARMMMUIdx_MPriv:
3597 case ARMMMUIdx_MUser:
3598 ss = ARMSS_NonSecure;
3599 break;
3600 case ARMMMUIdx_Stage2_S:
3601 case ARMMMUIdx_Phys_S:
3602 case ARMMMUIdx_MSPrivNegPri:
3603 case ARMMMUIdx_MSUserNegPri:
3604 case ARMMMUIdx_MSPriv:
3605 case ARMMMUIdx_MSUser:
3606 ss = ARMSS_Secure;
3607 break;
3608 case ARMMMUIdx_E3:
3609 case ARMMMUIdx_E30_0:
3610 case ARMMMUIdx_E30_3_PAN:
3611 if (arm_feature(env, ARM_FEATURE_AARCH64) &&
3612 cpu_isar_feature(aa64_rme, env_archcpu(env))) {
3613 ss = ARMSS_Root;
3614 } else {
3615 ss = ARMSS_Secure;
3616 }
3617 break;
3618 case ARMMMUIdx_Phys_Root:
3619 ss = ARMSS_Root;
3620 break;
3621 case ARMMMUIdx_Phys_Realm:
3622 ss = ARMSS_Realm;
3623 break;
3624 default:
3625 g_assert_not_reached();
3626 }
3627
3628 ptw.in_space = ss;
3629 return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
3630 }
3631
arm_cpu_get_phys_page_attrs_debug(CPUState * cs,vaddr addr,MemTxAttrs * attrs)3632 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
3633 MemTxAttrs *attrs)
3634 {
3635 ARMCPU *cpu = ARM_CPU(cs);
3636 CPUARMState *env = &cpu->env;
3637 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
3638 ARMSecuritySpace ss = arm_security_space(env);
3639 S1Translate ptw = {
3640 .in_mmu_idx = mmu_idx,
3641 .in_space = ss,
3642 .in_debug = true,
3643 };
3644 GetPhysAddrResult res = {};
3645 ARMMMUFaultInfo fi = {};
3646 bool ret;
3647
3648 ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
3649 *attrs = res.f.attrs;
3650
3651 if (ret) {
3652 return -1;
3653 }
3654 return res.f.phys_addr;
3655 }
3656