xref: /openbmc/qemu/target/arm/ptw.c (revision 6d62f309)
1 /*
2  * ARM page table walking.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/range.h"
12 #include "qemu/main-loop.h"
13 #include "exec/exec-all.h"
14 #include "exec/page-protection.h"
15 #include "cpu.h"
16 #include "internals.h"
17 #include "cpu-features.h"
18 #include "idau.h"
19 #ifdef CONFIG_TCG
20 # include "tcg/oversized-guest.h"
21 #endif
22 
23 typedef struct S1Translate {
24     /*
25      * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
26      * Together with in_space, specifies the architectural translation regime.
27      */
28     ARMMMUIdx in_mmu_idx;
29     /*
30      * in_ptw_idx: specifies which mmuidx to use for the actual
31      * page table descriptor load operations. This will be one of the
32      * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
33      * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
34      * this field is updated accordingly.
35      */
36     ARMMMUIdx in_ptw_idx;
37     /*
38      * in_space: the security space for this walk. This plus
39      * the in_mmu_idx specify the architectural translation regime.
40      * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
41      * this field is updated accordingly.
42      *
43      * Note that the security space for the in_ptw_idx may be different
44      * from that for the in_mmu_idx. We do not need to explicitly track
45      * the in_ptw_idx security space because:
46      *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
47      *    itself specifies the security space
48      *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
49      *    space used for ptw reads is the same as that of the security
50      *    space of the stage 1 translation for all cases except where
51      *    stage 1 is Secure; in that case the only possibilities for
52      *    the ptw read are Secure and NonSecure, and the in_ptw_idx
53      *    value being Stage2 vs Stage2_S distinguishes those.
54      */
55     ARMSecuritySpace in_space;
56     /*
57      * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
58      * accesses will not update the guest page table access flags
59      * and will not change the state of the softmmu TLBs.
60      */
61     bool in_debug;
62     /*
63      * If this is stage 2 of a stage 1+2 page table walk, then this must
64      * be true if stage 1 is an EL0 access; otherwise this is ignored.
65      * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
66      */
67     bool in_s1_is_el0;
68     bool out_rw;
69     bool out_be;
70     ARMSecuritySpace out_space;
71     hwaddr out_virt;
72     hwaddr out_phys;
73     void *out_host;
74 } S1Translate;
75 
76 static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
77                                 vaddr address,
78                                 MMUAccessType access_type,
79                                 GetPhysAddrResult *result,
80                                 ARMMMUFaultInfo *fi);
81 
82 static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
83                               vaddr address,
84                               MMUAccessType access_type,
85                               GetPhysAddrResult *result,
86                               ARMMMUFaultInfo *fi);
87 
88 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
89 static const uint8_t pamax_map[] = {
90     [0] = 32,
91     [1] = 36,
92     [2] = 40,
93     [3] = 42,
94     [4] = 44,
95     [5] = 48,
96     [6] = 52,
97 };
98 
99 /*
100  * The cpu-specific constant value of PAMax; also used by hw/arm/virt.
101  * Note that machvirt_init calls this on a CPU that is inited but not realized!
102  */
arm_pamax(ARMCPU * cpu)103 unsigned int arm_pamax(ARMCPU *cpu)
104 {
105     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
106         unsigned int parange =
107             FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
108 
109         /*
110          * id_aa64mmfr0 is a read-only register so values outside of the
111          * supported mappings can be considered an implementation error.
112          */
113         assert(parange < ARRAY_SIZE(pamax_map));
114         return pamax_map[parange];
115     }
116 
117     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
118         /* v7 or v8 with LPAE */
119         return 40;
120     }
121     /* Anything else */
122     return 32;
123 }
124 
125 /*
126  * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index
127  */
stage_1_mmu_idx(ARMMMUIdx mmu_idx)128 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
129 {
130     switch (mmu_idx) {
131     case ARMMMUIdx_E10_0:
132         return ARMMMUIdx_Stage1_E0;
133     case ARMMMUIdx_E10_1:
134         return ARMMMUIdx_Stage1_E1;
135     case ARMMMUIdx_E10_1_PAN:
136         return ARMMMUIdx_Stage1_E1_PAN;
137     default:
138         return mmu_idx;
139     }
140 }
141 
arm_stage1_mmu_idx(CPUARMState * env)142 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
143 {
144     return stage_1_mmu_idx(arm_mmu_idx(env));
145 }
146 
147 /*
148  * Return where we should do ptw loads from for a stage 2 walk.
149  * This depends on whether the address we are looking up is a
150  * Secure IPA or a NonSecure IPA, which we know from whether this is
151  * Stage2 or Stage2_S.
152  * If this is the Secure EL1&0 regime we need to check the NSW and SW bits.
153  */
ptw_idx_for_stage_2(CPUARMState * env,ARMMMUIdx stage2idx)154 static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx)
155 {
156     bool s2walk_secure;
157 
158     /*
159      * We're OK to check the current state of the CPU here because
160      * (1) we always invalidate all TLBs when the SCR_EL3.NS or SCR_EL3.NSE bit
161      * changes.
162      * (2) there's no way to do a lookup that cares about Stage 2 for a
163      * different security state to the current one for AArch64, and AArch32
164      * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
165      * an NS stage 1+2 lookup while the NS bit is 0.)
166      */
167     if (!arm_el_is_aa64(env, 3)) {
168         return ARMMMUIdx_Phys_NS;
169     }
170 
171     switch (arm_security_space_below_el3(env)) {
172     case ARMSS_NonSecure:
173         return ARMMMUIdx_Phys_NS;
174     case ARMSS_Realm:
175         return ARMMMUIdx_Phys_Realm;
176     case ARMSS_Secure:
177         if (stage2idx == ARMMMUIdx_Stage2_S) {
178             s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
179         } else {
180             s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
181         }
182         return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
183     default:
184         g_assert_not_reached();
185     }
186 }
187 
regime_translation_big_endian(CPUARMState * env,ARMMMUIdx mmu_idx)188 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
189 {
190     return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
191 }
192 
193 /* Return the TTBR associated with this translation regime */
regime_ttbr(CPUARMState * env,ARMMMUIdx mmu_idx,int ttbrn)194 static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
195 {
196     if (mmu_idx == ARMMMUIdx_Stage2) {
197         return env->cp15.vttbr_el2;
198     }
199     if (mmu_idx == ARMMMUIdx_Stage2_S) {
200         return env->cp15.vsttbr_el2;
201     }
202     if (ttbrn == 0) {
203         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
204     } else {
205         return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
206     }
207 }
208 
209 /* Return true if the specified stage of address translation is disabled */
regime_translation_disabled(CPUARMState * env,ARMMMUIdx mmu_idx,ARMSecuritySpace space)210 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
211                                         ARMSecuritySpace space)
212 {
213     uint64_t hcr_el2;
214 
215     if (arm_feature(env, ARM_FEATURE_M)) {
216         bool is_secure = arm_space_is_secure(space);
217         switch (env->v7m.mpu_ctrl[is_secure] &
218                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
219         case R_V7M_MPU_CTRL_ENABLE_MASK:
220             /* Enabled, but not for HardFault and NMI */
221             return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
222         case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
223             /* Enabled for all cases */
224             return false;
225         case 0:
226         default:
227             /*
228              * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
229              * we warned about that in armv7m_nvic.c when the guest set it.
230              */
231             return true;
232         }
233     }
234 
235 
236     switch (mmu_idx) {
237     case ARMMMUIdx_Stage2:
238     case ARMMMUIdx_Stage2_S:
239         /* HCR.DC means HCR.VM behaves as 1 */
240         hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
241         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
242 
243     case ARMMMUIdx_E10_0:
244     case ARMMMUIdx_E10_1:
245     case ARMMMUIdx_E10_1_PAN:
246         /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
247         hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
248         if (hcr_el2 & HCR_TGE) {
249             return true;
250         }
251         break;
252 
253     case ARMMMUIdx_Stage1_E0:
254     case ARMMMUIdx_Stage1_E1:
255     case ARMMMUIdx_Stage1_E1_PAN:
256         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
257         hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
258         if (hcr_el2 & HCR_DC) {
259             return true;
260         }
261         break;
262 
263     case ARMMMUIdx_E20_0:
264     case ARMMMUIdx_E20_2:
265     case ARMMMUIdx_E20_2_PAN:
266     case ARMMMUIdx_E2:
267     case ARMMMUIdx_E3:
268     case ARMMMUIdx_E30_0:
269     case ARMMMUIdx_E30_3_PAN:
270         break;
271 
272     case ARMMMUIdx_Phys_S:
273     case ARMMMUIdx_Phys_NS:
274     case ARMMMUIdx_Phys_Root:
275     case ARMMMUIdx_Phys_Realm:
276         /* No translation for physical address spaces. */
277         return true;
278 
279     default:
280         g_assert_not_reached();
281     }
282 
283     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
284 }
285 
granule_protection_check(CPUARMState * env,uint64_t paddress,ARMSecuritySpace pspace,ARMMMUFaultInfo * fi)286 static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
287                                      ARMSecuritySpace pspace,
288                                      ARMMMUFaultInfo *fi)
289 {
290     MemTxAttrs attrs = {
291         .secure = true,
292         .space = ARMSS_Root,
293     };
294     ARMCPU *cpu = env_archcpu(env);
295     uint64_t gpccr = env->cp15.gpccr_el3;
296     unsigned pps, pgs, l0gptsz, level = 0;
297     uint64_t tableaddr, pps_mask, align, entry, index;
298     AddressSpace *as;
299     MemTxResult result;
300     int gpi;
301 
302     if (!FIELD_EX64(gpccr, GPCCR, GPC)) {
303         return true;
304     }
305 
306     /*
307      * GPC Priority 1 (R_GMGRR):
308      * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
309      * the access fails as GPT walk fault at level 0.
310      */
311 
312     /*
313      * Configuration of PPS to a value exceeding the implemented
314      * physical address size is invalid.
315      */
316     pps = FIELD_EX64(gpccr, GPCCR, PPS);
317     if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
318         goto fault_walk;
319     }
320     pps = pamax_map[pps];
321     pps_mask = MAKE_64BIT_MASK(0, pps);
322 
323     switch (FIELD_EX64(gpccr, GPCCR, SH)) {
324     case 0b10: /* outer shareable */
325         break;
326     case 0b00: /* non-shareable */
327     case 0b11: /* inner shareable */
328         /* Inner and Outer non-cacheable requires Outer shareable. */
329         if (FIELD_EX64(gpccr, GPCCR, ORGN) == 0 &&
330             FIELD_EX64(gpccr, GPCCR, IRGN) == 0) {
331             goto fault_walk;
332         }
333         break;
334     default:   /* reserved */
335         goto fault_walk;
336     }
337 
338     switch (FIELD_EX64(gpccr, GPCCR, PGS)) {
339     case 0b00: /* 4KB */
340         pgs = 12;
341         break;
342     case 0b01: /* 64KB */
343         pgs = 16;
344         break;
345     case 0b10: /* 16KB */
346         pgs = 14;
347         break;
348     default: /* reserved */
349         goto fault_walk;
350     }
351 
352     /* Note this field is read-only and fixed at reset. */
353     l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
354 
355     /*
356      * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
357      * R_CPDSB: A NonSecure physical address input exceeding PPS
358      * does not experience any fault.
359      */
360     if (paddress & ~pps_mask) {
361         if (pspace == ARMSS_NonSecure) {
362             return true;
363         }
364         goto fault_size;
365     }
366 
367     /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
368     tableaddr = env->cp15.gptbr_el3 << 12;
369     if (tableaddr & ~pps_mask) {
370         goto fault_size;
371     }
372 
373     /*
374      * BADDR is aligned per a function of PPS and L0GPTSZ.
375      * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
376      * unlike the RES0 bits of the GPT entries (R_XNKFZ).
377      */
378     align = MAX(pps - l0gptsz + 3, 12);
379     align = MAKE_64BIT_MASK(0, align);
380     tableaddr &= ~align;
381 
382     as = arm_addressspace(env_cpu(env), attrs);
383 
384     /* Level 0 lookup. */
385     index = extract64(paddress, l0gptsz, pps - l0gptsz);
386     tableaddr += index * 8;
387     entry = address_space_ldq_le(as, tableaddr, attrs, &result);
388     if (result != MEMTX_OK) {
389         goto fault_eabt;
390     }
391 
392     switch (extract32(entry, 0, 4)) {
393     case 1: /* block descriptor */
394         if (entry >> 8) {
395             goto fault_walk; /* RES0 bits not 0 */
396         }
397         gpi = extract32(entry, 4, 4);
398         goto found;
399     case 3: /* table descriptor */
400         tableaddr = entry & ~0xf;
401         align = MAX(l0gptsz - pgs - 1, 12);
402         align = MAKE_64BIT_MASK(0, align);
403         if (tableaddr & (~pps_mask | align)) {
404             goto fault_walk; /* RES0 bits not 0 */
405         }
406         break;
407     default: /* invalid */
408         goto fault_walk;
409     }
410 
411     /* Level 1 lookup */
412     level = 1;
413     index = extract64(paddress, pgs + 4, l0gptsz - pgs - 4);
414     tableaddr += index * 8;
415     entry = address_space_ldq_le(as, tableaddr, attrs, &result);
416     if (result != MEMTX_OK) {
417         goto fault_eabt;
418     }
419 
420     switch (extract32(entry, 0, 4)) {
421     case 1: /* contiguous descriptor */
422         if (entry >> 10) {
423             goto fault_walk; /* RES0 bits not 0 */
424         }
425         /*
426          * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
427          * and because we cannot invalidate by pa, and thus will always
428          * flush entire tlbs, we don't actually care about the range here
429          * and can simply extract the GPI as the result.
430          */
431         if (extract32(entry, 8, 2) == 0) {
432             goto fault_walk; /* reserved contig */
433         }
434         gpi = extract32(entry, 4, 4);
435         break;
436     default:
437         index = extract64(paddress, pgs, 4);
438         gpi = extract64(entry, index * 4, 4);
439         break;
440     }
441 
442  found:
443     switch (gpi) {
444     case 0b0000: /* no access */
445         break;
446     case 0b1111: /* all access */
447         return true;
448     case 0b1000:
449     case 0b1001:
450     case 0b1010:
451     case 0b1011:
452         if (pspace == (gpi & 3)) {
453             return true;
454         }
455         break;
456     default:
457         goto fault_walk; /* reserved */
458     }
459 
460     fi->gpcf = GPCF_Fail;
461     goto fault_common;
462  fault_eabt:
463     fi->gpcf = GPCF_EABT;
464     goto fault_common;
465  fault_size:
466     fi->gpcf = GPCF_AddressSize;
467     goto fault_common;
468  fault_walk:
469     fi->gpcf = GPCF_Walk;
470  fault_common:
471     fi->level = level;
472     fi->paddr = paddress;
473     fi->paddr_space = pspace;
474     return false;
475 }
476 
S1_attrs_are_device(uint8_t attrs)477 static bool S1_attrs_are_device(uint8_t attrs)
478 {
479     /*
480      * This slightly under-decodes the MAIR_ELx field:
481      * 0b0000dd01 is Device with FEAT_XS, otherwise UNPREDICTABLE;
482      * 0b0000dd1x is UNPREDICTABLE.
483      */
484     return (attrs & 0xf0) == 0;
485 }
486 
S2_attrs_are_device(uint64_t hcr,uint8_t attrs)487 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
488 {
489     /*
490      * For an S1 page table walk, the stage 1 attributes are always
491      * some form of "this is Normal memory". The combined S1+S2
492      * attributes are therefore only Device if stage 2 specifies Device.
493      * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00,
494      * ie when cacheattrs.attrs bits [3:2] are 0b00.
495      * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie
496      * when cacheattrs.attrs bit [2] is 0.
497      */
498     if (hcr & HCR_FWB) {
499         return (attrs & 0x4) == 0;
500     } else {
501         return (attrs & 0xc) == 0;
502     }
503 }
504 
S2_security_space(ARMSecuritySpace s1_space,ARMMMUIdx s2_mmu_idx)505 static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
506                                           ARMMMUIdx s2_mmu_idx)
507 {
508     /*
509      * Return the security space to use for stage 2 when doing
510      * the S1 page table descriptor load.
511      */
512     if (regime_is_stage2(s2_mmu_idx)) {
513         /*
514          * The security space for ptw reads is almost always the same
515          * as that of the security space of the stage 1 translation.
516          * The only exception is when stage 1 is Secure; in that case
517          * the ptw read might be to the Secure or the NonSecure space
518          * (but never Realm or Root), and the s2_mmu_idx tells us which.
519          * Root translations are always single-stage.
520          */
521         if (s1_space == ARMSS_Secure) {
522             return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
523         } else {
524             assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
525             assert(s1_space != ARMSS_Root);
526             return s1_space;
527         }
528     } else {
529         /* ptw loads are from phys: the mmu idx itself says which space */
530         return arm_phys_to_space(s2_mmu_idx);
531     }
532 }
533 
fault_s1ns(ARMSecuritySpace space,ARMMMUIdx s2_mmu_idx)534 static bool fault_s1ns(ARMSecuritySpace space, ARMMMUIdx s2_mmu_idx)
535 {
536     /*
537      * For stage 2 faults in Secure EL22, S1NS indicates
538      * whether the faulting IPA is in the Secure or NonSecure
539      * IPA space. For all other kinds of fault, it is false.
540      */
541     return space == ARMSS_Secure && regime_is_stage2(s2_mmu_idx)
542         && s2_mmu_idx == ARMMMUIdx_Stage2_S;
543 }
544 
545 /* Translate a S1 pagetable walk through S2 if needed.  */
S1_ptw_translate(CPUARMState * env,S1Translate * ptw,hwaddr addr,ARMMMUFaultInfo * fi)546 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
547                              hwaddr addr, ARMMMUFaultInfo *fi)
548 {
549     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
550     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
551     uint8_t pte_attrs;
552 
553     ptw->out_virt = addr;
554 
555     if (unlikely(ptw->in_debug)) {
556         /*
557          * From gdbstub, do not use softmmu so that we don't modify the
558          * state of the cpu at all, including softmmu tlb contents.
559          */
560         ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
561         S1Translate s2ptw = {
562             .in_mmu_idx = s2_mmu_idx,
563             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
564             .in_space = s2_space,
565             .in_debug = true,
566         };
567         GetPhysAddrResult s2 = { };
568 
569         if (get_phys_addr_gpc(env, &s2ptw, addr, MMU_DATA_LOAD, &s2, fi)) {
570             goto fail;
571         }
572 
573         ptw->out_phys = s2.f.phys_addr;
574         pte_attrs = s2.cacheattrs.attrs;
575         ptw->out_host = NULL;
576         ptw->out_rw = false;
577         ptw->out_space = s2.f.attrs.space;
578     } else {
579 #ifdef CONFIG_TCG
580         CPUTLBEntryFull *full;
581         int flags;
582 
583         env->tlb_fi = fi;
584         flags = probe_access_full_mmu(env, addr, 0, MMU_DATA_LOAD,
585                                       arm_to_core_mmu_idx(s2_mmu_idx),
586                                       &ptw->out_host, &full);
587         env->tlb_fi = NULL;
588 
589         if (unlikely(flags & TLB_INVALID_MASK)) {
590             goto fail;
591         }
592         ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK);
593         ptw->out_rw = full->prot & PAGE_WRITE;
594         pte_attrs = full->extra.arm.pte_attrs;
595         ptw->out_space = full->attrs.space;
596 #else
597         g_assert_not_reached();
598 #endif
599     }
600 
601     if (regime_is_stage2(s2_mmu_idx)) {
602         uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
603 
604         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
605             /*
606              * PTW set and S1 walk touched S2 Device memory:
607              * generate Permission fault.
608              */
609             fi->type = ARMFault_Permission;
610             fi->s2addr = addr;
611             fi->stage2 = true;
612             fi->s1ptw = true;
613             fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
614             return false;
615         }
616     }
617 
618     ptw->out_be = regime_translation_big_endian(env, mmu_idx);
619     return true;
620 
621  fail:
622     assert(fi->type != ARMFault_None);
623     if (fi->type == ARMFault_GPCFOnOutput) {
624         fi->type = ARMFault_GPCFOnWalk;
625     }
626     fi->s2addr = addr;
627     fi->stage2 = regime_is_stage2(s2_mmu_idx);
628     fi->s1ptw = fi->stage2;
629     fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
630     return false;
631 }
632 
633 /* All loads done in the course of a page table walk go through here. */
arm_ldl_ptw(CPUARMState * env,S1Translate * ptw,ARMMMUFaultInfo * fi)634 static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
635                             ARMMMUFaultInfo *fi)
636 {
637     CPUState *cs = env_cpu(env);
638     void *host = ptw->out_host;
639     uint32_t data;
640 
641     if (likely(host)) {
642         /* Page tables are in RAM, and we have the host address. */
643         data = qatomic_read((uint32_t *)host);
644         if (ptw->out_be) {
645             data = be32_to_cpu(data);
646         } else {
647             data = le32_to_cpu(data);
648         }
649     } else {
650         /* Page tables are in MMIO. */
651         MemTxAttrs attrs = {
652             .space = ptw->out_space,
653             .secure = arm_space_is_secure(ptw->out_space),
654         };
655         AddressSpace *as = arm_addressspace(cs, attrs);
656         MemTxResult result = MEMTX_OK;
657 
658         if (ptw->out_be) {
659             data = address_space_ldl_be(as, ptw->out_phys, attrs, &result);
660         } else {
661             data = address_space_ldl_le(as, ptw->out_phys, attrs, &result);
662         }
663         if (unlikely(result != MEMTX_OK)) {
664             fi->type = ARMFault_SyncExternalOnWalk;
665             fi->ea = arm_extabort_type(result);
666             return 0;
667         }
668     }
669     return data;
670 }
671 
arm_ldq_ptw(CPUARMState * env,S1Translate * ptw,ARMMMUFaultInfo * fi)672 static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
673                             ARMMMUFaultInfo *fi)
674 {
675     CPUState *cs = env_cpu(env);
676     void *host = ptw->out_host;
677     uint64_t data;
678 
679     if (likely(host)) {
680         /* Page tables are in RAM, and we have the host address. */
681 #ifdef CONFIG_ATOMIC64
682         data = qatomic_read__nocheck((uint64_t *)host);
683         if (ptw->out_be) {
684             data = be64_to_cpu(data);
685         } else {
686             data = le64_to_cpu(data);
687         }
688 #else
689         if (ptw->out_be) {
690             data = ldq_be_p(host);
691         } else {
692             data = ldq_le_p(host);
693         }
694 #endif
695     } else {
696         /* Page tables are in MMIO. */
697         MemTxAttrs attrs = {
698             .space = ptw->out_space,
699             .secure = arm_space_is_secure(ptw->out_space),
700         };
701         AddressSpace *as = arm_addressspace(cs, attrs);
702         MemTxResult result = MEMTX_OK;
703 
704         if (ptw->out_be) {
705             data = address_space_ldq_be(as, ptw->out_phys, attrs, &result);
706         } else {
707             data = address_space_ldq_le(as, ptw->out_phys, attrs, &result);
708         }
709         if (unlikely(result != MEMTX_OK)) {
710             fi->type = ARMFault_SyncExternalOnWalk;
711             fi->ea = arm_extabort_type(result);
712             return 0;
713         }
714     }
715     return data;
716 }
717 
arm_casq_ptw(CPUARMState * env,uint64_t old_val,uint64_t new_val,S1Translate * ptw,ARMMMUFaultInfo * fi)718 static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
719                              uint64_t new_val, S1Translate *ptw,
720                              ARMMMUFaultInfo *fi)
721 {
722 #if defined(TARGET_AARCH64) && defined(CONFIG_TCG)
723     uint64_t cur_val;
724     void *host = ptw->out_host;
725 
726     if (unlikely(!host)) {
727         /* Page table in MMIO Memory Region */
728         CPUState *cs = env_cpu(env);
729         MemTxAttrs attrs = {
730             .space = ptw->out_space,
731             .secure = arm_space_is_secure(ptw->out_space),
732         };
733         AddressSpace *as = arm_addressspace(cs, attrs);
734         MemTxResult result = MEMTX_OK;
735         bool need_lock = !bql_locked();
736 
737         if (need_lock) {
738             bql_lock();
739         }
740         if (ptw->out_be) {
741             cur_val = address_space_ldq_be(as, ptw->out_phys, attrs, &result);
742             if (unlikely(result != MEMTX_OK)) {
743                 fi->type = ARMFault_SyncExternalOnWalk;
744                 fi->ea = arm_extabort_type(result);
745                 if (need_lock) {
746                     bql_unlock();
747                 }
748                 return old_val;
749             }
750             if (cur_val == old_val) {
751                 address_space_stq_be(as, ptw->out_phys, new_val, attrs, &result);
752                 if (unlikely(result != MEMTX_OK)) {
753                     fi->type = ARMFault_SyncExternalOnWalk;
754                     fi->ea = arm_extabort_type(result);
755                     if (need_lock) {
756                         bql_unlock();
757                     }
758                     return old_val;
759                 }
760                 cur_val = new_val;
761             }
762         } else {
763             cur_val = address_space_ldq_le(as, ptw->out_phys, attrs, &result);
764             if (unlikely(result != MEMTX_OK)) {
765                 fi->type = ARMFault_SyncExternalOnWalk;
766                 fi->ea = arm_extabort_type(result);
767                 if (need_lock) {
768                     bql_unlock();
769                 }
770                 return old_val;
771             }
772             if (cur_val == old_val) {
773                 address_space_stq_le(as, ptw->out_phys, new_val, attrs, &result);
774                 if (unlikely(result != MEMTX_OK)) {
775                     fi->type = ARMFault_SyncExternalOnWalk;
776                     fi->ea = arm_extabort_type(result);
777                     if (need_lock) {
778                         bql_unlock();
779                     }
780                     return old_val;
781                 }
782                 cur_val = new_val;
783             }
784         }
785         if (need_lock) {
786             bql_unlock();
787         }
788         return cur_val;
789     }
790 
791     /*
792      * Raising a stage2 Protection fault for an atomic update to a read-only
793      * page is delayed until it is certain that there is a change to make.
794      */
795     if (unlikely(!ptw->out_rw)) {
796         int flags;
797 
798         env->tlb_fi = fi;
799         flags = probe_access_full_mmu(env, ptw->out_virt, 0,
800                                       MMU_DATA_STORE,
801                                       arm_to_core_mmu_idx(ptw->in_ptw_idx),
802                                       NULL, NULL);
803         env->tlb_fi = NULL;
804 
805         if (unlikely(flags & TLB_INVALID_MASK)) {
806             /*
807              * We know this must be a stage 2 fault because the granule
808              * protection table does not separately track read and write
809              * permission, so all GPC faults are caught in S1_ptw_translate():
810              * we only get here for "readable but not writeable".
811              */
812             assert(fi->type != ARMFault_None);
813             fi->s2addr = ptw->out_virt;
814             fi->stage2 = true;
815             fi->s1ptw = true;
816             fi->s1ns = fault_s1ns(ptw->in_space, ptw->in_ptw_idx);
817             return 0;
818         }
819 
820         /* In case CAS mismatches and we loop, remember writability. */
821         ptw->out_rw = true;
822     }
823 
824 #ifdef CONFIG_ATOMIC64
825     if (ptw->out_be) {
826         old_val = cpu_to_be64(old_val);
827         new_val = cpu_to_be64(new_val);
828         cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
829         cur_val = be64_to_cpu(cur_val);
830     } else {
831         old_val = cpu_to_le64(old_val);
832         new_val = cpu_to_le64(new_val);
833         cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
834         cur_val = le64_to_cpu(cur_val);
835     }
836 #else
837     /*
838      * We can't support the full 64-bit atomic cmpxchg on the host.
839      * Because this is only used for FEAT_HAFDBS, which is only for AA64,
840      * we know that TCG_OVERSIZED_GUEST is set, which means that we are
841      * running in round-robin mode and could only race with dma i/o.
842      */
843 #if !TCG_OVERSIZED_GUEST
844 # error "Unexpected configuration"
845 #endif
846     bool locked = bql_locked();
847     if (!locked) {
848         bql_lock();
849     }
850     if (ptw->out_be) {
851         cur_val = ldq_be_p(host);
852         if (cur_val == old_val) {
853             stq_be_p(host, new_val);
854         }
855     } else {
856         cur_val = ldq_le_p(host);
857         if (cur_val == old_val) {
858             stq_le_p(host, new_val);
859         }
860     }
861     if (!locked) {
862         bql_unlock();
863     }
864 #endif
865 
866     return cur_val;
867 #else
868     /* AArch32 does not have FEAT_HADFS; non-TCG guests only use debug-mode. */
869     g_assert_not_reached();
870 #endif
871 }
872 
get_level1_table_address(CPUARMState * env,ARMMMUIdx mmu_idx,uint32_t * table,uint32_t address)873 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
874                                      uint32_t *table, uint32_t address)
875 {
876     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
877     uint64_t tcr = regime_tcr(env, mmu_idx);
878     int maskshift = extract32(tcr, 0, 3);
879     uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
880     uint32_t base_mask;
881 
882     if (address & mask) {
883         if (tcr & TTBCR_PD1) {
884             /* Translation table walk disabled for TTBR1 */
885             return false;
886         }
887         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
888     } else {
889         if (tcr & TTBCR_PD0) {
890             /* Translation table walk disabled for TTBR0 */
891             return false;
892         }
893         base_mask = ~((uint32_t)0x3fffu >> maskshift);
894         *table = regime_ttbr(env, mmu_idx, 0) & base_mask;
895     }
896     *table |= (address >> 18) & 0x3ffc;
897     return true;
898 }
899 
900 /*
901  * Translate section/page access permissions to page R/W protection flags
902  * @env:         CPUARMState
903  * @mmu_idx:     MMU index indicating required translation regime
904  * @ap:          The 3-bit access permissions (AP[2:0])
905  * @domain_prot: The 2-bit domain access permissions
906  * @is_user: TRUE if accessing from PL0
907  */
ap_to_rw_prot_is_user(CPUARMState * env,ARMMMUIdx mmu_idx,int ap,int domain_prot,bool is_user)908 static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx,
909                          int ap, int domain_prot, bool is_user)
910 {
911     if (domain_prot == 3) {
912         return PAGE_READ | PAGE_WRITE;
913     }
914 
915     switch (ap) {
916     case 0:
917         if (arm_feature(env, ARM_FEATURE_V7)) {
918             return 0;
919         }
920         switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
921         case SCTLR_S:
922             return is_user ? 0 : PAGE_READ;
923         case SCTLR_R:
924             return PAGE_READ;
925         default:
926             return 0;
927         }
928     case 1:
929         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
930     case 2:
931         if (is_user) {
932             return PAGE_READ;
933         } else {
934             return PAGE_READ | PAGE_WRITE;
935         }
936     case 3:
937         return PAGE_READ | PAGE_WRITE;
938     case 4: /* Reserved.  */
939         return 0;
940     case 5:
941         return is_user ? 0 : PAGE_READ;
942     case 6:
943         return PAGE_READ;
944     case 7:
945         if (!arm_feature(env, ARM_FEATURE_V6K)) {
946             return 0;
947         }
948         return PAGE_READ;
949     default:
950         g_assert_not_reached();
951     }
952 }
953 
954 /*
955  * Translate section/page access permissions to page R/W protection flags
956  * @env:         CPUARMState
957  * @mmu_idx:     MMU index indicating required translation regime
958  * @ap:          The 3-bit access permissions (AP[2:0])
959  * @domain_prot: The 2-bit domain access permissions
960  */
ap_to_rw_prot(CPUARMState * env,ARMMMUIdx mmu_idx,int ap,int domain_prot)961 static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
962                          int ap, int domain_prot)
963 {
964    return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
965                                 regime_is_user(env, mmu_idx));
966 }
967 
968 /*
969  * Translate section/page access permissions to page R/W protection flags.
970  * @ap:      The 2-bit simple AP (AP[2:1])
971  * @is_user: TRUE if accessing from PL0
972  */
simple_ap_to_rw_prot_is_user(int ap,bool is_user)973 static int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
974 {
975     switch (ap) {
976     case 0:
977         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
978     case 1:
979         return PAGE_READ | PAGE_WRITE;
980     case 2:
981         return is_user ? 0 : PAGE_READ;
982     case 3:
983         return PAGE_READ;
984     default:
985         g_assert_not_reached();
986     }
987 }
988 
simple_ap_to_rw_prot(CPUARMState * env,ARMMMUIdx mmu_idx,int ap)989 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
990 {
991     return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
992 }
993 
get_phys_addr_v5(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)994 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
995                              uint32_t address, MMUAccessType access_type,
996                              GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
997 {
998     int level = 1;
999     uint32_t table;
1000     uint32_t desc;
1001     int type;
1002     int ap;
1003     int domain = 0;
1004     int domain_prot;
1005     hwaddr phys_addr;
1006     uint32_t dacr;
1007 
1008     /* Pagetable walk.  */
1009     /* Lookup l1 descriptor.  */
1010     if (!get_level1_table_address(env, ptw->in_mmu_idx, &table, address)) {
1011         /* Section translation fault if page walk is disabled by PD0 or PD1 */
1012         fi->type = ARMFault_Translation;
1013         goto do_fault;
1014     }
1015     if (!S1_ptw_translate(env, ptw, table, fi)) {
1016         goto do_fault;
1017     }
1018     desc = arm_ldl_ptw(env, ptw, fi);
1019     if (fi->type != ARMFault_None) {
1020         goto do_fault;
1021     }
1022     type = (desc & 3);
1023     domain = (desc >> 5) & 0x0f;
1024     if (regime_el(env, ptw->in_mmu_idx) == 1) {
1025         dacr = env->cp15.dacr_ns;
1026     } else {
1027         dacr = env->cp15.dacr_s;
1028     }
1029     domain_prot = (dacr >> (domain * 2)) & 3;
1030     if (type == 0) {
1031         /* Section translation fault.  */
1032         fi->type = ARMFault_Translation;
1033         goto do_fault;
1034     }
1035     if (type != 2) {
1036         level = 2;
1037     }
1038     if (domain_prot == 0 || domain_prot == 2) {
1039         fi->type = ARMFault_Domain;
1040         goto do_fault;
1041     }
1042     if (type == 2) {
1043         /* 1Mb section.  */
1044         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1045         ap = (desc >> 10) & 3;
1046         result->f.lg_page_size = 20; /* 1MB */
1047     } else {
1048         /* Lookup l2 entry.  */
1049         if (type == 1) {
1050             /* Coarse pagetable.  */
1051             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1052         } else {
1053             /* Fine pagetable.  */
1054             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
1055         }
1056         if (!S1_ptw_translate(env, ptw, table, fi)) {
1057             goto do_fault;
1058         }
1059         desc = arm_ldl_ptw(env, ptw, fi);
1060         if (fi->type != ARMFault_None) {
1061             goto do_fault;
1062         }
1063         switch (desc & 3) {
1064         case 0: /* Page translation fault.  */
1065             fi->type = ARMFault_Translation;
1066             goto do_fault;
1067         case 1: /* 64k page.  */
1068             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1069             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
1070             result->f.lg_page_size = 16;
1071             break;
1072         case 2: /* 4k page.  */
1073             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1074             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
1075             result->f.lg_page_size = 12;
1076             break;
1077         case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
1078             if (type == 1) {
1079                 /* ARMv6/XScale extended small page format */
1080                 if (arm_feature(env, ARM_FEATURE_XSCALE)
1081                     || arm_feature(env, ARM_FEATURE_V6)) {
1082                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1083                     result->f.lg_page_size = 12;
1084                 } else {
1085                     /*
1086                      * UNPREDICTABLE in ARMv5; we choose to take a
1087                      * page translation fault.
1088                      */
1089                     fi->type = ARMFault_Translation;
1090                     goto do_fault;
1091                 }
1092             } else {
1093                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
1094                 result->f.lg_page_size = 10;
1095             }
1096             ap = (desc >> 4) & 3;
1097             break;
1098         default:
1099             /* Never happens, but compiler isn't smart enough to tell.  */
1100             g_assert_not_reached();
1101         }
1102     }
1103     result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot);
1104     result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
1105     if (!(result->f.prot & (1 << access_type))) {
1106         /* Access permission fault.  */
1107         fi->type = ARMFault_Permission;
1108         goto do_fault;
1109     }
1110     result->f.phys_addr = phys_addr;
1111     return false;
1112 do_fault:
1113     fi->domain = domain;
1114     fi->level = level;
1115     return true;
1116 }
1117 
get_phys_addr_v6(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)1118 static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
1119                              uint32_t address, MMUAccessType access_type,
1120                              GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
1121 {
1122     ARMCPU *cpu = env_archcpu(env);
1123     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
1124     int level = 1;
1125     uint32_t table;
1126     uint32_t desc;
1127     uint32_t xn;
1128     uint32_t pxn = 0;
1129     int type;
1130     int ap;
1131     int domain = 0;
1132     int domain_prot;
1133     hwaddr phys_addr;
1134     uint32_t dacr;
1135     bool ns;
1136     int user_prot;
1137 
1138     /* Pagetable walk.  */
1139     /* Lookup l1 descriptor.  */
1140     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
1141         /* Section translation fault if page walk is disabled by PD0 or PD1 */
1142         fi->type = ARMFault_Translation;
1143         goto do_fault;
1144     }
1145     if (!S1_ptw_translate(env, ptw, table, fi)) {
1146         goto do_fault;
1147     }
1148     desc = arm_ldl_ptw(env, ptw, fi);
1149     if (fi->type != ARMFault_None) {
1150         goto do_fault;
1151     }
1152     type = (desc & 3);
1153     if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
1154         /* Section translation fault, or attempt to use the encoding
1155          * which is Reserved on implementations without PXN.
1156          */
1157         fi->type = ARMFault_Translation;
1158         goto do_fault;
1159     }
1160     if ((type == 1) || !(desc & (1 << 18))) {
1161         /* Page or Section.  */
1162         domain = (desc >> 5) & 0x0f;
1163     }
1164     if (regime_el(env, mmu_idx) == 1) {
1165         dacr = env->cp15.dacr_ns;
1166     } else {
1167         dacr = env->cp15.dacr_s;
1168     }
1169     if (type == 1) {
1170         level = 2;
1171     }
1172     domain_prot = (dacr >> (domain * 2)) & 3;
1173     if (domain_prot == 0 || domain_prot == 2) {
1174         /* Section or Page domain fault */
1175         fi->type = ARMFault_Domain;
1176         goto do_fault;
1177     }
1178     if (type != 1) {
1179         if (desc & (1 << 18)) {
1180             /* Supersection.  */
1181             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
1182             phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
1183             phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
1184             result->f.lg_page_size = 24;  /* 16MB */
1185         } else {
1186             /* Section.  */
1187             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
1188             result->f.lg_page_size = 20;  /* 1MB */
1189         }
1190         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
1191         xn = desc & (1 << 4);
1192         pxn = desc & 1;
1193         ns = extract32(desc, 19, 1);
1194     } else {
1195         if (cpu_isar_feature(aa32_pxn, cpu)) {
1196             pxn = (desc >> 2) & 1;
1197         }
1198         ns = extract32(desc, 3, 1);
1199         /* Lookup l2 entry.  */
1200         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
1201         if (!S1_ptw_translate(env, ptw, table, fi)) {
1202             goto do_fault;
1203         }
1204         desc = arm_ldl_ptw(env, ptw, fi);
1205         if (fi->type != ARMFault_None) {
1206             goto do_fault;
1207         }
1208         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
1209         switch (desc & 3) {
1210         case 0: /* Page translation fault.  */
1211             fi->type = ARMFault_Translation;
1212             goto do_fault;
1213         case 1: /* 64k page.  */
1214             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
1215             xn = desc & (1 << 15);
1216             result->f.lg_page_size = 16;
1217             break;
1218         case 2: case 3: /* 4k page.  */
1219             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
1220             xn = desc & 1;
1221             result->f.lg_page_size = 12;
1222             break;
1223         default:
1224             /* Never happens, but compiler isn't smart enough to tell.  */
1225             g_assert_not_reached();
1226         }
1227     }
1228     if (domain_prot == 3) {
1229         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1230     } else {
1231         if (pxn && !regime_is_user(env, mmu_idx)) {
1232             xn = 1;
1233         }
1234         if (xn && access_type == MMU_INST_FETCH) {
1235             fi->type = ARMFault_Permission;
1236             goto do_fault;
1237         }
1238 
1239         if (arm_feature(env, ARM_FEATURE_V6K) &&
1240                 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
1241             /* The simplified model uses AP[0] as an access control bit.  */
1242             if ((ap & 1) == 0) {
1243                 /* Access flag fault.  */
1244                 fi->type = ARMFault_AccessFlag;
1245                 goto do_fault;
1246             }
1247             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
1248             user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1);
1249         } else {
1250             result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
1251             user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1);
1252         }
1253         if (result->f.prot && !xn) {
1254             result->f.prot |= PAGE_EXEC;
1255         }
1256         if (!(result->f.prot & (1 << access_type))) {
1257             /* Access permission fault.  */
1258             fi->type = ARMFault_Permission;
1259             goto do_fault;
1260         }
1261         if (regime_is_pan(env, mmu_idx) &&
1262             !regime_is_user(env, mmu_idx) &&
1263             user_prot &&
1264             access_type != MMU_INST_FETCH) {
1265             /* Privileged Access Never fault */
1266             fi->type = ARMFault_Permission;
1267             goto do_fault;
1268         }
1269     }
1270     if (ns) {
1271         /* The NS bit will (as required by the architecture) have no effect if
1272          * the CPU doesn't support TZ or this is a non-secure translation
1273          * regime, because the attribute will already be non-secure.
1274          */
1275         result->f.attrs.secure = false;
1276         result->f.attrs.space = ARMSS_NonSecure;
1277     }
1278     result->f.phys_addr = phys_addr;
1279     return false;
1280 do_fault:
1281     fi->domain = domain;
1282     fi->level = level;
1283     return true;
1284 }
1285 
1286 /*
1287  * Translate S2 section/page access permissions to protection flags
1288  * @env:     CPUARMState
1289  * @s2ap:    The 2-bit stage2 access permissions (S2AP)
1290  * @xn:      XN (execute-never) bits
1291  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
1292  */
get_S2prot_noexecute(int s2ap)1293 static int get_S2prot_noexecute(int s2ap)
1294 {
1295     int prot = 0;
1296 
1297     if (s2ap & 1) {
1298         prot |= PAGE_READ;
1299     }
1300     if (s2ap & 2) {
1301         prot |= PAGE_WRITE;
1302     }
1303     return prot;
1304 }
1305 
get_S2prot(CPUARMState * env,int s2ap,int xn,bool s1_is_el0)1306 static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
1307 {
1308     int prot = get_S2prot_noexecute(s2ap);
1309 
1310     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
1311         switch (xn) {
1312         case 0:
1313             prot |= PAGE_EXEC;
1314             break;
1315         case 1:
1316             if (s1_is_el0) {
1317                 prot |= PAGE_EXEC;
1318             }
1319             break;
1320         case 2:
1321             break;
1322         case 3:
1323             if (!s1_is_el0) {
1324                 prot |= PAGE_EXEC;
1325             }
1326             break;
1327         default:
1328             g_assert_not_reached();
1329         }
1330     } else {
1331         if (!extract32(xn, 1, 1)) {
1332             if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
1333                 prot |= PAGE_EXEC;
1334             }
1335         }
1336     }
1337     return prot;
1338 }
1339 
1340 /*
1341  * Translate section/page access permissions to protection flags
1342  * @env:     CPUARMState
1343  * @mmu_idx: MMU index indicating required translation regime
1344  * @is_aa64: TRUE if AArch64
1345  * @ap:      The 2-bit simple AP (AP[2:1])
1346  * @xn:      XN (execute-never) bit
1347  * @pxn:     PXN (privileged execute-never) bit
1348  * @in_pa:   The original input pa space
1349  * @out_pa:  The output pa space, modified by NSTable, NS, and NSE
1350  */
get_S1prot(CPUARMState * env,ARMMMUIdx mmu_idx,bool is_aa64,int ap,int xn,int pxn,ARMSecuritySpace in_pa,ARMSecuritySpace out_pa)1351 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
1352                       int ap, int xn, int pxn,
1353                       ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
1354 {
1355     ARMCPU *cpu = env_archcpu(env);
1356     bool is_user = regime_is_user(env, mmu_idx);
1357     int prot_rw, user_rw;
1358     bool have_wxn;
1359     int wxn = 0;
1360 
1361     assert(!regime_is_stage2(mmu_idx));
1362 
1363     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
1364     if (is_user) {
1365         prot_rw = user_rw;
1366     } else {
1367         /*
1368          * PAN controls can forbid data accesses but don't affect insn fetch.
1369          * Plain PAN forbids data accesses if EL0 has data permissions;
1370          * PAN3 forbids data accesses if EL0 has either data or exec perms.
1371          * Note that for AArch64 the 'user can exec' case is exactly !xn.
1372          * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0
1373          * do not affect EPAN.
1374          */
1375         if (user_rw && regime_is_pan(env, mmu_idx)) {
1376             prot_rw = 0;
1377         } else if (cpu_isar_feature(aa64_pan3, cpu) && is_aa64 &&
1378                    regime_is_pan(env, mmu_idx) &&
1379                    (regime_sctlr(env, mmu_idx) & SCTLR_EPAN) && !xn) {
1380             prot_rw = 0;
1381         } else {
1382             prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
1383         }
1384     }
1385 
1386     if (in_pa != out_pa) {
1387         switch (in_pa) {
1388         case ARMSS_Root:
1389             /*
1390              * R_ZWRVD: permission fault for insn fetched from non-Root,
1391              * I_WWBFB: SIF has no effect in EL3.
1392              */
1393             return prot_rw;
1394         case ARMSS_Realm:
1395             /*
1396              * R_PKTDS: permission fault for insn fetched from non-Realm,
1397              * for Realm EL2 or EL2&0.  The corresponding fault for EL1&0
1398              * happens during any stage2 translation.
1399              */
1400             switch (mmu_idx) {
1401             case ARMMMUIdx_E2:
1402             case ARMMMUIdx_E20_0:
1403             case ARMMMUIdx_E20_2:
1404             case ARMMMUIdx_E20_2_PAN:
1405                 return prot_rw;
1406             default:
1407                 break;
1408             }
1409             break;
1410         case ARMSS_Secure:
1411             if (env->cp15.scr_el3 & SCR_SIF) {
1412                 return prot_rw;
1413             }
1414             break;
1415         default:
1416             /* Input NonSecure must have output NonSecure. */
1417             g_assert_not_reached();
1418         }
1419     }
1420 
1421     /* TODO have_wxn should be replaced with
1422      *   ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
1423      * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
1424      * compatible processors have EL2, which is required for [U]WXN.
1425      */
1426     have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
1427 
1428     if (have_wxn) {
1429         wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
1430     }
1431 
1432     if (is_aa64) {
1433         if (regime_has_2_ranges(mmu_idx) && !is_user) {
1434             xn = pxn || (user_rw & PAGE_WRITE);
1435         }
1436     } else if (arm_feature(env, ARM_FEATURE_V7)) {
1437         switch (regime_el(env, mmu_idx)) {
1438         case 1:
1439         case 3:
1440             if (is_user) {
1441                 xn = xn || !(user_rw & PAGE_READ);
1442             } else {
1443                 int uwxn = 0;
1444                 if (have_wxn) {
1445                     uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
1446                 }
1447                 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
1448                      (uwxn && (user_rw & PAGE_WRITE));
1449             }
1450             break;
1451         case 2:
1452             break;
1453         }
1454     } else {
1455         xn = wxn = 0;
1456     }
1457 
1458     if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
1459         return prot_rw;
1460     }
1461     return prot_rw | PAGE_EXEC;
1462 }
1463 
aa32_va_parameters(CPUARMState * env,uint32_t va,ARMMMUIdx mmu_idx)1464 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
1465                                           ARMMMUIdx mmu_idx)
1466 {
1467     uint64_t tcr = regime_tcr(env, mmu_idx);
1468     uint32_t el = regime_el(env, mmu_idx);
1469     int select, tsz;
1470     bool epd, hpd;
1471 
1472     assert(mmu_idx != ARMMMUIdx_Stage2_S);
1473 
1474     if (mmu_idx == ARMMMUIdx_Stage2) {
1475         /* VTCR */
1476         bool sext = extract32(tcr, 4, 1);
1477         bool sign = extract32(tcr, 3, 1);
1478 
1479         /*
1480          * If the sign-extend bit is not the same as t0sz[3], the result
1481          * is unpredictable. Flag this as a guest error.
1482          */
1483         if (sign != sext) {
1484             qemu_log_mask(LOG_GUEST_ERROR,
1485                           "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
1486         }
1487         tsz = sextract32(tcr, 0, 4) + 8;
1488         select = 0;
1489         hpd = false;
1490         epd = false;
1491     } else if (el == 2) {
1492         /* HTCR */
1493         tsz = extract32(tcr, 0, 3);
1494         select = 0;
1495         hpd = extract64(tcr, 24, 1);
1496         epd = false;
1497     } else {
1498         int t0sz = extract32(tcr, 0, 3);
1499         int t1sz = extract32(tcr, 16, 3);
1500 
1501         if (t1sz == 0) {
1502             select = va > (0xffffffffu >> t0sz);
1503         } else {
1504             /* Note that we will detect errors later.  */
1505             select = va >= ~(0xffffffffu >> t1sz);
1506         }
1507         if (!select) {
1508             tsz = t0sz;
1509             epd = extract32(tcr, 7, 1);
1510             hpd = extract64(tcr, 41, 1);
1511         } else {
1512             tsz = t1sz;
1513             epd = extract32(tcr, 23, 1);
1514             hpd = extract64(tcr, 42, 1);
1515         }
1516         /* For aarch32, hpd0 is not enabled without t2e as well.  */
1517         hpd &= extract32(tcr, 6, 1);
1518     }
1519 
1520     return (ARMVAParameters) {
1521         .tsz = tsz,
1522         .select = select,
1523         .epd = epd,
1524         .hpd = hpd,
1525     };
1526 }
1527 
1528 /*
1529  * check_s2_mmu_setup
1530  * @cpu:        ARMCPU
1531  * @is_aa64:    True if the translation regime is in AArch64 state
1532  * @tcr:        VTCR_EL2 or VSTCR_EL2
1533  * @ds:         Effective value of TCR.DS.
1534  * @iasize:     Bitsize of IPAs
1535  * @stride:     Page-table stride (See the ARM ARM)
1536  *
1537  * Decode the starting level of the S2 lookup, returning INT_MIN if
1538  * the configuration is invalid.
1539  */
check_s2_mmu_setup(ARMCPU * cpu,bool is_aa64,uint64_t tcr,bool ds,int iasize,int stride)1540 static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
1541                               bool ds, int iasize, int stride)
1542 {
1543     int sl0, sl2, startlevel, granulebits, levels;
1544     int s1_min_iasize, s1_max_iasize;
1545 
1546     sl0 = extract32(tcr, 6, 2);
1547     if (is_aa64) {
1548         /*
1549          * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
1550          * so interleave AArch64.S2StartLevel.
1551          */
1552         switch (stride) {
1553         case 9: /* 4KB */
1554             /* SL2 is RES0 unless DS=1 & 4KB granule. */
1555             sl2 = extract64(tcr, 33, 1);
1556             if (ds && sl2) {
1557                 if (sl0 != 0) {
1558                     goto fail;
1559                 }
1560                 startlevel = -1;
1561             } else {
1562                 startlevel = 2 - sl0;
1563                 switch (sl0) {
1564                 case 2:
1565                     if (arm_pamax(cpu) < 44) {
1566                         goto fail;
1567                     }
1568                     break;
1569                 case 3:
1570                     if (!cpu_isar_feature(aa64_st, cpu)) {
1571                         goto fail;
1572                     }
1573                     startlevel = 3;
1574                     break;
1575                 }
1576             }
1577             break;
1578         case 11: /* 16KB */
1579             switch (sl0) {
1580             case 2:
1581                 if (arm_pamax(cpu) < 42) {
1582                     goto fail;
1583                 }
1584                 break;
1585             case 3:
1586                 if (!ds) {
1587                     goto fail;
1588                 }
1589                 break;
1590             }
1591             startlevel = 3 - sl0;
1592             break;
1593         case 13: /* 64KB */
1594             switch (sl0) {
1595             case 2:
1596                 if (arm_pamax(cpu) < 44) {
1597                     goto fail;
1598                 }
1599                 break;
1600             case 3:
1601                 goto fail;
1602             }
1603             startlevel = 3 - sl0;
1604             break;
1605         default:
1606             g_assert_not_reached();
1607         }
1608     } else {
1609         /*
1610          * Things are simpler for AArch32 EL2, with only 4k pages.
1611          * There is no separate S2InvalidSL function, but AArch32.S2Walk
1612          * begins with walkparms.sl0 in {'1x'}.
1613          */
1614         assert(stride == 9);
1615         if (sl0 >= 2) {
1616             goto fail;
1617         }
1618         startlevel = 2 - sl0;
1619     }
1620 
1621     /* AArch{64,32}.S2InconsistentSL are functionally equivalent.  */
1622     levels = 3 - startlevel;
1623     granulebits = stride + 3;
1624 
1625     s1_min_iasize = levels * stride + granulebits + 1;
1626     s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
1627 
1628     if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
1629         return startlevel;
1630     }
1631 
1632  fail:
1633     return INT_MIN;
1634 }
1635 
lpae_block_desc_valid(ARMCPU * cpu,bool ds,ARMGranuleSize gran,int level)1636 static bool lpae_block_desc_valid(ARMCPU *cpu, bool ds,
1637                                   ARMGranuleSize gran, int level)
1638 {
1639     /*
1640      * See pseudocode AArch46.BlockDescSupported(): block descriptors
1641      * are not valid at all levels, depending on the page size.
1642      */
1643     switch (gran) {
1644     case Gran4K:
1645         return (level == 0 && ds) || level == 1 || level == 2;
1646     case Gran16K:
1647         return (level == 1 && ds) || level == 2;
1648     case Gran64K:
1649         return (level == 1 && arm_pamax(cpu) == 52) || level == 2;
1650     default:
1651         g_assert_not_reached();
1652     }
1653 }
1654 
nv_nv1_enabled(CPUARMState * env,S1Translate * ptw)1655 static bool nv_nv1_enabled(CPUARMState *env, S1Translate *ptw)
1656 {
1657     uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
1658     return (hcr & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1);
1659 }
1660 
1661 /**
1662  * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
1663  *
1664  * Returns false if the translation was successful. Otherwise, phys_ptr,
1665  * attrs, prot and page_size may not be filled in, and the populated fsr
1666  * value provides information on why the translation aborted, in the format
1667  * of a long-format DFSR/IFSR fault register, with the following caveat:
1668  * the WnR bit is never set (the caller must do this).
1669  *
1670  * @env: CPUARMState
1671  * @ptw: Current and next stage parameters for the walk.
1672  * @address: virtual address to get physical address for
1673  * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
1674  * @result: set on translation success,
1675  * @fi: set to fault info if the translation fails
1676  */
get_phys_addr_lpae(CPUARMState * env,S1Translate * ptw,uint64_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)1677 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
1678                                uint64_t address,
1679                                MMUAccessType access_type,
1680                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
1681 {
1682     ARMCPU *cpu = env_archcpu(env);
1683     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
1684     int32_t level;
1685     ARMVAParameters param;
1686     uint64_t ttbr;
1687     hwaddr descaddr, indexmask, indexmask_grainsize;
1688     uint32_t tableattrs;
1689     target_ulong page_size;
1690     uint64_t attrs;
1691     int32_t stride;
1692     int addrsize, inputsize, outputsize;
1693     uint64_t tcr = regime_tcr(env, mmu_idx);
1694     int ap, xn, pxn;
1695     uint32_t el = regime_el(env, mmu_idx);
1696     uint64_t descaddrmask;
1697     bool aarch64 = arm_el_is_aa64(env, el);
1698     uint64_t descriptor, new_descriptor;
1699     ARMSecuritySpace out_space;
1700     bool device;
1701 
1702     /* TODO: This code does not support shareability levels. */
1703     if (aarch64) {
1704         int ps;
1705 
1706         param = aa64_va_parameters(env, address, mmu_idx,
1707                                    access_type != MMU_INST_FETCH,
1708                                    !arm_el_is_aa64(env, 1));
1709         level = 0;
1710 
1711         /*
1712          * If TxSZ is programmed to a value larger than the maximum,
1713          * or smaller than the effective minimum, it is IMPLEMENTATION
1714          * DEFINED whether we behave as if the field were programmed
1715          * within bounds, or if a level 0 Translation fault is generated.
1716          *
1717          * With FEAT_LVA, fault on less than minimum becomes required,
1718          * so our choice is to always raise the fault.
1719          */
1720         if (param.tsz_oob) {
1721             goto do_translation_fault;
1722         }
1723 
1724         addrsize = 64 - 8 * param.tbi;
1725         inputsize = 64 - param.tsz;
1726 
1727         /*
1728          * Bound PS by PARANGE to find the effective output address size.
1729          * ID_AA64MMFR0 is a read-only register so values outside of the
1730          * supported mappings can be considered an implementation error.
1731          */
1732         ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
1733         ps = MIN(ps, param.ps);
1734         assert(ps < ARRAY_SIZE(pamax_map));
1735         outputsize = pamax_map[ps];
1736 
1737         /*
1738          * With LPA2, the effective output address (OA) size is at most 48 bits
1739          * unless TCR.DS == 1
1740          */
1741         if (!param.ds && param.gran != Gran64K) {
1742             outputsize = MIN(outputsize, 48);
1743         }
1744     } else {
1745         param = aa32_va_parameters(env, address, mmu_idx);
1746         level = 1;
1747         addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32);
1748         inputsize = addrsize - param.tsz;
1749         outputsize = 40;
1750     }
1751 
1752     /*
1753      * We determined the region when collecting the parameters, but we
1754      * have not yet validated that the address is valid for the region.
1755      * Extract the top bits and verify that they all match select.
1756      *
1757      * For aa32, if inputsize == addrsize, then we have selected the
1758      * region by exclusion in aa32_va_parameters and there is no more
1759      * validation to do here.
1760      */
1761     if (inputsize < addrsize) {
1762         target_ulong top_bits = sextract64(address, inputsize,
1763                                            addrsize - inputsize);
1764         if (-top_bits != param.select) {
1765             /* The gap between the two regions is a Translation fault */
1766             goto do_translation_fault;
1767         }
1768     }
1769 
1770     stride = arm_granule_bits(param.gran) - 3;
1771 
1772     /*
1773      * Note that QEMU ignores shareability and cacheability attributes,
1774      * so we don't need to do anything with the SH, ORGN, IRGN fields
1775      * in the TTBCR.  Similarly, TTBCR:A1 selects whether we get the
1776      * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
1777      * implement any ASID-like capability so we can ignore it (instead
1778      * we will always flush the TLB any time the ASID is changed).
1779      */
1780     ttbr = regime_ttbr(env, mmu_idx, param.select);
1781 
1782     /*
1783      * Here we should have set up all the parameters for the translation:
1784      * inputsize, ttbr, epd, stride, tbi
1785      */
1786 
1787     if (param.epd) {
1788         /*
1789          * Translation table walk disabled => Translation fault on TLB miss
1790          * Note: This is always 0 on 64-bit EL2 and EL3.
1791          */
1792         goto do_translation_fault;
1793     }
1794 
1795     if (!regime_is_stage2(mmu_idx)) {
1796         /*
1797          * The starting level depends on the virtual address size (which can
1798          * be up to 48 bits) and the translation granule size. It indicates
1799          * the number of strides (stride bits at a time) needed to
1800          * consume the bits of the input address. In the pseudocode this is:
1801          *  level = 4 - RoundUp((inputsize - grainsize) / stride)
1802          * where their 'inputsize' is our 'inputsize', 'grainsize' is
1803          * our 'stride + 3' and 'stride' is our 'stride'.
1804          * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
1805          * = 4 - (inputsize - stride - 3 + stride - 1) / stride
1806          * = 4 - (inputsize - 4) / stride;
1807          */
1808         level = 4 - (inputsize - 4) / stride;
1809     } else {
1810         int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
1811                                             inputsize, stride);
1812         if (startlevel == INT_MIN) {
1813             level = 0;
1814             goto do_translation_fault;
1815         }
1816         level = startlevel;
1817     }
1818 
1819     indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3);
1820     indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level)));
1821 
1822     /* Now we can extract the actual base address from the TTBR */
1823     descaddr = extract64(ttbr, 0, 48);
1824 
1825     /*
1826      * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
1827      *
1828      * Otherwise, if the base address is out of range, raise AddressSizeFault.
1829      * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
1830      * but we've just cleared the bits above 47, so simplify the test.
1831      */
1832     if (outputsize > 48) {
1833         descaddr |= extract64(ttbr, 2, 4) << 48;
1834     } else if (descaddr >> outputsize) {
1835         level = 0;
1836         fi->type = ARMFault_AddressSize;
1837         goto do_fault;
1838     }
1839 
1840     /*
1841      * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
1842      * and also to mask out CnP (bit 0) which could validly be non-zero.
1843      */
1844     descaddr &= ~indexmask;
1845 
1846     /*
1847      * For AArch32, the address field in the descriptor goes up to bit 39
1848      * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
1849      * or an AddressSize fault is raised.  So for v8 we extract those SBZ
1850      * bits as part of the address, which will be checked via outputsize.
1851      * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
1852      * the highest bits of a 52-bit output are placed elsewhere.
1853      */
1854     if (param.ds) {
1855         descaddrmask = MAKE_64BIT_MASK(0, 50);
1856     } else if (arm_feature(env, ARM_FEATURE_V8)) {
1857         descaddrmask = MAKE_64BIT_MASK(0, 48);
1858     } else {
1859         descaddrmask = MAKE_64BIT_MASK(0, 40);
1860     }
1861     descaddrmask &= ~indexmask_grainsize;
1862     tableattrs = 0;
1863 
1864  next_level:
1865     descaddr |= (address >> (stride * (4 - level))) & indexmask;
1866     descaddr &= ~7ULL;
1867 
1868     /*
1869      * Process the NSTable bit from the previous level.  This changes
1870      * the table address space and the output space from Secure to
1871      * NonSecure.  With RME, the EL3 translation regime does not change
1872      * from Root to NonSecure.
1873      */
1874     if (ptw->in_space == ARMSS_Secure
1875         && !regime_is_stage2(mmu_idx)
1876         && extract32(tableattrs, 4, 1)) {
1877         /*
1878          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
1879          * Assert the relative order of the secure/non-secure indexes.
1880          */
1881         QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
1882         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
1883         ptw->in_ptw_idx += 1;
1884         ptw->in_space = ARMSS_NonSecure;
1885     }
1886 
1887     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
1888         goto do_fault;
1889     }
1890     descriptor = arm_ldq_ptw(env, ptw, fi);
1891     if (fi->type != ARMFault_None) {
1892         goto do_fault;
1893     }
1894     new_descriptor = descriptor;
1895 
1896  restart_atomic_update:
1897     if (!(descriptor & 1) ||
1898         (!(descriptor & 2) &&
1899          !lpae_block_desc_valid(cpu, param.ds, param.gran, level))) {
1900         /* Invalid, or a block descriptor at an invalid level */
1901         goto do_translation_fault;
1902     }
1903 
1904     descaddr = descriptor & descaddrmask;
1905 
1906     /*
1907      * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
1908      * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
1909      * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
1910      * raise AddressSizeFault.
1911      */
1912     if (outputsize > 48) {
1913         if (param.ds) {
1914             descaddr |= extract64(descriptor, 8, 2) << 50;
1915         } else {
1916             descaddr |= extract64(descriptor, 12, 4) << 48;
1917         }
1918     } else if (descaddr >> outputsize) {
1919         fi->type = ARMFault_AddressSize;
1920         goto do_fault;
1921     }
1922 
1923     if ((descriptor & 2) && (level < 3)) {
1924         /*
1925          * Table entry. The top five bits are attributes which may
1926          * propagate down through lower levels of the table (and
1927          * which are all arranged so that 0 means "no effect", so
1928          * we can gather them up by ORing in the bits at each level).
1929          */
1930         tableattrs |= extract64(descriptor, 59, 5);
1931         level++;
1932         indexmask = indexmask_grainsize;
1933         goto next_level;
1934     }
1935 
1936     /*
1937      * Block entry at level 1 or 2, or page entry at level 3.
1938      * These are basically the same thing, although the number
1939      * of bits we pull in from the vaddr varies. Note that although
1940      * descaddrmask masks enough of the low bits of the descriptor
1941      * to give a correct page or table address, the address field
1942      * in a block descriptor is smaller; so we need to explicitly
1943      * clear the lower bits here before ORing in the low vaddr bits.
1944      *
1945      * Afterward, descaddr is the final physical address.
1946      */
1947     page_size = (1ULL << ((stride * (4 - level)) + 3));
1948     descaddr &= ~(hwaddr)(page_size - 1);
1949     descaddr |= (address & (page_size - 1));
1950 
1951     if (likely(!ptw->in_debug)) {
1952         /*
1953          * Access flag.
1954          * If HA is enabled, prepare to update the descriptor below.
1955          * Otherwise, pass the access fault on to software.
1956          */
1957         if (!(descriptor & (1 << 10))) {
1958             if (param.ha) {
1959                 new_descriptor |= 1 << 10; /* AF */
1960             } else {
1961                 fi->type = ARMFault_AccessFlag;
1962                 goto do_fault;
1963             }
1964         }
1965 
1966         /*
1967          * Dirty Bit.
1968          * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
1969          * bit for writeback. The actual write protection test may still be
1970          * overridden by tableattrs, to be merged below.
1971          */
1972         if (param.hd
1973             && extract64(descriptor, 51, 1)  /* DBM */
1974             && access_type == MMU_DATA_STORE) {
1975             if (regime_is_stage2(mmu_idx)) {
1976                 new_descriptor |= 1ull << 7;    /* set S2AP[1] */
1977             } else {
1978                 new_descriptor &= ~(1ull << 7); /* clear AP[2] */
1979             }
1980         }
1981     }
1982 
1983     /*
1984      * Extract attributes from the (modified) descriptor, and apply
1985      * table descriptors. Stage 2 table descriptors do not include
1986      * any attribute fields. HPD disables all the table attributes
1987      * except NSTable (which we have already handled).
1988      */
1989     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
1990     if (!regime_is_stage2(mmu_idx)) {
1991         if (!param.hpd) {
1992             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
1993             /*
1994              * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
1995              * means "force PL1 access only", which means forcing AP[1] to 0.
1996              */
1997             attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
1998             attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
1999         }
2000     }
2001 
2002     ap = extract32(attrs, 6, 2);
2003     out_space = ptw->in_space;
2004     if (regime_is_stage2(mmu_idx)) {
2005         /*
2006          * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
2007          * The bit remains ignored for other security states.
2008          * R_YMCSL: Executing an insn fetched from non-Realm causes
2009          * a stage2 permission fault.
2010          */
2011         if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
2012             out_space = ARMSS_NonSecure;
2013             result->f.prot = get_S2prot_noexecute(ap);
2014         } else {
2015             xn = extract64(attrs, 53, 2);
2016             result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
2017         }
2018     } else {
2019         int nse, ns = extract32(attrs, 5, 1);
2020         switch (out_space) {
2021         case ARMSS_Root:
2022             /*
2023              * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
2024              * R_XTYPW: NSE and NS together select the output pa space.
2025              */
2026             nse = extract32(attrs, 11, 1);
2027             out_space = (nse << 1) | ns;
2028             if (out_space == ARMSS_Secure &&
2029                 !cpu_isar_feature(aa64_sel2, cpu)) {
2030                 out_space = ARMSS_NonSecure;
2031             }
2032             break;
2033         case ARMSS_Secure:
2034             if (ns) {
2035                 out_space = ARMSS_NonSecure;
2036             }
2037             break;
2038         case ARMSS_Realm:
2039             switch (mmu_idx) {
2040             case ARMMMUIdx_Stage1_E0:
2041             case ARMMMUIdx_Stage1_E1:
2042             case ARMMMUIdx_Stage1_E1_PAN:
2043                 /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
2044                 break;
2045             case ARMMMUIdx_E2:
2046             case ARMMMUIdx_E20_0:
2047             case ARMMMUIdx_E20_2:
2048             case ARMMMUIdx_E20_2_PAN:
2049                 /*
2050                  * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
2051                  * NS changes the output to non-secure space.
2052                  */
2053                 if (ns) {
2054                     out_space = ARMSS_NonSecure;
2055                 }
2056                 break;
2057             default:
2058                 g_assert_not_reached();
2059             }
2060             break;
2061         case ARMSS_NonSecure:
2062             /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
2063             break;
2064         default:
2065             g_assert_not_reached();
2066         }
2067         xn = extract64(attrs, 54, 1);
2068         pxn = extract64(attrs, 53, 1);
2069 
2070         if (el == 1 && nv_nv1_enabled(env, ptw)) {
2071             /*
2072              * With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1}, the block/page
2073              * descriptor bit 54 holds PXN, 53 is RES0, and the effective value
2074              * of UXN is 0. Similarly for bits 59 and 60 in table descriptors
2075              * (which we have already folded into bits 53 and 54 of attrs).
2076              * AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
2077              * Similarly, APTable[0] from the table descriptor is treated as 0;
2078              * we already folded this into AP[1] and squashing that to 0 does
2079              * the right thing.
2080              */
2081             pxn = xn;
2082             xn = 0;
2083             ap &= ~1;
2084         }
2085         /*
2086          * Note that we modified ptw->in_space earlier for NSTable, but
2087          * result->f.attrs retains a copy of the original security space.
2088          */
2089         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, xn, pxn,
2090                                     result->f.attrs.space, out_space);
2091     }
2092 
2093     if (!(result->f.prot & (1 << access_type))) {
2094         fi->type = ARMFault_Permission;
2095         goto do_fault;
2096     }
2097 
2098     /* If FEAT_HAFDBS has made changes, update the PTE. */
2099     if (new_descriptor != descriptor) {
2100         new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
2101         if (fi->type != ARMFault_None) {
2102             goto do_fault;
2103         }
2104         /*
2105          * I_YZSVV says that if the in-memory descriptor has changed,
2106          * then we must use the information in that new value
2107          * (which might include a different output address, different
2108          * attributes, or generate a fault).
2109          * Restart the handling of the descriptor value from scratch.
2110          */
2111         if (new_descriptor != descriptor) {
2112             descriptor = new_descriptor;
2113             goto restart_atomic_update;
2114         }
2115     }
2116 
2117     result->f.attrs.space = out_space;
2118     result->f.attrs.secure = arm_space_is_secure(out_space);
2119 
2120     if (regime_is_stage2(mmu_idx)) {
2121         result->cacheattrs.is_s2_format = true;
2122         result->cacheattrs.attrs = extract32(attrs, 2, 4);
2123         /*
2124          * Security state does not really affect HCR_EL2.FWB;
2125          * we only need to filter FWB for aa32 or other FEAT.
2126          */
2127         device = S2_attrs_are_device(arm_hcr_el2_eff(env),
2128                                      result->cacheattrs.attrs);
2129     } else {
2130         /* Index into MAIR registers for cache attributes */
2131         uint8_t attrindx = extract32(attrs, 2, 3);
2132         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
2133         assert(attrindx <= 7);
2134         result->cacheattrs.is_s2_format = false;
2135         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
2136 
2137         /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
2138         if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
2139             result->f.extra.arm.guarded = extract64(attrs, 50, 1); /* GP */
2140         }
2141         device = S1_attrs_are_device(result->cacheattrs.attrs);
2142     }
2143 
2144     /*
2145      * Enable alignment checks on Device memory.
2146      *
2147      * Per R_XCHFJ, this check is mis-ordered. The correct ordering
2148      * for alignment, permission, and stage 2 faults should be:
2149      *    - Alignment fault caused by the memory type
2150      *    - Permission fault
2151      *    - A stage 2 fault on the memory access
2152      * but due to the way the TCG softmmu TLB operates, we will have
2153      * implicitly done the permission check and the stage2 lookup in
2154      * finding the TLB entry, so the alignment check cannot be done sooner.
2155      *
2156      * In v7, for a CPU without the Virtualization Extensions this
2157      * access is UNPREDICTABLE; we choose to make it take the alignment
2158      * fault as is required for a v7VE CPU. (QEMU doesn't emulate any
2159      * CPUs with ARM_FEATURE_LPAE but not ARM_FEATURE_V7VE anyway.)
2160      */
2161     if (device) {
2162         result->f.tlb_fill_flags |= TLB_CHECK_ALIGNED;
2163     }
2164 
2165     /*
2166      * For FEAT_LPA2 and effective DS, the SH field in the attributes
2167      * was re-purposed for output address bits.  The SH attribute in
2168      * that case comes from TCR_ELx, which we extracted earlier.
2169      */
2170     if (param.ds) {
2171         result->cacheattrs.shareability = param.sh;
2172     } else {
2173         result->cacheattrs.shareability = extract32(attrs, 8, 2);
2174     }
2175 
2176     result->f.phys_addr = descaddr;
2177     result->f.lg_page_size = ctz64(page_size);
2178     return false;
2179 
2180  do_translation_fault:
2181     fi->type = ARMFault_Translation;
2182  do_fault:
2183     if (fi->s1ptw) {
2184         /* Retain the existing stage 2 fi->level */
2185         assert(fi->stage2);
2186     } else {
2187         fi->level = level;
2188         fi->stage2 = regime_is_stage2(mmu_idx);
2189     }
2190     fi->s1ns = fault_s1ns(ptw->in_space, mmu_idx);
2191     return true;
2192 }
2193 
get_phys_addr_pmsav5(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)2194 static bool get_phys_addr_pmsav5(CPUARMState *env,
2195                                  S1Translate *ptw,
2196                                  uint32_t address,
2197                                  MMUAccessType access_type,
2198                                  GetPhysAddrResult *result,
2199                                  ARMMMUFaultInfo *fi)
2200 {
2201     int n;
2202     uint32_t mask;
2203     uint32_t base;
2204     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2205     bool is_user = regime_is_user(env, mmu_idx);
2206 
2207     if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
2208         /* MPU disabled.  */
2209         result->f.phys_addr = address;
2210         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
2211         return false;
2212     }
2213 
2214     result->f.phys_addr = address;
2215     for (n = 7; n >= 0; n--) {
2216         base = env->cp15.c6_region[n];
2217         if ((base & 1) == 0) {
2218             continue;
2219         }
2220         mask = 1 << ((base >> 1) & 0x1f);
2221         /* Keep this shift separate from the above to avoid an
2222            (undefined) << 32.  */
2223         mask = (mask << 1) - 1;
2224         if (((base ^ address) & ~mask) == 0) {
2225             break;
2226         }
2227     }
2228     if (n < 0) {
2229         fi->type = ARMFault_Background;
2230         return true;
2231     }
2232 
2233     if (access_type == MMU_INST_FETCH) {
2234         mask = env->cp15.pmsav5_insn_ap;
2235     } else {
2236         mask = env->cp15.pmsav5_data_ap;
2237     }
2238     mask = (mask >> (n * 4)) & 0xf;
2239     switch (mask) {
2240     case 0:
2241         fi->type = ARMFault_Permission;
2242         fi->level = 1;
2243         return true;
2244     case 1:
2245         if (is_user) {
2246             fi->type = ARMFault_Permission;
2247             fi->level = 1;
2248             return true;
2249         }
2250         result->f.prot = PAGE_READ | PAGE_WRITE;
2251         break;
2252     case 2:
2253         result->f.prot = PAGE_READ;
2254         if (!is_user) {
2255             result->f.prot |= PAGE_WRITE;
2256         }
2257         break;
2258     case 3:
2259         result->f.prot = PAGE_READ | PAGE_WRITE;
2260         break;
2261     case 5:
2262         if (is_user) {
2263             fi->type = ARMFault_Permission;
2264             fi->level = 1;
2265             return true;
2266         }
2267         result->f.prot = PAGE_READ;
2268         break;
2269     case 6:
2270         result->f.prot = PAGE_READ;
2271         break;
2272     default:
2273         /* Bad permission.  */
2274         fi->type = ARMFault_Permission;
2275         fi->level = 1;
2276         return true;
2277     }
2278     result->f.prot |= PAGE_EXEC;
2279     return false;
2280 }
2281 
get_phys_addr_pmsav7_default(CPUARMState * env,ARMMMUIdx mmu_idx,int32_t address,uint8_t * prot)2282 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx,
2283                                          int32_t address, uint8_t *prot)
2284 {
2285     if (!arm_feature(env, ARM_FEATURE_M)) {
2286         *prot = PAGE_READ | PAGE_WRITE;
2287         switch (address) {
2288         case 0xF0000000 ... 0xFFFFFFFF:
2289             if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
2290                 /* hivecs execing is ok */
2291                 *prot |= PAGE_EXEC;
2292             }
2293             break;
2294         case 0x00000000 ... 0x7FFFFFFF:
2295             *prot |= PAGE_EXEC;
2296             break;
2297         }
2298     } else {
2299         /* Default system address map for M profile cores.
2300          * The architecture specifies which regions are execute-never;
2301          * at the MPU level no other checks are defined.
2302          */
2303         switch (address) {
2304         case 0x00000000 ... 0x1fffffff: /* ROM */
2305         case 0x20000000 ... 0x3fffffff: /* SRAM */
2306         case 0x60000000 ... 0x7fffffff: /* RAM */
2307         case 0x80000000 ... 0x9fffffff: /* RAM */
2308             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
2309             break;
2310         case 0x40000000 ... 0x5fffffff: /* Peripheral */
2311         case 0xa0000000 ... 0xbfffffff: /* Device */
2312         case 0xc0000000 ... 0xdfffffff: /* Device */
2313         case 0xe0000000 ... 0xffffffff: /* System */
2314             *prot = PAGE_READ | PAGE_WRITE;
2315             break;
2316         default:
2317             g_assert_not_reached();
2318         }
2319     }
2320 }
2321 
m_is_ppb_region(CPUARMState * env,uint32_t address)2322 static bool m_is_ppb_region(CPUARMState *env, uint32_t address)
2323 {
2324     /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
2325     return arm_feature(env, ARM_FEATURE_M) &&
2326         extract32(address, 20, 12) == 0xe00;
2327 }
2328 
m_is_system_region(CPUARMState * env,uint32_t address)2329 static bool m_is_system_region(CPUARMState *env, uint32_t address)
2330 {
2331     /*
2332      * True if address is in the M profile system region
2333      * 0xe0000000 - 0xffffffff
2334      */
2335     return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
2336 }
2337 
pmsav7_use_background_region(ARMCPU * cpu,ARMMMUIdx mmu_idx,bool is_secure,bool is_user)2338 static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx,
2339                                          bool is_secure, bool is_user)
2340 {
2341     /*
2342      * Return true if we should use the default memory map as a
2343      * "background" region if there are no hits against any MPU regions.
2344      */
2345     CPUARMState *env = &cpu->env;
2346 
2347     if (is_user) {
2348         return false;
2349     }
2350 
2351     if (arm_feature(env, ARM_FEATURE_M)) {
2352         return env->v7m.mpu_ctrl[is_secure] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
2353     }
2354 
2355     if (mmu_idx == ARMMMUIdx_Stage2) {
2356         return false;
2357     }
2358 
2359     return regime_sctlr(env, mmu_idx) & SCTLR_BR;
2360 }
2361 
get_phys_addr_pmsav7(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)2362 static bool get_phys_addr_pmsav7(CPUARMState *env,
2363                                  S1Translate *ptw,
2364                                  uint32_t address,
2365                                  MMUAccessType access_type,
2366                                  GetPhysAddrResult *result,
2367                                  ARMMMUFaultInfo *fi)
2368 {
2369     ARMCPU *cpu = env_archcpu(env);
2370     int n;
2371     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2372     bool is_user = regime_is_user(env, mmu_idx);
2373     bool secure = arm_space_is_secure(ptw->in_space);
2374 
2375     result->f.phys_addr = address;
2376     result->f.lg_page_size = TARGET_PAGE_BITS;
2377     result->f.prot = 0;
2378 
2379     if (regime_translation_disabled(env, mmu_idx, ptw->in_space) ||
2380         m_is_ppb_region(env, address)) {
2381         /*
2382          * MPU disabled or M profile PPB access: use default memory map.
2383          * The other case which uses the default memory map in the
2384          * v7M ARM ARM pseudocode is exception vector reads from the vector
2385          * table. In QEMU those accesses are done in arm_v7m_load_vector(),
2386          * which always does a direct read using address_space_ldl(), rather
2387          * than going via this function, so we don't need to check that here.
2388          */
2389         get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
2390     } else { /* MPU enabled */
2391         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
2392             /* region search */
2393             uint32_t base = env->pmsav7.drbar[n];
2394             uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
2395             uint32_t rmask;
2396             bool srdis = false;
2397 
2398             if (!(env->pmsav7.drsr[n] & 0x1)) {
2399                 continue;
2400             }
2401 
2402             if (!rsize) {
2403                 qemu_log_mask(LOG_GUEST_ERROR,
2404                               "DRSR[%d]: Rsize field cannot be 0\n", n);
2405                 continue;
2406             }
2407             rsize++;
2408             rmask = (1ull << rsize) - 1;
2409 
2410             if (base & rmask) {
2411                 qemu_log_mask(LOG_GUEST_ERROR,
2412                               "DRBAR[%d]: 0x%" PRIx32 " misaligned "
2413                               "to DRSR region size, mask = 0x%" PRIx32 "\n",
2414                               n, base, rmask);
2415                 continue;
2416             }
2417 
2418             if (address < base || address > base + rmask) {
2419                 /*
2420                  * Address not in this region. We must check whether the
2421                  * region covers addresses in the same page as our address.
2422                  * In that case we must not report a size that covers the
2423                  * whole page for a subsequent hit against a different MPU
2424                  * region or the background region, because it would result in
2425                  * incorrect TLB hits for subsequent accesses to addresses that
2426                  * are in this MPU region.
2427                  */
2428                 if (ranges_overlap(base, rmask,
2429                                    address & TARGET_PAGE_MASK,
2430                                    TARGET_PAGE_SIZE)) {
2431                     result->f.lg_page_size = 0;
2432                 }
2433                 continue;
2434             }
2435 
2436             /* Region matched */
2437 
2438             if (rsize >= 8) { /* no subregions for regions < 256 bytes */
2439                 int i, snd;
2440                 uint32_t srdis_mask;
2441 
2442                 rsize -= 3; /* sub region size (power of 2) */
2443                 snd = ((address - base) >> rsize) & 0x7;
2444                 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
2445 
2446                 srdis_mask = srdis ? 0x3 : 0x0;
2447                 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
2448                     /*
2449                      * This will check in groups of 2, 4 and then 8, whether
2450                      * the subregion bits are consistent. rsize is incremented
2451                      * back up to give the region size, considering consistent
2452                      * adjacent subregions as one region. Stop testing if rsize
2453                      * is already big enough for an entire QEMU page.
2454                      */
2455                     int snd_rounded = snd & ~(i - 1);
2456                     uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
2457                                                      snd_rounded + 8, i);
2458                     if (srdis_mask ^ srdis_multi) {
2459                         break;
2460                     }
2461                     srdis_mask = (srdis_mask << i) | srdis_mask;
2462                     rsize++;
2463                 }
2464             }
2465             if (srdis) {
2466                 continue;
2467             }
2468             if (rsize < TARGET_PAGE_BITS) {
2469                 result->f.lg_page_size = rsize;
2470             }
2471             break;
2472         }
2473 
2474         if (n == -1) { /* no hits */
2475             if (!pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
2476                 /* background fault */
2477                 fi->type = ARMFault_Background;
2478                 return true;
2479             }
2480             get_phys_addr_pmsav7_default(env, mmu_idx, address,
2481                                          &result->f.prot);
2482         } else { /* a MPU hit! */
2483             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
2484             uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
2485 
2486             if (m_is_system_region(env, address)) {
2487                 /* System space is always execute never */
2488                 xn = 1;
2489             }
2490 
2491             if (is_user) { /* User mode AP bit decoding */
2492                 switch (ap) {
2493                 case 0:
2494                 case 1:
2495                 case 5:
2496                     break; /* no access */
2497                 case 3:
2498                     result->f.prot |= PAGE_WRITE;
2499                     /* fall through */
2500                 case 2:
2501                 case 6:
2502                     result->f.prot |= PAGE_READ | PAGE_EXEC;
2503                     break;
2504                 case 7:
2505                     /* for v7M, same as 6; for R profile a reserved value */
2506                     if (arm_feature(env, ARM_FEATURE_M)) {
2507                         result->f.prot |= PAGE_READ | PAGE_EXEC;
2508                         break;
2509                     }
2510                     /* fall through */
2511                 default:
2512                     qemu_log_mask(LOG_GUEST_ERROR,
2513                                   "DRACR[%d]: Bad value for AP bits: 0x%"
2514                                   PRIx32 "\n", n, ap);
2515                 }
2516             } else { /* Priv. mode AP bits decoding */
2517                 switch (ap) {
2518                 case 0:
2519                     break; /* no access */
2520                 case 1:
2521                 case 2:
2522                 case 3:
2523                     result->f.prot |= PAGE_WRITE;
2524                     /* fall through */
2525                 case 5:
2526                 case 6:
2527                     result->f.prot |= PAGE_READ | PAGE_EXEC;
2528                     break;
2529                 case 7:
2530                     /* for v7M, same as 6; for R profile a reserved value */
2531                     if (arm_feature(env, ARM_FEATURE_M)) {
2532                         result->f.prot |= PAGE_READ | PAGE_EXEC;
2533                         break;
2534                     }
2535                     /* fall through */
2536                 default:
2537                     qemu_log_mask(LOG_GUEST_ERROR,
2538                                   "DRACR[%d]: Bad value for AP bits: 0x%"
2539                                   PRIx32 "\n", n, ap);
2540                 }
2541             }
2542 
2543             /* execute never */
2544             if (xn) {
2545                 result->f.prot &= ~PAGE_EXEC;
2546             }
2547         }
2548     }
2549 
2550     fi->type = ARMFault_Permission;
2551     fi->level = 1;
2552     return !(result->f.prot & (1 << access_type));
2553 }
2554 
regime_rbar(CPUARMState * env,ARMMMUIdx mmu_idx,uint32_t secure)2555 static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx,
2556                              uint32_t secure)
2557 {
2558     if (regime_el(env, mmu_idx) == 2) {
2559         return env->pmsav8.hprbar;
2560     } else {
2561         return env->pmsav8.rbar[secure];
2562     }
2563 }
2564 
regime_rlar(CPUARMState * env,ARMMMUIdx mmu_idx,uint32_t secure)2565 static uint32_t *regime_rlar(CPUARMState *env, ARMMMUIdx mmu_idx,
2566                              uint32_t secure)
2567 {
2568     if (regime_el(env, mmu_idx) == 2) {
2569         return env->pmsav8.hprlar;
2570     } else {
2571         return env->pmsav8.rlar[secure];
2572     }
2573 }
2574 
pmsav8_mpu_lookup(CPUARMState * env,uint32_t address,MMUAccessType access_type,ARMMMUIdx mmu_idx,bool secure,GetPhysAddrResult * result,ARMMMUFaultInfo * fi,uint32_t * mregion)2575 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
2576                        MMUAccessType access_type, ARMMMUIdx mmu_idx,
2577                        bool secure, GetPhysAddrResult *result,
2578                        ARMMMUFaultInfo *fi, uint32_t *mregion)
2579 {
2580     /*
2581      * Perform a PMSAv8 MPU lookup (without also doing the SAU check
2582      * that a full phys-to-virt translation does).
2583      * mregion is (if not NULL) set to the region number which matched,
2584      * or -1 if no region number is returned (MPU off, address did not
2585      * hit a region, address hit in multiple regions).
2586      * If the region hit doesn't cover the entire TARGET_PAGE the address
2587      * is within, then we set the result page_size to 1 to force the
2588      * memory system to use a subpage.
2589      */
2590     ARMCPU *cpu = env_archcpu(env);
2591     bool is_user = regime_is_user(env, mmu_idx);
2592     int n;
2593     int matchregion = -1;
2594     bool hit = false;
2595     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2596     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2597     int region_counter;
2598 
2599     if (regime_el(env, mmu_idx) == 2) {
2600         region_counter = cpu->pmsav8r_hdregion;
2601     } else {
2602         region_counter = cpu->pmsav7_dregion;
2603     }
2604 
2605     result->f.lg_page_size = TARGET_PAGE_BITS;
2606     result->f.phys_addr = address;
2607     result->f.prot = 0;
2608     if (mregion) {
2609         *mregion = -1;
2610     }
2611 
2612     if (mmu_idx == ARMMMUIdx_Stage2) {
2613         fi->stage2 = true;
2614     }
2615 
2616     /*
2617      * Unlike the ARM ARM pseudocode, we don't need to check whether this
2618      * was an exception vector read from the vector table (which is always
2619      * done using the default system address map), because those accesses
2620      * are done in arm_v7m_load_vector(), which always does a direct
2621      * read using address_space_ldl(), rather than going via this function.
2622      */
2623     if (regime_translation_disabled(env, mmu_idx, arm_secure_to_space(secure))) {
2624         /* MPU disabled */
2625         hit = true;
2626     } else if (m_is_ppb_region(env, address)) {
2627         hit = true;
2628     } else {
2629         if (pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
2630             hit = true;
2631         }
2632 
2633         uint32_t bitmask;
2634         if (arm_feature(env, ARM_FEATURE_M)) {
2635             bitmask = 0x1f;
2636         } else {
2637             bitmask = 0x3f;
2638             fi->level = 0;
2639         }
2640 
2641         for (n = region_counter - 1; n >= 0; n--) {
2642             /* region search */
2643             /*
2644              * Note that the base address is bits [31:x] from the register
2645              * with bits [x-1:0] all zeroes, but the limit address is bits
2646              * [31:x] from the register with bits [x:0] all ones. Where x is
2647              * 5 for Cortex-M and 6 for Cortex-R
2648              */
2649             uint32_t base = regime_rbar(env, mmu_idx, secure)[n] & ~bitmask;
2650             uint32_t limit = regime_rlar(env, mmu_idx, secure)[n] | bitmask;
2651 
2652             if (!(regime_rlar(env, mmu_idx, secure)[n] & 0x1)) {
2653                 /* Region disabled */
2654                 continue;
2655             }
2656 
2657             if (address < base || address > limit) {
2658                 /*
2659                  * Address not in this region. We must check whether the
2660                  * region covers addresses in the same page as our address.
2661                  * In that case we must not report a size that covers the
2662                  * whole page for a subsequent hit against a different MPU
2663                  * region or the background region, because it would result in
2664                  * incorrect TLB hits for subsequent accesses to addresses that
2665                  * are in this MPU region.
2666                  */
2667                 if (limit >= base &&
2668                     ranges_overlap(base, limit - base + 1,
2669                                    addr_page_base,
2670                                    TARGET_PAGE_SIZE)) {
2671                     result->f.lg_page_size = 0;
2672                 }
2673                 continue;
2674             }
2675 
2676             if (base > addr_page_base || limit < addr_page_limit) {
2677                 result->f.lg_page_size = 0;
2678             }
2679 
2680             if (matchregion != -1) {
2681                 /*
2682                  * Multiple regions match -- always a failure (unlike
2683                  * PMSAv7 where highest-numbered-region wins)
2684                  */
2685                 fi->type = ARMFault_Permission;
2686                 if (arm_feature(env, ARM_FEATURE_M)) {
2687                     fi->level = 1;
2688                 }
2689                 return true;
2690             }
2691 
2692             matchregion = n;
2693             hit = true;
2694         }
2695     }
2696 
2697     if (!hit) {
2698         if (arm_feature(env, ARM_FEATURE_M)) {
2699             fi->type = ARMFault_Background;
2700         } else {
2701             fi->type = ARMFault_Permission;
2702         }
2703         return true;
2704     }
2705 
2706     if (matchregion == -1) {
2707         /* hit using the background region */
2708         get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
2709     } else {
2710         uint32_t matched_rbar = regime_rbar(env, mmu_idx, secure)[matchregion];
2711         uint32_t matched_rlar = regime_rlar(env, mmu_idx, secure)[matchregion];
2712         uint32_t ap = extract32(matched_rbar, 1, 2);
2713         uint32_t xn = extract32(matched_rbar, 0, 1);
2714         bool pxn = false;
2715 
2716         if (arm_feature(env, ARM_FEATURE_V8_1M)) {
2717             pxn = extract32(matched_rlar, 4, 1);
2718         }
2719 
2720         if (m_is_system_region(env, address)) {
2721             /* System space is always execute never */
2722             xn = 1;
2723         }
2724 
2725         if (regime_el(env, mmu_idx) == 2) {
2726             result->f.prot = simple_ap_to_rw_prot_is_user(ap,
2727                                             mmu_idx != ARMMMUIdx_E2);
2728         } else {
2729             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
2730         }
2731 
2732         if (!arm_feature(env, ARM_FEATURE_M)) {
2733             uint8_t attrindx = extract32(matched_rlar, 1, 3);
2734             uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
2735             uint8_t sh = extract32(matched_rlar, 3, 2);
2736 
2737             if (regime_sctlr(env, mmu_idx) & SCTLR_WXN &&
2738                 result->f.prot & PAGE_WRITE && mmu_idx != ARMMMUIdx_Stage2) {
2739                 xn = 0x1;
2740             }
2741 
2742             if ((regime_el(env, mmu_idx) == 1) &&
2743                 regime_sctlr(env, mmu_idx) & SCTLR_UWXN && ap == 0x1) {
2744                 pxn = 0x1;
2745             }
2746 
2747             result->cacheattrs.is_s2_format = false;
2748             result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
2749             result->cacheattrs.shareability = sh;
2750         }
2751 
2752         if (result->f.prot && !xn && !(pxn && !is_user)) {
2753             result->f.prot |= PAGE_EXEC;
2754         }
2755 
2756         if (mregion) {
2757             *mregion = matchregion;
2758         }
2759     }
2760 
2761     fi->type = ARMFault_Permission;
2762     if (arm_feature(env, ARM_FEATURE_M)) {
2763         fi->level = 1;
2764     }
2765     return !(result->f.prot & (1 << access_type));
2766 }
2767 
v8m_is_sau_exempt(CPUARMState * env,uint32_t address,MMUAccessType access_type)2768 static bool v8m_is_sau_exempt(CPUARMState *env,
2769                               uint32_t address, MMUAccessType access_type)
2770 {
2771     /*
2772      * The architecture specifies that certain address ranges are
2773      * exempt from v8M SAU/IDAU checks.
2774      */
2775     return
2776         (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
2777         (address >= 0xe0000000 && address <= 0xe0002fff) ||
2778         (address >= 0xe000e000 && address <= 0xe000efff) ||
2779         (address >= 0xe002e000 && address <= 0xe002efff) ||
2780         (address >= 0xe0040000 && address <= 0xe0041fff) ||
2781         (address >= 0xe00ff000 && address <= 0xe00fffff);
2782 }
2783 
v8m_security_lookup(CPUARMState * env,uint32_t address,MMUAccessType access_type,ARMMMUIdx mmu_idx,bool is_secure,V8M_SAttributes * sattrs)2784 void v8m_security_lookup(CPUARMState *env, uint32_t address,
2785                          MMUAccessType access_type, ARMMMUIdx mmu_idx,
2786                          bool is_secure, V8M_SAttributes *sattrs)
2787 {
2788     /*
2789      * Look up the security attributes for this address. Compare the
2790      * pseudocode SecurityCheck() function.
2791      * We assume the caller has zero-initialized *sattrs.
2792      */
2793     ARMCPU *cpu = env_archcpu(env);
2794     int r;
2795     bool idau_exempt = false, idau_ns = true, idau_nsc = true;
2796     int idau_region = IREGION_NOTVALID;
2797     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2798     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2799 
2800     if (cpu->idau) {
2801         IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
2802         IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
2803 
2804         iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
2805                    &idau_nsc);
2806     }
2807 
2808     if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
2809         /* 0xf0000000..0xffffffff is always S for insn fetches */
2810         return;
2811     }
2812 
2813     if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
2814         sattrs->ns = !is_secure;
2815         return;
2816     }
2817 
2818     if (idau_region != IREGION_NOTVALID) {
2819         sattrs->irvalid = true;
2820         sattrs->iregion = idau_region;
2821     }
2822 
2823     switch (env->sau.ctrl & 3) {
2824     case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
2825         break;
2826     case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
2827         sattrs->ns = true;
2828         break;
2829     default: /* SAU.ENABLE == 1 */
2830         for (r = 0; r < cpu->sau_sregion; r++) {
2831             if (env->sau.rlar[r] & 1) {
2832                 uint32_t base = env->sau.rbar[r] & ~0x1f;
2833                 uint32_t limit = env->sau.rlar[r] | 0x1f;
2834 
2835                 if (base <= address && limit >= address) {
2836                     if (base > addr_page_base || limit < addr_page_limit) {
2837                         sattrs->subpage = true;
2838                     }
2839                     if (sattrs->srvalid) {
2840                         /*
2841                          * If we hit in more than one region then we must report
2842                          * as Secure, not NS-Callable, with no valid region
2843                          * number info.
2844                          */
2845                         sattrs->ns = false;
2846                         sattrs->nsc = false;
2847                         sattrs->sregion = 0;
2848                         sattrs->srvalid = false;
2849                         break;
2850                     } else {
2851                         if (env->sau.rlar[r] & 2) {
2852                             sattrs->nsc = true;
2853                         } else {
2854                             sattrs->ns = true;
2855                         }
2856                         sattrs->srvalid = true;
2857                         sattrs->sregion = r;
2858                     }
2859                 } else {
2860                     /*
2861                      * Address not in this region. We must check whether the
2862                      * region covers addresses in the same page as our address.
2863                      * In that case we must not report a size that covers the
2864                      * whole page for a subsequent hit against a different MPU
2865                      * region or the background region, because it would result
2866                      * in incorrect TLB hits for subsequent accesses to
2867                      * addresses that are in this MPU region.
2868                      */
2869                     if (limit >= base &&
2870                         ranges_overlap(base, limit - base + 1,
2871                                        addr_page_base,
2872                                        TARGET_PAGE_SIZE)) {
2873                         sattrs->subpage = true;
2874                     }
2875                 }
2876             }
2877         }
2878         break;
2879     }
2880 
2881     /*
2882      * The IDAU will override the SAU lookup results if it specifies
2883      * higher security than the SAU does.
2884      */
2885     if (!idau_ns) {
2886         if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
2887             sattrs->ns = false;
2888             sattrs->nsc = idau_nsc;
2889         }
2890     }
2891 }
2892 
get_phys_addr_pmsav8(CPUARMState * env,S1Translate * ptw,uint32_t address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)2893 static bool get_phys_addr_pmsav8(CPUARMState *env,
2894                                  S1Translate *ptw,
2895                                  uint32_t address,
2896                                  MMUAccessType access_type,
2897                                  GetPhysAddrResult *result,
2898                                  ARMMMUFaultInfo *fi)
2899 {
2900     V8M_SAttributes sattrs = {};
2901     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2902     bool secure = arm_space_is_secure(ptw->in_space);
2903     bool ret;
2904 
2905     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2906         v8m_security_lookup(env, address, access_type, mmu_idx,
2907                             secure, &sattrs);
2908         if (access_type == MMU_INST_FETCH) {
2909             /*
2910              * Instruction fetches always use the MMU bank and the
2911              * transaction attribute determined by the fetch address,
2912              * regardless of CPU state. This is painful for QEMU
2913              * to handle, because it would mean we need to encode
2914              * into the mmu_idx not just the (user, negpri) information
2915              * for the current security state but also that for the
2916              * other security state, which would balloon the number
2917              * of mmu_idx values needed alarmingly.
2918              * Fortunately we can avoid this because it's not actually
2919              * possible to arbitrarily execute code from memory with
2920              * the wrong security attribute: it will always generate
2921              * an exception of some kind or another, apart from the
2922              * special case of an NS CPU executing an SG instruction
2923              * in S&NSC memory. So we always just fail the translation
2924              * here and sort things out in the exception handler
2925              * (including possibly emulating an SG instruction).
2926              */
2927             if (sattrs.ns != !secure) {
2928                 if (sattrs.nsc) {
2929                     fi->type = ARMFault_QEMU_NSCExec;
2930                 } else {
2931                     fi->type = ARMFault_QEMU_SFault;
2932                 }
2933                 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2934                 result->f.phys_addr = address;
2935                 result->f.prot = 0;
2936                 return true;
2937             }
2938         } else {
2939             /*
2940              * For data accesses we always use the MMU bank indicated
2941              * by the current CPU state, but the security attributes
2942              * might downgrade a secure access to nonsecure.
2943              */
2944             if (sattrs.ns) {
2945                 result->f.attrs.secure = false;
2946                 result->f.attrs.space = ARMSS_NonSecure;
2947             } else if (!secure) {
2948                 /*
2949                  * NS access to S memory must fault.
2950                  * Architecturally we should first check whether the
2951                  * MPU information for this address indicates that we
2952                  * are doing an unaligned access to Device memory, which
2953                  * should generate a UsageFault instead. QEMU does not
2954                  * currently check for that kind of unaligned access though.
2955                  * If we added it we would need to do so as a special case
2956                  * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
2957                  */
2958                 fi->type = ARMFault_QEMU_SFault;
2959                 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2960                 result->f.phys_addr = address;
2961                 result->f.prot = 0;
2962                 return true;
2963             }
2964         }
2965     }
2966 
2967     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
2968                             result, fi, NULL);
2969     if (sattrs.subpage) {
2970         result->f.lg_page_size = 0;
2971     }
2972     return ret;
2973 }
2974 
2975 /*
2976  * Translate from the 4-bit stage 2 representation of
2977  * memory attributes (without cache-allocation hints) to
2978  * the 8-bit representation of the stage 1 MAIR registers
2979  * (which includes allocation hints).
2980  *
2981  * ref: shared/translation/attrs/S2AttrDecode()
2982  *      .../S2ConvertAttrsHints()
2983  */
convert_stage2_attrs(uint64_t hcr,uint8_t s2attrs)2984 static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs)
2985 {
2986     uint8_t hiattr = extract32(s2attrs, 2, 2);
2987     uint8_t loattr = extract32(s2attrs, 0, 2);
2988     uint8_t hihint = 0, lohint = 0;
2989 
2990     if (hiattr != 0) { /* normal memory */
2991         if (hcr & HCR_CD) { /* cache disabled */
2992             hiattr = loattr = 1; /* non-cacheable */
2993         } else {
2994             if (hiattr != 1) { /* Write-through or write-back */
2995                 hihint = 3; /* RW allocate */
2996             }
2997             if (loattr != 1) { /* Write-through or write-back */
2998                 lohint = 3; /* RW allocate */
2999             }
3000         }
3001     }
3002 
3003     return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
3004 }
3005 
3006 /*
3007  * Combine either inner or outer cacheability attributes for normal
3008  * memory, according to table D4-42 and pseudocode procedure
3009  * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
3010  *
3011  * NB: only stage 1 includes allocation hints (RW bits), leading to
3012  * some asymmetry.
3013  */
combine_cacheattr_nibble(uint8_t s1,uint8_t s2)3014 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
3015 {
3016     if (s1 == 4 || s2 == 4) {
3017         /* non-cacheable has precedence */
3018         return 4;
3019     } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
3020         /* stage 1 write-through takes precedence */
3021         return s1;
3022     } else if (extract32(s2, 2, 2) == 2) {
3023         /* stage 2 write-through takes precedence, but the allocation hint
3024          * is still taken from stage 1
3025          */
3026         return (2 << 2) | extract32(s1, 0, 2);
3027     } else { /* write-back */
3028         return s1;
3029     }
3030 }
3031 
3032 /*
3033  * Combine the memory type and cacheability attributes of
3034  * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
3035  * combined attributes in MAIR_EL1 format.
3036  */
combined_attrs_nofwb(uint64_t hcr,ARMCacheAttrs s1,ARMCacheAttrs s2)3037 static uint8_t combined_attrs_nofwb(uint64_t hcr,
3038                                     ARMCacheAttrs s1, ARMCacheAttrs s2)
3039 {
3040     uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs;
3041 
3042     if (s2.is_s2_format) {
3043         s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs);
3044     } else {
3045         s2_mair_attrs = s2.attrs;
3046     }
3047 
3048     s1lo = extract32(s1.attrs, 0, 4);
3049     s2lo = extract32(s2_mair_attrs, 0, 4);
3050     s1hi = extract32(s1.attrs, 4, 4);
3051     s2hi = extract32(s2_mair_attrs, 4, 4);
3052 
3053     /* Combine memory type and cacheability attributes */
3054     if (s1hi == 0 || s2hi == 0) {
3055         /* Device has precedence over normal */
3056         if (s1lo == 0 || s2lo == 0) {
3057             /* nGnRnE has precedence over anything */
3058             ret_attrs = 0;
3059         } else if (s1lo == 4 || s2lo == 4) {
3060             /* non-Reordering has precedence over Reordering */
3061             ret_attrs = 4;  /* nGnRE */
3062         } else if (s1lo == 8 || s2lo == 8) {
3063             /* non-Gathering has precedence over Gathering */
3064             ret_attrs = 8;  /* nGRE */
3065         } else {
3066             ret_attrs = 0xc; /* GRE */
3067         }
3068     } else { /* Normal memory */
3069         /* Outer/inner cacheability combine independently */
3070         ret_attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
3071                   | combine_cacheattr_nibble(s1lo, s2lo);
3072     }
3073     return ret_attrs;
3074 }
3075 
force_cacheattr_nibble_wb(uint8_t attr)3076 static uint8_t force_cacheattr_nibble_wb(uint8_t attr)
3077 {
3078     /*
3079      * Given the 4 bits specifying the outer or inner cacheability
3080      * in MAIR format, return a value specifying Normal Write-Back,
3081      * with the allocation and transient hints taken from the input
3082      * if the input specified some kind of cacheable attribute.
3083      */
3084     if (attr == 0 || attr == 4) {
3085         /*
3086          * 0 == an UNPREDICTABLE encoding
3087          * 4 == Non-cacheable
3088          * Either way, force Write-Back RW allocate non-transient
3089          */
3090         return 0xf;
3091     }
3092     /* Change WriteThrough to WriteBack, keep allocation and transient hints */
3093     return attr | 4;
3094 }
3095 
3096 /*
3097  * Combine the memory type and cacheability attributes of
3098  * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
3099  * combined attributes in MAIR_EL1 format.
3100  */
combined_attrs_fwb(ARMCacheAttrs s1,ARMCacheAttrs s2)3101 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
3102 {
3103     assert(s2.is_s2_format && !s1.is_s2_format);
3104 
3105     switch (s2.attrs) {
3106     case 7:
3107         /* Use stage 1 attributes */
3108         return s1.attrs;
3109     case 6:
3110         /*
3111          * Force Normal Write-Back. Note that if S1 is Normal cacheable
3112          * then we take the allocation hints from it; otherwise it is
3113          * RW allocate, non-transient.
3114          */
3115         if ((s1.attrs & 0xf0) == 0) {
3116             /* S1 is Device */
3117             return 0xff;
3118         }
3119         /* Need to check the Inner and Outer nibbles separately */
3120         return force_cacheattr_nibble_wb(s1.attrs & 0xf) |
3121             force_cacheattr_nibble_wb(s1.attrs >> 4) << 4;
3122     case 5:
3123         /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */
3124         if ((s1.attrs & 0xf0) == 0) {
3125             return s1.attrs;
3126         }
3127         return 0x44;
3128     case 0 ... 3:
3129         /* Force Device, of subtype specified by S2 */
3130         return s2.attrs << 2;
3131     default:
3132         /*
3133          * RESERVED values (including RES0 descriptor bit [5] being nonzero);
3134          * arbitrarily force Device.
3135          */
3136         return 0;
3137     }
3138 }
3139 
3140 /*
3141  * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
3142  * and CombineS1S2Desc()
3143  *
3144  * @env:     CPUARMState
3145  * @s1:      Attributes from stage 1 walk
3146  * @s2:      Attributes from stage 2 walk
3147  */
combine_cacheattrs(uint64_t hcr,ARMCacheAttrs s1,ARMCacheAttrs s2)3148 static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
3149                                         ARMCacheAttrs s1, ARMCacheAttrs s2)
3150 {
3151     ARMCacheAttrs ret;
3152     bool tagged = false;
3153 
3154     assert(!s1.is_s2_format);
3155     ret.is_s2_format = false;
3156 
3157     if (s1.attrs == 0xf0) {
3158         tagged = true;
3159         s1.attrs = 0xff;
3160     }
3161 
3162     /* Combine shareability attributes (table D4-43) */
3163     if (s1.shareability == 2 || s2.shareability == 2) {
3164         /* if either are outer-shareable, the result is outer-shareable */
3165         ret.shareability = 2;
3166     } else if (s1.shareability == 3 || s2.shareability == 3) {
3167         /* if either are inner-shareable, the result is inner-shareable */
3168         ret.shareability = 3;
3169     } else {
3170         /* both non-shareable */
3171         ret.shareability = 0;
3172     }
3173 
3174     /* Combine memory type and cacheability attributes */
3175     if (hcr & HCR_FWB) {
3176         ret.attrs = combined_attrs_fwb(s1, s2);
3177     } else {
3178         ret.attrs = combined_attrs_nofwb(hcr, s1, s2);
3179     }
3180 
3181     /*
3182      * Any location for which the resultant memory type is any
3183      * type of Device memory is always treated as Outer Shareable.
3184      * Any location for which the resultant memory type is Normal
3185      * Inner Non-cacheable, Outer Non-cacheable is always treated
3186      * as Outer Shareable.
3187      * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC
3188      */
3189     if ((ret.attrs & 0xf0) == 0 || ret.attrs == 0x44) {
3190         ret.shareability = 2;
3191     }
3192 
3193     /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */
3194     if (tagged && ret.attrs == 0xff) {
3195         ret.attrs = 0xf0;
3196     }
3197 
3198     return ret;
3199 }
3200 
3201 /*
3202  * MMU disabled.  S1 addresses within aa64 translation regimes are
3203  * still checked for bounds -- see AArch64.S1DisabledOutput().
3204  */
get_phys_addr_disabled(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3205 static bool get_phys_addr_disabled(CPUARMState *env,
3206                                    S1Translate *ptw,
3207                                    vaddr address,
3208                                    MMUAccessType access_type,
3209                                    GetPhysAddrResult *result,
3210                                    ARMMMUFaultInfo *fi)
3211 {
3212     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
3213     uint8_t memattr = 0x00;    /* Device nGnRnE */
3214     uint8_t shareability = 0;  /* non-shareable */
3215     int r_el;
3216 
3217     switch (mmu_idx) {
3218     case ARMMMUIdx_Stage2:
3219     case ARMMMUIdx_Stage2_S:
3220     case ARMMMUIdx_Phys_S:
3221     case ARMMMUIdx_Phys_NS:
3222     case ARMMMUIdx_Phys_Root:
3223     case ARMMMUIdx_Phys_Realm:
3224         break;
3225 
3226     default:
3227         r_el = regime_el(env, mmu_idx);
3228         if (arm_el_is_aa64(env, r_el)) {
3229             int pamax = arm_pamax(env_archcpu(env));
3230             uint64_t tcr = env->cp15.tcr_el[r_el];
3231             int addrtop, tbi;
3232 
3233             tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
3234             if (access_type == MMU_INST_FETCH) {
3235                 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
3236             }
3237             tbi = (tbi >> extract64(address, 55, 1)) & 1;
3238             addrtop = (tbi ? 55 : 63);
3239 
3240             if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
3241                 fi->type = ARMFault_AddressSize;
3242                 fi->level = 0;
3243                 fi->stage2 = false;
3244                 return 1;
3245             }
3246 
3247             /*
3248              * When TBI is disabled, we've just validated that all of the
3249              * bits above PAMax are zero, so logically we only need to
3250              * clear the top byte for TBI.  But it's clearer to follow
3251              * the pseudocode set of addrdesc.paddress.
3252              */
3253             address = extract64(address, 0, 52);
3254         }
3255 
3256         /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
3257         if (r_el == 1) {
3258             uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
3259             if (hcr & HCR_DC) {
3260                 if (hcr & HCR_DCT) {
3261                     memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
3262                 } else {
3263                     memattr = 0xff;  /* Normal, WB, RWA */
3264                 }
3265             }
3266         }
3267         if (memattr == 0) {
3268             if (access_type == MMU_INST_FETCH) {
3269                 if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
3270                     memattr = 0xee;  /* Normal, WT, RA, NT */
3271                 } else {
3272                     memattr = 0x44;  /* Normal, NC, No */
3273                 }
3274             }
3275             shareability = 2; /* outer shareable */
3276         }
3277         result->cacheattrs.is_s2_format = false;
3278         break;
3279     }
3280 
3281     result->f.phys_addr = address;
3282     result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
3283     result->f.lg_page_size = TARGET_PAGE_BITS;
3284     result->cacheattrs.shareability = shareability;
3285     result->cacheattrs.attrs = memattr;
3286     return false;
3287 }
3288 
get_phys_addr_twostage(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3289 static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
3290                                    vaddr address,
3291                                    MMUAccessType access_type,
3292                                    GetPhysAddrResult *result,
3293                                    ARMMMUFaultInfo *fi)
3294 {
3295     hwaddr ipa;
3296     int s1_prot, s1_lgpgsz;
3297     ARMSecuritySpace in_space = ptw->in_space;
3298     bool ret, ipa_secure, s1_guarded;
3299     ARMCacheAttrs cacheattrs1;
3300     ARMSecuritySpace ipa_space;
3301     uint64_t hcr;
3302 
3303     ret = get_phys_addr_nogpc(env, ptw, address, access_type, result, fi);
3304 
3305     /* If S1 fails, return early.  */
3306     if (ret) {
3307         return ret;
3308     }
3309 
3310     ipa = result->f.phys_addr;
3311     ipa_secure = result->f.attrs.secure;
3312     ipa_space = result->f.attrs.space;
3313 
3314     ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
3315     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
3316     ptw->in_space = ipa_space;
3317     ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
3318 
3319     /*
3320      * S1 is done, now do S2 translation.
3321      * Save the stage1 results so that we may merge prot and cacheattrs later.
3322      */
3323     s1_prot = result->f.prot;
3324     s1_lgpgsz = result->f.lg_page_size;
3325     s1_guarded = result->f.extra.arm.guarded;
3326     cacheattrs1 = result->cacheattrs;
3327     memset(result, 0, sizeof(*result));
3328 
3329     ret = get_phys_addr_nogpc(env, ptw, ipa, access_type, result, fi);
3330     fi->s2addr = ipa;
3331 
3332     /* Combine the S1 and S2 perms.  */
3333     result->f.prot &= s1_prot;
3334 
3335     /* If S2 fails, return early.  */
3336     if (ret) {
3337         return ret;
3338     }
3339 
3340     /*
3341      * If either S1 or S2 returned a result smaller than TARGET_PAGE_SIZE,
3342      * this means "don't put this in the TLB"; in this case, return a
3343      * result with lg_page_size == 0 to achieve that. Otherwise,
3344      * use the maximum of the S1 & S2 page size, so that invalidation
3345      * of pages > TARGET_PAGE_SIZE works correctly. (This works even though
3346      * we know the combined result permissions etc only cover the minimum
3347      * of the S1 and S2 page size, because we know that the common TLB code
3348      * never actually creates TLB entries bigger than TARGET_PAGE_SIZE,
3349      * and passing a larger page size value only affects invalidations.)
3350      */
3351     if (result->f.lg_page_size < TARGET_PAGE_BITS ||
3352         s1_lgpgsz < TARGET_PAGE_BITS) {
3353         result->f.lg_page_size = 0;
3354     } else if (result->f.lg_page_size < s1_lgpgsz) {
3355         result->f.lg_page_size = s1_lgpgsz;
3356     }
3357 
3358     /* Combine the S1 and S2 cache attributes. */
3359     hcr = arm_hcr_el2_eff_secstate(env, in_space);
3360     if (hcr & HCR_DC) {
3361         /*
3362          * HCR.DC forces the first stage attributes to
3363          *  Normal Non-Shareable,
3364          *  Inner Write-Back Read-Allocate Write-Allocate,
3365          *  Outer Write-Back Read-Allocate Write-Allocate.
3366          * Do not overwrite Tagged within attrs.
3367          */
3368         if (cacheattrs1.attrs != 0xf0) {
3369             cacheattrs1.attrs = 0xff;
3370         }
3371         cacheattrs1.shareability = 0;
3372     }
3373     result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1,
3374                                             result->cacheattrs);
3375 
3376     /* No BTI GP information in stage 2, we just use the S1 value */
3377     result->f.extra.arm.guarded = s1_guarded;
3378 
3379     /*
3380      * Check if IPA translates to secure or non-secure PA space.
3381      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
3382      */
3383     if (in_space == ARMSS_Secure) {
3384         result->f.attrs.secure =
3385             !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
3386             && (ipa_secure
3387                 || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
3388         result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
3389     }
3390 
3391     return false;
3392 }
3393 
get_phys_addr_nogpc(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3394 static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
3395                                       vaddr address,
3396                                       MMUAccessType access_type,
3397                                       GetPhysAddrResult *result,
3398                                       ARMMMUFaultInfo *fi)
3399 {
3400     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
3401     ARMMMUIdx s1_mmu_idx;
3402 
3403     /*
3404      * The page table entries may downgrade Secure to NonSecure, but
3405      * cannot upgrade a NonSecure translation regime's attributes
3406      * to Secure or Realm.
3407      */
3408     result->f.attrs.space = ptw->in_space;
3409     result->f.attrs.secure = arm_space_is_secure(ptw->in_space);
3410 
3411     switch (mmu_idx) {
3412     case ARMMMUIdx_Phys_S:
3413     case ARMMMUIdx_Phys_NS:
3414     case ARMMMUIdx_Phys_Root:
3415     case ARMMMUIdx_Phys_Realm:
3416         /* Checking Phys early avoids special casing later vs regime_el. */
3417         return get_phys_addr_disabled(env, ptw, address, access_type,
3418                                       result, fi);
3419 
3420     case ARMMMUIdx_Stage1_E0:
3421     case ARMMMUIdx_Stage1_E1:
3422     case ARMMMUIdx_Stage1_E1_PAN:
3423         /*
3424          * First stage lookup uses second stage for ptw; only
3425          * Secure has both S and NS IPA and starts with Stage2_S.
3426          */
3427         ptw->in_ptw_idx = (ptw->in_space == ARMSS_Secure) ?
3428             ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
3429         break;
3430 
3431     case ARMMMUIdx_Stage2:
3432     case ARMMMUIdx_Stage2_S:
3433         /*
3434          * Second stage lookup uses physical for ptw; whether this is S or
3435          * NS may depend on the SW/NSW bits if this is a stage 2 lookup for
3436          * the Secure EL2&0 regime.
3437          */
3438         ptw->in_ptw_idx = ptw_idx_for_stage_2(env, mmu_idx);
3439         break;
3440 
3441     case ARMMMUIdx_E10_0:
3442         s1_mmu_idx = ARMMMUIdx_Stage1_E0;
3443         goto do_twostage;
3444     case ARMMMUIdx_E10_1:
3445         s1_mmu_idx = ARMMMUIdx_Stage1_E1;
3446         goto do_twostage;
3447     case ARMMMUIdx_E10_1_PAN:
3448         s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
3449     do_twostage:
3450         /*
3451          * Call ourselves recursively to do the stage 1 and then stage 2
3452          * translations if mmu_idx is a two-stage regime, and EL2 present.
3453          * Otherwise, a stage1+stage2 translation is just stage 1.
3454          */
3455         ptw->in_mmu_idx = mmu_idx = s1_mmu_idx;
3456         if (arm_feature(env, ARM_FEATURE_EL2) &&
3457             !regime_translation_disabled(env, ARMMMUIdx_Stage2, ptw->in_space)) {
3458             return get_phys_addr_twostage(env, ptw, address, access_type,
3459                                           result, fi);
3460         }
3461         /* fall through */
3462 
3463     default:
3464         /* Single stage uses physical for ptw. */
3465         ptw->in_ptw_idx = arm_space_to_phys(ptw->in_space);
3466         break;
3467     }
3468 
3469     result->f.attrs.user = regime_is_user(env, mmu_idx);
3470 
3471     /*
3472      * Fast Context Switch Extension. This doesn't exist at all in v8.
3473      * In v7 and earlier it affects all stage 1 translations.
3474      */
3475     if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2
3476         && !arm_feature(env, ARM_FEATURE_V8)) {
3477         if (regime_el(env, mmu_idx) == 3) {
3478             address += env->cp15.fcseidr_s;
3479         } else {
3480             address += env->cp15.fcseidr_ns;
3481         }
3482     }
3483 
3484     if (arm_feature(env, ARM_FEATURE_PMSA)) {
3485         bool ret;
3486         result->f.lg_page_size = TARGET_PAGE_BITS;
3487 
3488         if (arm_feature(env, ARM_FEATURE_V8)) {
3489             /* PMSAv8 */
3490             ret = get_phys_addr_pmsav8(env, ptw, address, access_type,
3491                                        result, fi);
3492         } else if (arm_feature(env, ARM_FEATURE_V7)) {
3493             /* PMSAv7 */
3494             ret = get_phys_addr_pmsav7(env, ptw, address, access_type,
3495                                        result, fi);
3496         } else {
3497             /* Pre-v7 MPU */
3498             ret = get_phys_addr_pmsav5(env, ptw, address, access_type,
3499                                        result, fi);
3500         }
3501         qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
3502                       " mmu_idx %u -> %s (prot %c%c%c)\n",
3503                       access_type == MMU_DATA_LOAD ? "reading" :
3504                       (access_type == MMU_DATA_STORE ? "writing" : "execute"),
3505                       (uint32_t)address, mmu_idx,
3506                       ret ? "Miss" : "Hit",
3507                       result->f.prot & PAGE_READ ? 'r' : '-',
3508                       result->f.prot & PAGE_WRITE ? 'w' : '-',
3509                       result->f.prot & PAGE_EXEC ? 'x' : '-');
3510 
3511         return ret;
3512     }
3513 
3514     /* Definitely a real MMU, not an MPU */
3515 
3516     if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
3517         return get_phys_addr_disabled(env, ptw, address, access_type,
3518                                       result, fi);
3519     }
3520 
3521     if (regime_using_lpae_format(env, mmu_idx)) {
3522         return get_phys_addr_lpae(env, ptw, address, access_type, result, fi);
3523     } else if (arm_feature(env, ARM_FEATURE_V7) ||
3524                regime_sctlr(env, mmu_idx) & SCTLR_XP) {
3525         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
3526     } else {
3527         return get_phys_addr_v5(env, ptw, address, access_type, result, fi);
3528     }
3529 }
3530 
get_phys_addr_gpc(CPUARMState * env,S1Translate * ptw,vaddr address,MMUAccessType access_type,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3531 static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
3532                               vaddr address,
3533                               MMUAccessType access_type,
3534                               GetPhysAddrResult *result,
3535                               ARMMMUFaultInfo *fi)
3536 {
3537     if (get_phys_addr_nogpc(env, ptw, address, access_type, result, fi)) {
3538         return true;
3539     }
3540     if (!granule_protection_check(env, result->f.phys_addr,
3541                                   result->f.attrs.space, fi)) {
3542         fi->type = ARMFault_GPCFOnOutput;
3543         return true;
3544     }
3545     return false;
3546 }
3547 
get_phys_addr_with_space_nogpc(CPUARMState * env,vaddr address,MMUAccessType access_type,ARMMMUIdx mmu_idx,ARMSecuritySpace space,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3548 bool get_phys_addr_with_space_nogpc(CPUARMState *env, vaddr address,
3549                                     MMUAccessType access_type,
3550                                     ARMMMUIdx mmu_idx, ARMSecuritySpace space,
3551                                     GetPhysAddrResult *result,
3552                                     ARMMMUFaultInfo *fi)
3553 {
3554     S1Translate ptw = {
3555         .in_mmu_idx = mmu_idx,
3556         .in_space = space,
3557     };
3558     return get_phys_addr_nogpc(env, &ptw, address, access_type, result, fi);
3559 }
3560 
get_phys_addr(CPUARMState * env,vaddr address,MMUAccessType access_type,ARMMMUIdx mmu_idx,GetPhysAddrResult * result,ARMMMUFaultInfo * fi)3561 bool get_phys_addr(CPUARMState *env, vaddr address,
3562                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
3563                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
3564 {
3565     S1Translate ptw = {
3566         .in_mmu_idx = mmu_idx,
3567     };
3568     ARMSecuritySpace ss;
3569 
3570     switch (mmu_idx) {
3571     case ARMMMUIdx_E10_0:
3572     case ARMMMUIdx_E10_1:
3573     case ARMMMUIdx_E10_1_PAN:
3574     case ARMMMUIdx_E20_0:
3575     case ARMMMUIdx_E20_2:
3576     case ARMMMUIdx_E20_2_PAN:
3577     case ARMMMUIdx_Stage1_E0:
3578     case ARMMMUIdx_Stage1_E1:
3579     case ARMMMUIdx_Stage1_E1_PAN:
3580     case ARMMMUIdx_E2:
3581         ss = arm_security_space_below_el3(env);
3582         break;
3583     case ARMMMUIdx_Stage2:
3584         /*
3585          * For Secure EL2, we need this index to be NonSecure;
3586          * otherwise this will already be NonSecure or Realm.
3587          */
3588         ss = arm_security_space_below_el3(env);
3589         if (ss == ARMSS_Secure) {
3590             ss = ARMSS_NonSecure;
3591         }
3592         break;
3593     case ARMMMUIdx_Phys_NS:
3594     case ARMMMUIdx_MPrivNegPri:
3595     case ARMMMUIdx_MUserNegPri:
3596     case ARMMMUIdx_MPriv:
3597     case ARMMMUIdx_MUser:
3598         ss = ARMSS_NonSecure;
3599         break;
3600     case ARMMMUIdx_Stage2_S:
3601     case ARMMMUIdx_Phys_S:
3602     case ARMMMUIdx_MSPrivNegPri:
3603     case ARMMMUIdx_MSUserNegPri:
3604     case ARMMMUIdx_MSPriv:
3605     case ARMMMUIdx_MSUser:
3606         ss = ARMSS_Secure;
3607         break;
3608     case ARMMMUIdx_E3:
3609     case ARMMMUIdx_E30_0:
3610     case ARMMMUIdx_E30_3_PAN:
3611         if (arm_feature(env, ARM_FEATURE_AARCH64) &&
3612             cpu_isar_feature(aa64_rme, env_archcpu(env))) {
3613             ss = ARMSS_Root;
3614         } else {
3615             ss = ARMSS_Secure;
3616         }
3617         break;
3618     case ARMMMUIdx_Phys_Root:
3619         ss = ARMSS_Root;
3620         break;
3621     case ARMMMUIdx_Phys_Realm:
3622         ss = ARMSS_Realm;
3623         break;
3624     default:
3625         g_assert_not_reached();
3626     }
3627 
3628     ptw.in_space = ss;
3629     return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
3630 }
3631 
arm_cpu_get_phys_page_attrs_debug(CPUState * cs,vaddr addr,MemTxAttrs * attrs)3632 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
3633                                          MemTxAttrs *attrs)
3634 {
3635     ARMCPU *cpu = ARM_CPU(cs);
3636     CPUARMState *env = &cpu->env;
3637     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
3638     ARMSecuritySpace ss = arm_security_space(env);
3639     S1Translate ptw = {
3640         .in_mmu_idx = mmu_idx,
3641         .in_space = ss,
3642         .in_debug = true,
3643     };
3644     GetPhysAddrResult res = {};
3645     ARMMMUFaultInfo fi = {};
3646     bool ret;
3647 
3648     ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
3649     *attrs = res.f.attrs;
3650 
3651     if (ret) {
3652         return -1;
3653     }
3654     return res.f.phys_addr;
3655 }
3656