2 * ARM page table walking.
4 * This code is licensed under the GNU GPL v2 or later.
6 * SPDX-License-Identifier: GPL-2.0-or-later
9 #include "qemu/osdep.h"
11 #include "qemu/range.h"
12 #include "qemu/main-loop.h"
13 #include "exec/exec-all.h"
15 #include "internals.h"
16 #include "cpu-features.h"
19 # include "tcg/oversized-guest.h"
22 typedef struct S1Translate
{
24 * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
25 * Together with in_space, specifies the architectural translation regime.
29 * in_ptw_idx: specifies which mmuidx to use for the actual
30 * page table descriptor load operations. This will be one of the
31 * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
32 * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
33 * this field is updated accordingly.
37 * in_space: the security space for this walk. This plus
38 * the in_mmu_idx specify the architectural translation regime.
39 * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
40 * this field is updated accordingly.
42 * Note that the security space for the in_ptw_idx may be different
43 * from that for the in_mmu_idx. We do not need to explicitly track
44 * the in_ptw_idx security space because:
45 * - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
46 * itself specifies the security space
47 * - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
48 * space used for ptw reads is the same as that of the security
49 * space of the stage 1 translation for all cases except where
50 * stage 1 is Secure; in that case the only possibilities for
51 * the ptw read are Secure and NonSecure, and the in_ptw_idx
52 * value being Stage2 vs Stage2_S distinguishes those.
54 ARMSecuritySpace in_space
;
56 * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
57 * accesses will not update the guest page table access flags
58 * and will not change the state of the softmmu TLBs.
62 * If this is stage 2 of a stage 1+2 page table walk, then this must
63 * be true if stage 1 is an EL0 access; otherwise this is ignored.
64 * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
69 ARMSecuritySpace out_space
;
75 static bool get_phys_addr_nogpc(CPUARMState
*env
, S1Translate
*ptw
,
77 MMUAccessType access_type
,
78 GetPhysAddrResult
*result
,
81 static bool get_phys_addr_gpc(CPUARMState
*env
, S1Translate
*ptw
,
83 MMUAccessType access_type
,
84 GetPhysAddrResult
*result
,
87 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
88 static const uint8_t pamax_map
[] = {
98 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
99 unsigned int arm_pamax(ARMCPU
*cpu
)
101 if (arm_feature(&cpu
->env
, ARM_FEATURE_AARCH64
)) {
102 unsigned int parange
=
103 FIELD_EX64(cpu
->isar
.id_aa64mmfr0
, ID_AA64MMFR0
, PARANGE
);
106 * id_aa64mmfr0 is a read-only register so values outside of the
107 * supported mappings can be considered an implementation error.
109 assert(parange
< ARRAY_SIZE(pamax_map
));
110 return pamax_map
[parange
];
114 * In machvirt_init, we call arm_pamax on a cpu that is not fully
115 * initialized, so we can't rely on the propagation done in realize.
117 if (arm_feature(&cpu
->env
, ARM_FEATURE_LPAE
) ||
118 arm_feature(&cpu
->env
, ARM_FEATURE_V7VE
)) {
127 * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index
129 ARMMMUIdx
stage_1_mmu_idx(ARMMMUIdx mmu_idx
)
132 case ARMMMUIdx_E10_0
:
133 return ARMMMUIdx_Stage1_E0
;
134 case ARMMMUIdx_E10_1
:
135 return ARMMMUIdx_Stage1_E1
;
136 case ARMMMUIdx_E10_1_PAN
:
137 return ARMMMUIdx_Stage1_E1_PAN
;
143 ARMMMUIdx
arm_stage1_mmu_idx(CPUARMState
*env
)
145 return stage_1_mmu_idx(arm_mmu_idx(env
));
149 * Return where we should do ptw loads from for a stage 2 walk.
150 * This depends on whether the address we are looking up is a
151 * Secure IPA or a NonSecure IPA, which we know from whether this is
152 * Stage2 or Stage2_S.
153 * If this is the Secure EL1&0 regime we need to check the NSW and SW bits.
155 static ARMMMUIdx
ptw_idx_for_stage_2(CPUARMState
*env
, ARMMMUIdx stage2idx
)
160 * We're OK to check the current state of the CPU here because
161 * (1) we always invalidate all TLBs when the SCR_EL3.NS or SCR_EL3.NSE bit
163 * (2) there's no way to do a lookup that cares about Stage 2 for a
164 * different security state to the current one for AArch64, and AArch32
165 * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
166 * an NS stage 1+2 lookup while the NS bit is 0.)
168 if (!arm_el_is_aa64(env
, 3)) {
169 return ARMMMUIdx_Phys_NS
;
172 switch (arm_security_space_below_el3(env
)) {
173 case ARMSS_NonSecure
:
174 return ARMMMUIdx_Phys_NS
;
176 return ARMMMUIdx_Phys_Realm
;
178 if (stage2idx
== ARMMMUIdx_Stage2_S
) {
179 s2walk_secure
= !(env
->cp15
.vstcr_el2
& VSTCR_SW
);
181 s2walk_secure
= !(env
->cp15
.vtcr_el2
& VTCR_NSW
);
183 return s2walk_secure
? ARMMMUIdx_Phys_S
: ARMMMUIdx_Phys_NS
;
185 g_assert_not_reached();
189 static bool regime_translation_big_endian(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
191 return (regime_sctlr(env
, mmu_idx
) & SCTLR_EE
) != 0;
194 /* Return the TTBR associated with this translation regime */
195 static uint64_t regime_ttbr(CPUARMState
*env
, ARMMMUIdx mmu_idx
, int ttbrn
)
197 if (mmu_idx
== ARMMMUIdx_Stage2
) {
198 return env
->cp15
.vttbr_el2
;
200 if (mmu_idx
== ARMMMUIdx_Stage2_S
) {
201 return env
->cp15
.vsttbr_el2
;
204 return env
->cp15
.ttbr0_el
[regime_el(env
, mmu_idx
)];
206 return env
->cp15
.ttbr1_el
[regime_el(env
, mmu_idx
)];
210 /* Return true if the specified stage of address translation is disabled */
211 static bool regime_translation_disabled(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
212 ARMSecuritySpace space
)
216 if (arm_feature(env
, ARM_FEATURE_M
)) {
217 bool is_secure
= arm_space_is_secure(space
);
218 switch (env
->v7m
.mpu_ctrl
[is_secure
] &
219 (R_V7M_MPU_CTRL_ENABLE_MASK
| R_V7M_MPU_CTRL_HFNMIENA_MASK
)) {
220 case R_V7M_MPU_CTRL_ENABLE_MASK
:
221 /* Enabled, but not for HardFault and NMI */
222 return mmu_idx
& ARM_MMU_IDX_M_NEGPRI
;
223 case R_V7M_MPU_CTRL_ENABLE_MASK
| R_V7M_MPU_CTRL_HFNMIENA_MASK
:
224 /* Enabled for all cases */
229 * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
230 * we warned about that in armv7m_nvic.c when the guest set it.
238 case ARMMMUIdx_Stage2
:
239 case ARMMMUIdx_Stage2_S
:
240 /* HCR.DC means HCR.VM behaves as 1 */
241 hcr_el2
= arm_hcr_el2_eff_secstate(env
, space
);
242 return (hcr_el2
& (HCR_DC
| HCR_VM
)) == 0;
244 case ARMMMUIdx_E10_0
:
245 case ARMMMUIdx_E10_1
:
246 case ARMMMUIdx_E10_1_PAN
:
247 /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
248 hcr_el2
= arm_hcr_el2_eff_secstate(env
, space
);
249 if (hcr_el2
& HCR_TGE
) {
254 case ARMMMUIdx_Stage1_E0
:
255 case ARMMMUIdx_Stage1_E1
:
256 case ARMMMUIdx_Stage1_E1_PAN
:
257 /* HCR.DC means SCTLR_EL1.M behaves as 0 */
258 hcr_el2
= arm_hcr_el2_eff_secstate(env
, space
);
259 if (hcr_el2
& HCR_DC
) {
264 case ARMMMUIdx_E20_0
:
265 case ARMMMUIdx_E20_2
:
266 case ARMMMUIdx_E20_2_PAN
:
271 case ARMMMUIdx_Phys_S
:
272 case ARMMMUIdx_Phys_NS
:
273 case ARMMMUIdx_Phys_Root
:
274 case ARMMMUIdx_Phys_Realm
:
275 /* No translation for physical address spaces. */
279 g_assert_not_reached();
282 return (regime_sctlr(env
, mmu_idx
) & SCTLR_M
) == 0;
285 static bool granule_protection_check(CPUARMState
*env
, uint64_t paddress
,
286 ARMSecuritySpace pspace
,
293 ARMCPU
*cpu
= env_archcpu(env
);
294 uint64_t gpccr
= env
->cp15
.gpccr_el3
;
295 unsigned pps
, pgs
, l0gptsz
, level
= 0;
296 uint64_t tableaddr
, pps_mask
, align
, entry
, index
;
301 if (!FIELD_EX64(gpccr
, GPCCR
, GPC
)) {
306 * GPC Priority 1 (R_GMGRR):
307 * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
308 * the access fails as GPT walk fault at level 0.
312 * Configuration of PPS to a value exceeding the implemented
313 * physical address size is invalid.
315 pps
= FIELD_EX64(gpccr
, GPCCR
, PPS
);
316 if (pps
> FIELD_EX64(cpu
->isar
.id_aa64mmfr0
, ID_AA64MMFR0
, PARANGE
)) {
319 pps
= pamax_map
[pps
];
320 pps_mask
= MAKE_64BIT_MASK(0, pps
);
322 switch (FIELD_EX64(gpccr
, GPCCR
, SH
)) {
323 case 0b10: /* outer shareable */
325 case 0b00: /* non-shareable */
326 case 0b11: /* inner shareable */
327 /* Inner and Outer non-cacheable requires Outer shareable. */
328 if (FIELD_EX64(gpccr
, GPCCR
, ORGN
) == 0 &&
329 FIELD_EX64(gpccr
, GPCCR
, IRGN
) == 0) {
333 default: /* reserved */
337 switch (FIELD_EX64(gpccr
, GPCCR
, PGS
)) {
341 case 0b01: /* 64KB */
344 case 0b10: /* 16KB */
347 default: /* reserved */
351 /* Note this field is read-only and fixed at reset. */
352 l0gptsz
= 30 + FIELD_EX64(gpccr
, GPCCR
, L0GPTSZ
);
355 * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
356 * R_CPDSB: A NonSecure physical address input exceeding PPS
357 * does not experience any fault.
359 if (paddress
& ~pps_mask
) {
360 if (pspace
== ARMSS_NonSecure
) {
366 /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
367 tableaddr
= env
->cp15
.gptbr_el3
<< 12;
368 if (tableaddr
& ~pps_mask
) {
373 * BADDR is aligned per a function of PPS and L0GPTSZ.
374 * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
375 * unlike the RES0 bits of the GPT entries (R_XNKFZ).
377 align
= MAX(pps
- l0gptsz
+ 3, 12);
378 align
= MAKE_64BIT_MASK(0, align
);
381 as
= arm_addressspace(env_cpu(env
), attrs
);
383 /* Level 0 lookup. */
384 index
= extract64(paddress
, l0gptsz
, pps
- l0gptsz
);
385 tableaddr
+= index
* 8;
386 entry
= address_space_ldq_le(as
, tableaddr
, attrs
, &result
);
387 if (result
!= MEMTX_OK
) {
391 switch (extract32(entry
, 0, 4)) {
392 case 1: /* block descriptor */
394 goto fault_walk
; /* RES0 bits not 0 */
396 gpi
= extract32(entry
, 4, 4);
398 case 3: /* table descriptor */
399 tableaddr
= entry
& ~0xf;
400 align
= MAX(l0gptsz
- pgs
- 1, 12);
401 align
= MAKE_64BIT_MASK(0, align
);
402 if (tableaddr
& (~pps_mask
| align
)) {
403 goto fault_walk
; /* RES0 bits not 0 */
406 default: /* invalid */
412 index
= extract64(paddress
, pgs
+ 4, l0gptsz
- pgs
- 4);
413 tableaddr
+= index
* 8;
414 entry
= address_space_ldq_le(as
, tableaddr
, attrs
, &result
);
415 if (result
!= MEMTX_OK
) {
419 switch (extract32(entry
, 0, 4)) {
420 case 1: /* contiguous descriptor */
422 goto fault_walk
; /* RES0 bits not 0 */
425 * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
426 * and because we cannot invalidate by pa, and thus will always
427 * flush entire tlbs, we don't actually care about the range here
428 * and can simply extract the GPI as the result.
430 if (extract32(entry
, 8, 2) == 0) {
431 goto fault_walk
; /* reserved contig */
433 gpi
= extract32(entry
, 4, 4);
436 index
= extract64(paddress
, pgs
, 4);
437 gpi
= extract64(entry
, index
* 4, 4);
443 case 0b0000: /* no access */
445 case 0b1111: /* all access */
451 if (pspace
== (gpi
& 3)) {
456 goto fault_walk
; /* reserved */
459 fi
->gpcf
= GPCF_Fail
;
462 fi
->gpcf
= GPCF_EABT
;
465 fi
->gpcf
= GPCF_AddressSize
;
468 fi
->gpcf
= GPCF_Walk
;
471 fi
->paddr
= paddress
;
472 fi
->paddr_space
= pspace
;
476 static bool S2_attrs_are_device(uint64_t hcr
, uint8_t attrs
)
479 * For an S1 page table walk, the stage 1 attributes are always
480 * some form of "this is Normal memory". The combined S1+S2
481 * attributes are therefore only Device if stage 2 specifies Device.
482 * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00,
483 * ie when cacheattrs.attrs bits [3:2] are 0b00.
484 * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie
485 * when cacheattrs.attrs bit [2] is 0.
488 return (attrs
& 0x4) == 0;
490 return (attrs
& 0xc) == 0;
494 static ARMSecuritySpace
S2_security_space(ARMSecuritySpace s1_space
,
495 ARMMMUIdx s2_mmu_idx
)
498 * Return the security space to use for stage 2 when doing
499 * the S1 page table descriptor load.
501 if (regime_is_stage2(s2_mmu_idx
)) {
503 * The security space for ptw reads is almost always the same
504 * as that of the security space of the stage 1 translation.
505 * The only exception is when stage 1 is Secure; in that case
506 * the ptw read might be to the Secure or the NonSecure space
507 * (but never Realm or Root), and the s2_mmu_idx tells us which.
508 * Root translations are always single-stage.
510 if (s1_space
== ARMSS_Secure
) {
511 return arm_secure_to_space(s2_mmu_idx
== ARMMMUIdx_Stage2_S
);
513 assert(s2_mmu_idx
!= ARMMMUIdx_Stage2_S
);
514 assert(s1_space
!= ARMSS_Root
);
518 /* ptw loads are from phys: the mmu idx itself says which space */
519 return arm_phys_to_space(s2_mmu_idx
);
523 static bool fault_s1ns(ARMSecuritySpace space
, ARMMMUIdx s2_mmu_idx
)
526 * For stage 2 faults in Secure EL22, S1NS indicates
527 * whether the faulting IPA is in the Secure or NonSecure
528 * IPA space. For all other kinds of fault, it is false.
530 return space
== ARMSS_Secure
&& regime_is_stage2(s2_mmu_idx
)
531 && s2_mmu_idx
== ARMMMUIdx_Stage2_S
;
534 /* Translate a S1 pagetable walk through S2 if needed. */
535 static bool S1_ptw_translate(CPUARMState
*env
, S1Translate
*ptw
,
536 hwaddr addr
, ARMMMUFaultInfo
*fi
)
538 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
539 ARMMMUIdx s2_mmu_idx
= ptw
->in_ptw_idx
;
542 ptw
->out_virt
= addr
;
544 if (unlikely(ptw
->in_debug
)) {
546 * From gdbstub, do not use softmmu so that we don't modify the
547 * state of the cpu at all, including softmmu tlb contents.
549 ARMSecuritySpace s2_space
= S2_security_space(ptw
->in_space
, s2_mmu_idx
);
550 S1Translate s2ptw
= {
551 .in_mmu_idx
= s2_mmu_idx
,
552 .in_ptw_idx
= ptw_idx_for_stage_2(env
, s2_mmu_idx
),
553 .in_space
= s2_space
,
556 GetPhysAddrResult s2
= { };
558 if (get_phys_addr_gpc(env
, &s2ptw
, addr
, MMU_DATA_LOAD
, &s2
, fi
)) {
562 ptw
->out_phys
= s2
.f
.phys_addr
;
563 pte_attrs
= s2
.cacheattrs
.attrs
;
564 ptw
->out_host
= NULL
;
566 ptw
->out_space
= s2
.f
.attrs
.space
;
569 CPUTLBEntryFull
*full
;
573 flags
= probe_access_full_mmu(env
, addr
, 0, MMU_DATA_LOAD
,
574 arm_to_core_mmu_idx(s2_mmu_idx
),
575 &ptw
->out_host
, &full
);
578 if (unlikely(flags
& TLB_INVALID_MASK
)) {
581 ptw
->out_phys
= full
->phys_addr
| (addr
& ~TARGET_PAGE_MASK
);
582 ptw
->out_rw
= full
->prot
& PAGE_WRITE
;
583 pte_attrs
= full
->extra
.arm
.pte_attrs
;
584 ptw
->out_space
= full
->attrs
.space
;
586 g_assert_not_reached();
590 if (regime_is_stage2(s2_mmu_idx
)) {
591 uint64_t hcr
= arm_hcr_el2_eff_secstate(env
, ptw
->in_space
);
593 if ((hcr
& HCR_PTW
) && S2_attrs_are_device(hcr
, pte_attrs
)) {
595 * PTW set and S1 walk touched S2 Device memory:
596 * generate Permission fault.
598 fi
->type
= ARMFault_Permission
;
602 fi
->s1ns
= fault_s1ns(ptw
->in_space
, s2_mmu_idx
);
607 ptw
->out_be
= regime_translation_big_endian(env
, mmu_idx
);
611 assert(fi
->type
!= ARMFault_None
);
612 if (fi
->type
== ARMFault_GPCFOnOutput
) {
613 fi
->type
= ARMFault_GPCFOnWalk
;
616 fi
->stage2
= regime_is_stage2(s2_mmu_idx
);
617 fi
->s1ptw
= fi
->stage2
;
618 fi
->s1ns
= fault_s1ns(ptw
->in_space
, s2_mmu_idx
);
622 /* All loads done in the course of a page table walk go through here. */
623 static uint32_t arm_ldl_ptw(CPUARMState
*env
, S1Translate
*ptw
,
626 CPUState
*cs
= env_cpu(env
);
627 void *host
= ptw
->out_host
;
631 /* Page tables are in RAM, and we have the host address. */
632 data
= qatomic_read((uint32_t *)host
);
634 data
= be32_to_cpu(data
);
636 data
= le32_to_cpu(data
);
639 /* Page tables are in MMIO. */
641 .space
= ptw
->out_space
,
642 .secure
= arm_space_is_secure(ptw
->out_space
),
644 AddressSpace
*as
= arm_addressspace(cs
, attrs
);
645 MemTxResult result
= MEMTX_OK
;
648 data
= address_space_ldl_be(as
, ptw
->out_phys
, attrs
, &result
);
650 data
= address_space_ldl_le(as
, ptw
->out_phys
, attrs
, &result
);
652 if (unlikely(result
!= MEMTX_OK
)) {
653 fi
->type
= ARMFault_SyncExternalOnWalk
;
654 fi
->ea
= arm_extabort_type(result
);
661 static uint64_t arm_ldq_ptw(CPUARMState
*env
, S1Translate
*ptw
,
664 CPUState
*cs
= env_cpu(env
);
665 void *host
= ptw
->out_host
;
669 /* Page tables are in RAM, and we have the host address. */
670 #ifdef CONFIG_ATOMIC64
671 data
= qatomic_read__nocheck((uint64_t *)host
);
673 data
= be64_to_cpu(data
);
675 data
= le64_to_cpu(data
);
679 data
= ldq_be_p(host
);
681 data
= ldq_le_p(host
);
685 /* Page tables are in MMIO. */
687 .space
= ptw
->out_space
,
688 .secure
= arm_space_is_secure(ptw
->out_space
),
690 AddressSpace
*as
= arm_addressspace(cs
, attrs
);
691 MemTxResult result
= MEMTX_OK
;
694 data
= address_space_ldq_be(as
, ptw
->out_phys
, attrs
, &result
);
696 data
= address_space_ldq_le(as
, ptw
->out_phys
, attrs
, &result
);
698 if (unlikely(result
!= MEMTX_OK
)) {
699 fi
->type
= ARMFault_SyncExternalOnWalk
;
700 fi
->ea
= arm_extabort_type(result
);
707 static uint64_t arm_casq_ptw(CPUARMState
*env
, uint64_t old_val
,
708 uint64_t new_val
, S1Translate
*ptw
,
711 #if defined(TARGET_AARCH64) && defined(CONFIG_TCG)
713 void *host
= ptw
->out_host
;
715 if (unlikely(!host
)) {
716 fi
->type
= ARMFault_UnsuppAtomicUpdate
;
721 * Raising a stage2 Protection fault for an atomic update to a read-only
722 * page is delayed until it is certain that there is a change to make.
724 if (unlikely(!ptw
->out_rw
)) {
728 flags
= probe_access_full_mmu(env
, ptw
->out_virt
, 0,
730 arm_to_core_mmu_idx(ptw
->in_ptw_idx
),
734 if (unlikely(flags
& TLB_INVALID_MASK
)) {
736 * We know this must be a stage 2 fault because the granule
737 * protection table does not separately track read and write
738 * permission, so all GPC faults are caught in S1_ptw_translate():
739 * we only get here for "readable but not writeable".
741 assert(fi
->type
!= ARMFault_None
);
742 fi
->s2addr
= ptw
->out_virt
;
745 fi
->s1ns
= fault_s1ns(ptw
->in_space
, ptw
->in_ptw_idx
);
749 /* In case CAS mismatches and we loop, remember writability. */
753 #ifdef CONFIG_ATOMIC64
755 old_val
= cpu_to_be64(old_val
);
756 new_val
= cpu_to_be64(new_val
);
757 cur_val
= qatomic_cmpxchg__nocheck((uint64_t *)host
, old_val
, new_val
);
758 cur_val
= be64_to_cpu(cur_val
);
760 old_val
= cpu_to_le64(old_val
);
761 new_val
= cpu_to_le64(new_val
);
762 cur_val
= qatomic_cmpxchg__nocheck((uint64_t *)host
, old_val
, new_val
);
763 cur_val
= le64_to_cpu(cur_val
);
767 * We can't support the full 64-bit atomic cmpxchg on the host.
768 * Because this is only used for FEAT_HAFDBS, which is only for AA64,
769 * we know that TCG_OVERSIZED_GUEST is set, which means that we are
770 * running in round-robin mode and could only race with dma i/o.
772 #if !TCG_OVERSIZED_GUEST
773 # error "Unexpected configuration"
775 bool locked
= bql_locked();
780 cur_val
= ldq_be_p(host
);
781 if (cur_val
== old_val
) {
782 stq_be_p(host
, new_val
);
785 cur_val
= ldq_le_p(host
);
786 if (cur_val
== old_val
) {
787 stq_le_p(host
, new_val
);
797 /* AArch32 does not have FEAT_HADFS; non-TCG guests only use debug-mode. */
798 g_assert_not_reached();
802 static bool get_level1_table_address(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
803 uint32_t *table
, uint32_t address
)
805 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
806 uint64_t tcr
= regime_tcr(env
, mmu_idx
);
807 int maskshift
= extract32(tcr
, 0, 3);
808 uint32_t mask
= ~(((uint32_t)0xffffffffu
) >> maskshift
);
811 if (address
& mask
) {
812 if (tcr
& TTBCR_PD1
) {
813 /* Translation table walk disabled for TTBR1 */
816 *table
= regime_ttbr(env
, mmu_idx
, 1) & 0xffffc000;
818 if (tcr
& TTBCR_PD0
) {
819 /* Translation table walk disabled for TTBR0 */
822 base_mask
= ~((uint32_t)0x3fffu
>> maskshift
);
823 *table
= regime_ttbr(env
, mmu_idx
, 0) & base_mask
;
825 *table
|= (address
>> 18) & 0x3ffc;
830 * Translate section/page access permissions to page R/W protection flags
832 * @mmu_idx: MMU index indicating required translation regime
833 * @ap: The 3-bit access permissions (AP[2:0])
834 * @domain_prot: The 2-bit domain access permissions
835 * @is_user: TRUE if accessing from PL0
837 static int ap_to_rw_prot_is_user(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
838 int ap
, int domain_prot
, bool is_user
)
840 if (domain_prot
== 3) {
841 return PAGE_READ
| PAGE_WRITE
;
846 if (arm_feature(env
, ARM_FEATURE_V7
)) {
849 switch (regime_sctlr(env
, mmu_idx
) & (SCTLR_S
| SCTLR_R
)) {
851 return is_user
? 0 : PAGE_READ
;
858 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
863 return PAGE_READ
| PAGE_WRITE
;
866 return PAGE_READ
| PAGE_WRITE
;
867 case 4: /* Reserved. */
870 return is_user
? 0 : PAGE_READ
;
874 if (!arm_feature(env
, ARM_FEATURE_V6K
)) {
879 g_assert_not_reached();
884 * Translate section/page access permissions to page R/W protection flags
886 * @mmu_idx: MMU index indicating required translation regime
887 * @ap: The 3-bit access permissions (AP[2:0])
888 * @domain_prot: The 2-bit domain access permissions
890 static int ap_to_rw_prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
891 int ap
, int domain_prot
)
893 return ap_to_rw_prot_is_user(env
, mmu_idx
, ap
, domain_prot
,
894 regime_is_user(env
, mmu_idx
));
898 * Translate section/page access permissions to page R/W protection flags.
899 * @ap: The 2-bit simple AP (AP[2:1])
900 * @is_user: TRUE if accessing from PL0
902 static int simple_ap_to_rw_prot_is_user(int ap
, bool is_user
)
906 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
908 return PAGE_READ
| PAGE_WRITE
;
910 return is_user
? 0 : PAGE_READ
;
914 g_assert_not_reached();
918 static int simple_ap_to_rw_prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
, int ap
)
920 return simple_ap_to_rw_prot_is_user(ap
, regime_is_user(env
, mmu_idx
));
923 static bool get_phys_addr_v5(CPUARMState
*env
, S1Translate
*ptw
,
924 uint32_t address
, MMUAccessType access_type
,
925 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
937 /* Pagetable walk. */
938 /* Lookup l1 descriptor. */
939 if (!get_level1_table_address(env
, ptw
->in_mmu_idx
, &table
, address
)) {
940 /* Section translation fault if page walk is disabled by PD0 or PD1 */
941 fi
->type
= ARMFault_Translation
;
944 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
947 desc
= arm_ldl_ptw(env
, ptw
, fi
);
948 if (fi
->type
!= ARMFault_None
) {
952 domain
= (desc
>> 5) & 0x0f;
953 if (regime_el(env
, ptw
->in_mmu_idx
) == 1) {
954 dacr
= env
->cp15
.dacr_ns
;
956 dacr
= env
->cp15
.dacr_s
;
958 domain_prot
= (dacr
>> (domain
* 2)) & 3;
960 /* Section translation fault. */
961 fi
->type
= ARMFault_Translation
;
967 if (domain_prot
== 0 || domain_prot
== 2) {
968 fi
->type
= ARMFault_Domain
;
973 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
974 ap
= (desc
>> 10) & 3;
975 result
->f
.lg_page_size
= 20; /* 1MB */
977 /* Lookup l2 entry. */
979 /* Coarse pagetable. */
980 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
982 /* Fine pagetable. */
983 table
= (desc
& 0xfffff000) | ((address
>> 8) & 0xffc);
985 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
988 desc
= arm_ldl_ptw(env
, ptw
, fi
);
989 if (fi
->type
!= ARMFault_None
) {
993 case 0: /* Page translation fault. */
994 fi
->type
= ARMFault_Translation
;
996 case 1: /* 64k page. */
997 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
998 ap
= (desc
>> (4 + ((address
>> 13) & 6))) & 3;
999 result
->f
.lg_page_size
= 16;
1001 case 2: /* 4k page. */
1002 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
1003 ap
= (desc
>> (4 + ((address
>> 9) & 6))) & 3;
1004 result
->f
.lg_page_size
= 12;
1006 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
1008 /* ARMv6/XScale extended small page format */
1009 if (arm_feature(env
, ARM_FEATURE_XSCALE
)
1010 || arm_feature(env
, ARM_FEATURE_V6
)) {
1011 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
1012 result
->f
.lg_page_size
= 12;
1015 * UNPREDICTABLE in ARMv5; we choose to take a
1016 * page translation fault.
1018 fi
->type
= ARMFault_Translation
;
1022 phys_addr
= (desc
& 0xfffffc00) | (address
& 0x3ff);
1023 result
->f
.lg_page_size
= 10;
1025 ap
= (desc
>> 4) & 3;
1028 /* Never happens, but compiler isn't smart enough to tell. */
1029 g_assert_not_reached();
1032 result
->f
.prot
= ap_to_rw_prot(env
, ptw
->in_mmu_idx
, ap
, domain_prot
);
1033 result
->f
.prot
|= result
->f
.prot
? PAGE_EXEC
: 0;
1034 if (!(result
->f
.prot
& (1 << access_type
))) {
1035 /* Access permission fault. */
1036 fi
->type
= ARMFault_Permission
;
1039 result
->f
.phys_addr
= phys_addr
;
1042 fi
->domain
= domain
;
1047 static bool get_phys_addr_v6(CPUARMState
*env
, S1Translate
*ptw
,
1048 uint32_t address
, MMUAccessType access_type
,
1049 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
1051 ARMCPU
*cpu
= env_archcpu(env
);
1052 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
1067 /* Pagetable walk. */
1068 /* Lookup l1 descriptor. */
1069 if (!get_level1_table_address(env
, mmu_idx
, &table
, address
)) {
1070 /* Section translation fault if page walk is disabled by PD0 or PD1 */
1071 fi
->type
= ARMFault_Translation
;
1074 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
1077 desc
= arm_ldl_ptw(env
, ptw
, fi
);
1078 if (fi
->type
!= ARMFault_None
) {
1082 if (type
== 0 || (type
== 3 && !cpu_isar_feature(aa32_pxn
, cpu
))) {
1083 /* Section translation fault, or attempt to use the encoding
1084 * which is Reserved on implementations without PXN.
1086 fi
->type
= ARMFault_Translation
;
1089 if ((type
== 1) || !(desc
& (1 << 18))) {
1090 /* Page or Section. */
1091 domain
= (desc
>> 5) & 0x0f;
1093 if (regime_el(env
, mmu_idx
) == 1) {
1094 dacr
= env
->cp15
.dacr_ns
;
1096 dacr
= env
->cp15
.dacr_s
;
1101 domain_prot
= (dacr
>> (domain
* 2)) & 3;
1102 if (domain_prot
== 0 || domain_prot
== 2) {
1103 /* Section or Page domain fault */
1104 fi
->type
= ARMFault_Domain
;
1108 if (desc
& (1 << 18)) {
1110 phys_addr
= (desc
& 0xff000000) | (address
& 0x00ffffff);
1111 phys_addr
|= (uint64_t)extract32(desc
, 20, 4) << 32;
1112 phys_addr
|= (uint64_t)extract32(desc
, 5, 4) << 36;
1113 result
->f
.lg_page_size
= 24; /* 16MB */
1116 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
1117 result
->f
.lg_page_size
= 20; /* 1MB */
1119 ap
= ((desc
>> 10) & 3) | ((desc
>> 13) & 4);
1120 xn
= desc
& (1 << 4);
1122 ns
= extract32(desc
, 19, 1);
1124 if (cpu_isar_feature(aa32_pxn
, cpu
)) {
1125 pxn
= (desc
>> 2) & 1;
1127 ns
= extract32(desc
, 3, 1);
1128 /* Lookup l2 entry. */
1129 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
1130 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
1133 desc
= arm_ldl_ptw(env
, ptw
, fi
);
1134 if (fi
->type
!= ARMFault_None
) {
1137 ap
= ((desc
>> 4) & 3) | ((desc
>> 7) & 4);
1139 case 0: /* Page translation fault. */
1140 fi
->type
= ARMFault_Translation
;
1142 case 1: /* 64k page. */
1143 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
1144 xn
= desc
& (1 << 15);
1145 result
->f
.lg_page_size
= 16;
1147 case 2: case 3: /* 4k page. */
1148 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
1150 result
->f
.lg_page_size
= 12;
1153 /* Never happens, but compiler isn't smart enough to tell. */
1154 g_assert_not_reached();
1157 if (domain_prot
== 3) {
1158 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
1160 if (pxn
&& !regime_is_user(env
, mmu_idx
)) {
1163 if (xn
&& access_type
== MMU_INST_FETCH
) {
1164 fi
->type
= ARMFault_Permission
;
1168 if (arm_feature(env
, ARM_FEATURE_V6K
) &&
1169 (regime_sctlr(env
, mmu_idx
) & SCTLR_AFE
)) {
1170 /* The simplified model uses AP[0] as an access control bit. */
1171 if ((ap
& 1) == 0) {
1172 /* Access flag fault. */
1173 fi
->type
= ARMFault_AccessFlag
;
1176 result
->f
.prot
= simple_ap_to_rw_prot(env
, mmu_idx
, ap
>> 1);
1177 user_prot
= simple_ap_to_rw_prot_is_user(ap
>> 1, 1);
1179 result
->f
.prot
= ap_to_rw_prot(env
, mmu_idx
, ap
, domain_prot
);
1180 user_prot
= ap_to_rw_prot_is_user(env
, mmu_idx
, ap
, domain_prot
, 1);
1182 if (result
->f
.prot
&& !xn
) {
1183 result
->f
.prot
|= PAGE_EXEC
;
1185 if (!(result
->f
.prot
& (1 << access_type
))) {
1186 /* Access permission fault. */
1187 fi
->type
= ARMFault_Permission
;
1190 if (regime_is_pan(env
, mmu_idx
) &&
1191 !regime_is_user(env
, mmu_idx
) &&
1193 access_type
!= MMU_INST_FETCH
) {
1194 /* Privileged Access Never fault */
1195 fi
->type
= ARMFault_Permission
;
1200 /* The NS bit will (as required by the architecture) have no effect if
1201 * the CPU doesn't support TZ or this is a non-secure translation
1202 * regime, because the attribute will already be non-secure.
1204 result
->f
.attrs
.secure
= false;
1205 result
->f
.attrs
.space
= ARMSS_NonSecure
;
1207 result
->f
.phys_addr
= phys_addr
;
1210 fi
->domain
= domain
;
1216 * Translate S2 section/page access permissions to protection flags
1218 * @s2ap: The 2-bit stage2 access permissions (S2AP)
1219 * @xn: XN (execute-never) bits
1220 * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
1222 static int get_S2prot_noexecute(int s2ap
)
1235 static int get_S2prot(CPUARMState
*env
, int s2ap
, int xn
, bool s1_is_el0
)
1237 int prot
= get_S2prot_noexecute(s2ap
);
1239 if (cpu_isar_feature(any_tts2uxn
, env_archcpu(env
))) {
1257 g_assert_not_reached();
1260 if (!extract32(xn
, 1, 1)) {
1261 if (arm_el_is_aa64(env
, 2) || prot
& PAGE_READ
) {
1270 * Translate section/page access permissions to protection flags
1272 * @mmu_idx: MMU index indicating required translation regime
1273 * @is_aa64: TRUE if AArch64
1274 * @ap: The 2-bit simple AP (AP[2:1])
1275 * @xn: XN (execute-never) bit
1276 * @pxn: PXN (privileged execute-never) bit
1277 * @in_pa: The original input pa space
1278 * @out_pa: The output pa space, modified by NSTable, NS, and NSE
1280 static int get_S1prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
, bool is_aa64
,
1281 int ap
, int xn
, int pxn
,
1282 ARMSecuritySpace in_pa
, ARMSecuritySpace out_pa
)
1284 ARMCPU
*cpu
= env_archcpu(env
);
1285 bool is_user
= regime_is_user(env
, mmu_idx
);
1286 int prot_rw
, user_rw
;
1290 assert(!regime_is_stage2(mmu_idx
));
1292 user_rw
= simple_ap_to_rw_prot_is_user(ap
, true);
1297 * PAN controls can forbid data accesses but don't affect insn fetch.
1298 * Plain PAN forbids data accesses if EL0 has data permissions;
1299 * PAN3 forbids data accesses if EL0 has either data or exec perms.
1300 * Note that for AArch64 the 'user can exec' case is exactly !xn.
1301 * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0
1302 * do not affect EPAN.
1304 if (user_rw
&& regime_is_pan(env
, mmu_idx
)) {
1306 } else if (cpu_isar_feature(aa64_pan3
, cpu
) && is_aa64
&&
1307 regime_is_pan(env
, mmu_idx
) &&
1308 (regime_sctlr(env
, mmu_idx
) & SCTLR_EPAN
) && !xn
) {
1311 prot_rw
= simple_ap_to_rw_prot_is_user(ap
, false);
1315 if (in_pa
!= out_pa
) {
1319 * R_ZWRVD: permission fault for insn fetched from non-Root,
1320 * I_WWBFB: SIF has no effect in EL3.
1325 * R_PKTDS: permission fault for insn fetched from non-Realm,
1326 * for Realm EL2 or EL2&0. The corresponding fault for EL1&0
1327 * happens during any stage2 translation.
1331 case ARMMMUIdx_E20_0
:
1332 case ARMMMUIdx_E20_2
:
1333 case ARMMMUIdx_E20_2_PAN
:
1340 if (env
->cp15
.scr_el3
& SCR_SIF
) {
1345 /* Input NonSecure must have output NonSecure. */
1346 g_assert_not_reached();
1350 /* TODO have_wxn should be replaced with
1351 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
1352 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
1353 * compatible processors have EL2, which is required for [U]WXN.
1355 have_wxn
= arm_feature(env
, ARM_FEATURE_LPAE
);
1358 wxn
= regime_sctlr(env
, mmu_idx
) & SCTLR_WXN
;
1362 if (regime_has_2_ranges(mmu_idx
) && !is_user
) {
1363 xn
= pxn
|| (user_rw
& PAGE_WRITE
);
1365 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
1366 switch (regime_el(env
, mmu_idx
)) {
1370 xn
= xn
|| !(user_rw
& PAGE_READ
);
1374 uwxn
= regime_sctlr(env
, mmu_idx
) & SCTLR_UWXN
;
1376 xn
= xn
|| !(prot_rw
& PAGE_READ
) || pxn
||
1377 (uwxn
&& (user_rw
& PAGE_WRITE
));
1387 if (xn
|| (wxn
&& (prot_rw
& PAGE_WRITE
))) {
1390 return prot_rw
| PAGE_EXEC
;
1393 static ARMVAParameters
aa32_va_parameters(CPUARMState
*env
, uint32_t va
,
1396 uint64_t tcr
= regime_tcr(env
, mmu_idx
);
1397 uint32_t el
= regime_el(env
, mmu_idx
);
1401 assert(mmu_idx
!= ARMMMUIdx_Stage2_S
);
1403 if (mmu_idx
== ARMMMUIdx_Stage2
) {
1405 bool sext
= extract32(tcr
, 4, 1);
1406 bool sign
= extract32(tcr
, 3, 1);
1409 * If the sign-extend bit is not the same as t0sz[3], the result
1410 * is unpredictable. Flag this as a guest error.
1413 qemu_log_mask(LOG_GUEST_ERROR
,
1414 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
1416 tsz
= sextract32(tcr
, 0, 4) + 8;
1420 } else if (el
== 2) {
1422 tsz
= extract32(tcr
, 0, 3);
1424 hpd
= extract64(tcr
, 24, 1);
1427 int t0sz
= extract32(tcr
, 0, 3);
1428 int t1sz
= extract32(tcr
, 16, 3);
1431 select
= va
> (0xffffffffu
>> t0sz
);
1433 /* Note that we will detect errors later. */
1434 select
= va
>= ~(0xffffffffu
>> t1sz
);
1438 epd
= extract32(tcr
, 7, 1);
1439 hpd
= extract64(tcr
, 41, 1);
1442 epd
= extract32(tcr
, 23, 1);
1443 hpd
= extract64(tcr
, 42, 1);
1445 /* For aarch32, hpd0 is not enabled without t2e as well. */
1446 hpd
&= extract32(tcr
, 6, 1);
1449 return (ARMVAParameters
) {
1458 * check_s2_mmu_setup
1460 * @is_aa64: True if the translation regime is in AArch64 state
1461 * @tcr: VTCR_EL2 or VSTCR_EL2
1462 * @ds: Effective value of TCR.DS.
1463 * @iasize: Bitsize of IPAs
1464 * @stride: Page-table stride (See the ARM ARM)
1466 * Decode the starting level of the S2 lookup, returning INT_MIN if
1467 * the configuration is invalid.
1469 static int check_s2_mmu_setup(ARMCPU
*cpu
, bool is_aa64
, uint64_t tcr
,
1470 bool ds
, int iasize
, int stride
)
1472 int sl0
, sl2
, startlevel
, granulebits
, levels
;
1473 int s1_min_iasize
, s1_max_iasize
;
1475 sl0
= extract32(tcr
, 6, 2);
1478 * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
1479 * so interleave AArch64.S2StartLevel.
1483 /* SL2 is RES0 unless DS=1 & 4KB granule. */
1484 sl2
= extract64(tcr
, 33, 1);
1491 startlevel
= 2 - sl0
;
1494 if (arm_pamax(cpu
) < 44) {
1499 if (!cpu_isar_feature(aa64_st
, cpu
)) {
1510 if (arm_pamax(cpu
) < 42) {
1520 startlevel
= 3 - sl0
;
1525 if (arm_pamax(cpu
) < 44) {
1532 startlevel
= 3 - sl0
;
1535 g_assert_not_reached();
1539 * Things are simpler for AArch32 EL2, with only 4k pages.
1540 * There is no separate S2InvalidSL function, but AArch32.S2Walk
1541 * begins with walkparms.sl0 in {'1x'}.
1543 assert(stride
== 9);
1547 startlevel
= 2 - sl0
;
1550 /* AArch{64,32}.S2InconsistentSL are functionally equivalent. */
1551 levels
= 3 - startlevel
;
1552 granulebits
= stride
+ 3;
1554 s1_min_iasize
= levels
* stride
+ granulebits
+ 1;
1555 s1_max_iasize
= s1_min_iasize
+ (stride
- 1) + 4;
1557 if (iasize
>= s1_min_iasize
&& iasize
<= s1_max_iasize
) {
1565 static bool lpae_block_desc_valid(ARMCPU
*cpu
, bool ds
,
1566 ARMGranuleSize gran
, int level
)
1569 * See pseudocode AArch46.BlockDescSupported(): block descriptors
1570 * are not valid at all levels, depending on the page size.
1574 return (level
== 0 && ds
) || level
== 1 || level
== 2;
1576 return (level
== 1 && ds
) || level
== 2;
1578 return (level
== 1 && arm_pamax(cpu
) == 52) || level
== 2;
1580 g_assert_not_reached();
1584 static bool nv_nv1_enabled(CPUARMState
*env
, S1Translate
*ptw
)
1586 uint64_t hcr
= arm_hcr_el2_eff_secstate(env
, ptw
->in_space
);
1587 return (hcr
& (HCR_NV
| HCR_NV1
)) == (HCR_NV
| HCR_NV1
);
1591 * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
1593 * Returns false if the translation was successful. Otherwise, phys_ptr,
1594 * attrs, prot and page_size may not be filled in, and the populated fsr
1595 * value provides information on why the translation aborted, in the format
1596 * of a long-format DFSR/IFSR fault register, with the following caveat:
1597 * the WnR bit is never set (the caller must do this).
1600 * @ptw: Current and next stage parameters for the walk.
1601 * @address: virtual address to get physical address for
1602 * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
1603 * @result: set on translation success,
1604 * @fi: set to fault info if the translation fails
1606 static bool get_phys_addr_lpae(CPUARMState
*env
, S1Translate
*ptw
,
1608 MMUAccessType access_type
,
1609 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
1611 ARMCPU
*cpu
= env_archcpu(env
);
1612 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
1614 ARMVAParameters param
;
1616 hwaddr descaddr
, indexmask
, indexmask_grainsize
;
1617 uint32_t tableattrs
;
1618 target_ulong page_size
;
1621 int addrsize
, inputsize
, outputsize
;
1622 uint64_t tcr
= regime_tcr(env
, mmu_idx
);
1624 uint32_t el
= regime_el(env
, mmu_idx
);
1625 uint64_t descaddrmask
;
1626 bool aarch64
= arm_el_is_aa64(env
, el
);
1627 uint64_t descriptor
, new_descriptor
;
1628 ARMSecuritySpace out_space
;
1630 /* TODO: This code does not support shareability levels. */
1634 param
= aa64_va_parameters(env
, address
, mmu_idx
,
1635 access_type
!= MMU_INST_FETCH
,
1636 !arm_el_is_aa64(env
, 1));
1640 * If TxSZ is programmed to a value larger than the maximum,
1641 * or smaller than the effective minimum, it is IMPLEMENTATION
1642 * DEFINED whether we behave as if the field were programmed
1643 * within bounds, or if a level 0 Translation fault is generated.
1645 * With FEAT_LVA, fault on less than minimum becomes required,
1646 * so our choice is to always raise the fault.
1648 if (param
.tsz_oob
) {
1649 goto do_translation_fault
;
1652 addrsize
= 64 - 8 * param
.tbi
;
1653 inputsize
= 64 - param
.tsz
;
1656 * Bound PS by PARANGE to find the effective output address size.
1657 * ID_AA64MMFR0 is a read-only register so values outside of the
1658 * supported mappings can be considered an implementation error.
1660 ps
= FIELD_EX64(cpu
->isar
.id_aa64mmfr0
, ID_AA64MMFR0
, PARANGE
);
1661 ps
= MIN(ps
, param
.ps
);
1662 assert(ps
< ARRAY_SIZE(pamax_map
));
1663 outputsize
= pamax_map
[ps
];
1666 * With LPA2, the effective output address (OA) size is at most 48 bits
1667 * unless TCR.DS == 1
1669 if (!param
.ds
&& param
.gran
!= Gran64K
) {
1670 outputsize
= MIN(outputsize
, 48);
1673 param
= aa32_va_parameters(env
, address
, mmu_idx
);
1675 addrsize
= (mmu_idx
== ARMMMUIdx_Stage2
? 40 : 32);
1676 inputsize
= addrsize
- param
.tsz
;
1681 * We determined the region when collecting the parameters, but we
1682 * have not yet validated that the address is valid for the region.
1683 * Extract the top bits and verify that they all match select.
1685 * For aa32, if inputsize == addrsize, then we have selected the
1686 * region by exclusion in aa32_va_parameters and there is no more
1687 * validation to do here.
1689 if (inputsize
< addrsize
) {
1690 target_ulong top_bits
= sextract64(address
, inputsize
,
1691 addrsize
- inputsize
);
1692 if (-top_bits
!= param
.select
) {
1693 /* The gap between the two regions is a Translation fault */
1694 goto do_translation_fault
;
1698 stride
= arm_granule_bits(param
.gran
) - 3;
1701 * Note that QEMU ignores shareability and cacheability attributes,
1702 * so we don't need to do anything with the SH, ORGN, IRGN fields
1703 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
1704 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
1705 * implement any ASID-like capability so we can ignore it (instead
1706 * we will always flush the TLB any time the ASID is changed).
1708 ttbr
= regime_ttbr(env
, mmu_idx
, param
.select
);
1711 * Here we should have set up all the parameters for the translation:
1712 * inputsize, ttbr, epd, stride, tbi
1717 * Translation table walk disabled => Translation fault on TLB miss
1718 * Note: This is always 0 on 64-bit EL2 and EL3.
1720 goto do_translation_fault
;
1723 if (!regime_is_stage2(mmu_idx
)) {
1725 * The starting level depends on the virtual address size (which can
1726 * be up to 48 bits) and the translation granule size. It indicates
1727 * the number of strides (stride bits at a time) needed to
1728 * consume the bits of the input address. In the pseudocode this is:
1729 * level = 4 - RoundUp((inputsize - grainsize) / stride)
1730 * where their 'inputsize' is our 'inputsize', 'grainsize' is
1731 * our 'stride + 3' and 'stride' is our 'stride'.
1732 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
1733 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
1734 * = 4 - (inputsize - 4) / stride;
1736 level
= 4 - (inputsize
- 4) / stride
;
1738 int startlevel
= check_s2_mmu_setup(cpu
, aarch64
, tcr
, param
.ds
,
1740 if (startlevel
== INT_MIN
) {
1742 goto do_translation_fault
;
1747 indexmask_grainsize
= MAKE_64BIT_MASK(0, stride
+ 3);
1748 indexmask
= MAKE_64BIT_MASK(0, inputsize
- (stride
* (4 - level
)));
1750 /* Now we can extract the actual base address from the TTBR */
1751 descaddr
= extract64(ttbr
, 0, 48);
1754 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
1756 * Otherwise, if the base address is out of range, raise AddressSizeFault.
1757 * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
1758 * but we've just cleared the bits above 47, so simplify the test.
1760 if (outputsize
> 48) {
1761 descaddr
|= extract64(ttbr
, 2, 4) << 48;
1762 } else if (descaddr
>> outputsize
) {
1764 fi
->type
= ARMFault_AddressSize
;
1769 * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
1770 * and also to mask out CnP (bit 0) which could validly be non-zero.
1772 descaddr
&= ~indexmask
;
1775 * For AArch32, the address field in the descriptor goes up to bit 39
1776 * for both v7 and v8. However, for v8 the SBZ bits [47:40] must be 0
1777 * or an AddressSize fault is raised. So for v8 we extract those SBZ
1778 * bits as part of the address, which will be checked via outputsize.
1779 * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
1780 * the highest bits of a 52-bit output are placed elsewhere.
1783 descaddrmask
= MAKE_64BIT_MASK(0, 50);
1784 } else if (arm_feature(env
, ARM_FEATURE_V8
)) {
1785 descaddrmask
= MAKE_64BIT_MASK(0, 48);
1787 descaddrmask
= MAKE_64BIT_MASK(0, 40);
1789 descaddrmask
&= ~indexmask_grainsize
;
1793 descaddr
|= (address
>> (stride
* (4 - level
))) & indexmask
;
1797 * Process the NSTable bit from the previous level. This changes
1798 * the table address space and the output space from Secure to
1799 * NonSecure. With RME, the EL3 translation regime does not change
1800 * from Root to NonSecure.
1802 if (ptw
->in_space
== ARMSS_Secure
1803 && !regime_is_stage2(mmu_idx
)
1804 && extract32(tableattrs
, 4, 1)) {
1806 * Stage2_S -> Stage2 or Phys_S -> Phys_NS
1807 * Assert the relative order of the secure/non-secure indexes.
1809 QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S
+ 1 != ARMMMUIdx_Phys_NS
);
1810 QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S
+ 1 != ARMMMUIdx_Stage2
);
1811 ptw
->in_ptw_idx
+= 1;
1812 ptw
->in_space
= ARMSS_NonSecure
;
1815 if (!S1_ptw_translate(env
, ptw
, descaddr
, fi
)) {
1818 descriptor
= arm_ldq_ptw(env
, ptw
, fi
);
1819 if (fi
->type
!= ARMFault_None
) {
1822 new_descriptor
= descriptor
;
1824 restart_atomic_update
:
1825 if (!(descriptor
& 1) ||
1826 (!(descriptor
& 2) &&
1827 !lpae_block_desc_valid(cpu
, param
.ds
, param
.gran
, level
))) {
1828 /* Invalid, or a block descriptor at an invalid level */
1829 goto do_translation_fault
;
1832 descaddr
= descriptor
& descaddrmask
;
1835 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
1836 * of descriptor. For FEAT_LPA2 and effective DS, bits [51:50] of
1837 * descaddr are in [9:8]. Otherwise, if descaddr is out of range,
1838 * raise AddressSizeFault.
1840 if (outputsize
> 48) {
1842 descaddr
|= extract64(descriptor
, 8, 2) << 50;
1844 descaddr
|= extract64(descriptor
, 12, 4) << 48;
1846 } else if (descaddr
>> outputsize
) {
1847 fi
->type
= ARMFault_AddressSize
;
1851 if ((descriptor
& 2) && (level
< 3)) {
1853 * Table entry. The top five bits are attributes which may
1854 * propagate down through lower levels of the table (and
1855 * which are all arranged so that 0 means "no effect", so
1856 * we can gather them up by ORing in the bits at each level).
1858 tableattrs
|= extract64(descriptor
, 59, 5);
1860 indexmask
= indexmask_grainsize
;
1865 * Block entry at level 1 or 2, or page entry at level 3.
1866 * These are basically the same thing, although the number
1867 * of bits we pull in from the vaddr varies. Note that although
1868 * descaddrmask masks enough of the low bits of the descriptor
1869 * to give a correct page or table address, the address field
1870 * in a block descriptor is smaller; so we need to explicitly
1871 * clear the lower bits here before ORing in the low vaddr bits.
1873 * Afterward, descaddr is the final physical address.
1875 page_size
= (1ULL << ((stride
* (4 - level
)) + 3));
1876 descaddr
&= ~(hwaddr
)(page_size
- 1);
1877 descaddr
|= (address
& (page_size
- 1));
1879 if (likely(!ptw
->in_debug
)) {
1882 * If HA is enabled, prepare to update the descriptor below.
1883 * Otherwise, pass the access fault on to software.
1885 if (!(descriptor
& (1 << 10))) {
1887 new_descriptor
|= 1 << 10; /* AF */
1889 fi
->type
= ARMFault_AccessFlag
;
1896 * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
1897 * bit for writeback. The actual write protection test may still be
1898 * overridden by tableattrs, to be merged below.
1901 && extract64(descriptor
, 51, 1) /* DBM */
1902 && access_type
== MMU_DATA_STORE
) {
1903 if (regime_is_stage2(mmu_idx
)) {
1904 new_descriptor
|= 1ull << 7; /* set S2AP[1] */
1906 new_descriptor
&= ~(1ull << 7); /* clear AP[2] */
1912 * Extract attributes from the (modified) descriptor, and apply
1913 * table descriptors. Stage 2 table descriptors do not include
1914 * any attribute fields. HPD disables all the table attributes
1915 * except NSTable (which we have already handled).
1917 attrs
= new_descriptor
& (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
1918 if (!regime_is_stage2(mmu_idx
)) {
1920 attrs
|= extract64(tableattrs
, 0, 2) << 53; /* XN, PXN */
1922 * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
1923 * means "force PL1 access only", which means forcing AP[1] to 0.
1925 attrs
&= ~(extract64(tableattrs
, 2, 1) << 6); /* !APT[0] => AP[1] */
1926 attrs
|= extract32(tableattrs
, 3, 1) << 7; /* APT[1] => AP[2] */
1930 ap
= extract32(attrs
, 6, 2);
1931 out_space
= ptw
->in_space
;
1932 if (regime_is_stage2(mmu_idx
)) {
1934 * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
1935 * The bit remains ignored for other security states.
1936 * R_YMCSL: Executing an insn fetched from non-Realm causes
1937 * a stage2 permission fault.
1939 if (out_space
== ARMSS_Realm
&& extract64(attrs
, 55, 1)) {
1940 out_space
= ARMSS_NonSecure
;
1941 result
->f
.prot
= get_S2prot_noexecute(ap
);
1943 xn
= extract64(attrs
, 53, 2);
1944 result
->f
.prot
= get_S2prot(env
, ap
, xn
, ptw
->in_s1_is_el0
);
1947 int nse
, ns
= extract32(attrs
, 5, 1);
1948 switch (out_space
) {
1951 * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
1952 * R_XTYPW: NSE and NS together select the output pa space.
1954 nse
= extract32(attrs
, 11, 1);
1955 out_space
= (nse
<< 1) | ns
;
1956 if (out_space
== ARMSS_Secure
&&
1957 !cpu_isar_feature(aa64_sel2
, cpu
)) {
1958 out_space
= ARMSS_NonSecure
;
1963 out_space
= ARMSS_NonSecure
;
1968 case ARMMMUIdx_Stage1_E0
:
1969 case ARMMMUIdx_Stage1_E1
:
1970 case ARMMMUIdx_Stage1_E1_PAN
:
1971 /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
1974 case ARMMMUIdx_E20_0
:
1975 case ARMMMUIdx_E20_2
:
1976 case ARMMMUIdx_E20_2_PAN
:
1978 * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
1979 * NS changes the output to non-secure space.
1982 out_space
= ARMSS_NonSecure
;
1986 g_assert_not_reached();
1989 case ARMSS_NonSecure
:
1990 /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
1993 g_assert_not_reached();
1995 xn
= extract64(attrs
, 54, 1);
1996 pxn
= extract64(attrs
, 53, 1);
1998 if (el
== 1 && nv_nv1_enabled(env
, ptw
)) {
2000 * With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1}, the block/page
2001 * descriptor bit 54 holds PXN, 53 is RES0, and the effective value
2002 * of UXN is 0. Similarly for bits 59 and 60 in table descriptors
2003 * (which we have already folded into bits 53 and 54 of attrs).
2004 * AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
2005 * Similarly, APTable[0] from the table descriptor is treated as 0;
2006 * we already folded this into AP[1] and squashing that to 0 does
2014 * Note that we modified ptw->in_space earlier for NSTable, but
2015 * result->f.attrs retains a copy of the original security space.
2017 result
->f
.prot
= get_S1prot(env
, mmu_idx
, aarch64
, ap
, xn
, pxn
,
2018 result
->f
.attrs
.space
, out_space
);
2021 if (!(result
->f
.prot
& (1 << access_type
))) {
2022 fi
->type
= ARMFault_Permission
;
2026 /* If FEAT_HAFDBS has made changes, update the PTE. */
2027 if (new_descriptor
!= descriptor
) {
2028 new_descriptor
= arm_casq_ptw(env
, descriptor
, new_descriptor
, ptw
, fi
);
2029 if (fi
->type
!= ARMFault_None
) {
2033 * I_YZSVV says that if the in-memory descriptor has changed,
2034 * then we must use the information in that new value
2035 * (which might include a different output address, different
2036 * attributes, or generate a fault).
2037 * Restart the handling of the descriptor value from scratch.
2039 if (new_descriptor
!= descriptor
) {
2040 descriptor
= new_descriptor
;
2041 goto restart_atomic_update
;
2045 result
->f
.attrs
.space
= out_space
;
2046 result
->f
.attrs
.secure
= arm_space_is_secure(out_space
);
2048 if (regime_is_stage2(mmu_idx
)) {
2049 result
->cacheattrs
.is_s2_format
= true;
2050 result
->cacheattrs
.attrs
= extract32(attrs
, 2, 4);
2052 /* Index into MAIR registers for cache attributes */
2053 uint8_t attrindx
= extract32(attrs
, 2, 3);
2054 uint64_t mair
= env
->cp15
.mair_el
[regime_el(env
, mmu_idx
)];
2055 assert(attrindx
<= 7);
2056 result
->cacheattrs
.is_s2_format
= false;
2057 result
->cacheattrs
.attrs
= extract64(mair
, attrindx
* 8, 8);
2059 /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
2060 if (aarch64
&& cpu_isar_feature(aa64_bti
, cpu
)) {
2061 result
->f
.extra
.arm
.guarded
= extract64(attrs
, 50, 1); /* GP */
2066 * For FEAT_LPA2 and effective DS, the SH field in the attributes
2067 * was re-purposed for output address bits. The SH attribute in
2068 * that case comes from TCR_ELx, which we extracted earlier.
2071 result
->cacheattrs
.shareability
= param
.sh
;
2073 result
->cacheattrs
.shareability
= extract32(attrs
, 8, 2);
2076 result
->f
.phys_addr
= descaddr
;
2077 result
->f
.lg_page_size
= ctz64(page_size
);
2080 do_translation_fault
:
2081 fi
->type
= ARMFault_Translation
;
2084 /* Retain the existing stage 2 fi->level */
2088 fi
->stage2
= regime_is_stage2(mmu_idx
);
2090 fi
->s1ns
= fault_s1ns(ptw
->in_space
, mmu_idx
);
2094 static bool get_phys_addr_pmsav5(CPUARMState
*env
,
2097 MMUAccessType access_type
,
2098 GetPhysAddrResult
*result
,
2099 ARMMMUFaultInfo
*fi
)
2104 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
2105 bool is_user
= regime_is_user(env
, mmu_idx
);
2107 if (regime_translation_disabled(env
, mmu_idx
, ptw
->in_space
)) {
2109 result
->f
.phys_addr
= address
;
2110 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
2114 result
->f
.phys_addr
= address
;
2115 for (n
= 7; n
>= 0; n
--) {
2116 base
= env
->cp15
.c6_region
[n
];
2117 if ((base
& 1) == 0) {
2120 mask
= 1 << ((base
>> 1) & 0x1f);
2121 /* Keep this shift separate from the above to avoid an
2122 (undefined) << 32. */
2123 mask
= (mask
<< 1) - 1;
2124 if (((base
^ address
) & ~mask
) == 0) {
2129 fi
->type
= ARMFault_Background
;
2133 if (access_type
== MMU_INST_FETCH
) {
2134 mask
= env
->cp15
.pmsav5_insn_ap
;
2136 mask
= env
->cp15
.pmsav5_data_ap
;
2138 mask
= (mask
>> (n
* 4)) & 0xf;
2141 fi
->type
= ARMFault_Permission
;
2146 fi
->type
= ARMFault_Permission
;
2150 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
;
2153 result
->f
.prot
= PAGE_READ
;
2155 result
->f
.prot
|= PAGE_WRITE
;
2159 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
;
2163 fi
->type
= ARMFault_Permission
;
2167 result
->f
.prot
= PAGE_READ
;
2170 result
->f
.prot
= PAGE_READ
;
2173 /* Bad permission. */
2174 fi
->type
= ARMFault_Permission
;
2178 result
->f
.prot
|= PAGE_EXEC
;
2182 static void get_phys_addr_pmsav7_default(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
2183 int32_t address
, uint8_t *prot
)
2185 if (!arm_feature(env
, ARM_FEATURE_M
)) {
2186 *prot
= PAGE_READ
| PAGE_WRITE
;
2188 case 0xF0000000 ... 0xFFFFFFFF:
2189 if (regime_sctlr(env
, mmu_idx
) & SCTLR_V
) {
2190 /* hivecs execing is ok */
2194 case 0x00000000 ... 0x7FFFFFFF:
2199 /* Default system address map for M profile cores.
2200 * The architecture specifies which regions are execute-never;
2201 * at the MPU level no other checks are defined.
2204 case 0x00000000 ... 0x1fffffff: /* ROM */
2205 case 0x20000000 ... 0x3fffffff: /* SRAM */
2206 case 0x60000000 ... 0x7fffffff: /* RAM */
2207 case 0x80000000 ... 0x9fffffff: /* RAM */
2208 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
2210 case 0x40000000 ... 0x5fffffff: /* Peripheral */
2211 case 0xa0000000 ... 0xbfffffff: /* Device */
2212 case 0xc0000000 ... 0xdfffffff: /* Device */
2213 case 0xe0000000 ... 0xffffffff: /* System */
2214 *prot
= PAGE_READ
| PAGE_WRITE
;
2217 g_assert_not_reached();
2222 static bool m_is_ppb_region(CPUARMState
*env
, uint32_t address
)
2224 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
2225 return arm_feature(env
, ARM_FEATURE_M
) &&
2226 extract32(address
, 20, 12) == 0xe00;
2229 static bool m_is_system_region(CPUARMState
*env
, uint32_t address
)
2232 * True if address is in the M profile system region
2233 * 0xe0000000 - 0xffffffff
2235 return arm_feature(env
, ARM_FEATURE_M
) && extract32(address
, 29, 3) == 0x7;
2238 static bool pmsav7_use_background_region(ARMCPU
*cpu
, ARMMMUIdx mmu_idx
,
2239 bool is_secure
, bool is_user
)
2242 * Return true if we should use the default memory map as a
2243 * "background" region if there are no hits against any MPU regions.
2245 CPUARMState
*env
= &cpu
->env
;
2251 if (arm_feature(env
, ARM_FEATURE_M
)) {
2252 return env
->v7m
.mpu_ctrl
[is_secure
] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK
;
2255 if (mmu_idx
== ARMMMUIdx_Stage2
) {
2259 return regime_sctlr(env
, mmu_idx
) & SCTLR_BR
;
2262 static bool get_phys_addr_pmsav7(CPUARMState
*env
,
2265 MMUAccessType access_type
,
2266 GetPhysAddrResult
*result
,
2267 ARMMMUFaultInfo
*fi
)
2269 ARMCPU
*cpu
= env_archcpu(env
);
2271 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
2272 bool is_user
= regime_is_user(env
, mmu_idx
);
2273 bool secure
= arm_space_is_secure(ptw
->in_space
);
2275 result
->f
.phys_addr
= address
;
2276 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
2279 if (regime_translation_disabled(env
, mmu_idx
, ptw
->in_space
) ||
2280 m_is_ppb_region(env
, address
)) {
2282 * MPU disabled or M profile PPB access: use default memory map.
2283 * The other case which uses the default memory map in the
2284 * v7M ARM ARM pseudocode is exception vector reads from the vector
2285 * table. In QEMU those accesses are done in arm_v7m_load_vector(),
2286 * which always does a direct read using address_space_ldl(), rather
2287 * than going via this function, so we don't need to check that here.
2289 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
, &result
->f
.prot
);
2290 } else { /* MPU enabled */
2291 for (n
= (int)cpu
->pmsav7_dregion
- 1; n
>= 0; n
--) {
2293 uint32_t base
= env
->pmsav7
.drbar
[n
];
2294 uint32_t rsize
= extract32(env
->pmsav7
.drsr
[n
], 1, 5);
2298 if (!(env
->pmsav7
.drsr
[n
] & 0x1)) {
2303 qemu_log_mask(LOG_GUEST_ERROR
,
2304 "DRSR[%d]: Rsize field cannot be 0\n", n
);
2308 rmask
= (1ull << rsize
) - 1;
2311 qemu_log_mask(LOG_GUEST_ERROR
,
2312 "DRBAR[%d]: 0x%" PRIx32
" misaligned "
2313 "to DRSR region size, mask = 0x%" PRIx32
"\n",
2318 if (address
< base
|| address
> base
+ rmask
) {
2320 * Address not in this region. We must check whether the
2321 * region covers addresses in the same page as our address.
2322 * In that case we must not report a size that covers the
2323 * whole page for a subsequent hit against a different MPU
2324 * region or the background region, because it would result in
2325 * incorrect TLB hits for subsequent accesses to addresses that
2326 * are in this MPU region.
2328 if (ranges_overlap(base
, rmask
,
2329 address
& TARGET_PAGE_MASK
,
2330 TARGET_PAGE_SIZE
)) {
2331 result
->f
.lg_page_size
= 0;
2336 /* Region matched */
2338 if (rsize
>= 8) { /* no subregions for regions < 256 bytes */
2340 uint32_t srdis_mask
;
2342 rsize
-= 3; /* sub region size (power of 2) */
2343 snd
= ((address
- base
) >> rsize
) & 0x7;
2344 srdis
= extract32(env
->pmsav7
.drsr
[n
], snd
+ 8, 1);
2346 srdis_mask
= srdis
? 0x3 : 0x0;
2347 for (i
= 2; i
<= 8 && rsize
< TARGET_PAGE_BITS
; i
*= 2) {
2349 * This will check in groups of 2, 4 and then 8, whether
2350 * the subregion bits are consistent. rsize is incremented
2351 * back up to give the region size, considering consistent
2352 * adjacent subregions as one region. Stop testing if rsize
2353 * is already big enough for an entire QEMU page.
2355 int snd_rounded
= snd
& ~(i
- 1);
2356 uint32_t srdis_multi
= extract32(env
->pmsav7
.drsr
[n
],
2357 snd_rounded
+ 8, i
);
2358 if (srdis_mask
^ srdis_multi
) {
2361 srdis_mask
= (srdis_mask
<< i
) | srdis_mask
;
2368 if (rsize
< TARGET_PAGE_BITS
) {
2369 result
->f
.lg_page_size
= rsize
;
2374 if (n
== -1) { /* no hits */
2375 if (!pmsav7_use_background_region(cpu
, mmu_idx
, secure
, is_user
)) {
2376 /* background fault */
2377 fi
->type
= ARMFault_Background
;
2380 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
,
2382 } else { /* a MPU hit! */
2383 uint32_t ap
= extract32(env
->pmsav7
.dracr
[n
], 8, 3);
2384 uint32_t xn
= extract32(env
->pmsav7
.dracr
[n
], 12, 1);
2386 if (m_is_system_region(env
, address
)) {
2387 /* System space is always execute never */
2391 if (is_user
) { /* User mode AP bit decoding */
2396 break; /* no access */
2398 result
->f
.prot
|= PAGE_WRITE
;
2402 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
2405 /* for v7M, same as 6; for R profile a reserved value */
2406 if (arm_feature(env
, ARM_FEATURE_M
)) {
2407 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
2412 qemu_log_mask(LOG_GUEST_ERROR
,
2413 "DRACR[%d]: Bad value for AP bits: 0x%"
2414 PRIx32
"\n", n
, ap
);
2416 } else { /* Priv. mode AP bits decoding */
2419 break; /* no access */
2423 result
->f
.prot
|= PAGE_WRITE
;
2427 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
2430 /* for v7M, same as 6; for R profile a reserved value */
2431 if (arm_feature(env
, ARM_FEATURE_M
)) {
2432 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
2437 qemu_log_mask(LOG_GUEST_ERROR
,
2438 "DRACR[%d]: Bad value for AP bits: 0x%"
2439 PRIx32
"\n", n
, ap
);
2445 result
->f
.prot
&= ~PAGE_EXEC
;
2450 fi
->type
= ARMFault_Permission
;
2452 return !(result
->f
.prot
& (1 << access_type
));
2455 static uint32_t *regime_rbar(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
2458 if (regime_el(env
, mmu_idx
) == 2) {
2459 return env
->pmsav8
.hprbar
;
2461 return env
->pmsav8
.rbar
[secure
];
2465 static uint32_t *regime_rlar(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
2468 if (regime_el(env
, mmu_idx
) == 2) {
2469 return env
->pmsav8
.hprlar
;
2471 return env
->pmsav8
.rlar
[secure
];
2475 bool pmsav8_mpu_lookup(CPUARMState
*env
, uint32_t address
,
2476 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
2477 bool secure
, GetPhysAddrResult
*result
,
2478 ARMMMUFaultInfo
*fi
, uint32_t *mregion
)
2481 * Perform a PMSAv8 MPU lookup (without also doing the SAU check
2482 * that a full phys-to-virt translation does).
2483 * mregion is (if not NULL) set to the region number which matched,
2484 * or -1 if no region number is returned (MPU off, address did not
2485 * hit a region, address hit in multiple regions).
2486 * If the region hit doesn't cover the entire TARGET_PAGE the address
2487 * is within, then we set the result page_size to 1 to force the
2488 * memory system to use a subpage.
2490 ARMCPU
*cpu
= env_archcpu(env
);
2491 bool is_user
= regime_is_user(env
, mmu_idx
);
2493 int matchregion
= -1;
2495 uint32_t addr_page_base
= address
& TARGET_PAGE_MASK
;
2496 uint32_t addr_page_limit
= addr_page_base
+ (TARGET_PAGE_SIZE
- 1);
2499 if (regime_el(env
, mmu_idx
) == 2) {
2500 region_counter
= cpu
->pmsav8r_hdregion
;
2502 region_counter
= cpu
->pmsav7_dregion
;
2505 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
2506 result
->f
.phys_addr
= address
;
2512 if (mmu_idx
== ARMMMUIdx_Stage2
) {
2517 * Unlike the ARM ARM pseudocode, we don't need to check whether this
2518 * was an exception vector read from the vector table (which is always
2519 * done using the default system address map), because those accesses
2520 * are done in arm_v7m_load_vector(), which always does a direct
2521 * read using address_space_ldl(), rather than going via this function.
2523 if (regime_translation_disabled(env
, mmu_idx
, arm_secure_to_space(secure
))) {
2526 } else if (m_is_ppb_region(env
, address
)) {
2529 if (pmsav7_use_background_region(cpu
, mmu_idx
, secure
, is_user
)) {
2534 if (arm_feature(env
, ARM_FEATURE_M
)) {
2541 for (n
= region_counter
- 1; n
>= 0; n
--) {
2544 * Note that the base address is bits [31:x] from the register
2545 * with bits [x-1:0] all zeroes, but the limit address is bits
2546 * [31:x] from the register with bits [x:0] all ones. Where x is
2547 * 5 for Cortex-M and 6 for Cortex-R
2549 uint32_t base
= regime_rbar(env
, mmu_idx
, secure
)[n
] & ~bitmask
;
2550 uint32_t limit
= regime_rlar(env
, mmu_idx
, secure
)[n
] | bitmask
;
2552 if (!(regime_rlar(env
, mmu_idx
, secure
)[n
] & 0x1)) {
2553 /* Region disabled */
2557 if (address
< base
|| address
> limit
) {
2559 * Address not in this region. We must check whether the
2560 * region covers addresses in the same page as our address.
2561 * In that case we must not report a size that covers the
2562 * whole page for a subsequent hit against a different MPU
2563 * region or the background region, because it would result in
2564 * incorrect TLB hits for subsequent accesses to addresses that
2565 * are in this MPU region.
2567 if (limit
>= base
&&
2568 ranges_overlap(base
, limit
- base
+ 1,
2570 TARGET_PAGE_SIZE
)) {
2571 result
->f
.lg_page_size
= 0;
2576 if (base
> addr_page_base
|| limit
< addr_page_limit
) {
2577 result
->f
.lg_page_size
= 0;
2580 if (matchregion
!= -1) {
2582 * Multiple regions match -- always a failure (unlike
2583 * PMSAv7 where highest-numbered-region wins)
2585 fi
->type
= ARMFault_Permission
;
2586 if (arm_feature(env
, ARM_FEATURE_M
)) {
2598 if (arm_feature(env
, ARM_FEATURE_M
)) {
2599 fi
->type
= ARMFault_Background
;
2601 fi
->type
= ARMFault_Permission
;
2606 if (matchregion
== -1) {
2607 /* hit using the background region */
2608 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
, &result
->f
.prot
);
2610 uint32_t matched_rbar
= regime_rbar(env
, mmu_idx
, secure
)[matchregion
];
2611 uint32_t matched_rlar
= regime_rlar(env
, mmu_idx
, secure
)[matchregion
];
2612 uint32_t ap
= extract32(matched_rbar
, 1, 2);
2613 uint32_t xn
= extract32(matched_rbar
, 0, 1);
2616 if (arm_feature(env
, ARM_FEATURE_V8_1M
)) {
2617 pxn
= extract32(matched_rlar
, 4, 1);
2620 if (m_is_system_region(env
, address
)) {
2621 /* System space is always execute never */
2625 if (regime_el(env
, mmu_idx
) == 2) {
2626 result
->f
.prot
= simple_ap_to_rw_prot_is_user(ap
,
2627 mmu_idx
!= ARMMMUIdx_E2
);
2629 result
->f
.prot
= simple_ap_to_rw_prot(env
, mmu_idx
, ap
);
2632 if (!arm_feature(env
, ARM_FEATURE_M
)) {
2633 uint8_t attrindx
= extract32(matched_rlar
, 1, 3);
2634 uint64_t mair
= env
->cp15
.mair_el
[regime_el(env
, mmu_idx
)];
2635 uint8_t sh
= extract32(matched_rlar
, 3, 2);
2637 if (regime_sctlr(env
, mmu_idx
) & SCTLR_WXN
&&
2638 result
->f
.prot
& PAGE_WRITE
&& mmu_idx
!= ARMMMUIdx_Stage2
) {
2642 if ((regime_el(env
, mmu_idx
) == 1) &&
2643 regime_sctlr(env
, mmu_idx
) & SCTLR_UWXN
&& ap
== 0x1) {
2647 result
->cacheattrs
.is_s2_format
= false;
2648 result
->cacheattrs
.attrs
= extract64(mair
, attrindx
* 8, 8);
2649 result
->cacheattrs
.shareability
= sh
;
2652 if (result
->f
.prot
&& !xn
&& !(pxn
&& !is_user
)) {
2653 result
->f
.prot
|= PAGE_EXEC
;
2657 *mregion
= matchregion
;
2661 fi
->type
= ARMFault_Permission
;
2662 if (arm_feature(env
, ARM_FEATURE_M
)) {
2665 return !(result
->f
.prot
& (1 << access_type
));
2668 static bool v8m_is_sau_exempt(CPUARMState
*env
,
2669 uint32_t address
, MMUAccessType access_type
)
2672 * The architecture specifies that certain address ranges are
2673 * exempt from v8M SAU/IDAU checks.
2676 (access_type
== MMU_INST_FETCH
&& m_is_system_region(env
, address
)) ||
2677 (address
>= 0xe0000000 && address
<= 0xe0002fff) ||
2678 (address
>= 0xe000e000 && address
<= 0xe000efff) ||
2679 (address
>= 0xe002e000 && address
<= 0xe002efff) ||
2680 (address
>= 0xe0040000 && address
<= 0xe0041fff) ||
2681 (address
>= 0xe00ff000 && address
<= 0xe00fffff);
2684 void v8m_security_lookup(CPUARMState
*env
, uint32_t address
,
2685 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
2686 bool is_secure
, V8M_SAttributes
*sattrs
)
2689 * Look up the security attributes for this address. Compare the
2690 * pseudocode SecurityCheck() function.
2691 * We assume the caller has zero-initialized *sattrs.
2693 ARMCPU
*cpu
= env_archcpu(env
);
2695 bool idau_exempt
= false, idau_ns
= true, idau_nsc
= true;
2696 int idau_region
= IREGION_NOTVALID
;
2697 uint32_t addr_page_base
= address
& TARGET_PAGE_MASK
;
2698 uint32_t addr_page_limit
= addr_page_base
+ (TARGET_PAGE_SIZE
- 1);
2701 IDAUInterfaceClass
*iic
= IDAU_INTERFACE_GET_CLASS(cpu
->idau
);
2702 IDAUInterface
*ii
= IDAU_INTERFACE(cpu
->idau
);
2704 iic
->check(ii
, address
, &idau_region
, &idau_exempt
, &idau_ns
,
2708 if (access_type
== MMU_INST_FETCH
&& extract32(address
, 28, 4) == 0xf) {
2709 /* 0xf0000000..0xffffffff is always S for insn fetches */
2713 if (idau_exempt
|| v8m_is_sau_exempt(env
, address
, access_type
)) {
2714 sattrs
->ns
= !is_secure
;
2718 if (idau_region
!= IREGION_NOTVALID
) {
2719 sattrs
->irvalid
= true;
2720 sattrs
->iregion
= idau_region
;
2723 switch (env
->sau
.ctrl
& 3) {
2724 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
2726 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
2729 default: /* SAU.ENABLE == 1 */
2730 for (r
= 0; r
< cpu
->sau_sregion
; r
++) {
2731 if (env
->sau
.rlar
[r
] & 1) {
2732 uint32_t base
= env
->sau
.rbar
[r
] & ~0x1f;
2733 uint32_t limit
= env
->sau
.rlar
[r
] | 0x1f;
2735 if (base
<= address
&& limit
>= address
) {
2736 if (base
> addr_page_base
|| limit
< addr_page_limit
) {
2737 sattrs
->subpage
= true;
2739 if (sattrs
->srvalid
) {
2741 * If we hit in more than one region then we must report
2742 * as Secure, not NS-Callable, with no valid region
2746 sattrs
->nsc
= false;
2747 sattrs
->sregion
= 0;
2748 sattrs
->srvalid
= false;
2751 if (env
->sau
.rlar
[r
] & 2) {
2756 sattrs
->srvalid
= true;
2757 sattrs
->sregion
= r
;
2761 * Address not in this region. We must check whether the
2762 * region covers addresses in the same page as our address.
2763 * In that case we must not report a size that covers the
2764 * whole page for a subsequent hit against a different MPU
2765 * region or the background region, because it would result
2766 * in incorrect TLB hits for subsequent accesses to
2767 * addresses that are in this MPU region.
2769 if (limit
>= base
&&
2770 ranges_overlap(base
, limit
- base
+ 1,
2772 TARGET_PAGE_SIZE
)) {
2773 sattrs
->subpage
= true;
2782 * The IDAU will override the SAU lookup results if it specifies
2783 * higher security than the SAU does.
2786 if (sattrs
->ns
|| (!idau_nsc
&& sattrs
->nsc
)) {
2788 sattrs
->nsc
= idau_nsc
;
2793 static bool get_phys_addr_pmsav8(CPUARMState
*env
,
2796 MMUAccessType access_type
,
2797 GetPhysAddrResult
*result
,
2798 ARMMMUFaultInfo
*fi
)
2800 V8M_SAttributes sattrs
= {};
2801 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
2802 bool secure
= arm_space_is_secure(ptw
->in_space
);
2805 if (arm_feature(env
, ARM_FEATURE_M_SECURITY
)) {
2806 v8m_security_lookup(env
, address
, access_type
, mmu_idx
,
2808 if (access_type
== MMU_INST_FETCH
) {
2810 * Instruction fetches always use the MMU bank and the
2811 * transaction attribute determined by the fetch address,
2812 * regardless of CPU state. This is painful for QEMU
2813 * to handle, because it would mean we need to encode
2814 * into the mmu_idx not just the (user, negpri) information
2815 * for the current security state but also that for the
2816 * other security state, which would balloon the number
2817 * of mmu_idx values needed alarmingly.
2818 * Fortunately we can avoid this because it's not actually
2819 * possible to arbitrarily execute code from memory with
2820 * the wrong security attribute: it will always generate
2821 * an exception of some kind or another, apart from the
2822 * special case of an NS CPU executing an SG instruction
2823 * in S&NSC memory. So we always just fail the translation
2824 * here and sort things out in the exception handler
2825 * (including possibly emulating an SG instruction).
2827 if (sattrs
.ns
!= !secure
) {
2829 fi
->type
= ARMFault_QEMU_NSCExec
;
2831 fi
->type
= ARMFault_QEMU_SFault
;
2833 result
->f
.lg_page_size
= sattrs
.subpage
? 0 : TARGET_PAGE_BITS
;
2834 result
->f
.phys_addr
= address
;
2840 * For data accesses we always use the MMU bank indicated
2841 * by the current CPU state, but the security attributes
2842 * might downgrade a secure access to nonsecure.
2845 result
->f
.attrs
.secure
= false;
2846 result
->f
.attrs
.space
= ARMSS_NonSecure
;
2847 } else if (!secure
) {
2849 * NS access to S memory must fault.
2850 * Architecturally we should first check whether the
2851 * MPU information for this address indicates that we
2852 * are doing an unaligned access to Device memory, which
2853 * should generate a UsageFault instead. QEMU does not
2854 * currently check for that kind of unaligned access though.
2855 * If we added it we would need to do so as a special case
2856 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
2858 fi
->type
= ARMFault_QEMU_SFault
;
2859 result
->f
.lg_page_size
= sattrs
.subpage
? 0 : TARGET_PAGE_BITS
;
2860 result
->f
.phys_addr
= address
;
2867 ret
= pmsav8_mpu_lookup(env
, address
, access_type
, mmu_idx
, secure
,
2869 if (sattrs
.subpage
) {
2870 result
->f
.lg_page_size
= 0;
2876 * Translate from the 4-bit stage 2 representation of
2877 * memory attributes (without cache-allocation hints) to
2878 * the 8-bit representation of the stage 1 MAIR registers
2879 * (which includes allocation hints).
2881 * ref: shared/translation/attrs/S2AttrDecode()
2882 * .../S2ConvertAttrsHints()
2884 static uint8_t convert_stage2_attrs(uint64_t hcr
, uint8_t s2attrs
)
2886 uint8_t hiattr
= extract32(s2attrs
, 2, 2);
2887 uint8_t loattr
= extract32(s2attrs
, 0, 2);
2888 uint8_t hihint
= 0, lohint
= 0;
2890 if (hiattr
!= 0) { /* normal memory */
2891 if (hcr
& HCR_CD
) { /* cache disabled */
2892 hiattr
= loattr
= 1; /* non-cacheable */
2894 if (hiattr
!= 1) { /* Write-through or write-back */
2895 hihint
= 3; /* RW allocate */
2897 if (loattr
!= 1) { /* Write-through or write-back */
2898 lohint
= 3; /* RW allocate */
2903 return (hiattr
<< 6) | (hihint
<< 4) | (loattr
<< 2) | lohint
;
2907 * Combine either inner or outer cacheability attributes for normal
2908 * memory, according to table D4-42 and pseudocode procedure
2909 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
2911 * NB: only stage 1 includes allocation hints (RW bits), leading to
2914 static uint8_t combine_cacheattr_nibble(uint8_t s1
, uint8_t s2
)
2916 if (s1
== 4 || s2
== 4) {
2917 /* non-cacheable has precedence */
2919 } else if (extract32(s1
, 2, 2) == 0 || extract32(s1
, 2, 2) == 2) {
2920 /* stage 1 write-through takes precedence */
2922 } else if (extract32(s2
, 2, 2) == 2) {
2923 /* stage 2 write-through takes precedence, but the allocation hint
2924 * is still taken from stage 1
2926 return (2 << 2) | extract32(s1
, 0, 2);
2927 } else { /* write-back */
2933 * Combine the memory type and cacheability attributes of
2934 * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
2935 * combined attributes in MAIR_EL1 format.
2937 static uint8_t combined_attrs_nofwb(uint64_t hcr
,
2938 ARMCacheAttrs s1
, ARMCacheAttrs s2
)
2940 uint8_t s1lo
, s2lo
, s1hi
, s2hi
, s2_mair_attrs
, ret_attrs
;
2942 if (s2
.is_s2_format
) {
2943 s2_mair_attrs
= convert_stage2_attrs(hcr
, s2
.attrs
);
2945 s2_mair_attrs
= s2
.attrs
;
2948 s1lo
= extract32(s1
.attrs
, 0, 4);
2949 s2lo
= extract32(s2_mair_attrs
, 0, 4);
2950 s1hi
= extract32(s1
.attrs
, 4, 4);
2951 s2hi
= extract32(s2_mair_attrs
, 4, 4);
2953 /* Combine memory type and cacheability attributes */
2954 if (s1hi
== 0 || s2hi
== 0) {
2955 /* Device has precedence over normal */
2956 if (s1lo
== 0 || s2lo
== 0) {
2957 /* nGnRnE has precedence over anything */
2959 } else if (s1lo
== 4 || s2lo
== 4) {
2960 /* non-Reordering has precedence over Reordering */
2961 ret_attrs
= 4; /* nGnRE */
2962 } else if (s1lo
== 8 || s2lo
== 8) {
2963 /* non-Gathering has precedence over Gathering */
2964 ret_attrs
= 8; /* nGRE */
2966 ret_attrs
= 0xc; /* GRE */
2968 } else { /* Normal memory */
2969 /* Outer/inner cacheability combine independently */
2970 ret_attrs
= combine_cacheattr_nibble(s1hi
, s2hi
) << 4
2971 | combine_cacheattr_nibble(s1lo
, s2lo
);
2976 static uint8_t force_cacheattr_nibble_wb(uint8_t attr
)
2979 * Given the 4 bits specifying the outer or inner cacheability
2980 * in MAIR format, return a value specifying Normal Write-Back,
2981 * with the allocation and transient hints taken from the input
2982 * if the input specified some kind of cacheable attribute.
2984 if (attr
== 0 || attr
== 4) {
2986 * 0 == an UNPREDICTABLE encoding
2987 * 4 == Non-cacheable
2988 * Either way, force Write-Back RW allocate non-transient
2992 /* Change WriteThrough to WriteBack, keep allocation and transient hints */
2997 * Combine the memory type and cacheability attributes of
2998 * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
2999 * combined attributes in MAIR_EL1 format.
3001 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1
, ARMCacheAttrs s2
)
3003 assert(s2
.is_s2_format
&& !s1
.is_s2_format
);
3007 /* Use stage 1 attributes */
3011 * Force Normal Write-Back. Note that if S1 is Normal cacheable
3012 * then we take the allocation hints from it; otherwise it is
3013 * RW allocate, non-transient.
3015 if ((s1
.attrs
& 0xf0) == 0) {
3019 /* Need to check the Inner and Outer nibbles separately */
3020 return force_cacheattr_nibble_wb(s1
.attrs
& 0xf) |
3021 force_cacheattr_nibble_wb(s1
.attrs
>> 4) << 4;
3023 /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */
3024 if ((s1
.attrs
& 0xf0) == 0) {
3029 /* Force Device, of subtype specified by S2 */
3030 return s2
.attrs
<< 2;
3033 * RESERVED values (including RES0 descriptor bit [5] being nonzero);
3034 * arbitrarily force Device.
3041 * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
3042 * and CombineS1S2Desc()
3045 * @s1: Attributes from stage 1 walk
3046 * @s2: Attributes from stage 2 walk
3048 static ARMCacheAttrs
combine_cacheattrs(uint64_t hcr
,
3049 ARMCacheAttrs s1
, ARMCacheAttrs s2
)
3052 bool tagged
= false;
3054 assert(!s1
.is_s2_format
);
3055 ret
.is_s2_format
= false;
3057 if (s1
.attrs
== 0xf0) {
3062 /* Combine shareability attributes (table D4-43) */
3063 if (s1
.shareability
== 2 || s2
.shareability
== 2) {
3064 /* if either are outer-shareable, the result is outer-shareable */
3065 ret
.shareability
= 2;
3066 } else if (s1
.shareability
== 3 || s2
.shareability
== 3) {
3067 /* if either are inner-shareable, the result is inner-shareable */
3068 ret
.shareability
= 3;
3070 /* both non-shareable */
3071 ret
.shareability
= 0;
3074 /* Combine memory type and cacheability attributes */
3075 if (hcr
& HCR_FWB
) {
3076 ret
.attrs
= combined_attrs_fwb(s1
, s2
);
3078 ret
.attrs
= combined_attrs_nofwb(hcr
, s1
, s2
);
3082 * Any location for which the resultant memory type is any
3083 * type of Device memory is always treated as Outer Shareable.
3084 * Any location for which the resultant memory type is Normal
3085 * Inner Non-cacheable, Outer Non-cacheable is always treated
3086 * as Outer Shareable.
3087 * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC
3089 if ((ret
.attrs
& 0xf0) == 0 || ret
.attrs
== 0x44) {
3090 ret
.shareability
= 2;
3093 /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */
3094 if (tagged
&& ret
.attrs
== 0xff) {
3102 * MMU disabled. S1 addresses within aa64 translation regimes are
3103 * still checked for bounds -- see AArch64.S1DisabledOutput().
3105 static bool get_phys_addr_disabled(CPUARMState
*env
,
3107 target_ulong address
,
3108 MMUAccessType access_type
,
3109 GetPhysAddrResult
*result
,
3110 ARMMMUFaultInfo
*fi
)
3112 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
3113 uint8_t memattr
= 0x00; /* Device nGnRnE */
3114 uint8_t shareability
= 0; /* non-shareable */
3118 case ARMMMUIdx_Stage2
:
3119 case ARMMMUIdx_Stage2_S
:
3120 case ARMMMUIdx_Phys_S
:
3121 case ARMMMUIdx_Phys_NS
:
3122 case ARMMMUIdx_Phys_Root
:
3123 case ARMMMUIdx_Phys_Realm
:
3127 r_el
= regime_el(env
, mmu_idx
);
3128 if (arm_el_is_aa64(env
, r_el
)) {
3129 int pamax
= arm_pamax(env_archcpu(env
));
3130 uint64_t tcr
= env
->cp15
.tcr_el
[r_el
];
3133 tbi
= aa64_va_parameter_tbi(tcr
, mmu_idx
);
3134 if (access_type
== MMU_INST_FETCH
) {
3135 tbi
&= ~aa64_va_parameter_tbid(tcr
, mmu_idx
);
3137 tbi
= (tbi
>> extract64(address
, 55, 1)) & 1;
3138 addrtop
= (tbi
? 55 : 63);
3140 if (extract64(address
, pamax
, addrtop
- pamax
+ 1) != 0) {
3141 fi
->type
= ARMFault_AddressSize
;
3148 * When TBI is disabled, we've just validated that all of the
3149 * bits above PAMax are zero, so logically we only need to
3150 * clear the top byte for TBI. But it's clearer to follow
3151 * the pseudocode set of addrdesc.paddress.
3153 address
= extract64(address
, 0, 52);
3156 /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
3158 uint64_t hcr
= arm_hcr_el2_eff_secstate(env
, ptw
->in_space
);
3160 if (hcr
& HCR_DCT
) {
3161 memattr
= 0xf0; /* Tagged, Normal, WB, RWA */
3163 memattr
= 0xff; /* Normal, WB, RWA */
3168 if (access_type
== MMU_INST_FETCH
) {
3169 if (regime_sctlr(env
, mmu_idx
) & SCTLR_I
) {
3170 memattr
= 0xee; /* Normal, WT, RA, NT */
3172 memattr
= 0x44; /* Normal, NC, No */
3175 shareability
= 2; /* outer shareable */
3177 result
->cacheattrs
.is_s2_format
= false;
3181 result
->f
.phys_addr
= address
;
3182 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
3183 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
3184 result
->cacheattrs
.shareability
= shareability
;
3185 result
->cacheattrs
.attrs
= memattr
;
3189 static bool get_phys_addr_twostage(CPUARMState
*env
, S1Translate
*ptw
,
3190 target_ulong address
,
3191 MMUAccessType access_type
,
3192 GetPhysAddrResult
*result
,
3193 ARMMMUFaultInfo
*fi
)
3196 int s1_prot
, s1_lgpgsz
;
3197 ARMSecuritySpace in_space
= ptw
->in_space
;
3198 bool ret
, ipa_secure
, s1_guarded
;
3199 ARMCacheAttrs cacheattrs1
;
3200 ARMSecuritySpace ipa_space
;
3203 ret
= get_phys_addr_nogpc(env
, ptw
, address
, access_type
, result
, fi
);
3205 /* If S1 fails, return early. */
3210 ipa
= result
->f
.phys_addr
;
3211 ipa_secure
= result
->f
.attrs
.secure
;
3212 ipa_space
= result
->f
.attrs
.space
;
3214 ptw
->in_s1_is_el0
= ptw
->in_mmu_idx
== ARMMMUIdx_Stage1_E0
;
3215 ptw
->in_mmu_idx
= ipa_secure
? ARMMMUIdx_Stage2_S
: ARMMMUIdx_Stage2
;
3216 ptw
->in_space
= ipa_space
;
3217 ptw
->in_ptw_idx
= ptw_idx_for_stage_2(env
, ptw
->in_mmu_idx
);
3220 * S1 is done, now do S2 translation.
3221 * Save the stage1 results so that we may merge prot and cacheattrs later.
3223 s1_prot
= result
->f
.prot
;
3224 s1_lgpgsz
= result
->f
.lg_page_size
;
3225 s1_guarded
= result
->f
.extra
.arm
.guarded
;
3226 cacheattrs1
= result
->cacheattrs
;
3227 memset(result
, 0, sizeof(*result
));
3229 ret
= get_phys_addr_nogpc(env
, ptw
, ipa
, access_type
, result
, fi
);
3232 /* Combine the S1 and S2 perms. */
3233 result
->f
.prot
&= s1_prot
;
3235 /* If S2 fails, return early. */
3241 * If either S1 or S2 returned a result smaller than TARGET_PAGE_SIZE,
3242 * this means "don't put this in the TLB"; in this case, return a
3243 * result with lg_page_size == 0 to achieve that. Otherwise,
3244 * use the maximum of the S1 & S2 page size, so that invalidation
3245 * of pages > TARGET_PAGE_SIZE works correctly. (This works even though
3246 * we know the combined result permissions etc only cover the minimum
3247 * of the S1 and S2 page size, because we know that the common TLB code
3248 * never actually creates TLB entries bigger than TARGET_PAGE_SIZE,
3249 * and passing a larger page size value only affects invalidations.)
3251 if (result
->f
.lg_page_size
< TARGET_PAGE_BITS
||
3252 s1_lgpgsz
< TARGET_PAGE_BITS
) {
3253 result
->f
.lg_page_size
= 0;
3254 } else if (result
->f
.lg_page_size
< s1_lgpgsz
) {
3255 result
->f
.lg_page_size
= s1_lgpgsz
;
3258 /* Combine the S1 and S2 cache attributes. */
3259 hcr
= arm_hcr_el2_eff_secstate(env
, in_space
);
3262 * HCR.DC forces the first stage attributes to
3263 * Normal Non-Shareable,
3264 * Inner Write-Back Read-Allocate Write-Allocate,
3265 * Outer Write-Back Read-Allocate Write-Allocate.
3266 * Do not overwrite Tagged within attrs.
3268 if (cacheattrs1
.attrs
!= 0xf0) {
3269 cacheattrs1
.attrs
= 0xff;
3271 cacheattrs1
.shareability
= 0;
3273 result
->cacheattrs
= combine_cacheattrs(hcr
, cacheattrs1
,
3274 result
->cacheattrs
);
3276 /* No BTI GP information in stage 2, we just use the S1 value */
3277 result
->f
.extra
.arm
.guarded
= s1_guarded
;
3280 * Check if IPA translates to secure or non-secure PA space.
3281 * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
3283 if (in_space
== ARMSS_Secure
) {
3284 result
->f
.attrs
.secure
=
3285 !(env
->cp15
.vstcr_el2
& (VSTCR_SA
| VSTCR_SW
))
3287 || !(env
->cp15
.vtcr_el2
& (VTCR_NSA
| VTCR_NSW
)));
3288 result
->f
.attrs
.space
= arm_secure_to_space(result
->f
.attrs
.secure
);
3294 static bool get_phys_addr_nogpc(CPUARMState
*env
, S1Translate
*ptw
,
3295 target_ulong address
,
3296 MMUAccessType access_type
,
3297 GetPhysAddrResult
*result
,
3298 ARMMMUFaultInfo
*fi
)
3300 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
3301 ARMMMUIdx s1_mmu_idx
;
3304 * The page table entries may downgrade Secure to NonSecure, but
3305 * cannot upgrade a NonSecure translation regime's attributes
3306 * to Secure or Realm.
3308 result
->f
.attrs
.space
= ptw
->in_space
;
3309 result
->f
.attrs
.secure
= arm_space_is_secure(ptw
->in_space
);
3312 case ARMMMUIdx_Phys_S
:
3313 case ARMMMUIdx_Phys_NS
:
3314 case ARMMMUIdx_Phys_Root
:
3315 case ARMMMUIdx_Phys_Realm
:
3316 /* Checking Phys early avoids special casing later vs regime_el. */
3317 return get_phys_addr_disabled(env
, ptw
, address
, access_type
,
3320 case ARMMMUIdx_Stage1_E0
:
3321 case ARMMMUIdx_Stage1_E1
:
3322 case ARMMMUIdx_Stage1_E1_PAN
:
3324 * First stage lookup uses second stage for ptw; only
3325 * Secure has both S and NS IPA and starts with Stage2_S.
3327 ptw
->in_ptw_idx
= (ptw
->in_space
== ARMSS_Secure
) ?
3328 ARMMMUIdx_Stage2_S
: ARMMMUIdx_Stage2
;
3331 case ARMMMUIdx_Stage2
:
3332 case ARMMMUIdx_Stage2_S
:
3334 * Second stage lookup uses physical for ptw; whether this is S or
3335 * NS may depend on the SW/NSW bits if this is a stage 2 lookup for
3336 * the Secure EL2&0 regime.
3338 ptw
->in_ptw_idx
= ptw_idx_for_stage_2(env
, mmu_idx
);
3341 case ARMMMUIdx_E10_0
:
3342 s1_mmu_idx
= ARMMMUIdx_Stage1_E0
;
3344 case ARMMMUIdx_E10_1
:
3345 s1_mmu_idx
= ARMMMUIdx_Stage1_E1
;
3347 case ARMMMUIdx_E10_1_PAN
:
3348 s1_mmu_idx
= ARMMMUIdx_Stage1_E1_PAN
;
3351 * Call ourselves recursively to do the stage 1 and then stage 2
3352 * translations if mmu_idx is a two-stage regime, and EL2 present.
3353 * Otherwise, a stage1+stage2 translation is just stage 1.
3355 ptw
->in_mmu_idx
= mmu_idx
= s1_mmu_idx
;
3356 if (arm_feature(env
, ARM_FEATURE_EL2
) &&
3357 !regime_translation_disabled(env
, ARMMMUIdx_Stage2
, ptw
->in_space
)) {
3358 return get_phys_addr_twostage(env
, ptw
, address
, access_type
,
3364 /* Single stage uses physical for ptw. */
3365 ptw
->in_ptw_idx
= arm_space_to_phys(ptw
->in_space
);
3369 result
->f
.attrs
.user
= regime_is_user(env
, mmu_idx
);
3372 * Fast Context Switch Extension. This doesn't exist at all in v8.
3373 * In v7 and earlier it affects all stage 1 translations.
3375 if (address
< 0x02000000 && mmu_idx
!= ARMMMUIdx_Stage2
3376 && !arm_feature(env
, ARM_FEATURE_V8
)) {
3377 if (regime_el(env
, mmu_idx
) == 3) {
3378 address
+= env
->cp15
.fcseidr_s
;
3380 address
+= env
->cp15
.fcseidr_ns
;
3384 if (arm_feature(env
, ARM_FEATURE_PMSA
)) {
3386 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
3388 if (arm_feature(env
, ARM_FEATURE_V8
)) {
3390 ret
= get_phys_addr_pmsav8(env
, ptw
, address
, access_type
,
3392 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
3394 ret
= get_phys_addr_pmsav7(env
, ptw
, address
, access_type
,
3398 ret
= get_phys_addr_pmsav5(env
, ptw
, address
, access_type
,
3401 qemu_log_mask(CPU_LOG_MMU
, "PMSA MPU lookup for %s at 0x%08" PRIx32
3402 " mmu_idx %u -> %s (prot %c%c%c)\n",
3403 access_type
== MMU_DATA_LOAD
? "reading" :
3404 (access_type
== MMU_DATA_STORE
? "writing" : "execute"),
3405 (uint32_t)address
, mmu_idx
,
3406 ret
? "Miss" : "Hit",
3407 result
->f
.prot
& PAGE_READ
? 'r' : '-',
3408 result
->f
.prot
& PAGE_WRITE
? 'w' : '-',
3409 result
->f
.prot
& PAGE_EXEC
? 'x' : '-');
3414 /* Definitely a real MMU, not an MPU */
3416 if (regime_translation_disabled(env
, mmu_idx
, ptw
->in_space
)) {
3417 return get_phys_addr_disabled(env
, ptw
, address
, access_type
,
3421 if (regime_using_lpae_format(env
, mmu_idx
)) {
3422 return get_phys_addr_lpae(env
, ptw
, address
, access_type
, result
, fi
);
3423 } else if (arm_feature(env
, ARM_FEATURE_V7
) ||
3424 regime_sctlr(env
, mmu_idx
) & SCTLR_XP
) {
3425 return get_phys_addr_v6(env
, ptw
, address
, access_type
, result
, fi
);
3427 return get_phys_addr_v5(env
, ptw
, address
, access_type
, result
, fi
);
3431 static bool get_phys_addr_gpc(CPUARMState
*env
, S1Translate
*ptw
,
3432 target_ulong address
,
3433 MMUAccessType access_type
,
3434 GetPhysAddrResult
*result
,
3435 ARMMMUFaultInfo
*fi
)
3437 if (get_phys_addr_nogpc(env
, ptw
, address
, access_type
, result
, fi
)) {
3440 if (!granule_protection_check(env
, result
->f
.phys_addr
,
3441 result
->f
.attrs
.space
, fi
)) {
3442 fi
->type
= ARMFault_GPCFOnOutput
;
3448 bool get_phys_addr_with_space_nogpc(CPUARMState
*env
, target_ulong address
,
3449 MMUAccessType access_type
,
3450 ARMMMUIdx mmu_idx
, ARMSecuritySpace space
,
3451 GetPhysAddrResult
*result
,
3452 ARMMMUFaultInfo
*fi
)
3455 .in_mmu_idx
= mmu_idx
,
3458 return get_phys_addr_nogpc(env
, &ptw
, address
, access_type
, result
, fi
);
3461 bool get_phys_addr(CPUARMState
*env
, target_ulong address
,
3462 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
3463 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
3466 .in_mmu_idx
= mmu_idx
,
3468 ARMSecuritySpace ss
;
3471 case ARMMMUIdx_E10_0
:
3472 case ARMMMUIdx_E10_1
:
3473 case ARMMMUIdx_E10_1_PAN
:
3474 case ARMMMUIdx_E20_0
:
3475 case ARMMMUIdx_E20_2
:
3476 case ARMMMUIdx_E20_2_PAN
:
3477 case ARMMMUIdx_Stage1_E0
:
3478 case ARMMMUIdx_Stage1_E1
:
3479 case ARMMMUIdx_Stage1_E1_PAN
:
3481 ss
= arm_security_space_below_el3(env
);
3483 case ARMMMUIdx_Stage2
:
3485 * For Secure EL2, we need this index to be NonSecure;
3486 * otherwise this will already be NonSecure or Realm.
3488 ss
= arm_security_space_below_el3(env
);
3489 if (ss
== ARMSS_Secure
) {
3490 ss
= ARMSS_NonSecure
;
3493 case ARMMMUIdx_Phys_NS
:
3494 case ARMMMUIdx_MPrivNegPri
:
3495 case ARMMMUIdx_MUserNegPri
:
3496 case ARMMMUIdx_MPriv
:
3497 case ARMMMUIdx_MUser
:
3498 ss
= ARMSS_NonSecure
;
3500 case ARMMMUIdx_Stage2_S
:
3501 case ARMMMUIdx_Phys_S
:
3502 case ARMMMUIdx_MSPrivNegPri
:
3503 case ARMMMUIdx_MSUserNegPri
:
3504 case ARMMMUIdx_MSPriv
:
3505 case ARMMMUIdx_MSUser
:
3509 if (arm_feature(env
, ARM_FEATURE_AARCH64
) &&
3510 cpu_isar_feature(aa64_rme
, env_archcpu(env
))) {
3516 case ARMMMUIdx_Phys_Root
:
3519 case ARMMMUIdx_Phys_Realm
:
3523 g_assert_not_reached();
3527 return get_phys_addr_gpc(env
, &ptw
, address
, access_type
, result
, fi
);
3530 hwaddr
arm_cpu_get_phys_page_attrs_debug(CPUState
*cs
, vaddr addr
,
3533 ARMCPU
*cpu
= ARM_CPU(cs
);
3534 CPUARMState
*env
= &cpu
->env
;
3535 ARMMMUIdx mmu_idx
= arm_mmu_idx(env
);
3536 ARMSecuritySpace ss
= arm_security_space(env
);
3538 .in_mmu_idx
= mmu_idx
,
3542 GetPhysAddrResult res
= {};
3543 ARMMMUFaultInfo fi
= {};
3546 ret
= get_phys_addr_gpc(env
, &ptw
, addr
, MMU_DATA_LOAD
, &res
, &fi
);
3547 *attrs
= res
.f
.attrs
;
3552 return res
.f
.phys_addr
;