2 * ARM page table walking.
4 * This code is licensed under the GNU GPL v2 or later.
6 * SPDX-License-Identifier: GPL-2.0-or-later
9 #include "qemu/osdep.h"
11 #include "qemu/range.h"
12 #include "qemu/main-loop.h"
13 #include "exec/exec-all.h"
15 #include "internals.h"
18 # include "tcg/oversized-guest.h"
21 typedef struct S1Translate
{
24 ARMSecuritySpace in_space
;
30 ARMSecuritySpace out_space
;
36 static bool get_phys_addr_lpae(CPUARMState
*env
, S1Translate
*ptw
,
38 MMUAccessType access_type
, bool s1_is_el0
,
39 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
);
41 static bool get_phys_addr_with_struct(CPUARMState
*env
, S1Translate
*ptw
,
43 MMUAccessType access_type
,
44 GetPhysAddrResult
*result
,
47 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
48 static const uint8_t pamax_map
[] = {
58 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
59 unsigned int arm_pamax(ARMCPU
*cpu
)
61 if (arm_feature(&cpu
->env
, ARM_FEATURE_AARCH64
)) {
62 unsigned int parange
=
63 FIELD_EX64(cpu
->isar
.id_aa64mmfr0
, ID_AA64MMFR0
, PARANGE
);
66 * id_aa64mmfr0 is a read-only register so values outside of the
67 * supported mappings can be considered an implementation error.
69 assert(parange
< ARRAY_SIZE(pamax_map
));
70 return pamax_map
[parange
];
74 * In machvirt_init, we call arm_pamax on a cpu that is not fully
75 * initialized, so we can't rely on the propagation done in realize.
77 if (arm_feature(&cpu
->env
, ARM_FEATURE_LPAE
) ||
78 arm_feature(&cpu
->env
, ARM_FEATURE_V7VE
)) {
87 * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index
89 ARMMMUIdx
stage_1_mmu_idx(ARMMMUIdx mmu_idx
)
93 return ARMMMUIdx_Stage1_E0
;
95 return ARMMMUIdx_Stage1_E1
;
96 case ARMMMUIdx_E10_1_PAN
:
97 return ARMMMUIdx_Stage1_E1_PAN
;
103 ARMMMUIdx
arm_stage1_mmu_idx(CPUARMState
*env
)
105 return stage_1_mmu_idx(arm_mmu_idx(env
));
109 * Return where we should do ptw loads from for a stage 2 walk.
110 * This depends on whether the address we are looking up is a
111 * Secure IPA or a NonSecure IPA, which we know from whether this is
112 * Stage2 or Stage2_S.
113 * If this is the Secure EL1&0 regime we need to check the NSW and SW bits.
115 static ARMMMUIdx
ptw_idx_for_stage_2(CPUARMState
*env
, ARMMMUIdx stage2idx
)
120 * We're OK to check the current state of the CPU here because
121 * (1) we always invalidate all TLBs when the SCR_EL3.NS bit changes
122 * (2) there's no way to do a lookup that cares about Stage 2 for a
123 * different security state to the current one for AArch64, and AArch32
124 * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
125 * an NS stage 1+2 lookup while the NS bit is 0.)
127 if (!arm_is_secure_below_el3(env
) || !arm_el_is_aa64(env
, 3)) {
128 return ARMMMUIdx_Phys_NS
;
130 if (stage2idx
== ARMMMUIdx_Stage2_S
) {
131 s2walk_secure
= !(env
->cp15
.vstcr_el2
& VSTCR_SW
);
133 s2walk_secure
= !(env
->cp15
.vtcr_el2
& VTCR_NSW
);
135 return s2walk_secure
? ARMMMUIdx_Phys_S
: ARMMMUIdx_Phys_NS
;
139 static bool regime_translation_big_endian(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
141 return (regime_sctlr(env
, mmu_idx
) & SCTLR_EE
) != 0;
144 /* Return the TTBR associated with this translation regime */
145 static uint64_t regime_ttbr(CPUARMState
*env
, ARMMMUIdx mmu_idx
, int ttbrn
)
147 if (mmu_idx
== ARMMMUIdx_Stage2
) {
148 return env
->cp15
.vttbr_el2
;
150 if (mmu_idx
== ARMMMUIdx_Stage2_S
) {
151 return env
->cp15
.vsttbr_el2
;
154 return env
->cp15
.ttbr0_el
[regime_el(env
, mmu_idx
)];
156 return env
->cp15
.ttbr1_el
[regime_el(env
, mmu_idx
)];
160 /* Return true if the specified stage of address translation is disabled */
161 static bool regime_translation_disabled(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
166 if (arm_feature(env
, ARM_FEATURE_M
)) {
167 switch (env
->v7m
.mpu_ctrl
[is_secure
] &
168 (R_V7M_MPU_CTRL_ENABLE_MASK
| R_V7M_MPU_CTRL_HFNMIENA_MASK
)) {
169 case R_V7M_MPU_CTRL_ENABLE_MASK
:
170 /* Enabled, but not for HardFault and NMI */
171 return mmu_idx
& ARM_MMU_IDX_M_NEGPRI
;
172 case R_V7M_MPU_CTRL_ENABLE_MASK
| R_V7M_MPU_CTRL_HFNMIENA_MASK
:
173 /* Enabled for all cases */
178 * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
179 * we warned about that in armv7m_nvic.c when the guest set it.
185 hcr_el2
= arm_hcr_el2_eff_secstate(env
, is_secure
);
188 case ARMMMUIdx_Stage2
:
189 case ARMMMUIdx_Stage2_S
:
190 /* HCR.DC means HCR.VM behaves as 1 */
191 return (hcr_el2
& (HCR_DC
| HCR_VM
)) == 0;
193 case ARMMMUIdx_E10_0
:
194 case ARMMMUIdx_E10_1
:
195 case ARMMMUIdx_E10_1_PAN
:
196 /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
197 if (hcr_el2
& HCR_TGE
) {
202 case ARMMMUIdx_Stage1_E0
:
203 case ARMMMUIdx_Stage1_E1
:
204 case ARMMMUIdx_Stage1_E1_PAN
:
205 /* HCR.DC means SCTLR_EL1.M behaves as 0 */
206 if (hcr_el2
& HCR_DC
) {
211 case ARMMMUIdx_E20_0
:
212 case ARMMMUIdx_E20_2
:
213 case ARMMMUIdx_E20_2_PAN
:
218 case ARMMMUIdx_Phys_S
:
219 case ARMMMUIdx_Phys_NS
:
220 case ARMMMUIdx_Phys_Root
:
221 case ARMMMUIdx_Phys_Realm
:
222 /* No translation for physical address spaces. */
226 g_assert_not_reached();
229 return (regime_sctlr(env
, mmu_idx
) & SCTLR_M
) == 0;
232 static bool S2_attrs_are_device(uint64_t hcr
, uint8_t attrs
)
235 * For an S1 page table walk, the stage 1 attributes are always
236 * some form of "this is Normal memory". The combined S1+S2
237 * attributes are therefore only Device if stage 2 specifies Device.
238 * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00,
239 * ie when cacheattrs.attrs bits [3:2] are 0b00.
240 * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie
241 * when cacheattrs.attrs bit [2] is 0.
244 return (attrs
& 0x4) == 0;
246 return (attrs
& 0xc) == 0;
250 /* Translate a S1 pagetable walk through S2 if needed. */
251 static bool S1_ptw_translate(CPUARMState
*env
, S1Translate
*ptw
,
252 hwaddr addr
, ARMMMUFaultInfo
*fi
)
254 ARMSecuritySpace space
= ptw
->in_space
;
255 bool is_secure
= ptw
->in_secure
;
256 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
257 ARMMMUIdx s2_mmu_idx
= ptw
->in_ptw_idx
;
260 ptw
->out_virt
= addr
;
262 if (unlikely(ptw
->in_debug
)) {
264 * From gdbstub, do not use softmmu so that we don't modify the
265 * state of the cpu at all, including softmmu tlb contents.
267 if (regime_is_stage2(s2_mmu_idx
)) {
268 S1Translate s2ptw
= {
269 .in_mmu_idx
= s2_mmu_idx
,
270 .in_ptw_idx
= ptw_idx_for_stage_2(env
, s2_mmu_idx
),
271 .in_secure
= s2_mmu_idx
== ARMMMUIdx_Stage2_S
,
272 .in_space
= (s2_mmu_idx
== ARMMMUIdx_Stage2_S
? ARMSS_Secure
273 : space
== ARMSS_Realm
? ARMSS_Realm
277 GetPhysAddrResult s2
= { };
279 if (get_phys_addr_lpae(env
, &s2ptw
, addr
, MMU_DATA_LOAD
,
283 ptw
->out_phys
= s2
.f
.phys_addr
;
284 pte_attrs
= s2
.cacheattrs
.attrs
;
285 ptw
->out_secure
= s2
.f
.attrs
.secure
;
286 ptw
->out_space
= s2
.f
.attrs
.space
;
288 /* Regime is physical. */
289 ptw
->out_phys
= addr
;
291 ptw
->out_secure
= s2_mmu_idx
== ARMMMUIdx_Phys_S
;
292 ptw
->out_space
= (s2_mmu_idx
== ARMMMUIdx_Phys_S
? ARMSS_Secure
293 : space
== ARMSS_Realm
? ARMSS_Realm
296 ptw
->out_host
= NULL
;
300 CPUTLBEntryFull
*full
;
304 flags
= probe_access_full(env
, addr
, 0, MMU_DATA_LOAD
,
305 arm_to_core_mmu_idx(s2_mmu_idx
),
306 true, &ptw
->out_host
, &full
, 0);
309 if (unlikely(flags
& TLB_INVALID_MASK
)) {
312 ptw
->out_phys
= full
->phys_addr
| (addr
& ~TARGET_PAGE_MASK
);
313 ptw
->out_rw
= full
->prot
& PAGE_WRITE
;
314 pte_attrs
= full
->pte_attrs
;
315 ptw
->out_secure
= full
->attrs
.secure
;
316 ptw
->out_space
= full
->attrs
.space
;
318 g_assert_not_reached();
322 if (regime_is_stage2(s2_mmu_idx
)) {
323 uint64_t hcr
= arm_hcr_el2_eff_secstate(env
, is_secure
);
325 if ((hcr
& HCR_PTW
) && S2_attrs_are_device(hcr
, pte_attrs
)) {
327 * PTW set and S1 walk touched S2 Device memory:
328 * generate Permission fault.
330 fi
->type
= ARMFault_Permission
;
334 fi
->s1ns
= !is_secure
;
339 ptw
->out_be
= regime_translation_big_endian(env
, mmu_idx
);
343 assert(fi
->type
!= ARMFault_None
);
347 fi
->s1ns
= !is_secure
;
351 /* All loads done in the course of a page table walk go through here. */
352 static uint32_t arm_ldl_ptw(CPUARMState
*env
, S1Translate
*ptw
,
355 CPUState
*cs
= env_cpu(env
);
356 void *host
= ptw
->out_host
;
360 /* Page tables are in RAM, and we have the host address. */
361 data
= qatomic_read((uint32_t *)host
);
363 data
= be32_to_cpu(data
);
365 data
= le32_to_cpu(data
);
368 /* Page tables are in MMIO. */
370 .secure
= ptw
->out_secure
,
371 .space
= ptw
->out_space
,
373 AddressSpace
*as
= arm_addressspace(cs
, attrs
);
374 MemTxResult result
= MEMTX_OK
;
377 data
= address_space_ldl_be(as
, ptw
->out_phys
, attrs
, &result
);
379 data
= address_space_ldl_le(as
, ptw
->out_phys
, attrs
, &result
);
381 if (unlikely(result
!= MEMTX_OK
)) {
382 fi
->type
= ARMFault_SyncExternalOnWalk
;
383 fi
->ea
= arm_extabort_type(result
);
390 static uint64_t arm_ldq_ptw(CPUARMState
*env
, S1Translate
*ptw
,
393 CPUState
*cs
= env_cpu(env
);
394 void *host
= ptw
->out_host
;
398 /* Page tables are in RAM, and we have the host address. */
399 #ifdef CONFIG_ATOMIC64
400 data
= qatomic_read__nocheck((uint64_t *)host
);
402 data
= be64_to_cpu(data
);
404 data
= le64_to_cpu(data
);
408 data
= ldq_be_p(host
);
410 data
= ldq_le_p(host
);
414 /* Page tables are in MMIO. */
416 .secure
= ptw
->out_secure
,
417 .space
= ptw
->out_space
,
419 AddressSpace
*as
= arm_addressspace(cs
, attrs
);
420 MemTxResult result
= MEMTX_OK
;
423 data
= address_space_ldq_be(as
, ptw
->out_phys
, attrs
, &result
);
425 data
= address_space_ldq_le(as
, ptw
->out_phys
, attrs
, &result
);
427 if (unlikely(result
!= MEMTX_OK
)) {
428 fi
->type
= ARMFault_SyncExternalOnWalk
;
429 fi
->ea
= arm_extabort_type(result
);
436 static uint64_t arm_casq_ptw(CPUARMState
*env
, uint64_t old_val
,
437 uint64_t new_val
, S1Translate
*ptw
,
440 #ifdef TARGET_AARCH64
442 void *host
= ptw
->out_host
;
444 if (unlikely(!host
)) {
445 fi
->type
= ARMFault_UnsuppAtomicUpdate
;
451 * Raising a stage2 Protection fault for an atomic update to a read-only
452 * page is delayed until it is certain that there is a change to make.
454 if (unlikely(!ptw
->out_rw
)) {
459 flags
= probe_access_flags(env
, ptw
->out_virt
, 0, MMU_DATA_STORE
,
460 arm_to_core_mmu_idx(ptw
->in_ptw_idx
),
464 if (unlikely(flags
& TLB_INVALID_MASK
)) {
465 assert(fi
->type
!= ARMFault_None
);
466 fi
->s2addr
= ptw
->out_virt
;
469 fi
->s1ns
= !ptw
->in_secure
;
473 /* In case CAS mismatches and we loop, remember writability. */
477 #ifdef CONFIG_ATOMIC64
479 old_val
= cpu_to_be64(old_val
);
480 new_val
= cpu_to_be64(new_val
);
481 cur_val
= qatomic_cmpxchg__nocheck((uint64_t *)host
, old_val
, new_val
);
482 cur_val
= be64_to_cpu(cur_val
);
484 old_val
= cpu_to_le64(old_val
);
485 new_val
= cpu_to_le64(new_val
);
486 cur_val
= qatomic_cmpxchg__nocheck((uint64_t *)host
, old_val
, new_val
);
487 cur_val
= le64_to_cpu(cur_val
);
491 * We can't support the full 64-bit atomic cmpxchg on the host.
492 * Because this is only used for FEAT_HAFDBS, which is only for AA64,
493 * we know that TCG_OVERSIZED_GUEST is set, which means that we are
494 * running in round-robin mode and could only race with dma i/o.
496 #if !TCG_OVERSIZED_GUEST
497 # error "Unexpected configuration"
499 bool locked
= qemu_mutex_iothread_locked();
501 qemu_mutex_lock_iothread();
504 cur_val
= ldq_be_p(host
);
505 if (cur_val
== old_val
) {
506 stq_be_p(host
, new_val
);
509 cur_val
= ldq_le_p(host
);
510 if (cur_val
== old_val
) {
511 stq_le_p(host
, new_val
);
515 qemu_mutex_unlock_iothread();
521 /* AArch32 does not have FEAT_HADFS. */
522 g_assert_not_reached();
526 static bool get_level1_table_address(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
527 uint32_t *table
, uint32_t address
)
529 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
530 uint64_t tcr
= regime_tcr(env
, mmu_idx
);
531 int maskshift
= extract32(tcr
, 0, 3);
532 uint32_t mask
= ~(((uint32_t)0xffffffffu
) >> maskshift
);
535 if (address
& mask
) {
536 if (tcr
& TTBCR_PD1
) {
537 /* Translation table walk disabled for TTBR1 */
540 *table
= regime_ttbr(env
, mmu_idx
, 1) & 0xffffc000;
542 if (tcr
& TTBCR_PD0
) {
543 /* Translation table walk disabled for TTBR0 */
546 base_mask
= ~((uint32_t)0x3fffu
>> maskshift
);
547 *table
= regime_ttbr(env
, mmu_idx
, 0) & base_mask
;
549 *table
|= (address
>> 18) & 0x3ffc;
554 * Translate section/page access permissions to page R/W protection flags
556 * @mmu_idx: MMU index indicating required translation regime
557 * @ap: The 3-bit access permissions (AP[2:0])
558 * @domain_prot: The 2-bit domain access permissions
559 * @is_user: TRUE if accessing from PL0
561 static int ap_to_rw_prot_is_user(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
562 int ap
, int domain_prot
, bool is_user
)
564 if (domain_prot
== 3) {
565 return PAGE_READ
| PAGE_WRITE
;
570 if (arm_feature(env
, ARM_FEATURE_V7
)) {
573 switch (regime_sctlr(env
, mmu_idx
) & (SCTLR_S
| SCTLR_R
)) {
575 return is_user
? 0 : PAGE_READ
;
582 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
587 return PAGE_READ
| PAGE_WRITE
;
590 return PAGE_READ
| PAGE_WRITE
;
591 case 4: /* Reserved. */
594 return is_user
? 0 : PAGE_READ
;
598 if (!arm_feature(env
, ARM_FEATURE_V6K
)) {
603 g_assert_not_reached();
608 * Translate section/page access permissions to page R/W protection flags
610 * @mmu_idx: MMU index indicating required translation regime
611 * @ap: The 3-bit access permissions (AP[2:0])
612 * @domain_prot: The 2-bit domain access permissions
614 static int ap_to_rw_prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
615 int ap
, int domain_prot
)
617 return ap_to_rw_prot_is_user(env
, mmu_idx
, ap
, domain_prot
,
618 regime_is_user(env
, mmu_idx
));
622 * Translate section/page access permissions to page R/W protection flags.
623 * @ap: The 2-bit simple AP (AP[2:1])
624 * @is_user: TRUE if accessing from PL0
626 static int simple_ap_to_rw_prot_is_user(int ap
, bool is_user
)
630 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
632 return PAGE_READ
| PAGE_WRITE
;
634 return is_user
? 0 : PAGE_READ
;
638 g_assert_not_reached();
642 static int simple_ap_to_rw_prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
, int ap
)
644 return simple_ap_to_rw_prot_is_user(ap
, regime_is_user(env
, mmu_idx
));
647 static bool get_phys_addr_v5(CPUARMState
*env
, S1Translate
*ptw
,
648 uint32_t address
, MMUAccessType access_type
,
649 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
661 /* Pagetable walk. */
662 /* Lookup l1 descriptor. */
663 if (!get_level1_table_address(env
, ptw
->in_mmu_idx
, &table
, address
)) {
664 /* Section translation fault if page walk is disabled by PD0 or PD1 */
665 fi
->type
= ARMFault_Translation
;
668 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
671 desc
= arm_ldl_ptw(env
, ptw
, fi
);
672 if (fi
->type
!= ARMFault_None
) {
676 domain
= (desc
>> 5) & 0x0f;
677 if (regime_el(env
, ptw
->in_mmu_idx
) == 1) {
678 dacr
= env
->cp15
.dacr_ns
;
680 dacr
= env
->cp15
.dacr_s
;
682 domain_prot
= (dacr
>> (domain
* 2)) & 3;
684 /* Section translation fault. */
685 fi
->type
= ARMFault_Translation
;
691 if (domain_prot
== 0 || domain_prot
== 2) {
692 fi
->type
= ARMFault_Domain
;
697 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
698 ap
= (desc
>> 10) & 3;
699 result
->f
.lg_page_size
= 20; /* 1MB */
701 /* Lookup l2 entry. */
703 /* Coarse pagetable. */
704 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
706 /* Fine pagetable. */
707 table
= (desc
& 0xfffff000) | ((address
>> 8) & 0xffc);
709 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
712 desc
= arm_ldl_ptw(env
, ptw
, fi
);
713 if (fi
->type
!= ARMFault_None
) {
717 case 0: /* Page translation fault. */
718 fi
->type
= ARMFault_Translation
;
720 case 1: /* 64k page. */
721 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
722 ap
= (desc
>> (4 + ((address
>> 13) & 6))) & 3;
723 result
->f
.lg_page_size
= 16;
725 case 2: /* 4k page. */
726 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
727 ap
= (desc
>> (4 + ((address
>> 9) & 6))) & 3;
728 result
->f
.lg_page_size
= 12;
730 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
732 /* ARMv6/XScale extended small page format */
733 if (arm_feature(env
, ARM_FEATURE_XSCALE
)
734 || arm_feature(env
, ARM_FEATURE_V6
)) {
735 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
736 result
->f
.lg_page_size
= 12;
739 * UNPREDICTABLE in ARMv5; we choose to take a
740 * page translation fault.
742 fi
->type
= ARMFault_Translation
;
746 phys_addr
= (desc
& 0xfffffc00) | (address
& 0x3ff);
747 result
->f
.lg_page_size
= 10;
749 ap
= (desc
>> 4) & 3;
752 /* Never happens, but compiler isn't smart enough to tell. */
753 g_assert_not_reached();
756 result
->f
.prot
= ap_to_rw_prot(env
, ptw
->in_mmu_idx
, ap
, domain_prot
);
757 result
->f
.prot
|= result
->f
.prot
? PAGE_EXEC
: 0;
758 if (!(result
->f
.prot
& (1 << access_type
))) {
759 /* Access permission fault. */
760 fi
->type
= ARMFault_Permission
;
763 result
->f
.phys_addr
= phys_addr
;
771 static bool get_phys_addr_v6(CPUARMState
*env
, S1Translate
*ptw
,
772 uint32_t address
, MMUAccessType access_type
,
773 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
775 ARMCPU
*cpu
= env_archcpu(env
);
776 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
791 /* Pagetable walk. */
792 /* Lookup l1 descriptor. */
793 if (!get_level1_table_address(env
, mmu_idx
, &table
, address
)) {
794 /* Section translation fault if page walk is disabled by PD0 or PD1 */
795 fi
->type
= ARMFault_Translation
;
798 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
801 desc
= arm_ldl_ptw(env
, ptw
, fi
);
802 if (fi
->type
!= ARMFault_None
) {
806 if (type
== 0 || (type
== 3 && !cpu_isar_feature(aa32_pxn
, cpu
))) {
807 /* Section translation fault, or attempt to use the encoding
808 * which is Reserved on implementations without PXN.
810 fi
->type
= ARMFault_Translation
;
813 if ((type
== 1) || !(desc
& (1 << 18))) {
814 /* Page or Section. */
815 domain
= (desc
>> 5) & 0x0f;
817 if (regime_el(env
, mmu_idx
) == 1) {
818 dacr
= env
->cp15
.dacr_ns
;
820 dacr
= env
->cp15
.dacr_s
;
825 domain_prot
= (dacr
>> (domain
* 2)) & 3;
826 if (domain_prot
== 0 || domain_prot
== 2) {
827 /* Section or Page domain fault */
828 fi
->type
= ARMFault_Domain
;
832 if (desc
& (1 << 18)) {
834 phys_addr
= (desc
& 0xff000000) | (address
& 0x00ffffff);
835 phys_addr
|= (uint64_t)extract32(desc
, 20, 4) << 32;
836 phys_addr
|= (uint64_t)extract32(desc
, 5, 4) << 36;
837 result
->f
.lg_page_size
= 24; /* 16MB */
840 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
841 result
->f
.lg_page_size
= 20; /* 1MB */
843 ap
= ((desc
>> 10) & 3) | ((desc
>> 13) & 4);
844 xn
= desc
& (1 << 4);
846 ns
= extract32(desc
, 19, 1);
848 if (cpu_isar_feature(aa32_pxn
, cpu
)) {
849 pxn
= (desc
>> 2) & 1;
851 ns
= extract32(desc
, 3, 1);
852 /* Lookup l2 entry. */
853 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
854 if (!S1_ptw_translate(env
, ptw
, table
, fi
)) {
857 desc
= arm_ldl_ptw(env
, ptw
, fi
);
858 if (fi
->type
!= ARMFault_None
) {
861 ap
= ((desc
>> 4) & 3) | ((desc
>> 7) & 4);
863 case 0: /* Page translation fault. */
864 fi
->type
= ARMFault_Translation
;
866 case 1: /* 64k page. */
867 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
868 xn
= desc
& (1 << 15);
869 result
->f
.lg_page_size
= 16;
871 case 2: case 3: /* 4k page. */
872 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
874 result
->f
.lg_page_size
= 12;
877 /* Never happens, but compiler isn't smart enough to tell. */
878 g_assert_not_reached();
881 if (domain_prot
== 3) {
882 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
884 if (pxn
&& !regime_is_user(env
, mmu_idx
)) {
887 if (xn
&& access_type
== MMU_INST_FETCH
) {
888 fi
->type
= ARMFault_Permission
;
892 if (arm_feature(env
, ARM_FEATURE_V6K
) &&
893 (regime_sctlr(env
, mmu_idx
) & SCTLR_AFE
)) {
894 /* The simplified model uses AP[0] as an access control bit. */
896 /* Access flag fault. */
897 fi
->type
= ARMFault_AccessFlag
;
900 result
->f
.prot
= simple_ap_to_rw_prot(env
, mmu_idx
, ap
>> 1);
901 user_prot
= simple_ap_to_rw_prot_is_user(ap
>> 1, 1);
903 result
->f
.prot
= ap_to_rw_prot(env
, mmu_idx
, ap
, domain_prot
);
904 user_prot
= ap_to_rw_prot_is_user(env
, mmu_idx
, ap
, domain_prot
, 1);
906 if (result
->f
.prot
&& !xn
) {
907 result
->f
.prot
|= PAGE_EXEC
;
909 if (!(result
->f
.prot
& (1 << access_type
))) {
910 /* Access permission fault. */
911 fi
->type
= ARMFault_Permission
;
914 if (regime_is_pan(env
, mmu_idx
) &&
915 !regime_is_user(env
, mmu_idx
) &&
917 access_type
!= MMU_INST_FETCH
) {
918 /* Privileged Access Never fault */
919 fi
->type
= ARMFault_Permission
;
924 /* The NS bit will (as required by the architecture) have no effect if
925 * the CPU doesn't support TZ or this is a non-secure translation
926 * regime, because the attribute will already be non-secure.
928 result
->f
.attrs
.secure
= false;
929 result
->f
.attrs
.space
= ARMSS_NonSecure
;
931 result
->f
.phys_addr
= phys_addr
;
940 * Translate S2 section/page access permissions to protection flags
942 * @s2ap: The 2-bit stage2 access permissions (S2AP)
943 * @xn: XN (execute-never) bits
944 * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
946 static int get_S2prot(CPUARMState
*env
, int s2ap
, int xn
, bool s1_is_el0
)
957 if (cpu_isar_feature(any_tts2uxn
, env_archcpu(env
))) {
975 g_assert_not_reached();
978 if (!extract32(xn
, 1, 1)) {
979 if (arm_el_is_aa64(env
, 2) || prot
& PAGE_READ
) {
988 * Translate section/page access permissions to protection flags
990 * @mmu_idx: MMU index indicating required translation regime
991 * @is_aa64: TRUE if AArch64
992 * @ap: The 2-bit simple AP (AP[2:1])
993 * @ns: NS (non-secure) bit
994 * @xn: XN (execute-never) bit
995 * @pxn: PXN (privileged execute-never) bit
997 static int get_S1prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
, bool is_aa64
,
998 int ap
, int ns
, int xn
, int pxn
)
1000 ARMCPU
*cpu
= env_archcpu(env
);
1001 bool is_user
= regime_is_user(env
, mmu_idx
);
1002 int prot_rw
, user_rw
;
1006 assert(!regime_is_stage2(mmu_idx
));
1008 user_rw
= simple_ap_to_rw_prot_is_user(ap
, true);
1013 * PAN controls can forbid data accesses but don't affect insn fetch.
1014 * Plain PAN forbids data accesses if EL0 has data permissions;
1015 * PAN3 forbids data accesses if EL0 has either data or exec perms.
1016 * Note that for AArch64 the 'user can exec' case is exactly !xn.
1017 * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0
1018 * do not affect EPAN.
1020 if (user_rw
&& regime_is_pan(env
, mmu_idx
)) {
1022 } else if (cpu_isar_feature(aa64_pan3
, cpu
) && is_aa64
&&
1023 regime_is_pan(env
, mmu_idx
) &&
1024 (regime_sctlr(env
, mmu_idx
) & SCTLR_EPAN
) && !xn
) {
1027 prot_rw
= simple_ap_to_rw_prot_is_user(ap
, false);
1031 if (ns
&& arm_is_secure(env
) && (env
->cp15
.scr_el3
& SCR_SIF
)) {
1035 /* TODO have_wxn should be replaced with
1036 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
1037 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
1038 * compatible processors have EL2, which is required for [U]WXN.
1040 have_wxn
= arm_feature(env
, ARM_FEATURE_LPAE
);
1043 wxn
= regime_sctlr(env
, mmu_idx
) & SCTLR_WXN
;
1047 if (regime_has_2_ranges(mmu_idx
) && !is_user
) {
1048 xn
= pxn
|| (user_rw
& PAGE_WRITE
);
1050 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
1051 switch (regime_el(env
, mmu_idx
)) {
1055 xn
= xn
|| !(user_rw
& PAGE_READ
);
1059 uwxn
= regime_sctlr(env
, mmu_idx
) & SCTLR_UWXN
;
1061 xn
= xn
|| !(prot_rw
& PAGE_READ
) || pxn
||
1062 (uwxn
&& (user_rw
& PAGE_WRITE
));
1072 if (xn
|| (wxn
&& (prot_rw
& PAGE_WRITE
))) {
1075 return prot_rw
| PAGE_EXEC
;
1078 static ARMVAParameters
aa32_va_parameters(CPUARMState
*env
, uint32_t va
,
1081 uint64_t tcr
= regime_tcr(env
, mmu_idx
);
1082 uint32_t el
= regime_el(env
, mmu_idx
);
1086 assert(mmu_idx
!= ARMMMUIdx_Stage2_S
);
1088 if (mmu_idx
== ARMMMUIdx_Stage2
) {
1090 bool sext
= extract32(tcr
, 4, 1);
1091 bool sign
= extract32(tcr
, 3, 1);
1094 * If the sign-extend bit is not the same as t0sz[3], the result
1095 * is unpredictable. Flag this as a guest error.
1098 qemu_log_mask(LOG_GUEST_ERROR
,
1099 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
1101 tsz
= sextract32(tcr
, 0, 4) + 8;
1105 } else if (el
== 2) {
1107 tsz
= extract32(tcr
, 0, 3);
1109 hpd
= extract64(tcr
, 24, 1);
1112 int t0sz
= extract32(tcr
, 0, 3);
1113 int t1sz
= extract32(tcr
, 16, 3);
1116 select
= va
> (0xffffffffu
>> t0sz
);
1118 /* Note that we will detect errors later. */
1119 select
= va
>= ~(0xffffffffu
>> t1sz
);
1123 epd
= extract32(tcr
, 7, 1);
1124 hpd
= extract64(tcr
, 41, 1);
1127 epd
= extract32(tcr
, 23, 1);
1128 hpd
= extract64(tcr
, 42, 1);
1130 /* For aarch32, hpd0 is not enabled without t2e as well. */
1131 hpd
&= extract32(tcr
, 6, 1);
1134 return (ARMVAParameters
) {
1143 * check_s2_mmu_setup
1145 * @is_aa64: True if the translation regime is in AArch64 state
1146 * @tcr: VTCR_EL2 or VSTCR_EL2
1147 * @ds: Effective value of TCR.DS.
1148 * @iasize: Bitsize of IPAs
1149 * @stride: Page-table stride (See the ARM ARM)
1151 * Decode the starting level of the S2 lookup, returning INT_MIN if
1152 * the configuration is invalid.
1154 static int check_s2_mmu_setup(ARMCPU
*cpu
, bool is_aa64
, uint64_t tcr
,
1155 bool ds
, int iasize
, int stride
)
1157 int sl0
, sl2
, startlevel
, granulebits
, levels
;
1158 int s1_min_iasize
, s1_max_iasize
;
1160 sl0
= extract32(tcr
, 6, 2);
1163 * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
1164 * so interleave AArch64.S2StartLevel.
1168 /* SL2 is RES0 unless DS=1 & 4KB granule. */
1169 sl2
= extract64(tcr
, 33, 1);
1176 startlevel
= 2 - sl0
;
1179 if (arm_pamax(cpu
) < 44) {
1184 if (!cpu_isar_feature(aa64_st
, cpu
)) {
1195 if (arm_pamax(cpu
) < 42) {
1205 startlevel
= 3 - sl0
;
1210 if (arm_pamax(cpu
) < 44) {
1217 startlevel
= 3 - sl0
;
1220 g_assert_not_reached();
1224 * Things are simpler for AArch32 EL2, with only 4k pages.
1225 * There is no separate S2InvalidSL function, but AArch32.S2Walk
1226 * begins with walkparms.sl0 in {'1x'}.
1228 assert(stride
== 9);
1232 startlevel
= 2 - sl0
;
1235 /* AArch{64,32}.S2InconsistentSL are functionally equivalent. */
1236 levels
= 3 - startlevel
;
1237 granulebits
= stride
+ 3;
1239 s1_min_iasize
= levels
* stride
+ granulebits
+ 1;
1240 s1_max_iasize
= s1_min_iasize
+ (stride
- 1) + 4;
1242 if (iasize
>= s1_min_iasize
&& iasize
<= s1_max_iasize
) {
1251 * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
1253 * Returns false if the translation was successful. Otherwise, phys_ptr,
1254 * attrs, prot and page_size may not be filled in, and the populated fsr
1255 * value provides information on why the translation aborted, in the format
1256 * of a long-format DFSR/IFSR fault register, with the following caveat:
1257 * the WnR bit is never set (the caller must do this).
1260 * @ptw: Current and next stage parameters for the walk.
1261 * @address: virtual address to get physical address for
1262 * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
1263 * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
1264 * (so this is a stage 2 page table walk),
1265 * must be true if this is stage 2 of a stage 1+2
1266 * walk for an EL0 access. If @mmu_idx is anything else,
1267 * @s1_is_el0 is ignored.
1268 * @result: set on translation success,
1269 * @fi: set to fault info if the translation fails
1271 static bool get_phys_addr_lpae(CPUARMState
*env
, S1Translate
*ptw
,
1273 MMUAccessType access_type
, bool s1_is_el0
,
1274 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
1276 ARMCPU
*cpu
= env_archcpu(env
);
1277 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
1279 ARMVAParameters param
;
1281 hwaddr descaddr
, indexmask
, indexmask_grainsize
;
1282 uint32_t tableattrs
;
1283 target_ulong page_size
;
1286 int addrsize
, inputsize
, outputsize
;
1287 uint64_t tcr
= regime_tcr(env
, mmu_idx
);
1288 int ap
, ns
, xn
, pxn
;
1289 uint32_t el
= regime_el(env
, mmu_idx
);
1290 uint64_t descaddrmask
;
1291 bool aarch64
= arm_el_is_aa64(env
, el
);
1292 uint64_t descriptor
, new_descriptor
;
1294 /* TODO: This code does not support shareability levels. */
1298 param
= aa64_va_parameters(env
, address
, mmu_idx
,
1299 access_type
!= MMU_INST_FETCH
,
1300 !arm_el_is_aa64(env
, 1));
1304 * If TxSZ is programmed to a value larger than the maximum,
1305 * or smaller than the effective minimum, it is IMPLEMENTATION
1306 * DEFINED whether we behave as if the field were programmed
1307 * within bounds, or if a level 0 Translation fault is generated.
1309 * With FEAT_LVA, fault on less than minimum becomes required,
1310 * so our choice is to always raise the fault.
1312 if (param
.tsz_oob
) {
1313 goto do_translation_fault
;
1316 addrsize
= 64 - 8 * param
.tbi
;
1317 inputsize
= 64 - param
.tsz
;
1320 * Bound PS by PARANGE to find the effective output address size.
1321 * ID_AA64MMFR0 is a read-only register so values outside of the
1322 * supported mappings can be considered an implementation error.
1324 ps
= FIELD_EX64(cpu
->isar
.id_aa64mmfr0
, ID_AA64MMFR0
, PARANGE
);
1325 ps
= MIN(ps
, param
.ps
);
1326 assert(ps
< ARRAY_SIZE(pamax_map
));
1327 outputsize
= pamax_map
[ps
];
1330 * With LPA2, the effective output address (OA) size is at most 48 bits
1331 * unless TCR.DS == 1
1333 if (!param
.ds
&& param
.gran
!= Gran64K
) {
1334 outputsize
= MIN(outputsize
, 48);
1337 param
= aa32_va_parameters(env
, address
, mmu_idx
);
1339 addrsize
= (mmu_idx
== ARMMMUIdx_Stage2
? 40 : 32);
1340 inputsize
= addrsize
- param
.tsz
;
1345 * We determined the region when collecting the parameters, but we
1346 * have not yet validated that the address is valid for the region.
1347 * Extract the top bits and verify that they all match select.
1349 * For aa32, if inputsize == addrsize, then we have selected the
1350 * region by exclusion in aa32_va_parameters and there is no more
1351 * validation to do here.
1353 if (inputsize
< addrsize
) {
1354 target_ulong top_bits
= sextract64(address
, inputsize
,
1355 addrsize
- inputsize
);
1356 if (-top_bits
!= param
.select
) {
1357 /* The gap between the two regions is a Translation fault */
1358 goto do_translation_fault
;
1362 stride
= arm_granule_bits(param
.gran
) - 3;
1365 * Note that QEMU ignores shareability and cacheability attributes,
1366 * so we don't need to do anything with the SH, ORGN, IRGN fields
1367 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
1368 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
1369 * implement any ASID-like capability so we can ignore it (instead
1370 * we will always flush the TLB any time the ASID is changed).
1372 ttbr
= regime_ttbr(env
, mmu_idx
, param
.select
);
1375 * Here we should have set up all the parameters for the translation:
1376 * inputsize, ttbr, epd, stride, tbi
1381 * Translation table walk disabled => Translation fault on TLB miss
1382 * Note: This is always 0 on 64-bit EL2 and EL3.
1384 goto do_translation_fault
;
1387 if (!regime_is_stage2(mmu_idx
)) {
1389 * The starting level depends on the virtual address size (which can
1390 * be up to 48 bits) and the translation granule size. It indicates
1391 * the number of strides (stride bits at a time) needed to
1392 * consume the bits of the input address. In the pseudocode this is:
1393 * level = 4 - RoundUp((inputsize - grainsize) / stride)
1394 * where their 'inputsize' is our 'inputsize', 'grainsize' is
1395 * our 'stride + 3' and 'stride' is our 'stride'.
1396 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
1397 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
1398 * = 4 - (inputsize - 4) / stride;
1400 level
= 4 - (inputsize
- 4) / stride
;
1402 int startlevel
= check_s2_mmu_setup(cpu
, aarch64
, tcr
, param
.ds
,
1404 if (startlevel
== INT_MIN
) {
1406 goto do_translation_fault
;
1411 indexmask_grainsize
= MAKE_64BIT_MASK(0, stride
+ 3);
1412 indexmask
= MAKE_64BIT_MASK(0, inputsize
- (stride
* (4 - level
)));
1414 /* Now we can extract the actual base address from the TTBR */
1415 descaddr
= extract64(ttbr
, 0, 48);
1418 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
1420 * Otherwise, if the base address is out of range, raise AddressSizeFault.
1421 * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
1422 * but we've just cleared the bits above 47, so simplify the test.
1424 if (outputsize
> 48) {
1425 descaddr
|= extract64(ttbr
, 2, 4) << 48;
1426 } else if (descaddr
>> outputsize
) {
1428 fi
->type
= ARMFault_AddressSize
;
1433 * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
1434 * and also to mask out CnP (bit 0) which could validly be non-zero.
1436 descaddr
&= ~indexmask
;
1439 * For AArch32, the address field in the descriptor goes up to bit 39
1440 * for both v7 and v8. However, for v8 the SBZ bits [47:40] must be 0
1441 * or an AddressSize fault is raised. So for v8 we extract those SBZ
1442 * bits as part of the address, which will be checked via outputsize.
1443 * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
1444 * the highest bits of a 52-bit output are placed elsewhere.
1447 descaddrmask
= MAKE_64BIT_MASK(0, 50);
1448 } else if (arm_feature(env
, ARM_FEATURE_V8
)) {
1449 descaddrmask
= MAKE_64BIT_MASK(0, 48);
1451 descaddrmask
= MAKE_64BIT_MASK(0, 40);
1453 descaddrmask
&= ~indexmask_grainsize
;
1457 descaddr
|= (address
>> (stride
* (4 - level
))) & indexmask
;
1461 * Process the NSTable bit from the previous level. This changes
1462 * the table address space and the output space from Secure to
1463 * NonSecure. With RME, the EL3 translation regime does not change
1464 * from Root to NonSecure.
1466 if (ptw
->in_space
== ARMSS_Secure
1467 && !regime_is_stage2(mmu_idx
)
1468 && extract32(tableattrs
, 4, 1)) {
1470 * Stage2_S -> Stage2 or Phys_S -> Phys_NS
1471 * Assert the relative order of the secure/non-secure indexes.
1473 QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S
+ 1 != ARMMMUIdx_Phys_NS
);
1474 QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S
+ 1 != ARMMMUIdx_Stage2
);
1475 ptw
->in_ptw_idx
+= 1;
1476 ptw
->in_secure
= false;
1477 ptw
->in_space
= ARMSS_NonSecure
;
1480 if (!S1_ptw_translate(env
, ptw
, descaddr
, fi
)) {
1483 descriptor
= arm_ldq_ptw(env
, ptw
, fi
);
1484 if (fi
->type
!= ARMFault_None
) {
1487 new_descriptor
= descriptor
;
1489 restart_atomic_update
:
1490 if (!(descriptor
& 1) || (!(descriptor
& 2) && (level
== 3))) {
1491 /* Invalid, or the Reserved level 3 encoding */
1492 goto do_translation_fault
;
1495 descaddr
= descriptor
& descaddrmask
;
1498 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
1499 * of descriptor. For FEAT_LPA2 and effective DS, bits [51:50] of
1500 * descaddr are in [9:8]. Otherwise, if descaddr is out of range,
1501 * raise AddressSizeFault.
1503 if (outputsize
> 48) {
1505 descaddr
|= extract64(descriptor
, 8, 2) << 50;
1507 descaddr
|= extract64(descriptor
, 12, 4) << 48;
1509 } else if (descaddr
>> outputsize
) {
1510 fi
->type
= ARMFault_AddressSize
;
1514 if ((descriptor
& 2) && (level
< 3)) {
1516 * Table entry. The top five bits are attributes which may
1517 * propagate down through lower levels of the table (and
1518 * which are all arranged so that 0 means "no effect", so
1519 * we can gather them up by ORing in the bits at each level).
1521 tableattrs
|= extract64(descriptor
, 59, 5);
1523 indexmask
= indexmask_grainsize
;
1528 * Block entry at level 1 or 2, or page entry at level 3.
1529 * These are basically the same thing, although the number
1530 * of bits we pull in from the vaddr varies. Note that although
1531 * descaddrmask masks enough of the low bits of the descriptor
1532 * to give a correct page or table address, the address field
1533 * in a block descriptor is smaller; so we need to explicitly
1534 * clear the lower bits here before ORing in the low vaddr bits.
1536 * Afterward, descaddr is the final physical address.
1538 page_size
= (1ULL << ((stride
* (4 - level
)) + 3));
1539 descaddr
&= ~(hwaddr
)(page_size
- 1);
1540 descaddr
|= (address
& (page_size
- 1));
1542 if (likely(!ptw
->in_debug
)) {
1545 * If HA is enabled, prepare to update the descriptor below.
1546 * Otherwise, pass the access fault on to software.
1548 if (!(descriptor
& (1 << 10))) {
1550 new_descriptor
|= 1 << 10; /* AF */
1552 fi
->type
= ARMFault_AccessFlag
;
1559 * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
1560 * bit for writeback. The actual write protection test may still be
1561 * overridden by tableattrs, to be merged below.
1564 && extract64(descriptor
, 51, 1) /* DBM */
1565 && access_type
== MMU_DATA_STORE
) {
1566 if (regime_is_stage2(mmu_idx
)) {
1567 new_descriptor
|= 1ull << 7; /* set S2AP[1] */
1569 new_descriptor
&= ~(1ull << 7); /* clear AP[2] */
1575 * Extract attributes from the (modified) descriptor, and apply
1576 * table descriptors. Stage 2 table descriptors do not include
1577 * any attribute fields. HPD disables all the table attributes
1580 attrs
= new_descriptor
& (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
1581 if (!regime_is_stage2(mmu_idx
)) {
1582 attrs
|= !ptw
->in_secure
<< 5; /* NS */
1584 attrs
|= extract64(tableattrs
, 0, 2) << 53; /* XN, PXN */
1586 * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
1587 * means "force PL1 access only", which means forcing AP[1] to 0.
1589 attrs
&= ~(extract64(tableattrs
, 2, 1) << 6); /* !APT[0] => AP[1] */
1590 attrs
|= extract32(tableattrs
, 3, 1) << 7; /* APT[1] => AP[2] */
1594 ap
= extract32(attrs
, 6, 2);
1595 if (regime_is_stage2(mmu_idx
)) {
1596 ns
= mmu_idx
== ARMMMUIdx_Stage2
;
1597 xn
= extract64(attrs
, 53, 2);
1598 result
->f
.prot
= get_S2prot(env
, ap
, xn
, s1_is_el0
);
1600 ns
= extract32(attrs
, 5, 1);
1601 xn
= extract64(attrs
, 54, 1);
1602 pxn
= extract64(attrs
, 53, 1);
1603 result
->f
.prot
= get_S1prot(env
, mmu_idx
, aarch64
, ap
, ns
, xn
, pxn
);
1606 if (!(result
->f
.prot
& (1 << access_type
))) {
1607 fi
->type
= ARMFault_Permission
;
1611 /* If FEAT_HAFDBS has made changes, update the PTE. */
1612 if (new_descriptor
!= descriptor
) {
1613 new_descriptor
= arm_casq_ptw(env
, descriptor
, new_descriptor
, ptw
, fi
);
1614 if (fi
->type
!= ARMFault_None
) {
1618 * I_YZSVV says that if the in-memory descriptor has changed,
1619 * then we must use the information in that new value
1620 * (which might include a different output address, different
1621 * attributes, or generate a fault).
1622 * Restart the handling of the descriptor value from scratch.
1624 if (new_descriptor
!= descriptor
) {
1625 descriptor
= new_descriptor
;
1626 goto restart_atomic_update
;
1632 * The NS bit will (as required by the architecture) have no effect if
1633 * the CPU doesn't support TZ or this is a non-secure translation
1634 * regime, because the attribute will already be non-secure.
1636 result
->f
.attrs
.secure
= false;
1637 result
->f
.attrs
.space
= ARMSS_NonSecure
;
1640 if (regime_is_stage2(mmu_idx
)) {
1641 result
->cacheattrs
.is_s2_format
= true;
1642 result
->cacheattrs
.attrs
= extract32(attrs
, 2, 4);
1644 /* Index into MAIR registers for cache attributes */
1645 uint8_t attrindx
= extract32(attrs
, 2, 3);
1646 uint64_t mair
= env
->cp15
.mair_el
[regime_el(env
, mmu_idx
)];
1647 assert(attrindx
<= 7);
1648 result
->cacheattrs
.is_s2_format
= false;
1649 result
->cacheattrs
.attrs
= extract64(mair
, attrindx
* 8, 8);
1651 /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
1652 if (aarch64
&& cpu_isar_feature(aa64_bti
, cpu
)) {
1653 result
->f
.guarded
= extract64(attrs
, 50, 1); /* GP */
1658 * For FEAT_LPA2 and effective DS, the SH field in the attributes
1659 * was re-purposed for output address bits. The SH attribute in
1660 * that case comes from TCR_ELx, which we extracted earlier.
1663 result
->cacheattrs
.shareability
= param
.sh
;
1665 result
->cacheattrs
.shareability
= extract32(attrs
, 8, 2);
1668 result
->f
.phys_addr
= descaddr
;
1669 result
->f
.lg_page_size
= ctz64(page_size
);
1672 do_translation_fault
:
1673 fi
->type
= ARMFault_Translation
;
1676 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */
1677 fi
->stage2
= fi
->s1ptw
|| regime_is_stage2(mmu_idx
);
1678 fi
->s1ns
= mmu_idx
== ARMMMUIdx_Stage2
;
1682 static bool get_phys_addr_pmsav5(CPUARMState
*env
, uint32_t address
,
1683 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
1684 bool is_secure
, GetPhysAddrResult
*result
,
1685 ARMMMUFaultInfo
*fi
)
1690 bool is_user
= regime_is_user(env
, mmu_idx
);
1692 if (regime_translation_disabled(env
, mmu_idx
, is_secure
)) {
1694 result
->f
.phys_addr
= address
;
1695 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
1699 result
->f
.phys_addr
= address
;
1700 for (n
= 7; n
>= 0; n
--) {
1701 base
= env
->cp15
.c6_region
[n
];
1702 if ((base
& 1) == 0) {
1705 mask
= 1 << ((base
>> 1) & 0x1f);
1706 /* Keep this shift separate from the above to avoid an
1707 (undefined) << 32. */
1708 mask
= (mask
<< 1) - 1;
1709 if (((base
^ address
) & ~mask
) == 0) {
1714 fi
->type
= ARMFault_Background
;
1718 if (access_type
== MMU_INST_FETCH
) {
1719 mask
= env
->cp15
.pmsav5_insn_ap
;
1721 mask
= env
->cp15
.pmsav5_data_ap
;
1723 mask
= (mask
>> (n
* 4)) & 0xf;
1726 fi
->type
= ARMFault_Permission
;
1731 fi
->type
= ARMFault_Permission
;
1735 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
;
1738 result
->f
.prot
= PAGE_READ
;
1740 result
->f
.prot
|= PAGE_WRITE
;
1744 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
;
1748 fi
->type
= ARMFault_Permission
;
1752 result
->f
.prot
= PAGE_READ
;
1755 result
->f
.prot
= PAGE_READ
;
1758 /* Bad permission. */
1759 fi
->type
= ARMFault_Permission
;
1763 result
->f
.prot
|= PAGE_EXEC
;
1767 static void get_phys_addr_pmsav7_default(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
1768 int32_t address
, uint8_t *prot
)
1770 if (!arm_feature(env
, ARM_FEATURE_M
)) {
1771 *prot
= PAGE_READ
| PAGE_WRITE
;
1773 case 0xF0000000 ... 0xFFFFFFFF:
1774 if (regime_sctlr(env
, mmu_idx
) & SCTLR_V
) {
1775 /* hivecs execing is ok */
1779 case 0x00000000 ... 0x7FFFFFFF:
1784 /* Default system address map for M profile cores.
1785 * The architecture specifies which regions are execute-never;
1786 * at the MPU level no other checks are defined.
1789 case 0x00000000 ... 0x1fffffff: /* ROM */
1790 case 0x20000000 ... 0x3fffffff: /* SRAM */
1791 case 0x60000000 ... 0x7fffffff: /* RAM */
1792 case 0x80000000 ... 0x9fffffff: /* RAM */
1793 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
1795 case 0x40000000 ... 0x5fffffff: /* Peripheral */
1796 case 0xa0000000 ... 0xbfffffff: /* Device */
1797 case 0xc0000000 ... 0xdfffffff: /* Device */
1798 case 0xe0000000 ... 0xffffffff: /* System */
1799 *prot
= PAGE_READ
| PAGE_WRITE
;
1802 g_assert_not_reached();
1807 static bool m_is_ppb_region(CPUARMState
*env
, uint32_t address
)
1809 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
1810 return arm_feature(env
, ARM_FEATURE_M
) &&
1811 extract32(address
, 20, 12) == 0xe00;
1814 static bool m_is_system_region(CPUARMState
*env
, uint32_t address
)
1817 * True if address is in the M profile system region
1818 * 0xe0000000 - 0xffffffff
1820 return arm_feature(env
, ARM_FEATURE_M
) && extract32(address
, 29, 3) == 0x7;
1823 static bool pmsav7_use_background_region(ARMCPU
*cpu
, ARMMMUIdx mmu_idx
,
1824 bool is_secure
, bool is_user
)
1827 * Return true if we should use the default memory map as a
1828 * "background" region if there are no hits against any MPU regions.
1830 CPUARMState
*env
= &cpu
->env
;
1836 if (arm_feature(env
, ARM_FEATURE_M
)) {
1837 return env
->v7m
.mpu_ctrl
[is_secure
] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK
;
1840 if (mmu_idx
== ARMMMUIdx_Stage2
) {
1844 return regime_sctlr(env
, mmu_idx
) & SCTLR_BR
;
1847 static bool get_phys_addr_pmsav7(CPUARMState
*env
, uint32_t address
,
1848 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
1849 bool secure
, GetPhysAddrResult
*result
,
1850 ARMMMUFaultInfo
*fi
)
1852 ARMCPU
*cpu
= env_archcpu(env
);
1854 bool is_user
= regime_is_user(env
, mmu_idx
);
1856 result
->f
.phys_addr
= address
;
1857 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
1860 if (regime_translation_disabled(env
, mmu_idx
, secure
) ||
1861 m_is_ppb_region(env
, address
)) {
1863 * MPU disabled or M profile PPB access: use default memory map.
1864 * The other case which uses the default memory map in the
1865 * v7M ARM ARM pseudocode is exception vector reads from the vector
1866 * table. In QEMU those accesses are done in arm_v7m_load_vector(),
1867 * which always does a direct read using address_space_ldl(), rather
1868 * than going via this function, so we don't need to check that here.
1870 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
, &result
->f
.prot
);
1871 } else { /* MPU enabled */
1872 for (n
= (int)cpu
->pmsav7_dregion
- 1; n
>= 0; n
--) {
1874 uint32_t base
= env
->pmsav7
.drbar
[n
];
1875 uint32_t rsize
= extract32(env
->pmsav7
.drsr
[n
], 1, 5);
1879 if (!(env
->pmsav7
.drsr
[n
] & 0x1)) {
1884 qemu_log_mask(LOG_GUEST_ERROR
,
1885 "DRSR[%d]: Rsize field cannot be 0\n", n
);
1889 rmask
= (1ull << rsize
) - 1;
1892 qemu_log_mask(LOG_GUEST_ERROR
,
1893 "DRBAR[%d]: 0x%" PRIx32
" misaligned "
1894 "to DRSR region size, mask = 0x%" PRIx32
"\n",
1899 if (address
< base
|| address
> base
+ rmask
) {
1901 * Address not in this region. We must check whether the
1902 * region covers addresses in the same page as our address.
1903 * In that case we must not report a size that covers the
1904 * whole page for a subsequent hit against a different MPU
1905 * region or the background region, because it would result in
1906 * incorrect TLB hits for subsequent accesses to addresses that
1907 * are in this MPU region.
1909 if (ranges_overlap(base
, rmask
,
1910 address
& TARGET_PAGE_MASK
,
1911 TARGET_PAGE_SIZE
)) {
1912 result
->f
.lg_page_size
= 0;
1917 /* Region matched */
1919 if (rsize
>= 8) { /* no subregions for regions < 256 bytes */
1921 uint32_t srdis_mask
;
1923 rsize
-= 3; /* sub region size (power of 2) */
1924 snd
= ((address
- base
) >> rsize
) & 0x7;
1925 srdis
= extract32(env
->pmsav7
.drsr
[n
], snd
+ 8, 1);
1927 srdis_mask
= srdis
? 0x3 : 0x0;
1928 for (i
= 2; i
<= 8 && rsize
< TARGET_PAGE_BITS
; i
*= 2) {
1930 * This will check in groups of 2, 4 and then 8, whether
1931 * the subregion bits are consistent. rsize is incremented
1932 * back up to give the region size, considering consistent
1933 * adjacent subregions as one region. Stop testing if rsize
1934 * is already big enough for an entire QEMU page.
1936 int snd_rounded
= snd
& ~(i
- 1);
1937 uint32_t srdis_multi
= extract32(env
->pmsav7
.drsr
[n
],
1938 snd_rounded
+ 8, i
);
1939 if (srdis_mask
^ srdis_multi
) {
1942 srdis_mask
= (srdis_mask
<< i
) | srdis_mask
;
1949 if (rsize
< TARGET_PAGE_BITS
) {
1950 result
->f
.lg_page_size
= rsize
;
1955 if (n
== -1) { /* no hits */
1956 if (!pmsav7_use_background_region(cpu
, mmu_idx
, secure
, is_user
)) {
1957 /* background fault */
1958 fi
->type
= ARMFault_Background
;
1961 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
,
1963 } else { /* a MPU hit! */
1964 uint32_t ap
= extract32(env
->pmsav7
.dracr
[n
], 8, 3);
1965 uint32_t xn
= extract32(env
->pmsav7
.dracr
[n
], 12, 1);
1967 if (m_is_system_region(env
, address
)) {
1968 /* System space is always execute never */
1972 if (is_user
) { /* User mode AP bit decoding */
1977 break; /* no access */
1979 result
->f
.prot
|= PAGE_WRITE
;
1983 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
1986 /* for v7M, same as 6; for R profile a reserved value */
1987 if (arm_feature(env
, ARM_FEATURE_M
)) {
1988 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
1993 qemu_log_mask(LOG_GUEST_ERROR
,
1994 "DRACR[%d]: Bad value for AP bits: 0x%"
1995 PRIx32
"\n", n
, ap
);
1997 } else { /* Priv. mode AP bits decoding */
2000 break; /* no access */
2004 result
->f
.prot
|= PAGE_WRITE
;
2008 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
2011 /* for v7M, same as 6; for R profile a reserved value */
2012 if (arm_feature(env
, ARM_FEATURE_M
)) {
2013 result
->f
.prot
|= PAGE_READ
| PAGE_EXEC
;
2018 qemu_log_mask(LOG_GUEST_ERROR
,
2019 "DRACR[%d]: Bad value for AP bits: 0x%"
2020 PRIx32
"\n", n
, ap
);
2026 result
->f
.prot
&= ~PAGE_EXEC
;
2031 fi
->type
= ARMFault_Permission
;
2033 return !(result
->f
.prot
& (1 << access_type
));
2036 static uint32_t *regime_rbar(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
2039 if (regime_el(env
, mmu_idx
) == 2) {
2040 return env
->pmsav8
.hprbar
;
2042 return env
->pmsav8
.rbar
[secure
];
2046 static uint32_t *regime_rlar(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
2049 if (regime_el(env
, mmu_idx
) == 2) {
2050 return env
->pmsav8
.hprlar
;
2052 return env
->pmsav8
.rlar
[secure
];
2056 bool pmsav8_mpu_lookup(CPUARMState
*env
, uint32_t address
,
2057 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
2058 bool secure
, GetPhysAddrResult
*result
,
2059 ARMMMUFaultInfo
*fi
, uint32_t *mregion
)
2062 * Perform a PMSAv8 MPU lookup (without also doing the SAU check
2063 * that a full phys-to-virt translation does).
2064 * mregion is (if not NULL) set to the region number which matched,
2065 * or -1 if no region number is returned (MPU off, address did not
2066 * hit a region, address hit in multiple regions).
2067 * If the region hit doesn't cover the entire TARGET_PAGE the address
2068 * is within, then we set the result page_size to 1 to force the
2069 * memory system to use a subpage.
2071 ARMCPU
*cpu
= env_archcpu(env
);
2072 bool is_user
= regime_is_user(env
, mmu_idx
);
2074 int matchregion
= -1;
2076 uint32_t addr_page_base
= address
& TARGET_PAGE_MASK
;
2077 uint32_t addr_page_limit
= addr_page_base
+ (TARGET_PAGE_SIZE
- 1);
2080 if (regime_el(env
, mmu_idx
) == 2) {
2081 region_counter
= cpu
->pmsav8r_hdregion
;
2083 region_counter
= cpu
->pmsav7_dregion
;
2086 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
2087 result
->f
.phys_addr
= address
;
2093 if (mmu_idx
== ARMMMUIdx_Stage2
) {
2098 * Unlike the ARM ARM pseudocode, we don't need to check whether this
2099 * was an exception vector read from the vector table (which is always
2100 * done using the default system address map), because those accesses
2101 * are done in arm_v7m_load_vector(), which always does a direct
2102 * read using address_space_ldl(), rather than going via this function.
2104 if (regime_translation_disabled(env
, mmu_idx
, secure
)) { /* MPU disabled */
2106 } else if (m_is_ppb_region(env
, address
)) {
2109 if (pmsav7_use_background_region(cpu
, mmu_idx
, secure
, is_user
)) {
2114 if (arm_feature(env
, ARM_FEATURE_M
)) {
2121 for (n
= region_counter
- 1; n
>= 0; n
--) {
2124 * Note that the base address is bits [31:x] from the register
2125 * with bits [x-1:0] all zeroes, but the limit address is bits
2126 * [31:x] from the register with bits [x:0] all ones. Where x is
2127 * 5 for Cortex-M and 6 for Cortex-R
2129 uint32_t base
= regime_rbar(env
, mmu_idx
, secure
)[n
] & ~bitmask
;
2130 uint32_t limit
= regime_rlar(env
, mmu_idx
, secure
)[n
] | bitmask
;
2132 if (!(regime_rlar(env
, mmu_idx
, secure
)[n
] & 0x1)) {
2133 /* Region disabled */
2137 if (address
< base
|| address
> limit
) {
2139 * Address not in this region. We must check whether the
2140 * region covers addresses in the same page as our address.
2141 * In that case we must not report a size that covers the
2142 * whole page for a subsequent hit against a different MPU
2143 * region or the background region, because it would result in
2144 * incorrect TLB hits for subsequent accesses to addresses that
2145 * are in this MPU region.
2147 if (limit
>= base
&&
2148 ranges_overlap(base
, limit
- base
+ 1,
2150 TARGET_PAGE_SIZE
)) {
2151 result
->f
.lg_page_size
= 0;
2156 if (base
> addr_page_base
|| limit
< addr_page_limit
) {
2157 result
->f
.lg_page_size
= 0;
2160 if (matchregion
!= -1) {
2162 * Multiple regions match -- always a failure (unlike
2163 * PMSAv7 where highest-numbered-region wins)
2165 fi
->type
= ARMFault_Permission
;
2166 if (arm_feature(env
, ARM_FEATURE_M
)) {
2178 if (arm_feature(env
, ARM_FEATURE_M
)) {
2179 fi
->type
= ARMFault_Background
;
2181 fi
->type
= ARMFault_Permission
;
2186 if (matchregion
== -1) {
2187 /* hit using the background region */
2188 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
, &result
->f
.prot
);
2190 uint32_t matched_rbar
= regime_rbar(env
, mmu_idx
, secure
)[matchregion
];
2191 uint32_t matched_rlar
= regime_rlar(env
, mmu_idx
, secure
)[matchregion
];
2192 uint32_t ap
= extract32(matched_rbar
, 1, 2);
2193 uint32_t xn
= extract32(matched_rbar
, 0, 1);
2196 if (arm_feature(env
, ARM_FEATURE_V8_1M
)) {
2197 pxn
= extract32(matched_rlar
, 4, 1);
2200 if (m_is_system_region(env
, address
)) {
2201 /* System space is always execute never */
2205 if (regime_el(env
, mmu_idx
) == 2) {
2206 result
->f
.prot
= simple_ap_to_rw_prot_is_user(ap
,
2207 mmu_idx
!= ARMMMUIdx_E2
);
2209 result
->f
.prot
= simple_ap_to_rw_prot(env
, mmu_idx
, ap
);
2212 if (!arm_feature(env
, ARM_FEATURE_M
)) {
2213 uint8_t attrindx
= extract32(matched_rlar
, 1, 3);
2214 uint64_t mair
= env
->cp15
.mair_el
[regime_el(env
, mmu_idx
)];
2215 uint8_t sh
= extract32(matched_rlar
, 3, 2);
2217 if (regime_sctlr(env
, mmu_idx
) & SCTLR_WXN
&&
2218 result
->f
.prot
& PAGE_WRITE
&& mmu_idx
!= ARMMMUIdx_Stage2
) {
2222 if ((regime_el(env
, mmu_idx
) == 1) &&
2223 regime_sctlr(env
, mmu_idx
) & SCTLR_UWXN
&& ap
== 0x1) {
2227 result
->cacheattrs
.is_s2_format
= false;
2228 result
->cacheattrs
.attrs
= extract64(mair
, attrindx
* 8, 8);
2229 result
->cacheattrs
.shareability
= sh
;
2232 if (result
->f
.prot
&& !xn
&& !(pxn
&& !is_user
)) {
2233 result
->f
.prot
|= PAGE_EXEC
;
2237 *mregion
= matchregion
;
2241 fi
->type
= ARMFault_Permission
;
2242 if (arm_feature(env
, ARM_FEATURE_M
)) {
2245 return !(result
->f
.prot
& (1 << access_type
));
2248 static bool v8m_is_sau_exempt(CPUARMState
*env
,
2249 uint32_t address
, MMUAccessType access_type
)
2252 * The architecture specifies that certain address ranges are
2253 * exempt from v8M SAU/IDAU checks.
2256 (access_type
== MMU_INST_FETCH
&& m_is_system_region(env
, address
)) ||
2257 (address
>= 0xe0000000 && address
<= 0xe0002fff) ||
2258 (address
>= 0xe000e000 && address
<= 0xe000efff) ||
2259 (address
>= 0xe002e000 && address
<= 0xe002efff) ||
2260 (address
>= 0xe0040000 && address
<= 0xe0041fff) ||
2261 (address
>= 0xe00ff000 && address
<= 0xe00fffff);
2264 void v8m_security_lookup(CPUARMState
*env
, uint32_t address
,
2265 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
2266 bool is_secure
, V8M_SAttributes
*sattrs
)
2269 * Look up the security attributes for this address. Compare the
2270 * pseudocode SecurityCheck() function.
2271 * We assume the caller has zero-initialized *sattrs.
2273 ARMCPU
*cpu
= env_archcpu(env
);
2275 bool idau_exempt
= false, idau_ns
= true, idau_nsc
= true;
2276 int idau_region
= IREGION_NOTVALID
;
2277 uint32_t addr_page_base
= address
& TARGET_PAGE_MASK
;
2278 uint32_t addr_page_limit
= addr_page_base
+ (TARGET_PAGE_SIZE
- 1);
2281 IDAUInterfaceClass
*iic
= IDAU_INTERFACE_GET_CLASS(cpu
->idau
);
2282 IDAUInterface
*ii
= IDAU_INTERFACE(cpu
->idau
);
2284 iic
->check(ii
, address
, &idau_region
, &idau_exempt
, &idau_ns
,
2288 if (access_type
== MMU_INST_FETCH
&& extract32(address
, 28, 4) == 0xf) {
2289 /* 0xf0000000..0xffffffff is always S for insn fetches */
2293 if (idau_exempt
|| v8m_is_sau_exempt(env
, address
, access_type
)) {
2294 sattrs
->ns
= !is_secure
;
2298 if (idau_region
!= IREGION_NOTVALID
) {
2299 sattrs
->irvalid
= true;
2300 sattrs
->iregion
= idau_region
;
2303 switch (env
->sau
.ctrl
& 3) {
2304 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
2306 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
2309 default: /* SAU.ENABLE == 1 */
2310 for (r
= 0; r
< cpu
->sau_sregion
; r
++) {
2311 if (env
->sau
.rlar
[r
] & 1) {
2312 uint32_t base
= env
->sau
.rbar
[r
] & ~0x1f;
2313 uint32_t limit
= env
->sau
.rlar
[r
] | 0x1f;
2315 if (base
<= address
&& limit
>= address
) {
2316 if (base
> addr_page_base
|| limit
< addr_page_limit
) {
2317 sattrs
->subpage
= true;
2319 if (sattrs
->srvalid
) {
2321 * If we hit in more than one region then we must report
2322 * as Secure, not NS-Callable, with no valid region
2326 sattrs
->nsc
= false;
2327 sattrs
->sregion
= 0;
2328 sattrs
->srvalid
= false;
2331 if (env
->sau
.rlar
[r
] & 2) {
2336 sattrs
->srvalid
= true;
2337 sattrs
->sregion
= r
;
2341 * Address not in this region. We must check whether the
2342 * region covers addresses in the same page as our address.
2343 * In that case we must not report a size that covers the
2344 * whole page for a subsequent hit against a different MPU
2345 * region or the background region, because it would result
2346 * in incorrect TLB hits for subsequent accesses to
2347 * addresses that are in this MPU region.
2349 if (limit
>= base
&&
2350 ranges_overlap(base
, limit
- base
+ 1,
2352 TARGET_PAGE_SIZE
)) {
2353 sattrs
->subpage
= true;
2362 * The IDAU will override the SAU lookup results if it specifies
2363 * higher security than the SAU does.
2366 if (sattrs
->ns
|| (!idau_nsc
&& sattrs
->nsc
)) {
2368 sattrs
->nsc
= idau_nsc
;
2373 static bool get_phys_addr_pmsav8(CPUARMState
*env
, uint32_t address
,
2374 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
2375 bool secure
, GetPhysAddrResult
*result
,
2376 ARMMMUFaultInfo
*fi
)
2378 V8M_SAttributes sattrs
= {};
2381 if (arm_feature(env
, ARM_FEATURE_M_SECURITY
)) {
2382 v8m_security_lookup(env
, address
, access_type
, mmu_idx
,
2384 if (access_type
== MMU_INST_FETCH
) {
2386 * Instruction fetches always use the MMU bank and the
2387 * transaction attribute determined by the fetch address,
2388 * regardless of CPU state. This is painful for QEMU
2389 * to handle, because it would mean we need to encode
2390 * into the mmu_idx not just the (user, negpri) information
2391 * for the current security state but also that for the
2392 * other security state, which would balloon the number
2393 * of mmu_idx values needed alarmingly.
2394 * Fortunately we can avoid this because it's not actually
2395 * possible to arbitrarily execute code from memory with
2396 * the wrong security attribute: it will always generate
2397 * an exception of some kind or another, apart from the
2398 * special case of an NS CPU executing an SG instruction
2399 * in S&NSC memory. So we always just fail the translation
2400 * here and sort things out in the exception handler
2401 * (including possibly emulating an SG instruction).
2403 if (sattrs
.ns
!= !secure
) {
2405 fi
->type
= ARMFault_QEMU_NSCExec
;
2407 fi
->type
= ARMFault_QEMU_SFault
;
2409 result
->f
.lg_page_size
= sattrs
.subpage
? 0 : TARGET_PAGE_BITS
;
2410 result
->f
.phys_addr
= address
;
2416 * For data accesses we always use the MMU bank indicated
2417 * by the current CPU state, but the security attributes
2418 * might downgrade a secure access to nonsecure.
2421 result
->f
.attrs
.secure
= false;
2422 result
->f
.attrs
.space
= ARMSS_NonSecure
;
2423 } else if (!secure
) {
2425 * NS access to S memory must fault.
2426 * Architecturally we should first check whether the
2427 * MPU information for this address indicates that we
2428 * are doing an unaligned access to Device memory, which
2429 * should generate a UsageFault instead. QEMU does not
2430 * currently check for that kind of unaligned access though.
2431 * If we added it we would need to do so as a special case
2432 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
2434 fi
->type
= ARMFault_QEMU_SFault
;
2435 result
->f
.lg_page_size
= sattrs
.subpage
? 0 : TARGET_PAGE_BITS
;
2436 result
->f
.phys_addr
= address
;
2443 ret
= pmsav8_mpu_lookup(env
, address
, access_type
, mmu_idx
, secure
,
2445 if (sattrs
.subpage
) {
2446 result
->f
.lg_page_size
= 0;
2452 * Translate from the 4-bit stage 2 representation of
2453 * memory attributes (without cache-allocation hints) to
2454 * the 8-bit representation of the stage 1 MAIR registers
2455 * (which includes allocation hints).
2457 * ref: shared/translation/attrs/S2AttrDecode()
2458 * .../S2ConvertAttrsHints()
2460 static uint8_t convert_stage2_attrs(uint64_t hcr
, uint8_t s2attrs
)
2462 uint8_t hiattr
= extract32(s2attrs
, 2, 2);
2463 uint8_t loattr
= extract32(s2attrs
, 0, 2);
2464 uint8_t hihint
= 0, lohint
= 0;
2466 if (hiattr
!= 0) { /* normal memory */
2467 if (hcr
& HCR_CD
) { /* cache disabled */
2468 hiattr
= loattr
= 1; /* non-cacheable */
2470 if (hiattr
!= 1) { /* Write-through or write-back */
2471 hihint
= 3; /* RW allocate */
2473 if (loattr
!= 1) { /* Write-through or write-back */
2474 lohint
= 3; /* RW allocate */
2479 return (hiattr
<< 6) | (hihint
<< 4) | (loattr
<< 2) | lohint
;
2483 * Combine either inner or outer cacheability attributes for normal
2484 * memory, according to table D4-42 and pseudocode procedure
2485 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
2487 * NB: only stage 1 includes allocation hints (RW bits), leading to
2490 static uint8_t combine_cacheattr_nibble(uint8_t s1
, uint8_t s2
)
2492 if (s1
== 4 || s2
== 4) {
2493 /* non-cacheable has precedence */
2495 } else if (extract32(s1
, 2, 2) == 0 || extract32(s1
, 2, 2) == 2) {
2496 /* stage 1 write-through takes precedence */
2498 } else if (extract32(s2
, 2, 2) == 2) {
2499 /* stage 2 write-through takes precedence, but the allocation hint
2500 * is still taken from stage 1
2502 return (2 << 2) | extract32(s1
, 0, 2);
2503 } else { /* write-back */
2509 * Combine the memory type and cacheability attributes of
2510 * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
2511 * combined attributes in MAIR_EL1 format.
2513 static uint8_t combined_attrs_nofwb(uint64_t hcr
,
2514 ARMCacheAttrs s1
, ARMCacheAttrs s2
)
2516 uint8_t s1lo
, s2lo
, s1hi
, s2hi
, s2_mair_attrs
, ret_attrs
;
2518 if (s2
.is_s2_format
) {
2519 s2_mair_attrs
= convert_stage2_attrs(hcr
, s2
.attrs
);
2521 s2_mair_attrs
= s2
.attrs
;
2524 s1lo
= extract32(s1
.attrs
, 0, 4);
2525 s2lo
= extract32(s2_mair_attrs
, 0, 4);
2526 s1hi
= extract32(s1
.attrs
, 4, 4);
2527 s2hi
= extract32(s2_mair_attrs
, 4, 4);
2529 /* Combine memory type and cacheability attributes */
2530 if (s1hi
== 0 || s2hi
== 0) {
2531 /* Device has precedence over normal */
2532 if (s1lo
== 0 || s2lo
== 0) {
2533 /* nGnRnE has precedence over anything */
2535 } else if (s1lo
== 4 || s2lo
== 4) {
2536 /* non-Reordering has precedence over Reordering */
2537 ret_attrs
= 4; /* nGnRE */
2538 } else if (s1lo
== 8 || s2lo
== 8) {
2539 /* non-Gathering has precedence over Gathering */
2540 ret_attrs
= 8; /* nGRE */
2542 ret_attrs
= 0xc; /* GRE */
2544 } else { /* Normal memory */
2545 /* Outer/inner cacheability combine independently */
2546 ret_attrs
= combine_cacheattr_nibble(s1hi
, s2hi
) << 4
2547 | combine_cacheattr_nibble(s1lo
, s2lo
);
2552 static uint8_t force_cacheattr_nibble_wb(uint8_t attr
)
2555 * Given the 4 bits specifying the outer or inner cacheability
2556 * in MAIR format, return a value specifying Normal Write-Back,
2557 * with the allocation and transient hints taken from the input
2558 * if the input specified some kind of cacheable attribute.
2560 if (attr
== 0 || attr
== 4) {
2562 * 0 == an UNPREDICTABLE encoding
2563 * 4 == Non-cacheable
2564 * Either way, force Write-Back RW allocate non-transient
2568 /* Change WriteThrough to WriteBack, keep allocation and transient hints */
2573 * Combine the memory type and cacheability attributes of
2574 * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
2575 * combined attributes in MAIR_EL1 format.
2577 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1
, ARMCacheAttrs s2
)
2579 assert(s2
.is_s2_format
&& !s1
.is_s2_format
);
2583 /* Use stage 1 attributes */
2587 * Force Normal Write-Back. Note that if S1 is Normal cacheable
2588 * then we take the allocation hints from it; otherwise it is
2589 * RW allocate, non-transient.
2591 if ((s1
.attrs
& 0xf0) == 0) {
2595 /* Need to check the Inner and Outer nibbles separately */
2596 return force_cacheattr_nibble_wb(s1
.attrs
& 0xf) |
2597 force_cacheattr_nibble_wb(s1
.attrs
>> 4) << 4;
2599 /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */
2600 if ((s1
.attrs
& 0xf0) == 0) {
2605 /* Force Device, of subtype specified by S2 */
2606 return s2
.attrs
<< 2;
2609 * RESERVED values (including RES0 descriptor bit [5] being nonzero);
2610 * arbitrarily force Device.
2617 * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
2618 * and CombineS1S2Desc()
2621 * @s1: Attributes from stage 1 walk
2622 * @s2: Attributes from stage 2 walk
2624 static ARMCacheAttrs
combine_cacheattrs(uint64_t hcr
,
2625 ARMCacheAttrs s1
, ARMCacheAttrs s2
)
2628 bool tagged
= false;
2630 assert(!s1
.is_s2_format
);
2631 ret
.is_s2_format
= false;
2632 ret
.guarded
= s1
.guarded
;
2634 if (s1
.attrs
== 0xf0) {
2639 /* Combine shareability attributes (table D4-43) */
2640 if (s1
.shareability
== 2 || s2
.shareability
== 2) {
2641 /* if either are outer-shareable, the result is outer-shareable */
2642 ret
.shareability
= 2;
2643 } else if (s1
.shareability
== 3 || s2
.shareability
== 3) {
2644 /* if either are inner-shareable, the result is inner-shareable */
2645 ret
.shareability
= 3;
2647 /* both non-shareable */
2648 ret
.shareability
= 0;
2651 /* Combine memory type and cacheability attributes */
2652 if (hcr
& HCR_FWB
) {
2653 ret
.attrs
= combined_attrs_fwb(s1
, s2
);
2655 ret
.attrs
= combined_attrs_nofwb(hcr
, s1
, s2
);
2659 * Any location for which the resultant memory type is any
2660 * type of Device memory is always treated as Outer Shareable.
2661 * Any location for which the resultant memory type is Normal
2662 * Inner Non-cacheable, Outer Non-cacheable is always treated
2663 * as Outer Shareable.
2664 * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC
2666 if ((ret
.attrs
& 0xf0) == 0 || ret
.attrs
== 0x44) {
2667 ret
.shareability
= 2;
2670 /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */
2671 if (tagged
&& ret
.attrs
== 0xff) {
2679 * MMU disabled. S1 addresses within aa64 translation regimes are
2680 * still checked for bounds -- see AArch64.S1DisabledOutput().
2682 static bool get_phys_addr_disabled(CPUARMState
*env
, target_ulong address
,
2683 MMUAccessType access_type
,
2684 ARMMMUIdx mmu_idx
, bool is_secure
,
2685 GetPhysAddrResult
*result
,
2686 ARMMMUFaultInfo
*fi
)
2688 uint8_t memattr
= 0x00; /* Device nGnRnE */
2689 uint8_t shareability
= 0; /* non-sharable */
2693 case ARMMMUIdx_Stage2
:
2694 case ARMMMUIdx_Stage2_S
:
2695 case ARMMMUIdx_Phys_S
:
2696 case ARMMMUIdx_Phys_NS
:
2697 case ARMMMUIdx_Phys_Root
:
2698 case ARMMMUIdx_Phys_Realm
:
2702 r_el
= regime_el(env
, mmu_idx
);
2703 if (arm_el_is_aa64(env
, r_el
)) {
2704 int pamax
= arm_pamax(env_archcpu(env
));
2705 uint64_t tcr
= env
->cp15
.tcr_el
[r_el
];
2708 tbi
= aa64_va_parameter_tbi(tcr
, mmu_idx
);
2709 if (access_type
== MMU_INST_FETCH
) {
2710 tbi
&= ~aa64_va_parameter_tbid(tcr
, mmu_idx
);
2712 tbi
= (tbi
>> extract64(address
, 55, 1)) & 1;
2713 addrtop
= (tbi
? 55 : 63);
2715 if (extract64(address
, pamax
, addrtop
- pamax
+ 1) != 0) {
2716 fi
->type
= ARMFault_AddressSize
;
2723 * When TBI is disabled, we've just validated that all of the
2724 * bits above PAMax are zero, so logically we only need to
2725 * clear the top byte for TBI. But it's clearer to follow
2726 * the pseudocode set of addrdesc.paddress.
2728 address
= extract64(address
, 0, 52);
2731 /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
2733 uint64_t hcr
= arm_hcr_el2_eff_secstate(env
, is_secure
);
2735 if (hcr
& HCR_DCT
) {
2736 memattr
= 0xf0; /* Tagged, Normal, WB, RWA */
2738 memattr
= 0xff; /* Normal, WB, RWA */
2742 if (memattr
== 0 && access_type
== MMU_INST_FETCH
) {
2743 if (regime_sctlr(env
, mmu_idx
) & SCTLR_I
) {
2744 memattr
= 0xee; /* Normal, WT, RA, NT */
2746 memattr
= 0x44; /* Normal, NC, No */
2748 shareability
= 2; /* outer sharable */
2750 result
->cacheattrs
.is_s2_format
= false;
2754 result
->f
.phys_addr
= address
;
2755 result
->f
.prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
2756 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
2757 result
->cacheattrs
.shareability
= shareability
;
2758 result
->cacheattrs
.attrs
= memattr
;
2762 static bool get_phys_addr_twostage(CPUARMState
*env
, S1Translate
*ptw
,
2763 target_ulong address
,
2764 MMUAccessType access_type
,
2765 GetPhysAddrResult
*result
,
2766 ARMMMUFaultInfo
*fi
)
2769 int s1_prot
, s1_lgpgsz
;
2770 bool is_secure
= ptw
->in_secure
;
2771 bool ret
, ipa_secure
;
2772 ARMCacheAttrs cacheattrs1
;
2773 ARMSecuritySpace ipa_space
;
2777 ret
= get_phys_addr_with_struct(env
, ptw
, address
, access_type
, result
, fi
);
2779 /* If S1 fails, return early. */
2784 ipa
= result
->f
.phys_addr
;
2785 ipa_secure
= result
->f
.attrs
.secure
;
2786 ipa_space
= result
->f
.attrs
.space
;
2788 is_el0
= ptw
->in_mmu_idx
== ARMMMUIdx_Stage1_E0
;
2789 ptw
->in_mmu_idx
= ipa_secure
? ARMMMUIdx_Stage2_S
: ARMMMUIdx_Stage2
;
2790 ptw
->in_secure
= ipa_secure
;
2791 ptw
->in_space
= ipa_space
;
2792 ptw
->in_ptw_idx
= ptw_idx_for_stage_2(env
, ptw
->in_mmu_idx
);
2795 * S1 is done, now do S2 translation.
2796 * Save the stage1 results so that we may merge prot and cacheattrs later.
2798 s1_prot
= result
->f
.prot
;
2799 s1_lgpgsz
= result
->f
.lg_page_size
;
2800 cacheattrs1
= result
->cacheattrs
;
2801 memset(result
, 0, sizeof(*result
));
2803 if (arm_feature(env
, ARM_FEATURE_PMSA
)) {
2804 ret
= get_phys_addr_pmsav8(env
, ipa
, access_type
,
2805 ptw
->in_mmu_idx
, is_secure
, result
, fi
);
2807 ret
= get_phys_addr_lpae(env
, ptw
, ipa
, access_type
,
2808 is_el0
, result
, fi
);
2812 /* Combine the S1 and S2 perms. */
2813 result
->f
.prot
&= s1_prot
;
2815 /* If S2 fails, return early. */
2821 * If either S1 or S2 returned a result smaller than TARGET_PAGE_SIZE,
2822 * this means "don't put this in the TLB"; in this case, return a
2823 * result with lg_page_size == 0 to achieve that. Otherwise,
2824 * use the maximum of the S1 & S2 page size, so that invalidation
2825 * of pages > TARGET_PAGE_SIZE works correctly. (This works even though
2826 * we know the combined result permissions etc only cover the minimum
2827 * of the S1 and S2 page size, because we know that the common TLB code
2828 * never actually creates TLB entries bigger than TARGET_PAGE_SIZE,
2829 * and passing a larger page size value only affects invalidations.)
2831 if (result
->f
.lg_page_size
< TARGET_PAGE_BITS
||
2832 s1_lgpgsz
< TARGET_PAGE_BITS
) {
2833 result
->f
.lg_page_size
= 0;
2834 } else if (result
->f
.lg_page_size
< s1_lgpgsz
) {
2835 result
->f
.lg_page_size
= s1_lgpgsz
;
2838 /* Combine the S1 and S2 cache attributes. */
2839 hcr
= arm_hcr_el2_eff_secstate(env
, is_secure
);
2842 * HCR.DC forces the first stage attributes to
2843 * Normal Non-Shareable,
2844 * Inner Write-Back Read-Allocate Write-Allocate,
2845 * Outer Write-Back Read-Allocate Write-Allocate.
2846 * Do not overwrite Tagged within attrs.
2848 if (cacheattrs1
.attrs
!= 0xf0) {
2849 cacheattrs1
.attrs
= 0xff;
2851 cacheattrs1
.shareability
= 0;
2853 result
->cacheattrs
= combine_cacheattrs(hcr
, cacheattrs1
,
2854 result
->cacheattrs
);
2857 * Check if IPA translates to secure or non-secure PA space.
2858 * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
2860 result
->f
.attrs
.secure
=
2862 && !(env
->cp15
.vstcr_el2
& (VSTCR_SA
| VSTCR_SW
))
2864 || !(env
->cp15
.vtcr_el2
& (VTCR_NSA
| VTCR_NSW
))));
2869 static bool get_phys_addr_with_struct(CPUARMState
*env
, S1Translate
*ptw
,
2870 target_ulong address
,
2871 MMUAccessType access_type
,
2872 GetPhysAddrResult
*result
,
2873 ARMMMUFaultInfo
*fi
)
2875 ARMMMUIdx mmu_idx
= ptw
->in_mmu_idx
;
2876 bool is_secure
= ptw
->in_secure
;
2877 ARMMMUIdx s1_mmu_idx
;
2880 * The page table entries may downgrade Secure to NonSecure, but
2881 * cannot upgrade a NonSecure translation regime's attributes
2882 * to Secure or Realm.
2884 result
->f
.attrs
.secure
= is_secure
;
2885 result
->f
.attrs
.space
= ptw
->in_space
;
2888 case ARMMMUIdx_Phys_S
:
2889 case ARMMMUIdx_Phys_NS
:
2890 case ARMMMUIdx_Phys_Root
:
2891 case ARMMMUIdx_Phys_Realm
:
2892 /* Checking Phys early avoids special casing later vs regime_el. */
2893 return get_phys_addr_disabled(env
, address
, access_type
, mmu_idx
,
2894 is_secure
, result
, fi
);
2896 case ARMMMUIdx_Stage1_E0
:
2897 case ARMMMUIdx_Stage1_E1
:
2898 case ARMMMUIdx_Stage1_E1_PAN
:
2899 /* First stage lookup uses second stage for ptw. */
2900 ptw
->in_ptw_idx
= is_secure
? ARMMMUIdx_Stage2_S
: ARMMMUIdx_Stage2
;
2903 case ARMMMUIdx_Stage2
:
2904 case ARMMMUIdx_Stage2_S
:
2906 * Second stage lookup uses physical for ptw; whether this is S or
2907 * NS may depend on the SW/NSW bits if this is a stage 2 lookup for
2908 * the Secure EL2&0 regime.
2910 ptw
->in_ptw_idx
= ptw_idx_for_stage_2(env
, mmu_idx
);
2913 case ARMMMUIdx_E10_0
:
2914 s1_mmu_idx
= ARMMMUIdx_Stage1_E0
;
2916 case ARMMMUIdx_E10_1
:
2917 s1_mmu_idx
= ARMMMUIdx_Stage1_E1
;
2919 case ARMMMUIdx_E10_1_PAN
:
2920 s1_mmu_idx
= ARMMMUIdx_Stage1_E1_PAN
;
2923 * Call ourselves recursively to do the stage 1 and then stage 2
2924 * translations if mmu_idx is a two-stage regime, and EL2 present.
2925 * Otherwise, a stage1+stage2 translation is just stage 1.
2927 ptw
->in_mmu_idx
= mmu_idx
= s1_mmu_idx
;
2928 if (arm_feature(env
, ARM_FEATURE_EL2
) &&
2929 !regime_translation_disabled(env
, ARMMMUIdx_Stage2
, is_secure
)) {
2930 return get_phys_addr_twostage(env
, ptw
, address
, access_type
,
2936 /* Single stage uses physical for ptw. */
2937 ptw
->in_ptw_idx
= arm_space_to_phys(ptw
->in_space
);
2941 result
->f
.attrs
.user
= regime_is_user(env
, mmu_idx
);
2944 * Fast Context Switch Extension. This doesn't exist at all in v8.
2945 * In v7 and earlier it affects all stage 1 translations.
2947 if (address
< 0x02000000 && mmu_idx
!= ARMMMUIdx_Stage2
2948 && !arm_feature(env
, ARM_FEATURE_V8
)) {
2949 if (regime_el(env
, mmu_idx
) == 3) {
2950 address
+= env
->cp15
.fcseidr_s
;
2952 address
+= env
->cp15
.fcseidr_ns
;
2956 if (arm_feature(env
, ARM_FEATURE_PMSA
)) {
2958 result
->f
.lg_page_size
= TARGET_PAGE_BITS
;
2960 if (arm_feature(env
, ARM_FEATURE_V8
)) {
2962 ret
= get_phys_addr_pmsav8(env
, address
, access_type
, mmu_idx
,
2963 is_secure
, result
, fi
);
2964 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
2966 ret
= get_phys_addr_pmsav7(env
, address
, access_type
, mmu_idx
,
2967 is_secure
, result
, fi
);
2970 ret
= get_phys_addr_pmsav5(env
, address
, access_type
, mmu_idx
,
2971 is_secure
, result
, fi
);
2973 qemu_log_mask(CPU_LOG_MMU
, "PMSA MPU lookup for %s at 0x%08" PRIx32
2974 " mmu_idx %u -> %s (prot %c%c%c)\n",
2975 access_type
== MMU_DATA_LOAD
? "reading" :
2976 (access_type
== MMU_DATA_STORE
? "writing" : "execute"),
2977 (uint32_t)address
, mmu_idx
,
2978 ret
? "Miss" : "Hit",
2979 result
->f
.prot
& PAGE_READ
? 'r' : '-',
2980 result
->f
.prot
& PAGE_WRITE
? 'w' : '-',
2981 result
->f
.prot
& PAGE_EXEC
? 'x' : '-');
2986 /* Definitely a real MMU, not an MPU */
2988 if (regime_translation_disabled(env
, mmu_idx
, is_secure
)) {
2989 return get_phys_addr_disabled(env
, address
, access_type
, mmu_idx
,
2990 is_secure
, result
, fi
);
2993 if (regime_using_lpae_format(env
, mmu_idx
)) {
2994 return get_phys_addr_lpae(env
, ptw
, address
, access_type
, false,
2996 } else if (arm_feature(env
, ARM_FEATURE_V7
) ||
2997 regime_sctlr(env
, mmu_idx
) & SCTLR_XP
) {
2998 return get_phys_addr_v6(env
, ptw
, address
, access_type
, result
, fi
);
3000 return get_phys_addr_v5(env
, ptw
, address
, access_type
, result
, fi
);
3004 bool get_phys_addr_with_secure(CPUARMState
*env
, target_ulong address
,
3005 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
3006 bool is_secure
, GetPhysAddrResult
*result
,
3007 ARMMMUFaultInfo
*fi
)
3010 .in_mmu_idx
= mmu_idx
,
3011 .in_secure
= is_secure
,
3012 .in_space
= arm_secure_to_space(is_secure
),
3014 return get_phys_addr_with_struct(env
, &ptw
, address
, access_type
,
3018 bool get_phys_addr(CPUARMState
*env
, target_ulong address
,
3019 MMUAccessType access_type
, ARMMMUIdx mmu_idx
,
3020 GetPhysAddrResult
*result
, ARMMMUFaultInfo
*fi
)
3023 .in_mmu_idx
= mmu_idx
,
3025 ARMSecuritySpace ss
;
3028 case ARMMMUIdx_E10_0
:
3029 case ARMMMUIdx_E10_1
:
3030 case ARMMMUIdx_E10_1_PAN
:
3031 case ARMMMUIdx_E20_0
:
3032 case ARMMMUIdx_E20_2
:
3033 case ARMMMUIdx_E20_2_PAN
:
3034 case ARMMMUIdx_Stage1_E0
:
3035 case ARMMMUIdx_Stage1_E1
:
3036 case ARMMMUIdx_Stage1_E1_PAN
:
3038 ss
= arm_security_space_below_el3(env
);
3040 case ARMMMUIdx_Stage2
:
3042 * For Secure EL2, we need this index to be NonSecure;
3043 * otherwise this will already be NonSecure or Realm.
3045 ss
= arm_security_space_below_el3(env
);
3046 if (ss
== ARMSS_Secure
) {
3047 ss
= ARMSS_NonSecure
;
3050 case ARMMMUIdx_Phys_NS
:
3051 case ARMMMUIdx_MPrivNegPri
:
3052 case ARMMMUIdx_MUserNegPri
:
3053 case ARMMMUIdx_MPriv
:
3054 case ARMMMUIdx_MUser
:
3055 ss
= ARMSS_NonSecure
;
3057 case ARMMMUIdx_Stage2_S
:
3058 case ARMMMUIdx_Phys_S
:
3059 case ARMMMUIdx_MSPrivNegPri
:
3060 case ARMMMUIdx_MSUserNegPri
:
3061 case ARMMMUIdx_MSPriv
:
3062 case ARMMMUIdx_MSUser
:
3066 if (arm_feature(env
, ARM_FEATURE_AARCH64
) &&
3067 cpu_isar_feature(aa64_rme
, env_archcpu(env
))) {
3073 case ARMMMUIdx_Phys_Root
:
3076 case ARMMMUIdx_Phys_Realm
:
3080 g_assert_not_reached();
3084 ptw
.in_secure
= arm_space_is_secure(ss
);
3085 return get_phys_addr_with_struct(env
, &ptw
, address
, access_type
,
3089 hwaddr
arm_cpu_get_phys_page_attrs_debug(CPUState
*cs
, vaddr addr
,
3092 ARMCPU
*cpu
= ARM_CPU(cs
);
3093 CPUARMState
*env
= &cpu
->env
;
3094 ARMMMUIdx mmu_idx
= arm_mmu_idx(env
);
3095 ARMSecuritySpace ss
= arm_security_space(env
);
3097 .in_mmu_idx
= mmu_idx
,
3099 .in_secure
= arm_space_is_secure(ss
),
3102 GetPhysAddrResult res
= {};
3103 ARMMMUFaultInfo fi
= {};
3106 ret
= get_phys_addr_with_struct(env
, &ptw
, addr
, MMU_DATA_LOAD
, &res
, &fi
);
3107 *attrs
= res
.f
.attrs
;
3112 return res
.f
.phys_addr
;