xref: /qemu/target/arm/ptw.c (revision d6359e150dbdf84f67add786473fd277a9a442bb)
1 /*
2  * ARM page table walking.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "qemu/range.h"
12 #include "qemu/main-loop.h"
13 #include "exec/exec-all.h"
14 #include "cpu.h"
15 #include "internals.h"
16 #include "idau.h"
17 
18 
19 typedef struct S1Translate {
20     ARMMMUIdx in_mmu_idx;
21     ARMMMUIdx in_ptw_idx;
22     bool in_secure;
23     bool in_debug;
24     bool out_secure;
25     bool out_rw;
26     bool out_be;
27     hwaddr out_virt;
28     hwaddr out_phys;
29     void *out_host;
30 } S1Translate;
31 
32 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
33                                uint64_t address,
34                                MMUAccessType access_type, bool s1_is_el0,
35                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
36     __attribute__((nonnull));
37 
38 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
39                                       target_ulong address,
40                                       MMUAccessType access_type,
41                                       GetPhysAddrResult *result,
42                                       ARMMMUFaultInfo *fi)
43     __attribute__((nonnull));
44 
45 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
46 static const uint8_t pamax_map[] = {
47     [0] = 32,
48     [1] = 36,
49     [2] = 40,
50     [3] = 42,
51     [4] = 44,
52     [5] = 48,
53     [6] = 52,
54 };
55 
56 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
57 unsigned int arm_pamax(ARMCPU *cpu)
58 {
59     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
60         unsigned int parange =
61             FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
62 
63         /*
64          * id_aa64mmfr0 is a read-only register so values outside of the
65          * supported mappings can be considered an implementation error.
66          */
67         assert(parange < ARRAY_SIZE(pamax_map));
68         return pamax_map[parange];
69     }
70 
71     /*
72      * In machvirt_init, we call arm_pamax on a cpu that is not fully
73      * initialized, so we can't rely on the propagation done in realize.
74      */
75     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) ||
76         arm_feature(&cpu->env, ARM_FEATURE_V7VE)) {
77         /* v7 with LPAE */
78         return 40;
79     }
80     /* Anything else */
81     return 32;
82 }
83 
84 /*
85  * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index
86  */
87 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
88 {
89     switch (mmu_idx) {
90     case ARMMMUIdx_E10_0:
91         return ARMMMUIdx_Stage1_E0;
92     case ARMMMUIdx_E10_1:
93         return ARMMMUIdx_Stage1_E1;
94     case ARMMMUIdx_E10_1_PAN:
95         return ARMMMUIdx_Stage1_E1_PAN;
96     default:
97         return mmu_idx;
98     }
99 }
100 
101 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
102 {
103     return stage_1_mmu_idx(arm_mmu_idx(env));
104 }
105 
106 /*
107  * Return where we should do ptw loads from for a stage 2 walk.
108  * This depends on whether the address we are looking up is a
109  * Secure IPA or a NonSecure IPA, which we know from whether this is
110  * Stage2 or Stage2_S.
111  * If this is the Secure EL1&0 regime we need to check the NSW and SW bits.
112  */
113 static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx)
114 {
115     bool s2walk_secure;
116 
117     /*
118      * We're OK to check the current state of the CPU here because
119      * (1) we always invalidate all TLBs when the SCR_EL3.NS bit changes
120      * (2) there's no way to do a lookup that cares about Stage 2 for a
121      * different security state to the current one for AArch64, and AArch32
122      * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
123      * an NS stage 1+2 lookup while the NS bit is 0.)
124      */
125     if (!arm_is_secure_below_el3(env) || !arm_el_is_aa64(env, 3)) {
126         return ARMMMUIdx_Phys_NS;
127     }
128     if (stage2idx == ARMMMUIdx_Stage2_S) {
129         s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
130     } else {
131         s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
132     }
133     return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
134 
135 }
136 
137 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
138 {
139     return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
140 }
141 
142 /* Return the TTBR associated with this translation regime */
143 static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
144 {
145     if (mmu_idx == ARMMMUIdx_Stage2) {
146         return env->cp15.vttbr_el2;
147     }
148     if (mmu_idx == ARMMMUIdx_Stage2_S) {
149         return env->cp15.vsttbr_el2;
150     }
151     if (ttbrn == 0) {
152         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
153     } else {
154         return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
155     }
156 }
157 
158 /* Return true if the specified stage of address translation is disabled */
159 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
160                                         bool is_secure)
161 {
162     uint64_t hcr_el2;
163 
164     if (arm_feature(env, ARM_FEATURE_M)) {
165         switch (env->v7m.mpu_ctrl[is_secure] &
166                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
167         case R_V7M_MPU_CTRL_ENABLE_MASK:
168             /* Enabled, but not for HardFault and NMI */
169             return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
170         case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
171             /* Enabled for all cases */
172             return false;
173         case 0:
174         default:
175             /*
176              * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
177              * we warned about that in armv7m_nvic.c when the guest set it.
178              */
179             return true;
180         }
181     }
182 
183     hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure);
184 
185     switch (mmu_idx) {
186     case ARMMMUIdx_Stage2:
187     case ARMMMUIdx_Stage2_S:
188         /* HCR.DC means HCR.VM behaves as 1 */
189         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
190 
191     case ARMMMUIdx_E10_0:
192     case ARMMMUIdx_E10_1:
193     case ARMMMUIdx_E10_1_PAN:
194         /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
195         if (hcr_el2 & HCR_TGE) {
196             return true;
197         }
198         break;
199 
200     case ARMMMUIdx_Stage1_E0:
201     case ARMMMUIdx_Stage1_E1:
202     case ARMMMUIdx_Stage1_E1_PAN:
203         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
204         if (hcr_el2 & HCR_DC) {
205             return true;
206         }
207         break;
208 
209     case ARMMMUIdx_E20_0:
210     case ARMMMUIdx_E20_2:
211     case ARMMMUIdx_E20_2_PAN:
212     case ARMMMUIdx_E2:
213     case ARMMMUIdx_E3:
214         break;
215 
216     case ARMMMUIdx_Phys_NS:
217     case ARMMMUIdx_Phys_S:
218         /* No translation for physical address spaces. */
219         return true;
220 
221     default:
222         g_assert_not_reached();
223     }
224 
225     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
226 }
227 
228 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
229 {
230     /*
231      * For an S1 page table walk, the stage 1 attributes are always
232      * some form of "this is Normal memory". The combined S1+S2
233      * attributes are therefore only Device if stage 2 specifies Device.
234      * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00,
235      * ie when cacheattrs.attrs bits [3:2] are 0b00.
236      * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie
237      * when cacheattrs.attrs bit [2] is 0.
238      */
239     if (hcr & HCR_FWB) {
240         return (attrs & 0x4) == 0;
241     } else {
242         return (attrs & 0xc) == 0;
243     }
244 }
245 
246 /* Translate a S1 pagetable walk through S2 if needed.  */
247 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
248                              hwaddr addr, ARMMMUFaultInfo *fi)
249 {
250     bool is_secure = ptw->in_secure;
251     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
252     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
253     uint8_t pte_attrs;
254 
255     ptw->out_virt = addr;
256 
257     if (unlikely(ptw->in_debug)) {
258         /*
259          * From gdbstub, do not use softmmu so that we don't modify the
260          * state of the cpu at all, including softmmu tlb contents.
261          */
262         if (regime_is_stage2(s2_mmu_idx)) {
263             S1Translate s2ptw = {
264                 .in_mmu_idx = s2_mmu_idx,
265                 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
266                 .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
267                 .in_debug = true,
268             };
269             GetPhysAddrResult s2 = { };
270 
271             if (get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
272                                    false, &s2, fi)) {
273                 goto fail;
274             }
275             ptw->out_phys = s2.f.phys_addr;
276             pte_attrs = s2.cacheattrs.attrs;
277             ptw->out_secure = s2.f.attrs.secure;
278         } else {
279             /* Regime is physical. */
280             ptw->out_phys = addr;
281             pte_attrs = 0;
282             ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
283         }
284         ptw->out_host = NULL;
285         ptw->out_rw = false;
286     } else {
287 #ifdef CONFIG_TCG
288         CPUTLBEntryFull *full;
289         int flags;
290 
291         env->tlb_fi = fi;
292         flags = probe_access_full(env, addr, 0, MMU_DATA_LOAD,
293                                   arm_to_core_mmu_idx(s2_mmu_idx),
294                                   true, &ptw->out_host, &full, 0);
295         env->tlb_fi = NULL;
296 
297         if (unlikely(flags & TLB_INVALID_MASK)) {
298             goto fail;
299         }
300         ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK);
301         ptw->out_rw = full->prot & PAGE_WRITE;
302         pte_attrs = full->pte_attrs;
303         ptw->out_secure = full->attrs.secure;
304 #else
305         g_assert_not_reached();
306 #endif
307     }
308 
309     if (regime_is_stage2(s2_mmu_idx)) {
310         uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
311 
312         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
313             /*
314              * PTW set and S1 walk touched S2 Device memory:
315              * generate Permission fault.
316              */
317             fi->type = ARMFault_Permission;
318             fi->s2addr = addr;
319             fi->stage2 = true;
320             fi->s1ptw = true;
321             fi->s1ns = !is_secure;
322             return false;
323         }
324     }
325 
326     ptw->out_be = regime_translation_big_endian(env, mmu_idx);
327     return true;
328 
329  fail:
330     assert(fi->type != ARMFault_None);
331     fi->s2addr = addr;
332     fi->stage2 = true;
333     fi->s1ptw = true;
334     fi->s1ns = !is_secure;
335     return false;
336 }
337 
338 /* All loads done in the course of a page table walk go through here. */
339 static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
340                             ARMMMUFaultInfo *fi)
341 {
342     CPUState *cs = env_cpu(env);
343     void *host = ptw->out_host;
344     uint32_t data;
345 
346     if (likely(host)) {
347         /* Page tables are in RAM, and we have the host address. */
348         data = qatomic_read((uint32_t *)host);
349         if (ptw->out_be) {
350             data = be32_to_cpu(data);
351         } else {
352             data = le32_to_cpu(data);
353         }
354     } else {
355         /* Page tables are in MMIO. */
356         MemTxAttrs attrs = { .secure = ptw->out_secure };
357         AddressSpace *as = arm_addressspace(cs, attrs);
358         MemTxResult result = MEMTX_OK;
359 
360         if (ptw->out_be) {
361             data = address_space_ldl_be(as, ptw->out_phys, attrs, &result);
362         } else {
363             data = address_space_ldl_le(as, ptw->out_phys, attrs, &result);
364         }
365         if (unlikely(result != MEMTX_OK)) {
366             fi->type = ARMFault_SyncExternalOnWalk;
367             fi->ea = arm_extabort_type(result);
368             return 0;
369         }
370     }
371     return data;
372 }
373 
374 static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
375                             ARMMMUFaultInfo *fi)
376 {
377     CPUState *cs = env_cpu(env);
378     void *host = ptw->out_host;
379     uint64_t data;
380 
381     if (likely(host)) {
382         /* Page tables are in RAM, and we have the host address. */
383 #ifdef CONFIG_ATOMIC64
384         data = qatomic_read__nocheck((uint64_t *)host);
385         if (ptw->out_be) {
386             data = be64_to_cpu(data);
387         } else {
388             data = le64_to_cpu(data);
389         }
390 #else
391         if (ptw->out_be) {
392             data = ldq_be_p(host);
393         } else {
394             data = ldq_le_p(host);
395         }
396 #endif
397     } else {
398         /* Page tables are in MMIO. */
399         MemTxAttrs attrs = { .secure = ptw->out_secure };
400         AddressSpace *as = arm_addressspace(cs, attrs);
401         MemTxResult result = MEMTX_OK;
402 
403         if (ptw->out_be) {
404             data = address_space_ldq_be(as, ptw->out_phys, attrs, &result);
405         } else {
406             data = address_space_ldq_le(as, ptw->out_phys, attrs, &result);
407         }
408         if (unlikely(result != MEMTX_OK)) {
409             fi->type = ARMFault_SyncExternalOnWalk;
410             fi->ea = arm_extabort_type(result);
411             return 0;
412         }
413     }
414     return data;
415 }
416 
417 static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
418                              uint64_t new_val, S1Translate *ptw,
419                              ARMMMUFaultInfo *fi)
420 {
421     uint64_t cur_val;
422     void *host = ptw->out_host;
423 
424     if (unlikely(!host)) {
425         fi->type = ARMFault_UnsuppAtomicUpdate;
426         fi->s1ptw = true;
427         return 0;
428     }
429 
430     /*
431      * Raising a stage2 Protection fault for an atomic update to a read-only
432      * page is delayed until it is certain that there is a change to make.
433      */
434     if (unlikely(!ptw->out_rw)) {
435         int flags;
436         void *discard;
437 
438         env->tlb_fi = fi;
439         flags = probe_access_flags(env, ptw->out_virt, 0, MMU_DATA_STORE,
440                                    arm_to_core_mmu_idx(ptw->in_ptw_idx),
441                                    true, &discard, 0);
442         env->tlb_fi = NULL;
443 
444         if (unlikely(flags & TLB_INVALID_MASK)) {
445             assert(fi->type != ARMFault_None);
446             fi->s2addr = ptw->out_virt;
447             fi->stage2 = true;
448             fi->s1ptw = true;
449             fi->s1ns = !ptw->in_secure;
450             return 0;
451         }
452 
453         /* In case CAS mismatches and we loop, remember writability. */
454         ptw->out_rw = true;
455     }
456 
457 #ifdef CONFIG_ATOMIC64
458     if (ptw->out_be) {
459         old_val = cpu_to_be64(old_val);
460         new_val = cpu_to_be64(new_val);
461         cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
462         cur_val = be64_to_cpu(cur_val);
463     } else {
464         old_val = cpu_to_le64(old_val);
465         new_val = cpu_to_le64(new_val);
466         cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
467         cur_val = le64_to_cpu(cur_val);
468     }
469 #else
470     /*
471      * We can't support the full 64-bit atomic cmpxchg on the host.
472      * Because this is only used for FEAT_HAFDBS, which is only for AA64,
473      * we know that TCG_OVERSIZED_GUEST is set, which means that we are
474      * running in round-robin mode and could only race with dma i/o.
475      */
476 #ifndef TCG_OVERSIZED_GUEST
477 # error "Unexpected configuration"
478 #endif
479     bool locked = qemu_mutex_iothread_locked();
480     if (!locked) {
481        qemu_mutex_lock_iothread();
482     }
483     if (ptw->out_be) {
484         cur_val = ldq_be_p(host);
485         if (cur_val == old_val) {
486             stq_be_p(host, new_val);
487         }
488     } else {
489         cur_val = ldq_le_p(host);
490         if (cur_val == old_val) {
491             stq_le_p(host, new_val);
492         }
493     }
494     if (!locked) {
495         qemu_mutex_unlock_iothread();
496     }
497 #endif
498 
499     return cur_val;
500 }
501 
502 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
503                                      uint32_t *table, uint32_t address)
504 {
505     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
506     uint64_t tcr = regime_tcr(env, mmu_idx);
507     int maskshift = extract32(tcr, 0, 3);
508     uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift);
509     uint32_t base_mask;
510 
511     if (address & mask) {
512         if (tcr & TTBCR_PD1) {
513             /* Translation table walk disabled for TTBR1 */
514             return false;
515         }
516         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
517     } else {
518         if (tcr & TTBCR_PD0) {
519             /* Translation table walk disabled for TTBR0 */
520             return false;
521         }
522         base_mask = ~((uint32_t)0x3fffu >> maskshift);
523         *table = regime_ttbr(env, mmu_idx, 0) & base_mask;
524     }
525     *table |= (address >> 18) & 0x3ffc;
526     return true;
527 }
528 
529 /*
530  * Translate section/page access permissions to page R/W protection flags
531  * @env:         CPUARMState
532  * @mmu_idx:     MMU index indicating required translation regime
533  * @ap:          The 3-bit access permissions (AP[2:0])
534  * @domain_prot: The 2-bit domain access permissions
535  * @is_user: TRUE if accessing from PL0
536  */
537 static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx,
538                          int ap, int domain_prot, bool is_user)
539 {
540     if (domain_prot == 3) {
541         return PAGE_READ | PAGE_WRITE;
542     }
543 
544     switch (ap) {
545     case 0:
546         if (arm_feature(env, ARM_FEATURE_V7)) {
547             return 0;
548         }
549         switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
550         case SCTLR_S:
551             return is_user ? 0 : PAGE_READ;
552         case SCTLR_R:
553             return PAGE_READ;
554         default:
555             return 0;
556         }
557     case 1:
558         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
559     case 2:
560         if (is_user) {
561             return PAGE_READ;
562         } else {
563             return PAGE_READ | PAGE_WRITE;
564         }
565     case 3:
566         return PAGE_READ | PAGE_WRITE;
567     case 4: /* Reserved.  */
568         return 0;
569     case 5:
570         return is_user ? 0 : PAGE_READ;
571     case 6:
572         return PAGE_READ;
573     case 7:
574         if (!arm_feature(env, ARM_FEATURE_V6K)) {
575             return 0;
576         }
577         return PAGE_READ;
578     default:
579         g_assert_not_reached();
580     }
581 }
582 
583 /*
584  * Translate section/page access permissions to page R/W protection flags
585  * @env:         CPUARMState
586  * @mmu_idx:     MMU index indicating required translation regime
587  * @ap:          The 3-bit access permissions (AP[2:0])
588  * @domain_prot: The 2-bit domain access permissions
589  */
590 static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
591                          int ap, int domain_prot)
592 {
593    return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
594                                 regime_is_user(env, mmu_idx));
595 }
596 
597 /*
598  * Translate section/page access permissions to page R/W protection flags.
599  * @ap:      The 2-bit simple AP (AP[2:1])
600  * @is_user: TRUE if accessing from PL0
601  */
602 static int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
603 {
604     switch (ap) {
605     case 0:
606         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
607     case 1:
608         return PAGE_READ | PAGE_WRITE;
609     case 2:
610         return is_user ? 0 : PAGE_READ;
611     case 3:
612         return PAGE_READ;
613     default:
614         g_assert_not_reached();
615     }
616 }
617 
618 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
619 {
620     return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
621 }
622 
623 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
624                              uint32_t address, MMUAccessType access_type,
625                              GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
626 {
627     int level = 1;
628     uint32_t table;
629     uint32_t desc;
630     int type;
631     int ap;
632     int domain = 0;
633     int domain_prot;
634     hwaddr phys_addr;
635     uint32_t dacr;
636 
637     /* Pagetable walk.  */
638     /* Lookup l1 descriptor.  */
639     if (!get_level1_table_address(env, ptw->in_mmu_idx, &table, address)) {
640         /* Section translation fault if page walk is disabled by PD0 or PD1 */
641         fi->type = ARMFault_Translation;
642         goto do_fault;
643     }
644     if (!S1_ptw_translate(env, ptw, table, fi)) {
645         goto do_fault;
646     }
647     desc = arm_ldl_ptw(env, ptw, fi);
648     if (fi->type != ARMFault_None) {
649         goto do_fault;
650     }
651     type = (desc & 3);
652     domain = (desc >> 5) & 0x0f;
653     if (regime_el(env, ptw->in_mmu_idx) == 1) {
654         dacr = env->cp15.dacr_ns;
655     } else {
656         dacr = env->cp15.dacr_s;
657     }
658     domain_prot = (dacr >> (domain * 2)) & 3;
659     if (type == 0) {
660         /* Section translation fault.  */
661         fi->type = ARMFault_Translation;
662         goto do_fault;
663     }
664     if (type != 2) {
665         level = 2;
666     }
667     if (domain_prot == 0 || domain_prot == 2) {
668         fi->type = ARMFault_Domain;
669         goto do_fault;
670     }
671     if (type == 2) {
672         /* 1Mb section.  */
673         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
674         ap = (desc >> 10) & 3;
675         result->f.lg_page_size = 20; /* 1MB */
676     } else {
677         /* Lookup l2 entry.  */
678         if (type == 1) {
679             /* Coarse pagetable.  */
680             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
681         } else {
682             /* Fine pagetable.  */
683             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
684         }
685         if (!S1_ptw_translate(env, ptw, table, fi)) {
686             goto do_fault;
687         }
688         desc = arm_ldl_ptw(env, ptw, fi);
689         if (fi->type != ARMFault_None) {
690             goto do_fault;
691         }
692         switch (desc & 3) {
693         case 0: /* Page translation fault.  */
694             fi->type = ARMFault_Translation;
695             goto do_fault;
696         case 1: /* 64k page.  */
697             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
698             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
699             result->f.lg_page_size = 16;
700             break;
701         case 2: /* 4k page.  */
702             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
703             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
704             result->f.lg_page_size = 12;
705             break;
706         case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
707             if (type == 1) {
708                 /* ARMv6/XScale extended small page format */
709                 if (arm_feature(env, ARM_FEATURE_XSCALE)
710                     || arm_feature(env, ARM_FEATURE_V6)) {
711                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
712                     result->f.lg_page_size = 12;
713                 } else {
714                     /*
715                      * UNPREDICTABLE in ARMv5; we choose to take a
716                      * page translation fault.
717                      */
718                     fi->type = ARMFault_Translation;
719                     goto do_fault;
720                 }
721             } else {
722                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
723                 result->f.lg_page_size = 10;
724             }
725             ap = (desc >> 4) & 3;
726             break;
727         default:
728             /* Never happens, but compiler isn't smart enough to tell.  */
729             g_assert_not_reached();
730         }
731     }
732     result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot);
733     result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
734     if (!(result->f.prot & (1 << access_type))) {
735         /* Access permission fault.  */
736         fi->type = ARMFault_Permission;
737         goto do_fault;
738     }
739     result->f.phys_addr = phys_addr;
740     return false;
741 do_fault:
742     fi->domain = domain;
743     fi->level = level;
744     return true;
745 }
746 
747 static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
748                              uint32_t address, MMUAccessType access_type,
749                              GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
750 {
751     ARMCPU *cpu = env_archcpu(env);
752     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
753     int level = 1;
754     uint32_t table;
755     uint32_t desc;
756     uint32_t xn;
757     uint32_t pxn = 0;
758     int type;
759     int ap;
760     int domain = 0;
761     int domain_prot;
762     hwaddr phys_addr;
763     uint32_t dacr;
764     bool ns;
765     int user_prot;
766 
767     /* Pagetable walk.  */
768     /* Lookup l1 descriptor.  */
769     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
770         /* Section translation fault if page walk is disabled by PD0 or PD1 */
771         fi->type = ARMFault_Translation;
772         goto do_fault;
773     }
774     if (!S1_ptw_translate(env, ptw, table, fi)) {
775         goto do_fault;
776     }
777     desc = arm_ldl_ptw(env, ptw, fi);
778     if (fi->type != ARMFault_None) {
779         goto do_fault;
780     }
781     type = (desc & 3);
782     if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
783         /* Section translation fault, or attempt to use the encoding
784          * which is Reserved on implementations without PXN.
785          */
786         fi->type = ARMFault_Translation;
787         goto do_fault;
788     }
789     if ((type == 1) || !(desc & (1 << 18))) {
790         /* Page or Section.  */
791         domain = (desc >> 5) & 0x0f;
792     }
793     if (regime_el(env, mmu_idx) == 1) {
794         dacr = env->cp15.dacr_ns;
795     } else {
796         dacr = env->cp15.dacr_s;
797     }
798     if (type == 1) {
799         level = 2;
800     }
801     domain_prot = (dacr >> (domain * 2)) & 3;
802     if (domain_prot == 0 || domain_prot == 2) {
803         /* Section or Page domain fault */
804         fi->type = ARMFault_Domain;
805         goto do_fault;
806     }
807     if (type != 1) {
808         if (desc & (1 << 18)) {
809             /* Supersection.  */
810             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
811             phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
812             phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
813             result->f.lg_page_size = 24;  /* 16MB */
814         } else {
815             /* Section.  */
816             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
817             result->f.lg_page_size = 20;  /* 1MB */
818         }
819         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
820         xn = desc & (1 << 4);
821         pxn = desc & 1;
822         ns = extract32(desc, 19, 1);
823     } else {
824         if (cpu_isar_feature(aa32_pxn, cpu)) {
825             pxn = (desc >> 2) & 1;
826         }
827         ns = extract32(desc, 3, 1);
828         /* Lookup l2 entry.  */
829         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
830         if (!S1_ptw_translate(env, ptw, table, fi)) {
831             goto do_fault;
832         }
833         desc = arm_ldl_ptw(env, ptw, fi);
834         if (fi->type != ARMFault_None) {
835             goto do_fault;
836         }
837         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
838         switch (desc & 3) {
839         case 0: /* Page translation fault.  */
840             fi->type = ARMFault_Translation;
841             goto do_fault;
842         case 1: /* 64k page.  */
843             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
844             xn = desc & (1 << 15);
845             result->f.lg_page_size = 16;
846             break;
847         case 2: case 3: /* 4k page.  */
848             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
849             xn = desc & 1;
850             result->f.lg_page_size = 12;
851             break;
852         default:
853             /* Never happens, but compiler isn't smart enough to tell.  */
854             g_assert_not_reached();
855         }
856     }
857     if (domain_prot == 3) {
858         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
859     } else {
860         if (pxn && !regime_is_user(env, mmu_idx)) {
861             xn = 1;
862         }
863         if (xn && access_type == MMU_INST_FETCH) {
864             fi->type = ARMFault_Permission;
865             goto do_fault;
866         }
867 
868         if (arm_feature(env, ARM_FEATURE_V6K) &&
869                 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
870             /* The simplified model uses AP[0] as an access control bit.  */
871             if ((ap & 1) == 0) {
872                 /* Access flag fault.  */
873                 fi->type = ARMFault_AccessFlag;
874                 goto do_fault;
875             }
876             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
877             user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1);
878         } else {
879             result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
880             user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1);
881         }
882         if (result->f.prot && !xn) {
883             result->f.prot |= PAGE_EXEC;
884         }
885         if (!(result->f.prot & (1 << access_type))) {
886             /* Access permission fault.  */
887             fi->type = ARMFault_Permission;
888             goto do_fault;
889         }
890         if (regime_is_pan(env, mmu_idx) &&
891             !regime_is_user(env, mmu_idx) &&
892             user_prot &&
893             access_type != MMU_INST_FETCH) {
894             /* Privileged Access Never fault */
895             fi->type = ARMFault_Permission;
896             goto do_fault;
897         }
898     }
899     if (ns) {
900         /* The NS bit will (as required by the architecture) have no effect if
901          * the CPU doesn't support TZ or this is a non-secure translation
902          * regime, because the attribute will already be non-secure.
903          */
904         result->f.attrs.secure = false;
905     }
906     result->f.phys_addr = phys_addr;
907     return false;
908 do_fault:
909     fi->domain = domain;
910     fi->level = level;
911     return true;
912 }
913 
914 /*
915  * Translate S2 section/page access permissions to protection flags
916  * @env:     CPUARMState
917  * @s2ap:    The 2-bit stage2 access permissions (S2AP)
918  * @xn:      XN (execute-never) bits
919  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
920  */
921 static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
922 {
923     int prot = 0;
924 
925     if (s2ap & 1) {
926         prot |= PAGE_READ;
927     }
928     if (s2ap & 2) {
929         prot |= PAGE_WRITE;
930     }
931 
932     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
933         switch (xn) {
934         case 0:
935             prot |= PAGE_EXEC;
936             break;
937         case 1:
938             if (s1_is_el0) {
939                 prot |= PAGE_EXEC;
940             }
941             break;
942         case 2:
943             break;
944         case 3:
945             if (!s1_is_el0) {
946                 prot |= PAGE_EXEC;
947             }
948             break;
949         default:
950             g_assert_not_reached();
951         }
952     } else {
953         if (!extract32(xn, 1, 1)) {
954             if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
955                 prot |= PAGE_EXEC;
956             }
957         }
958     }
959     return prot;
960 }
961 
962 /*
963  * Translate section/page access permissions to protection flags
964  * @env:     CPUARMState
965  * @mmu_idx: MMU index indicating required translation regime
966  * @is_aa64: TRUE if AArch64
967  * @ap:      The 2-bit simple AP (AP[2:1])
968  * @ns:      NS (non-secure) bit
969  * @xn:      XN (execute-never) bit
970  * @pxn:     PXN (privileged execute-never) bit
971  */
972 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
973                       int ap, int ns, int xn, int pxn)
974 {
975     ARMCPU *cpu = env_archcpu(env);
976     bool is_user = regime_is_user(env, mmu_idx);
977     int prot_rw, user_rw;
978     bool have_wxn;
979     int wxn = 0;
980 
981     assert(!regime_is_stage2(mmu_idx));
982 
983     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
984     if (is_user) {
985         prot_rw = user_rw;
986     } else {
987         /*
988          * PAN controls can forbid data accesses but don't affect insn fetch.
989          * Plain PAN forbids data accesses if EL0 has data permissions;
990          * PAN3 forbids data accesses if EL0 has either data or exec perms.
991          * Note that for AArch64 the 'user can exec' case is exactly !xn.
992          * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0
993          * do not affect EPAN.
994          */
995         if (user_rw && regime_is_pan(env, mmu_idx)) {
996             prot_rw = 0;
997         } else if (cpu_isar_feature(aa64_pan3, cpu) && is_aa64 &&
998                    regime_is_pan(env, mmu_idx) &&
999                    (regime_sctlr(env, mmu_idx) & SCTLR_EPAN) && !xn) {
1000             prot_rw = 0;
1001         } else {
1002             prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
1003         }
1004     }
1005 
1006     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
1007         return prot_rw;
1008     }
1009 
1010     /* TODO have_wxn should be replaced with
1011      *   ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
1012      * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
1013      * compatible processors have EL2, which is required for [U]WXN.
1014      */
1015     have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
1016 
1017     if (have_wxn) {
1018         wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
1019     }
1020 
1021     if (is_aa64) {
1022         if (regime_has_2_ranges(mmu_idx) && !is_user) {
1023             xn = pxn || (user_rw & PAGE_WRITE);
1024         }
1025     } else if (arm_feature(env, ARM_FEATURE_V7)) {
1026         switch (regime_el(env, mmu_idx)) {
1027         case 1:
1028         case 3:
1029             if (is_user) {
1030                 xn = xn || !(user_rw & PAGE_READ);
1031             } else {
1032                 int uwxn = 0;
1033                 if (have_wxn) {
1034                     uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
1035                 }
1036                 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
1037                      (uwxn && (user_rw & PAGE_WRITE));
1038             }
1039             break;
1040         case 2:
1041             break;
1042         }
1043     } else {
1044         xn = wxn = 0;
1045     }
1046 
1047     if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
1048         return prot_rw;
1049     }
1050     return prot_rw | PAGE_EXEC;
1051 }
1052 
1053 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
1054                                           ARMMMUIdx mmu_idx)
1055 {
1056     uint64_t tcr = regime_tcr(env, mmu_idx);
1057     uint32_t el = regime_el(env, mmu_idx);
1058     int select, tsz;
1059     bool epd, hpd;
1060 
1061     assert(mmu_idx != ARMMMUIdx_Stage2_S);
1062 
1063     if (mmu_idx == ARMMMUIdx_Stage2) {
1064         /* VTCR */
1065         bool sext = extract32(tcr, 4, 1);
1066         bool sign = extract32(tcr, 3, 1);
1067 
1068         /*
1069          * If the sign-extend bit is not the same as t0sz[3], the result
1070          * is unpredictable. Flag this as a guest error.
1071          */
1072         if (sign != sext) {
1073             qemu_log_mask(LOG_GUEST_ERROR,
1074                           "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
1075         }
1076         tsz = sextract32(tcr, 0, 4) + 8;
1077         select = 0;
1078         hpd = false;
1079         epd = false;
1080     } else if (el == 2) {
1081         /* HTCR */
1082         tsz = extract32(tcr, 0, 3);
1083         select = 0;
1084         hpd = extract64(tcr, 24, 1);
1085         epd = false;
1086     } else {
1087         int t0sz = extract32(tcr, 0, 3);
1088         int t1sz = extract32(tcr, 16, 3);
1089 
1090         if (t1sz == 0) {
1091             select = va > (0xffffffffu >> t0sz);
1092         } else {
1093             /* Note that we will detect errors later.  */
1094             select = va >= ~(0xffffffffu >> t1sz);
1095         }
1096         if (!select) {
1097             tsz = t0sz;
1098             epd = extract32(tcr, 7, 1);
1099             hpd = extract64(tcr, 41, 1);
1100         } else {
1101             tsz = t1sz;
1102             epd = extract32(tcr, 23, 1);
1103             hpd = extract64(tcr, 42, 1);
1104         }
1105         /* For aarch32, hpd0 is not enabled without t2e as well.  */
1106         hpd &= extract32(tcr, 6, 1);
1107     }
1108 
1109     return (ARMVAParameters) {
1110         .tsz = tsz,
1111         .select = select,
1112         .epd = epd,
1113         .hpd = hpd,
1114     };
1115 }
1116 
1117 /*
1118  * check_s2_mmu_setup
1119  * @cpu:        ARMCPU
1120  * @is_aa64:    True if the translation regime is in AArch64 state
1121  * @tcr:        VTCR_EL2 or VSTCR_EL2
1122  * @ds:         Effective value of TCR.DS.
1123  * @iasize:     Bitsize of IPAs
1124  * @stride:     Page-table stride (See the ARM ARM)
1125  *
1126  * Decode the starting level of the S2 lookup, returning INT_MIN if
1127  * the configuration is invalid.
1128  */
1129 static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
1130                               bool ds, int iasize, int stride)
1131 {
1132     int sl0, sl2, startlevel, granulebits, levels;
1133     int s1_min_iasize, s1_max_iasize;
1134 
1135     sl0 = extract32(tcr, 6, 2);
1136     if (is_aa64) {
1137         /*
1138          * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
1139          * get_phys_addr_lpae, that used aa64_va_parameters which apply
1140          * to aarch64.  If Stage1 is aarch32, the min_txsz is larger.
1141          * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
1142          * inputsize is 64 - 24 = 40.
1143          */
1144         if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
1145             goto fail;
1146         }
1147 
1148         /*
1149          * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
1150          * so interleave AArch64.S2StartLevel.
1151          */
1152         switch (stride) {
1153         case 9: /* 4KB */
1154             /* SL2 is RES0 unless DS=1 & 4KB granule. */
1155             sl2 = extract64(tcr, 33, 1);
1156             if (ds && sl2) {
1157                 if (sl0 != 0) {
1158                     goto fail;
1159                 }
1160                 startlevel = -1;
1161             } else {
1162                 startlevel = 2 - sl0;
1163                 switch (sl0) {
1164                 case 2:
1165                     if (arm_pamax(cpu) < 44) {
1166                         goto fail;
1167                     }
1168                     break;
1169                 case 3:
1170                     if (!cpu_isar_feature(aa64_st, cpu)) {
1171                         goto fail;
1172                     }
1173                     startlevel = 3;
1174                     break;
1175                 }
1176             }
1177             break;
1178         case 11: /* 16KB */
1179             switch (sl0) {
1180             case 2:
1181                 if (arm_pamax(cpu) < 42) {
1182                     goto fail;
1183                 }
1184                 break;
1185             case 3:
1186                 if (!ds) {
1187                     goto fail;
1188                 }
1189                 break;
1190             }
1191             startlevel = 3 - sl0;
1192             break;
1193         case 13: /* 64KB */
1194             switch (sl0) {
1195             case 2:
1196                 if (arm_pamax(cpu) < 44) {
1197                     goto fail;
1198                 }
1199                 break;
1200             case 3:
1201                 goto fail;
1202             }
1203             startlevel = 3 - sl0;
1204             break;
1205         default:
1206             g_assert_not_reached();
1207         }
1208     } else {
1209         /*
1210          * Things are simpler for AArch32 EL2, with only 4k pages.
1211          * There is no separate S2InvalidSL function, but AArch32.S2Walk
1212          * begins with walkparms.sl0 in {'1x'}.
1213          */
1214         assert(stride == 9);
1215         if (sl0 >= 2) {
1216             goto fail;
1217         }
1218         startlevel = 2 - sl0;
1219     }
1220 
1221     /* AArch{64,32}.S2InconsistentSL are functionally equivalent.  */
1222     levels = 3 - startlevel;
1223     granulebits = stride + 3;
1224 
1225     s1_min_iasize = levels * stride + granulebits + 1;
1226     s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
1227 
1228     if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
1229         return startlevel;
1230     }
1231 
1232  fail:
1233     return INT_MIN;
1234 }
1235 
1236 /**
1237  * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
1238  *
1239  * Returns false if the translation was successful. Otherwise, phys_ptr,
1240  * attrs, prot and page_size may not be filled in, and the populated fsr
1241  * value provides information on why the translation aborted, in the format
1242  * of a long-format DFSR/IFSR fault register, with the following caveat:
1243  * the WnR bit is never set (the caller must do this).
1244  *
1245  * @env: CPUARMState
1246  * @ptw: Current and next stage parameters for the walk.
1247  * @address: virtual address to get physical address for
1248  * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
1249  * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
1250  *             (so this is a stage 2 page table walk),
1251  *             must be true if this is stage 2 of a stage 1+2
1252  *             walk for an EL0 access. If @mmu_idx is anything else,
1253  *             @s1_is_el0 is ignored.
1254  * @result: set on translation success,
1255  * @fi: set to fault info if the translation fails
1256  */
1257 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
1258                                uint64_t address,
1259                                MMUAccessType access_type, bool s1_is_el0,
1260                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
1261 {
1262     ARMCPU *cpu = env_archcpu(env);
1263     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
1264     bool is_secure = ptw->in_secure;
1265     int32_t level;
1266     ARMVAParameters param;
1267     uint64_t ttbr;
1268     hwaddr descaddr, indexmask, indexmask_grainsize;
1269     uint32_t tableattrs;
1270     target_ulong page_size;
1271     uint64_t attrs;
1272     int32_t stride;
1273     int addrsize, inputsize, outputsize;
1274     uint64_t tcr = regime_tcr(env, mmu_idx);
1275     int ap, ns, xn, pxn;
1276     uint32_t el = regime_el(env, mmu_idx);
1277     uint64_t descaddrmask;
1278     bool aarch64 = arm_el_is_aa64(env, el);
1279     uint64_t descriptor, new_descriptor;
1280     bool nstable;
1281 
1282     /* TODO: This code does not support shareability levels. */
1283     if (aarch64) {
1284         int ps;
1285 
1286         param = aa64_va_parameters(env, address, mmu_idx,
1287                                    access_type != MMU_INST_FETCH);
1288         level = 0;
1289 
1290         /*
1291          * If TxSZ is programmed to a value larger than the maximum,
1292          * or smaller than the effective minimum, it is IMPLEMENTATION
1293          * DEFINED whether we behave as if the field were programmed
1294          * within bounds, or if a level 0 Translation fault is generated.
1295          *
1296          * With FEAT_LVA, fault on less than minimum becomes required,
1297          * so our choice is to always raise the fault.
1298          */
1299         if (param.tsz_oob) {
1300             goto do_translation_fault;
1301         }
1302 
1303         addrsize = 64 - 8 * param.tbi;
1304         inputsize = 64 - param.tsz;
1305 
1306         /*
1307          * Bound PS by PARANGE to find the effective output address size.
1308          * ID_AA64MMFR0 is a read-only register so values outside of the
1309          * supported mappings can be considered an implementation error.
1310          */
1311         ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
1312         ps = MIN(ps, param.ps);
1313         assert(ps < ARRAY_SIZE(pamax_map));
1314         outputsize = pamax_map[ps];
1315 
1316         /*
1317          * With LPA2, the effective output address (OA) size is at most 48 bits
1318          * unless TCR.DS == 1
1319          */
1320         if (!param.ds && param.gran != Gran64K) {
1321             outputsize = MIN(outputsize, 48);
1322         }
1323     } else {
1324         param = aa32_va_parameters(env, address, mmu_idx);
1325         level = 1;
1326         addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32);
1327         inputsize = addrsize - param.tsz;
1328         outputsize = 40;
1329     }
1330 
1331     /*
1332      * We determined the region when collecting the parameters, but we
1333      * have not yet validated that the address is valid for the region.
1334      * Extract the top bits and verify that they all match select.
1335      *
1336      * For aa32, if inputsize == addrsize, then we have selected the
1337      * region by exclusion in aa32_va_parameters and there is no more
1338      * validation to do here.
1339      */
1340     if (inputsize < addrsize) {
1341         target_ulong top_bits = sextract64(address, inputsize,
1342                                            addrsize - inputsize);
1343         if (-top_bits != param.select) {
1344             /* The gap between the two regions is a Translation fault */
1345             goto do_translation_fault;
1346         }
1347     }
1348 
1349     stride = arm_granule_bits(param.gran) - 3;
1350 
1351     /*
1352      * Note that QEMU ignores shareability and cacheability attributes,
1353      * so we don't need to do anything with the SH, ORGN, IRGN fields
1354      * in the TTBCR.  Similarly, TTBCR:A1 selects whether we get the
1355      * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
1356      * implement any ASID-like capability so we can ignore it (instead
1357      * we will always flush the TLB any time the ASID is changed).
1358      */
1359     ttbr = regime_ttbr(env, mmu_idx, param.select);
1360 
1361     /*
1362      * Here we should have set up all the parameters for the translation:
1363      * inputsize, ttbr, epd, stride, tbi
1364      */
1365 
1366     if (param.epd) {
1367         /*
1368          * Translation table walk disabled => Translation fault on TLB miss
1369          * Note: This is always 0 on 64-bit EL2 and EL3.
1370          */
1371         goto do_translation_fault;
1372     }
1373 
1374     if (!regime_is_stage2(mmu_idx)) {
1375         /*
1376          * The starting level depends on the virtual address size (which can
1377          * be up to 48 bits) and the translation granule size. It indicates
1378          * the number of strides (stride bits at a time) needed to
1379          * consume the bits of the input address. In the pseudocode this is:
1380          *  level = 4 - RoundUp((inputsize - grainsize) / stride)
1381          * where their 'inputsize' is our 'inputsize', 'grainsize' is
1382          * our 'stride + 3' and 'stride' is our 'stride'.
1383          * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
1384          * = 4 - (inputsize - stride - 3 + stride - 1) / stride
1385          * = 4 - (inputsize - 4) / stride;
1386          */
1387         level = 4 - (inputsize - 4) / stride;
1388     } else {
1389         int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
1390                                             inputsize, stride);
1391         if (startlevel == INT_MIN) {
1392             level = 0;
1393             goto do_translation_fault;
1394         }
1395         level = startlevel;
1396     }
1397 
1398     indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3);
1399     indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level)));
1400 
1401     /* Now we can extract the actual base address from the TTBR */
1402     descaddr = extract64(ttbr, 0, 48);
1403 
1404     /*
1405      * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
1406      *
1407      * Otherwise, if the base address is out of range, raise AddressSizeFault.
1408      * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
1409      * but we've just cleared the bits above 47, so simplify the test.
1410      */
1411     if (outputsize > 48) {
1412         descaddr |= extract64(ttbr, 2, 4) << 48;
1413     } else if (descaddr >> outputsize) {
1414         level = 0;
1415         fi->type = ARMFault_AddressSize;
1416         goto do_fault;
1417     }
1418 
1419     /*
1420      * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
1421      * and also to mask out CnP (bit 0) which could validly be non-zero.
1422      */
1423     descaddr &= ~indexmask;
1424 
1425     /*
1426      * For AArch32, the address field in the descriptor goes up to bit 39
1427      * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
1428      * or an AddressSize fault is raised.  So for v8 we extract those SBZ
1429      * bits as part of the address, which will be checked via outputsize.
1430      * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
1431      * the highest bits of a 52-bit output are placed elsewhere.
1432      */
1433     if (param.ds) {
1434         descaddrmask = MAKE_64BIT_MASK(0, 50);
1435     } else if (arm_feature(env, ARM_FEATURE_V8)) {
1436         descaddrmask = MAKE_64BIT_MASK(0, 48);
1437     } else {
1438         descaddrmask = MAKE_64BIT_MASK(0, 40);
1439     }
1440     descaddrmask &= ~indexmask_grainsize;
1441 
1442     /*
1443      * Secure stage 1 accesses start with the page table in secure memory and
1444      * can be downgraded to non-secure at any step. Non-secure accesses
1445      * remain non-secure. We implement this by just ORing in the NSTable/NS
1446      * bits at each step.
1447      * Stage 2 never gets this kind of downgrade.
1448      */
1449     tableattrs = is_secure ? 0 : (1 << 4);
1450 
1451  next_level:
1452     descaddr |= (address >> (stride * (4 - level))) & indexmask;
1453     descaddr &= ~7ULL;
1454     nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
1455     if (nstable) {
1456         /*
1457          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
1458          * Assert that the non-secure idx are even, and relative order.
1459          */
1460         QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
1461         QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
1462         QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
1463         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
1464         ptw->in_ptw_idx &= ~1;
1465         ptw->in_secure = false;
1466     }
1467     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
1468         goto do_fault;
1469     }
1470     descriptor = arm_ldq_ptw(env, ptw, fi);
1471     if (fi->type != ARMFault_None) {
1472         goto do_fault;
1473     }
1474     new_descriptor = descriptor;
1475 
1476  restart_atomic_update:
1477     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
1478         /* Invalid, or the Reserved level 3 encoding */
1479         goto do_translation_fault;
1480     }
1481 
1482     descaddr = descriptor & descaddrmask;
1483 
1484     /*
1485      * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
1486      * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
1487      * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
1488      * raise AddressSizeFault.
1489      */
1490     if (outputsize > 48) {
1491         if (param.ds) {
1492             descaddr |= extract64(descriptor, 8, 2) << 50;
1493         } else {
1494             descaddr |= extract64(descriptor, 12, 4) << 48;
1495         }
1496     } else if (descaddr >> outputsize) {
1497         fi->type = ARMFault_AddressSize;
1498         goto do_fault;
1499     }
1500 
1501     if ((descriptor & 2) && (level < 3)) {
1502         /*
1503          * Table entry. The top five bits are attributes which may
1504          * propagate down through lower levels of the table (and
1505          * which are all arranged so that 0 means "no effect", so
1506          * we can gather them up by ORing in the bits at each level).
1507          */
1508         tableattrs |= extract64(descriptor, 59, 5);
1509         level++;
1510         indexmask = indexmask_grainsize;
1511         goto next_level;
1512     }
1513 
1514     /*
1515      * Block entry at level 1 or 2, or page entry at level 3.
1516      * These are basically the same thing, although the number
1517      * of bits we pull in from the vaddr varies. Note that although
1518      * descaddrmask masks enough of the low bits of the descriptor
1519      * to give a correct page or table address, the address field
1520      * in a block descriptor is smaller; so we need to explicitly
1521      * clear the lower bits here before ORing in the low vaddr bits.
1522      *
1523      * Afterward, descaddr is the final physical address.
1524      */
1525     page_size = (1ULL << ((stride * (4 - level)) + 3));
1526     descaddr &= ~(hwaddr)(page_size - 1);
1527     descaddr |= (address & (page_size - 1));
1528 
1529     if (likely(!ptw->in_debug)) {
1530         /*
1531          * Access flag.
1532          * If HA is enabled, prepare to update the descriptor below.
1533          * Otherwise, pass the access fault on to software.
1534          */
1535         if (!(descriptor & (1 << 10))) {
1536             if (param.ha) {
1537                 new_descriptor |= 1 << 10; /* AF */
1538             } else {
1539                 fi->type = ARMFault_AccessFlag;
1540                 goto do_fault;
1541             }
1542         }
1543 
1544         /*
1545          * Dirty Bit.
1546          * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
1547          * bit for writeback. The actual write protection test may still be
1548          * overridden by tableattrs, to be merged below.
1549          */
1550         if (param.hd
1551             && extract64(descriptor, 51, 1)  /* DBM */
1552             && access_type == MMU_DATA_STORE) {
1553             if (regime_is_stage2(mmu_idx)) {
1554                 new_descriptor |= 1ull << 7;    /* set S2AP[1] */
1555             } else {
1556                 new_descriptor &= ~(1ull << 7); /* clear AP[2] */
1557             }
1558         }
1559     }
1560 
1561     /*
1562      * Extract attributes from the (modified) descriptor, and apply
1563      * table descriptors. Stage 2 table descriptors do not include
1564      * any attribute fields. HPD disables all the table attributes
1565      * except NSTable.
1566      */
1567     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
1568     if (!regime_is_stage2(mmu_idx)) {
1569         attrs |= nstable << 5; /* NS */
1570         if (!param.hpd) {
1571             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
1572             /*
1573              * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
1574              * means "force PL1 access only", which means forcing AP[1] to 0.
1575              */
1576             attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
1577             attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
1578         }
1579     }
1580 
1581     ap = extract32(attrs, 6, 2);
1582     if (regime_is_stage2(mmu_idx)) {
1583         ns = mmu_idx == ARMMMUIdx_Stage2;
1584         xn = extract64(attrs, 53, 2);
1585         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
1586     } else {
1587         ns = extract32(attrs, 5, 1);
1588         xn = extract64(attrs, 54, 1);
1589         pxn = extract64(attrs, 53, 1);
1590         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
1591     }
1592 
1593     if (!(result->f.prot & (1 << access_type))) {
1594         fi->type = ARMFault_Permission;
1595         goto do_fault;
1596     }
1597 
1598     /* If FEAT_HAFDBS has made changes, update the PTE. */
1599     if (new_descriptor != descriptor) {
1600         new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
1601         if (fi->type != ARMFault_None) {
1602             goto do_fault;
1603         }
1604         /*
1605          * I_YZSVV says that if the in-memory descriptor has changed,
1606          * then we must use the information in that new value
1607          * (which might include a different output address, different
1608          * attributes, or generate a fault).
1609          * Restart the handling of the descriptor value from scratch.
1610          */
1611         if (new_descriptor != descriptor) {
1612             descriptor = new_descriptor;
1613             goto restart_atomic_update;
1614         }
1615     }
1616 
1617     if (ns) {
1618         /*
1619          * The NS bit will (as required by the architecture) have no effect if
1620          * the CPU doesn't support TZ or this is a non-secure translation
1621          * regime, because the attribute will already be non-secure.
1622          */
1623         result->f.attrs.secure = false;
1624     }
1625 
1626     if (regime_is_stage2(mmu_idx)) {
1627         result->cacheattrs.is_s2_format = true;
1628         result->cacheattrs.attrs = extract32(attrs, 2, 4);
1629     } else {
1630         /* Index into MAIR registers for cache attributes */
1631         uint8_t attrindx = extract32(attrs, 2, 3);
1632         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
1633         assert(attrindx <= 7);
1634         result->cacheattrs.is_s2_format = false;
1635         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
1636 
1637         /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
1638         if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
1639             result->f.guarded = extract64(attrs, 50, 1); /* GP */
1640         }
1641     }
1642 
1643     /*
1644      * For FEAT_LPA2 and effective DS, the SH field in the attributes
1645      * was re-purposed for output address bits.  The SH attribute in
1646      * that case comes from TCR_ELx, which we extracted earlier.
1647      */
1648     if (param.ds) {
1649         result->cacheattrs.shareability = param.sh;
1650     } else {
1651         result->cacheattrs.shareability = extract32(attrs, 8, 2);
1652     }
1653 
1654     result->f.phys_addr = descaddr;
1655     result->f.lg_page_size = ctz64(page_size);
1656     return false;
1657 
1658  do_translation_fault:
1659     fi->type = ARMFault_Translation;
1660  do_fault:
1661     fi->level = level;
1662     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
1663     fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
1664     fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
1665     return true;
1666 }
1667 
1668 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
1669                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
1670                                  bool is_secure, GetPhysAddrResult *result,
1671                                  ARMMMUFaultInfo *fi)
1672 {
1673     int n;
1674     uint32_t mask;
1675     uint32_t base;
1676     bool is_user = regime_is_user(env, mmu_idx);
1677 
1678     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
1679         /* MPU disabled.  */
1680         result->f.phys_addr = address;
1681         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1682         return false;
1683     }
1684 
1685     result->f.phys_addr = address;
1686     for (n = 7; n >= 0; n--) {
1687         base = env->cp15.c6_region[n];
1688         if ((base & 1) == 0) {
1689             continue;
1690         }
1691         mask = 1 << ((base >> 1) & 0x1f);
1692         /* Keep this shift separate from the above to avoid an
1693            (undefined) << 32.  */
1694         mask = (mask << 1) - 1;
1695         if (((base ^ address) & ~mask) == 0) {
1696             break;
1697         }
1698     }
1699     if (n < 0) {
1700         fi->type = ARMFault_Background;
1701         return true;
1702     }
1703 
1704     if (access_type == MMU_INST_FETCH) {
1705         mask = env->cp15.pmsav5_insn_ap;
1706     } else {
1707         mask = env->cp15.pmsav5_data_ap;
1708     }
1709     mask = (mask >> (n * 4)) & 0xf;
1710     switch (mask) {
1711     case 0:
1712         fi->type = ARMFault_Permission;
1713         fi->level = 1;
1714         return true;
1715     case 1:
1716         if (is_user) {
1717             fi->type = ARMFault_Permission;
1718             fi->level = 1;
1719             return true;
1720         }
1721         result->f.prot = PAGE_READ | PAGE_WRITE;
1722         break;
1723     case 2:
1724         result->f.prot = PAGE_READ;
1725         if (!is_user) {
1726             result->f.prot |= PAGE_WRITE;
1727         }
1728         break;
1729     case 3:
1730         result->f.prot = PAGE_READ | PAGE_WRITE;
1731         break;
1732     case 5:
1733         if (is_user) {
1734             fi->type = ARMFault_Permission;
1735             fi->level = 1;
1736             return true;
1737         }
1738         result->f.prot = PAGE_READ;
1739         break;
1740     case 6:
1741         result->f.prot = PAGE_READ;
1742         break;
1743     default:
1744         /* Bad permission.  */
1745         fi->type = ARMFault_Permission;
1746         fi->level = 1;
1747         return true;
1748     }
1749     result->f.prot |= PAGE_EXEC;
1750     return false;
1751 }
1752 
1753 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx,
1754                                          int32_t address, uint8_t *prot)
1755 {
1756     if (!arm_feature(env, ARM_FEATURE_M)) {
1757         *prot = PAGE_READ | PAGE_WRITE;
1758         switch (address) {
1759         case 0xF0000000 ... 0xFFFFFFFF:
1760             if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
1761                 /* hivecs execing is ok */
1762                 *prot |= PAGE_EXEC;
1763             }
1764             break;
1765         case 0x00000000 ... 0x7FFFFFFF:
1766             *prot |= PAGE_EXEC;
1767             break;
1768         }
1769     } else {
1770         /* Default system address map for M profile cores.
1771          * The architecture specifies which regions are execute-never;
1772          * at the MPU level no other checks are defined.
1773          */
1774         switch (address) {
1775         case 0x00000000 ... 0x1fffffff: /* ROM */
1776         case 0x20000000 ... 0x3fffffff: /* SRAM */
1777         case 0x60000000 ... 0x7fffffff: /* RAM */
1778         case 0x80000000 ... 0x9fffffff: /* RAM */
1779             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1780             break;
1781         case 0x40000000 ... 0x5fffffff: /* Peripheral */
1782         case 0xa0000000 ... 0xbfffffff: /* Device */
1783         case 0xc0000000 ... 0xdfffffff: /* Device */
1784         case 0xe0000000 ... 0xffffffff: /* System */
1785             *prot = PAGE_READ | PAGE_WRITE;
1786             break;
1787         default:
1788             g_assert_not_reached();
1789         }
1790     }
1791 }
1792 
1793 static bool m_is_ppb_region(CPUARMState *env, uint32_t address)
1794 {
1795     /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
1796     return arm_feature(env, ARM_FEATURE_M) &&
1797         extract32(address, 20, 12) == 0xe00;
1798 }
1799 
1800 static bool m_is_system_region(CPUARMState *env, uint32_t address)
1801 {
1802     /*
1803      * True if address is in the M profile system region
1804      * 0xe0000000 - 0xffffffff
1805      */
1806     return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
1807 }
1808 
1809 static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx,
1810                                          bool is_secure, bool is_user)
1811 {
1812     /*
1813      * Return true if we should use the default memory map as a
1814      * "background" region if there are no hits against any MPU regions.
1815      */
1816     CPUARMState *env = &cpu->env;
1817 
1818     if (is_user) {
1819         return false;
1820     }
1821 
1822     if (arm_feature(env, ARM_FEATURE_M)) {
1823         return env->v7m.mpu_ctrl[is_secure] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
1824     }
1825 
1826     if (mmu_idx == ARMMMUIdx_Stage2) {
1827         return false;
1828     }
1829 
1830     return regime_sctlr(env, mmu_idx) & SCTLR_BR;
1831 }
1832 
1833 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
1834                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
1835                                  bool secure, GetPhysAddrResult *result,
1836                                  ARMMMUFaultInfo *fi)
1837 {
1838     ARMCPU *cpu = env_archcpu(env);
1839     int n;
1840     bool is_user = regime_is_user(env, mmu_idx);
1841 
1842     result->f.phys_addr = address;
1843     result->f.lg_page_size = TARGET_PAGE_BITS;
1844     result->f.prot = 0;
1845 
1846     if (regime_translation_disabled(env, mmu_idx, secure) ||
1847         m_is_ppb_region(env, address)) {
1848         /*
1849          * MPU disabled or M profile PPB access: use default memory map.
1850          * The other case which uses the default memory map in the
1851          * v7M ARM ARM pseudocode is exception vector reads from the vector
1852          * table. In QEMU those accesses are done in arm_v7m_load_vector(),
1853          * which always does a direct read using address_space_ldl(), rather
1854          * than going via this function, so we don't need to check that here.
1855          */
1856         get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
1857     } else { /* MPU enabled */
1858         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
1859             /* region search */
1860             uint32_t base = env->pmsav7.drbar[n];
1861             uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
1862             uint32_t rmask;
1863             bool srdis = false;
1864 
1865             if (!(env->pmsav7.drsr[n] & 0x1)) {
1866                 continue;
1867             }
1868 
1869             if (!rsize) {
1870                 qemu_log_mask(LOG_GUEST_ERROR,
1871                               "DRSR[%d]: Rsize field cannot be 0\n", n);
1872                 continue;
1873             }
1874             rsize++;
1875             rmask = (1ull << rsize) - 1;
1876 
1877             if (base & rmask) {
1878                 qemu_log_mask(LOG_GUEST_ERROR,
1879                               "DRBAR[%d]: 0x%" PRIx32 " misaligned "
1880                               "to DRSR region size, mask = 0x%" PRIx32 "\n",
1881                               n, base, rmask);
1882                 continue;
1883             }
1884 
1885             if (address < base || address > base + rmask) {
1886                 /*
1887                  * Address not in this region. We must check whether the
1888                  * region covers addresses in the same page as our address.
1889                  * In that case we must not report a size that covers the
1890                  * whole page for a subsequent hit against a different MPU
1891                  * region or the background region, because it would result in
1892                  * incorrect TLB hits for subsequent accesses to addresses that
1893                  * are in this MPU region.
1894                  */
1895                 if (ranges_overlap(base, rmask,
1896                                    address & TARGET_PAGE_MASK,
1897                                    TARGET_PAGE_SIZE)) {
1898                     result->f.lg_page_size = 0;
1899                 }
1900                 continue;
1901             }
1902 
1903             /* Region matched */
1904 
1905             if (rsize >= 8) { /* no subregions for regions < 256 bytes */
1906                 int i, snd;
1907                 uint32_t srdis_mask;
1908 
1909                 rsize -= 3; /* sub region size (power of 2) */
1910                 snd = ((address - base) >> rsize) & 0x7;
1911                 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
1912 
1913                 srdis_mask = srdis ? 0x3 : 0x0;
1914                 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
1915                     /*
1916                      * This will check in groups of 2, 4 and then 8, whether
1917                      * the subregion bits are consistent. rsize is incremented
1918                      * back up to give the region size, considering consistent
1919                      * adjacent subregions as one region. Stop testing if rsize
1920                      * is already big enough for an entire QEMU page.
1921                      */
1922                     int snd_rounded = snd & ~(i - 1);
1923                     uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
1924                                                      snd_rounded + 8, i);
1925                     if (srdis_mask ^ srdis_multi) {
1926                         break;
1927                     }
1928                     srdis_mask = (srdis_mask << i) | srdis_mask;
1929                     rsize++;
1930                 }
1931             }
1932             if (srdis) {
1933                 continue;
1934             }
1935             if (rsize < TARGET_PAGE_BITS) {
1936                 result->f.lg_page_size = rsize;
1937             }
1938             break;
1939         }
1940 
1941         if (n == -1) { /* no hits */
1942             if (!pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
1943                 /* background fault */
1944                 fi->type = ARMFault_Background;
1945                 return true;
1946             }
1947             get_phys_addr_pmsav7_default(env, mmu_idx, address,
1948                                          &result->f.prot);
1949         } else { /* a MPU hit! */
1950             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
1951             uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
1952 
1953             if (m_is_system_region(env, address)) {
1954                 /* System space is always execute never */
1955                 xn = 1;
1956             }
1957 
1958             if (is_user) { /* User mode AP bit decoding */
1959                 switch (ap) {
1960                 case 0:
1961                 case 1:
1962                 case 5:
1963                     break; /* no access */
1964                 case 3:
1965                     result->f.prot |= PAGE_WRITE;
1966                     /* fall through */
1967                 case 2:
1968                 case 6:
1969                     result->f.prot |= PAGE_READ | PAGE_EXEC;
1970                     break;
1971                 case 7:
1972                     /* for v7M, same as 6; for R profile a reserved value */
1973                     if (arm_feature(env, ARM_FEATURE_M)) {
1974                         result->f.prot |= PAGE_READ | PAGE_EXEC;
1975                         break;
1976                     }
1977                     /* fall through */
1978                 default:
1979                     qemu_log_mask(LOG_GUEST_ERROR,
1980                                   "DRACR[%d]: Bad value for AP bits: 0x%"
1981                                   PRIx32 "\n", n, ap);
1982                 }
1983             } else { /* Priv. mode AP bits decoding */
1984                 switch (ap) {
1985                 case 0:
1986                     break; /* no access */
1987                 case 1:
1988                 case 2:
1989                 case 3:
1990                     result->f.prot |= PAGE_WRITE;
1991                     /* fall through */
1992                 case 5:
1993                 case 6:
1994                     result->f.prot |= PAGE_READ | PAGE_EXEC;
1995                     break;
1996                 case 7:
1997                     /* for v7M, same as 6; for R profile a reserved value */
1998                     if (arm_feature(env, ARM_FEATURE_M)) {
1999                         result->f.prot |= PAGE_READ | PAGE_EXEC;
2000                         break;
2001                     }
2002                     /* fall through */
2003                 default:
2004                     qemu_log_mask(LOG_GUEST_ERROR,
2005                                   "DRACR[%d]: Bad value for AP bits: 0x%"
2006                                   PRIx32 "\n", n, ap);
2007                 }
2008             }
2009 
2010             /* execute never */
2011             if (xn) {
2012                 result->f.prot &= ~PAGE_EXEC;
2013             }
2014         }
2015     }
2016 
2017     fi->type = ARMFault_Permission;
2018     fi->level = 1;
2019     return !(result->f.prot & (1 << access_type));
2020 }
2021 
2022 static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx,
2023                              uint32_t secure)
2024 {
2025     if (regime_el(env, mmu_idx) == 2) {
2026         return env->pmsav8.hprbar;
2027     } else {
2028         return env->pmsav8.rbar[secure];
2029     }
2030 }
2031 
2032 static uint32_t *regime_rlar(CPUARMState *env, ARMMMUIdx mmu_idx,
2033                              uint32_t secure)
2034 {
2035     if (regime_el(env, mmu_idx) == 2) {
2036         return env->pmsav8.hprlar;
2037     } else {
2038         return env->pmsav8.rlar[secure];
2039     }
2040 }
2041 
2042 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
2043                        MMUAccessType access_type, ARMMMUIdx mmu_idx,
2044                        bool secure, GetPhysAddrResult *result,
2045                        ARMMMUFaultInfo *fi, uint32_t *mregion)
2046 {
2047     /*
2048      * Perform a PMSAv8 MPU lookup (without also doing the SAU check
2049      * that a full phys-to-virt translation does).
2050      * mregion is (if not NULL) set to the region number which matched,
2051      * or -1 if no region number is returned (MPU off, address did not
2052      * hit a region, address hit in multiple regions).
2053      * If the region hit doesn't cover the entire TARGET_PAGE the address
2054      * is within, then we set the result page_size to 1 to force the
2055      * memory system to use a subpage.
2056      */
2057     ARMCPU *cpu = env_archcpu(env);
2058     bool is_user = regime_is_user(env, mmu_idx);
2059     int n;
2060     int matchregion = -1;
2061     bool hit = false;
2062     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2063     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2064     int region_counter;
2065 
2066     if (regime_el(env, mmu_idx) == 2) {
2067         region_counter = cpu->pmsav8r_hdregion;
2068     } else {
2069         region_counter = cpu->pmsav7_dregion;
2070     }
2071 
2072     result->f.lg_page_size = TARGET_PAGE_BITS;
2073     result->f.phys_addr = address;
2074     result->f.prot = 0;
2075     if (mregion) {
2076         *mregion = -1;
2077     }
2078 
2079     if (mmu_idx == ARMMMUIdx_Stage2) {
2080         fi->stage2 = true;
2081     }
2082 
2083     /*
2084      * Unlike the ARM ARM pseudocode, we don't need to check whether this
2085      * was an exception vector read from the vector table (which is always
2086      * done using the default system address map), because those accesses
2087      * are done in arm_v7m_load_vector(), which always does a direct
2088      * read using address_space_ldl(), rather than going via this function.
2089      */
2090     if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */
2091         hit = true;
2092     } else if (m_is_ppb_region(env, address)) {
2093         hit = true;
2094     } else {
2095         if (pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) {
2096             hit = true;
2097         }
2098 
2099         uint32_t bitmask;
2100         if (arm_feature(env, ARM_FEATURE_M)) {
2101             bitmask = 0x1f;
2102         } else {
2103             bitmask = 0x3f;
2104             fi->level = 0;
2105         }
2106 
2107         for (n = region_counter - 1; n >= 0; n--) {
2108             /* region search */
2109             /*
2110              * Note that the base address is bits [31:x] from the register
2111              * with bits [x-1:0] all zeroes, but the limit address is bits
2112              * [31:x] from the register with bits [x:0] all ones. Where x is
2113              * 5 for Cortex-M and 6 for Cortex-R
2114              */
2115             uint32_t base = regime_rbar(env, mmu_idx, secure)[n] & ~bitmask;
2116             uint32_t limit = regime_rlar(env, mmu_idx, secure)[n] | bitmask;
2117 
2118             if (!(regime_rlar(env, mmu_idx, secure)[n] & 0x1)) {
2119                 /* Region disabled */
2120                 continue;
2121             }
2122 
2123             if (address < base || address > limit) {
2124                 /*
2125                  * Address not in this region. We must check whether the
2126                  * region covers addresses in the same page as our address.
2127                  * In that case we must not report a size that covers the
2128                  * whole page for a subsequent hit against a different MPU
2129                  * region or the background region, because it would result in
2130                  * incorrect TLB hits for subsequent accesses to addresses that
2131                  * are in this MPU region.
2132                  */
2133                 if (limit >= base &&
2134                     ranges_overlap(base, limit - base + 1,
2135                                    addr_page_base,
2136                                    TARGET_PAGE_SIZE)) {
2137                     result->f.lg_page_size = 0;
2138                 }
2139                 continue;
2140             }
2141 
2142             if (base > addr_page_base || limit < addr_page_limit) {
2143                 result->f.lg_page_size = 0;
2144             }
2145 
2146             if (matchregion != -1) {
2147                 /*
2148                  * Multiple regions match -- always a failure (unlike
2149                  * PMSAv7 where highest-numbered-region wins)
2150                  */
2151                 fi->type = ARMFault_Permission;
2152                 if (arm_feature(env, ARM_FEATURE_M)) {
2153                     fi->level = 1;
2154                 }
2155                 return true;
2156             }
2157 
2158             matchregion = n;
2159             hit = true;
2160         }
2161     }
2162 
2163     if (!hit) {
2164         if (arm_feature(env, ARM_FEATURE_M)) {
2165             fi->type = ARMFault_Background;
2166         } else {
2167             fi->type = ARMFault_Permission;
2168         }
2169         return true;
2170     }
2171 
2172     if (matchregion == -1) {
2173         /* hit using the background region */
2174         get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
2175     } else {
2176         uint32_t matched_rbar = regime_rbar(env, mmu_idx, secure)[matchregion];
2177         uint32_t matched_rlar = regime_rlar(env, mmu_idx, secure)[matchregion];
2178         uint32_t ap = extract32(matched_rbar, 1, 2);
2179         uint32_t xn = extract32(matched_rbar, 0, 1);
2180         bool pxn = false;
2181 
2182         if (arm_feature(env, ARM_FEATURE_V8_1M)) {
2183             pxn = extract32(matched_rlar, 4, 1);
2184         }
2185 
2186         if (m_is_system_region(env, address)) {
2187             /* System space is always execute never */
2188             xn = 1;
2189         }
2190 
2191         if (regime_el(env, mmu_idx) == 2) {
2192             result->f.prot = simple_ap_to_rw_prot_is_user(ap,
2193                                             mmu_idx != ARMMMUIdx_E2);
2194         } else {
2195             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
2196         }
2197 
2198         if (!arm_feature(env, ARM_FEATURE_M)) {
2199             uint8_t attrindx = extract32(matched_rlar, 1, 3);
2200             uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
2201             uint8_t sh = extract32(matched_rlar, 3, 2);
2202 
2203             if (regime_sctlr(env, mmu_idx) & SCTLR_WXN &&
2204                 result->f.prot & PAGE_WRITE && mmu_idx != ARMMMUIdx_Stage2) {
2205                 xn = 0x1;
2206             }
2207 
2208             if ((regime_el(env, mmu_idx) == 1) &&
2209                 regime_sctlr(env, mmu_idx) & SCTLR_UWXN && ap == 0x1) {
2210                 pxn = 0x1;
2211             }
2212 
2213             result->cacheattrs.is_s2_format = false;
2214             result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
2215             result->cacheattrs.shareability = sh;
2216         }
2217 
2218         if (result->f.prot && !xn && !(pxn && !is_user)) {
2219             result->f.prot |= PAGE_EXEC;
2220         }
2221 
2222         if (mregion) {
2223             *mregion = matchregion;
2224         }
2225     }
2226 
2227     fi->type = ARMFault_Permission;
2228     if (arm_feature(env, ARM_FEATURE_M)) {
2229         fi->level = 1;
2230     }
2231     return !(result->f.prot & (1 << access_type));
2232 }
2233 
2234 static bool v8m_is_sau_exempt(CPUARMState *env,
2235                               uint32_t address, MMUAccessType access_type)
2236 {
2237     /*
2238      * The architecture specifies that certain address ranges are
2239      * exempt from v8M SAU/IDAU checks.
2240      */
2241     return
2242         (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
2243         (address >= 0xe0000000 && address <= 0xe0002fff) ||
2244         (address >= 0xe000e000 && address <= 0xe000efff) ||
2245         (address >= 0xe002e000 && address <= 0xe002efff) ||
2246         (address >= 0xe0040000 && address <= 0xe0041fff) ||
2247         (address >= 0xe00ff000 && address <= 0xe00fffff);
2248 }
2249 
2250 void v8m_security_lookup(CPUARMState *env, uint32_t address,
2251                          MMUAccessType access_type, ARMMMUIdx mmu_idx,
2252                          bool is_secure, V8M_SAttributes *sattrs)
2253 {
2254     /*
2255      * Look up the security attributes for this address. Compare the
2256      * pseudocode SecurityCheck() function.
2257      * We assume the caller has zero-initialized *sattrs.
2258      */
2259     ARMCPU *cpu = env_archcpu(env);
2260     int r;
2261     bool idau_exempt = false, idau_ns = true, idau_nsc = true;
2262     int idau_region = IREGION_NOTVALID;
2263     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
2264     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
2265 
2266     if (cpu->idau) {
2267         IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
2268         IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
2269 
2270         iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
2271                    &idau_nsc);
2272     }
2273 
2274     if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
2275         /* 0xf0000000..0xffffffff is always S for insn fetches */
2276         return;
2277     }
2278 
2279     if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
2280         sattrs->ns = !is_secure;
2281         return;
2282     }
2283 
2284     if (idau_region != IREGION_NOTVALID) {
2285         sattrs->irvalid = true;
2286         sattrs->iregion = idau_region;
2287     }
2288 
2289     switch (env->sau.ctrl & 3) {
2290     case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
2291         break;
2292     case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
2293         sattrs->ns = true;
2294         break;
2295     default: /* SAU.ENABLE == 1 */
2296         for (r = 0; r < cpu->sau_sregion; r++) {
2297             if (env->sau.rlar[r] & 1) {
2298                 uint32_t base = env->sau.rbar[r] & ~0x1f;
2299                 uint32_t limit = env->sau.rlar[r] | 0x1f;
2300 
2301                 if (base <= address && limit >= address) {
2302                     if (base > addr_page_base || limit < addr_page_limit) {
2303                         sattrs->subpage = true;
2304                     }
2305                     if (sattrs->srvalid) {
2306                         /*
2307                          * If we hit in more than one region then we must report
2308                          * as Secure, not NS-Callable, with no valid region
2309                          * number info.
2310                          */
2311                         sattrs->ns = false;
2312                         sattrs->nsc = false;
2313                         sattrs->sregion = 0;
2314                         sattrs->srvalid = false;
2315                         break;
2316                     } else {
2317                         if (env->sau.rlar[r] & 2) {
2318                             sattrs->nsc = true;
2319                         } else {
2320                             sattrs->ns = true;
2321                         }
2322                         sattrs->srvalid = true;
2323                         sattrs->sregion = r;
2324                     }
2325                 } else {
2326                     /*
2327                      * Address not in this region. We must check whether the
2328                      * region covers addresses in the same page as our address.
2329                      * In that case we must not report a size that covers the
2330                      * whole page for a subsequent hit against a different MPU
2331                      * region or the background region, because it would result
2332                      * in incorrect TLB hits for subsequent accesses to
2333                      * addresses that are in this MPU region.
2334                      */
2335                     if (limit >= base &&
2336                         ranges_overlap(base, limit - base + 1,
2337                                        addr_page_base,
2338                                        TARGET_PAGE_SIZE)) {
2339                         sattrs->subpage = true;
2340                     }
2341                 }
2342             }
2343         }
2344         break;
2345     }
2346 
2347     /*
2348      * The IDAU will override the SAU lookup results if it specifies
2349      * higher security than the SAU does.
2350      */
2351     if (!idau_ns) {
2352         if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
2353             sattrs->ns = false;
2354             sattrs->nsc = idau_nsc;
2355         }
2356     }
2357 }
2358 
2359 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
2360                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
2361                                  bool secure, GetPhysAddrResult *result,
2362                                  ARMMMUFaultInfo *fi)
2363 {
2364     V8M_SAttributes sattrs = {};
2365     bool ret;
2366 
2367     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2368         v8m_security_lookup(env, address, access_type, mmu_idx,
2369                             secure, &sattrs);
2370         if (access_type == MMU_INST_FETCH) {
2371             /*
2372              * Instruction fetches always use the MMU bank and the
2373              * transaction attribute determined by the fetch address,
2374              * regardless of CPU state. This is painful for QEMU
2375              * to handle, because it would mean we need to encode
2376              * into the mmu_idx not just the (user, negpri) information
2377              * for the current security state but also that for the
2378              * other security state, which would balloon the number
2379              * of mmu_idx values needed alarmingly.
2380              * Fortunately we can avoid this because it's not actually
2381              * possible to arbitrarily execute code from memory with
2382              * the wrong security attribute: it will always generate
2383              * an exception of some kind or another, apart from the
2384              * special case of an NS CPU executing an SG instruction
2385              * in S&NSC memory. So we always just fail the translation
2386              * here and sort things out in the exception handler
2387              * (including possibly emulating an SG instruction).
2388              */
2389             if (sattrs.ns != !secure) {
2390                 if (sattrs.nsc) {
2391                     fi->type = ARMFault_QEMU_NSCExec;
2392                 } else {
2393                     fi->type = ARMFault_QEMU_SFault;
2394                 }
2395                 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2396                 result->f.phys_addr = address;
2397                 result->f.prot = 0;
2398                 return true;
2399             }
2400         } else {
2401             /*
2402              * For data accesses we always use the MMU bank indicated
2403              * by the current CPU state, but the security attributes
2404              * might downgrade a secure access to nonsecure.
2405              */
2406             if (sattrs.ns) {
2407                 result->f.attrs.secure = false;
2408             } else if (!secure) {
2409                 /*
2410                  * NS access to S memory must fault.
2411                  * Architecturally we should first check whether the
2412                  * MPU information for this address indicates that we
2413                  * are doing an unaligned access to Device memory, which
2414                  * should generate a UsageFault instead. QEMU does not
2415                  * currently check for that kind of unaligned access though.
2416                  * If we added it we would need to do so as a special case
2417                  * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
2418                  */
2419                 fi->type = ARMFault_QEMU_SFault;
2420                 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
2421                 result->f.phys_addr = address;
2422                 result->f.prot = 0;
2423                 return true;
2424             }
2425         }
2426     }
2427 
2428     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
2429                             result, fi, NULL);
2430     if (sattrs.subpage) {
2431         result->f.lg_page_size = 0;
2432     }
2433     return ret;
2434 }
2435 
2436 /*
2437  * Translate from the 4-bit stage 2 representation of
2438  * memory attributes (without cache-allocation hints) to
2439  * the 8-bit representation of the stage 1 MAIR registers
2440  * (which includes allocation hints).
2441  *
2442  * ref: shared/translation/attrs/S2AttrDecode()
2443  *      .../S2ConvertAttrsHints()
2444  */
2445 static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs)
2446 {
2447     uint8_t hiattr = extract32(s2attrs, 2, 2);
2448     uint8_t loattr = extract32(s2attrs, 0, 2);
2449     uint8_t hihint = 0, lohint = 0;
2450 
2451     if (hiattr != 0) { /* normal memory */
2452         if (hcr & HCR_CD) { /* cache disabled */
2453             hiattr = loattr = 1; /* non-cacheable */
2454         } else {
2455             if (hiattr != 1) { /* Write-through or write-back */
2456                 hihint = 3; /* RW allocate */
2457             }
2458             if (loattr != 1) { /* Write-through or write-back */
2459                 lohint = 3; /* RW allocate */
2460             }
2461         }
2462     }
2463 
2464     return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
2465 }
2466 
2467 /*
2468  * Combine either inner or outer cacheability attributes for normal
2469  * memory, according to table D4-42 and pseudocode procedure
2470  * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
2471  *
2472  * NB: only stage 1 includes allocation hints (RW bits), leading to
2473  * some asymmetry.
2474  */
2475 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
2476 {
2477     if (s1 == 4 || s2 == 4) {
2478         /* non-cacheable has precedence */
2479         return 4;
2480     } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
2481         /* stage 1 write-through takes precedence */
2482         return s1;
2483     } else if (extract32(s2, 2, 2) == 2) {
2484         /* stage 2 write-through takes precedence, but the allocation hint
2485          * is still taken from stage 1
2486          */
2487         return (2 << 2) | extract32(s1, 0, 2);
2488     } else { /* write-back */
2489         return s1;
2490     }
2491 }
2492 
2493 /*
2494  * Combine the memory type and cacheability attributes of
2495  * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
2496  * combined attributes in MAIR_EL1 format.
2497  */
2498 static uint8_t combined_attrs_nofwb(uint64_t hcr,
2499                                     ARMCacheAttrs s1, ARMCacheAttrs s2)
2500 {
2501     uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs;
2502 
2503     if (s2.is_s2_format) {
2504         s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs);
2505     } else {
2506         s2_mair_attrs = s2.attrs;
2507     }
2508 
2509     s1lo = extract32(s1.attrs, 0, 4);
2510     s2lo = extract32(s2_mair_attrs, 0, 4);
2511     s1hi = extract32(s1.attrs, 4, 4);
2512     s2hi = extract32(s2_mair_attrs, 4, 4);
2513 
2514     /* Combine memory type and cacheability attributes */
2515     if (s1hi == 0 || s2hi == 0) {
2516         /* Device has precedence over normal */
2517         if (s1lo == 0 || s2lo == 0) {
2518             /* nGnRnE has precedence over anything */
2519             ret_attrs = 0;
2520         } else if (s1lo == 4 || s2lo == 4) {
2521             /* non-Reordering has precedence over Reordering */
2522             ret_attrs = 4;  /* nGnRE */
2523         } else if (s1lo == 8 || s2lo == 8) {
2524             /* non-Gathering has precedence over Gathering */
2525             ret_attrs = 8;  /* nGRE */
2526         } else {
2527             ret_attrs = 0xc; /* GRE */
2528         }
2529     } else { /* Normal memory */
2530         /* Outer/inner cacheability combine independently */
2531         ret_attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
2532                   | combine_cacheattr_nibble(s1lo, s2lo);
2533     }
2534     return ret_attrs;
2535 }
2536 
2537 static uint8_t force_cacheattr_nibble_wb(uint8_t attr)
2538 {
2539     /*
2540      * Given the 4 bits specifying the outer or inner cacheability
2541      * in MAIR format, return a value specifying Normal Write-Back,
2542      * with the allocation and transient hints taken from the input
2543      * if the input specified some kind of cacheable attribute.
2544      */
2545     if (attr == 0 || attr == 4) {
2546         /*
2547          * 0 == an UNPREDICTABLE encoding
2548          * 4 == Non-cacheable
2549          * Either way, force Write-Back RW allocate non-transient
2550          */
2551         return 0xf;
2552     }
2553     /* Change WriteThrough to WriteBack, keep allocation and transient hints */
2554     return attr | 4;
2555 }
2556 
2557 /*
2558  * Combine the memory type and cacheability attributes of
2559  * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
2560  * combined attributes in MAIR_EL1 format.
2561  */
2562 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
2563 {
2564     assert(s2.is_s2_format && !s1.is_s2_format);
2565 
2566     switch (s2.attrs) {
2567     case 7:
2568         /* Use stage 1 attributes */
2569         return s1.attrs;
2570     case 6:
2571         /*
2572          * Force Normal Write-Back. Note that if S1 is Normal cacheable
2573          * then we take the allocation hints from it; otherwise it is
2574          * RW allocate, non-transient.
2575          */
2576         if ((s1.attrs & 0xf0) == 0) {
2577             /* S1 is Device */
2578             return 0xff;
2579         }
2580         /* Need to check the Inner and Outer nibbles separately */
2581         return force_cacheattr_nibble_wb(s1.attrs & 0xf) |
2582             force_cacheattr_nibble_wb(s1.attrs >> 4) << 4;
2583     case 5:
2584         /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */
2585         if ((s1.attrs & 0xf0) == 0) {
2586             return s1.attrs;
2587         }
2588         return 0x44;
2589     case 0 ... 3:
2590         /* Force Device, of subtype specified by S2 */
2591         return s2.attrs << 2;
2592     default:
2593         /*
2594          * RESERVED values (including RES0 descriptor bit [5] being nonzero);
2595          * arbitrarily force Device.
2596          */
2597         return 0;
2598     }
2599 }
2600 
2601 /*
2602  * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
2603  * and CombineS1S2Desc()
2604  *
2605  * @env:     CPUARMState
2606  * @s1:      Attributes from stage 1 walk
2607  * @s2:      Attributes from stage 2 walk
2608  */
2609 static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
2610                                         ARMCacheAttrs s1, ARMCacheAttrs s2)
2611 {
2612     ARMCacheAttrs ret;
2613     bool tagged = false;
2614 
2615     assert(!s1.is_s2_format);
2616     ret.is_s2_format = false;
2617     ret.guarded = s1.guarded;
2618 
2619     if (s1.attrs == 0xf0) {
2620         tagged = true;
2621         s1.attrs = 0xff;
2622     }
2623 
2624     /* Combine shareability attributes (table D4-43) */
2625     if (s1.shareability == 2 || s2.shareability == 2) {
2626         /* if either are outer-shareable, the result is outer-shareable */
2627         ret.shareability = 2;
2628     } else if (s1.shareability == 3 || s2.shareability == 3) {
2629         /* if either are inner-shareable, the result is inner-shareable */
2630         ret.shareability = 3;
2631     } else {
2632         /* both non-shareable */
2633         ret.shareability = 0;
2634     }
2635 
2636     /* Combine memory type and cacheability attributes */
2637     if (hcr & HCR_FWB) {
2638         ret.attrs = combined_attrs_fwb(s1, s2);
2639     } else {
2640         ret.attrs = combined_attrs_nofwb(hcr, s1, s2);
2641     }
2642 
2643     /*
2644      * Any location for which the resultant memory type is any
2645      * type of Device memory is always treated as Outer Shareable.
2646      * Any location for which the resultant memory type is Normal
2647      * Inner Non-cacheable, Outer Non-cacheable is always treated
2648      * as Outer Shareable.
2649      * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC
2650      */
2651     if ((ret.attrs & 0xf0) == 0 || ret.attrs == 0x44) {
2652         ret.shareability = 2;
2653     }
2654 
2655     /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */
2656     if (tagged && ret.attrs == 0xff) {
2657         ret.attrs = 0xf0;
2658     }
2659 
2660     return ret;
2661 }
2662 
2663 /*
2664  * MMU disabled.  S1 addresses within aa64 translation regimes are
2665  * still checked for bounds -- see AArch64.S1DisabledOutput().
2666  */
2667 static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
2668                                    MMUAccessType access_type,
2669                                    ARMMMUIdx mmu_idx, bool is_secure,
2670                                    GetPhysAddrResult *result,
2671                                    ARMMMUFaultInfo *fi)
2672 {
2673     uint8_t memattr = 0x00;    /* Device nGnRnE */
2674     uint8_t shareability = 0;  /* non-sharable */
2675     int r_el;
2676 
2677     switch (mmu_idx) {
2678     case ARMMMUIdx_Stage2:
2679     case ARMMMUIdx_Stage2_S:
2680     case ARMMMUIdx_Phys_NS:
2681     case ARMMMUIdx_Phys_S:
2682         break;
2683 
2684     default:
2685         r_el = regime_el(env, mmu_idx);
2686         if (arm_el_is_aa64(env, r_el)) {
2687             int pamax = arm_pamax(env_archcpu(env));
2688             uint64_t tcr = env->cp15.tcr_el[r_el];
2689             int addrtop, tbi;
2690 
2691             tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
2692             if (access_type == MMU_INST_FETCH) {
2693                 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
2694             }
2695             tbi = (tbi >> extract64(address, 55, 1)) & 1;
2696             addrtop = (tbi ? 55 : 63);
2697 
2698             if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
2699                 fi->type = ARMFault_AddressSize;
2700                 fi->level = 0;
2701                 fi->stage2 = false;
2702                 return 1;
2703             }
2704 
2705             /*
2706              * When TBI is disabled, we've just validated that all of the
2707              * bits above PAMax are zero, so logically we only need to
2708              * clear the top byte for TBI.  But it's clearer to follow
2709              * the pseudocode set of addrdesc.paddress.
2710              */
2711             address = extract64(address, 0, 52);
2712         }
2713 
2714         /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
2715         if (r_el == 1) {
2716             uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
2717             if (hcr & HCR_DC) {
2718                 if (hcr & HCR_DCT) {
2719                     memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
2720                 } else {
2721                     memattr = 0xff;  /* Normal, WB, RWA */
2722                 }
2723             }
2724         }
2725         if (memattr == 0 && access_type == MMU_INST_FETCH) {
2726             if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
2727                 memattr = 0xee;  /* Normal, WT, RA, NT */
2728             } else {
2729                 memattr = 0x44;  /* Normal, NC, No */
2730             }
2731             shareability = 2; /* outer sharable */
2732         }
2733         result->cacheattrs.is_s2_format = false;
2734         break;
2735     }
2736 
2737     result->f.phys_addr = address;
2738     result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
2739     result->f.lg_page_size = TARGET_PAGE_BITS;
2740     result->cacheattrs.shareability = shareability;
2741     result->cacheattrs.attrs = memattr;
2742     return false;
2743 }
2744 
2745 static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
2746                                    target_ulong address,
2747                                    MMUAccessType access_type,
2748                                    GetPhysAddrResult *result,
2749                                    ARMMMUFaultInfo *fi)
2750 {
2751     hwaddr ipa;
2752     int s1_prot, s1_lgpgsz;
2753     bool is_secure = ptw->in_secure;
2754     bool ret, ipa_secure;
2755     ARMCacheAttrs cacheattrs1;
2756     bool is_el0;
2757     uint64_t hcr;
2758 
2759     ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
2760 
2761     /* If S1 fails, return early.  */
2762     if (ret) {
2763         return ret;
2764     }
2765 
2766     ipa = result->f.phys_addr;
2767     ipa_secure = result->f.attrs.secure;
2768 
2769     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
2770     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
2771     ptw->in_secure = ipa_secure;
2772     ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
2773 
2774     /*
2775      * S1 is done, now do S2 translation.
2776      * Save the stage1 results so that we may merge prot and cacheattrs later.
2777      */
2778     s1_prot = result->f.prot;
2779     s1_lgpgsz = result->f.lg_page_size;
2780     cacheattrs1 = result->cacheattrs;
2781     memset(result, 0, sizeof(*result));
2782 
2783     if (arm_feature(env, ARM_FEATURE_PMSA)) {
2784         ret = get_phys_addr_pmsav8(env, ipa, access_type,
2785                                    ptw->in_mmu_idx, is_secure, result, fi);
2786     } else {
2787         ret = get_phys_addr_lpae(env, ptw, ipa, access_type,
2788                                  is_el0, result, fi);
2789     }
2790     fi->s2addr = ipa;
2791 
2792     /* Combine the S1 and S2 perms.  */
2793     result->f.prot &= s1_prot;
2794 
2795     /* If S2 fails, return early.  */
2796     if (ret) {
2797         return ret;
2798     }
2799 
2800     /*
2801      * If either S1 or S2 returned a result smaller than TARGET_PAGE_SIZE,
2802      * this means "don't put this in the TLB"; in this case, return a
2803      * result with lg_page_size == 0 to achieve that. Otherwise,
2804      * use the maximum of the S1 & S2 page size, so that invalidation
2805      * of pages > TARGET_PAGE_SIZE works correctly. (This works even though
2806      * we know the combined result permissions etc only cover the minimum
2807      * of the S1 and S2 page size, because we know that the common TLB code
2808      * never actually creates TLB entries bigger than TARGET_PAGE_SIZE,
2809      * and passing a larger page size value only affects invalidations.)
2810      */
2811     if (result->f.lg_page_size < TARGET_PAGE_BITS ||
2812         s1_lgpgsz < TARGET_PAGE_BITS) {
2813         result->f.lg_page_size = 0;
2814     } else if (result->f.lg_page_size < s1_lgpgsz) {
2815         result->f.lg_page_size = s1_lgpgsz;
2816     }
2817 
2818     /* Combine the S1 and S2 cache attributes. */
2819     hcr = arm_hcr_el2_eff_secstate(env, is_secure);
2820     if (hcr & HCR_DC) {
2821         /*
2822          * HCR.DC forces the first stage attributes to
2823          *  Normal Non-Shareable,
2824          *  Inner Write-Back Read-Allocate Write-Allocate,
2825          *  Outer Write-Back Read-Allocate Write-Allocate.
2826          * Do not overwrite Tagged within attrs.
2827          */
2828         if (cacheattrs1.attrs != 0xf0) {
2829             cacheattrs1.attrs = 0xff;
2830         }
2831         cacheattrs1.shareability = 0;
2832     }
2833     result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1,
2834                                             result->cacheattrs);
2835 
2836     /*
2837      * Check if IPA translates to secure or non-secure PA space.
2838      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
2839      */
2840     result->f.attrs.secure =
2841         (is_secure
2842          && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
2843          && (ipa_secure
2844              || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
2845 
2846     return false;
2847 }
2848 
2849 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
2850                                       target_ulong address,
2851                                       MMUAccessType access_type,
2852                                       GetPhysAddrResult *result,
2853                                       ARMMMUFaultInfo *fi)
2854 {
2855     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
2856     bool is_secure = ptw->in_secure;
2857     ARMMMUIdx s1_mmu_idx;
2858 
2859     /*
2860      * The page table entries may downgrade secure to non-secure, but
2861      * cannot upgrade an non-secure translation regime's attributes
2862      * to secure.
2863      */
2864     result->f.attrs.secure = is_secure;
2865 
2866     switch (mmu_idx) {
2867     case ARMMMUIdx_Phys_S:
2868     case ARMMMUIdx_Phys_NS:
2869         /* Checking Phys early avoids special casing later vs regime_el. */
2870         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
2871                                       is_secure, result, fi);
2872 
2873     case ARMMMUIdx_Stage1_E0:
2874     case ARMMMUIdx_Stage1_E1:
2875     case ARMMMUIdx_Stage1_E1_PAN:
2876         /* First stage lookup uses second stage for ptw. */
2877         ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
2878         break;
2879 
2880     case ARMMMUIdx_Stage2:
2881     case ARMMMUIdx_Stage2_S:
2882         /*
2883          * Second stage lookup uses physical for ptw; whether this is S or
2884          * NS may depend on the SW/NSW bits if this is a stage 2 lookup for
2885          * the Secure EL2&0 regime.
2886          */
2887         ptw->in_ptw_idx = ptw_idx_for_stage_2(env, mmu_idx);
2888         break;
2889 
2890     case ARMMMUIdx_E10_0:
2891         s1_mmu_idx = ARMMMUIdx_Stage1_E0;
2892         goto do_twostage;
2893     case ARMMMUIdx_E10_1:
2894         s1_mmu_idx = ARMMMUIdx_Stage1_E1;
2895         goto do_twostage;
2896     case ARMMMUIdx_E10_1_PAN:
2897         s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
2898     do_twostage:
2899         /*
2900          * Call ourselves recursively to do the stage 1 and then stage 2
2901          * translations if mmu_idx is a two-stage regime, and EL2 present.
2902          * Otherwise, a stage1+stage2 translation is just stage 1.
2903          */
2904         ptw->in_mmu_idx = mmu_idx = s1_mmu_idx;
2905         if (arm_feature(env, ARM_FEATURE_EL2) &&
2906             !regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) {
2907             return get_phys_addr_twostage(env, ptw, address, access_type,
2908                                           result, fi);
2909         }
2910         /* fall through */
2911 
2912     default:
2913         /* Single stage uses physical for ptw. */
2914         ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
2915         break;
2916     }
2917 
2918     result->f.attrs.user = regime_is_user(env, mmu_idx);
2919 
2920     /*
2921      * Fast Context Switch Extension. This doesn't exist at all in v8.
2922      * In v7 and earlier it affects all stage 1 translations.
2923      */
2924     if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2
2925         && !arm_feature(env, ARM_FEATURE_V8)) {
2926         if (regime_el(env, mmu_idx) == 3) {
2927             address += env->cp15.fcseidr_s;
2928         } else {
2929             address += env->cp15.fcseidr_ns;
2930         }
2931     }
2932 
2933     if (arm_feature(env, ARM_FEATURE_PMSA)) {
2934         bool ret;
2935         result->f.lg_page_size = TARGET_PAGE_BITS;
2936 
2937         if (arm_feature(env, ARM_FEATURE_V8)) {
2938             /* PMSAv8 */
2939             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
2940                                        is_secure, result, fi);
2941         } else if (arm_feature(env, ARM_FEATURE_V7)) {
2942             /* PMSAv7 */
2943             ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
2944                                        is_secure, result, fi);
2945         } else {
2946             /* Pre-v7 MPU */
2947             ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
2948                                        is_secure, result, fi);
2949         }
2950         qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
2951                       " mmu_idx %u -> %s (prot %c%c%c)\n",
2952                       access_type == MMU_DATA_LOAD ? "reading" :
2953                       (access_type == MMU_DATA_STORE ? "writing" : "execute"),
2954                       (uint32_t)address, mmu_idx,
2955                       ret ? "Miss" : "Hit",
2956                       result->f.prot & PAGE_READ ? 'r' : '-',
2957                       result->f.prot & PAGE_WRITE ? 'w' : '-',
2958                       result->f.prot & PAGE_EXEC ? 'x' : '-');
2959 
2960         return ret;
2961     }
2962 
2963     /* Definitely a real MMU, not an MPU */
2964 
2965     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
2966         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
2967                                       is_secure, result, fi);
2968     }
2969 
2970     if (regime_using_lpae_format(env, mmu_idx)) {
2971         return get_phys_addr_lpae(env, ptw, address, access_type, false,
2972                                   result, fi);
2973     } else if (arm_feature(env, ARM_FEATURE_V7) ||
2974                regime_sctlr(env, mmu_idx) & SCTLR_XP) {
2975         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
2976     } else {
2977         return get_phys_addr_v5(env, ptw, address, access_type, result, fi);
2978     }
2979 }
2980 
2981 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
2982                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
2983                                bool is_secure, GetPhysAddrResult *result,
2984                                ARMMMUFaultInfo *fi)
2985 {
2986     S1Translate ptw = {
2987         .in_mmu_idx = mmu_idx,
2988         .in_secure = is_secure,
2989     };
2990     return get_phys_addr_with_struct(env, &ptw, address, access_type,
2991                                      result, fi);
2992 }
2993 
2994 bool get_phys_addr(CPUARMState *env, target_ulong address,
2995                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
2996                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
2997 {
2998     bool is_secure;
2999 
3000     switch (mmu_idx) {
3001     case ARMMMUIdx_E10_0:
3002     case ARMMMUIdx_E10_1:
3003     case ARMMMUIdx_E10_1_PAN:
3004     case ARMMMUIdx_E20_0:
3005     case ARMMMUIdx_E20_2:
3006     case ARMMMUIdx_E20_2_PAN:
3007     case ARMMMUIdx_Stage1_E0:
3008     case ARMMMUIdx_Stage1_E1:
3009     case ARMMMUIdx_Stage1_E1_PAN:
3010     case ARMMMUIdx_E2:
3011         is_secure = arm_is_secure_below_el3(env);
3012         break;
3013     case ARMMMUIdx_Stage2:
3014     case ARMMMUIdx_Phys_NS:
3015     case ARMMMUIdx_MPrivNegPri:
3016     case ARMMMUIdx_MUserNegPri:
3017     case ARMMMUIdx_MPriv:
3018     case ARMMMUIdx_MUser:
3019         is_secure = false;
3020         break;
3021     case ARMMMUIdx_E3:
3022     case ARMMMUIdx_Stage2_S:
3023     case ARMMMUIdx_Phys_S:
3024     case ARMMMUIdx_MSPrivNegPri:
3025     case ARMMMUIdx_MSUserNegPri:
3026     case ARMMMUIdx_MSPriv:
3027     case ARMMMUIdx_MSUser:
3028         is_secure = true;
3029         break;
3030     default:
3031         g_assert_not_reached();
3032     }
3033     return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
3034                                      is_secure, result, fi);
3035 }
3036 
3037 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
3038                                          MemTxAttrs *attrs)
3039 {
3040     ARMCPU *cpu = ARM_CPU(cs);
3041     CPUARMState *env = &cpu->env;
3042     S1Translate ptw = {
3043         .in_mmu_idx = arm_mmu_idx(env),
3044         .in_secure = arm_is_secure(env),
3045         .in_debug = true,
3046     };
3047     GetPhysAddrResult res = {};
3048     ARMMMUFaultInfo fi = {};
3049     bool ret;
3050 
3051     ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
3052     *attrs = res.f.attrs;
3053 
3054     if (ret) {
3055         return -1;
3056     }
3057     return res.f.phys_addr;
3058 }
3059