1 /* 2 * ARM page table walking. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "qemu/range.h" 12 #include "qemu/main-loop.h" 13 #include "exec/exec-all.h" 14 #include "cpu.h" 15 #include "internals.h" 16 #include "idau.h" 17 18 19 typedef struct S1Translate { 20 ARMMMUIdx in_mmu_idx; 21 ARMMMUIdx in_ptw_idx; 22 bool in_secure; 23 bool in_debug; 24 bool out_secure; 25 bool out_rw; 26 bool out_be; 27 hwaddr out_virt; 28 hwaddr out_phys; 29 void *out_host; 30 } S1Translate; 31 32 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, 33 uint64_t address, 34 MMUAccessType access_type, bool s1_is_el0, 35 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 36 __attribute__((nonnull)); 37 38 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, 39 target_ulong address, 40 MMUAccessType access_type, 41 GetPhysAddrResult *result, 42 ARMMMUFaultInfo *fi) 43 __attribute__((nonnull)); 44 45 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */ 46 static const uint8_t pamax_map[] = { 47 [0] = 32, 48 [1] = 36, 49 [2] = 40, 50 [3] = 42, 51 [4] = 44, 52 [5] = 48, 53 [6] = 52, 54 }; 55 56 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */ 57 unsigned int arm_pamax(ARMCPU *cpu) 58 { 59 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 60 unsigned int parange = 61 FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE); 62 63 /* 64 * id_aa64mmfr0 is a read-only register so values outside of the 65 * supported mappings can be considered an implementation error. 66 */ 67 assert(parange < ARRAY_SIZE(pamax_map)); 68 return pamax_map[parange]; 69 } 70 71 /* 72 * In machvirt_init, we call arm_pamax on a cpu that is not fully 73 * initialized, so we can't rely on the propagation done in realize. 74 */ 75 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) || 76 arm_feature(&cpu->env, ARM_FEATURE_V7VE)) { 77 /* v7 with LPAE */ 78 return 40; 79 } 80 /* Anything else */ 81 return 32; 82 } 83 84 /* 85 * Convert a possible stage1+2 MMU index into the appropriate stage 1 MMU index 86 */ 87 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 88 { 89 switch (mmu_idx) { 90 case ARMMMUIdx_E10_0: 91 return ARMMMUIdx_Stage1_E0; 92 case ARMMMUIdx_E10_1: 93 return ARMMMUIdx_Stage1_E1; 94 case ARMMMUIdx_E10_1_PAN: 95 return ARMMMUIdx_Stage1_E1_PAN; 96 default: 97 return mmu_idx; 98 } 99 } 100 101 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 102 { 103 return stage_1_mmu_idx(arm_mmu_idx(env)); 104 } 105 106 /* 107 * Return where we should do ptw loads from for a stage 2 walk. 108 * This depends on whether the address we are looking up is a 109 * Secure IPA or a NonSecure IPA, which we know from whether this is 110 * Stage2 or Stage2_S. 111 * If this is the Secure EL1&0 regime we need to check the NSW and SW bits. 112 */ 113 static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx) 114 { 115 bool s2walk_secure; 116 117 /* 118 * We're OK to check the current state of the CPU here because 119 * (1) we always invalidate all TLBs when the SCR_EL3.NS bit changes 120 * (2) there's no way to do a lookup that cares about Stage 2 for a 121 * different security state to the current one for AArch64, and AArch32 122 * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do 123 * an NS stage 1+2 lookup while the NS bit is 0.) 124 */ 125 if (!arm_is_secure_below_el3(env) || !arm_el_is_aa64(env, 3)) { 126 return ARMMMUIdx_Phys_NS; 127 } 128 if (stage2idx == ARMMMUIdx_Stage2_S) { 129 s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW); 130 } else { 131 s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW); 132 } 133 return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; 134 135 } 136 137 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx) 138 { 139 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 140 } 141 142 /* Return the TTBR associated with this translation regime */ 143 static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn) 144 { 145 if (mmu_idx == ARMMMUIdx_Stage2) { 146 return env->cp15.vttbr_el2; 147 } 148 if (mmu_idx == ARMMMUIdx_Stage2_S) { 149 return env->cp15.vsttbr_el2; 150 } 151 if (ttbrn == 0) { 152 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 153 } else { 154 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 155 } 156 } 157 158 /* Return true if the specified stage of address translation is disabled */ 159 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx, 160 bool is_secure) 161 { 162 uint64_t hcr_el2; 163 164 if (arm_feature(env, ARM_FEATURE_M)) { 165 switch (env->v7m.mpu_ctrl[is_secure] & 166 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 167 case R_V7M_MPU_CTRL_ENABLE_MASK: 168 /* Enabled, but not for HardFault and NMI */ 169 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 170 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 171 /* Enabled for all cases */ 172 return false; 173 case 0: 174 default: 175 /* 176 * HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 177 * we warned about that in armv7m_nvic.c when the guest set it. 178 */ 179 return true; 180 } 181 } 182 183 hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure); 184 185 switch (mmu_idx) { 186 case ARMMMUIdx_Stage2: 187 case ARMMMUIdx_Stage2_S: 188 /* HCR.DC means HCR.VM behaves as 1 */ 189 return (hcr_el2 & (HCR_DC | HCR_VM)) == 0; 190 191 case ARMMMUIdx_E10_0: 192 case ARMMMUIdx_E10_1: 193 case ARMMMUIdx_E10_1_PAN: 194 /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */ 195 if (hcr_el2 & HCR_TGE) { 196 return true; 197 } 198 break; 199 200 case ARMMMUIdx_Stage1_E0: 201 case ARMMMUIdx_Stage1_E1: 202 case ARMMMUIdx_Stage1_E1_PAN: 203 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 204 if (hcr_el2 & HCR_DC) { 205 return true; 206 } 207 break; 208 209 case ARMMMUIdx_E20_0: 210 case ARMMMUIdx_E20_2: 211 case ARMMMUIdx_E20_2_PAN: 212 case ARMMMUIdx_E2: 213 case ARMMMUIdx_E3: 214 break; 215 216 case ARMMMUIdx_Phys_NS: 217 case ARMMMUIdx_Phys_S: 218 /* No translation for physical address spaces. */ 219 return true; 220 221 default: 222 g_assert_not_reached(); 223 } 224 225 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 226 } 227 228 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs) 229 { 230 /* 231 * For an S1 page table walk, the stage 1 attributes are always 232 * some form of "this is Normal memory". The combined S1+S2 233 * attributes are therefore only Device if stage 2 specifies Device. 234 * With HCR_EL2.FWB == 0 this is when descriptor bits [5:4] are 0b00, 235 * ie when cacheattrs.attrs bits [3:2] are 0b00. 236 * With HCR_EL2.FWB == 1 this is when descriptor bit [4] is 0, ie 237 * when cacheattrs.attrs bit [2] is 0. 238 */ 239 if (hcr & HCR_FWB) { 240 return (attrs & 0x4) == 0; 241 } else { 242 return (attrs & 0xc) == 0; 243 } 244 } 245 246 /* Translate a S1 pagetable walk through S2 if needed. */ 247 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, 248 hwaddr addr, ARMMMUFaultInfo *fi) 249 { 250 bool is_secure = ptw->in_secure; 251 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 252 ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx; 253 uint8_t pte_attrs; 254 255 ptw->out_virt = addr; 256 257 if (unlikely(ptw->in_debug)) { 258 /* 259 * From gdbstub, do not use softmmu so that we don't modify the 260 * state of the cpu at all, including softmmu tlb contents. 261 */ 262 if (regime_is_stage2(s2_mmu_idx)) { 263 S1Translate s2ptw = { 264 .in_mmu_idx = s2_mmu_idx, 265 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx), 266 .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S, 267 .in_debug = true, 268 }; 269 GetPhysAddrResult s2 = { }; 270 271 if (get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD, 272 false, &s2, fi)) { 273 goto fail; 274 } 275 ptw->out_phys = s2.f.phys_addr; 276 pte_attrs = s2.cacheattrs.attrs; 277 ptw->out_secure = s2.f.attrs.secure; 278 } else { 279 /* Regime is physical. */ 280 ptw->out_phys = addr; 281 pte_attrs = 0; 282 ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S; 283 } 284 ptw->out_host = NULL; 285 ptw->out_rw = false; 286 } else { 287 #ifdef CONFIG_TCG 288 CPUTLBEntryFull *full; 289 int flags; 290 291 env->tlb_fi = fi; 292 flags = probe_access_full(env, addr, 0, MMU_DATA_LOAD, 293 arm_to_core_mmu_idx(s2_mmu_idx), 294 true, &ptw->out_host, &full, 0); 295 env->tlb_fi = NULL; 296 297 if (unlikely(flags & TLB_INVALID_MASK)) { 298 goto fail; 299 } 300 ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK); 301 ptw->out_rw = full->prot & PAGE_WRITE; 302 pte_attrs = full->pte_attrs; 303 ptw->out_secure = full->attrs.secure; 304 #else 305 g_assert_not_reached(); 306 #endif 307 } 308 309 if (regime_is_stage2(s2_mmu_idx)) { 310 uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure); 311 312 if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) { 313 /* 314 * PTW set and S1 walk touched S2 Device memory: 315 * generate Permission fault. 316 */ 317 fi->type = ARMFault_Permission; 318 fi->s2addr = addr; 319 fi->stage2 = true; 320 fi->s1ptw = true; 321 fi->s1ns = !is_secure; 322 return false; 323 } 324 } 325 326 ptw->out_be = regime_translation_big_endian(env, mmu_idx); 327 return true; 328 329 fail: 330 assert(fi->type != ARMFault_None); 331 fi->s2addr = addr; 332 fi->stage2 = true; 333 fi->s1ptw = true; 334 fi->s1ns = !is_secure; 335 return false; 336 } 337 338 /* All loads done in the course of a page table walk go through here. */ 339 static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, 340 ARMMMUFaultInfo *fi) 341 { 342 CPUState *cs = env_cpu(env); 343 void *host = ptw->out_host; 344 uint32_t data; 345 346 if (likely(host)) { 347 /* Page tables are in RAM, and we have the host address. */ 348 data = qatomic_read((uint32_t *)host); 349 if (ptw->out_be) { 350 data = be32_to_cpu(data); 351 } else { 352 data = le32_to_cpu(data); 353 } 354 } else { 355 /* Page tables are in MMIO. */ 356 MemTxAttrs attrs = { .secure = ptw->out_secure }; 357 AddressSpace *as = arm_addressspace(cs, attrs); 358 MemTxResult result = MEMTX_OK; 359 360 if (ptw->out_be) { 361 data = address_space_ldl_be(as, ptw->out_phys, attrs, &result); 362 } else { 363 data = address_space_ldl_le(as, ptw->out_phys, attrs, &result); 364 } 365 if (unlikely(result != MEMTX_OK)) { 366 fi->type = ARMFault_SyncExternalOnWalk; 367 fi->ea = arm_extabort_type(result); 368 return 0; 369 } 370 } 371 return data; 372 } 373 374 static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw, 375 ARMMMUFaultInfo *fi) 376 { 377 CPUState *cs = env_cpu(env); 378 void *host = ptw->out_host; 379 uint64_t data; 380 381 if (likely(host)) { 382 /* Page tables are in RAM, and we have the host address. */ 383 #ifdef CONFIG_ATOMIC64 384 data = qatomic_read__nocheck((uint64_t *)host); 385 if (ptw->out_be) { 386 data = be64_to_cpu(data); 387 } else { 388 data = le64_to_cpu(data); 389 } 390 #else 391 if (ptw->out_be) { 392 data = ldq_be_p(host); 393 } else { 394 data = ldq_le_p(host); 395 } 396 #endif 397 } else { 398 /* Page tables are in MMIO. */ 399 MemTxAttrs attrs = { .secure = ptw->out_secure }; 400 AddressSpace *as = arm_addressspace(cs, attrs); 401 MemTxResult result = MEMTX_OK; 402 403 if (ptw->out_be) { 404 data = address_space_ldq_be(as, ptw->out_phys, attrs, &result); 405 } else { 406 data = address_space_ldq_le(as, ptw->out_phys, attrs, &result); 407 } 408 if (unlikely(result != MEMTX_OK)) { 409 fi->type = ARMFault_SyncExternalOnWalk; 410 fi->ea = arm_extabort_type(result); 411 return 0; 412 } 413 } 414 return data; 415 } 416 417 static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val, 418 uint64_t new_val, S1Translate *ptw, 419 ARMMMUFaultInfo *fi) 420 { 421 uint64_t cur_val; 422 void *host = ptw->out_host; 423 424 if (unlikely(!host)) { 425 fi->type = ARMFault_UnsuppAtomicUpdate; 426 fi->s1ptw = true; 427 return 0; 428 } 429 430 /* 431 * Raising a stage2 Protection fault for an atomic update to a read-only 432 * page is delayed until it is certain that there is a change to make. 433 */ 434 if (unlikely(!ptw->out_rw)) { 435 int flags; 436 void *discard; 437 438 env->tlb_fi = fi; 439 flags = probe_access_flags(env, ptw->out_virt, 0, MMU_DATA_STORE, 440 arm_to_core_mmu_idx(ptw->in_ptw_idx), 441 true, &discard, 0); 442 env->tlb_fi = NULL; 443 444 if (unlikely(flags & TLB_INVALID_MASK)) { 445 assert(fi->type != ARMFault_None); 446 fi->s2addr = ptw->out_virt; 447 fi->stage2 = true; 448 fi->s1ptw = true; 449 fi->s1ns = !ptw->in_secure; 450 return 0; 451 } 452 453 /* In case CAS mismatches and we loop, remember writability. */ 454 ptw->out_rw = true; 455 } 456 457 #ifdef CONFIG_ATOMIC64 458 if (ptw->out_be) { 459 old_val = cpu_to_be64(old_val); 460 new_val = cpu_to_be64(new_val); 461 cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val); 462 cur_val = be64_to_cpu(cur_val); 463 } else { 464 old_val = cpu_to_le64(old_val); 465 new_val = cpu_to_le64(new_val); 466 cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val); 467 cur_val = le64_to_cpu(cur_val); 468 } 469 #else 470 /* 471 * We can't support the full 64-bit atomic cmpxchg on the host. 472 * Because this is only used for FEAT_HAFDBS, which is only for AA64, 473 * we know that TCG_OVERSIZED_GUEST is set, which means that we are 474 * running in round-robin mode and could only race with dma i/o. 475 */ 476 #ifndef TCG_OVERSIZED_GUEST 477 # error "Unexpected configuration" 478 #endif 479 bool locked = qemu_mutex_iothread_locked(); 480 if (!locked) { 481 qemu_mutex_lock_iothread(); 482 } 483 if (ptw->out_be) { 484 cur_val = ldq_be_p(host); 485 if (cur_val == old_val) { 486 stq_be_p(host, new_val); 487 } 488 } else { 489 cur_val = ldq_le_p(host); 490 if (cur_val == old_val) { 491 stq_le_p(host, new_val); 492 } 493 } 494 if (!locked) { 495 qemu_mutex_unlock_iothread(); 496 } 497 #endif 498 499 return cur_val; 500 } 501 502 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 503 uint32_t *table, uint32_t address) 504 { 505 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 506 uint64_t tcr = regime_tcr(env, mmu_idx); 507 int maskshift = extract32(tcr, 0, 3); 508 uint32_t mask = ~(((uint32_t)0xffffffffu) >> maskshift); 509 uint32_t base_mask; 510 511 if (address & mask) { 512 if (tcr & TTBCR_PD1) { 513 /* Translation table walk disabled for TTBR1 */ 514 return false; 515 } 516 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 517 } else { 518 if (tcr & TTBCR_PD0) { 519 /* Translation table walk disabled for TTBR0 */ 520 return false; 521 } 522 base_mask = ~((uint32_t)0x3fffu >> maskshift); 523 *table = regime_ttbr(env, mmu_idx, 0) & base_mask; 524 } 525 *table |= (address >> 18) & 0x3ffc; 526 return true; 527 } 528 529 /* 530 * Translate section/page access permissions to page R/W protection flags 531 * @env: CPUARMState 532 * @mmu_idx: MMU index indicating required translation regime 533 * @ap: The 3-bit access permissions (AP[2:0]) 534 * @domain_prot: The 2-bit domain access permissions 535 * @is_user: TRUE if accessing from PL0 536 */ 537 static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx, 538 int ap, int domain_prot, bool is_user) 539 { 540 if (domain_prot == 3) { 541 return PAGE_READ | PAGE_WRITE; 542 } 543 544 switch (ap) { 545 case 0: 546 if (arm_feature(env, ARM_FEATURE_V7)) { 547 return 0; 548 } 549 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 550 case SCTLR_S: 551 return is_user ? 0 : PAGE_READ; 552 case SCTLR_R: 553 return PAGE_READ; 554 default: 555 return 0; 556 } 557 case 1: 558 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 559 case 2: 560 if (is_user) { 561 return PAGE_READ; 562 } else { 563 return PAGE_READ | PAGE_WRITE; 564 } 565 case 3: 566 return PAGE_READ | PAGE_WRITE; 567 case 4: /* Reserved. */ 568 return 0; 569 case 5: 570 return is_user ? 0 : PAGE_READ; 571 case 6: 572 return PAGE_READ; 573 case 7: 574 if (!arm_feature(env, ARM_FEATURE_V6K)) { 575 return 0; 576 } 577 return PAGE_READ; 578 default: 579 g_assert_not_reached(); 580 } 581 } 582 583 /* 584 * Translate section/page access permissions to page R/W protection flags 585 * @env: CPUARMState 586 * @mmu_idx: MMU index indicating required translation regime 587 * @ap: The 3-bit access permissions (AP[2:0]) 588 * @domain_prot: The 2-bit domain access permissions 589 */ 590 static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 591 int ap, int domain_prot) 592 { 593 return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 594 regime_is_user(env, mmu_idx)); 595 } 596 597 /* 598 * Translate section/page access permissions to page R/W protection flags. 599 * @ap: The 2-bit simple AP (AP[2:1]) 600 * @is_user: TRUE if accessing from PL0 601 */ 602 static int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 603 { 604 switch (ap) { 605 case 0: 606 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 607 case 1: 608 return PAGE_READ | PAGE_WRITE; 609 case 2: 610 return is_user ? 0 : PAGE_READ; 611 case 3: 612 return PAGE_READ; 613 default: 614 g_assert_not_reached(); 615 } 616 } 617 618 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 619 { 620 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 621 } 622 623 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw, 624 uint32_t address, MMUAccessType access_type, 625 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 626 { 627 int level = 1; 628 uint32_t table; 629 uint32_t desc; 630 int type; 631 int ap; 632 int domain = 0; 633 int domain_prot; 634 hwaddr phys_addr; 635 uint32_t dacr; 636 637 /* Pagetable walk. */ 638 /* Lookup l1 descriptor. */ 639 if (!get_level1_table_address(env, ptw->in_mmu_idx, &table, address)) { 640 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 641 fi->type = ARMFault_Translation; 642 goto do_fault; 643 } 644 if (!S1_ptw_translate(env, ptw, table, fi)) { 645 goto do_fault; 646 } 647 desc = arm_ldl_ptw(env, ptw, fi); 648 if (fi->type != ARMFault_None) { 649 goto do_fault; 650 } 651 type = (desc & 3); 652 domain = (desc >> 5) & 0x0f; 653 if (regime_el(env, ptw->in_mmu_idx) == 1) { 654 dacr = env->cp15.dacr_ns; 655 } else { 656 dacr = env->cp15.dacr_s; 657 } 658 domain_prot = (dacr >> (domain * 2)) & 3; 659 if (type == 0) { 660 /* Section translation fault. */ 661 fi->type = ARMFault_Translation; 662 goto do_fault; 663 } 664 if (type != 2) { 665 level = 2; 666 } 667 if (domain_prot == 0 || domain_prot == 2) { 668 fi->type = ARMFault_Domain; 669 goto do_fault; 670 } 671 if (type == 2) { 672 /* 1Mb section. */ 673 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 674 ap = (desc >> 10) & 3; 675 result->f.lg_page_size = 20; /* 1MB */ 676 } else { 677 /* Lookup l2 entry. */ 678 if (type == 1) { 679 /* Coarse pagetable. */ 680 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 681 } else { 682 /* Fine pagetable. */ 683 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 684 } 685 if (!S1_ptw_translate(env, ptw, table, fi)) { 686 goto do_fault; 687 } 688 desc = arm_ldl_ptw(env, ptw, fi); 689 if (fi->type != ARMFault_None) { 690 goto do_fault; 691 } 692 switch (desc & 3) { 693 case 0: /* Page translation fault. */ 694 fi->type = ARMFault_Translation; 695 goto do_fault; 696 case 1: /* 64k page. */ 697 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 698 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 699 result->f.lg_page_size = 16; 700 break; 701 case 2: /* 4k page. */ 702 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 703 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 704 result->f.lg_page_size = 12; 705 break; 706 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 707 if (type == 1) { 708 /* ARMv6/XScale extended small page format */ 709 if (arm_feature(env, ARM_FEATURE_XSCALE) 710 || arm_feature(env, ARM_FEATURE_V6)) { 711 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 712 result->f.lg_page_size = 12; 713 } else { 714 /* 715 * UNPREDICTABLE in ARMv5; we choose to take a 716 * page translation fault. 717 */ 718 fi->type = ARMFault_Translation; 719 goto do_fault; 720 } 721 } else { 722 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 723 result->f.lg_page_size = 10; 724 } 725 ap = (desc >> 4) & 3; 726 break; 727 default: 728 /* Never happens, but compiler isn't smart enough to tell. */ 729 g_assert_not_reached(); 730 } 731 } 732 result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot); 733 result->f.prot |= result->f.prot ? PAGE_EXEC : 0; 734 if (!(result->f.prot & (1 << access_type))) { 735 /* Access permission fault. */ 736 fi->type = ARMFault_Permission; 737 goto do_fault; 738 } 739 result->f.phys_addr = phys_addr; 740 return false; 741 do_fault: 742 fi->domain = domain; 743 fi->level = level; 744 return true; 745 } 746 747 static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw, 748 uint32_t address, MMUAccessType access_type, 749 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 750 { 751 ARMCPU *cpu = env_archcpu(env); 752 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 753 int level = 1; 754 uint32_t table; 755 uint32_t desc; 756 uint32_t xn; 757 uint32_t pxn = 0; 758 int type; 759 int ap; 760 int domain = 0; 761 int domain_prot; 762 hwaddr phys_addr; 763 uint32_t dacr; 764 bool ns; 765 int user_prot; 766 767 /* Pagetable walk. */ 768 /* Lookup l1 descriptor. */ 769 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 770 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 771 fi->type = ARMFault_Translation; 772 goto do_fault; 773 } 774 if (!S1_ptw_translate(env, ptw, table, fi)) { 775 goto do_fault; 776 } 777 desc = arm_ldl_ptw(env, ptw, fi); 778 if (fi->type != ARMFault_None) { 779 goto do_fault; 780 } 781 type = (desc & 3); 782 if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) { 783 /* Section translation fault, or attempt to use the encoding 784 * which is Reserved on implementations without PXN. 785 */ 786 fi->type = ARMFault_Translation; 787 goto do_fault; 788 } 789 if ((type == 1) || !(desc & (1 << 18))) { 790 /* Page or Section. */ 791 domain = (desc >> 5) & 0x0f; 792 } 793 if (regime_el(env, mmu_idx) == 1) { 794 dacr = env->cp15.dacr_ns; 795 } else { 796 dacr = env->cp15.dacr_s; 797 } 798 if (type == 1) { 799 level = 2; 800 } 801 domain_prot = (dacr >> (domain * 2)) & 3; 802 if (domain_prot == 0 || domain_prot == 2) { 803 /* Section or Page domain fault */ 804 fi->type = ARMFault_Domain; 805 goto do_fault; 806 } 807 if (type != 1) { 808 if (desc & (1 << 18)) { 809 /* Supersection. */ 810 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 811 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 812 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 813 result->f.lg_page_size = 24; /* 16MB */ 814 } else { 815 /* Section. */ 816 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 817 result->f.lg_page_size = 20; /* 1MB */ 818 } 819 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 820 xn = desc & (1 << 4); 821 pxn = desc & 1; 822 ns = extract32(desc, 19, 1); 823 } else { 824 if (cpu_isar_feature(aa32_pxn, cpu)) { 825 pxn = (desc >> 2) & 1; 826 } 827 ns = extract32(desc, 3, 1); 828 /* Lookup l2 entry. */ 829 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 830 if (!S1_ptw_translate(env, ptw, table, fi)) { 831 goto do_fault; 832 } 833 desc = arm_ldl_ptw(env, ptw, fi); 834 if (fi->type != ARMFault_None) { 835 goto do_fault; 836 } 837 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 838 switch (desc & 3) { 839 case 0: /* Page translation fault. */ 840 fi->type = ARMFault_Translation; 841 goto do_fault; 842 case 1: /* 64k page. */ 843 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 844 xn = desc & (1 << 15); 845 result->f.lg_page_size = 16; 846 break; 847 case 2: case 3: /* 4k page. */ 848 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 849 xn = desc & 1; 850 result->f.lg_page_size = 12; 851 break; 852 default: 853 /* Never happens, but compiler isn't smart enough to tell. */ 854 g_assert_not_reached(); 855 } 856 } 857 if (domain_prot == 3) { 858 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 859 } else { 860 if (pxn && !regime_is_user(env, mmu_idx)) { 861 xn = 1; 862 } 863 if (xn && access_type == MMU_INST_FETCH) { 864 fi->type = ARMFault_Permission; 865 goto do_fault; 866 } 867 868 if (arm_feature(env, ARM_FEATURE_V6K) && 869 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 870 /* The simplified model uses AP[0] as an access control bit. */ 871 if ((ap & 1) == 0) { 872 /* Access flag fault. */ 873 fi->type = ARMFault_AccessFlag; 874 goto do_fault; 875 } 876 result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 877 user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1); 878 } else { 879 result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 880 user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1); 881 } 882 if (result->f.prot && !xn) { 883 result->f.prot |= PAGE_EXEC; 884 } 885 if (!(result->f.prot & (1 << access_type))) { 886 /* Access permission fault. */ 887 fi->type = ARMFault_Permission; 888 goto do_fault; 889 } 890 if (regime_is_pan(env, mmu_idx) && 891 !regime_is_user(env, mmu_idx) && 892 user_prot && 893 access_type != MMU_INST_FETCH) { 894 /* Privileged Access Never fault */ 895 fi->type = ARMFault_Permission; 896 goto do_fault; 897 } 898 } 899 if (ns) { 900 /* The NS bit will (as required by the architecture) have no effect if 901 * the CPU doesn't support TZ or this is a non-secure translation 902 * regime, because the attribute will already be non-secure. 903 */ 904 result->f.attrs.secure = false; 905 } 906 result->f.phys_addr = phys_addr; 907 return false; 908 do_fault: 909 fi->domain = domain; 910 fi->level = level; 911 return true; 912 } 913 914 /* 915 * Translate S2 section/page access permissions to protection flags 916 * @env: CPUARMState 917 * @s2ap: The 2-bit stage2 access permissions (S2AP) 918 * @xn: XN (execute-never) bits 919 * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0 920 */ 921 static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0) 922 { 923 int prot = 0; 924 925 if (s2ap & 1) { 926 prot |= PAGE_READ; 927 } 928 if (s2ap & 2) { 929 prot |= PAGE_WRITE; 930 } 931 932 if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) { 933 switch (xn) { 934 case 0: 935 prot |= PAGE_EXEC; 936 break; 937 case 1: 938 if (s1_is_el0) { 939 prot |= PAGE_EXEC; 940 } 941 break; 942 case 2: 943 break; 944 case 3: 945 if (!s1_is_el0) { 946 prot |= PAGE_EXEC; 947 } 948 break; 949 default: 950 g_assert_not_reached(); 951 } 952 } else { 953 if (!extract32(xn, 1, 1)) { 954 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 955 prot |= PAGE_EXEC; 956 } 957 } 958 } 959 return prot; 960 } 961 962 /* 963 * Translate section/page access permissions to protection flags 964 * @env: CPUARMState 965 * @mmu_idx: MMU index indicating required translation regime 966 * @is_aa64: TRUE if AArch64 967 * @ap: The 2-bit simple AP (AP[2:1]) 968 * @ns: NS (non-secure) bit 969 * @xn: XN (execute-never) bit 970 * @pxn: PXN (privileged execute-never) bit 971 */ 972 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 973 int ap, int ns, int xn, int pxn) 974 { 975 ARMCPU *cpu = env_archcpu(env); 976 bool is_user = regime_is_user(env, mmu_idx); 977 int prot_rw, user_rw; 978 bool have_wxn; 979 int wxn = 0; 980 981 assert(!regime_is_stage2(mmu_idx)); 982 983 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 984 if (is_user) { 985 prot_rw = user_rw; 986 } else { 987 /* 988 * PAN controls can forbid data accesses but don't affect insn fetch. 989 * Plain PAN forbids data accesses if EL0 has data permissions; 990 * PAN3 forbids data accesses if EL0 has either data or exec perms. 991 * Note that for AArch64 the 'user can exec' case is exactly !xn. 992 * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0 993 * do not affect EPAN. 994 */ 995 if (user_rw && regime_is_pan(env, mmu_idx)) { 996 prot_rw = 0; 997 } else if (cpu_isar_feature(aa64_pan3, cpu) && is_aa64 && 998 regime_is_pan(env, mmu_idx) && 999 (regime_sctlr(env, mmu_idx) & SCTLR_EPAN) && !xn) { 1000 prot_rw = 0; 1001 } else { 1002 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 1003 } 1004 } 1005 1006 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 1007 return prot_rw; 1008 } 1009 1010 /* TODO have_wxn should be replaced with 1011 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 1012 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 1013 * compatible processors have EL2, which is required for [U]WXN. 1014 */ 1015 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 1016 1017 if (have_wxn) { 1018 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 1019 } 1020 1021 if (is_aa64) { 1022 if (regime_has_2_ranges(mmu_idx) && !is_user) { 1023 xn = pxn || (user_rw & PAGE_WRITE); 1024 } 1025 } else if (arm_feature(env, ARM_FEATURE_V7)) { 1026 switch (regime_el(env, mmu_idx)) { 1027 case 1: 1028 case 3: 1029 if (is_user) { 1030 xn = xn || !(user_rw & PAGE_READ); 1031 } else { 1032 int uwxn = 0; 1033 if (have_wxn) { 1034 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 1035 } 1036 xn = xn || !(prot_rw & PAGE_READ) || pxn || 1037 (uwxn && (user_rw & PAGE_WRITE)); 1038 } 1039 break; 1040 case 2: 1041 break; 1042 } 1043 } else { 1044 xn = wxn = 0; 1045 } 1046 1047 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 1048 return prot_rw; 1049 } 1050 return prot_rw | PAGE_EXEC; 1051 } 1052 1053 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 1054 ARMMMUIdx mmu_idx) 1055 { 1056 uint64_t tcr = regime_tcr(env, mmu_idx); 1057 uint32_t el = regime_el(env, mmu_idx); 1058 int select, tsz; 1059 bool epd, hpd; 1060 1061 assert(mmu_idx != ARMMMUIdx_Stage2_S); 1062 1063 if (mmu_idx == ARMMMUIdx_Stage2) { 1064 /* VTCR */ 1065 bool sext = extract32(tcr, 4, 1); 1066 bool sign = extract32(tcr, 3, 1); 1067 1068 /* 1069 * If the sign-extend bit is not the same as t0sz[3], the result 1070 * is unpredictable. Flag this as a guest error. 1071 */ 1072 if (sign != sext) { 1073 qemu_log_mask(LOG_GUEST_ERROR, 1074 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 1075 } 1076 tsz = sextract32(tcr, 0, 4) + 8; 1077 select = 0; 1078 hpd = false; 1079 epd = false; 1080 } else if (el == 2) { 1081 /* HTCR */ 1082 tsz = extract32(tcr, 0, 3); 1083 select = 0; 1084 hpd = extract64(tcr, 24, 1); 1085 epd = false; 1086 } else { 1087 int t0sz = extract32(tcr, 0, 3); 1088 int t1sz = extract32(tcr, 16, 3); 1089 1090 if (t1sz == 0) { 1091 select = va > (0xffffffffu >> t0sz); 1092 } else { 1093 /* Note that we will detect errors later. */ 1094 select = va >= ~(0xffffffffu >> t1sz); 1095 } 1096 if (!select) { 1097 tsz = t0sz; 1098 epd = extract32(tcr, 7, 1); 1099 hpd = extract64(tcr, 41, 1); 1100 } else { 1101 tsz = t1sz; 1102 epd = extract32(tcr, 23, 1); 1103 hpd = extract64(tcr, 42, 1); 1104 } 1105 /* For aarch32, hpd0 is not enabled without t2e as well. */ 1106 hpd &= extract32(tcr, 6, 1); 1107 } 1108 1109 return (ARMVAParameters) { 1110 .tsz = tsz, 1111 .select = select, 1112 .epd = epd, 1113 .hpd = hpd, 1114 }; 1115 } 1116 1117 /* 1118 * check_s2_mmu_setup 1119 * @cpu: ARMCPU 1120 * @is_aa64: True if the translation regime is in AArch64 state 1121 * @tcr: VTCR_EL2 or VSTCR_EL2 1122 * @ds: Effective value of TCR.DS. 1123 * @iasize: Bitsize of IPAs 1124 * @stride: Page-table stride (See the ARM ARM) 1125 * 1126 * Decode the starting level of the S2 lookup, returning INT_MIN if 1127 * the configuration is invalid. 1128 */ 1129 static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr, 1130 bool ds, int iasize, int stride) 1131 { 1132 int sl0, sl2, startlevel, granulebits, levels; 1133 int s1_min_iasize, s1_max_iasize; 1134 1135 sl0 = extract32(tcr, 6, 2); 1136 if (is_aa64) { 1137 /* 1138 * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of 1139 * get_phys_addr_lpae, that used aa64_va_parameters which apply 1140 * to aarch64. If Stage1 is aarch32, the min_txsz is larger. 1141 * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to 1142 * inputsize is 64 - 24 = 40. 1143 */ 1144 if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) { 1145 goto fail; 1146 } 1147 1148 /* 1149 * AArch64.S2InvalidSL: Interpretation of SL depends on the page size, 1150 * so interleave AArch64.S2StartLevel. 1151 */ 1152 switch (stride) { 1153 case 9: /* 4KB */ 1154 /* SL2 is RES0 unless DS=1 & 4KB granule. */ 1155 sl2 = extract64(tcr, 33, 1); 1156 if (ds && sl2) { 1157 if (sl0 != 0) { 1158 goto fail; 1159 } 1160 startlevel = -1; 1161 } else { 1162 startlevel = 2 - sl0; 1163 switch (sl0) { 1164 case 2: 1165 if (arm_pamax(cpu) < 44) { 1166 goto fail; 1167 } 1168 break; 1169 case 3: 1170 if (!cpu_isar_feature(aa64_st, cpu)) { 1171 goto fail; 1172 } 1173 startlevel = 3; 1174 break; 1175 } 1176 } 1177 break; 1178 case 11: /* 16KB */ 1179 switch (sl0) { 1180 case 2: 1181 if (arm_pamax(cpu) < 42) { 1182 goto fail; 1183 } 1184 break; 1185 case 3: 1186 if (!ds) { 1187 goto fail; 1188 } 1189 break; 1190 } 1191 startlevel = 3 - sl0; 1192 break; 1193 case 13: /* 64KB */ 1194 switch (sl0) { 1195 case 2: 1196 if (arm_pamax(cpu) < 44) { 1197 goto fail; 1198 } 1199 break; 1200 case 3: 1201 goto fail; 1202 } 1203 startlevel = 3 - sl0; 1204 break; 1205 default: 1206 g_assert_not_reached(); 1207 } 1208 } else { 1209 /* 1210 * Things are simpler for AArch32 EL2, with only 4k pages. 1211 * There is no separate S2InvalidSL function, but AArch32.S2Walk 1212 * begins with walkparms.sl0 in {'1x'}. 1213 */ 1214 assert(stride == 9); 1215 if (sl0 >= 2) { 1216 goto fail; 1217 } 1218 startlevel = 2 - sl0; 1219 } 1220 1221 /* AArch{64,32}.S2InconsistentSL are functionally equivalent. */ 1222 levels = 3 - startlevel; 1223 granulebits = stride + 3; 1224 1225 s1_min_iasize = levels * stride + granulebits + 1; 1226 s1_max_iasize = s1_min_iasize + (stride - 1) + 4; 1227 1228 if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) { 1229 return startlevel; 1230 } 1231 1232 fail: 1233 return INT_MIN; 1234 } 1235 1236 /** 1237 * get_phys_addr_lpae: perform one stage of page table walk, LPAE format 1238 * 1239 * Returns false if the translation was successful. Otherwise, phys_ptr, 1240 * attrs, prot and page_size may not be filled in, and the populated fsr 1241 * value provides information on why the translation aborted, in the format 1242 * of a long-format DFSR/IFSR fault register, with the following caveat: 1243 * the WnR bit is never set (the caller must do this). 1244 * 1245 * @env: CPUARMState 1246 * @ptw: Current and next stage parameters for the walk. 1247 * @address: virtual address to get physical address for 1248 * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH 1249 * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2 1250 * (so this is a stage 2 page table walk), 1251 * must be true if this is stage 2 of a stage 1+2 1252 * walk for an EL0 access. If @mmu_idx is anything else, 1253 * @s1_is_el0 is ignored. 1254 * @result: set on translation success, 1255 * @fi: set to fault info if the translation fails 1256 */ 1257 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, 1258 uint64_t address, 1259 MMUAccessType access_type, bool s1_is_el0, 1260 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 1261 { 1262 ARMCPU *cpu = env_archcpu(env); 1263 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 1264 bool is_secure = ptw->in_secure; 1265 int32_t level; 1266 ARMVAParameters param; 1267 uint64_t ttbr; 1268 hwaddr descaddr, indexmask, indexmask_grainsize; 1269 uint32_t tableattrs; 1270 target_ulong page_size; 1271 uint64_t attrs; 1272 int32_t stride; 1273 int addrsize, inputsize, outputsize; 1274 uint64_t tcr = regime_tcr(env, mmu_idx); 1275 int ap, ns, xn, pxn; 1276 uint32_t el = regime_el(env, mmu_idx); 1277 uint64_t descaddrmask; 1278 bool aarch64 = arm_el_is_aa64(env, el); 1279 uint64_t descriptor, new_descriptor; 1280 bool nstable; 1281 1282 /* TODO: This code does not support shareability levels. */ 1283 if (aarch64) { 1284 int ps; 1285 1286 param = aa64_va_parameters(env, address, mmu_idx, 1287 access_type != MMU_INST_FETCH); 1288 level = 0; 1289 1290 /* 1291 * If TxSZ is programmed to a value larger than the maximum, 1292 * or smaller than the effective minimum, it is IMPLEMENTATION 1293 * DEFINED whether we behave as if the field were programmed 1294 * within bounds, or if a level 0 Translation fault is generated. 1295 * 1296 * With FEAT_LVA, fault on less than minimum becomes required, 1297 * so our choice is to always raise the fault. 1298 */ 1299 if (param.tsz_oob) { 1300 goto do_translation_fault; 1301 } 1302 1303 addrsize = 64 - 8 * param.tbi; 1304 inputsize = 64 - param.tsz; 1305 1306 /* 1307 * Bound PS by PARANGE to find the effective output address size. 1308 * ID_AA64MMFR0 is a read-only register so values outside of the 1309 * supported mappings can be considered an implementation error. 1310 */ 1311 ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE); 1312 ps = MIN(ps, param.ps); 1313 assert(ps < ARRAY_SIZE(pamax_map)); 1314 outputsize = pamax_map[ps]; 1315 1316 /* 1317 * With LPA2, the effective output address (OA) size is at most 48 bits 1318 * unless TCR.DS == 1 1319 */ 1320 if (!param.ds && param.gran != Gran64K) { 1321 outputsize = MIN(outputsize, 48); 1322 } 1323 } else { 1324 param = aa32_va_parameters(env, address, mmu_idx); 1325 level = 1; 1326 addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32); 1327 inputsize = addrsize - param.tsz; 1328 outputsize = 40; 1329 } 1330 1331 /* 1332 * We determined the region when collecting the parameters, but we 1333 * have not yet validated that the address is valid for the region. 1334 * Extract the top bits and verify that they all match select. 1335 * 1336 * For aa32, if inputsize == addrsize, then we have selected the 1337 * region by exclusion in aa32_va_parameters and there is no more 1338 * validation to do here. 1339 */ 1340 if (inputsize < addrsize) { 1341 target_ulong top_bits = sextract64(address, inputsize, 1342 addrsize - inputsize); 1343 if (-top_bits != param.select) { 1344 /* The gap between the two regions is a Translation fault */ 1345 goto do_translation_fault; 1346 } 1347 } 1348 1349 stride = arm_granule_bits(param.gran) - 3; 1350 1351 /* 1352 * Note that QEMU ignores shareability and cacheability attributes, 1353 * so we don't need to do anything with the SH, ORGN, IRGN fields 1354 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 1355 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 1356 * implement any ASID-like capability so we can ignore it (instead 1357 * we will always flush the TLB any time the ASID is changed). 1358 */ 1359 ttbr = regime_ttbr(env, mmu_idx, param.select); 1360 1361 /* 1362 * Here we should have set up all the parameters for the translation: 1363 * inputsize, ttbr, epd, stride, tbi 1364 */ 1365 1366 if (param.epd) { 1367 /* 1368 * Translation table walk disabled => Translation fault on TLB miss 1369 * Note: This is always 0 on 64-bit EL2 and EL3. 1370 */ 1371 goto do_translation_fault; 1372 } 1373 1374 if (!regime_is_stage2(mmu_idx)) { 1375 /* 1376 * The starting level depends on the virtual address size (which can 1377 * be up to 48 bits) and the translation granule size. It indicates 1378 * the number of strides (stride bits at a time) needed to 1379 * consume the bits of the input address. In the pseudocode this is: 1380 * level = 4 - RoundUp((inputsize - grainsize) / stride) 1381 * where their 'inputsize' is our 'inputsize', 'grainsize' is 1382 * our 'stride + 3' and 'stride' is our 'stride'. 1383 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 1384 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 1385 * = 4 - (inputsize - 4) / stride; 1386 */ 1387 level = 4 - (inputsize - 4) / stride; 1388 } else { 1389 int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds, 1390 inputsize, stride); 1391 if (startlevel == INT_MIN) { 1392 level = 0; 1393 goto do_translation_fault; 1394 } 1395 level = startlevel; 1396 } 1397 1398 indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3); 1399 indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level))); 1400 1401 /* Now we can extract the actual base address from the TTBR */ 1402 descaddr = extract64(ttbr, 0, 48); 1403 1404 /* 1405 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR. 1406 * 1407 * Otherwise, if the base address is out of range, raise AddressSizeFault. 1408 * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), 1409 * but we've just cleared the bits above 47, so simplify the test. 1410 */ 1411 if (outputsize > 48) { 1412 descaddr |= extract64(ttbr, 2, 4) << 48; 1413 } else if (descaddr >> outputsize) { 1414 level = 0; 1415 fi->type = ARMFault_AddressSize; 1416 goto do_fault; 1417 } 1418 1419 /* 1420 * We rely on this masking to clear the RES0 bits at the bottom of the TTBR 1421 * and also to mask out CnP (bit 0) which could validly be non-zero. 1422 */ 1423 descaddr &= ~indexmask; 1424 1425 /* 1426 * For AArch32, the address field in the descriptor goes up to bit 39 1427 * for both v7 and v8. However, for v8 the SBZ bits [47:40] must be 0 1428 * or an AddressSize fault is raised. So for v8 we extract those SBZ 1429 * bits as part of the address, which will be checked via outputsize. 1430 * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2; 1431 * the highest bits of a 52-bit output are placed elsewhere. 1432 */ 1433 if (param.ds) { 1434 descaddrmask = MAKE_64BIT_MASK(0, 50); 1435 } else if (arm_feature(env, ARM_FEATURE_V8)) { 1436 descaddrmask = MAKE_64BIT_MASK(0, 48); 1437 } else { 1438 descaddrmask = MAKE_64BIT_MASK(0, 40); 1439 } 1440 descaddrmask &= ~indexmask_grainsize; 1441 1442 /* 1443 * Secure stage 1 accesses start with the page table in secure memory and 1444 * can be downgraded to non-secure at any step. Non-secure accesses 1445 * remain non-secure. We implement this by just ORing in the NSTable/NS 1446 * bits at each step. 1447 * Stage 2 never gets this kind of downgrade. 1448 */ 1449 tableattrs = is_secure ? 0 : (1 << 4); 1450 1451 next_level: 1452 descaddr |= (address >> (stride * (4 - level))) & indexmask; 1453 descaddr &= ~7ULL; 1454 nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1); 1455 if (nstable) { 1456 /* 1457 * Stage2_S -> Stage2 or Phys_S -> Phys_NS 1458 * Assert that the non-secure idx are even, and relative order. 1459 */ 1460 QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0); 1461 QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0); 1462 QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S); 1463 QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S); 1464 ptw->in_ptw_idx &= ~1; 1465 ptw->in_secure = false; 1466 } 1467 if (!S1_ptw_translate(env, ptw, descaddr, fi)) { 1468 goto do_fault; 1469 } 1470 descriptor = arm_ldq_ptw(env, ptw, fi); 1471 if (fi->type != ARMFault_None) { 1472 goto do_fault; 1473 } 1474 new_descriptor = descriptor; 1475 1476 restart_atomic_update: 1477 if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) { 1478 /* Invalid, or the Reserved level 3 encoding */ 1479 goto do_translation_fault; 1480 } 1481 1482 descaddr = descriptor & descaddrmask; 1483 1484 /* 1485 * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12] 1486 * of descriptor. For FEAT_LPA2 and effective DS, bits [51:50] of 1487 * descaddr are in [9:8]. Otherwise, if descaddr is out of range, 1488 * raise AddressSizeFault. 1489 */ 1490 if (outputsize > 48) { 1491 if (param.ds) { 1492 descaddr |= extract64(descriptor, 8, 2) << 50; 1493 } else { 1494 descaddr |= extract64(descriptor, 12, 4) << 48; 1495 } 1496 } else if (descaddr >> outputsize) { 1497 fi->type = ARMFault_AddressSize; 1498 goto do_fault; 1499 } 1500 1501 if ((descriptor & 2) && (level < 3)) { 1502 /* 1503 * Table entry. The top five bits are attributes which may 1504 * propagate down through lower levels of the table (and 1505 * which are all arranged so that 0 means "no effect", so 1506 * we can gather them up by ORing in the bits at each level). 1507 */ 1508 tableattrs |= extract64(descriptor, 59, 5); 1509 level++; 1510 indexmask = indexmask_grainsize; 1511 goto next_level; 1512 } 1513 1514 /* 1515 * Block entry at level 1 or 2, or page entry at level 3. 1516 * These are basically the same thing, although the number 1517 * of bits we pull in from the vaddr varies. Note that although 1518 * descaddrmask masks enough of the low bits of the descriptor 1519 * to give a correct page or table address, the address field 1520 * in a block descriptor is smaller; so we need to explicitly 1521 * clear the lower bits here before ORing in the low vaddr bits. 1522 * 1523 * Afterward, descaddr is the final physical address. 1524 */ 1525 page_size = (1ULL << ((stride * (4 - level)) + 3)); 1526 descaddr &= ~(hwaddr)(page_size - 1); 1527 descaddr |= (address & (page_size - 1)); 1528 1529 if (likely(!ptw->in_debug)) { 1530 /* 1531 * Access flag. 1532 * If HA is enabled, prepare to update the descriptor below. 1533 * Otherwise, pass the access fault on to software. 1534 */ 1535 if (!(descriptor & (1 << 10))) { 1536 if (param.ha) { 1537 new_descriptor |= 1 << 10; /* AF */ 1538 } else { 1539 fi->type = ARMFault_AccessFlag; 1540 goto do_fault; 1541 } 1542 } 1543 1544 /* 1545 * Dirty Bit. 1546 * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP 1547 * bit for writeback. The actual write protection test may still be 1548 * overridden by tableattrs, to be merged below. 1549 */ 1550 if (param.hd 1551 && extract64(descriptor, 51, 1) /* DBM */ 1552 && access_type == MMU_DATA_STORE) { 1553 if (regime_is_stage2(mmu_idx)) { 1554 new_descriptor |= 1ull << 7; /* set S2AP[1] */ 1555 } else { 1556 new_descriptor &= ~(1ull << 7); /* clear AP[2] */ 1557 } 1558 } 1559 } 1560 1561 /* 1562 * Extract attributes from the (modified) descriptor, and apply 1563 * table descriptors. Stage 2 table descriptors do not include 1564 * any attribute fields. HPD disables all the table attributes 1565 * except NSTable. 1566 */ 1567 attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14)); 1568 if (!regime_is_stage2(mmu_idx)) { 1569 attrs |= nstable << 5; /* NS */ 1570 if (!param.hpd) { 1571 attrs |= extract64(tableattrs, 0, 2) << 53; /* XN, PXN */ 1572 /* 1573 * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 1574 * means "force PL1 access only", which means forcing AP[1] to 0. 1575 */ 1576 attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */ 1577 attrs |= extract32(tableattrs, 3, 1) << 7; /* APT[1] => AP[2] */ 1578 } 1579 } 1580 1581 ap = extract32(attrs, 6, 2); 1582 if (regime_is_stage2(mmu_idx)) { 1583 ns = mmu_idx == ARMMMUIdx_Stage2; 1584 xn = extract64(attrs, 53, 2); 1585 result->f.prot = get_S2prot(env, ap, xn, s1_is_el0); 1586 } else { 1587 ns = extract32(attrs, 5, 1); 1588 xn = extract64(attrs, 54, 1); 1589 pxn = extract64(attrs, 53, 1); 1590 result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 1591 } 1592 1593 if (!(result->f.prot & (1 << access_type))) { 1594 fi->type = ARMFault_Permission; 1595 goto do_fault; 1596 } 1597 1598 /* If FEAT_HAFDBS has made changes, update the PTE. */ 1599 if (new_descriptor != descriptor) { 1600 new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi); 1601 if (fi->type != ARMFault_None) { 1602 goto do_fault; 1603 } 1604 /* 1605 * I_YZSVV says that if the in-memory descriptor has changed, 1606 * then we must use the information in that new value 1607 * (which might include a different output address, different 1608 * attributes, or generate a fault). 1609 * Restart the handling of the descriptor value from scratch. 1610 */ 1611 if (new_descriptor != descriptor) { 1612 descriptor = new_descriptor; 1613 goto restart_atomic_update; 1614 } 1615 } 1616 1617 if (ns) { 1618 /* 1619 * The NS bit will (as required by the architecture) have no effect if 1620 * the CPU doesn't support TZ or this is a non-secure translation 1621 * regime, because the attribute will already be non-secure. 1622 */ 1623 result->f.attrs.secure = false; 1624 } 1625 1626 if (regime_is_stage2(mmu_idx)) { 1627 result->cacheattrs.is_s2_format = true; 1628 result->cacheattrs.attrs = extract32(attrs, 2, 4); 1629 } else { 1630 /* Index into MAIR registers for cache attributes */ 1631 uint8_t attrindx = extract32(attrs, 2, 3); 1632 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 1633 assert(attrindx <= 7); 1634 result->cacheattrs.is_s2_format = false; 1635 result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); 1636 1637 /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ 1638 if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { 1639 result->f.guarded = extract64(attrs, 50, 1); /* GP */ 1640 } 1641 } 1642 1643 /* 1644 * For FEAT_LPA2 and effective DS, the SH field in the attributes 1645 * was re-purposed for output address bits. The SH attribute in 1646 * that case comes from TCR_ELx, which we extracted earlier. 1647 */ 1648 if (param.ds) { 1649 result->cacheattrs.shareability = param.sh; 1650 } else { 1651 result->cacheattrs.shareability = extract32(attrs, 8, 2); 1652 } 1653 1654 result->f.phys_addr = descaddr; 1655 result->f.lg_page_size = ctz64(page_size); 1656 return false; 1657 1658 do_translation_fault: 1659 fi->type = ARMFault_Translation; 1660 do_fault: 1661 fi->level = level; 1662 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 1663 fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx); 1664 fi->s1ns = mmu_idx == ARMMMUIdx_Stage2; 1665 return true; 1666 } 1667 1668 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 1669 MMUAccessType access_type, ARMMMUIdx mmu_idx, 1670 bool is_secure, GetPhysAddrResult *result, 1671 ARMMMUFaultInfo *fi) 1672 { 1673 int n; 1674 uint32_t mask; 1675 uint32_t base; 1676 bool is_user = regime_is_user(env, mmu_idx); 1677 1678 if (regime_translation_disabled(env, mmu_idx, is_secure)) { 1679 /* MPU disabled. */ 1680 result->f.phys_addr = address; 1681 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 1682 return false; 1683 } 1684 1685 result->f.phys_addr = address; 1686 for (n = 7; n >= 0; n--) { 1687 base = env->cp15.c6_region[n]; 1688 if ((base & 1) == 0) { 1689 continue; 1690 } 1691 mask = 1 << ((base >> 1) & 0x1f); 1692 /* Keep this shift separate from the above to avoid an 1693 (undefined) << 32. */ 1694 mask = (mask << 1) - 1; 1695 if (((base ^ address) & ~mask) == 0) { 1696 break; 1697 } 1698 } 1699 if (n < 0) { 1700 fi->type = ARMFault_Background; 1701 return true; 1702 } 1703 1704 if (access_type == MMU_INST_FETCH) { 1705 mask = env->cp15.pmsav5_insn_ap; 1706 } else { 1707 mask = env->cp15.pmsav5_data_ap; 1708 } 1709 mask = (mask >> (n * 4)) & 0xf; 1710 switch (mask) { 1711 case 0: 1712 fi->type = ARMFault_Permission; 1713 fi->level = 1; 1714 return true; 1715 case 1: 1716 if (is_user) { 1717 fi->type = ARMFault_Permission; 1718 fi->level = 1; 1719 return true; 1720 } 1721 result->f.prot = PAGE_READ | PAGE_WRITE; 1722 break; 1723 case 2: 1724 result->f.prot = PAGE_READ; 1725 if (!is_user) { 1726 result->f.prot |= PAGE_WRITE; 1727 } 1728 break; 1729 case 3: 1730 result->f.prot = PAGE_READ | PAGE_WRITE; 1731 break; 1732 case 5: 1733 if (is_user) { 1734 fi->type = ARMFault_Permission; 1735 fi->level = 1; 1736 return true; 1737 } 1738 result->f.prot = PAGE_READ; 1739 break; 1740 case 6: 1741 result->f.prot = PAGE_READ; 1742 break; 1743 default: 1744 /* Bad permission. */ 1745 fi->type = ARMFault_Permission; 1746 fi->level = 1; 1747 return true; 1748 } 1749 result->f.prot |= PAGE_EXEC; 1750 return false; 1751 } 1752 1753 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx, 1754 int32_t address, uint8_t *prot) 1755 { 1756 if (!arm_feature(env, ARM_FEATURE_M)) { 1757 *prot = PAGE_READ | PAGE_WRITE; 1758 switch (address) { 1759 case 0xF0000000 ... 0xFFFFFFFF: 1760 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 1761 /* hivecs execing is ok */ 1762 *prot |= PAGE_EXEC; 1763 } 1764 break; 1765 case 0x00000000 ... 0x7FFFFFFF: 1766 *prot |= PAGE_EXEC; 1767 break; 1768 } 1769 } else { 1770 /* Default system address map for M profile cores. 1771 * The architecture specifies which regions are execute-never; 1772 * at the MPU level no other checks are defined. 1773 */ 1774 switch (address) { 1775 case 0x00000000 ... 0x1fffffff: /* ROM */ 1776 case 0x20000000 ... 0x3fffffff: /* SRAM */ 1777 case 0x60000000 ... 0x7fffffff: /* RAM */ 1778 case 0x80000000 ... 0x9fffffff: /* RAM */ 1779 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 1780 break; 1781 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 1782 case 0xa0000000 ... 0xbfffffff: /* Device */ 1783 case 0xc0000000 ... 0xdfffffff: /* Device */ 1784 case 0xe0000000 ... 0xffffffff: /* System */ 1785 *prot = PAGE_READ | PAGE_WRITE; 1786 break; 1787 default: 1788 g_assert_not_reached(); 1789 } 1790 } 1791 } 1792 1793 static bool m_is_ppb_region(CPUARMState *env, uint32_t address) 1794 { 1795 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 1796 return arm_feature(env, ARM_FEATURE_M) && 1797 extract32(address, 20, 12) == 0xe00; 1798 } 1799 1800 static bool m_is_system_region(CPUARMState *env, uint32_t address) 1801 { 1802 /* 1803 * True if address is in the M profile system region 1804 * 0xe0000000 - 0xffffffff 1805 */ 1806 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 1807 } 1808 1809 static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx, 1810 bool is_secure, bool is_user) 1811 { 1812 /* 1813 * Return true if we should use the default memory map as a 1814 * "background" region if there are no hits against any MPU regions. 1815 */ 1816 CPUARMState *env = &cpu->env; 1817 1818 if (is_user) { 1819 return false; 1820 } 1821 1822 if (arm_feature(env, ARM_FEATURE_M)) { 1823 return env->v7m.mpu_ctrl[is_secure] & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 1824 } 1825 1826 if (mmu_idx == ARMMMUIdx_Stage2) { 1827 return false; 1828 } 1829 1830 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 1831 } 1832 1833 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 1834 MMUAccessType access_type, ARMMMUIdx mmu_idx, 1835 bool secure, GetPhysAddrResult *result, 1836 ARMMMUFaultInfo *fi) 1837 { 1838 ARMCPU *cpu = env_archcpu(env); 1839 int n; 1840 bool is_user = regime_is_user(env, mmu_idx); 1841 1842 result->f.phys_addr = address; 1843 result->f.lg_page_size = TARGET_PAGE_BITS; 1844 result->f.prot = 0; 1845 1846 if (regime_translation_disabled(env, mmu_idx, secure) || 1847 m_is_ppb_region(env, address)) { 1848 /* 1849 * MPU disabled or M profile PPB access: use default memory map. 1850 * The other case which uses the default memory map in the 1851 * v7M ARM ARM pseudocode is exception vector reads from the vector 1852 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 1853 * which always does a direct read using address_space_ldl(), rather 1854 * than going via this function, so we don't need to check that here. 1855 */ 1856 get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot); 1857 } else { /* MPU enabled */ 1858 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 1859 /* region search */ 1860 uint32_t base = env->pmsav7.drbar[n]; 1861 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 1862 uint32_t rmask; 1863 bool srdis = false; 1864 1865 if (!(env->pmsav7.drsr[n] & 0x1)) { 1866 continue; 1867 } 1868 1869 if (!rsize) { 1870 qemu_log_mask(LOG_GUEST_ERROR, 1871 "DRSR[%d]: Rsize field cannot be 0\n", n); 1872 continue; 1873 } 1874 rsize++; 1875 rmask = (1ull << rsize) - 1; 1876 1877 if (base & rmask) { 1878 qemu_log_mask(LOG_GUEST_ERROR, 1879 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 1880 "to DRSR region size, mask = 0x%" PRIx32 "\n", 1881 n, base, rmask); 1882 continue; 1883 } 1884 1885 if (address < base || address > base + rmask) { 1886 /* 1887 * Address not in this region. We must check whether the 1888 * region covers addresses in the same page as our address. 1889 * In that case we must not report a size that covers the 1890 * whole page for a subsequent hit against a different MPU 1891 * region or the background region, because it would result in 1892 * incorrect TLB hits for subsequent accesses to addresses that 1893 * are in this MPU region. 1894 */ 1895 if (ranges_overlap(base, rmask, 1896 address & TARGET_PAGE_MASK, 1897 TARGET_PAGE_SIZE)) { 1898 result->f.lg_page_size = 0; 1899 } 1900 continue; 1901 } 1902 1903 /* Region matched */ 1904 1905 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 1906 int i, snd; 1907 uint32_t srdis_mask; 1908 1909 rsize -= 3; /* sub region size (power of 2) */ 1910 snd = ((address - base) >> rsize) & 0x7; 1911 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 1912 1913 srdis_mask = srdis ? 0x3 : 0x0; 1914 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 1915 /* 1916 * This will check in groups of 2, 4 and then 8, whether 1917 * the subregion bits are consistent. rsize is incremented 1918 * back up to give the region size, considering consistent 1919 * adjacent subregions as one region. Stop testing if rsize 1920 * is already big enough for an entire QEMU page. 1921 */ 1922 int snd_rounded = snd & ~(i - 1); 1923 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 1924 snd_rounded + 8, i); 1925 if (srdis_mask ^ srdis_multi) { 1926 break; 1927 } 1928 srdis_mask = (srdis_mask << i) | srdis_mask; 1929 rsize++; 1930 } 1931 } 1932 if (srdis) { 1933 continue; 1934 } 1935 if (rsize < TARGET_PAGE_BITS) { 1936 result->f.lg_page_size = rsize; 1937 } 1938 break; 1939 } 1940 1941 if (n == -1) { /* no hits */ 1942 if (!pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) { 1943 /* background fault */ 1944 fi->type = ARMFault_Background; 1945 return true; 1946 } 1947 get_phys_addr_pmsav7_default(env, mmu_idx, address, 1948 &result->f.prot); 1949 } else { /* a MPU hit! */ 1950 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 1951 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 1952 1953 if (m_is_system_region(env, address)) { 1954 /* System space is always execute never */ 1955 xn = 1; 1956 } 1957 1958 if (is_user) { /* User mode AP bit decoding */ 1959 switch (ap) { 1960 case 0: 1961 case 1: 1962 case 5: 1963 break; /* no access */ 1964 case 3: 1965 result->f.prot |= PAGE_WRITE; 1966 /* fall through */ 1967 case 2: 1968 case 6: 1969 result->f.prot |= PAGE_READ | PAGE_EXEC; 1970 break; 1971 case 7: 1972 /* for v7M, same as 6; for R profile a reserved value */ 1973 if (arm_feature(env, ARM_FEATURE_M)) { 1974 result->f.prot |= PAGE_READ | PAGE_EXEC; 1975 break; 1976 } 1977 /* fall through */ 1978 default: 1979 qemu_log_mask(LOG_GUEST_ERROR, 1980 "DRACR[%d]: Bad value for AP bits: 0x%" 1981 PRIx32 "\n", n, ap); 1982 } 1983 } else { /* Priv. mode AP bits decoding */ 1984 switch (ap) { 1985 case 0: 1986 break; /* no access */ 1987 case 1: 1988 case 2: 1989 case 3: 1990 result->f.prot |= PAGE_WRITE; 1991 /* fall through */ 1992 case 5: 1993 case 6: 1994 result->f.prot |= PAGE_READ | PAGE_EXEC; 1995 break; 1996 case 7: 1997 /* for v7M, same as 6; for R profile a reserved value */ 1998 if (arm_feature(env, ARM_FEATURE_M)) { 1999 result->f.prot |= PAGE_READ | PAGE_EXEC; 2000 break; 2001 } 2002 /* fall through */ 2003 default: 2004 qemu_log_mask(LOG_GUEST_ERROR, 2005 "DRACR[%d]: Bad value for AP bits: 0x%" 2006 PRIx32 "\n", n, ap); 2007 } 2008 } 2009 2010 /* execute never */ 2011 if (xn) { 2012 result->f.prot &= ~PAGE_EXEC; 2013 } 2014 } 2015 } 2016 2017 fi->type = ARMFault_Permission; 2018 fi->level = 1; 2019 return !(result->f.prot & (1 << access_type)); 2020 } 2021 2022 static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx, 2023 uint32_t secure) 2024 { 2025 if (regime_el(env, mmu_idx) == 2) { 2026 return env->pmsav8.hprbar; 2027 } else { 2028 return env->pmsav8.rbar[secure]; 2029 } 2030 } 2031 2032 static uint32_t *regime_rlar(CPUARMState *env, ARMMMUIdx mmu_idx, 2033 uint32_t secure) 2034 { 2035 if (regime_el(env, mmu_idx) == 2) { 2036 return env->pmsav8.hprlar; 2037 } else { 2038 return env->pmsav8.rlar[secure]; 2039 } 2040 } 2041 2042 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 2043 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2044 bool secure, GetPhysAddrResult *result, 2045 ARMMMUFaultInfo *fi, uint32_t *mregion) 2046 { 2047 /* 2048 * Perform a PMSAv8 MPU lookup (without also doing the SAU check 2049 * that a full phys-to-virt translation does). 2050 * mregion is (if not NULL) set to the region number which matched, 2051 * or -1 if no region number is returned (MPU off, address did not 2052 * hit a region, address hit in multiple regions). 2053 * If the region hit doesn't cover the entire TARGET_PAGE the address 2054 * is within, then we set the result page_size to 1 to force the 2055 * memory system to use a subpage. 2056 */ 2057 ARMCPU *cpu = env_archcpu(env); 2058 bool is_user = regime_is_user(env, mmu_idx); 2059 int n; 2060 int matchregion = -1; 2061 bool hit = false; 2062 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 2063 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 2064 int region_counter; 2065 2066 if (regime_el(env, mmu_idx) == 2) { 2067 region_counter = cpu->pmsav8r_hdregion; 2068 } else { 2069 region_counter = cpu->pmsav7_dregion; 2070 } 2071 2072 result->f.lg_page_size = TARGET_PAGE_BITS; 2073 result->f.phys_addr = address; 2074 result->f.prot = 0; 2075 if (mregion) { 2076 *mregion = -1; 2077 } 2078 2079 if (mmu_idx == ARMMMUIdx_Stage2) { 2080 fi->stage2 = true; 2081 } 2082 2083 /* 2084 * Unlike the ARM ARM pseudocode, we don't need to check whether this 2085 * was an exception vector read from the vector table (which is always 2086 * done using the default system address map), because those accesses 2087 * are done in arm_v7m_load_vector(), which always does a direct 2088 * read using address_space_ldl(), rather than going via this function. 2089 */ 2090 if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */ 2091 hit = true; 2092 } else if (m_is_ppb_region(env, address)) { 2093 hit = true; 2094 } else { 2095 if (pmsav7_use_background_region(cpu, mmu_idx, secure, is_user)) { 2096 hit = true; 2097 } 2098 2099 uint32_t bitmask; 2100 if (arm_feature(env, ARM_FEATURE_M)) { 2101 bitmask = 0x1f; 2102 } else { 2103 bitmask = 0x3f; 2104 fi->level = 0; 2105 } 2106 2107 for (n = region_counter - 1; n >= 0; n--) { 2108 /* region search */ 2109 /* 2110 * Note that the base address is bits [31:x] from the register 2111 * with bits [x-1:0] all zeroes, but the limit address is bits 2112 * [31:x] from the register with bits [x:0] all ones. Where x is 2113 * 5 for Cortex-M and 6 for Cortex-R 2114 */ 2115 uint32_t base = regime_rbar(env, mmu_idx, secure)[n] & ~bitmask; 2116 uint32_t limit = regime_rlar(env, mmu_idx, secure)[n] | bitmask; 2117 2118 if (!(regime_rlar(env, mmu_idx, secure)[n] & 0x1)) { 2119 /* Region disabled */ 2120 continue; 2121 } 2122 2123 if (address < base || address > limit) { 2124 /* 2125 * Address not in this region. We must check whether the 2126 * region covers addresses in the same page as our address. 2127 * In that case we must not report a size that covers the 2128 * whole page for a subsequent hit against a different MPU 2129 * region or the background region, because it would result in 2130 * incorrect TLB hits for subsequent accesses to addresses that 2131 * are in this MPU region. 2132 */ 2133 if (limit >= base && 2134 ranges_overlap(base, limit - base + 1, 2135 addr_page_base, 2136 TARGET_PAGE_SIZE)) { 2137 result->f.lg_page_size = 0; 2138 } 2139 continue; 2140 } 2141 2142 if (base > addr_page_base || limit < addr_page_limit) { 2143 result->f.lg_page_size = 0; 2144 } 2145 2146 if (matchregion != -1) { 2147 /* 2148 * Multiple regions match -- always a failure (unlike 2149 * PMSAv7 where highest-numbered-region wins) 2150 */ 2151 fi->type = ARMFault_Permission; 2152 if (arm_feature(env, ARM_FEATURE_M)) { 2153 fi->level = 1; 2154 } 2155 return true; 2156 } 2157 2158 matchregion = n; 2159 hit = true; 2160 } 2161 } 2162 2163 if (!hit) { 2164 if (arm_feature(env, ARM_FEATURE_M)) { 2165 fi->type = ARMFault_Background; 2166 } else { 2167 fi->type = ARMFault_Permission; 2168 } 2169 return true; 2170 } 2171 2172 if (matchregion == -1) { 2173 /* hit using the background region */ 2174 get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot); 2175 } else { 2176 uint32_t matched_rbar = regime_rbar(env, mmu_idx, secure)[matchregion]; 2177 uint32_t matched_rlar = regime_rlar(env, mmu_idx, secure)[matchregion]; 2178 uint32_t ap = extract32(matched_rbar, 1, 2); 2179 uint32_t xn = extract32(matched_rbar, 0, 1); 2180 bool pxn = false; 2181 2182 if (arm_feature(env, ARM_FEATURE_V8_1M)) { 2183 pxn = extract32(matched_rlar, 4, 1); 2184 } 2185 2186 if (m_is_system_region(env, address)) { 2187 /* System space is always execute never */ 2188 xn = 1; 2189 } 2190 2191 if (regime_el(env, mmu_idx) == 2) { 2192 result->f.prot = simple_ap_to_rw_prot_is_user(ap, 2193 mmu_idx != ARMMMUIdx_E2); 2194 } else { 2195 result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 2196 } 2197 2198 if (!arm_feature(env, ARM_FEATURE_M)) { 2199 uint8_t attrindx = extract32(matched_rlar, 1, 3); 2200 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 2201 uint8_t sh = extract32(matched_rlar, 3, 2); 2202 2203 if (regime_sctlr(env, mmu_idx) & SCTLR_WXN && 2204 result->f.prot & PAGE_WRITE && mmu_idx != ARMMMUIdx_Stage2) { 2205 xn = 0x1; 2206 } 2207 2208 if ((regime_el(env, mmu_idx) == 1) && 2209 regime_sctlr(env, mmu_idx) & SCTLR_UWXN && ap == 0x1) { 2210 pxn = 0x1; 2211 } 2212 2213 result->cacheattrs.is_s2_format = false; 2214 result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); 2215 result->cacheattrs.shareability = sh; 2216 } 2217 2218 if (result->f.prot && !xn && !(pxn && !is_user)) { 2219 result->f.prot |= PAGE_EXEC; 2220 } 2221 2222 if (mregion) { 2223 *mregion = matchregion; 2224 } 2225 } 2226 2227 fi->type = ARMFault_Permission; 2228 if (arm_feature(env, ARM_FEATURE_M)) { 2229 fi->level = 1; 2230 } 2231 return !(result->f.prot & (1 << access_type)); 2232 } 2233 2234 static bool v8m_is_sau_exempt(CPUARMState *env, 2235 uint32_t address, MMUAccessType access_type) 2236 { 2237 /* 2238 * The architecture specifies that certain address ranges are 2239 * exempt from v8M SAU/IDAU checks. 2240 */ 2241 return 2242 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 2243 (address >= 0xe0000000 && address <= 0xe0002fff) || 2244 (address >= 0xe000e000 && address <= 0xe000efff) || 2245 (address >= 0xe002e000 && address <= 0xe002efff) || 2246 (address >= 0xe0040000 && address <= 0xe0041fff) || 2247 (address >= 0xe00ff000 && address <= 0xe00fffff); 2248 } 2249 2250 void v8m_security_lookup(CPUARMState *env, uint32_t address, 2251 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2252 bool is_secure, V8M_SAttributes *sattrs) 2253 { 2254 /* 2255 * Look up the security attributes for this address. Compare the 2256 * pseudocode SecurityCheck() function. 2257 * We assume the caller has zero-initialized *sattrs. 2258 */ 2259 ARMCPU *cpu = env_archcpu(env); 2260 int r; 2261 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 2262 int idau_region = IREGION_NOTVALID; 2263 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 2264 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 2265 2266 if (cpu->idau) { 2267 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 2268 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 2269 2270 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 2271 &idau_nsc); 2272 } 2273 2274 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 2275 /* 0xf0000000..0xffffffff is always S for insn fetches */ 2276 return; 2277 } 2278 2279 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 2280 sattrs->ns = !is_secure; 2281 return; 2282 } 2283 2284 if (idau_region != IREGION_NOTVALID) { 2285 sattrs->irvalid = true; 2286 sattrs->iregion = idau_region; 2287 } 2288 2289 switch (env->sau.ctrl & 3) { 2290 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 2291 break; 2292 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 2293 sattrs->ns = true; 2294 break; 2295 default: /* SAU.ENABLE == 1 */ 2296 for (r = 0; r < cpu->sau_sregion; r++) { 2297 if (env->sau.rlar[r] & 1) { 2298 uint32_t base = env->sau.rbar[r] & ~0x1f; 2299 uint32_t limit = env->sau.rlar[r] | 0x1f; 2300 2301 if (base <= address && limit >= address) { 2302 if (base > addr_page_base || limit < addr_page_limit) { 2303 sattrs->subpage = true; 2304 } 2305 if (sattrs->srvalid) { 2306 /* 2307 * If we hit in more than one region then we must report 2308 * as Secure, not NS-Callable, with no valid region 2309 * number info. 2310 */ 2311 sattrs->ns = false; 2312 sattrs->nsc = false; 2313 sattrs->sregion = 0; 2314 sattrs->srvalid = false; 2315 break; 2316 } else { 2317 if (env->sau.rlar[r] & 2) { 2318 sattrs->nsc = true; 2319 } else { 2320 sattrs->ns = true; 2321 } 2322 sattrs->srvalid = true; 2323 sattrs->sregion = r; 2324 } 2325 } else { 2326 /* 2327 * Address not in this region. We must check whether the 2328 * region covers addresses in the same page as our address. 2329 * In that case we must not report a size that covers the 2330 * whole page for a subsequent hit against a different MPU 2331 * region or the background region, because it would result 2332 * in incorrect TLB hits for subsequent accesses to 2333 * addresses that are in this MPU region. 2334 */ 2335 if (limit >= base && 2336 ranges_overlap(base, limit - base + 1, 2337 addr_page_base, 2338 TARGET_PAGE_SIZE)) { 2339 sattrs->subpage = true; 2340 } 2341 } 2342 } 2343 } 2344 break; 2345 } 2346 2347 /* 2348 * The IDAU will override the SAU lookup results if it specifies 2349 * higher security than the SAU does. 2350 */ 2351 if (!idau_ns) { 2352 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 2353 sattrs->ns = false; 2354 sattrs->nsc = idau_nsc; 2355 } 2356 } 2357 } 2358 2359 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 2360 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2361 bool secure, GetPhysAddrResult *result, 2362 ARMMMUFaultInfo *fi) 2363 { 2364 V8M_SAttributes sattrs = {}; 2365 bool ret; 2366 2367 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 2368 v8m_security_lookup(env, address, access_type, mmu_idx, 2369 secure, &sattrs); 2370 if (access_type == MMU_INST_FETCH) { 2371 /* 2372 * Instruction fetches always use the MMU bank and the 2373 * transaction attribute determined by the fetch address, 2374 * regardless of CPU state. This is painful for QEMU 2375 * to handle, because it would mean we need to encode 2376 * into the mmu_idx not just the (user, negpri) information 2377 * for the current security state but also that for the 2378 * other security state, which would balloon the number 2379 * of mmu_idx values needed alarmingly. 2380 * Fortunately we can avoid this because it's not actually 2381 * possible to arbitrarily execute code from memory with 2382 * the wrong security attribute: it will always generate 2383 * an exception of some kind or another, apart from the 2384 * special case of an NS CPU executing an SG instruction 2385 * in S&NSC memory. So we always just fail the translation 2386 * here and sort things out in the exception handler 2387 * (including possibly emulating an SG instruction). 2388 */ 2389 if (sattrs.ns != !secure) { 2390 if (sattrs.nsc) { 2391 fi->type = ARMFault_QEMU_NSCExec; 2392 } else { 2393 fi->type = ARMFault_QEMU_SFault; 2394 } 2395 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS; 2396 result->f.phys_addr = address; 2397 result->f.prot = 0; 2398 return true; 2399 } 2400 } else { 2401 /* 2402 * For data accesses we always use the MMU bank indicated 2403 * by the current CPU state, but the security attributes 2404 * might downgrade a secure access to nonsecure. 2405 */ 2406 if (sattrs.ns) { 2407 result->f.attrs.secure = false; 2408 } else if (!secure) { 2409 /* 2410 * NS access to S memory must fault. 2411 * Architecturally we should first check whether the 2412 * MPU information for this address indicates that we 2413 * are doing an unaligned access to Device memory, which 2414 * should generate a UsageFault instead. QEMU does not 2415 * currently check for that kind of unaligned access though. 2416 * If we added it we would need to do so as a special case 2417 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 2418 */ 2419 fi->type = ARMFault_QEMU_SFault; 2420 result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS; 2421 result->f.phys_addr = address; 2422 result->f.prot = 0; 2423 return true; 2424 } 2425 } 2426 } 2427 2428 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure, 2429 result, fi, NULL); 2430 if (sattrs.subpage) { 2431 result->f.lg_page_size = 0; 2432 } 2433 return ret; 2434 } 2435 2436 /* 2437 * Translate from the 4-bit stage 2 representation of 2438 * memory attributes (without cache-allocation hints) to 2439 * the 8-bit representation of the stage 1 MAIR registers 2440 * (which includes allocation hints). 2441 * 2442 * ref: shared/translation/attrs/S2AttrDecode() 2443 * .../S2ConvertAttrsHints() 2444 */ 2445 static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs) 2446 { 2447 uint8_t hiattr = extract32(s2attrs, 2, 2); 2448 uint8_t loattr = extract32(s2attrs, 0, 2); 2449 uint8_t hihint = 0, lohint = 0; 2450 2451 if (hiattr != 0) { /* normal memory */ 2452 if (hcr & HCR_CD) { /* cache disabled */ 2453 hiattr = loattr = 1; /* non-cacheable */ 2454 } else { 2455 if (hiattr != 1) { /* Write-through or write-back */ 2456 hihint = 3; /* RW allocate */ 2457 } 2458 if (loattr != 1) { /* Write-through or write-back */ 2459 lohint = 3; /* RW allocate */ 2460 } 2461 } 2462 } 2463 2464 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 2465 } 2466 2467 /* 2468 * Combine either inner or outer cacheability attributes for normal 2469 * memory, according to table D4-42 and pseudocode procedure 2470 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 2471 * 2472 * NB: only stage 1 includes allocation hints (RW bits), leading to 2473 * some asymmetry. 2474 */ 2475 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 2476 { 2477 if (s1 == 4 || s2 == 4) { 2478 /* non-cacheable has precedence */ 2479 return 4; 2480 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 2481 /* stage 1 write-through takes precedence */ 2482 return s1; 2483 } else if (extract32(s2, 2, 2) == 2) { 2484 /* stage 2 write-through takes precedence, but the allocation hint 2485 * is still taken from stage 1 2486 */ 2487 return (2 << 2) | extract32(s1, 0, 2); 2488 } else { /* write-back */ 2489 return s1; 2490 } 2491 } 2492 2493 /* 2494 * Combine the memory type and cacheability attributes of 2495 * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the 2496 * combined attributes in MAIR_EL1 format. 2497 */ 2498 static uint8_t combined_attrs_nofwb(uint64_t hcr, 2499 ARMCacheAttrs s1, ARMCacheAttrs s2) 2500 { 2501 uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs; 2502 2503 if (s2.is_s2_format) { 2504 s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs); 2505 } else { 2506 s2_mair_attrs = s2.attrs; 2507 } 2508 2509 s1lo = extract32(s1.attrs, 0, 4); 2510 s2lo = extract32(s2_mair_attrs, 0, 4); 2511 s1hi = extract32(s1.attrs, 4, 4); 2512 s2hi = extract32(s2_mair_attrs, 4, 4); 2513 2514 /* Combine memory type and cacheability attributes */ 2515 if (s1hi == 0 || s2hi == 0) { 2516 /* Device has precedence over normal */ 2517 if (s1lo == 0 || s2lo == 0) { 2518 /* nGnRnE has precedence over anything */ 2519 ret_attrs = 0; 2520 } else if (s1lo == 4 || s2lo == 4) { 2521 /* non-Reordering has precedence over Reordering */ 2522 ret_attrs = 4; /* nGnRE */ 2523 } else if (s1lo == 8 || s2lo == 8) { 2524 /* non-Gathering has precedence over Gathering */ 2525 ret_attrs = 8; /* nGRE */ 2526 } else { 2527 ret_attrs = 0xc; /* GRE */ 2528 } 2529 } else { /* Normal memory */ 2530 /* Outer/inner cacheability combine independently */ 2531 ret_attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 2532 | combine_cacheattr_nibble(s1lo, s2lo); 2533 } 2534 return ret_attrs; 2535 } 2536 2537 static uint8_t force_cacheattr_nibble_wb(uint8_t attr) 2538 { 2539 /* 2540 * Given the 4 bits specifying the outer or inner cacheability 2541 * in MAIR format, return a value specifying Normal Write-Back, 2542 * with the allocation and transient hints taken from the input 2543 * if the input specified some kind of cacheable attribute. 2544 */ 2545 if (attr == 0 || attr == 4) { 2546 /* 2547 * 0 == an UNPREDICTABLE encoding 2548 * 4 == Non-cacheable 2549 * Either way, force Write-Back RW allocate non-transient 2550 */ 2551 return 0xf; 2552 } 2553 /* Change WriteThrough to WriteBack, keep allocation and transient hints */ 2554 return attr | 4; 2555 } 2556 2557 /* 2558 * Combine the memory type and cacheability attributes of 2559 * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the 2560 * combined attributes in MAIR_EL1 format. 2561 */ 2562 static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2) 2563 { 2564 assert(s2.is_s2_format && !s1.is_s2_format); 2565 2566 switch (s2.attrs) { 2567 case 7: 2568 /* Use stage 1 attributes */ 2569 return s1.attrs; 2570 case 6: 2571 /* 2572 * Force Normal Write-Back. Note that if S1 is Normal cacheable 2573 * then we take the allocation hints from it; otherwise it is 2574 * RW allocate, non-transient. 2575 */ 2576 if ((s1.attrs & 0xf0) == 0) { 2577 /* S1 is Device */ 2578 return 0xff; 2579 } 2580 /* Need to check the Inner and Outer nibbles separately */ 2581 return force_cacheattr_nibble_wb(s1.attrs & 0xf) | 2582 force_cacheattr_nibble_wb(s1.attrs >> 4) << 4; 2583 case 5: 2584 /* If S1 attrs are Device, use them; otherwise Normal Non-cacheable */ 2585 if ((s1.attrs & 0xf0) == 0) { 2586 return s1.attrs; 2587 } 2588 return 0x44; 2589 case 0 ... 3: 2590 /* Force Device, of subtype specified by S2 */ 2591 return s2.attrs << 2; 2592 default: 2593 /* 2594 * RESERVED values (including RES0 descriptor bit [5] being nonzero); 2595 * arbitrarily force Device. 2596 */ 2597 return 0; 2598 } 2599 } 2600 2601 /* 2602 * Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 2603 * and CombineS1S2Desc() 2604 * 2605 * @env: CPUARMState 2606 * @s1: Attributes from stage 1 walk 2607 * @s2: Attributes from stage 2 walk 2608 */ 2609 static ARMCacheAttrs combine_cacheattrs(uint64_t hcr, 2610 ARMCacheAttrs s1, ARMCacheAttrs s2) 2611 { 2612 ARMCacheAttrs ret; 2613 bool tagged = false; 2614 2615 assert(!s1.is_s2_format); 2616 ret.is_s2_format = false; 2617 ret.guarded = s1.guarded; 2618 2619 if (s1.attrs == 0xf0) { 2620 tagged = true; 2621 s1.attrs = 0xff; 2622 } 2623 2624 /* Combine shareability attributes (table D4-43) */ 2625 if (s1.shareability == 2 || s2.shareability == 2) { 2626 /* if either are outer-shareable, the result is outer-shareable */ 2627 ret.shareability = 2; 2628 } else if (s1.shareability == 3 || s2.shareability == 3) { 2629 /* if either are inner-shareable, the result is inner-shareable */ 2630 ret.shareability = 3; 2631 } else { 2632 /* both non-shareable */ 2633 ret.shareability = 0; 2634 } 2635 2636 /* Combine memory type and cacheability attributes */ 2637 if (hcr & HCR_FWB) { 2638 ret.attrs = combined_attrs_fwb(s1, s2); 2639 } else { 2640 ret.attrs = combined_attrs_nofwb(hcr, s1, s2); 2641 } 2642 2643 /* 2644 * Any location for which the resultant memory type is any 2645 * type of Device memory is always treated as Outer Shareable. 2646 * Any location for which the resultant memory type is Normal 2647 * Inner Non-cacheable, Outer Non-cacheable is always treated 2648 * as Outer Shareable. 2649 * TODO: FEAT_XS adds another value (0x40) also meaning iNCoNC 2650 */ 2651 if ((ret.attrs & 0xf0) == 0 || ret.attrs == 0x44) { 2652 ret.shareability = 2; 2653 } 2654 2655 /* TODO: CombineS1S2Desc does not consider transient, only WB, RWA. */ 2656 if (tagged && ret.attrs == 0xff) { 2657 ret.attrs = 0xf0; 2658 } 2659 2660 return ret; 2661 } 2662 2663 /* 2664 * MMU disabled. S1 addresses within aa64 translation regimes are 2665 * still checked for bounds -- see AArch64.S1DisabledOutput(). 2666 */ 2667 static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address, 2668 MMUAccessType access_type, 2669 ARMMMUIdx mmu_idx, bool is_secure, 2670 GetPhysAddrResult *result, 2671 ARMMMUFaultInfo *fi) 2672 { 2673 uint8_t memattr = 0x00; /* Device nGnRnE */ 2674 uint8_t shareability = 0; /* non-sharable */ 2675 int r_el; 2676 2677 switch (mmu_idx) { 2678 case ARMMMUIdx_Stage2: 2679 case ARMMMUIdx_Stage2_S: 2680 case ARMMMUIdx_Phys_NS: 2681 case ARMMMUIdx_Phys_S: 2682 break; 2683 2684 default: 2685 r_el = regime_el(env, mmu_idx); 2686 if (arm_el_is_aa64(env, r_el)) { 2687 int pamax = arm_pamax(env_archcpu(env)); 2688 uint64_t tcr = env->cp15.tcr_el[r_el]; 2689 int addrtop, tbi; 2690 2691 tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 2692 if (access_type == MMU_INST_FETCH) { 2693 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx); 2694 } 2695 tbi = (tbi >> extract64(address, 55, 1)) & 1; 2696 addrtop = (tbi ? 55 : 63); 2697 2698 if (extract64(address, pamax, addrtop - pamax + 1) != 0) { 2699 fi->type = ARMFault_AddressSize; 2700 fi->level = 0; 2701 fi->stage2 = false; 2702 return 1; 2703 } 2704 2705 /* 2706 * When TBI is disabled, we've just validated that all of the 2707 * bits above PAMax are zero, so logically we only need to 2708 * clear the top byte for TBI. But it's clearer to follow 2709 * the pseudocode set of addrdesc.paddress. 2710 */ 2711 address = extract64(address, 0, 52); 2712 } 2713 2714 /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */ 2715 if (r_el == 1) { 2716 uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure); 2717 if (hcr & HCR_DC) { 2718 if (hcr & HCR_DCT) { 2719 memattr = 0xf0; /* Tagged, Normal, WB, RWA */ 2720 } else { 2721 memattr = 0xff; /* Normal, WB, RWA */ 2722 } 2723 } 2724 } 2725 if (memattr == 0 && access_type == MMU_INST_FETCH) { 2726 if (regime_sctlr(env, mmu_idx) & SCTLR_I) { 2727 memattr = 0xee; /* Normal, WT, RA, NT */ 2728 } else { 2729 memattr = 0x44; /* Normal, NC, No */ 2730 } 2731 shareability = 2; /* outer sharable */ 2732 } 2733 result->cacheattrs.is_s2_format = false; 2734 break; 2735 } 2736 2737 result->f.phys_addr = address; 2738 result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 2739 result->f.lg_page_size = TARGET_PAGE_BITS; 2740 result->cacheattrs.shareability = shareability; 2741 result->cacheattrs.attrs = memattr; 2742 return false; 2743 } 2744 2745 static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, 2746 target_ulong address, 2747 MMUAccessType access_type, 2748 GetPhysAddrResult *result, 2749 ARMMMUFaultInfo *fi) 2750 { 2751 hwaddr ipa; 2752 int s1_prot, s1_lgpgsz; 2753 bool is_secure = ptw->in_secure; 2754 bool ret, ipa_secure; 2755 ARMCacheAttrs cacheattrs1; 2756 bool is_el0; 2757 uint64_t hcr; 2758 2759 ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi); 2760 2761 /* If S1 fails, return early. */ 2762 if (ret) { 2763 return ret; 2764 } 2765 2766 ipa = result->f.phys_addr; 2767 ipa_secure = result->f.attrs.secure; 2768 2769 is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0; 2770 ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; 2771 ptw->in_secure = ipa_secure; 2772 ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx); 2773 2774 /* 2775 * S1 is done, now do S2 translation. 2776 * Save the stage1 results so that we may merge prot and cacheattrs later. 2777 */ 2778 s1_prot = result->f.prot; 2779 s1_lgpgsz = result->f.lg_page_size; 2780 cacheattrs1 = result->cacheattrs; 2781 memset(result, 0, sizeof(*result)); 2782 2783 if (arm_feature(env, ARM_FEATURE_PMSA)) { 2784 ret = get_phys_addr_pmsav8(env, ipa, access_type, 2785 ptw->in_mmu_idx, is_secure, result, fi); 2786 } else { 2787 ret = get_phys_addr_lpae(env, ptw, ipa, access_type, 2788 is_el0, result, fi); 2789 } 2790 fi->s2addr = ipa; 2791 2792 /* Combine the S1 and S2 perms. */ 2793 result->f.prot &= s1_prot; 2794 2795 /* If S2 fails, return early. */ 2796 if (ret) { 2797 return ret; 2798 } 2799 2800 /* 2801 * If either S1 or S2 returned a result smaller than TARGET_PAGE_SIZE, 2802 * this means "don't put this in the TLB"; in this case, return a 2803 * result with lg_page_size == 0 to achieve that. Otherwise, 2804 * use the maximum of the S1 & S2 page size, so that invalidation 2805 * of pages > TARGET_PAGE_SIZE works correctly. (This works even though 2806 * we know the combined result permissions etc only cover the minimum 2807 * of the S1 and S2 page size, because we know that the common TLB code 2808 * never actually creates TLB entries bigger than TARGET_PAGE_SIZE, 2809 * and passing a larger page size value only affects invalidations.) 2810 */ 2811 if (result->f.lg_page_size < TARGET_PAGE_BITS || 2812 s1_lgpgsz < TARGET_PAGE_BITS) { 2813 result->f.lg_page_size = 0; 2814 } else if (result->f.lg_page_size < s1_lgpgsz) { 2815 result->f.lg_page_size = s1_lgpgsz; 2816 } 2817 2818 /* Combine the S1 and S2 cache attributes. */ 2819 hcr = arm_hcr_el2_eff_secstate(env, is_secure); 2820 if (hcr & HCR_DC) { 2821 /* 2822 * HCR.DC forces the first stage attributes to 2823 * Normal Non-Shareable, 2824 * Inner Write-Back Read-Allocate Write-Allocate, 2825 * Outer Write-Back Read-Allocate Write-Allocate. 2826 * Do not overwrite Tagged within attrs. 2827 */ 2828 if (cacheattrs1.attrs != 0xf0) { 2829 cacheattrs1.attrs = 0xff; 2830 } 2831 cacheattrs1.shareability = 0; 2832 } 2833 result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1, 2834 result->cacheattrs); 2835 2836 /* 2837 * Check if IPA translates to secure or non-secure PA space. 2838 * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA. 2839 */ 2840 result->f.attrs.secure = 2841 (is_secure 2842 && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)) 2843 && (ipa_secure 2844 || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)))); 2845 2846 return false; 2847 } 2848 2849 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, 2850 target_ulong address, 2851 MMUAccessType access_type, 2852 GetPhysAddrResult *result, 2853 ARMMMUFaultInfo *fi) 2854 { 2855 ARMMMUIdx mmu_idx = ptw->in_mmu_idx; 2856 bool is_secure = ptw->in_secure; 2857 ARMMMUIdx s1_mmu_idx; 2858 2859 /* 2860 * The page table entries may downgrade secure to non-secure, but 2861 * cannot upgrade an non-secure translation regime's attributes 2862 * to secure. 2863 */ 2864 result->f.attrs.secure = is_secure; 2865 2866 switch (mmu_idx) { 2867 case ARMMMUIdx_Phys_S: 2868 case ARMMMUIdx_Phys_NS: 2869 /* Checking Phys early avoids special casing later vs regime_el. */ 2870 return get_phys_addr_disabled(env, address, access_type, mmu_idx, 2871 is_secure, result, fi); 2872 2873 case ARMMMUIdx_Stage1_E0: 2874 case ARMMMUIdx_Stage1_E1: 2875 case ARMMMUIdx_Stage1_E1_PAN: 2876 /* First stage lookup uses second stage for ptw. */ 2877 ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; 2878 break; 2879 2880 case ARMMMUIdx_Stage2: 2881 case ARMMMUIdx_Stage2_S: 2882 /* 2883 * Second stage lookup uses physical for ptw; whether this is S or 2884 * NS may depend on the SW/NSW bits if this is a stage 2 lookup for 2885 * the Secure EL2&0 regime. 2886 */ 2887 ptw->in_ptw_idx = ptw_idx_for_stage_2(env, mmu_idx); 2888 break; 2889 2890 case ARMMMUIdx_E10_0: 2891 s1_mmu_idx = ARMMMUIdx_Stage1_E0; 2892 goto do_twostage; 2893 case ARMMMUIdx_E10_1: 2894 s1_mmu_idx = ARMMMUIdx_Stage1_E1; 2895 goto do_twostage; 2896 case ARMMMUIdx_E10_1_PAN: 2897 s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN; 2898 do_twostage: 2899 /* 2900 * Call ourselves recursively to do the stage 1 and then stage 2 2901 * translations if mmu_idx is a two-stage regime, and EL2 present. 2902 * Otherwise, a stage1+stage2 translation is just stage 1. 2903 */ 2904 ptw->in_mmu_idx = mmu_idx = s1_mmu_idx; 2905 if (arm_feature(env, ARM_FEATURE_EL2) && 2906 !regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) { 2907 return get_phys_addr_twostage(env, ptw, address, access_type, 2908 result, fi); 2909 } 2910 /* fall through */ 2911 2912 default: 2913 /* Single stage uses physical for ptw. */ 2914 ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; 2915 break; 2916 } 2917 2918 result->f.attrs.user = regime_is_user(env, mmu_idx); 2919 2920 /* 2921 * Fast Context Switch Extension. This doesn't exist at all in v8. 2922 * In v7 and earlier it affects all stage 1 translations. 2923 */ 2924 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2 2925 && !arm_feature(env, ARM_FEATURE_V8)) { 2926 if (regime_el(env, mmu_idx) == 3) { 2927 address += env->cp15.fcseidr_s; 2928 } else { 2929 address += env->cp15.fcseidr_ns; 2930 } 2931 } 2932 2933 if (arm_feature(env, ARM_FEATURE_PMSA)) { 2934 bool ret; 2935 result->f.lg_page_size = TARGET_PAGE_BITS; 2936 2937 if (arm_feature(env, ARM_FEATURE_V8)) { 2938 /* PMSAv8 */ 2939 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 2940 is_secure, result, fi); 2941 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2942 /* PMSAv7 */ 2943 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 2944 is_secure, result, fi); 2945 } else { 2946 /* Pre-v7 MPU */ 2947 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 2948 is_secure, result, fi); 2949 } 2950 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 2951 " mmu_idx %u -> %s (prot %c%c%c)\n", 2952 access_type == MMU_DATA_LOAD ? "reading" : 2953 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 2954 (uint32_t)address, mmu_idx, 2955 ret ? "Miss" : "Hit", 2956 result->f.prot & PAGE_READ ? 'r' : '-', 2957 result->f.prot & PAGE_WRITE ? 'w' : '-', 2958 result->f.prot & PAGE_EXEC ? 'x' : '-'); 2959 2960 return ret; 2961 } 2962 2963 /* Definitely a real MMU, not an MPU */ 2964 2965 if (regime_translation_disabled(env, mmu_idx, is_secure)) { 2966 return get_phys_addr_disabled(env, address, access_type, mmu_idx, 2967 is_secure, result, fi); 2968 } 2969 2970 if (regime_using_lpae_format(env, mmu_idx)) { 2971 return get_phys_addr_lpae(env, ptw, address, access_type, false, 2972 result, fi); 2973 } else if (arm_feature(env, ARM_FEATURE_V7) || 2974 regime_sctlr(env, mmu_idx) & SCTLR_XP) { 2975 return get_phys_addr_v6(env, ptw, address, access_type, result, fi); 2976 } else { 2977 return get_phys_addr_v5(env, ptw, address, access_type, result, fi); 2978 } 2979 } 2980 2981 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address, 2982 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2983 bool is_secure, GetPhysAddrResult *result, 2984 ARMMMUFaultInfo *fi) 2985 { 2986 S1Translate ptw = { 2987 .in_mmu_idx = mmu_idx, 2988 .in_secure = is_secure, 2989 }; 2990 return get_phys_addr_with_struct(env, &ptw, address, access_type, 2991 result, fi); 2992 } 2993 2994 bool get_phys_addr(CPUARMState *env, target_ulong address, 2995 MMUAccessType access_type, ARMMMUIdx mmu_idx, 2996 GetPhysAddrResult *result, ARMMMUFaultInfo *fi) 2997 { 2998 bool is_secure; 2999 3000 switch (mmu_idx) { 3001 case ARMMMUIdx_E10_0: 3002 case ARMMMUIdx_E10_1: 3003 case ARMMMUIdx_E10_1_PAN: 3004 case ARMMMUIdx_E20_0: 3005 case ARMMMUIdx_E20_2: 3006 case ARMMMUIdx_E20_2_PAN: 3007 case ARMMMUIdx_Stage1_E0: 3008 case ARMMMUIdx_Stage1_E1: 3009 case ARMMMUIdx_Stage1_E1_PAN: 3010 case ARMMMUIdx_E2: 3011 is_secure = arm_is_secure_below_el3(env); 3012 break; 3013 case ARMMMUIdx_Stage2: 3014 case ARMMMUIdx_Phys_NS: 3015 case ARMMMUIdx_MPrivNegPri: 3016 case ARMMMUIdx_MUserNegPri: 3017 case ARMMMUIdx_MPriv: 3018 case ARMMMUIdx_MUser: 3019 is_secure = false; 3020 break; 3021 case ARMMMUIdx_E3: 3022 case ARMMMUIdx_Stage2_S: 3023 case ARMMMUIdx_Phys_S: 3024 case ARMMMUIdx_MSPrivNegPri: 3025 case ARMMMUIdx_MSUserNegPri: 3026 case ARMMMUIdx_MSPriv: 3027 case ARMMMUIdx_MSUser: 3028 is_secure = true; 3029 break; 3030 default: 3031 g_assert_not_reached(); 3032 } 3033 return get_phys_addr_with_secure(env, address, access_type, mmu_idx, 3034 is_secure, result, fi); 3035 } 3036 3037 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 3038 MemTxAttrs *attrs) 3039 { 3040 ARMCPU *cpu = ARM_CPU(cs); 3041 CPUARMState *env = &cpu->env; 3042 S1Translate ptw = { 3043 .in_mmu_idx = arm_mmu_idx(env), 3044 .in_secure = arm_is_secure(env), 3045 .in_debug = true, 3046 }; 3047 GetPhysAddrResult res = {}; 3048 ARMMMUFaultInfo fi = {}; 3049 bool ret; 3050 3051 ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi); 3052 *attrs = res.f.attrs; 3053 3054 if (ret) { 3055 return -1; 3056 } 3057 return res.f.phys_addr; 3058 } 3059