Series comparison

-[Qemu-devel] [PULL 00/20] target-arm queue
+[PULL 00/28] target-arm queue
-Mostly my stuff with a few easy patches from others. I know I have
+Hi; this is the latest target-arm queue; most of this is a refactoring
-a few big series in my to-review queue, but I've been too jetlagged
+patchset from RTH for the arm page-table-walk emulation.
 to try to tackle those :-(
 thanks
 -- PMM
-The following changes since commit a26a98dfb9d448d7234d931ae3720feddf6f0651:
+The following changes since commit f1d33f55c47dfdaf8daacd618588ad3ae4c452d1:
-  Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20171006' into staging (2017-10-06 13:19:03 +0100)
+  Merge tag 'pull-testing-gdbstub-plugins-gitdm-061022-3' of https://github.com/stsquad/qemu into staging (2022-10-06 07:11:56 -0400)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171006
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221010
-for you to fetch changes up to 04829ce334bece78d4fa1d0fdbc8bc27dae9b242:
+for you to fetch changes up to 915f62844cf62e428c7c178149b5ff1cbe129b07:
-  nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit (2017-10-06 16:46:49 +0100)
+  docs/system/arm/emulation.rst: Report FEAT_GTG support (2022-10-10 14:52:25 +0100)
 ----------------------------------------------------------------
-target-arm:
+target-arm queue:
- * v8M: more preparatory work
+ * Retry KVM_CREATE_VM call if it fails EINTR
- * nvic: reset properly rather than leaving the nvic in a weird state
+ * allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented
- * xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
+ * docs/nuvoton: Update URL for images
- * sd: fix out-of-bounds check for multi block reads
+ * refactoring of page table walk code
- * arm: Fix SMC reporting to EL2 when QEMU provides PSCI
+ * hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3
  * Don't allow guest to use unimplemented granule sizes
  * Report FEAT_GTG support
 ----------------------------------------------------------------
-Jan Kiszka (1):
+Jerome Forissier (2):
-      arm: Fix SMC reporting to EL2 when QEMU provides PSCI
+      target/arm: allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented
       hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3
-Michael Olbrich (1):
+Joel Stanley (1):
-      hw/sd: fix out-of-bounds check for multi block reads
+      docs/nuvoton: Update URL for images
-Peter Maydell (17):
+Peter Maydell (4):
-      nvic: Clear the vector arrays and prigroup on reset
+      target/arm/kvm: Retry KVM_CREATE_VM call if it fails EINTR
-      target/arm: Don't switch to target stack early in v7M exception return
+      target/arm: Don't allow guest to use unimplemented granule sizes
-      target/arm: Prepare for CONTROL.SPSEL being nonzero in Handler mode
+      target/arm: Use ARMGranuleSize in ARMVAParameters
-      target/arm: Restore security state on exception return
+      docs/system/arm/emulation.rst: Report FEAT_GTG support
       target/arm: Restore SPSEL to correct CONTROL register on exception return
       target/arm: Check for xPSR mismatch usage faults earlier for v8M
       target/arm: Warn about restoring to unaligned stack
       target/arm: Don't warn about exception return with PC low bit set for v8M
       target/arm: Add new-in-v8M SFSR and SFAR
       target/arm: Update excret sanity checks for v8M
       target/arm: Add support for restoring v8M additional state context
       target/arm: Add v8M support to exception entry code
       nvic: Implement Security Attribution Unit registers
       target/arm: Implement security attribute lookups for memory accesses
       target/arm: Fix calculation of secure mm_idx values
       target/arm: Factor out "get mmuidx for specified security state"
       nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit
-Thomas Huth (1):
+Richard Henderson (21):
-      hw/arm/xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
+      target/arm: Split s2walk_secure from ipa_secure in get_phys_addr
       target/arm: Make the final stage1+2 write to secure be unconditional
       target/arm: Add is_secure parameter to get_phys_addr_lpae
       target/arm: Fix S2 disabled check in S1_ptw_translate
       target/arm: Add is_secure parameter to regime_translation_disabled
       target/arm: Split out get_phys_addr_with_secure
       target/arm: Add is_secure parameter to v7m_read_half_insn
       target/arm: Add TBFLAG_M32.SECURE
       target/arm: Merge regime_is_secure into get_phys_addr
       target/arm: Add is_secure parameter to do_ats_write
       target/arm: Fold secure and non-secure a-profile mmu indexes
       target/arm: Reorg regime_translation_disabled
       target/arm: Drop secure check for HCR.TGE vs SCTLR_EL1.M
       target/arm: Introduce arm_hcr_el2_eff_secstate
       target/arm: Hoist read of *is_secure in S1_ptw_translate
       target/arm: Remove env argument from combined_attrs_fwb
       target/arm: Pass HCR to attribute subroutines.
       target/arm: Fix ATS12NSO* from S PL1
       target/arm: Split out get_phys_addr_disabled
       target/arm: Fix cacheattr in get_phys_addr_disabled
       target/arm: Use tlb_set_page_full
- target/arm/cpu.h       |  60 ++++-
+ docs/system/arm/emulation.rst |   1 +
- target/arm/internals.h |  15 ++
+ docs/system/arm/nuvoton.rst   |   4 +-
- hw/arm/xlnx-zynqmp.c   |   2 +
+ target/arm/cpu-param.h        |   2 +-
- hw/intc/armv7m_nvic.c  | 158 ++++++++++-
+ target/arm/cpu.h              | 181 ++++++++------
- hw/sd/sd.c             |  12 +-
+ target/arm/internals.h        | 150 ++++++-----
- target/arm/cpu.c       |  27 ++
+ hw/arm/boot.c                 |   4 +
- target/arm/helper.c    | 691 +++++++++++++++++++++++++++++++++++++++++++------
+ target/arm/helper.c           | 332 ++++++++++++++----------
- target/arm/machine.c   |  16 ++
+ target/arm/kvm.c              |   4 +-
- target/arm/op_helper.c |  27 +-
+ target/arm/m_helper.c         |  29 ++-
-files changed, 898 insertions(+), 110 deletions(-)
+ target/arm/ptw.c              | 570 ++++++++++++++++++++++--------------------
+ target/arm/tlb_helper.c       |   9 +-
  target/arm/translate-a64.c    |   8 -
  target/arm/translate.c        |   9 +-
 files changed, 717 insertions(+), 586 deletions(-)

-New patch
+[PULL 01/28] target/arm/kvm: Retry KVM_CREATE_VM call if it fails EINTR
+Occasionally the KVM_CREATE_VM ioctl can return EINTR, even though
+there is no pending signal to be taken. In commit 94ccff13382055
+we added a retry-on-EINTR loop to the KVM_CREATE_VM call in the
+generic KVM code. Adopt the same approach for the use of the
+ioctl in the Arm-specific KVM code (where we use it to create a
+scratch VM for probing for various things).
+For more information, see the mailing list thread:
+https://lore.kernel.org/qemu-devel/8735e0s1zw.wl-maz@kernel.org/
+Reported-by: Vitaly Chikunov <vt@altlinux.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Message-id: 20220930113824.1933293-1-peter.maydell@linaro.org
+---
+ target/arm/kvm.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/kvm.c
++++ b/target/arm/kvm.c
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
+     if (max_vm_pa_size < 0) {
+         max_vm_pa_size = 0;
+     }
+-    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
++    do {
++        vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
++    } while (vmfd == -1 && errno == EINTR);
+     if (vmfd < 0) {
+         goto err;
+     }
+--
+.25.1

-[Qemu-devel] [PULL 12/20] target/arm: Add new-in-v8M SFSR and SFAR
+[PULL 02/28] target/arm: allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented
-Add the new M profile Secure Fault Status Register
+From: Jerome Forissier <jerome.forissier@linaro.org>
 and Secure Fault Address Register.
+Updates write_scr() to allow setting SCR_EL3.EnTP2 when FEAT_SME is
+implemented. SCR_EL3 being a 64-bit register, valid_mask is changed
+to uint64_t and the SCR_* constants in target/arm/cpu.h are extended
+to 64-bit so that masking and bitwise not (~) behave as expected.
+This enables booting Linux with Trusted Firmware-A at EL3 with
+"-M virt,secure=on -cpu max".
+Cc: qemu-stable@nongnu.org
+Fixes: 78cb9776662a ("target/arm: Enable SME for -cpu max")
+Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221004072354.27037-1-jerome.forissier@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-10-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      | 12 ++++++++++++
+ target/arm/cpu.h    | 54 ++++++++++++++++++++++-----------------------
- hw/intc/armv7m_nvic.c | 34 ++++++++++++++++++++++++++++++++++
+ target/arm/helper.c |  5 ++++-
- target/arm/machine.c  |  2 ++
+files changed, 31 insertions(+), 28 deletions(-)
 files changed, 48 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
-         uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
-         uint32_t hfsr; /* HardFault Status */
+ #define HPFAR_NS      (1ULL << 63)
-         uint32_t dfsr; /* Debug Fault Status Register */
-+        uint32_t sfsr; /* Secure Fault Status Register */
+-#define SCR_NS                (1U << 0)
-         uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
+-#define SCR_IRQ               (1U << 1)
-         uint32_t bfar; /* BusFault Address */
+-#define SCR_FIQ               (1U << 2)
-+        uint32_t sfar; /* Secure Fault Address Register */
+-#define SCR_EA                (1U << 3)
-         unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
+-#define SCR_FW                (1U << 4)
-         int exception;
+-#define SCR_AW                (1U << 5)
-         uint32_t primask[M_REG_NUM_BANKS];
+-#define SCR_NET               (1U << 6)
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
+-#define SCR_SMD               (1U << 7)
- FIELD(V7M_DFSR, VCATCH, 3, 1)
+-#define SCR_HCE               (1U << 8)
- FIELD(V7M_DFSR, EXTERNAL, 4, 1)
+-#define SCR_SIF               (1U << 9)
+-#define SCR_RW                (1U << 10)
-+/* V7M SFSR bits */
+-#define SCR_ST                (1U << 11)
-+FIELD(V7M_SFSR, INVEP, 0, 1)
+-#define SCR_TWI               (1U << 12)
-+FIELD(V7M_SFSR, INVIS, 1, 1)
+-#define SCR_TWE               (1U << 13)
-+FIELD(V7M_SFSR, INVER, 2, 1)
+-#define SCR_TLOR              (1U << 14)
-+FIELD(V7M_SFSR, AUVIOL, 3, 1)
+-#define SCR_TERR              (1U << 15)
-+FIELD(V7M_SFSR, INVTRAN, 4, 1)
+-#define SCR_APK               (1U << 16)
-+FIELD(V7M_SFSR, LSPERR, 5, 1)
+-#define SCR_API               (1U << 17)
-+FIELD(V7M_SFSR, SFARVALID, 6, 1)
+-#define SCR_EEL2              (1U << 18)
-+FIELD(V7M_SFSR, LSERR, 7, 1)
+-#define SCR_EASE              (1U << 19)
-+
+-#define SCR_NMEA              (1U << 20)
- /* v7M MPU_CTRL bits */
+-#define SCR_FIEN              (1U << 21)
- FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
+-#define SCR_ENSCXT            (1U << 25)
- FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
+-#define SCR_ATA               (1U << 26)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+-#define SCR_FGTEN             (1U << 27)
 -#define SCR_ECVEN             (1U << 28)
 -#define SCR_TWEDEN            (1U << 29)
 +#define SCR_NS                (1ULL << 0)
 +#define SCR_IRQ               (1ULL << 1)
 +#define SCR_FIQ               (1ULL << 2)
 +#define SCR_EA                (1ULL << 3)
 +#define SCR_FW                (1ULL << 4)
 +#define SCR_AW                (1ULL << 5)
 +#define SCR_NET               (1ULL << 6)
 +#define SCR_SMD               (1ULL << 7)
 +#define SCR_HCE               (1ULL << 8)
 +#define SCR_SIF               (1ULL << 9)
 +#define SCR_RW                (1ULL << 10)
 +#define SCR_ST                (1ULL << 11)
 +#define SCR_TWI               (1ULL << 12)
 +#define SCR_TWE               (1ULL << 13)
 +#define SCR_TLOR              (1ULL << 14)
 +#define SCR_TERR              (1ULL << 15)
 +#define SCR_APK               (1ULL << 16)
 +#define SCR_API               (1ULL << 17)
 +#define SCR_EEL2              (1ULL << 18)
 +#define SCR_EASE              (1ULL << 19)
 +#define SCR_NMEA              (1ULL << 20)
 +#define SCR_FIEN              (1ULL << 21)
 +#define SCR_ENSCXT            (1ULL << 25)
 +#define SCR_ATA               (1ULL << 26)
 +#define SCR_FGTEN             (1ULL << 27)
 +#define SCR_ECVEN             (1ULL << 28)
 +#define SCR_TWEDEN            (1ULL << 29)
  #define SCR_TWEDEL            MAKE_64BIT_MASK(30, 4)
  #define SCR_TME               (1ULL << 34)
  #define SCR_AMVOFFEN          (1ULL << 35)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/helper.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
-             goto bad_offset;
+ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
  {
      /* Begin with base v8.0 state.  */
 -    uint32_t valid_mask = 0x3fff;
 +    uint64_t valid_mask = 0x3fff;
      ARMCPU *cpu = env_archcpu(env);
      /*
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
          if (cpu_isar_feature(aa64_doublefault, cpu)) {
              valid_mask |= SCR_EASE | SCR_NMEA;
          }
-         return cpu->env.pmsav8.mair1[attrs.secure];
++        if (cpu_isar_feature(aa64_sme, cpu)) {
-+    case 0xde4: /* SFSR */
++            valid_mask |= SCR_ENTP2;
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
-+        if (!attrs.secure) {
+     } else {
-+            return 0;
+         valid_mask &= ~(SCR_RW | SCR_ST);
-+        }
+         if (cpu_isar_feature(aa32_ras, cpu)) {
 +        return cpu->env.v7m.sfsr;
 +    case 0xde8: /* SFAR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->env.v7m.sfar;
      default:
      bad_offset:
          qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
           * only affect cacheability, and we don't implement caching.
           */
          break;
 +    case 0xde4: /* SFSR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        cpu->env.v7m.sfsr &= ~value; /* W1C */
 +        break;
 +    case 0xde8: /* SFAR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        cpu->env.v7m.sfsr = value;
 +        break;
      case 0xf00: /* Software Triggered Interrupt Register */
      {
          int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
          VMSTATE_UINT32(env.v7m.ccr[M_REG_S], ARMCPU),
          VMSTATE_UINT32(env.v7m.mmfar[M_REG_S], ARMCPU),
          VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
 +        VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
 +        VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
          VMSTATE_END_OF_LIST()
      }
  };
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 10/20] target/arm: Warn about restoring to unaligned stack
+[PULL 03/28] docs/nuvoton: Update URL for images
-Attempting to do an exception return with an exception frame that
+From: Joel Stanley <joel@jms.id.au>
 is not 8-aligned is UNPREDICTABLE in v8M; warn about this.
 (It is not UNPREDICTABLE in v7M, and our implementation can
 handle the merely-4-aligned case fine, so we don't need to
 do anything except warn.)
+openpower.xyz was retired some time ago. The OpenBMC Jenkins is where
+images can be found these days.
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20221004050042.22681-1-joel@jms.id.au
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-8-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 7 +++++++
+ docs/system/arm/nuvoton.rst | 4 ++--
-file changed, 7 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/docs/system/arm/nuvoton.rst
-+++ b/target/arm/helper.c
++++ b/docs/system/arm/nuvoton.rst
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ Boot options
-                                               return_to_sp_process);
-         uint32_t frameptr = *frame_sp_p;
+ The Nuvoton machines can boot from an OpenBMC firmware image, or directly into
+ a kernel using the ``-kernel`` option. OpenBMC images for ``quanta-gsj`` and
-+        if (!QEMU_IS_ALIGNED(frameptr, 8) &&
+-possibly others can be downloaded from the OpenPOWER jenkins :
-+            arm_feature(env, ARM_FEATURE_V8)) {
++possibly others can be downloaded from the OpenBMC jenkins :
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "M profile exception return with non-8-aligned SP "
+-   https://openpower.xyz/
-+                          "for destination state is UNPREDICTABLE\n");
++   https://jenkins.openbmc.org/
-+        }
-+
+ The firmware image should be attached as an MTD drive. Example :
-         /* Pop registers. TODO: make these accesses use the correct
           * attributes and address space (S/NS, priv/unpriv) and handle
           * memory transaction failures.
 --
-.7.4
+.25.1

-New patch
+[PULL 04/28] target/arm: Split s2walk_secure from ipa_secure in get_phys_addr
+From: Richard Henderson <richard.henderson@linaro.org>
+The starting security state comes with the translation regime,
+not the current state of arm_is_secure_below_el3().
+Create a new local variable, s2walk_secure, which does not need
+to be written back to result->attrs.secure -- we compute that
+value later, after the S2 walk is complete.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20221001162318.153420-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 18 +++++++++---------
+file changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+             hwaddr ipa;
+             int s1_prot;
+             int ret;
+-            bool ipa_secure;
++            bool ipa_secure, s2walk_secure;
+             ARMCacheAttrs cacheattrs1;
+             ARMMMUIdx s2_mmu_idx;
+             bool is_el0;
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+             ipa = result->phys;
+             ipa_secure = result->attrs.secure;
+-            if (arm_is_secure_below_el3(env)) {
+-                if (ipa_secure) {
+-                    result->attrs.secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
+-                } else {
+-                    result->attrs.secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
+-                }
++            if (is_secure) {
++                /* Select TCR based on the NS bit from the S1 walk. */
++                s2walk_secure = !(ipa_secure
++                                  ? env->cp15.vstcr_el2 & VSTCR_SW
++                                  : env->cp15.vtcr_el2 & VTCR_NSW);
+             } else {
+                 assert(!ipa_secure);
++                s2walk_secure = false;
+             }
+-            s2_mmu_idx = (result->attrs.secure
++            s2_mmu_idx = (s2walk_secure
+                           ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2);
+             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+                                                     result->cacheattrs);
+             /* Check if IPA translates to secure or non-secure PA space. */
+-            if (arm_is_secure_below_el3(env)) {
++            if (is_secure) {
+                 if (ipa_secure) {
+                     result->attrs.secure =
+                         !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW));
+--
+.25.1

-New patch
+[PULL 05/28] target/arm: Make the final stage1+2 write to secure be unconditional
+From: Richard Henderson <richard.henderson@linaro.org>
+While the stage2 call to get_phys_addr_lpae should never set
+attrs.secure when given a non-secure input, it's just as easy
+to make the final update to attrs.secure be unconditional and
+false in the case of non-secure input.
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221007152159.1414065-1-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 21 ++++++++++-----------
+file changed, 10 insertions(+), 11 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+             result->cacheattrs = combine_cacheattrs(env, cacheattrs1,
+                                                     result->cacheattrs);
+-            /* Check if IPA translates to secure or non-secure PA space. */
+-            if (is_secure) {
+-                if (ipa_secure) {
+-                    result->attrs.secure =
+-                        !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW));
+-                } else {
+-                    result->attrs.secure =
+-                        !((env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))
+-                        || (env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)));
+-                }
+-            }
++            /*
++             * Check if IPA translates to secure or non-secure PA space.
++             * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
++             */
++            result->attrs.secure =
++                (is_secure
++                 && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
++                 && (ipa_secure
++                     || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
++
+             return 0;
+         } else {
+             /*
+--
+.25.1

-[Qemu-devel] [PULL 04/20] nvic: Clear the vector arrays and prigroup on reset
+[PULL 06/28] target/arm: Add is_secure parameter to get_phys_addr_lpae
-Reset for devices does not include an automatic clear of the
+From: Richard Henderson <richard.henderson@linaro.org>
 device state (unlike CPU state, where most of the state
 structure is cleared to zero). Add some missing initialization
 of NVIC state that meant that the device was left in the wrong
 state if the guest did a warm reset.
-(In particular, since we were resetting the computed state like
+Remove the use of regime_is_secure from get_phys_addr_lpae,
-s->exception_prio but not all the state it was computed
+using the new parameter instead.
 from like s->vectors[x].active, the NVIC wound up in an
 inconsistent state that could later trigger assertion failures.)
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1506092407-26985-2-git-send-email-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 5 +++++
+ target/arm/ptw.c | 20 ++++++++++----------
-file changed, 5 insertions(+)
+file changed, 10 insertions(+), 10 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/ptw.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@
-     int resetprio;
-     NVICState *s = NVIC(dev);
+ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-+    memset(s->vectors, 0, sizeof(s->vectors));
+-                               bool s1_is_el0, GetPhysAddrResult *result,
-+    memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
+-                               ARMMMUFaultInfo *fi)
-+    s->prigroup[M_REG_NS] = 0;
++                               bool is_secure, bool s1_is_el0,
-+    s->prigroup[M_REG_S] = 0;
++                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
-+
+     __attribute__((nonnull));
-     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
-     /* MEM, BUS, and USAGE are enabled through
+ /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
-      * the System Handler Control register
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
          GetPhysAddrResult s2 = {};
          int ret;
 -        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx, false,
 -                                 &s2, fi);
 +        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx,
 +                                 *is_secure, false, &s2, fi);
          if (ret) {
              assert(fi->type != ARMFault_None);
              fi->s2addr = addr;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
   */
  static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
 -                               bool s1_is_el0, GetPhysAddrResult *result,
 -                               ARMMMUFaultInfo *fi)
 +                               bool is_secure, bool s1_is_el0,
 +                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
  {
      ARMCPU *cpu = env_archcpu(env);
      /* Read an LPAE long-descriptor translation table. */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
       * remain non-secure. We implement this by just ORing in the NSTable/NS
       * bits at each step.
       */
 -    tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
 +    tableattrs = is_secure ? 0 : (1 << 4);
      for (;;) {
          uint64_t descriptor;
          bool nstable;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              memset(result, 0, sizeof(*result));
              ret = get_phys_addr_lpae(env, ipa, access_type, s2_mmu_idx,
 -                                     is_el0, result, fi);
 +                                     s2walk_secure, is_el0, result, fi);
              fi->s2addr = ipa;
              /* Combine the S1 and S2 perms.  */
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
      }
      if (regime_using_lpae_format(env, mmu_idx)) {
 -        return get_phys_addr_lpae(env, address, access_type, mmu_idx, false,
 -                                  result, fi);
 +        return get_phys_addr_lpae(env, address, access_type, mmu_idx,
 +                                  is_secure, false, result, fi);
      } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
          return get_phys_addr_v6(env, address, access_type, mmu_idx,
                                  is_secure, result, fi);
 --
-.7.4
+.25.1

-New patch
+[PULL 07/28] target/arm: Fix S2 disabled check in S1_ptw_translate
+From: Richard Henderson <richard.henderson@linaro.org>
+Pass the correct stage2 mmu_idx to regime_translation_disabled,
+which we computed afterward.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20221001162318.153420-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+                                hwaddr addr, bool *is_secure,
+                                ARMMMUFaultInfo *fi)
+ {
++    ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
++
+     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
+-        !regime_translation_disabled(env, ARMMMUIdx_Stage2)) {
+-        ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S
+-                                          : ARMMMUIdx_Stage2;
++        !regime_translation_disabled(env, s2_mmu_idx)) {
+         GetPhysAddrResult s2 = {};
+         int ret;
+--
+.25.1

-[Qemu-devel] [PULL 03/20] hw/arm/xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
+[PULL 08/28] target/arm: Add is_secure parameter to regime_translation_disabled
-From: Thomas Huth <thuth@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The device uses serial_hds in its realize function and thus can't be
+Remove the use of regime_is_secure from regime_translation_disabled,
-used twice. Apart from that, the comma in its name makes it quite hard
+using the new parameter instead.
 to use for the user anyway, since a comma is normally used to separate
 the device name from its properties when using the "-device" parameter
 or the "device_add" HMP command.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+This fixes a bug in S1_ptw_translate and get_phys_addr where we had
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+passed ARMMMUIdx_Stage2 and not ARMMMUIdx_Stage2_S to determine if
-Message-id: 1506441116-16627-1-git-send-email-thuth@redhat.com
+Stage2 is disabled, affecting FEAT_SEL2.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20221001162318.153420-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zynqmp.c | 2 ++
+ target/arm/ptw.c | 20 +++++++++++---------
-file changed, 2 insertions(+)
+file changed, 11 insertions(+), 9 deletions(-)
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
+--- a/target/arm/ptw.c
-+++ b/hw/arm/xlnx-zynqmp.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
      dc->props = xlnx_zynqmp_props;
      dc->realize = xlnx_zynqmp_realize;
 +    /* Reason: Uses serial_hds in realize function, thus can't be used twice */
 +    dc->user_creatable = false;
  }
- static const TypeInfo xlnx_zynqmp_type_info = {
+ /* Return true if the specified stage of address translation is disabled */
 -static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx)
 +static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
 +                                        bool is_secure)
  {
      uint64_t hcr_el2;
      if (arm_feature(env, ARM_FEATURE_M)) {
 -        switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
 +        switch (env->v7m.mpu_ctrl[is_secure] &
                  (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
          case R_V7M_MPU_CTRL_ENABLE_MASK:
              /* Enabled, but not for HardFault and NMI */
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx)
      if (hcr_el2 & HCR_TGE) {
          /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
 -        if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
 +        if (!is_secure && regime_el(env, mmu_idx) == 1) {
              return true;
          }
      }
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
      ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
      if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
 -        !regime_translation_disabled(env, s2_mmu_idx)) {
 +        !regime_translation_disabled(env, s2_mmu_idx, *is_secure)) {
          GetPhysAddrResult s2 = {};
          int ret;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
      uint32_t base;
      bool is_user = regime_is_user(env, mmu_idx);
 -    if (regime_translation_disabled(env, mmu_idx)) {
 +    if (regime_translation_disabled(env, mmu_idx, is_secure)) {
          /* MPU disabled.  */
          result->phys = address;
          result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
      result->page_size = TARGET_PAGE_SIZE;
      result->prot = 0;
 -    if (regime_translation_disabled(env, mmu_idx) ||
 +    if (regime_translation_disabled(env, mmu_idx, secure) ||
          m_is_ppb_region(env, address)) {
          /*
           * MPU disabled or M profile PPB access: use default memory map.
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
       * are done in arm_v7m_load_vector(), which always does a direct
       * read using address_space_ldl(), rather than going via this function.
       */
 -    if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
 +    if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */
          hit = true;
      } else if (m_is_ppb_region(env, address)) {
          hit = true;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                                  result, fi);
              /* If S1 fails or S2 is disabled, return early.  */
 -            if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) {
 +            if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2,
 +                                                   is_secure)) {
                  return ret;
              }
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
      /* Definitely a real MMU, not an MPU */
 -    if (regime_translation_disabled(env, mmu_idx)) {
 +    if (regime_translation_disabled(env, mmu_idx, is_secure)) {
          uint64_t hcr;
          uint8_t memattr;
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 08/20] target/arm: Restore SPSEL to correct CONTROL register on exception return
+[PULL 09/28] target/arm: Split out get_phys_addr_with_secure
-On exception return for v8M, the SPSEL bit in the EXC_RETURN magic
+From: Richard Henderson <richard.henderson@linaro.org>
 value should be restored to the SPSEL bit in the CONTROL register
 banked specified by the EXC_RETURN.ES bit.
-Add write_v7m_control_spsel_for_secstate() which behaves like
+Retain the existing get_phys_addr interface using the security
-write_v7m_control_spsel() but allows the caller to specify which
+state derived from mmu_idx.  Move the kerneldoc comments to the
-CONTROL bank to use, reimplement write_v7m_control_spsel() in
+header file where they belong.
 terms of it, and use it in exception return.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-6-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 40 +++++++++++++++++++++++++++-------------
+ target/arm/internals.h | 40 ++++++++++++++++++++++++++++++++++++++
-file changed, 27 insertions(+), 13 deletions(-)
+ target/arm/ptw.c       | 44 ++++++++++++++----------------------------
 files changed, 55 insertions(+), 29 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/internals.h
-+++ b/target/arm/helper.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ typedef struct GetPhysAddrResult {
-         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
+     ARMCacheAttrs cacheattrs;
  } GetPhysAddrResult;
 +/**
 + * get_phys_addr_with_secure: get the physical address for a virtual address
 + * @env: CPUARMState
 + * @address: virtual address to get physical address for
 + * @access_type: 0 for read, 1 for write, 2 for execute
 + * @mmu_idx: MMU index indicating required translation regime
 + * @is_secure: security state for the access
 + * @result: set on translation success.
 + * @fi: set to fault info if the translation fails
 + *
 + * Find the physical address corresponding to the given virtual address,
 + * by doing a translation table walk on MMU based systems or using the
 + * MPU state on MPU based systems.
 + *
 + * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
 + * prot and page_size may not be filled in, and the populated fsr value provides
 + * information on why the translation aborted, in the format of a
 + * DFSR/IFSR fault register, with the following caveats:
 + *  * we honour the short vs long DFSR format differences.
 + *  * the WnR bit is never set (the caller must do this).
 + *  * for PSMAv5 based systems we don't bother to return a full FSR format
 + *    value.
 + */
 +bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
 +                               MMUAccessType access_type,
 +                               ARMMMUIdx mmu_idx, bool is_secure,
 +                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 +    __attribute__((nonnull));
 +
 +/**
 + * get_phys_addr: get the physical address for a virtual address
 + * @env: CPUARMState
 + * @address: virtual address to get physical address for
 + * @access_type: 0 for read, 1 for write, 2 for execute
 + * @mmu_idx: MMU index indicating required translation regime
 + * @result: set on translation success.
 + * @fi: set to fault info if the translation fails
 + *
 + * Similarly, but use the security regime of @mmu_idx.
 + */
  bool get_phys_addr(CPUARMState *env, target_ulong address,
                     MMUAccessType access_type, ARMMMUIdx mmu_idx,
                     GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
      return ret;
  }
--/* Write to v7M CONTROL.SPSEL bit. This may change the current
+-/**
-- * stack pointer between Main and Process stack pointers.
+- * get_phys_addr - get the physical address for this virtual address
-+/* Write to v7M CONTROL.SPSEL bit for the specified security bank.
+- *
-+ * This may change the current stack pointer between Main and Process
+- * Find the physical address corresponding to the given virtual address,
-+ * stack pointers if it is done for the CONTROL register for the current
+- * by doing a translation table walk on MMU based systems or using the
-+ * security state.
+- * MPU state on MPU based systems.
-  */
+- *
--static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+- * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
-+static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
+- * prot and page_size may not be filled in, and the populated fsr value provides
-+                                                 bool new_spsel,
+- * information on why the translation aborted, in the format of a
-+                                                 bool secstate)
+- * DFSR/IFSR fault register, with the following caveats:
 - *  * we honour the short vs long DFSR format differences.
 - *  * the WnR bit is never set (the caller must do this).
 - *  * for PSMAv5 based systems we don't bother to return a full FSR format
 - *    value.
 - *
 - * @env: CPUARMState
 - * @address: virtual address to get physical address for
 - * @access_type: 0 for read, 1 for write, 2 for execute
 - * @mmu_idx: MMU index indicating required translation regime
 - * @result: set on translation success.
 - * @fi: set to fault info if the translation fails
 - */
 -bool get_phys_addr(CPUARMState *env, target_ulong address,
 -                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
 -                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 +bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
 +                               MMUAccessType access_type, ARMMMUIdx mmu_idx,
 +                               bool is_secure, GetPhysAddrResult *result,
 +                               ARMMMUFaultInfo *fi)
  {
--    uint32_t tmp;
+     ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
--    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+-    bool is_secure = regime_is_secure(env, mmu_idx);
-+    bool old_is_psp = v7m_using_psp(env);
+     if (mmu_idx != s1_mmu_idx) {
--    env->v7m.control[env->v7m.secure] =
+         /*
--        deposit32(env->v7m.control[env->v7m.secure],
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-+    env->v7m.control[secstate] =
+             ARMMMUIdx s2_mmu_idx;
-+        deposit32(env->v7m.control[secstate],
+             bool is_el0;
-                   R_V7M_CONTROL_SPSEL_SHIFT,
-                   R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+-            ret = get_phys_addr(env, address, access_type, s1_mmu_idx,
+-                                result, fi);
--    new_is_psp = v7m_using_psp(env);
++            ret = get_phys_addr_with_secure(env, address, access_type,
-+    if (secstate == env->v7m.secure) {
++                                            s1_mmu_idx, is_secure, result, fi);
-+        bool new_is_psp = v7m_using_psp(env);
-+        uint32_t tmp;
+             /* If S1 fails or S2 is disabled, return early.  */
+             if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2,
--    if (old_is_psp != new_is_psp) {
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 -        tmp = env->v7m.other_sp;
 -        env->v7m.other_sp = env->regs[13];
 -        env->regs[13] = tmp;
 +        if (old_is_psp != new_is_psp) {
 +            tmp = env->v7m.other_sp;
 +            env->v7m.other_sp = env->regs[13];
 +            env->regs[13] = tmp;
 +        }
      }
  }
-+/* Write to v7M CONTROL.SPSEL bit. This may change the current
++bool get_phys_addr(CPUARMState *env, target_ulong address,
-+ * stack pointer between Main and Process stack pointers.
++                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
-+ */
++                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 +static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
 +{
-+    write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
++    return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
 +                                     regime_is_secure(env, mmu_idx),
 +                                     result, fi);
 +}
 +
- void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
                                           MemTxAttrs *attrs)
  {
-     /* Write a new value to v7m.exception, thus transitioning into or out
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-      * Handler mode (and will be until we write the new XPSR.Interrupt
-      * field) this does not switch around the current stack pointer.
-      */
--    write_v7m_control_spsel(env, return_to_sp_process);
-+    write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
-     switch_v7m_security_state(env, return_to_secure);
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 01/20] arm: Fix SMC reporting to EL2 when QEMU provides PSCI
+[PULL 10/28] target/arm: Add is_secure parameter to v7m_read_half_insn
-From: Jan Kiszka <jan.kiszka@siemens.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This properly forwards SMC events to EL2 when PSCI is provided by QEMU
+Remove the use of regime_is_secure from v7m_read_half_insn, using
-itself and, thus, ARM_FEATURE_EL3 is off.
+the new parameter instead.
-Found and tested with the Jailhouse hypervisor. Solution based on
+As it happens, both callers pass true, propagated from the argument
-suggestions by Peter Maydell.
+to arm_v7m_mmu_idx_for_secstate which created the mmu_idx argument,
 but that is a detail of v7m_handle_execute_nsc we need not expose
 to the callee.
-Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
-Message-id: 4f243068-aaea-776f-d18f-f9e05e7be9cd@siemens.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c    |  9 ++++++++-
+ target/arm/m_helper.c | 9 ++++-----
- target/arm/op_helper.c | 27 +++++++++++++++++----------
+file changed, 4 insertions(+), 5 deletions(-)
 files changed, 25 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/m_helper.c
-+++ b/target/arm/helper.c
++++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
+     return true;
-     if (arm_feature(env, ARM_FEATURE_EL3)) {
+ }
-         valid_mask &= ~HCR_HCD;
--    } else {
+-static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
-+    } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
++static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
-+        /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
+                                uint32_t addr, uint16_t *insn)
-+         * However, if we're using the SMC PSCI conduit then QEMU is
+ {
-+         * effectively acting like EL3 firmware and so the guest at
+     /*
-+         * EL2 should retain the ability to prevent EL1 from being
+@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
-+         * able to make SMC calls into the ersatz firmware, so in
+     ARMMMUFaultInfo fi = {};
-+         * that case HCR.TSC should be read/write.
+     MemTxResult txres;
-+         */
-         valid_mask &= ~HCR_TSC;
+-    v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx,
 -                        regime_is_secure(env, mmu_idx), &sattrs);
 +    v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, secure, &sattrs);
      if (!sattrs.nsc || sattrs.ns) {
          /*
           * This must be the second half of the insn, and it straddles a
@@ -XXX,XX +XXX,XX @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
      /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
      mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
 -    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
 +    if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15], &insn)) {
          return false;
      }
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
-index XXXXXXX..XXXXXXX 100644
+         goto gen_invep;
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
       */
      bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
 -    if (arm_is_psci_call(cpu, EXCP_SMC)) {
 -        /* If PSCI is enabled and this looks like a valid PSCI call then
 -         * that overrides the architecturally mandated SMC behaviour.
 +    if (!arm_feature(env, ARM_FEATURE_EL3) &&
 +        cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
 +        /* If we have no EL3 then SMC always UNDEFs and can't be
 +         * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
 +         * firmware within QEMU, and we want an EL2 guest to be able
 +         * to forbid its EL1 from making PSCI calls into QEMU's
 +         * "firmware" via HCR.TSC, so for these purposes treat
 +         * PSCI-via-SMC as implying an EL3.
           */
 -        return;
 -    }
 -
 -    if (!arm_feature(env, ARM_FEATURE_EL3)) {
 -        /* If we have no EL3 then SMC always UNDEFs */
          undef = true;
      } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 -        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 +        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
 +         * We also want an EL2 guest to be able to forbid its EL1 from
 +         * making PSCI calls into QEMU's "firmware" via HCR.TSC.
 +         */
          raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
      }
--    if (undef) {
+-    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
-+    /* If PSCI is enabled and this looks like a valid PSCI call then
++    if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15] + 2, &insn)) {
-+     * suppress the UNDEF -- we'll catch the SMC exception and
+         return false;
 +     * implement the PSCI call behaviour there.
 +     */
 +    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
          raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                          exception_target_el(env));
      }
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 16/20] nvic: Implement Security Attribution Unit registers
+[PULL 11/28] target/arm: Add TBFLAG_M32.SECURE
-Implement the register interface for the SAU: SAU_CTRL,
+From: Richard Henderson <richard.henderson@linaro.org>
 SAU_TYPE, SAU_RNR, SAU_RBAR and SAU_RLAR. None of the
 actual behaviour is implemented here; registers just
 read back as written.
-When the CPU definition for Cortex-M33 is eventually
+Remove the use of regime_is_secure from arm_tr_init_disas_context.
-added, its initfn will set cpu->sau_sregion, in the same
+Instead, provide the value of v8m_secure directly from tb_flags.
-way that we currently set cpu->pmsav7_dregion for the
+Rather than use regime_is_secure, use the env->v7m.secure directly,
-M3 and M4.
+as per arm_mmu_idx_el.
-Number of SAU regions is typically a configurable
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-CPU parameter, but this patch doesn't provide a
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-QEMU CPU property for it. We can easily add one when
+Message-id: 20221001162318.153420-8-richard.henderson@linaro.org
 we have a board that requires it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-14-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  10 +++++
+ target/arm/cpu.h       | 2 ++
- hw/intc/armv7m_nvic.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/helper.c    | 4 ++++
- target/arm/cpu.c      |  27 ++++++++++++
+ target/arm/translate.c | 3 +--
- target/arm/machine.c  |  14 ++++++
+files changed, 7 insertions(+), 2 deletions(-)
 files changed, 167 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_M32, NEW_FP_CTXT_NEEDED, 3, 1)     /* Not cached. */
-         uint32_t mair1[M_REG_NUM_BANKS];
+ FIELD(TBFLAG_M32, FPCCR_S_WRONG, 4, 1)          /* Not cached. */
-     } pmsav8;
+ /* Set if MVE insns are definitely not predicated by VPR or LTPSIZE */
+ FIELD(TBFLAG_M32, MVE_NO_PRED, 5, 1)            /* Not cached. */
-+    /* v8M SAU */
++/* Set if in secure mode */
-+    struct {
++FIELD(TBFLAG_M32, SECURE, 6, 1)
-+        uint32_t *rbar;
-+        uint32_t *rlar;
+ /*
-+        uint32_t rnr;
+  * Bit usage when in AArch64 state
-+        uint32_t ctrl;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 +    } sau;
 +
      void *nvic;
      const struct arm_boot_info *boot_info;
      /* Store GICv3CPUState to access from this struct */
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      bool has_mpu;
      /* PMSAv7 MPU number of supported regions */
      uint32_t pmsav7_dregion;
 +    /* v8M SAU number of supported regions */
 +    uint32_t sau_sregion;
      /* PSCI conduit used to invoke PSCI methods
       * 0 - disabled, 1 - smc, 2 - hvc
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/helper.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
-             goto bad_offset;
+         DP_TBFLAG_M32(flags, STACKCHECK, 1);
          }
          return cpu->env.pmsav8.mair1[attrs.secure];
 +    case 0xdd0: /* SAU_CTRL */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->env.sau.ctrl;
 +    case 0xdd4: /* SAU_TYPE */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->sau_sregion;
 +    case 0xdd8: /* SAU_RNR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->env.sau.rnr;
 +    case 0xddc: /* SAU_RBAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return 0;
 +        }
 +        return cpu->env.sau.rbar[region];
 +    }
 +    case 0xde0: /* SAU_RLAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return 0;
 +        }
 +        return cpu->env.sau.rlar[region];
 +    }
      case 0xde4: /* SFSR */
          if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
              goto bad_offset;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
           * only affect cacheability, and we don't implement caching.
           */
          break;
 +    case 0xdd0: /* SAU_CTRL */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        cpu->env.sau.ctrl = value & 3;
 +    case 0xdd4: /* SAU_TYPE */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        break;
 +    case 0xdd8: /* SAU_RNR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        if (value >= cpu->sau_sregion) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
 +                          PRIu32 "/%" PRIu32 "\n",
 +                          value, cpu->sau_sregion);
 +        } else {
 +            cpu->env.sau.rnr = value;
 +        }
 +        break;
 +    case 0xddc: /* SAU_RBAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return;
 +        }
 +        cpu->env.sau.rbar[region] = value & ~0x1f;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
 +    case 0xde0: /* SAU_RLAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return;
 +        }
 +        cpu->env.sau.rlar[region] = value & ~0x1c;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
      case 0xde4: /* SFSR */
          if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
              goto bad_offset;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
          env->pmsav8.mair1[M_REG_S] = 0;
      }
-+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++    if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
-+        if (cpu->sau_sregion > 0) {
++        DP_TBFLAG_M32(flags, SECURE, 1);
 +            memset(env->sau.rbar, 0, sizeof(*env->sau.rbar) * cpu->sau_sregion);
 +            memset(env->sau.rlar, 0, sizeof(*env->sau.rlar) * cpu->sau_sregion);
 +        }
 +        env->sau.rnr = 0;
 +        /* SAU_CTRL reset value is IMPDEF; we choose 0, which is what
 +         * the Cortex-M33 does.
 +         */
 +        env->sau.ctrl = 0;
 +    }
 +
-     set_flush_to_zero(1, &env->vfp.standard_fp_status);
+     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
      set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
      set_default_nan_mode(1, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          }
      }
 +    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +        uint32_t nr = cpu->sau_sregion;
 +
 +        if (nr > 0xff) {
 +            error_setg(errp, "v8M SAU #regions invalid %" PRIu32, nr);
 +            return;
 +        }
 +
 +        if (nr) {
 +            env->sau.rbar = g_new0(uint32_t, nr);
 +            env->sau.rlar = g_new0(uint32_t, nr);
 +        }
 +    }
 +
      if (arm_feature(env, ARM_FEATURE_EL3)) {
          set_feature(env, ARM_FEATURE_VBAR);
      }
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      cpu->midr = 0x410fc240; /* r0p0 */
      cpu->pmsav7_dregion = 8;
  }
-+
- static void arm_v7m_class_init(ObjectClass *oc, void *data)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
  {
      CPUClass *cc = CPU_CLASS(oc);
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/target/arm/translate.c
-+++ b/target/arm/machine.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static bool s_rnr_vmstate_validate(void *opaque, int version_id)
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     return cpu->env.pmsav7.rnr[M_REG_S] < cpu->pmsav7_dregion;
+         dc->vfp_enabled = 1;
- }
+         dc->be_data = MO_TE;
+         dc->v7m_handler_mode = EX_TBFLAG_M32(tb_flags, HANDLER);
-+static bool sau_rnr_vmstate_validate(void *opaque, int version_id)
+-        dc->v8m_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
-+{
+-            regime_is_secure(env, dc->mmu_idx);
-+    ARMCPU *cpu = opaque;
++        dc->v8m_secure = EX_TBFLAG_M32(tb_flags, SECURE);
-+
+         dc->v8m_stackcheck = EX_TBFLAG_M32(tb_flags, STACKCHECK);
-+    return cpu->env.sau.rnr < cpu->sau_sregion;
+         dc->v8m_fpccr_s_wrong = EX_TBFLAG_M32(tb_flags, FPCCR_S_WRONG);
-+}
+         dc->v7m_new_fp_ctxt_needed =
 +
  static bool m_security_needed(void *opaque)
  {
      ARMCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
          VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
          VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
          VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
 +        VMSTATE_VARRAY_UINT32(env.sau.rbar, ARMCPU, sau_sregion, 0,
 +                              vmstate_info_uint32, uint32_t),
 +        VMSTATE_VARRAY_UINT32(env.sau.rlar, ARMCPU, sau_sregion, 0,
 +                              vmstate_info_uint32, uint32_t),
 +        VMSTATE_UINT32(env.sau.rnr, ARMCPU),
 +        VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
 +        VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
          VMSTATE_END_OF_LIST()
      }
  };
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 15/20] target/arm: Add v8M support to exception entry code
+[PULL 12/28] target/arm: Merge regime_is_secure into get_phys_addr
-Add support for v8M and in particular the security extension
+From: Richard Henderson <richard.henderson@linaro.org>
 to the exception entry code. This requires changes to:
  * calculation of the exception-return magic LR value
  * push the callee-saves registers in certain cases
  * clear registers when taking non-secure exceptions to avoid
    leaking information from the interrupted secure code
  * switch to the correct security state on entry
  * use the vector table for the security state we're targeting
+This is the last use of regime_is_secure; remove it
+entirely before changing the layout of ARMMMUIdx.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-13-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 165 +++++++++++++++++++++++++++++++++++++++++++++-------
+ target/arm/internals.h | 42 ----------------------------------------
-file changed, 145 insertions(+), 20 deletions(-)
+ target/arm/ptw.c       | 44 ++++++++++++++++++++++++++++++++++++++++--
 files changed, 42 insertions(+), 44 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/internals.h
-+++ b/target/arm/helper.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
      }
  }
--static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
+-/* Return true if this address translation regime is secure */
-+static uint32_t arm_v7m_load_vector(ARMCPU *cpu, bool targets_secure)
+-static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
 -{
 -    switch (mmu_idx) {
 -    case ARMMMUIdx_E10_0:
 -    case ARMMMUIdx_E10_1:
 -    case ARMMMUIdx_E10_1_PAN:
 -    case ARMMMUIdx_E20_0:
 -    case ARMMMUIdx_E20_2:
 -    case ARMMMUIdx_E20_2_PAN:
 -    case ARMMMUIdx_Stage1_E0:
 -    case ARMMMUIdx_Stage1_E1:
 -    case ARMMMUIdx_Stage1_E1_PAN:
 -    case ARMMMUIdx_E2:
 -    case ARMMMUIdx_Stage2:
 -    case ARMMMUIdx_MPrivNegPri:
 -    case ARMMMUIdx_MUserNegPri:
 -    case ARMMMUIdx_MPriv:
 -    case ARMMMUIdx_MUser:
 -        return false;
 -    case ARMMMUIdx_SE3:
 -    case ARMMMUIdx_SE10_0:
 -    case ARMMMUIdx_SE10_1:
 -    case ARMMMUIdx_SE10_1_PAN:
 -    case ARMMMUIdx_SE20_0:
 -    case ARMMMUIdx_SE20_2:
 -    case ARMMMUIdx_SE20_2_PAN:
 -    case ARMMMUIdx_Stage1_SE0:
 -    case ARMMMUIdx_Stage1_SE1:
 -    case ARMMMUIdx_Stage1_SE1_PAN:
 -    case ARMMMUIdx_SE2:
 -    case ARMMMUIdx_Stage2_S:
 -    case ARMMMUIdx_MSPrivNegPri:
 -    case ARMMMUIdx_MSUserNegPri:
 -    case ARMMMUIdx_MSPriv:
 -    case ARMMMUIdx_MSUser:
 -        return true;
 -    default:
 -        g_assert_not_reached();
 -    }
 -}
 -
  static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
-     CPUState *cs = CPU(cpu);
+     switch (mmu_idx) {
-     CPUARMState *env = &cpu->env;
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-     MemTxResult result;
+index XXXXXXX..XXXXXXX 100644
--    hwaddr vec = env->v7m.vecbase[env->v7m.secure] + env->v7m.exception * 4;
+--- a/target/arm/ptw.c
-+    hwaddr vec = env->v7m.vecbase[targets_secure] + env->v7m.exception * 4;
++++ b/target/arm/ptw.c
-     uint32_t addr;
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
-     addr = address_space_ldl(cs->as, vec,
+                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
-@@ -XXX,XX +XXX,XX @@ static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
+ {
-          * Since we don't model Lockup, we just report this guest error
++    bool is_secure;
-          * via cpu_abort().
++
-          */
++    switch (mmu_idx) {
--        cpu_abort(cs, "Failed to read from exception vector table "
++    case ARMMMUIdx_E10_0:
--                  "entry %08x\n", (unsigned)vec);
++    case ARMMMUIdx_E10_1:
-+        cpu_abort(cs, "Failed to read from %s exception vector table "
++    case ARMMMUIdx_E10_1_PAN:
-+                  "entry %08x\n", targets_secure ? "secure" : "nonsecure",
++    case ARMMMUIdx_E20_0:
-+                  (unsigned)vec);
++    case ARMMMUIdx_E20_2:
-     }
++    case ARMMMUIdx_E20_2_PAN:
-     return addr;
++    case ARMMMUIdx_Stage1_E0:
 +    case ARMMMUIdx_Stage1_E1:
 +    case ARMMMUIdx_Stage1_E1_PAN:
 +    case ARMMMUIdx_E2:
 +    case ARMMMUIdx_Stage2:
 +    case ARMMMUIdx_MPrivNegPri:
 +    case ARMMMUIdx_MUserNegPri:
 +    case ARMMMUIdx_MPriv:
 +    case ARMMMUIdx_MUser:
 +        is_secure = false;
 +        break;
 +    case ARMMMUIdx_SE3:
 +    case ARMMMUIdx_SE10_0:
 +    case ARMMMUIdx_SE10_1:
 +    case ARMMMUIdx_SE10_1_PAN:
 +    case ARMMMUIdx_SE20_0:
 +    case ARMMMUIdx_SE20_2:
 +    case ARMMMUIdx_SE20_2_PAN:
 +    case ARMMMUIdx_Stage1_SE0:
 +    case ARMMMUIdx_Stage1_SE1:
 +    case ARMMMUIdx_Stage1_SE1_PAN:
 +    case ARMMMUIdx_SE2:
 +    case ARMMMUIdx_Stage2_S:
 +    case ARMMMUIdx_MSPrivNegPri:
 +    case ARMMMUIdx_MSUserNegPri:
 +    case ARMMMUIdx_MSPriv:
 +    case ARMMMUIdx_MSUser:
 +        is_secure = true;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
      return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
 -                                     regime_is_secure(env, mmu_idx),
 -                                     result, fi);
 +                                     is_secure, result, fi);
  }
--static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
+ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
 +static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain)
 +{
 +    /* For v8M, push the callee-saves register part of the stack frame.
 +     * Compare the v8M pseudocode PushCalleeStack().
 +     * In the tailchaining case this may not be the current stack.
 +     */
 +    CPUARMState *env = &cpu->env;
 +    CPUState *cs = CPU(cpu);
 +    uint32_t *frame_sp_p;
 +    uint32_t frameptr;
 +
 +    if (dotailchain) {
 +        frame_sp_p = get_v7m_sp_ptr(env, true,
 +                                    lr & R_V7M_EXCRET_MODE_MASK,
 +                                    lr & R_V7M_EXCRET_SPSEL_MASK);
 +    } else {
 +        frame_sp_p = &env->regs[13];
 +    }
 +
 +    frameptr = *frame_sp_p - 0x28;
 +
 +    stl_phys(cs->as, frameptr, 0xfefa125b);
 +    stl_phys(cs->as, frameptr + 0x8, env->regs[4]);
 +    stl_phys(cs->as, frameptr + 0xc, env->regs[5]);
 +    stl_phys(cs->as, frameptr + 0x10, env->regs[6]);
 +    stl_phys(cs->as, frameptr + 0x14, env->regs[7]);
 +    stl_phys(cs->as, frameptr + 0x18, env->regs[8]);
 +    stl_phys(cs->as, frameptr + 0x1c, env->regs[9]);
 +    stl_phys(cs->as, frameptr + 0x20, env->regs[10]);
 +    stl_phys(cs->as, frameptr + 0x24, env->regs[11]);
 +
 +    *frame_sp_p = frameptr;
 +}
 +
 +static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)
  {
      /* Do the "take the exception" parts of exception entry,
       * but not the pushing of state to the stack. This is
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
       */
      CPUARMState *env = &cpu->env;
      uint32_t addr;
 +    bool targets_secure;
 +
 +    targets_secure = armv7m_nvic_acknowledge_irq(env->nvic);
 -    armv7m_nvic_acknowledge_irq(env->nvic);
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
 +            (lr & R_V7M_EXCRET_S_MASK)) {
 +            /* The background code (the owner of the registers in the
 +             * exception frame) is Secure. This means it may either already
 +             * have or now needs to push callee-saves registers.
 +             */
 +            if (targets_secure) {
 +                if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
 +                    /* We took an exception from Secure to NonSecure
 +                     * (which means the callee-saved registers got stacked)
 +                     * and are now tailchaining to a Secure exception.
 +                     * Clear DCRS so eventual return from this Secure
 +                     * exception unstacks the callee-saved registers.
 +                     */
 +                    lr &= ~R_V7M_EXCRET_DCRS_MASK;
 +                }
 +            } else {
 +                /* We're going to a non-secure exception; push the
 +                 * callee-saves registers to the stack now, if they're
 +                 * not already saved.
 +                 */
 +                if (lr & R_V7M_EXCRET_DCRS_MASK &&
 +                    !(dotailchain && (lr & R_V7M_EXCRET_ES_MASK))) {
 +                    v7m_push_callee_stack(cpu, lr, dotailchain);
 +                }
 +                lr |= R_V7M_EXCRET_DCRS_MASK;
 +            }
 +        }
 +
 +        lr &= ~R_V7M_EXCRET_ES_MASK;
 +        if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +            lr |= R_V7M_EXCRET_ES_MASK;
 +        }
 +        lr &= ~R_V7M_EXCRET_SPSEL_MASK;
 +        if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
 +            lr |= R_V7M_EXCRET_SPSEL_MASK;
 +        }
 +
 +        /* Clear registers if necessary to prevent non-secure exception
 +         * code being able to see register values from secure code.
 +         * Where register values become architecturally UNKNOWN we leave
 +         * them with their previous values.
 +         */
 +        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +            if (!targets_secure) {
 +                /* Always clear the caller-saved registers (they have been
 +                 * pushed to the stack earlier in v7m_push_stack()).
 +                 * Clear callee-saved registers if the background code is
 +                 * Secure (in which case these regs were saved in
 +                 * v7m_push_callee_stack()).
 +                 */
 +                int i;
 +
 +                for (i = 0; i < 13; i++) {
 +                    /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
 +                    if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
 +                        env->regs[i] = 0;
 +                    }
 +                }
 +                /* Clear EAPSR */
 +                xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
 +            }
 +        }
 +    }
 +
 +    /* Switch to target security state -- must do this before writing SPSEL */
 +    switch_v7m_security_state(env, targets_secure);
      write_v7m_control_spsel(env, 0);
      arm_clear_exclusive(env);
      /* Clear IT bits */
      env->condexec_bits = 0;
      env->regs[14] = lr;
 -    addr = arm_v7m_load_vector(cpu);
 +    addr = arm_v7m_load_vector(cpu, targets_secure);
      env->regs[15] = addr & 0xfffffffe;
      env->thumb = addr & 1;
  }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      if (sfault) {
          env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 -        v7m_exception_taken(cpu, excret);
 +        v7m_exception_taken(cpu, excret, true);
          qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                        "stackframe: failed EXC_RETURN.ES validity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
           */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
 -        v7m_exception_taken(cpu, excret);
 +        v7m_exception_taken(cpu, excret, true);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                        "stackframe: failed exception return integrity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                  /* Take a SecureFault on the current stack */
                  env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
                  armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 -                v7m_exception_taken(cpu, excret);
 +                v7m_exception_taken(cpu, excret, true);
                  qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                                "stackframe: failed exception return integrity "
                                "signature check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                  armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                          env->v7m.secure);
                  env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
 -                v7m_exception_taken(cpu, excret);
 +                v7m_exception_taken(cpu, excret, true);
                  qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                                "stackframe: failed exception return integrity "
                                "check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          v7m_push_stack(cpu);
 -        v7m_exception_taken(cpu, excret);
 +        v7m_exception_taken(cpu, excret, false);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                        "failed exception return integrity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          return; /* Never happens.  Keep compiler happy.  */
      }
 -    lr = R_V7M_EXCRET_RES1_MASK |
 -        R_V7M_EXCRET_S_MASK |
 -        R_V7M_EXCRET_DCRS_MASK |
 -        R_V7M_EXCRET_FTYPE_MASK |
 -        R_V7M_EXCRET_ES_MASK;
 -    if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
 -        lr |= R_V7M_EXCRET_SPSEL_MASK;
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        lr = R_V7M_EXCRET_RES1_MASK |
 +            R_V7M_EXCRET_DCRS_MASK |
 +            R_V7M_EXCRET_FTYPE_MASK;
 +        /* The S bit indicates whether we should return to Secure
 +         * or NonSecure (ie our current state).
 +         * The ES bit indicates whether we're taking this exception
 +         * to Secure or NonSecure (ie our target state). We set it
 +         * later, in v7m_exception_taken().
 +         * The SPSEL bit is also set in v7m_exception_taken() for v8M.
 +         * This corresponds to the ARM ARM pseudocode for v8M setting
 +         * some LR bits in PushStack() and some in ExceptionTaken();
 +         * the distinction matters for the tailchain cases where we
 +         * can take an exception without pushing the stack.
 +         */
 +        if (env->v7m.secure) {
 +            lr |= R_V7M_EXCRET_S_MASK;
 +        }
 +    } else {
 +        lr = R_V7M_EXCRET_RES1_MASK |
 +            R_V7M_EXCRET_S_MASK |
 +            R_V7M_EXCRET_DCRS_MASK |
 +            R_V7M_EXCRET_FTYPE_MASK |
 +            R_V7M_EXCRET_ES_MASK;
 +        if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
 +            lr |= R_V7M_EXCRET_SPSEL_MASK;
 +        }
      }
      if (!arm_v7m_is_handler_mode(env)) {
          lr |= R_V7M_EXCRET_MODE_MASK;
      }
      v7m_push_stack(cpu);
 -    v7m_exception_taken(cpu, lr);
 +    v7m_exception_taken(cpu, lr, false);
      qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
  }
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 13/20] target/arm: Update excret sanity checks for v8M
+[PULL 13/28] target/arm: Add is_secure parameter to do_ats_write
-In v8M, more bits are defined in the exception-return magic
+From: Richard Henderson <richard.henderson@linaro.org>
 values; update the code that checks these so we accept
 the v8M values when the CPU permits them.
+Use get_phys_addr_with_secure directly.  For a-profile, this is the
+one place where the value of is_secure may not equal arm_is_secure(env).
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-11-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 73 ++++++++++++++++++++++++++++++++++++++++++-----------
+ target/arm/helper.c | 19 ++++++++++++++-----
-file changed, 58 insertions(+), 15 deletions(-)
+file changed, 14 insertions(+), 5 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
-     uint32_t excret;
-     uint32_t xpsr;
+ #ifdef CONFIG_TCG
-     bool ufault = false;
+ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
--    bool return_to_sp_process = false;
+-                             MMUAccessType access_type, ARMMMUIdx mmu_idx)
--    bool return_to_handler = false;
++                             MMUAccessType access_type, ARMMMUIdx mmu_idx,
-+    bool sfault = false;
++                             bool is_secure)
-+    bool return_to_sp_process;
+ {
-+    bool return_to_handler;
+     bool ret;
-     bool rettobase = false;
+     uint64_t par64;
-     bool exc_secure = false;
+@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-     bool return_to_secure;
+     ARMMMUFaultInfo fi = {};
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+     GetPhysAddrResult res = {};
-                       excret);
-     }
+-    ret = get_phys_addr(env, value, access_type, mmu_idx, &res, &fi);
++    ret = get_phys_addr_with_secure(env, value, access_type, mmu_idx,
-+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++                                    is_secure, &res, &fi);
-+        /* EXC_RETURN.ES validation check (R_SMFL). We must do this before
-+         * we pick which FAULTMASK to clear.
+     /*
-+         */
+      * ATS operations only do S1 or S1+S2 translations, so we never
-+        if (!env->v7m.secure &&
+@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-+            ((excret & R_V7M_EXCRET_ES_MASK) ||
+         switch (el) {
-+             !(excret & R_V7M_EXCRET_DCRS_MASK))) {
+         case 3:
-+            sfault = 1;
+             mmu_idx = ARMMMUIdx_SE3;
-+            /* For all other purposes, treat ES as 0 (R_HXSR) */
++            secure = true;
-+            excret &= ~R_V7M_EXCRET_ES_MASK;
+             break;
-+        }
+         case 2:
-+    }
+             g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
-+
+@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
+         switch (el) {
-         /* Auto-clear FAULTMASK on return from other than NMI.
+         case 3:
-          * If the security extension is implemented then this only
+             mmu_idx = ARMMMUIdx_SE10_0;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++            secure = true;
              break;
          case 2:
              g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
      case 4:
          /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
          mmu_idx = ARMMMUIdx_E10_1;
 +        secure = false;
          break;
      case 6:
          /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
          mmu_idx = ARMMMUIdx_E10_0;
 +        secure = false;
          break;
      default:
          g_assert_not_reached();
      }
-+    return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
+-    par64 = do_ats_write(env, value, access_type, mmu_idx);
-+    return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
++    par64 = do_ats_write(env, value, access_type, mmu_idx, secure);
-     return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
-         (excret & R_V7M_EXCRET_S_MASK);
+     A32_BANKED_CURRENT_REG_SET(env, par, par64);
+ #else
--    switch (excret & 0xf) {
+@@ -XXX,XX +XXX,XX @@ static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
--    case 1: /* Return to Handler */
+     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
--        return_to_handler = true;
+     uint64_t par64;
--        break;
--    case 13: /* Return to Thread using Process stack */
+-    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2);
--        return_to_sp_process = true;
++    /* There is no SecureEL2 for AArch32. */
--        /* fall through */
++    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2, false);
--    case 9: /* Return to Thread using Main stack */
--        if (!rettobase &&
+     A32_BANKED_CURRENT_REG_SET(env, par, par64);
--            !(env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_NONBASETHRDENA_MASK)) {
+ #else
-+    if (arm_feature(env, ARM_FEATURE_V8)) {
+@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
-+        if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+             break;
-+            /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
+         case 6: /* AT S1E3R, AT S1E3W */
-+             * we choose to take the UsageFault.
+             mmu_idx = ARMMMUIdx_SE3;
-+             */
++            secure = true;
-+            if ((excret & R_V7M_EXCRET_S_MASK) ||
+             break;
-+                (excret & R_V7M_EXCRET_ES_MASK) ||
+         default:
-+                !(excret & R_V7M_EXCRET_DCRS_MASK)) {
+             g_assert_not_reached();
-+                ufault = true;
+@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
-+            }
+         g_assert_not_reached();
 +        }
 +        if (excret & R_V7M_EXCRET_RES0_MASK) {
              ufault = true;
          }
 -        break;
 -    default:
 -        ufault = true;
 +    } else {
 +        /* For v7M we only recognize certain combinations of the low bits */
 +        switch (excret & 0xf) {
 +        case 1: /* Return to Handler */
 +            break;
 +        case 13: /* Return to Thread using Process stack */
 +        case 9: /* Return to Thread using Main stack */
 +            /* We only need to check NONBASETHRDENA for v7M, because in
 +             * v8M this bit does not exist (it is RES1).
 +             */
 +            if (!rettobase &&
 +                !(env->v7m.ccr[env->v7m.secure] &
 +                  R_V7M_CCR_NONBASETHRDENA_MASK)) {
 +                ufault = true;
 +            }
 +            break;
 +        default:
 +            ufault = true;
 +        }
 +    }
 +
 +    if (sfault) {
 +        env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +        v7m_exception_taken(cpu, excret);
 +        qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
 +                      "stackframe: failed EXC_RETURN.ES validity check\n");
 +        return;
      }
-     if (ufault) {
+-    env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
 +    env->cp15.par_el[1] = do_ats_write(env, value, access_type,
 +                                       mmu_idx, secure);
  #else
      /* Handled by hardware accelerator. */
      g_assert_not_reached();
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 07/20] target/arm: Restore security state on exception return
+[PULL 14/28] target/arm: Fold secure and non-secure a-profile mmu indexes
-Now that we can handle the CONTROL.SPSEL bit not necessarily being
+From: Richard Henderson <richard.henderson@linaro.org>
 in sync with the current stack pointer, we can restore the correct
 security state on exception return. This happens before we start
 to read registers off the stack frame, but after we have taken
 possible usage faults for bad exception return magic values and
 updated CONTROL.SPSEL.
+For a-profile aarch64, which does not bank system registers, it takes
+quite a lot of code to switch between security states.  In the process,
+registers such as TCR_EL{1,2} must be swapped, which in itself requires
+the flushing of softmmu tlbs.  Therefore it doesn't buy us anything to
+separate tlbs by security state.
+Retain the distinction between Stage2 and Stage2_S.
+This will be important as we implement FEAT_RME, and do not wish to
+add a third set of mmu indexes for Realm state.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-5-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 2 ++
+ target/arm/cpu-param.h     |   2 +-
-file changed, 2 insertions(+)
+ target/arm/cpu.h           |  72 +++++++------------
  target/arm/internals.h     |  31 +-------
  target/arm/helper.c        | 144 +++++++++++++------------------------
  target/arm/ptw.c           |  25 ++-----
  target/arm/translate-a64.c |   8 ---
  target/arm/translate.c     |   6 +-
 files changed, 85 insertions(+), 203 deletions(-)
+diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-param.h
++++ b/target/arm/cpu-param.h
+@@ -XXX,XX +XXX,XX @@
+ # define TARGET_PAGE_BITS_MIN  10
+ #endif
+-#define NB_MMU_MODES 15
++#define NB_MMU_MODES 8
+ #endif
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
+  *     table over and over.
+  *  6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access
+  *     Never (PAN) bit within PSTATE.
++ *  7. we fold together the secure and non-secure regimes for A-profile,
++ *     because there are no banked system registers for aarch64, so the
++ *     process of switching between secure and non-secure is
++ *     already heavyweight.
+  *
+  * This gives us the following list of cases:
+  *
+- * NS EL0 EL1&0 stage 1+2 (aka NS PL0)
+- * NS EL1 EL1&0 stage 1+2 (aka NS PL1)
+- * NS EL1 EL1&0 stage 1+2 +PAN
+- * NS EL0 EL2&0
+- * NS EL2 EL2&0
+- * NS EL2 EL2&0 +PAN
+- * NS EL2 (aka NS PL2)
+- * S EL0 EL1&0 (aka S PL0)
+- * S EL1 EL1&0 (not used if EL3 is 32 bit)
+- * S EL1 EL1&0 +PAN
+- * S EL3 (aka S PL1)
++ * EL0 EL1&0 stage 1+2 (aka NS PL0)
++ * EL1 EL1&0 stage 1+2 (aka NS PL1)
++ * EL1 EL1&0 stage 1+2 +PAN
++ * EL0 EL2&0
++ * EL2 EL2&0
++ * EL2 EL2&0 +PAN
++ * EL2 (aka NS PL2)
++ * EL3 (aka S PL1)
+  *
+- * for a total of 11 different mmu_idx.
++ * for a total of 8 different mmu_idx.
+  *
+  * R profile CPUs have an MPU, but can use the same set of MMU indexes
+- * as A profile. They only need to distinguish NS EL0 and NS EL1 (and
+- * NS EL2 if we ever model a Cortex-R52).
++ * as A profile. They only need to distinguish EL0 and EL1 (and
++ * EL2 if we ever model a Cortex-R52).
+  *
+  * M profile CPUs are rather different as they do not have a true MMU.
+  * They have the following different MMU indexes:
+@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
+ #define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
+ #define ARM_MMU_IDX_M     0x40  /* M profile */
+-/* Meanings of the bits for A profile mmu idx values */
+-#define ARM_MMU_IDX_A_NS     0x8
+-
+ /* Meanings of the bits for M profile mmu idx values */
+ #define ARM_MMU_IDX_M_PRIV   0x1
+ #define ARM_MMU_IDX_M_NEGPRI 0x2
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
+     /*
+      * A-profile.
+      */
+-    ARMMMUIdx_SE10_0     =  0 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE20_0     =  1 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE10_1     =  2 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE20_2     =  3 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE10_1_PAN =  4 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE20_2_PAN =  5 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE2        =  6 | ARM_MMU_IDX_A,
+-    ARMMMUIdx_SE3        =  7 | ARM_MMU_IDX_A,
+-
+-    ARMMMUIdx_E10_0     = ARMMMUIdx_SE10_0 | ARM_MMU_IDX_A_NS,
+-    ARMMMUIdx_E20_0     = ARMMMUIdx_SE20_0 | ARM_MMU_IDX_A_NS,
+-    ARMMMUIdx_E10_1     = ARMMMUIdx_SE10_1 | ARM_MMU_IDX_A_NS,
+-    ARMMMUIdx_E20_2     = ARMMMUIdx_SE20_2 | ARM_MMU_IDX_A_NS,
+-    ARMMMUIdx_E10_1_PAN = ARMMMUIdx_SE10_1_PAN | ARM_MMU_IDX_A_NS,
+-    ARMMMUIdx_E20_2_PAN = ARMMMUIdx_SE20_2_PAN | ARM_MMU_IDX_A_NS,
+-    ARMMMUIdx_E2        = ARMMMUIdx_SE2 | ARM_MMU_IDX_A_NS,
++    ARMMMUIdx_E10_0     = 0 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E20_0     = 1 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E10_1     = 2 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E20_2     = 3 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E10_1_PAN = 4 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E20_2_PAN = 5 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
++    ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
+     /*
+      * These are not allocated TLBs and are used only for AT system
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
+     ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
+     ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
+     ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
+-    ARMMMUIdx_Stage1_SE0 = 3 | ARM_MMU_IDX_NOTLB,
+-    ARMMMUIdx_Stage1_SE1 = 4 | ARM_MMU_IDX_NOTLB,
+-    ARMMMUIdx_Stage1_SE1_PAN = 5 | ARM_MMU_IDX_NOTLB,
+     /*
+      * Not allocated a TLB: used only for second stage of an S12 page
+      * table walk, or for descriptor loads during first stage of an S1
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
+      * then various TLB flush insns which currently are no-ops or flush
+      * only stage 1 MMU indexes will need to change to flush stage 2.
+      */
+-    ARMMMUIdx_Stage2     = 6 | ARM_MMU_IDX_NOTLB,
+-    ARMMMUIdx_Stage2_S   = 7 | ARM_MMU_IDX_NOTLB,
++    ARMMMUIdx_Stage2     = 3 | ARM_MMU_IDX_NOTLB,
++    ARMMMUIdx_Stage2_S   = 4 | ARM_MMU_IDX_NOTLB,
+     /*
+      * M-profile.
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
+     TO_CORE_BIT(E2),
+     TO_CORE_BIT(E20_2),
+     TO_CORE_BIT(E20_2_PAN),
+-    TO_CORE_BIT(SE10_0),
+-    TO_CORE_BIT(SE20_0),
+-    TO_CORE_BIT(SE10_1),
+-    TO_CORE_BIT(SE20_2),
+-    TO_CORE_BIT(SE10_1_PAN),
+-    TO_CORE_BIT(SE20_2_PAN),
+-    TO_CORE_BIT(SE2),
+-    TO_CORE_BIT(SE3),
++    TO_CORE_BIT(E3),
+     TO_CORE_BIT(MUser),
+     TO_CORE_BIT(MPriv),
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
+     case ARMMMUIdx_Stage1_E0:
+     case ARMMMUIdx_Stage1_E1:
+     case ARMMMUIdx_Stage1_E1_PAN:
+-    case ARMMMUIdx_Stage1_SE0:
+-    case ARMMMUIdx_Stage1_SE1:
+-    case ARMMMUIdx_Stage1_SE1_PAN:
+     case ARMMMUIdx_E10_0:
+     case ARMMMUIdx_E10_1:
+     case ARMMMUIdx_E10_1_PAN:
+     case ARMMMUIdx_E20_0:
+     case ARMMMUIdx_E20_2:
+     case ARMMMUIdx_E20_2_PAN:
+-    case ARMMMUIdx_SE10_0:
+-    case ARMMMUIdx_SE10_1:
+-    case ARMMMUIdx_SE10_1_PAN:
+-    case ARMMMUIdx_SE20_0:
+-    case ARMMMUIdx_SE20_2:
+-    case ARMMMUIdx_SE20_2_PAN:
+         return true;
+     default:
+         return false;
+@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
+ {
+     switch (mmu_idx) {
+     case ARMMMUIdx_Stage1_E1_PAN:
+-    case ARMMMUIdx_Stage1_SE1_PAN:
+     case ARMMMUIdx_E10_1_PAN:
+     case ARMMMUIdx_E20_2_PAN:
+-    case ARMMMUIdx_SE10_1_PAN:
+-    case ARMMMUIdx_SE20_2_PAN:
+         return true;
+     default:
+         return false;
+@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
+ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
+ {
+     switch (mmu_idx) {
+-    case ARMMMUIdx_SE20_0:
+-    case ARMMMUIdx_SE20_2:
+-    case ARMMMUIdx_SE20_2_PAN:
+     case ARMMMUIdx_E20_0:
+     case ARMMMUIdx_E20_2:
+     case ARMMMUIdx_E20_2_PAN:
+     case ARMMMUIdx_Stage2:
+     case ARMMMUIdx_Stage2_S:
+-    case ARMMMUIdx_SE2:
+     case ARMMMUIdx_E2:
+         return 2;
+-    case ARMMMUIdx_SE3:
++    case ARMMMUIdx_E3:
+         return 3;
+-    case ARMMMUIdx_SE10_0:
+-    case ARMMMUIdx_Stage1_SE0:
+-        return arm_el_is_aa64(env, 3) ? 1 : 3;
+-    case ARMMMUIdx_SE10_1:
+-    case ARMMMUIdx_SE10_1_PAN:
++    case ARMMMUIdx_E10_0:
+     case ARMMMUIdx_Stage1_E0:
++        return arm_el_is_aa64(env, 3) || !arm_is_secure_below_el3(env) ? 1 : 3;
+     case ARMMMUIdx_Stage1_E1:
+     case ARMMMUIdx_Stage1_E1_PAN:
+-    case ARMMMUIdx_Stage1_SE1:
+-    case ARMMMUIdx_Stage1_SE1_PAN:
+-    case ARMMMUIdx_E10_0:
+     case ARMMMUIdx_E10_1:
+     case ARMMMUIdx_E10_1_PAN:
+     case ARMMMUIdx_MPrivNegPri:
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)
+     case ARMMMUIdx_Stage1_E0:
+     case ARMMMUIdx_Stage1_E1:
+     case ARMMMUIdx_Stage1_E1_PAN:
+-    case ARMMMUIdx_Stage1_SE0:
+-    case ARMMMUIdx_Stage1_SE1:
+-    case ARMMMUIdx_Stage1_SE1_PAN:
+         return true;
+     default:
+         return false;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
      /* Begin with base v8.0 state.  */
      uint64_t valid_mask = 0x3fff;
      ARMCPU *cpu = env_archcpu(env);
 +    uint64_t changed;
      /*
       * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
      /* Clear all-context RES0 bits.  */
      value &= valid_mask;
 -    raw_write(env, ri, value);
 +    changed = env->cp15.scr_el3 ^ value;
 +    env->cp15.scr_el3 = value;
 +
 +    /*
 +     * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then
 +     * we must invalidate all TLBs below EL3.
 +     */
 +    if (changed & SCR_NS) {
 +        tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
 +                                           ARMMMUIdxBit_E20_0 |
 +                                           ARMMMUIdxBit_E10_1 |
 +                                           ARMMMUIdxBit_E20_2 |
 +                                           ARMMMUIdxBit_E10_1_PAN |
 +                                           ARMMMUIdxBit_E20_2_PAN |
 +                                           ARMMMUIdxBit_E2));
 +    }
  }
  static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static int gt_phys_redir_timeridx(CPUARMState *env)
      case ARMMMUIdx_E20_0:
      case ARMMMUIdx_E20_2:
      case ARMMMUIdx_E20_2_PAN:
 -    case ARMMMUIdx_SE20_0:
 -    case ARMMMUIdx_SE20_2:
 -    case ARMMMUIdx_SE20_2_PAN:
          return GTIMER_HYP;
      default:
          return GTIMER_PHYS;
@@ -XXX,XX +XXX,XX @@ static int gt_virt_redir_timeridx(CPUARMState *env)
      case ARMMMUIdx_E20_0:
      case ARMMMUIdx_E20_2:
      case ARMMMUIdx_E20_2_PAN:
 -    case ARMMMUIdx_SE20_0:
 -    case ARMMMUIdx_SE20_2:
 -    case ARMMMUIdx_SE20_2_PAN:
          return GTIMER_HYPVIRT;
      default:
          return GTIMER_VIRT;
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
          /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */
          switch (el) {
          case 3:
 -            mmu_idx = ARMMMUIdx_SE3;
 +            mmu_idx = ARMMMUIdx_E3;
              secure = true;
              break;
          case 2:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
              /* fall through */
          case 1:
              if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
 -                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
 -                           : ARMMMUIdx_Stage1_E1_PAN);
 +                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
              } else {
 -                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
 +                mmu_idx = ARMMMUIdx_Stage1_E1;
              }
              break;
          default:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
          /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
          switch (el) {
          case 3:
 -            mmu_idx = ARMMMUIdx_SE10_0;
 +            mmu_idx = ARMMMUIdx_E10_0;
              secure = true;
              break;
          case 2:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
              mmu_idx = ARMMMUIdx_Stage1_E0;
              break;
          case 1:
 -            mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
 +            mmu_idx = ARMMMUIdx_Stage1_E0;
              break;
          default:
              g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
          switch (ri->opc1) {
          case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
              if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
 -                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
 -                           : ARMMMUIdx_Stage1_E1_PAN);
 +                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
              } else {
 -                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
 +                mmu_idx = ARMMMUIdx_Stage1_E1;
              }
              break;
          case 4: /* AT S1E2R, AT S1E2W */
 -            mmu_idx = secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2;
 +            mmu_idx = ARMMMUIdx_E2;
              break;
          case 6: /* AT S1E3R, AT S1E3W */
 -            mmu_idx = ARMMMUIdx_SE3;
 +            mmu_idx = ARMMMUIdx_E3;
              secure = true;
              break;
          default:
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
          }
          break;
      case 2: /* AT S1E0R, AT S1E0W */
 -        mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
 +        mmu_idx = ARMMMUIdx_Stage1_E0;
          break;
      case 4: /* AT S12E1R, AT S12E1W */
 -        mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1;
 +        mmu_idx = ARMMMUIdx_E10_1;
          break;
      case 6: /* AT S12E0R, AT S12E0W */
 -        mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0;
 +        mmu_idx = ARMMMUIdx_E10_0;
          break;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
          uint16_t mask = ARMMMUIdxBit_E20_2 |
                          ARMMMUIdxBit_E20_2_PAN |
                          ARMMMUIdxBit_E20_0;
 -
 -        if (arm_is_secure_below_el3(env)) {
 -            mask >>= ARM_MMU_IDX_A_NS;
 -        }
 -
          tlb_flush_by_mmuidx(env_cpu(env), mask);
      }
      raw_write(env, ri, value);
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
          uint16_t mask = ARMMMUIdxBit_E10_1 |
                          ARMMMUIdxBit_E10_1_PAN |
                          ARMMMUIdxBit_E10_0;
 -
 -        if (arm_is_secure_below_el3(env)) {
 -            mask >>= ARM_MMU_IDX_A_NS;
 -        }
 -
          tlb_flush_by_mmuidx(cs, mask);
          raw_write(env, ri, value);
      }
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
                 ARMMMUIdxBit_E10_1_PAN |
                 ARMMMUIdxBit_E10_0;
      }
 -
 -    if (arm_is_secure_below_el3(env)) {
 -        mask >>= ARM_MMU_IDX_A_NS;
 -    }
 -
      return mask;
  }
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbbits(CPUARMState *env, uint64_t addr)
          mmu_idx = ARMMMUIdx_E10_0;
      }
 -    if (arm_is_secure_below_el3(env)) {
 -        mmu_idx &= ~ARM_MMU_IDX_A_NS;
 -    }
 -
      return tlbbits_for_regime(env, mmu_idx, addr);
  }
@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)
       * stage 2 translations, whereas most other scopes only invalidate
       * stage 1 translations.
       */
-     write_v7m_control_spsel(env, return_to_sp_process);
+-    if (arm_is_secure_below_el3(env)) {
+-        return ARMMMUIdxBit_SE10_1 |
-+    switch_v7m_security_state(env, return_to_secure);
+-               ARMMMUIdxBit_SE10_1_PAN |
-+
+-               ARMMMUIdxBit_SE10_0;
-     {
+-    } else {
-         /* The stack pointer we should be reading the exception frame from
+-        return ARMMMUIdxBit_E10_1 |
-          * depends on bits in the magic exception return type value (and
+-               ARMMMUIdxBit_E10_1_PAN |
 -               ARMMMUIdxBit_E10_0;
 -    }
 +    return (ARMMMUIdxBit_E10_1 |
 +            ARMMMUIdxBit_E10_1_PAN |
 +            ARMMMUIdxBit_E10_0);
  }
  static int e2_tlbmask(CPUARMState *env)
  {
 -    if (arm_is_secure_below_el3(env)) {
 -        return ARMMMUIdxBit_SE20_0 |
 -               ARMMMUIdxBit_SE20_2 |
 -               ARMMMUIdxBit_SE20_2_PAN |
 -               ARMMMUIdxBit_SE2;
 -    } else {
 -        return ARMMMUIdxBit_E20_0 |
 -               ARMMMUIdxBit_E20_2 |
 -               ARMMMUIdxBit_E20_2_PAN |
 -               ARMMMUIdxBit_E2;
 -    }
 +    return (ARMMMUIdxBit_E20_0 |
 +            ARMMMUIdxBit_E20_2 |
 +            ARMMMUIdxBit_E20_2_PAN |
 +            ARMMMUIdxBit_E2);
  }
  static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
      ARMCPU *cpu = env_archcpu(env);
      CPUState *cs = CPU(cpu);
 -    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_SE3);
 +    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3);
  }
  static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = env_cpu(env);
 -    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_SE3);
 +    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E3);
  }
  static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
      CPUState *cs = CPU(cpu);
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_SE3);
 +    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E3);
  }
  static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = env_cpu(env);
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
 -    bool secure = arm_is_secure_below_el3(env);
 -    int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
 -    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2,
 -                                  pageaddr);
 +    int bits = tlbbits_for_regime(env, ARMMMUIdx_E2, pageaddr);
 -    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
 +    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
 +                                                  ARMMMUIdxBit_E2, bits);
  }
  static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = env_cpu(env);
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
 -    int bits = tlbbits_for_regime(env, ARMMMUIdx_SE3, pageaddr);
 +    int bits = tlbbits_for_regime(env, ARMMMUIdx_E3, pageaddr);
      tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                                  ARMMMUIdxBit_SE3, bits);
 +                                                  ARMMMUIdxBit_E3, bits);
  }
  #ifdef TARGET_AARCH64
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_rvae1is_write(CPUARMState *env,
  static int vae2_tlbmask(CPUARMState *env)
  {
 -    return (arm_is_secure_below_el3(env)
 -            ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2);
 +    return ARMMMUIdxBit_E2;
  }
  static void tlbi_aa64_rvae2_write(CPUARMState *env,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_rvae3_write(CPUARMState *env,
       * flush-last-level-only.
       */
 -    do_rvae_write(env, value, ARMMMUIdxBit_SE3,
 -                  tlb_force_broadcast(env));
 +    do_rvae_write(env, value, ARMMMUIdxBit_E3, tlb_force_broadcast(env));
  }
  static void tlbi_aa64_rvae3is_write(CPUARMState *env,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_rvae3is_write(CPUARMState *env,
       * flush-last-level-only or inner/outer specific flushes.
       */
 -    do_rvae_write(env, value, ARMMMUIdxBit_SE3, true);
 +    do_rvae_write(env, value, ARMMMUIdxBit_E3, true);
  }
  #endif
@@ -XXX,XX +XXX,XX @@ uint64_t arm_sctlr(CPUARMState *env, int el)
      /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */
      if (el == 0) {
          ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0);
 -        el = (mmu_idx == ARMMMUIdx_E20_0 || mmu_idx == ARMMMUIdx_SE20_0)
 -             ? 2 : 1;
 +        el = mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1;
      }
      return env->cp15.sctlr_el[el];
  }
@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
      switch (mmu_idx) {
      case ARMMMUIdx_E10_0:
      case ARMMMUIdx_E20_0:
 -    case ARMMMUIdx_SE10_0:
 -    case ARMMMUIdx_SE20_0:
          return 0;
      case ARMMMUIdx_E10_1:
      case ARMMMUIdx_E10_1_PAN:
 -    case ARMMMUIdx_SE10_1:
 -    case ARMMMUIdx_SE10_1_PAN:
          return 1;
      case ARMMMUIdx_E2:
      case ARMMMUIdx_E20_2:
      case ARMMMUIdx_E20_2_PAN:
 -    case ARMMMUIdx_SE2:
 -    case ARMMMUIdx_SE20_2:
 -    case ARMMMUIdx_SE20_2_PAN:
          return 2;
 -    case ARMMMUIdx_SE3:
 +    case ARMMMUIdx_E3:
          return 3;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
          }
          break;
      case 3:
 -        return ARMMMUIdx_SE3;
 +        return ARMMMUIdx_E3;
      default:
          g_assert_not_reached();
      }
 -    if (arm_is_secure_below_el3(env)) {
 -        idx &= ~ARM_MMU_IDX_A_NS;
 -    }
 -
      return idx;
  }
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
          switch (mmu_idx) {
          case ARMMMUIdx_E10_1:
          case ARMMMUIdx_E10_1_PAN:
 -        case ARMMMUIdx_SE10_1:
 -        case ARMMMUIdx_SE10_1_PAN:
              /* TODO: ARMv8.3-NV */
              DP_TBFLAG_A64(flags, UNPRIV, 1);
              break;
          case ARMMMUIdx_E20_2:
          case ARMMMUIdx_E20_2_PAN:
 -        case ARMMMUIdx_SE20_2:
 -        case ARMMMUIdx_SE20_2_PAN:
              /*
               * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
               * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu)
  ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
  {
      switch (mmu_idx) {
 -    case ARMMMUIdx_SE10_0:
 -        return ARMMMUIdx_Stage1_SE0;
 -    case ARMMMUIdx_SE10_1:
 -        return ARMMMUIdx_Stage1_SE1;
 -    case ARMMMUIdx_SE10_1_PAN:
 -        return ARMMMUIdx_Stage1_SE1_PAN;
      case ARMMMUIdx_E10_0:
          return ARMMMUIdx_Stage1_E0;
      case ARMMMUIdx_E10_1:
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
  static bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
      switch (mmu_idx) {
 -    case ARMMMUIdx_SE10_0:
      case ARMMMUIdx_E20_0:
 -    case ARMMMUIdx_SE20_0:
      case ARMMMUIdx_Stage1_E0:
 -    case ARMMMUIdx_Stage1_SE0:
      case ARMMMUIdx_MUser:
      case ARMMMUIdx_MSUser:
      case ARMMMUIdx_MUserNegPri:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
              s2_mmu_idx = (s2walk_secure
                            ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2);
 -            is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
 +            is_el0 = mmu_idx == ARMMMUIdx_E10_0;
              /*
               * S1 is done, now do S2 translation.
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
      case ARMMMUIdx_Stage1_E1:
      case ARMMMUIdx_Stage1_E1_PAN:
      case ARMMMUIdx_E2:
 +        is_secure = arm_is_secure_below_el3(env);
 +        break;
      case ARMMMUIdx_Stage2:
      case ARMMMUIdx_MPrivNegPri:
      case ARMMMUIdx_MUserNegPri:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
      case ARMMMUIdx_MUser:
          is_secure = false;
          break;
 -    case ARMMMUIdx_SE3:
 -    case ARMMMUIdx_SE10_0:
 -    case ARMMMUIdx_SE10_1:
 -    case ARMMMUIdx_SE10_1_PAN:
 -    case ARMMMUIdx_SE20_0:
 -    case ARMMMUIdx_SE20_2:
 -    case ARMMMUIdx_SE20_2_PAN:
 -    case ARMMMUIdx_Stage1_SE0:
 -    case ARMMMUIdx_Stage1_SE1:
 -    case ARMMMUIdx_Stage1_SE1_PAN:
 -    case ARMMMUIdx_SE2:
 +    case ARMMMUIdx_E3:
      case ARMMMUIdx_Stage2_S:
      case ARMMMUIdx_MSPrivNegPri:
      case ARMMMUIdx_MSUserNegPri:
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static int get_a64_user_mem_index(DisasContext *s)
          case ARMMMUIdx_E20_2_PAN:
              useridx = ARMMMUIdx_E20_0;
              break;
 -        case ARMMMUIdx_SE10_1:
 -        case ARMMMUIdx_SE10_1_PAN:
 -            useridx = ARMMMUIdx_SE10_0;
 -            break;
 -        case ARMMMUIdx_SE20_2:
 -        case ARMMMUIdx_SE20_2_PAN:
 -            useridx = ARMMMUIdx_SE20_0;
 -            break;
          default:
              g_assert_not_reached();
          }
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
       *  otherwise, access as if at PL0.
       */
      switch (s->mmu_idx) {
 +    case ARMMMUIdx_E3:
      case ARMMMUIdx_E2:        /* this one is UNPREDICTABLE */
      case ARMMMUIdx_E10_0:
      case ARMMMUIdx_E10_1:
      case ARMMMUIdx_E10_1_PAN:
          return arm_to_core_mmu_idx(ARMMMUIdx_E10_0);
 -    case ARMMMUIdx_SE3:
 -    case ARMMMUIdx_SE10_0:
 -    case ARMMMUIdx_SE10_1:
 -    case ARMMMUIdx_SE10_1_PAN:
 -        return arm_to_core_mmu_idx(ARMMMUIdx_SE10_0);
      case ARMMMUIdx_MUser:
      case ARMMMUIdx_MPriv:
          return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
 --
-.7.4
+.25.1

-New patch
+[PULL 15/28] target/arm: Reorg regime_translation_disabled
+From: Richard Henderson <richard.henderson@linaro.org>
+Use a switch on mmu_idx for the a-profile indexes, instead of
+three different if's vs regime_el and arm_mmu_idx_is_stage1_of_2.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 32 +++++++++++++++++++++++++-------
+file changed, 25 insertions(+), 7 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
+     hcr_el2 = arm_hcr_el2_eff(env);
+-    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
++    switch (mmu_idx) {
++    case ARMMMUIdx_Stage2:
++    case ARMMMUIdx_Stage2_S:
+         /* HCR.DC means HCR.VM behaves as 1 */
+         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
+-    }
+-    if (hcr_el2 & HCR_TGE) {
++    case ARMMMUIdx_E10_0:
++    case ARMMMUIdx_E10_1:
++    case ARMMMUIdx_E10_1_PAN:
+         /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
+-        if (!is_secure && regime_el(env, mmu_idx) == 1) {
++        if (!is_secure && (hcr_el2 & HCR_TGE)) {
+             return true;
+         }
+-    }
++        break;
+-    if ((hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
++    case ARMMMUIdx_Stage1_E0:
++    case ARMMMUIdx_Stage1_E1:
++    case ARMMMUIdx_Stage1_E1_PAN:
+         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
+-        return true;
++        if (hcr_el2 & HCR_DC) {
++            return true;
++        }
++        break;
++
++    case ARMMMUIdx_E20_0:
++    case ARMMMUIdx_E20_2:
++    case ARMMMUIdx_E20_2_PAN:
++    case ARMMMUIdx_E2:
++    case ARMMMUIdx_E3:
++        break;
++
++    default:
++        g_assert_not_reached();
+     }
+     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
+--
+.25.1

-New patch
+[PULL 16/28] target/arm: Drop secure check for HCR.TGE vs SCTLR_EL1.M
+From: Richard Henderson <richard.henderson@linaro.org>
+The effect of TGE does not only apply to non-secure state,
+now that Secure EL2 exists.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-13-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
+     case ARMMMUIdx_E10_0:
+     case ARMMMUIdx_E10_1:
+     case ARMMMUIdx_E10_1_PAN:
+-        /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
+-        if (!is_secure && (hcr_el2 & HCR_TGE)) {
++        /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
++        if (hcr_el2 & HCR_TGE) {
+             return true;
+         }
+         break;
+--
+.25.1

-[Qemu-devel] [PULL 06/20] target/arm: Prepare for CONTROL.SPSEL being nonzero in Handler mode
+[PULL 17/28] target/arm: Introduce arm_hcr_el2_eff_secstate
-In the v7M architecture, there is an invariant that if the CPU is
+From: Richard Henderson <richard.henderson@linaro.org>
 in Handler mode then the CONTROL.SPSEL bit cannot be nonzero.
 This in turn means that the current stack pointer is always
 indicated by CONTROL.SPSEL, even though Handler mode always uses
 the Main stack pointer.
-In v8M, this invariant is removed, and CONTROL.SPSEL may now
+For page walking, we may require HCR for a security state
-be nonzero in Handler mode (though Handler mode still always
+that is not "current".
 uses the Main stack pointer). In preparation for this change,
 change how we handle this bit: rename switch_v7m_sp() to
 the now more accurate write_v7m_control_spsel(), and make it
 check both the handler mode state and the SPSEL bit.
-Note that this implicitly changes the point at which we switch
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-active SP on exception exit from before we pop the exception
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-frame to after it.
+Message-id: 20221001162318.153420-14-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-4-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  8 ++++++-
+ target/arm/cpu.h    | 20 +++++++++++++-------
- hw/intc/armv7m_nvic.c |  2 +-
+ target/arm/helper.c | 11 ++++++++---
- target/arm/helper.c   | 65 ++++++++++++++++++++++++++++++++++-----------------
+files changed, 21 insertions(+), 10 deletions(-)
 files changed, 51 insertions(+), 24 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ void pmccntr_sync(CPUARMState *env);
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
- #define PSTATE_MODE_EL1t 4
+  * Return true if the current security state has AArch64 EL2 or AArch32 Hyp.
- #define PSTATE_MODE_EL0t 0
+  * This corresponds to the pseudocode EL2Enabled()
+  */
-+/* Write a new value to v7m.exception, thus transitioning into or out
++static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)
-+ * of Handler mode; this may result in a change of active stack pointer.
++{
-+ */
++    return arm_feature(env, ARM_FEATURE_EL2)
-+void write_v7m_exception(CPUARMState *env, uint32_t new_exc);
++           && (!secure || (env->cp15.scr_el3 & SCR_EEL2));
 +}
 +
- /* Map EL and handler into a PSTATE_MODE.  */
+ static inline bool arm_is_el2_enabled(CPUARMState *env)
  static inline unsigned int aarch64_pstate_mode(unsigned int el, bool handler)
  {
-@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+-    if (arm_feature(env, ARM_FEATURE_EL2)) {
-         env->condexec_bits |= (val >> 8) & 0xfc;
+-        if (arm_is_secure_below_el3(env)) {
-     }
+-            return (env->cp15.scr_el3 & SCR_EEL2) != 0;
-     if (mask & XPSR_EXCP) {
+-        }
--        env->v7m.exception = val & XPSR_EXCP;
+-        return true;
-+        /* Note that this only happens on exception exit */
+-    }
-+        write_v7m_exception(env, val & XPSR_EXCP);
+-    return false;
-     }
++    return arm_is_el2_enabled_secstate(env, arm_is_secure_below_el3(env));
  }
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+ #else
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
---- a/hw/intc/armv7m_nvic.c
+     return false;
-+++ b/hw/intc/armv7m_nvic.c
+ }
-@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_acknowledge_irq(void *opaque)
-     vec->active = 1;
++static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)
-     vec->pending = 0;
++{
++    return false;
--    env->v7m.exception = s->vectpending;
++}
-+    write_v7m_exception(env, s->vectpending);
++
+ static inline bool arm_is_el2_enabled(CPUARMState *env)
-     nvic_irq_update(s);
+ {
      return false;
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
   * "for all purposes other than a direct read or write access of HCR_EL2."
   * Not included here is HCR_RW.
   */
 +uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure);
  uint64_t arm_hcr_el2_eff(CPUARMState *env);
  uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
          env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
  }
--/* Switch to V7M main or process stack pointer.  */
+ /*
--static void switch_v7m_sp(CPUARMState *env, bool new_spsel)
+- * Return the effective value of HCR_EL2.
-+/* Write to v7M CONTROL.SPSEL bit. This may change the current
++ * Return the effective value of HCR_EL2, at the given security state.
-+ * stack pointer between Main and Process stack pointers.
+  * Bits that are not included here:
-+ */
+  * RW       (read from SCR_EL3.RW as needed)
-+static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+  */
 -uint64_t arm_hcr_el2_eff(CPUARMState *env)
 +uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
  {
-     uint32_t tmp;
+     uint64_t ret = env->cp15.hcr_el2;
--    uint32_t old_control = env->v7m.control[env->v7m.secure];
--    bool old_spsel = old_control & R_V7M_CONTROL_SPSEL_MASK;
+-    if (!arm_is_el2_enabled(env)) {
-+    bool new_is_psp, old_is_psp = v7m_using_psp(env);
++    if (!arm_is_el2_enabled_secstate(env, secure)) {
-+
+         /*
-+    env->v7m.control[env->v7m.secure] =
+          * "This register has no effect if EL2 is not enabled in the
-+        deposit32(env->v7m.control[env->v7m.secure],
+          * current Security state".  This is ARMv8.4-SecEL2 speak for
-+                  R_V7M_CONTROL_SPSEL_SHIFT,
+@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)
-+                  R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+     return ret;
-+
+ }
-+    new_is_psp = v7m_using_psp(env);
++uint64_t arm_hcr_el2_eff(CPUARMState *env)
--    if (old_spsel != new_spsel) {
++{
-+    if (old_is_psp != new_is_psp) {
++    return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
          tmp = env->v7m.other_sp;
          env->v7m.other_sp = env->regs[13];
          env->regs[13] = tmp;
 +    }
 +}
 +
-+void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+ /*
-+{
+  * Corresponds to ARM pseudocode function ELIsInHost().
-+    /* Write a new value to v7m.exception, thus transitioning into or out
+  */
 +     * of Handler mode; this may result in a change of active stack pointer.
 +     */
 +    bool new_is_psp, old_is_psp = v7m_using_psp(env);
 +    uint32_t tmp;
 -        env->v7m.control[env->v7m.secure] = deposit32(old_control,
 -                                     R_V7M_CONTROL_SPSEL_SHIFT,
 -                                     R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
 +    env->v7m.exception = new_exc;
 +
 +    new_is_psp = v7m_using_psp(env);
 +
 +    if (old_is_psp != new_is_psp) {
 +        tmp = env->v7m.other_sp;
 +        env->v7m.other_sp = env->regs[13];
 +        env->regs[13] = tmp;
      }
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
      bool want_psp = threadmode && spsel;
      if (secure == env->v7m.secure) {
 -        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
 -         * so the SP we want is always in regs[13].
 -         * When we decouple SPSEL from the actually selected SP
 -         * we need to check want_psp against v7m_using_psp()
 -         * to see whether we need regs[13] or v7m.other_sp.
 -         */
 -        return &env->regs[13];
 +        if (want_psp == v7m_using_psp(env)) {
 +            return &env->regs[13];
 +        } else {
 +            return &env->v7m.other_sp;
 +        }
      } else {
          if (want_psp) {
              return &env->v7m.other_ss_psp;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
      uint32_t addr;
      armv7m_nvic_acknowledge_irq(env->nvic);
 -    switch_v7m_sp(env, 0);
 +    write_v7m_control_spsel(env, 0);
      arm_clear_exclusive(env);
      /* Clear IT bits */
      env->condexec_bits = 0;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          return;
      }
 -    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
 -     * causes us to switch the active SP, but we will change this
 -     * later to not do that so we can support v8M.
 +    /* Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
 +     * Handler mode (and will be until we write the new XPSR.Interrupt
 +     * field) this does not switch around the current stack pointer.
       */
 -    switch_v7m_sp(env, return_to_sp_process);
 +    write_v7m_control_spsel(env, return_to_sp_process);
      {
          /* The stack pointer we should be reading the exception frame from
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
      case 20: /* CONTROL */
          /* Writing to the SPSEL bit only has an effect if we are in
           * thread mode; other bits can be updated by any privileged code.
 -         * switch_v7m_sp() deals with updating the SPSEL bit in
 +         * write_v7m_control_spsel() deals with updating the SPSEL bit in
           * env->v7m.control, so we only need update the others.
           */
          if (!arm_v7m_is_handler_mode(env)) {
 -            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
 +            write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
          }
          env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
          env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
 --
-.7.4
+.25.1

-New patch
+[PULL 18/28] target/arm: Hoist read of *is_secure in S1_ptw_translate
+From: Richard Henderson <richard.henderson@linaro.org>
+Rename the argument to is_secure_ptr, and introduce a
+local variable is_secure with the value.  We only write
+back to the pointer toward the end of the function.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-15-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 22 ++++++++++++----------
+file changed, 12 insertions(+), 10 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static bool ptw_attrs_are_device(CPUARMState *env, ARMCacheAttrs cacheattrs)
+ /* Translate a S1 pagetable walk through S2 if needed.  */
+ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+-                               hwaddr addr, bool *is_secure,
++                               hwaddr addr, bool *is_secure_ptr,
+                                ARMMMUFaultInfo *fi)
+ {
+-    ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
++    bool is_secure = *is_secure_ptr;
++    ARMMMUIdx s2_mmu_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
+-        !regime_translation_disabled(env, s2_mmu_idx, *is_secure)) {
++        !regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
+         GetPhysAddrResult s2 = {};
+         int ret;
+         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx,
+-                                 *is_secure, false, &s2, fi);
++                                 is_secure, false, &s2, fi);
+         if (ret) {
+             assert(fi->type != ARMFault_None);
+             fi->s2addr = addr;
+             fi->stage2 = true;
+             fi->s1ptw = true;
+-            fi->s1ns = !*is_secure;
++            fi->s1ns = !is_secure;
+             return ~0;
+         }
+         if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+             fi->s2addr = addr;
+             fi->stage2 = true;
+             fi->s1ptw = true;
+-            fi->s1ns = !*is_secure;
++            fi->s1ns = !is_secure;
+             return ~0;
+         }
+         if (arm_is_secure_below_el3(env)) {
+             /* Check if page table walk is to secure or non-secure PA space. */
+-            if (*is_secure) {
+-                *is_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
++            if (is_secure) {
++                is_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
+             } else {
+-                *is_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
++                is_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
+             }
++            *is_secure_ptr = is_secure;
+         } else {
+-            assert(!*is_secure);
++            assert(!is_secure);
+         }
+         addr = s2.phys;
+--
+.25.1

-New patch
+[PULL 19/28] target/arm: Remove env argument from combined_attrs_fwb
+From: Richard Henderson <richard.henderson@linaro.org>
+This value is unused.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20221001162318.153420-16-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 5 ++---
+file changed, 2 insertions(+), 3 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static uint8_t force_cacheattr_nibble_wb(uint8_t attr)
+  * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
+  * combined attributes in MAIR_EL1 format.
+  */
+-static uint8_t combined_attrs_fwb(CPUARMState *env,
+-                                  ARMCacheAttrs s1, ARMCacheAttrs s2)
++static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
+ {
+     switch (s2.attrs) {
+     case 7:
+@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
+     /* Combine memory type and cacheability attributes */
+     if (arm_hcr_el2_eff(env) & HCR_FWB) {
+-        ret.attrs = combined_attrs_fwb(env, s1, s2);
++        ret.attrs = combined_attrs_fwb(s1, s2);
+     } else {
+         ret.attrs = combined_attrs_nofwb(env, s1, s2);
+     }
+--
+.25.1

-[Qemu-devel] [PULL 05/20] target/arm: Don't switch to target stack early in v7M exception return
+[PULL 20/28] target/arm: Pass HCR to attribute subroutines.
-Currently our M profile exception return code switches to the
+From: Richard Henderson <richard.henderson@linaro.org>
 target stack pointer relatively early in the process, before
 it tries to pop the exception frame off the stack. This is
 awkward for v8M for two reasons:
  * in v8M the process vs main stack pointer is not selected
    purely by the value of CONTROL.SPSEL, so updating SPSEL
    and relying on that to switch to the right stack pointer
    won't work
  * the stack we should be reading the stack frame from and
    the stack we will eventually switch to might not be the
    same if the guest is doing strange things
-Change our exception return code to use a 'frame pointer'
+These subroutines did not need ENV for anything except
-to read the exception frame rather than assuming that we
+retrieving the effective value of HCR anyway.
 can switch the live stack pointer this early.
+We have computed the effective value of HCR in the callers,
+and this will be especially important for interpreting HCR
+in a non-current security state.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-17-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 130 +++++++++++++++++++++++++++++++++++++++-------------
+ target/arm/ptw.c | 30 +++++++++++++++++-------------
-file changed, 98 insertions(+), 32 deletions(-)
+file changed, 17 insertions(+), 13 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/helper.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_push(CPUARMState *env, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
-     stl_phys(cs->as, env->regs[13], val);
+     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
  }
--static uint32_t v7m_pop(CPUARMState *env)
+-static bool ptw_attrs_are_device(CPUARMState *env, ARMCacheAttrs cacheattrs)
--{
++static bool ptw_attrs_are_device(uint64_t hcr, ARMCacheAttrs cacheattrs)
 -    CPUState *cs = CPU(arm_env_get_cpu(env));
 -    uint32_t val;
 -
 -    val = ldl_phys(cs->as, env->regs[13]);
 -    env->regs[13] += 4;
 -    return val;
 -}
 -
  /* Return true if we're using the process stack pointer (not the MSP) */
  static bool v7m_using_psp(CPUARMState *env)
  {
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
+     /*
-     env->regs[15] = dest & ~1;
+      * For an S1 page table walk, the stage 1 attributes are always
- }
+@@ -XXX,XX +XXX,XX @@ static bool ptw_attrs_are_device(CPUARMState *env, ARMCacheAttrs cacheattrs)
+      * when cacheattrs.attrs bit [2] is 0.
-+static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+      */
-+                                bool spsel)
+     assert(cacheattrs.is_s2_format);
-+{
+-    if (arm_hcr_el2_eff(env) & HCR_FWB) {
-+    /* Return a pointer to the location where we currently store the
++    if (hcr & HCR_FWB) {
-+     * stack pointer for the requested security state and thread mode.
+         return (cacheattrs.attrs & 0x4) == 0;
-+     * This pointer will become invalid if the CPU state is updated
+     } else {
-+     * such that the stack pointers are switched around (eg changing
+         return (cacheattrs.attrs & 0xc) == 0;
-+     * the SPSEL control bit).
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-+     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
+     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
-+     * Unlike that pseudocode, we require the caller to pass us in the
+         !regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
-+     * SPSEL control bit value; this is because we also use this
+         GetPhysAddrResult s2 = {};
-+     * function in handling of pushing of the callee-saves registers
++        uint64_t hcr;
-+     * part of the v8M stack frame (pseudocode PushCalleeStack()),
+         int ret;
-+     * and in the tailchain codepath the SPSEL bit comes from the exception
-+     * return magic LR value from the previous exception. The pseudocode
+         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx,
-+     * opencodes the stack-selection in PushCalleeStack(), but we prefer
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-+     * to make this utility function generic enough to do the job.
+             fi->s1ns = !is_secure;
-+     */
+             return ~0;
-+    bool want_psp = threadmode && spsel;
+         }
 -        if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
 -            ptw_attrs_are_device(env, s2.cacheattrs)) {
 +
-+    if (secure == env->v7m.secure) {
++        hcr = arm_hcr_el2_eff(env);
-+        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
++        if ((hcr & HCR_PTW) && ptw_attrs_are_device(hcr, s2.cacheattrs)) {
-+         * so the SP we want is always in regs[13].
+             /*
-+         * When we decouple SPSEL from the actually selected SP
+              * PTW set and S1 walk touched S2 Device memory:
-+         * we need to check want_psp against v7m_using_psp()
+              * generate Permission fault.
-+         * to see whether we need regs[13] or v7m.other_sp.
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
-+         */
+  * ref: shared/translation/attrs/S2AttrDecode()
-+        return &env->regs[13];
+  *      .../S2ConvertAttrsHints()
-+    } else {
+  */
-+        if (want_psp) {
+-static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
-+            return &env->v7m.other_ss_psp;
++static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs)
 +        } else {
 +            return &env->v7m.other_ss_msp;
 +        }
 +    }
 +}
 +
  static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
  {
-     CPUState *cs = CPU(cpu);
+     uint8_t hiattr = extract32(s2attrs, 2, 2);
-@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
+     uint8_t loattr = extract32(s2attrs, 0, 2);
- static void do_v7m_exception_exit(ARMCPU *cpu)
+     uint8_t hihint = 0, lohint = 0;
      if (hiattr != 0) { /* normal memory */
 -        if (arm_hcr_el2_eff(env) & HCR_CD) { /* cache disabled */
 +        if (hcr & HCR_CD) { /* cache disabled */
              hiattr = loattr = 1; /* non-cacheable */
          } else {
              if (hiattr != 1) { /* Write-through or write-back */
@@ -XXX,XX +XXX,XX @@ static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
   * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
   * combined attributes in MAIR_EL1 format.
   */
 -static uint8_t combined_attrs_nofwb(CPUARMState *env,
 +static uint8_t combined_attrs_nofwb(uint64_t hcr,
                                      ARMCacheAttrs s1, ARMCacheAttrs s2)
  {
-     CPUARMState *env = &cpu->env;
+     uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs;
-+    CPUState *cs = CPU(cpu);
-     uint32_t excret;
+-    s2_mair_attrs = convert_stage2_attrs(env, s2.attrs);
-     uint32_t xpsr;
++    s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs);
-     bool ufault = false;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+     s1lo = extract32(s1.attrs, 0, 4);
-     bool return_to_handler = false;
+     s2lo = extract32(s2_mair_attrs, 0, 4);
-     bool rettobase = false;
+@@ -XXX,XX +XXX,XX @@ static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
-     bool exc_secure = false;
+  * @s1:      Attributes from stage 1 walk
-+    bool return_to_secure;
+  * @s2:      Attributes from stage 2 walk
+  */
-     /* We can only get here from an EXCP_EXCEPTION_EXIT, and
+-static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
-      * gen_bx_excret() enforces the architectural rule
++static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+                                         ARMCacheAttrs s1, ARMCacheAttrs s2)
-         g_assert_not_reached();
+ {
      ARMCacheAttrs ret;
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
      }
-+    return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+     /* Combine memory type and cacheability attributes */
-+        (excret & R_V7M_EXCRET_S_MASK);
+-    if (arm_hcr_el2_eff(env) & HCR_FWB) {
-+
++    if (hcr & HCR_FWB) {
-     switch (excret & 0xf) {
+         ret.attrs = combined_attrs_fwb(s1, s2);
-     case 1: /* Return to Handler */
+     } else {
-         return_to_handler = true;
+-        ret.attrs = combined_attrs_nofwb(env, s1, s2);
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++        ret.attrs = combined_attrs_nofwb(hcr, s1, s2);
          return;
      }
--    /* Switch to the target stack.  */
+     /*
-+    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
-+     * causes us to switch the active SP, but we will change this
+             ARMCacheAttrs cacheattrs1;
-+     * later to not do that so we can support v8M.
+             ARMMMUIdx s2_mmu_idx;
-+     */
+             bool is_el0;
-     switch_v7m_sp(env, return_to_sp_process);
++            uint64_t hcr;
--    /* Pop registers.  */
--    env->regs[0] = v7m_pop(env);
+             ret = get_phys_addr_with_secure(env, address, access_type,
--    env->regs[1] = v7m_pop(env);
+                                             s1_mmu_idx, is_secure, result, fi);
--    env->regs[2] = v7m_pop(env);
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
--    env->regs[3] = v7m_pop(env);
+             }
--    env->regs[12] = v7m_pop(env);
--    env->regs[14] = v7m_pop(env);
+             /* Combine the S1 and S2 cache attributes. */
--    env->regs[15] = v7m_pop(env);
+-            if (arm_hcr_el2_eff(env) & HCR_DC) {
--    if (env->regs[15] & 1) {
++            hcr = arm_hcr_el2_eff(env);
--        qemu_log_mask(LOG_GUEST_ERROR,
++            if (hcr & HCR_DC) {
--                      "M profile return from interrupt with misaligned "
+                 /*
--                      "PC is UNPREDICTABLE\n");
+                  * HCR.DC forces the first stage attributes to
--        /* Actual hardware seems to ignore the lsbit, and there are several
+                  *  Normal Non-Shareable,
--         * RTOSes out there which incorrectly assume the r15 in the stack
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
--         * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
+                 }
-+
+                 cacheattrs1.shareability = 0;
-+    {
+             }
-+        /* The stack pointer we should be reading the exception frame from
+-            result->cacheattrs = combine_cacheattrs(env, cacheattrs1,
-+         * depends on bits in the magic exception return type value (and
++            result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1,
-+         * for v8M isn't necessarily the stack pointer we will eventually
+                                                     result->cacheattrs);
-+         * end up resuming execution with). Get a pointer to the location
-+         * in the CPU state struct where the SP we need is currently being
+             /*
 +         * stored; we will use and modify it in place.
 +         * We use this limited C variable scope so we don't accidentally
 +         * use 'frame_sp_p' after we do something that makes it invalid.
 +         */
 +        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
 +                                              return_to_secure,
 +                                              !return_to_handler,
 +                                              return_to_sp_process);
 +        uint32_t frameptr = *frame_sp_p;
 +
 +        /* Pop registers. TODO: make these accesses use the correct
 +         * attributes and address space (S/NS, priv/unpriv) and handle
 +         * memory transaction failures.
           */
 -        env->regs[15] &= ~1U;
 +        env->regs[0] = ldl_phys(cs->as, frameptr);
 +        env->regs[1] = ldl_phys(cs->as, frameptr + 0x4);
 +        env->regs[2] = ldl_phys(cs->as, frameptr + 0x8);
 +        env->regs[3] = ldl_phys(cs->as, frameptr + 0xc);
 +        env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
 +        env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
 +        env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
 +        if (env->regs[15] & 1) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "M profile return from interrupt with misaligned "
 +                          "PC is UNPREDICTABLE\n");
 +            /* Actual hardware seems to ignore the lsbit, and there are several
 +             * RTOSes out there which incorrectly assume the r15 in the stack
 +             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
 +             */
 +            env->regs[15] &= ~1U;
 +        }
 +        xpsr = ldl_phys(cs->as, frameptr + 0x1c);
 +
 +        /* Commit to consuming the stack frame */
 +        frameptr += 0x20;
 +        /* Undo stack alignment (the SPREALIGN bit indicates that the original
 +         * pre-exception SP was not 8-aligned and we added a padding word to
 +         * align it, so we undo this by ORing in the bit that increases it
 +         * from the current 8-aligned value to the 8-unaligned value. (Adding 4
 +         * would work too but a logical OR is how the pseudocode specifies it.)
 +         */
 +        if (xpsr & XPSR_SPREALIGN) {
 +            frameptr |= 4;
 +        }
 +        *frame_sp_p = frameptr;
      }
 -    xpsr = v7m_pop(env);
 +    /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
      xpsr_write(env, xpsr, ~XPSR_SPREALIGN);
 -    /* Undo stack alignment.  */
 -    if (xpsr & XPSR_SPREALIGN) {
 -        env->regs[13] |= 4;
 -    }
      /* The restored xPSR exception field will be zero if we're
       * resuming in Thread mode. If that doesn't match what the
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 18/20] target/arm: Fix calculation of secure mm_idx values
+[PULL 21/28] target/arm: Fix ATS12NSO* from S PL1
-In cpu_mmu_index() we try to do this:
+From: Richard Henderson <richard.henderson@linaro.org>
         if (env->v7m.secure) {
             mmu_idx += ARMMMUIdx_MSUser;
         }
 but it will give the wrong answer, because ARMMMUIdx_MSUser
 includes the 0x40 ARM_MMU_IDX_M field, and so does the
 mmu_idx we're adding to, and we'll end up with 0x8n rather
 than 0x4n. This error is then nullified by the call to
 arm_to_core_mmu_idx() which masks out the high part, but
 we're about to factor out the code that calculates the
 ARMMMUIdx values so it can be used without passing it through
 arm_to_core_mmu_idx(), so fix this bug first.
+Use arm_hcr_el2_eff_secstate instead of arm_hcr_el2_eff, so
+that we use is_secure instead of the current security state.
+These AT* operations have been broken since arm_hcr_el2_eff
+gained a check for "el2 enabled" for Secure EL2.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-18-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-16-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 12 +++++++-----
+ target/arm/ptw.c | 8 ++++----
-file changed, 7 insertions(+), 5 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/ptw.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
      int el = arm_current_el(env);
      if (arm_feature(env, ARM_FEATURE_M)) {
 -        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
 +        ARMMMUIdx mmu_idx;
 -        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
 -            mmu_idx = ARMMMUIdx_MNegPri;
 +        if (el == 0) {
 +            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
 +        } else {
 +            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
          }
+     }
--        if (env->v7m.secure) {
--            mmu_idx += ARMMMUIdx_MSUser;
+-    hcr_el2 = arm_hcr_el2_eff(env);
-+        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
++    hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure);
-+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
      switch (mmu_idx) {
      case ARMMMUIdx_Stage2:
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
              return ~0;
          }
-         return arm_to_core_mmu_idx(mmu_idx);
+-        hcr = arm_hcr_el2_eff(env);
 +        hcr = arm_hcr_el2_eff_secstate(env, is_secure);
          if ((hcr & HCR_PTW) && ptw_attrs_are_device(hcr, s2.cacheattrs)) {
              /*
               * PTW set and S1 walk touched S2 Device memory:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
              }
              /* Combine the S1 and S2 cache attributes. */
 -            hcr = arm_hcr_el2_eff(env);
 +            hcr = arm_hcr_el2_eff_secstate(env, is_secure);
              if (hcr & HCR_DC) {
                  /*
                   * HCR.DC forces the first stage attributes to
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
          result->page_size = TARGET_PAGE_SIZE;
          /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
 -        hcr = arm_hcr_el2_eff(env);
 +        hcr = arm_hcr_el2_eff_secstate(env, is_secure);
          result->cacheattrs.shareability = 0;
          result->cacheattrs.is_s2_format = false;
          if (hcr & HCR_DC) {
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 14/20] target/arm: Add support for restoring v8M additional state context
+[PULL 22/28] target/arm: Split out get_phys_addr_disabled
-For v8M, exceptions from Secure to Non-Secure state will save
+From: Richard Henderson <richard.henderson@linaro.org>
 callee-saved registers to the exception frame as well as the
 caller-saved registers. Add support for unstacking these
 registers in exception exit when necessary.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20221001162318.153420-19-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-12-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 30 ++++++++++++++++++++++++++++++
+ target/arm/ptw.c | 138 +++++++++++++++++++++++++----------------------
-file changed, 30 insertions(+)
+file changed, 74 insertions(+), 64 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/helper.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
-                           "for destination state is UNPREDICTABLE\n");
+     return ret;
-         }
+ }
-+        /* Do we need to pop callee-saved registers? */
++/*
-+        if (return_to_secure &&
++ * MMU disabled.  S1 addresses within aa64 translation regimes are
-+            ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
++ * still checked for bounds -- see AArch64.S1DisabledOutput().
-+             (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
++ */
-+            uint32_t expected_sig = 0xfefa125b;
++static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
-+            uint32_t actual_sig = ldl_phys(cs->as, frameptr);
++                                   MMUAccessType access_type,
 +                                   ARMMMUIdx mmu_idx, bool is_secure,
 +                                   GetPhysAddrResult *result,
 +                                   ARMMMUFaultInfo *fi)
 +{
 +    uint64_t hcr;
 +    uint8_t memattr;
 +
-+            if (expected_sig != actual_sig) {
++    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
-+                /* Take a SecureFault on the current stack */
++        int r_el = regime_el(env, mmu_idx);
-+                env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
++        if (arm_el_is_aa64(env, r_el)) {
-+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
++            int pamax = arm_pamax(env_archcpu(env));
-+                v7m_exception_taken(cpu, excret);
++            uint64_t tcr = env->cp15.tcr_el[r_el];
-+                qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
++            int addrtop, tbi;
-+                              "stackframe: failed exception return integrity "
++
-+                              "signature check\n");
++            tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
-+                return;
++            if (access_type == MMU_INST_FETCH) {
 +                tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
 +            }
 +            tbi = (tbi >> extract64(address, 55, 1)) & 1;
 +            addrtop = (tbi ? 55 : 63);
 +
 +            if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
 +                fi->type = ARMFault_AddressSize;
 +                fi->level = 0;
 +                fi->stage2 = false;
 +                return 1;
 +            }
 +
-+            env->regs[4] = ldl_phys(cs->as, frameptr + 0x8);
++            /*
-+            env->regs[5] = ldl_phys(cs->as, frameptr + 0xc);
++             * When TBI is disabled, we've just validated that all of the
-+            env->regs[6] = ldl_phys(cs->as, frameptr + 0x10);
++             * bits above PAMax are zero, so logically we only need to
-+            env->regs[7] = ldl_phys(cs->as, frameptr + 0x14);
++             * clear the top byte for TBI.  But it's clearer to follow
-+            env->regs[8] = ldl_phys(cs->as, frameptr + 0x18);
++             * the pseudocode set of addrdesc.paddress.
-+            env->regs[9] = ldl_phys(cs->as, frameptr + 0x1c);
++             */
-+            env->regs[10] = ldl_phys(cs->as, frameptr + 0x20);
++            address = extract64(address, 0, 52);
-+            env->regs[11] = ldl_phys(cs->as, frameptr + 0x24);
++        }
 +    }
 +
-+            frameptr += 0x28;
++    result->phys = address;
 +    result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 +    result->page_size = TARGET_PAGE_SIZE;
 +
 +    /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
 +    hcr = arm_hcr_el2_eff_secstate(env, is_secure);
 +    result->cacheattrs.shareability = 0;
 +    result->cacheattrs.is_s2_format = false;
 +    if (hcr & HCR_DC) {
 +        if (hcr & HCR_DCT) {
 +            memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
 +        } else {
 +            memattr = 0xff;  /* Normal, WB, RWA */
 +        }
++    } else if (access_type == MMU_INST_FETCH) {
++        if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
++            memattr = 0xee;  /* Normal, WT, RA, NT */
++        } else {
++            memattr = 0x44;  /* Normal, NC, No */
++        }
++        result->cacheattrs.shareability = 2; /* outer sharable */
++    } else {
++        memattr = 0x00;      /* Device, nGnRnE */
++    }
++    result->cacheattrs.attrs = memattr;
++    return 0;
++}
 +
-         /* Pop registers. TODO: make these accesses use the correct
+ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
-          * attributes and address space (S/NS, priv/unpriv) and handle
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-          * memory transaction failures.
+                                bool is_secure, GetPhysAddrResult *result,
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
      /* Definitely a real MMU, not an MPU */
      if (regime_translation_disabled(env, mmu_idx, is_secure)) {
 -        uint64_t hcr;
 -        uint8_t memattr;
 -
 -        /*
 -         * MMU disabled.  S1 addresses within aa64 translation regimes are
 -         * still checked for bounds -- see AArch64.TranslateAddressS1Off.
 -         */
 -        if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
 -            int r_el = regime_el(env, mmu_idx);
 -            if (arm_el_is_aa64(env, r_el)) {
 -                int pamax = arm_pamax(env_archcpu(env));
 -                uint64_t tcr = env->cp15.tcr_el[r_el];
 -                int addrtop, tbi;
 -
 -                tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
 -                if (access_type == MMU_INST_FETCH) {
 -                    tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
 -                }
 -                tbi = (tbi >> extract64(address, 55, 1)) & 1;
 -                addrtop = (tbi ? 55 : 63);
 -
 -                if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
 -                    fi->type = ARMFault_AddressSize;
 -                    fi->level = 0;
 -                    fi->stage2 = false;
 -                    return 1;
 -                }
 -
 -                /*
 -                 * When TBI is disabled, we've just validated that all of the
 -                 * bits above PAMax are zero, so logically we only need to
 -                 * clear the top byte for TBI.  But it's clearer to follow
 -                 * the pseudocode set of addrdesc.paddress.
 -                 */
 -                address = extract64(address, 0, 52);
 -            }
 -        }
 -        result->phys = address;
 -        result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 -        result->page_size = TARGET_PAGE_SIZE;
 -
 -        /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
 -        hcr = arm_hcr_el2_eff_secstate(env, is_secure);
 -        result->cacheattrs.shareability = 0;
 -        result->cacheattrs.is_s2_format = false;
 -        if (hcr & HCR_DC) {
 -            if (hcr & HCR_DCT) {
 -                memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
 -            } else {
 -                memattr = 0xff;  /* Normal, WB, RWA */
 -            }
 -        } else if (access_type == MMU_INST_FETCH) {
 -            if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
 -                memattr = 0xee;  /* Normal, WT, RA, NT */
 -            } else {
 -                memattr = 0x44;  /* Normal, NC, No */
 -            }
 -            result->cacheattrs.shareability = 2; /* outer sharable */
 -        } else {
 -            memattr = 0x00;      /* Device, nGnRnE */
 -        }
 -        result->cacheattrs.attrs = memattr;
 -        return 0;
 +        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
 +                                      is_secure, result, fi);
      }
 -
      if (regime_using_lpae_format(env, mmu_idx)) {
          return get_phys_addr_lpae(env, address, access_type, mmu_idx,
                                    is_secure, false, result, fi);
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 09/20] target/arm: Check for xPSR mismatch usage faults earlier for v8M
+[PULL 23/28] target/arm: Fix cacheattr in get_phys_addr_disabled
-ARM v8M specifies that the INVPC usage fault for mismatched
+From: Richard Henderson <richard.henderson@linaro.org>
 xPSR exception field and handler mode bit should be checked
 before updating the PSR and SP, so that the fault is taken
 with the existing stack frame rather than by pushing a new one.
 Perform this check in the right place for v8M.
-Since v7M specifies in its pseudocode that this usage fault
+Do not apply memattr or shareability for Stage2 translations.
-check should happen later, we have to retain the original
+Make sure to apply HCR_{DC,DCT} only to Regime_EL10, per the
-code for that check rather than being able to merge the two.
+pseudocode in AArch64.S1DisabledOutput.
 (The distinction is architecturally visible but only in
 very obscure corner cases like attempting an invalid exception
 return with an exception frame in read only memory.)
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20221001162318.153420-20-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-7-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 30 +++++++++++++++++++++++++++---
+ target/arm/ptw.c | 48 +++++++++++++++++++++++++-----------------------
-file changed, 27 insertions(+), 3 deletions(-)
+file changed, 25 insertions(+), 23 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/helper.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
                                     GetPhysAddrResult *result,
                                     ARMMMUFaultInfo *fi)
  {
 -    uint64_t hcr;
 -    uint8_t memattr;
 +    uint8_t memattr = 0x00;    /* Device nGnRnE */
 +    uint8_t shareability = 0;  /* non-sharable */
      if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
          int r_el = regime_el(env, mmu_idx);
 +
          if (arm_el_is_aa64(env, r_el)) {
              int pamax = arm_pamax(env_archcpu(env));
              uint64_t tcr = env->cp15.tcr_el[r_el];
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
               */
              address = extract64(address, 0, 52);
          }
-         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
++
++        /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
-+        if (arm_feature(env, ARM_FEATURE_V8)) {
++        if (r_el == 1) {
-+            /* For v8M we have to check whether the xPSR exception field
++            uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
-+             * matches the EXCRET value for return to handler/thread
++            if (hcr & HCR_DC) {
-+             * before we commit to changing the SP and xPSR.
++                if (hcr & HCR_DCT) {
-+             */
++                    memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
-+            bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
++                } else {
-+            if (return_to_handler != will_be_handler) {
++                    memattr = 0xff;  /* Normal, WB, RWA */
-+                /* Take an INVPC UsageFault on the current stack.
++                }
 +                 * By this point we will have switched to the security state
 +                 * for the background state, so this UsageFault will target
 +                 * that state.
 +                 */
 +                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
 +                                        env->v7m.secure);
 +                env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
 +                v7m_exception_taken(cpu, excret);
 +                qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
 +                              "stackframe: failed exception return integrity "
 +                              "check\n");
 +                return;
 +            }
 +        }
-+
++        if (memattr == 0 && access_type == MMU_INST_FETCH) {
-         /* Commit to consuming the stack frame */
++            if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
-         frameptr += 0x20;
++                memattr = 0xee;  /* Normal, WT, RA, NT */
-         /* Undo stack alignment (the SPREALIGN bit indicates that the original
++            } else {
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++                memattr = 0x44;  /* Normal, NC, No */
-     /* The restored xPSR exception field will be zero if we're
++            }
-      * resuming in Thread mode. If that doesn't match what the
++            shareability = 2; /* outer sharable */
-      * exception return excret specified then this is a UsageFault.
++        }
-+     * v7M requires we make this check here; v8M did it earlier.
++        result->cacheattrs.is_s2_format = false;
-      */
+     }
-     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
--        /* Take an INVPC UsageFault by pushing the stack again.
+     result->phys = address;
--         * TODO: the v8M version of this code should target the
+     result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
--         * background state for this exception.
+     result->page_size = TARGET_PAGE_SIZE;
-+        /* Take an INVPC UsageFault by pushing the stack again;
+-
-+         * we know we're v7M so this is never a Secure UsageFault.
+-    /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
-          */
+-    hcr = arm_hcr_el2_eff_secstate(env, is_secure);
-+        assert(!arm_feature(env, ARM_FEATURE_V8));
+-    result->cacheattrs.shareability = 0;
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
+-    result->cacheattrs.is_s2_format = false;
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+-    if (hcr & HCR_DC) {
-         v7m_push_stack(cpu);
+-        if (hcr & HCR_DCT) {
 -            memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
 -        } else {
 -            memattr = 0xff;  /* Normal, WB, RWA */
 -        }
 -    } else if (access_type == MMU_INST_FETCH) {
 -        if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
 -            memattr = 0xee;  /* Normal, WT, RA, NT */
 -        } else {
 -            memattr = 0x44;  /* Normal, NC, No */
 -        }
 -        result->cacheattrs.shareability = 2; /* outer sharable */
 -    } else {
 -        memattr = 0x00;      /* Device, nGnRnE */
 -    }
 +    result->cacheattrs.shareability = shareability;
      result->cacheattrs.attrs = memattr;
      return 0;
  }
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 11/20] target/arm: Don't warn about exception return with PC low bit set for v8M
+[PULL 24/28] target/arm: Use tlb_set_page_full
-In the v8M architecture, return from an exception to a PC which
+From: Richard Henderson <richard.henderson@linaro.org>
 has bit 0 set is not UNPREDICTABLE; it is defined that bit 0
 is discarded [R_HRJH]. Restrict our complaint about this to v7M.
+Adjust GetPhysAddrResult to fill in CPUTLBEntryFull,
+so that it may be passed directly to tlb_set_page_full.
+The change is large, but mostly mechanical.  The major
+non-mechanical change is page_size -> lg_page_size.
+Most of the time this is obvious, and is related to
+TARGET_PAGE_BITS.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20221001162318.153420-21-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-9-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 22 +++++++++++++++-------
+ target/arm/internals.h  |   5 +-
-file changed, 15 insertions(+), 7 deletions(-)
+ target/arm/helper.c     |  12 +--
  target/arm/m_helper.c   |  20 ++---
  target/arm/ptw.c        | 179 ++++++++++++++++++++--------------------
  target/arm/tlb_helper.c |   9 +-
 files changed, 111 insertions(+), 114 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMCacheAttrs {
+ /* Fields that are valid upon success. */
+ typedef struct GetPhysAddrResult {
+-    hwaddr phys;
+-    target_ulong page_size;
+-    int prot;
+-    MemTxAttrs attrs;
++    CPUTLBEntryFull f;
+     ARMCacheAttrs cacheattrs;
+ } GetPhysAddrResult;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-         env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
+         /* Create a 64-bit PAR */
-         env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
+         par64 = (1 << 11); /* LPAE bit always set */
-         env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
+         if (!ret) {
-+
+-            par64 |= res.phys & ~0xfffULL;
-+        /* Returning from an exception with a PC with bit 0 set is defined
+-            if (!res.attrs.secure) {
-+         * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
++            par64 |= res.f.phys_addr & ~0xfffULL;
-+         * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
++            if (!res.f.attrs.secure) {
-+         * the lsbit, and there are several RTOSes out there which incorrectly
+                 par64 |= (1 << 9); /* NS */
-+         * assume the r15 in the stack frame should be a Thumb-style "lsbit
+             }
-+         * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
+             par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */
-+         * complain about the badly behaved guest.
+@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-+         */
+          */
-         if (env->regs[15] & 1) {
+         if (!ret) {
--            qemu_log_mask(LOG_GUEST_ERROR,
+             /* We do not set any attribute bits in the PAR */
--                          "M profile return from interrupt with misaligned "
+-            if (res.page_size == (1 << 24)
--                          "PC is UNPREDICTABLE\n");
++            if (res.f.lg_page_size == 24
--            /* Actual hardware seems to ignore the lsbit, and there are several
+                 && arm_feature(env, ARM_FEATURE_V7)) {
--             * RTOSes out there which incorrectly assume the r15 in the stack
+-                par64 = (res.phys & 0xff000000) | (1 << 1);
--             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
++                par64 = (res.f.phys_addr & 0xff000000) | (1 << 1);
--             */
+             } else {
-             env->regs[15] &= ~1U;
+-                par64 = res.phys & 0xfffff000;
-+            if (!arm_feature(env, ARM_FEATURE_V8)) {
++                par64 = res.f.phys_addr & 0xfffff000;
-+                qemu_log_mask(LOG_GUEST_ERROR,
+             }
-+                              "M profile return from interrupt with misaligned "
+-            if (!res.attrs.secure) {
-+                              "PC is UNPREDICTABLE on v7M\n");
++            if (!res.f.attrs.secure) {
-+            }
+                 par64 |= (1 << 9); /* NS */
-         }
+             }
-+
+         } else {
-         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
          }
          goto pend_fault;
      }
 -    address_space_stl_le(arm_addressspace(cs, res.attrs), res.phys, value,
 -                         res.attrs, &txres);
 +    address_space_stl_le(arm_addressspace(cs, res.f.attrs), res.f.phys_addr,
 +                         value, res.f.attrs, &txres);
      if (txres != MEMTX_OK) {
          /* BusFault trying to write the data */
          if (mode == STACK_LAZYFP) {
@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
          goto pend_fault;
      }
 -    value = address_space_ldl(arm_addressspace(cs, res.attrs), res.phys,
 -                              res.attrs, &txres);
 +    value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
 +                              res.f.phys_addr, res.f.attrs, &txres);
      if (txres != MEMTX_OK) {
          /* BusFault trying to read the data */
          qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
          qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
          return false;
      }
 -    *insn = address_space_lduw_le(arm_addressspace(cs, res.attrs), res.phys,
 -                                  res.attrs, &txres);
 +    *insn = address_space_lduw_le(arm_addressspace(cs, res.f.attrs),
 +                                  res.f.phys_addr, res.f.attrs, &txres);
      if (txres != MEMTX_OK) {
          env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
          }
          return false;
      }
 -    value = address_space_ldl(arm_addressspace(cs, res.attrs), res.phys,
 -                              res.attrs, &txres);
 +    value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
 +                              res.f.phys_addr, res.f.attrs, &txres);
      if (txres != MEMTX_OK) {
          /* BusFault trying to read the data */
          qemu_log_mask(CPU_LOG_INT,
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
          } else {
              mrvalid = true;
          }
 -        r = res.prot & PAGE_READ;
 -        rw = res.prot & PAGE_WRITE;
 +        r = res.f.prot & PAGE_READ;
 +        rw = res.f.prot & PAGE_WRITE;
      } else {
          r = false;
          rw = false;
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
              assert(!is_secure);
          }
 -        addr = s2.phys;
 +        addr = s2.f.phys_addr;
      }
      return addr;
  }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
          /* 1Mb section.  */
          phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
          ap = (desc >> 10) & 3;
 -        result->page_size = 1024 * 1024;
 +        result->f.lg_page_size = 20; /* 1MB */
      } else {
          /* Lookup l2 entry.  */
          if (type == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
          case 1: /* 64k page.  */
              phys_addr = (desc & 0xffff0000) | (address & 0xffff);
              ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
 -            result->page_size = 0x10000;
 +            result->f.lg_page_size = 16;
              break;
          case 2: /* 4k page.  */
              phys_addr = (desc & 0xfffff000) | (address & 0xfff);
              ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
 -            result->page_size = 0x1000;
 +            result->f.lg_page_size = 12;
              break;
          case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
              if (type == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
                  if (arm_feature(env, ARM_FEATURE_XSCALE)
                      || arm_feature(env, ARM_FEATURE_V6)) {
                      phys_addr = (desc & 0xfffff000) | (address & 0xfff);
 -                    result->page_size = 0x1000;
 +                    result->f.lg_page_size = 12;
                  } else {
                      /*
                       * UNPREDICTABLE in ARMv5; we choose to take a
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
                  }
              } else {
                  phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
 -                result->page_size = 0x400;
 +                result->f.lg_page_size = 10;
              }
              ap = (desc >> 4) & 3;
              break;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
              g_assert_not_reached();
          }
      }
 -    result->prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
 -    result->prot |= result->prot ? PAGE_EXEC : 0;
 -    if (!(result->prot & (1 << access_type))) {
 +    result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
 +    result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
 +    if (!(result->f.prot & (1 << access_type))) {
          /* Access permission fault.  */
          fi->type = ARMFault_Permission;
          goto do_fault;
      }
 -    result->phys = phys_addr;
 +    result->f.phys_addr = phys_addr;
      return false;
  do_fault:
      fi->domain = domain;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
              phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
              phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
              phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
 -            result->page_size = 0x1000000;
 +            result->f.lg_page_size = 24;  /* 16MB */
          } else {
              /* Section.  */
              phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
 -            result->page_size = 0x100000;
 +            result->f.lg_page_size = 20;  /* 1MB */
          }
          ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
          xn = desc & (1 << 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
          case 1: /* 64k page.  */
              phys_addr = (desc & 0xffff0000) | (address & 0xffff);
              xn = desc & (1 << 15);
 -            result->page_size = 0x10000;
 +            result->f.lg_page_size = 16;
              break;
          case 2: case 3: /* 4k page.  */
              phys_addr = (desc & 0xfffff000) | (address & 0xfff);
              xn = desc & 1;
 -            result->page_size = 0x1000;
 +            result->f.lg_page_size = 12;
              break;
          default:
              /* Never happens, but compiler isn't smart enough to tell.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
          }
      }
      if (domain_prot == 3) {
 -        result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 +        result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
      } else {
          if (pxn && !regime_is_user(env, mmu_idx)) {
              xn = 1;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
                  fi->type = ARMFault_AccessFlag;
                  goto do_fault;
              }
 -            result->prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
 +            result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
          } else {
 -            result->prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
 +            result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
          }
 -        if (result->prot && !xn) {
 -            result->prot |= PAGE_EXEC;
 +        if (result->f.prot && !xn) {
 +            result->f.prot |= PAGE_EXEC;
          }
 -        if (!(result->prot & (1 << access_type))) {
 +        if (!(result->f.prot & (1 << access_type))) {
              /* Access permission fault.  */
              fi->type = ARMFault_Permission;
              goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
           * the CPU doesn't support TZ or this is a non-secure translation
           * regime, because the attribute will already be non-secure.
           */
 -        result->attrs.secure = false;
 +        result->f.attrs.secure = false;
      }
 -    result->phys = phys_addr;
 +    result->f.phys_addr = phys_addr;
      return false;
  do_fault:
      fi->domain = domain;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
          ns = mmu_idx == ARMMMUIdx_Stage2;
          xn = extract32(attrs, 11, 2);
 -        result->prot = get_S2prot(env, ap, xn, s1_is_el0);
 +        result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
      } else {
          ns = extract32(attrs, 3, 1);
          xn = extract32(attrs, 12, 1);
          pxn = extract32(attrs, 11, 1);
 -        result->prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
 +        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
      }
      fault_type = ARMFault_Permission;
 -    if (!(result->prot & (1 << access_type))) {
 +    if (!(result->f.prot & (1 << access_type))) {
          goto do_fault;
      }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
           * the CPU doesn't support TZ or this is a non-secure translation
           * regime, because the attribute will already be non-secure.
           */
 -        result->attrs.secure = false;
 +        result->f.attrs.secure = false;
      }
      /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB.  */
      if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) {
 -        arm_tlb_bti_gp(&result->attrs) = true;
 +        arm_tlb_bti_gp(&result->f.attrs) = true;
      }
      if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          result->cacheattrs.shareability = extract32(attrs, 6, 2);
      }
 -    result->phys = descaddr;
 -    result->page_size = page_size;
 +    result->f.phys_addr = descaddr;
 +    result->f.lg_page_size = ctz64(page_size);
      return false;
  do_fault:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
      if (regime_translation_disabled(env, mmu_idx, is_secure)) {
          /* MPU disabled.  */
 -        result->phys = address;
 -        result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 +        result->f.phys_addr = address;
 +        result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
          return false;
      }
 -    result->phys = address;
 +    result->f.phys_addr = address;
      for (n = 7; n >= 0; n--) {
          base = env->cp15.c6_region[n];
          if ((base & 1) == 0) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
              fi->level = 1;
              return true;
          }
 -        result->prot = PAGE_READ | PAGE_WRITE;
 +        result->f.prot = PAGE_READ | PAGE_WRITE;
          break;
      case 2:
 -        result->prot = PAGE_READ;
 +        result->f.prot = PAGE_READ;
          if (!is_user) {
 -            result->prot |= PAGE_WRITE;
 +            result->f.prot |= PAGE_WRITE;
          }
          break;
      case 3:
 -        result->prot = PAGE_READ | PAGE_WRITE;
 +        result->f.prot = PAGE_READ | PAGE_WRITE;
          break;
      case 5:
          if (is_user) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
              fi->level = 1;
              return true;
          }
 -        result->prot = PAGE_READ;
 +        result->f.prot = PAGE_READ;
          break;
      case 6:
 -        result->prot = PAGE_READ;
 +        result->f.prot = PAGE_READ;
          break;
      default:
          /* Bad permission.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
          fi->level = 1;
          return true;
      }
 -    result->prot |= PAGE_EXEC;
 +    result->f.prot |= PAGE_EXEC;
      return false;
  }
  static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx,
 -                                         int32_t address, int *prot)
 +                                         int32_t address, uint8_t *prot)
  {
      if (!arm_feature(env, ARM_FEATURE_M)) {
          *prot = PAGE_READ | PAGE_WRITE;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
      int n;
      bool is_user = regime_is_user(env, mmu_idx);
 -    result->phys = address;
 -    result->page_size = TARGET_PAGE_SIZE;
 -    result->prot = 0;
 +    result->f.phys_addr = address;
 +    result->f.lg_page_size = TARGET_PAGE_BITS;
 +    result->f.prot = 0;
      if (regime_translation_disabled(env, mmu_idx, secure) ||
          m_is_ppb_region(env, address)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
           * which always does a direct read using address_space_ldl(), rather
           * than going via this function, so we don't need to check that here.
           */
 -        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->prot);
 +        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
      } else { /* MPU enabled */
          for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
              /* region search */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                  if (ranges_overlap(base, rmask,
                                     address & TARGET_PAGE_MASK,
                                     TARGET_PAGE_SIZE)) {
 -                    result->page_size = 1;
 +                    result->f.lg_page_size = 0;
                  }
                  continue;
              }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                  continue;
              }
              if (rsize < TARGET_PAGE_BITS) {
 -                result->page_size = 1 << rsize;
 +                result->f.lg_page_size = rsize;
              }
              break;
          }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                  fi->type = ARMFault_Background;
                  return true;
              }
 -            get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->prot);
 +            get_phys_addr_pmsav7_default(env, mmu_idx, address,
 +                                         &result->f.prot);
          } else { /* a MPU hit! */
              uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
              uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                  case 5:
                      break; /* no access */
                  case 3:
 -                    result->prot |= PAGE_WRITE;
 +                    result->f.prot |= PAGE_WRITE;
                      /* fall through */
                  case 2:
                  case 6:
 -                    result->prot |= PAGE_READ | PAGE_EXEC;
 +                    result->f.prot |= PAGE_READ | PAGE_EXEC;
                      break;
                  case 7:
                      /* for v7M, same as 6; for R profile a reserved value */
                      if (arm_feature(env, ARM_FEATURE_M)) {
 -                        result->prot |= PAGE_READ | PAGE_EXEC;
 +                        result->f.prot |= PAGE_READ | PAGE_EXEC;
                          break;
                      }
                      /* fall through */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                  case 1:
                  case 2:
                  case 3:
 -                    result->prot |= PAGE_WRITE;
 +                    result->f.prot |= PAGE_WRITE;
                      /* fall through */
                  case 5:
                  case 6:
 -                    result->prot |= PAGE_READ | PAGE_EXEC;
 +                    result->f.prot |= PAGE_READ | PAGE_EXEC;
                      break;
                  case 7:
                      /* for v7M, same as 6; for R profile a reserved value */
                      if (arm_feature(env, ARM_FEATURE_M)) {
 -                        result->prot |= PAGE_READ | PAGE_EXEC;
 +                        result->f.prot |= PAGE_READ | PAGE_EXEC;
                          break;
                      }
                      /* fall through */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
              /* execute never */
              if (xn) {
 -                result->prot &= ~PAGE_EXEC;
 +                result->f.prot &= ~PAGE_EXEC;
              }
          }
      }
      fi->type = ARMFault_Permission;
      fi->level = 1;
 -    return !(result->prot & (1 << access_type));
 +    return !(result->f.prot & (1 << access_type));
  }
  bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
      uint32_t addr_page_base = address & TARGET_PAGE_MASK;
      uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
 -    result->page_size = TARGET_PAGE_SIZE;
 -    result->phys = address;
 -    result->prot = 0;
 +    result->f.lg_page_size = TARGET_PAGE_BITS;
 +    result->f.phys_addr = address;
 +    result->f.prot = 0;
      if (mregion) {
          *mregion = -1;
      }
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
                      ranges_overlap(base, limit - base + 1,
                                     addr_page_base,
                                     TARGET_PAGE_SIZE)) {
 -                    result->page_size = 1;
 +                    result->f.lg_page_size = 0;
                  }
                  continue;
              }
              if (base > addr_page_base || limit < addr_page_limit) {
 -                result->page_size = 1;
 +                result->f.lg_page_size = 0;
              }
              if (matchregion != -1) {
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
      if (matchregion == -1) {
          /* hit using the background region */
 -        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->prot);
 +        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
      } else {
          uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
          uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
              xn = 1;
          }
 -        result->prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
 -        if (result->prot && !xn && !(pxn && !is_user)) {
 -            result->prot |= PAGE_EXEC;
 +        result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
 +        if (result->f.prot && !xn && !(pxn && !is_user)) {
 +            result->f.prot |= PAGE_EXEC;
          }
          /*
           * We don't need to look the attribute up in the MAIR0/MAIR1
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
      fi->type = ARMFault_Permission;
      fi->level = 1;
 -    return !(result->prot & (1 << access_type));
 +    return !(result->f.prot & (1 << access_type));
  }
  static bool v8m_is_sau_exempt(CPUARMState *env,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
                  } else {
                      fi->type = ARMFault_QEMU_SFault;
                  }
 -                result->page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
 -                result->phys = address;
 -                result->prot = 0;
 +                result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
 +                result->f.phys_addr = address;
 +                result->f.prot = 0;
                  return true;
              }
          } else {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
               * might downgrade a secure access to nonsecure.
               */
              if (sattrs.ns) {
 -                result->attrs.secure = false;
 +                result->f.attrs.secure = false;
              } else if (!secure) {
                  /*
                   * NS access to S memory must fault.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
                   * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
                   */
                  fi->type = ARMFault_QEMU_SFault;
 -                result->page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
 -                result->phys = address;
 -                result->prot = 0;
 +                result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
 +                result->f.phys_addr = address;
 +                result->f.prot = 0;
                  return true;
              }
          }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
      ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
                              result, fi, NULL);
      if (sattrs.subpage) {
 -        result->page_size = 1;
 +        result->f.lg_page_size = 0;
      }
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
          result->cacheattrs.is_s2_format = false;
      }
 -    result->phys = address;
 -    result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 -    result->page_size = TARGET_PAGE_SIZE;
 +    result->f.phys_addr = address;
 +    result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 +    result->f.lg_page_size = TARGET_PAGE_BITS;
      result->cacheattrs.shareability = shareability;
      result->cacheattrs.attrs = memattr;
      return 0;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                  return ret;
              }
 -            ipa = result->phys;
 -            ipa_secure = result->attrs.secure;
 +            ipa = result->f.phys_addr;
 +            ipa_secure = result->f.attrs.secure;
              if (is_secure) {
                  /* Select TCR based on the NS bit from the S1 walk. */
                  s2walk_secure = !(ipa_secure
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
               * Save the stage1 results so that we may merge
               * prot and cacheattrs later.
               */
 -            s1_prot = result->prot;
 +            s1_prot = result->f.prot;
              cacheattrs1 = result->cacheattrs;
              memset(result, 0, sizeof(*result));
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
              fi->s2addr = ipa;
              /* Combine the S1 and S2 perms.  */
 -            result->prot &= s1_prot;
 +            result->f.prot &= s1_prot;
              /* If S2 fails, return early.  */
              if (ret) {
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
               * Check if IPA translates to secure or non-secure PA space.
               * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
               */
 -            result->attrs.secure =
 +            result->f.attrs.secure =
                  (is_secure
                   && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
                   && (ipa_secure
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
       * cannot upgrade an non-secure translation regime's attributes
       * to secure.
       */
 -    result->attrs.secure = is_secure;
 -    result->attrs.user = regime_is_user(env, mmu_idx);
 +    result->f.attrs.secure = is_secure;
 +    result->f.attrs.user = regime_is_user(env, mmu_idx);
      /*
       * Fast Context Switch Extension. This doesn't exist at all in v8.
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
      if (arm_feature(env, ARM_FEATURE_PMSA)) {
          bool ret;
 -        result->page_size = TARGET_PAGE_SIZE;
 +        result->f.lg_page_size = TARGET_PAGE_BITS;
          if (arm_feature(env, ARM_FEATURE_V8)) {
+             /* PMSAv8 */
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
+                       (access_type == MMU_DATA_STORE ? "writing" : "execute"),
+                       (uint32_t)address, mmu_idx,
+                       ret ? "Miss" : "Hit",
+-                      result->prot & PAGE_READ ? 'r' : '-',
+-                      result->prot & PAGE_WRITE ? 'w' : '-',
+-                      result->prot & PAGE_EXEC ? 'x' : '-');
++                      result->f.prot & PAGE_READ ? 'r' : '-',
++                      result->f.prot & PAGE_WRITE ? 'w' : '-',
++                      result->f.prot & PAGE_EXEC ? 'x' : '-');
+         return ret;
+     }
+@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
+     bool ret;
+     ret = get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &res, &fi);
+-    *attrs = res.attrs;
++    *attrs = res.f.attrs;
+     if (ret) {
+         return -1;
+     }
+-    return res.phys;
++    return res.f.phys_addr;
+ }
+diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tlb_helper.c
++++ b/target/arm/tlb_helper.c
+@@ -XXX,XX +XXX,XX @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+          * target page size are handled specially, so for those we
+          * pass in the exact addresses.
+          */
+-        if (res.page_size >= TARGET_PAGE_SIZE) {
+-            res.phys &= TARGET_PAGE_MASK;
++        if (res.f.lg_page_size >= TARGET_PAGE_BITS) {
++            res.f.phys_addr &= TARGET_PAGE_MASK;
+             address &= TARGET_PAGE_MASK;
+         }
+         /* Notice and record tagged memory. */
+         if (cpu_isar_feature(aa64_mte, cpu) && res.cacheattrs.attrs == 0xf0) {
+-            arm_tlb_mte_tagged(&res.attrs) = true;
++            arm_tlb_mte_tagged(&res.f.attrs) = true;
+         }
+-        tlb_set_page_with_attrs(cs, address, res.phys, res.attrs,
+-                                res.prot, mmu_idx, res.page_size);
++        tlb_set_page_full(cs, mmu_idx, address, &res.f);
+         return true;
+     } else if (probe) {
+         return false;
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 02/20] hw/sd: fix out-of-bounds check for multi block reads
+[PULL 25/28] hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3
-From: Michael Olbrich <m.olbrich@pengutronix.de>
+From: Jerome Forissier <jerome.forissier@linaro.org>
-The current code checks if the next block exceeds the size of the card.
+According to the Linux kernel booting.rst [1], CPTR_EL3.ESM and
-This generates an error while reading the last block of the card.
+SCR_EL3.EnTP2 must be initialized to 1 when EL3 is present and FEAT_SME
-Do the out-of-bounds check when starting to read a new block to fix this.
+is advertised. This has to be taken care of when QEMU boots directly
+into the kernel (i.e., "-M virt,secure=on -cpu max -kernel Image").
 This issue became visible with increased error checking in Linux 4.13.
 Cc: qemu-stable@nongnu.org
-Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
+Fixes: 78cb9776662a ("target/arm: Enable SME for -cpu max")
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Link: [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/arm64/booting.rst?h=v6.0#n321
-Message-id: 20170916091611.10241-1-m.olbrich@pengutronix.de
+Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
 Message-id: 20221003145641.1921467-1-jerome.forissier@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sd.c | 12 ++++++------
+ hw/arm/boot.c | 4 ++++
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 4 insertions(+)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/hw/arm/boot.c
-+++ b/hw/sd/sd.c
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
+@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-         break;
+                     if (cpu_isar_feature(aa64_sve, cpu)) {
+                         env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
-     case 18:    /* CMD18:  READ_MULTIPLE_BLOCK */
+                     }
--        if (sd->data_offset == 0)
++                    if (cpu_isar_feature(aa64_sme, cpu)) {
-+        if (sd->data_offset == 0) {
++                        env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
-+            if (sd->data_start + io_len > sd->size) {
++                        env->cp15.scr_el3 |= SCR_ENTP2;
-+                sd->card_status |= ADDRESS_ERROR;
++                    }
-+                return 0x00;
+                     /* AArch64 kernels never boot in secure mode */
-+            }
+                     assert(!info->secure_boot);
-             BLK_READ_BLOCK(sd->data_start, io_len);
+                     /* This hook is only supported for AArch32 currently:
 +        }
          ret = sd->data[sd->data_offset ++];
          if (sd->data_offset >= io_len) {
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
                      break;
                  }
              }
 -
 -            if (sd->data_start + io_len > sd->size) {
 -                sd->card_status |= ADDRESS_ERROR;
 -                break;
 -            }
          }
          break;
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 19/20] target/arm: Factor out "get mmuidx for specified security state"
+[PULL 26/28] target/arm: Don't allow guest to use unimplemented granule sizes
-For the SG instruction and secure function return we are going
+Arm CPUs support some subset of the granule (page) sizes 4K, 16K and
-to want to do memory accesses using the MMU index of the CPU
+K.  The guest selects the one it wants using bits in the TCR_ELx
-in secure state, even though the CPU is currently in non-secure
+registers.  If it tries to program these registers with a value that
-state. Write arm_v7m_mmu_idx_for_secstate() to do this job,
+is either reserved or which requests a size that the CPU does not
-and use it in cpu_mmu_index().
+implement, the architecture requires that the CPU behaves as if the
+field was programmed to some size that has been implemented.
 Currently we don't implement this, and instead let the guest use any
 granule size, even if the CPU ID register fields say it isn't
 present.
 Make aa64_va_parameters() check against the supported granule size
 and force use of a different one if it is not implemented.
 (A subsequent commit will make ARMVAParameters use the new enum
 rather than the current pair of using16k/using64k bools.)
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20221003162315.2833797-2-peter.maydell@linaro.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1506092407-26985-17-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 32 +++++++++++++++++++++-----------
+ target/arm/cpu.h       |  33 +++++++++++++
-file changed, 21 insertions(+), 11 deletions(-)
+ target/arm/internals.h |   9 ++++
  target/arm/helper.c    | 102 +++++++++++++++++++++++++++++++++++++----
 files changed, 136 insertions(+), 8 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_tgran16_2_lpa2(const ARMISARegisters *id)
      return t >= 3 || (t == 0 && isar_feature_aa64_tgran16_lpa2(id));
  }
 +static inline bool isar_feature_aa64_tgran4(const ARMISARegisters *id)
 +{
 +    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 0;
 +}
 +
 +static inline bool isar_feature_aa64_tgran16(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 1;
 +}
 +
 +static inline bool isar_feature_aa64_tgran64(const ARMISARegisters *id)
 +{
 +    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64) >= 0;
 +}
 +
 +static inline bool isar_feature_aa64_tgran4_2(const ARMISARegisters *id)
 +{
 +    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);
 +    return t >= 2 || (t == 0 && isar_feature_aa64_tgran4(id));
 +}
 +
 +static inline bool isar_feature_aa64_tgran16_2(const ARMISARegisters *id)
 +{
 +    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);
 +    return t >= 2 || (t == 0 && isar_feature_aa64_tgran16(id));
 +}
 +
 +static inline bool isar_feature_aa64_tgran64_2(const ARMISARegisters *id)
 +{
 +    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64_2);
 +    return t >= 2 || (t == 0 && isar_feature_aa64_tgran64(id));
 +}
 +
  static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
  {
      return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
      return valid;
  }
 +/* Granule size (i.e. page size) */
 +typedef enum ARMGranuleSize {
 +    /* Same order as TG0 encoding */
 +    Gran4K,
 +    Gran64K,
 +    Gran16K,
 +    GranInvalid,
 +} ARMGranuleSize;
 +
  /*
   * Parameters of a given virtual address, as extracted from the
   * translation control register (TCR) for a given regime.
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
      }
  }
-+/* Return the MMU index for a v7M CPU in the specified security state */
++static ARMGranuleSize tg0_to_gran_size(int tg)
-+static inline ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env,
++{
-+                                                     bool secstate)
++    switch (tg) {
-+{
++    case 0:
-+    int el = arm_current_el(env);
++        return Gran4K;
-+    ARMMMUIdx mmu_idx;
++    case 1:
-+
++        return Gran64K;
-+    if (el == 0) {
++    case 2:
-+        mmu_idx = secstate ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
++        return Gran16K;
-+    } else {
++    default:
-+        mmu_idx = secstate ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
++        return GranInvalid;
 +    }
-+
++}
-+    if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) {
++
-+        mmu_idx = secstate ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
++static ARMGranuleSize tg1_to_gran_size(int tg)
-+    }
++{
-+
++    switch (tg) {
-+    return mmu_idx;
++    case 1:
-+}
++        return Gran16K;
-+
++    case 2:
- /* Determine the current mmu_idx to use for normal loads/stores */
++        return Gran4K;
- static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
++    case 3:
 +        return Gran64K;
 +    default:
 +        return GranInvalid;
 +    }
 +}
 +
 +static inline bool have4k(ARMCPU *cpu, bool stage2)
 +{
 +    return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu)
 +        : cpu_isar_feature(aa64_tgran4, cpu);
 +}
 +
 +static inline bool have16k(ARMCPU *cpu, bool stage2)
 +{
 +    return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu)
 +        : cpu_isar_feature(aa64_tgran16, cpu);
 +}
 +
 +static inline bool have64k(ARMCPU *cpu, bool stage2)
 +{
 +    return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu)
 +        : cpu_isar_feature(aa64_tgran64, cpu);
 +}
 +
 +static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran,
 +                                         bool stage2)
 +{
 +    switch (gran) {
 +    case Gran4K:
 +        if (have4k(cpu, stage2)) {
 +            return gran;
 +        }
 +        break;
 +    case Gran16K:
 +        if (have16k(cpu, stage2)) {
 +            return gran;
 +        }
 +        break;
 +    case Gran64K:
 +        if (have64k(cpu, stage2)) {
 +            return gran;
 +        }
 +        break;
 +    case GranInvalid:
 +        break;
 +    }
 +    /*
 +     * If the guest selects a granule size that isn't implemented,
 +     * the architecture requires that we behave as if it selected one
 +     * that is (with an IMPDEF choice of which one to pick). We choose
 +     * to implement the smallest supported granule size.
 +     */
 +    if (have4k(cpu, stage2)) {
 +        return Gran4K;
 +    }
 +    if (have16k(cpu, stage2)) {
 +        return Gran16K;
 +    }
 +    assert(have64k(cpu, stage2));
 +    return Gran64K;
 +}
 +
  ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                     ARMMMUIdx mmu_idx, bool data)
  {
-     int el = arm_current_el(env);
+     uint64_t tcr = regime_tcr(env, mmu_idx);
+     bool epd, hpd, using16k, using64k, tsz_oob, ds;
-     if (arm_feature(env, ARM_FEATURE_M)) {
+     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
--        ARMMMUIdx mmu_idx;
++    ARMGranuleSize gran;
--
+     ARMCPU *cpu = env_archcpu(env);
--        if (el == 0) {
++    bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
--            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
--        } else {
+     if (!regime_has_2_ranges(mmu_idx)) {
--            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
+         select = 0;
--        }
+         tsz = extract32(tcr, 0, 6);
--
+-        using64k = extract32(tcr, 14, 1);
--        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
+-        using16k = extract32(tcr, 15, 1);
--            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
+-        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
--        }
++        gran = tg0_to_gran_size(extract32(tcr, 14, 2));
-+        ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
++        if (stage2) {
+             /* VTCR_EL2 */
-         return arm_to_core_mmu_idx(mmu_idx);
+             hpd = false;
          } else {
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          select = extract64(va, 55, 1);
          if (!select) {
              tsz = extract32(tcr, 0, 6);
 +            gran = tg0_to_gran_size(extract32(tcr, 14, 2));
              epd = extract32(tcr, 7, 1);
              sh = extract32(tcr, 12, 2);
 -            using64k = extract32(tcr, 14, 1);
 -            using16k = extract32(tcr, 15, 1);
              hpd = extract64(tcr, 41, 1);
          } else {
 -            int tg = extract32(tcr, 30, 2);
 -            using16k = tg == 1;
 -            using64k = tg == 3;
              tsz = extract32(tcr, 16, 6);
 +            gran = tg1_to_gran_size(extract32(tcr, 30, 2));
              epd = extract32(tcr, 23, 1);
              sh = extract32(tcr, 28, 2);
              hpd = extract64(tcr, 42, 1);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          ds = extract64(tcr, 59, 1);
      }
++    gran = sanitize_gran_size(cpu, gran, stage2);
++    using64k = gran == Gran64K;
++    using16k = gran == Gran16K;
++
+     if (cpu_isar_feature(aa64_st, cpu)) {
+         max_tsz = 48 - using64k;
+     } else {
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 17/20] target/arm: Implement security attribute lookups for memory accesses
+[PULL 27/28] target/arm: Use ARMGranuleSize in ARMVAParameters
-Implement the security attribute lookups for memory accesses
+Now we have an enum for the granule size, use it in the
-in the get_phys_addr() functions, causing these to generate
+ARMVAParameters struct instead of the using16k/using64k bools.
 various kinds of SecureFault for bad accesses.
 The major subtlety in this code relates to handling of the
 case when the security attributes the SAU assigns to the
 address don't match the current security state of the CPU.
 In the ARM ARM pseudocode for validating instruction
 accesses, the security attributes of the address determine
 whether the Secure or NonSecure MPU state is used. At face
 value, handling this would require us to encode the relevant
 bits of state into mmu_idx for both S and NS at once, which
 would result in our needing 16 mmu indexes. Fortunately we
 don't actually need to do this because a mismatch between
 address attributes and CPU state means either:
  * some kind of fault (usually a SecureFault, but in theory
    perhaps a UserFault for unaligned access to Device memory)
  * execution of the SG instruction in NS state from a
    Secure & NonSecure code region
 The purpose of SG is simply to flip the CPU into Secure
 state, so we can handle it by emulating execution of that
 instruction directly in arm_v7m_cpu_do_interrupt(), which
 means we can treat all the mismatch cases as "throw an
 exception" and we don't need to encode the state of the
 other MPU bank into our mmu_idx values.
 This commit doesn't include the actual emulation of SG;
 it also doesn't include implementation of the IDAU, which
 is a per-board way to specify hard-coded memory attributes
 for addresses, which override the CPU-internal SAU if they
 specify a more secure setting than the SAU is programmed to.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-15-git-send-email-peter.maydell@linaro.org
+Message-id: 20221003162315.2833797-3-peter.maydell@linaro.org
 ---
- target/arm/internals.h |  15 ++++
+ target/arm/internals.h | 23 +++++++++++++++++++++--
- target/arm/helper.c    | 182 ++++++++++++++++++++++++++++++++++++++++++++++++-
+ target/arm/helper.c    | 39 ++++++++++++++++++++++++++++-----------
-files changed, 195 insertions(+), 2 deletions(-)
+ target/arm/ptw.c       |  8 +-------
 files changed, 50 insertions(+), 20 deletions(-)
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMGranuleSize {
- FIELD(V7M_EXCRET, S, 6, 1)
+     GranInvalid,
- FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+ } ARMGranuleSize;
-+/* We use a few fake FSR values for internal purposes in M profile.
++/**
-+ * M profile cores don't have A/R format FSRs, but currently our
++ * arm_granule_bits: Return address size of the granule in bits
-+ * get_phys_addr() code assumes A/R profile and reports failures via
++ *
-+ * an A/R format FSR value. We then translate that into the proper
++ * Return the address size of the granule in bits. This corresponds
-+ * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
++ * to the pseudocode TGxGranuleBits().
 + * Mostly the FSR values we use for this are those defined for v7PMSA,
 + * since we share some of that codepath. A few kinds of fault are
 + * only for M profile and have no A/R equivalent, though, so we have
 + * to pick a value from the reserved range (which we never otherwise
 + * generate) to use for these.
 + * These values will never be visible to the guest.
 + */
-+#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
++static inline int arm_granule_bits(ARMGranuleSize gran)
-+#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
++{
 +    switch (gran) {
 +    case Gran64K:
 +        return 16;
 +    case Gran16K:
 +        return 14;
 +    case Gran4K:
 +        return 12;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
  /*
-  * For AArch64, map a given EL to an index in the banked_spsr array.
+  * Parameters of a given virtual address, as extracted from the
-  * Note that this mapping and the AArch32 mapping defined in bank_number()
+  * translation control register (TCR) for a given regime.
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
      bool tbi        : 1;
      bool epd        : 1;
      bool hpd        : 1;
 -    bool using16k   : 1;
 -    bool using64k   : 1;
      bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
      bool ds         : 1;
 +    ARMGranuleSize gran : 2;
  } ARMVAParameters;
  ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ typedef struct {
-                                target_ulong *page_size_ptr, uint32_t *fsr,
+     uint64_t length;
-                                ARMMMUFaultInfo *fi);
+ } TLBIRange;
-+/* Security attributes for an address, as returned by v8m_security_lookup. */
++static ARMGranuleSize tlbi_range_tg_to_gran_size(int tg)
 +typedef struct V8M_SAttributes {
 +    bool ns;
 +    bool nsc;
 +    uint8_t sregion;
 +    bool srvalid;
 +    uint8_t iregion;
 +    bool irvalid;
 +} V8M_SAttributes;
 +
  /* Definitions for the PMCCNTR and PMCR registers */
  #define PMCRD   0x8
  #define PMCRC   0x4
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
           * raises the fault, in the A profile short-descriptor format.
           */
          switch (env->exception.fsr & 0xf) {
 +        case M_FAKE_FSR_NSC_EXEC:
 +            /* Exception generated when we try to execute code at an address
 +             * which is marked as Secure & Non-Secure Callable and the CPU
 +             * is in the Non-Secure state. The only instruction which can
 +             * be executed like this is SG (and that only if both halves of
 +             * the SG instruction have the same security attributes.)
 +             * Everything else must generate an INVEP SecureFault, so we
 +             * emulate the SG instruction here.
 +             * TODO: actually emulate SG.
 +             */
 +            env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +            qemu_log_mask(CPU_LOG_INT,
 +                          "...really SecureFault with SFSR.INVEP\n");
 +            break;
 +        case M_FAKE_FSR_SFAULT:
 +            /* Various flavours of SecureFault for attempts to execute or
 +             * access data in the wrong security state.
 +             */
 +            switch (cs->exception_index) {
 +            case EXCP_PREFETCH_ABORT:
 +                if (env->v7m.secure) {
 +                    env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
 +                    qemu_log_mask(CPU_LOG_INT,
 +                                  "...really SecureFault with SFSR.INVTRAN\n");
 +                } else {
 +                    env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
 +                    qemu_log_mask(CPU_LOG_INT,
 +                                  "...really SecureFault with SFSR.INVEP\n");
 +                }
 +                break;
 +            case EXCP_DATA_ABORT:
 +                /* This must be an NS access to S memory */
 +                env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
 +                qemu_log_mask(CPU_LOG_INT,
 +                              "...really SecureFault with SFSR.AUVIOL\n");
 +                break;
 +            }
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +            break;
          case 0x8: /* External Abort */
              switch (cs->exception_index) {
              case EXCP_PREFETCH_ABORT:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
      return !(*prot & (1 << access_type));
  }
 +static bool v8m_is_sau_exempt(CPUARMState *env,
 +                              uint32_t address, MMUAccessType access_type)
 +{
-+    /* The architecture specifies that certain address ranges are
++    /*
-+     * exempt from v8M SAU/IDAU checks.
++     * Note that the TLBI range TG field encoding differs from both
 +     * TG0 and TG1 encodings.
 +     */
-+    return
++    switch (tg) {
-+        (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
++    case 1:
-+        (address >= 0xe0000000 && address <= 0xe0002fff) ||
++        return Gran4K;
-+        (address >= 0xe000e000 && address <= 0xe000efff) ||
++    case 2:
-+        (address >= 0xe002e000 && address <= 0xe002efff) ||
++        return Gran16K;
-+        (address >= 0xe0040000 && address <= 0xe0041fff) ||
++    case 3:
-+        (address >= 0xe00ff000 && address <= 0xe00fffff);
++        return Gran64K;
-+}
++    default:
-+
++        return GranInvalid;
 +static void v8m_security_lookup(CPUARMState *env, uint32_t address,
 +                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
 +                                V8M_SAttributes *sattrs)
 +{
 +    /* Look up the security attributes for this address. Compare the
 +     * pseudocode SecurityCheck() function.
 +     * We assume the caller has zero-initialized *sattrs.
 +     */
 +    ARMCPU *cpu = arm_env_get_cpu(env);
 +    int r;
 +
 +    /* TODO: implement IDAU */
 +
 +    if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
 +        /* 0xf0000000..0xffffffff is always S for insn fetches */
 +        return;
 +    }
 +
 +    if (v8m_is_sau_exempt(env, address, access_type)) {
 +        sattrs->ns = !regime_is_secure(env, mmu_idx);
 +        return;
 +    }
 +
 +    switch (env->sau.ctrl & 3) {
 +    case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
 +        break;
 +    case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
 +        sattrs->ns = true;
 +        break;
 +    default: /* SAU.ENABLE == 1 */
 +        for (r = 0; r < cpu->sau_sregion; r++) {
 +            if (env->sau.rlar[r] & 1) {
 +                uint32_t base = env->sau.rbar[r] & ~0x1f;
 +                uint32_t limit = env->sau.rlar[r] | 0x1f;
 +
 +                if (base <= address && limit >= address) {
 +                    if (sattrs->srvalid) {
 +                        /* If we hit in more than one region then we must report
 +                         * as Secure, not NS-Callable, with no valid region
 +                         * number info.
 +                         */
 +                        sattrs->ns = false;
 +                        sattrs->nsc = false;
 +                        sattrs->sregion = 0;
 +                        sattrs->srvalid = false;
 +                        break;
 +                    } else {
 +                        if (env->sau.rlar[r] & 2) {
 +                            sattrs->nsc = true;
 +                        } else {
 +                            sattrs->ns = true;
 +                        }
 +                        sattrs->srvalid = true;
 +                        sattrs->sregion = r;
 +                    }
 +                }
 +            }
 +        }
 +
 +        /* TODO when we support the IDAU then it may override the result here */
 +        break;
 +    }
 +}
 +
- static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
+ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
-                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                                      uint64_t value)
 -                                 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
 +                                 hwaddr *phys_ptr, MemTxAttrs *txattrs,
 +                                 int *prot, uint32_t *fsr)
  {
-     ARMCPU *cpu = arm_env_get_cpu(env);
+@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
-     bool is_user = regime_is_user(env, mmu_idx);
+     uint64_t select = sextract64(value, 36, 1);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
+     ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true);
-     int n;
+     TLBIRange ret = { };
-     int matchregion = -1;
++    ARMGranuleSize gran;
-     bool hit = false;
-+    V8M_SAttributes sattrs = {};
+     page_size_granule = extract64(value, 46, 2);
++    gran = tlbi_range_tg_to_gran_size(page_size_granule);
-     *phys_ptr = address;
-     *prot = 0;
+     /* The granule encoded in value must match the granule in use. */
+-    if (page_size_granule != (param.using64k ? 3 : param.using16k ? 2 : 1)) {
-+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++    if (gran != param.gran) {
-+        v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
+         qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
-+        if (access_type == MMU_INST_FETCH) {
+                       page_size_granule);
-+            /* Instruction fetches always use the MMU bank and the
+         return ret;
-+             * transaction attribute determined by the fetch address,
+     }
-+             * regardless of CPU state. This is painful for QEMU
-+             * to handle, because it would mean we need to encode
+-    page_shift = (page_size_granule - 1) * 2 + 12;
-+             * into the mmu_idx not just the (user, negpri) information
++    page_shift = arm_granule_bits(gran);
-+             * for the current security state but also that for the
+     num = extract64(value, 39, 5);
-+             * other security state, which would balloon the number
+     scale = extract64(value, 44, 2);
-+             * of mmu_idx values needed alarmingly.
+     exponent = (5 * scale) + 1;
-+             * Fortunately we can avoid this because it's not actually
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-+             * possible to arbitrarily execute code from memory with
+                                    ARMMMUIdx mmu_idx, bool data)
-+             * the wrong security attribute: it will always generate
+ {
-+             * an exception of some kind or another, apart from the
+     uint64_t tcr = regime_tcr(env, mmu_idx);
-+             * special case of an NS CPU executing an SG instruction
+-    bool epd, hpd, using16k, using64k, tsz_oob, ds;
-+             * in S&NSC memory. So we always just fail the translation
++    bool epd, hpd, tsz_oob, ds;
-+             * here and sort things out in the exception handler
+     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
-+             * (including possibly emulating an SG instruction).
+     ARMGranuleSize gran;
-+             */
+     ARMCPU *cpu = env_archcpu(env);
-+            if (sattrs.ns != !secure) {
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-+                *fsr = sattrs.nsc ? M_FAKE_FSR_NSC_EXEC : M_FAKE_FSR_SFAULT;
+     }
-+                return true;
-+            }
+     gran = sanitize_gran_size(cpu, gran, stage2);
-+        } else {
+-    using64k = gran == Gran64K;
-+            /* For data accesses we always use the MMU bank indicated
+-    using16k = gran == Gran16K;
-+             * by the current CPU state, but the security attributes
-+             * might downgrade a secure access to nonsecure.
+     if (cpu_isar_feature(aa64_st, cpu)) {
-+             */
+-        max_tsz = 48 - using64k;
-+            if (sattrs.ns) {
++        max_tsz = 48 - (gran == Gran64K);
-+                txattrs->secure = false;
+     } else {
-+            } else if (!secure) {
+         max_tsz = 39;
-+                /* NS access to S memory must fault.
+     }
-+                 * Architecturally we should first check whether the
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-+                 * MPU information for this address indicates that we
+      * adjust the effective value of DS, as documented.
-+                 * are doing an unaligned access to Device memory, which
+      */
-+                 * should generate a UsageFault instead. QEMU does not
+     min_tsz = 16;
-+                 * currently check for that kind of unaligned access though.
+-    if (using64k) {
-+                 * If we added it we would need to do so as a special case
++    if (gran == Gran64K) {
-+                 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
+         if (cpu_isar_feature(aa64_lva, cpu)) {
-+                 */
+             min_tsz = 12;
-+                *fsr = M_FAKE_FSR_SFAULT;
+         }
-+                return true;
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-+            }
+         switch (mmu_idx) {
-+        }
+         case ARMMMUIdx_Stage2:
-+    }
+         case ARMMMUIdx_Stage2_S:
-+
+-            if (using16k) {
-     /* Unlike the ARM ARM pseudocode, we don't need to check whether this
++            if (gran == Gran16K) {
-      * was an exception vector read from the vector table (which is always
+                 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
-      * done using the default system address map), because those accesses
+             } else {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+                 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
-         if (arm_feature(env, ARM_FEATURE_V8)) {
+             }
-             /* PMSAv8 */
+             break;
-             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
+         default:
--                                       phys_ptr, prot, fsr);
+-            if (using16k) {
-+                                       phys_ptr, attrs, prot, fsr);
++            if (gran == Gran16K) {
-         } else if (arm_feature(env, ARM_FEATURE_V7)) {
+                 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
-             /* PMSAv7 */
+             } else {
-             ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
+                 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          .tbi = tbi,
          .epd = epd,
          .hpd = hpd,
 -        .using16k = using16k,
 -        .using64k = using64k,
          .tsz_oob = tsz_oob,
          .ds = ds,
 +        .gran = gran,
      };
  }
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          }
      }
 -    if (param.using64k) {
 -        stride = 13;
 -    } else if (param.using16k) {
 -        stride = 11;
 -    } else {
 -        stride = 9;
 -    }
 +    stride = arm_granule_bits(param.gran) - 3;
      /*
       * Note that QEMU ignores shareability and cacheability attributes,
 --
-.7.4
+.25.1

-[Qemu-devel] [PULL 20/20] nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit
+[PULL 28/28] docs/system/arm/emulation.rst: Report FEAT_GTG support
-When we added support for the new SHCSR bits in v8M in commit
+FEAT_GTG is a change tho the ID register ID_AA64MMFR0_EL1 so that it
-d59c17e9 the code to support writing to the new HARDFAULTPENDED
+can report a different set of supported granule (page) sizes for
-bit was accidentally only added for non-secure writes; the
+stage 1 and stage 2 translation tables.  As of commit c20281b2a5048
-secure banked version of the bit should also be writable.
+we already report the granule sizes that way for '-cpu max', and now
 we also correctly make attempts to use unimplemented granule sizes
 fail, so we can report the support of the feature in the
 documentation.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20221003162315.2833797-4-peter.maydell@linaro.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1506092407-26985-21-git-send-email-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 1 +
+ docs/system/arm/emulation.rst | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/intc/armv7m_nvic.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
+ - FEAT_FRINTTS (Floating-point to integer instructions)
-             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
+ - FEAT_FlagM (Flag manipulation instructions v2)
-                 (value & (1 << 18)) != 0;
+ - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
-+            s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
++- FEAT_GTG (Guest translation granule size)
-             /* SecureFault not banked, but RAZ/WI to NS */
+ - FEAT_HCX (Support for the HCRX_EL2 register)
-             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
+ - FEAT_HPDS (Hierarchical permission disables)
-             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
+ - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
 --
-.7.4
+.25.1

Mostly my stuff with a few easy patches from others. I know I have
a few big series in my to-review queue, but I've been too jetlagged
to try to tackle those :-(

thanks
-- PMM

The following changes since commit a26a98dfb9d448d7234d931ae3720feddf6f0651:

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20171006' into staging (2017-10-06 13:19:03 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171006

for you to fetch changes up to 04829ce334bece78d4fa1d0fdbc8bc27dae9b242:

nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit (2017-10-06 16:46:49 +0100)

----------------------------------------------------------------
target-arm:
 * v8M: more preparatory work
 * nvic: reset properly rather than leaving the nvic in a weird state
 * xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
 * sd: fix out-of-bounds check for multi block reads
 * arm: Fix SMC reporting to EL2 when QEMU provides PSCI

----------------------------------------------------------------
Jan Kiszka (1):
      arm: Fix SMC reporting to EL2 when QEMU provides PSCI

Michael Olbrich (1):
      hw/sd: fix out-of-bounds check for multi block reads

Peter Maydell (17):
      nvic: Clear the vector arrays and prigroup on reset
      target/arm: Don't switch to target stack early in v7M exception return
      target/arm: Prepare for CONTROL.SPSEL being nonzero in Handler mode
      target/arm: Restore security state on exception return
      target/arm: Restore SPSEL to correct CONTROL register on exception return
      target/arm: Check for xPSR mismatch usage faults earlier for v8M
      target/arm: Warn about restoring to unaligned stack
      target/arm: Don't warn about exception return with PC low bit set for v8M
      target/arm: Add new-in-v8M SFSR and SFAR
      target/arm: Update excret sanity checks for v8M
      target/arm: Add support for restoring v8M additional state context
      target/arm: Add v8M support to exception entry code
      nvic: Implement Security Attribution Unit registers
      target/arm: Implement security attribute lookups for memory accesses
      target/arm: Fix calculation of secure mm_idx values
      target/arm: Factor out "get mmuidx for specified security state"
      nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit

Thomas Huth (1):
      hw/arm/xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false

From: Jan Kiszka <jan.kiszka@siemens.com>

This properly forwards SMC events to EL2 when PSCI is provided by QEMU
itself and, thus, ARM_FEATURE_EL3 is off.

Found and tested with the Jailhouse hypervisor. Solution based on
suggestions by Peter Maydell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-id: 4f243068-aaea-776f-d18f-f9e05e7be9cd@siemens.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    |  9 ++++++++-
 target/arm/op_helper.c | 27 +++++++++++++++++----------
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         valid_mask &= ~HCR_HCD;
-    } else {
+    } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
+        /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
+         * However, if we're using the SMC PSCI conduit then QEMU is
+         * effectively acting like EL3 firmware and so the guest at
+         * EL2 should retain the ability to prevent EL1 from being
+         * able to make SMC calls into the ersatz firmware, so in
+         * that case HCR.TSC should be read/write.
+         */
         valid_mask &= ~HCR_TSC;
     }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
      */
     bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
 
-    if (arm_is_psci_call(cpu, EXCP_SMC)) {
-        /* If PSCI is enabled and this looks like a valid PSCI call then
-         * that overrides the architecturally mandated SMC behaviour.
+    if (!arm_feature(env, ARM_FEATURE_EL3) &&
+        cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
+        /* If we have no EL3 then SMC always UNDEFs and can't be
+         * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
+         * firmware within QEMU, and we want an EL2 guest to be able
+         * to forbid its EL1 from making PSCI calls into QEMU's
+         * "firmware" via HCR.TSC, so for these purposes treat
+         * PSCI-via-SMC as implying an EL3.
          */
-        return;
-    }
-
-    if (!arm_feature(env, ARM_FEATURE_EL3)) {
-        /* If we have no EL3 then SMC always UNDEFs */
         undef = true;
     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
-        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
+        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
+         * We also want an EL2 guest to be able to forbid its EL1 from
+         * making PSCI calls into QEMU's "firmware" via HCR.TSC.
+         */
         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
     }
 
-    if (undef) {
+    /* If PSCI is enabled and this looks like a valid PSCI call then
+     * suppress the UNDEF -- we'll catch the SMC exception and
+     * implement the PSCI call behaviour there.
+     */
+    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                         exception_target_el(env));
     }
-- 
2.7.4

From: Michael Olbrich <m.olbrich@pengutronix.de>

The current code checks if the next block exceeds the size of the card.
This generates an error while reading the last block of the card.
Do the out-of-bounds check when starting to read a new block to fix this.

This issue became visible with increased error checking in Linux 4.13.

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170916091611.10241-1-m.olbrich@pengutronix.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
         break;
 
     case 18:	/* CMD18:  READ_MULTIPLE_BLOCK */
-        if (sd->data_offset == 0)
+        if (sd->data_offset == 0) {
+            if (sd->data_start + io_len > sd->size) {
+                sd->card_status |= ADDRESS_ERROR;
+                return 0x00;
+            }
             BLK_READ_BLOCK(sd->data_start, io_len);
+        }
         ret = sd->data[sd->data_offset ++];
 
         if (sd->data_offset >= io_len) {
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
                     break;
                 }
             }
-
-            if (sd->data_start + io_len > sd->size) {
-                sd->card_status |= ADDRESS_ERROR;
-                break;
-            }
         }
         break;
 
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

The device uses serial_hds in its realize function and thus can't be
used twice. Apart from that, the comma in its name makes it quite hard
to use for the user anyway, since a comma is normally used to separate
the device name from its properties when using the "-device" parameter
or the "device_add" HMP command.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1506441116-16627-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)
 
     dc->props = xlnx_zynqmp_props;
     dc->realize = xlnx_zynqmp_realize;
+    /* Reason: Uses serial_hds in realize function, thus can't be used twice */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo xlnx_zynqmp_type_info = {
-- 
2.7.4

Reset for devices does not include an automatic clear of the
device state (unlike CPU state, where most of the state
structure is cleared to zero). Add some missing initialization
of NVIC state that meant that the device was left in the wrong
state if the guest did a warm reset.

(In particular, since we were resetting the computed state like
s->exception_prio but not all the state it was computed
from like s->vectors[x].active, the NVIC wound up in an
inconsistent state that could later trigger assertion failures.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1506092407-26985-2-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
     int resetprio;
     NVICState *s = NVIC(dev);
 
+    memset(s->vectors, 0, sizeof(s->vectors));
+    memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
+    s->prigroup[M_REG_NS] = 0;
+    s->prigroup[M_REG_S] = 0;
+
     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
     /* MEM, BUS, and USAGE are enabled through
      * the System Handler Control register
-- 
2.7.4

Currently our M profile exception return code switches to the
target stack pointer relatively early in the process, before
it tries to pop the exception frame off the stack. This is
awkward for v8M for two reasons:
 * in v8M the process vs main stack pointer is not selected
   purely by the value of CONTROL.SPSEL, so updating SPSEL
   and relying on that to switch to the right stack pointer
   won't work
 * the stack we should be reading the stack frame from and
   the stack we will eventually switch to might not be the
   same if the guest is doing strange things

Change our exception return code to use a 'frame pointer'
to read the exception frame rather than assuming that we
can switch the live stack pointer this early.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 130 +++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 98 insertions(+), 32 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push(CPUARMState *env, uint32_t val)
     stl_phys(cs->as, env->regs[13], val);
 }
 
-static uint32_t v7m_pop(CPUARMState *env)
-{
-    CPUState *cs = CPU(arm_env_get_cpu(env));
-    uint32_t val;
-
-    val = ldl_phys(cs->as, env->regs[13]);
-    env->regs[13] += 4;
-    return val;
-}
-
 /* Return true if we're using the process stack pointer (not the MSP) */
 static bool v7m_using_psp(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
     env->regs[15] = dest & ~1;
 }
 
+static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+                                bool spsel)
+{
+    /* Return a pointer to the location where we currently store the
+     * stack pointer for the requested security state and thread mode.
+     * This pointer will become invalid if the CPU state is updated
+     * such that the stack pointers are switched around (eg changing
+     * the SPSEL control bit).
+     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
+     * Unlike that pseudocode, we require the caller to pass us in the
+     * SPSEL control bit value; this is because we also use this
+     * function in handling of pushing of the callee-saves registers
+     * part of the v8M stack frame (pseudocode PushCalleeStack()),
+     * and in the tailchain codepath the SPSEL bit comes from the exception
+     * return magic LR value from the previous exception. The pseudocode
+     * opencodes the stack-selection in PushCalleeStack(), but we prefer
+     * to make this utility function generic enough to do the job.
+     */
+    bool want_psp = threadmode && spsel;
+
+    if (secure == env->v7m.secure) {
+        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
+         * so the SP we want is always in regs[13].
+         * When we decouple SPSEL from the actually selected SP
+         * we need to check want_psp against v7m_using_psp()
+         * to see whether we need regs[13] or v7m.other_sp.
+         */
+        return &env->regs[13];
+    } else {
+        if (want_psp) {
+            return &env->v7m.other_ss_psp;
+        } else {
+            return &env->v7m.other_ss_msp;
+        }
+    }
+}
+
 static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
 {
     CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
     uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     bool return_to_handler = false;
     bool rettobase = false;
     bool exc_secure = false;
+    bool return_to_secure;
 
     /* We can only get here from an EXCP_EXCEPTION_EXIT, and
      * gen_bx_excret() enforces the architectural rule
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
+    return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+        (excret & R_V7M_EXCRET_S_MASK);
+
     switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         return;
     }
 
-    /* Switch to the target stack.  */
+    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
+     * causes us to switch the active SP, but we will change this
+     * later to not do that so we can support v8M.
+     */
     switch_v7m_sp(env, return_to_sp_process);
-    /* Pop registers.  */
-    env->regs[0] = v7m_pop(env);
-    env->regs[1] = v7m_pop(env);
-    env->regs[2] = v7m_pop(env);
-    env->regs[3] = v7m_pop(env);
-    env->regs[12] = v7m_pop(env);
-    env->regs[14] = v7m_pop(env);
-    env->regs[15] = v7m_pop(env);
-    if (env->regs[15] & 1) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "M profile return from interrupt with misaligned "
-                      "PC is UNPREDICTABLE\n");
-        /* Actual hardware seems to ignore the lsbit, and there are several
-         * RTOSes out there which incorrectly assume the r15 in the stack
-         * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
+
+    {
+        /* The stack pointer we should be reading the exception frame from
+         * depends on bits in the magic exception return type value (and
+         * for v8M isn't necessarily the stack pointer we will eventually
+         * end up resuming execution with). Get a pointer to the location
+         * in the CPU state struct where the SP we need is currently being
+         * stored; we will use and modify it in place.
+         * We use this limited C variable scope so we don't accidentally
+         * use 'frame_sp_p' after we do something that makes it invalid.
+         */
+        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
+                                              return_to_secure,
+                                              !return_to_handler,
+                                              return_to_sp_process);
+        uint32_t frameptr = *frame_sp_p;
+
+        /* Pop registers. TODO: make these accesses use the correct
+         * attributes and address space (S/NS, priv/unpriv) and handle
+         * memory transaction failures.
          */
-        env->regs[15] &= ~1U;
+        env->regs[0] = ldl_phys(cs->as, frameptr);
+        env->regs[1] = ldl_phys(cs->as, frameptr + 0x4);
+        env->regs[2] = ldl_phys(cs->as, frameptr + 0x8);
+        env->regs[3] = ldl_phys(cs->as, frameptr + 0xc);
+        env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
+        env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
+        env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
+        if (env->regs[15] & 1) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "M profile return from interrupt with misaligned "
+                          "PC is UNPREDICTABLE\n");
+            /* Actual hardware seems to ignore the lsbit, and there are several
+             * RTOSes out there which incorrectly assume the r15 in the stack
+             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
+             */
+            env->regs[15] &= ~1U;
+        }
+        xpsr = ldl_phys(cs->as, frameptr + 0x1c);
+
+        /* Commit to consuming the stack frame */
+        frameptr += 0x20;
+        /* Undo stack alignment (the SPREALIGN bit indicates that the original
+         * pre-exception SP was not 8-aligned and we added a padding word to
+         * align it, so we undo this by ORing in the bit that increases it
+         * from the current 8-aligned value to the 8-unaligned value. (Adding 4
+         * would work too but a logical OR is how the pseudocode specifies it.)
+         */
+        if (xpsr & XPSR_SPREALIGN) {
+            frameptr |= 4;
+        }
+        *frame_sp_p = frameptr;
     }
-    xpsr = v7m_pop(env);
+    /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
     xpsr_write(env, xpsr, ~XPSR_SPREALIGN);
-    /* Undo stack alignment.  */
-    if (xpsr & XPSR_SPREALIGN) {
-        env->regs[13] |= 4;
-    }
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-- 
2.7.4

In the v7M architecture, there is an invariant that if the CPU is
in Handler mode then the CONTROL.SPSEL bit cannot be nonzero.
This in turn means that the current stack pointer is always
indicated by CONTROL.SPSEL, even though Handler mode always uses
the Main stack pointer.

In v8M, this invariant is removed, and CONTROL.SPSEL may now
be nonzero in Handler mode (though Handler mode still always
uses the Main stack pointer). In preparation for this change,
change how we handle this bit: rename switch_v7m_sp() to
the now more accurate write_v7m_control_spsel(), and make it
check both the handler mode state and the SPSEL bit.

Note that this implicitly changes the point at which we switch
active SP on exception exit from before we pop the exception
frame to after it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  8 ++++++-
 hw/intc/armv7m_nvic.c |  2 +-
 target/arm/helper.c   | 65 ++++++++++++++++++++++++++++++++++-----------------
 3 files changed, 51 insertions(+), 24 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void pmccntr_sync(CPUARMState *env);
 #define PSTATE_MODE_EL1t 4
 #define PSTATE_MODE_EL0t 0
 
+/* Write a new value to v7m.exception, thus transitioning into or out
+ * of Handler mode; this may result in a change of active stack pointer.
+ */
+void write_v7m_exception(CPUARMState *env, uint32_t new_exc);
+
 /* Map EL and handler into a PSTATE_MODE.  */
 static inline unsigned int aarch64_pstate_mode(unsigned int el, bool handler)
 {
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
         env->condexec_bits |= (val >> 8) & 0xfc;
     }
     if (mask & XPSR_EXCP) {
-        env->v7m.exception = val & XPSR_EXCP;
+        /* Note that this only happens on exception exit */
+        write_v7m_exception(env, val & XPSR_EXCP);
     }
 }
 
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_acknowledge_irq(void *opaque)
     vec->active = 1;
     vec->pending = 0;
 
-    env->v7m.exception = s->vectpending;
+    write_v7m_exception(env, s->vectpending);
 
     nvic_irq_update(s);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
 }
 
-/* Switch to V7M main or process stack pointer.  */
-static void switch_v7m_sp(CPUARMState *env, bool new_spsel)
+/* Write to v7M CONTROL.SPSEL bit. This may change the current
+ * stack pointer between Main and Process stack pointers.
+ */
+static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
 {
     uint32_t tmp;
-    uint32_t old_control = env->v7m.control[env->v7m.secure];
-    bool old_spsel = old_control & R_V7M_CONTROL_SPSEL_MASK;
+    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+
+    env->v7m.control[env->v7m.secure] =
+        deposit32(env->v7m.control[env->v7m.secure],
+                  R_V7M_CONTROL_SPSEL_SHIFT,
+                  R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+
+    new_is_psp = v7m_using_psp(env);
 
-    if (old_spsel != new_spsel) {
+    if (old_is_psp != new_is_psp) {
         tmp = env->v7m.other_sp;
         env->v7m.other_sp = env->regs[13];
         env->regs[13] = tmp;
+    }
+}
+
+void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+{
+    /* Write a new value to v7m.exception, thus transitioning into or out
+     * of Handler mode; this may result in a change of active stack pointer.
+     */
+    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+    uint32_t tmp;
 
-        env->v7m.control[env->v7m.secure] = deposit32(old_control,
-                                     R_V7M_CONTROL_SPSEL_SHIFT,
-                                     R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+    env->v7m.exception = new_exc;
+
+    new_is_psp = v7m_using_psp(env);
+
+    if (old_is_psp != new_is_psp) {
+        tmp = env->v7m.other_sp;
+        env->v7m.other_sp = env->regs[13];
+        env->regs[13] = tmp;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
     bool want_psp = threadmode && spsel;
 
     if (secure == env->v7m.secure) {
-        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
-         * so the SP we want is always in regs[13].
-         * When we decouple SPSEL from the actually selected SP
-         * we need to check want_psp against v7m_using_psp()
-         * to see whether we need regs[13] or v7m.other_sp.
-         */
-        return &env->regs[13];
+        if (want_psp == v7m_using_psp(env)) {
+            return &env->regs[13];
+        } else {
+            return &env->v7m.other_sp;
+        }
     } else {
         if (want_psp) {
             return &env->v7m.other_ss_psp;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
     uint32_t addr;
 
     armv7m_nvic_acknowledge_irq(env->nvic);
-    switch_v7m_sp(env, 0);
+    write_v7m_control_spsel(env, 0);
     arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         return;
     }
 
-    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
-     * causes us to switch the active SP, but we will change this
-     * later to not do that so we can support v8M.
+    /* Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
+     * Handler mode (and will be until we write the new XPSR.Interrupt
+     * field) this does not switch around the current stack pointer.
      */
-    switch_v7m_sp(env, return_to_sp_process);
+    write_v7m_control_spsel(env, return_to_sp_process);
 
     {
         /* The stack pointer we should be reading the exception frame from
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
     case 20: /* CONTROL */
         /* Writing to the SPSEL bit only has an effect if we are in
          * thread mode; other bits can be updated by any privileged code.
-         * switch_v7m_sp() deals with updating the SPSEL bit in
+         * write_v7m_control_spsel() deals with updating the SPSEL bit in
          * env->v7m.control, so we only need update the others.
          */
         if (!arm_v7m_is_handler_mode(env)) {
-            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+            write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
         }
         env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
         env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
-- 
2.7.4

Now that we can handle the CONTROL.SPSEL bit not necessarily being
in sync with the current stack pointer, we can restore the correct
security state on exception return. This happens before we start
to read registers off the stack frame, but after we have taken
possible usage faults for bad exception return magic values and
updated CONTROL.SPSEL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-5-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      */
     write_v7m_control_spsel(env, return_to_sp_process);
 
+    switch_v7m_security_state(env, return_to_secure);
+
     {
         /* The stack pointer we should be reading the exception frame from
          * depends on bits in the magic exception return type value (and
-- 
2.7.4

On exception return for v8M, the SPSEL bit in the EXC_RETURN magic
value should be restored to the SPSEL bit in the CONTROL register
banked specified by the EXC_RETURN.ES bit.

Add write_v7m_control_spsel_for_secstate() which behaves like
write_v7m_control_spsel() but allows the caller to specify which
CONTROL bank to use, reimplement write_v7m_control_spsel() in
terms of it, and use it in exception return.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 40 +++++++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
 }
 
-/* Write to v7M CONTROL.SPSEL bit. This may change the current
- * stack pointer between Main and Process stack pointers.
+/* Write to v7M CONTROL.SPSEL bit for the specified security bank.
+ * This may change the current stack pointer between Main and Process
+ * stack pointers if it is done for the CONTROL register for the current
+ * security state.
  */
-static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
+                                                 bool new_spsel,
+                                                 bool secstate)
 {
-    uint32_t tmp;
-    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+    bool old_is_psp = v7m_using_psp(env);
 
-    env->v7m.control[env->v7m.secure] =
-        deposit32(env->v7m.control[env->v7m.secure],
+    env->v7m.control[secstate] =
+        deposit32(env->v7m.control[secstate],
                   R_V7M_CONTROL_SPSEL_SHIFT,
                   R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
 
-    new_is_psp = v7m_using_psp(env);
+    if (secstate == env->v7m.secure) {
+        bool new_is_psp = v7m_using_psp(env);
+        uint32_t tmp;
 
-    if (old_is_psp != new_is_psp) {
-        tmp = env->v7m.other_sp;
-        env->v7m.other_sp = env->regs[13];
-        env->regs[13] = tmp;
+        if (old_is_psp != new_is_psp) {
+            tmp = env->v7m.other_sp;
+            env->v7m.other_sp = env->regs[13];
+            env->regs[13] = tmp;
+        }
     }
 }
 
+/* Write to v7M CONTROL.SPSEL bit. This may change the current
+ * stack pointer between Main and Process stack pointers.
+ */
+static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+{
+    write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
+}
+
 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
 {
     /* Write a new value to v7m.exception, thus transitioning into or out
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * Handler mode (and will be until we write the new XPSR.Interrupt
      * field) this does not switch around the current stack pointer.
      */
-    write_v7m_control_spsel(env, return_to_sp_process);
+    write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
 
     switch_v7m_security_state(env, return_to_secure);
 
-- 
2.7.4

ARM v8M specifies that the INVPC usage fault for mismatched
xPSR exception field and handler mode bit should be checked
before updating the PSR and SP, so that the fault is taken
with the existing stack frame rather than by pushing a new one.
Perform this check in the right place for v8M.

Since v7M specifies in its pseudocode that this usage fault
check should happen later, we have to retain the original
code for that check rather than being able to merge the two.
(The distinction is architecturally visible but only in
very obscure corner cases like attempting an invalid exception
return with an exception frame in read only memory.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         }
         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
 
+        if (arm_feature(env, ARM_FEATURE_V8)) {
+            /* For v8M we have to check whether the xPSR exception field
+             * matches the EXCRET value for return to handler/thread
+             * before we commit to changing the SP and xPSR.
+             */
+            bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
+            if (return_to_handler != will_be_handler) {
+                /* Take an INVPC UsageFault on the current stack.
+                 * By this point we will have switched to the security state
+                 * for the background state, so this UsageFault will target
+                 * that state.
+                 */
+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                        env->v7m.secure);
+                env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+                v7m_exception_taken(cpu, excret);
+                qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                              "stackframe: failed exception return integrity "
+                              "check\n");
+                return;
+            }
+        }
+
         /* Commit to consuming the stack frame */
         frameptr += 0x20;
         /* Undo stack alignment (the SPREALIGN bit indicates that the original
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
      * exception return excret specified then this is a UsageFault.
+     * v7M requires we make this check here; v8M did it earlier.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
-        /* Take an INVPC UsageFault by pushing the stack again.
-         * TODO: the v8M version of this code should target the
-         * background state for this exception.
+        /* Take an INVPC UsageFault by pushing the stack again;
+         * we know we're v7M so this is never a Secure UsageFault.
          */
+        assert(!arm_feature(env, ARM_FEATURE_V8));
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-- 
2.7.4

Attempting to do an exception return with an exception frame that
is not 8-aligned is UNPREDICTABLE in v8M; warn about this.
(It is not UNPREDICTABLE in v7M, and our implementation can
handle the merely-4-aligned case fine, so we don't need to
do anything except warn.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                                               return_to_sp_process);
         uint32_t frameptr = *frame_sp_p;
 
+        if (!QEMU_IS_ALIGNED(frameptr, 8) &&
+            arm_feature(env, ARM_FEATURE_V8)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "M profile exception return with non-8-aligned SP "
+                          "for destination state is UNPREDICTABLE\n");
+        }
+
         /* Pop registers. TODO: make these accesses use the correct
          * attributes and address space (S/NS, priv/unpriv) and handle
          * memory transaction failures.
-- 
2.7.4

In the v8M architecture, return from an exception to a PC which
has bit 0 set is not UNPREDICTABLE; it is defined that bit 0
is discarded [R_HRJH]. Restrict our complaint about this to v7M.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-9-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
         env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
         env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
+
+        /* Returning from an exception with a PC with bit 0 set is defined
+         * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
+         * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
+         * the lsbit, and there are several RTOSes out there which incorrectly
+         * assume the r15 in the stack frame should be a Thumb-style "lsbit
+         * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
+         * complain about the badly behaved guest.
+         */
         if (env->regs[15] & 1) {
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "M profile return from interrupt with misaligned "
-                          "PC is UNPREDICTABLE\n");
-            /* Actual hardware seems to ignore the lsbit, and there are several
-             * RTOSes out there which incorrectly assume the r15 in the stack
-             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
-             */
             env->regs[15] &= ~1U;
+            if (!arm_feature(env, ARM_FEATURE_V8)) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "M profile return from interrupt with misaligned "
+                              "PC is UNPREDICTABLE on v7M\n");
+            }
         }
+
         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
 
         if (arm_feature(env, ARM_FEATURE_V8)) {
-- 
2.7.4

Add the new M profile Secure Fault Status Register
and Secure Fault Address Register.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-10-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      | 12 ++++++++++++
 hw/intc/armv7m_nvic.c | 34 ++++++++++++++++++++++++++++++++++
 target/arm/machine.c  |  2 ++
 3 files changed, 48 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
+        uint32_t sfsr; /* Secure Fault Status Register */
         uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
+        uint32_t sfar; /* Secure Fault Address Register */
         unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
         uint32_t primask[M_REG_NUM_BANKS];
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
 FIELD(V7M_DFSR, VCATCH, 3, 1)
 FIELD(V7M_DFSR, EXTERNAL, 4, 1)
 
+/* V7M SFSR bits */
+FIELD(V7M_SFSR, INVEP, 0, 1)
+FIELD(V7M_SFSR, INVIS, 1, 1)
+FIELD(V7M_SFSR, INVER, 2, 1)
+FIELD(V7M_SFSR, AUVIOL, 3, 1)
+FIELD(V7M_SFSR, INVTRAN, 4, 1)
+FIELD(V7M_SFSR, LSPERR, 5, 1)
+FIELD(V7M_SFSR, SFARVALID, 6, 1)
+FIELD(V7M_SFSR, LSERR, 7, 1)
+
 /* v7M MPU_CTRL bits */
 FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
 FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             goto bad_offset;
         }
         return cpu->env.pmsav8.mair1[attrs.secure];
+    case 0xde4: /* SFSR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.v7m.sfsr;
+    case 0xde8: /* SFAR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.v7m.sfar;
     default:
     bad_offset:
         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          * only affect cacheability, and we don't implement caching.
          */
         break;
+    case 0xde4: /* SFSR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        cpu->env.v7m.sfsr &= ~value; /* W1C */
+        break;
+    case 0xde8: /* SFAR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        cpu->env.v7m.sfsr = value;
+        break;
     case 0xf00: /* Software Triggered Interrupt Register */
     {
         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
         VMSTATE_UINT32(env.v7m.ccr[M_REG_S], ARMCPU),
         VMSTATE_UINT32(env.v7m.mmfar[M_REG_S], ARMCPU),
         VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
+        VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
+        VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.7.4

In v8M, more bits are defined in the exception-return magic
values; update the code that checks these so we accept
the v8M values when the CPU permits them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-11-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 73 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 58 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
-    bool return_to_sp_process = false;
-    bool return_to_handler = false;
+    bool sfault = false;
+    bool return_to_sp_process;
+    bool return_to_handler;
     bool rettobase = false;
     bool exc_secure = false;
     bool return_to_secure;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                       excret);
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        /* EXC_RETURN.ES validation check (R_SMFL). We must do this before
+         * we pick which FAULTMASK to clear.
+         */
+        if (!env->v7m.secure &&
+            ((excret & R_V7M_EXCRET_ES_MASK) ||
+             !(excret & R_V7M_EXCRET_DCRS_MASK))) {
+            sfault = 1;
+            /* For all other purposes, treat ES as 0 (R_HXSR) */
+            excret &= ~R_V7M_EXCRET_ES_MASK;
+        }
+    }
+
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
         /* Auto-clear FAULTMASK on return from other than NMI.
          * If the security extension is implemented then this only
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
+    return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
+    return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
     return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
         (excret & R_V7M_EXCRET_S_MASK);
 
-    switch (excret & 0xf) {
-    case 1: /* Return to Handler */
-        return_to_handler = true;
-        break;
-    case 13: /* Return to Thread using Process stack */
-        return_to_sp_process = true;
-        /* fall through */
-    case 9: /* Return to Thread using Main stack */
-        if (!rettobase &&
-            !(env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_NONBASETHRDENA_MASK)) {
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
+             * we choose to take the UsageFault.
+             */
+            if ((excret & R_V7M_EXCRET_S_MASK) ||
+                (excret & R_V7M_EXCRET_ES_MASK) ||
+                !(excret & R_V7M_EXCRET_DCRS_MASK)) {
+                ufault = true;
+            }
+        }
+        if (excret & R_V7M_EXCRET_RES0_MASK) {
             ufault = true;
         }
-        break;
-    default:
-        ufault = true;
+    } else {
+        /* For v7M we only recognize certain combinations of the low bits */
+        switch (excret & 0xf) {
+        case 1: /* Return to Handler */
+            break;
+        case 13: /* Return to Thread using Process stack */
+        case 9: /* Return to Thread using Main stack */
+            /* We only need to check NONBASETHRDENA for v7M, because in
+             * v8M this bit does not exist (it is RES1).
+             */
+            if (!rettobase &&
+                !(env->v7m.ccr[env->v7m.secure] &
+                  R_V7M_CCR_NONBASETHRDENA_MASK)) {
+                ufault = true;
+            }
+            break;
+        default:
+            ufault = true;
+        }
+    }
+
+    if (sfault) {
+        env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+        v7m_exception_taken(cpu, excret);
+        qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
+                      "stackframe: failed EXC_RETURN.ES validity check\n");
+        return;
     }
 
     if (ufault) {
-- 
2.7.4

For v8M, exceptions from Secure to Non-Secure state will save
callee-saved registers to the exception frame as well as the
caller-saved registers. Add support for unstacking these
registers in exception exit when necessary.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-12-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                           "for destination state is UNPREDICTABLE\n");
         }
 
+        /* Do we need to pop callee-saved registers? */
+        if (return_to_secure &&
+            ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
+             (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
+            uint32_t expected_sig = 0xfefa125b;
+            uint32_t actual_sig = ldl_phys(cs->as, frameptr);
+
+            if (expected_sig != actual_sig) {
+                /* Take a SecureFault on the current stack */
+                env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+                v7m_exception_taken(cpu, excret);
+                qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
+                              "stackframe: failed exception return integrity "
+                              "signature check\n");
+                return;
+            }
+
+            env->regs[4] = ldl_phys(cs->as, frameptr + 0x8);
+            env->regs[5] = ldl_phys(cs->as, frameptr + 0xc);
+            env->regs[6] = ldl_phys(cs->as, frameptr + 0x10);
+            env->regs[7] = ldl_phys(cs->as, frameptr + 0x14);
+            env->regs[8] = ldl_phys(cs->as, frameptr + 0x18);
+            env->regs[9] = ldl_phys(cs->as, frameptr + 0x1c);
+            env->regs[10] = ldl_phys(cs->as, frameptr + 0x20);
+            env->regs[11] = ldl_phys(cs->as, frameptr + 0x24);
+
+            frameptr += 0x28;
+        }
+
         /* Pop registers. TODO: make these accesses use the correct
          * attributes and address space (S/NS, priv/unpriv) and handle
          * memory transaction failures.
-- 
2.7.4

Add support for v8M and in particular the security extension
to the exception entry code. This requires changes to:
 * calculation of the exception-return magic LR value
 * push the callee-saves registers in certain cases
 * clear registers when taking non-secure exceptions to avoid
   leaking information from the interrupted secure code
 * switch to the correct security state on entry
 * use the vector table for the security state we're targeting

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-13-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 165 +++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 145 insertions(+), 20 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
     }
 }
 
-static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
+static uint32_t arm_v7m_load_vector(ARMCPU *cpu, bool targets_secure)
 {
     CPUState *cs = CPU(cpu);
     CPUARMState *env = &cpu->env;
     MemTxResult result;
-    hwaddr vec = env->v7m.vecbase[env->v7m.secure] + env->v7m.exception * 4;
+    hwaddr vec = env->v7m.vecbase[targets_secure] + env->v7m.exception * 4;
     uint32_t addr;
 
     addr = address_space_ldl(cs->as, vec,
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
          * Since we don't model Lockup, we just report this guest error
          * via cpu_abort().
          */
-        cpu_abort(cs, "Failed to read from exception vector table "
-                  "entry %08x\n", (unsigned)vec);
+        cpu_abort(cs, "Failed to read from %s exception vector table "
+                  "entry %08x\n", targets_secure ? "secure" : "nonsecure",
+                  (unsigned)vec);
     }
     return addr;
 }
 
-static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
+static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain)
+{
+    /* For v8M, push the callee-saves register part of the stack frame.
+     * Compare the v8M pseudocode PushCalleeStack().
+     * In the tailchaining case this may not be the current stack.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+    uint32_t *frame_sp_p;
+    uint32_t frameptr;
+
+    if (dotailchain) {
+        frame_sp_p = get_v7m_sp_ptr(env, true,
+                                    lr & R_V7M_EXCRET_MODE_MASK,
+                                    lr & R_V7M_EXCRET_SPSEL_MASK);
+    } else {
+        frame_sp_p = &env->regs[13];
+    }
+
+    frameptr = *frame_sp_p - 0x28;
+
+    stl_phys(cs->as, frameptr, 0xfefa125b);
+    stl_phys(cs->as, frameptr + 0x8, env->regs[4]);
+    stl_phys(cs->as, frameptr + 0xc, env->regs[5]);
+    stl_phys(cs->as, frameptr + 0x10, env->regs[6]);
+    stl_phys(cs->as, frameptr + 0x14, env->regs[7]);
+    stl_phys(cs->as, frameptr + 0x18, env->regs[8]);
+    stl_phys(cs->as, frameptr + 0x1c, env->regs[9]);
+    stl_phys(cs->as, frameptr + 0x20, env->regs[10]);
+    stl_phys(cs->as, frameptr + 0x24, env->regs[11]);
+
+    *frame_sp_p = frameptr;
+}
+
+static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)
 {
     /* Do the "take the exception" parts of exception entry,
      * but not the pushing of state to the stack. This is
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
      */
     CPUARMState *env = &cpu->env;
     uint32_t addr;
+    bool targets_secure;
+
+    targets_secure = armv7m_nvic_acknowledge_irq(env->nvic);
 
-    armv7m_nvic_acknowledge_irq(env->nvic);
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+            (lr & R_V7M_EXCRET_S_MASK)) {
+            /* The background code (the owner of the registers in the
+             * exception frame) is Secure. This means it may either already
+             * have or now needs to push callee-saves registers.
+             */
+            if (targets_secure) {
+                if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
+                    /* We took an exception from Secure to NonSecure
+                     * (which means the callee-saved registers got stacked)
+                     * and are now tailchaining to a Secure exception.
+                     * Clear DCRS so eventual return from this Secure
+                     * exception unstacks the callee-saved registers.
+                     */
+                    lr &= ~R_V7M_EXCRET_DCRS_MASK;
+                }
+            } else {
+                /* We're going to a non-secure exception; push the
+                 * callee-saves registers to the stack now, if they're
+                 * not already saved.
+                 */
+                if (lr & R_V7M_EXCRET_DCRS_MASK &&
+                    !(dotailchain && (lr & R_V7M_EXCRET_ES_MASK))) {
+                    v7m_push_callee_stack(cpu, lr, dotailchain);
+                }
+                lr |= R_V7M_EXCRET_DCRS_MASK;
+            }
+        }
+
+        lr &= ~R_V7M_EXCRET_ES_MASK;
+        if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            lr |= R_V7M_EXCRET_ES_MASK;
+        }
+        lr &= ~R_V7M_EXCRET_SPSEL_MASK;
+        if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
+            lr |= R_V7M_EXCRET_SPSEL_MASK;
+        }
+
+        /* Clear registers if necessary to prevent non-secure exception
+         * code being able to see register values from secure code.
+         * Where register values become architecturally UNKNOWN we leave
+         * them with their previous values.
+         */
+        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            if (!targets_secure) {
+                /* Always clear the caller-saved registers (they have been
+                 * pushed to the stack earlier in v7m_push_stack()).
+                 * Clear callee-saved registers if the background code is
+                 * Secure (in which case these regs were saved in
+                 * v7m_push_callee_stack()).
+                 */
+                int i;
+
+                for (i = 0; i < 13; i++) {
+                    /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
+                    if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
+                        env->regs[i] = 0;
+                    }
+                }
+                /* Clear EAPSR */
+                xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
+            }
+        }
+    }
+
+    /* Switch to target security state -- must do this before writing SPSEL */
+    switch_v7m_security_state(env, targets_secure);
     write_v7m_control_spsel(env, 0);
     arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
-    addr = arm_v7m_load_vector(cpu);
+    addr = arm_v7m_load_vector(cpu, targets_secure);
     env->regs[15] = addr & 0xfffffffe;
     env->thumb = addr & 1;
 }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     if (sfault) {
         env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-        v7m_exception_taken(cpu, excret);
+        v7m_exception_taken(cpu, excret, true);
         qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                       "stackframe: failed EXC_RETURN.ES validity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
-        v7m_exception_taken(cpu, excret);
+        v7m_exception_taken(cpu, excret, true);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                 /* Take a SecureFault on the current stack */
                 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-                v7m_exception_taken(cpu, excret);
+                v7m_exception_taken(cpu, excret, true);
                 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                               "stackframe: failed exception return integrity "
                               "signature check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                         env->v7m.secure);
                 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-                v7m_exception_taken(cpu, excret);
+                v7m_exception_taken(cpu, excret, true);
                 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                               "stackframe: failed exception return integrity "
                               "check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, excret);
+        v7m_exception_taken(cpu, excret, false);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = R_V7M_EXCRET_RES1_MASK |
-        R_V7M_EXCRET_S_MASK |
-        R_V7M_EXCRET_DCRS_MASK |
-        R_V7M_EXCRET_FTYPE_MASK |
-        R_V7M_EXCRET_ES_MASK;
-    if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= R_V7M_EXCRET_SPSEL_MASK;
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        lr = R_V7M_EXCRET_RES1_MASK |
+            R_V7M_EXCRET_DCRS_MASK |
+            R_V7M_EXCRET_FTYPE_MASK;
+        /* The S bit indicates whether we should return to Secure
+         * or NonSecure (ie our current state).
+         * The ES bit indicates whether we're taking this exception
+         * to Secure or NonSecure (ie our target state). We set it
+         * later, in v7m_exception_taken().
+         * The SPSEL bit is also set in v7m_exception_taken() for v8M.
+         * This corresponds to the ARM ARM pseudocode for v8M setting
+         * some LR bits in PushStack() and some in ExceptionTaken();
+         * the distinction matters for the tailchain cases where we
+         * can take an exception without pushing the stack.
+         */
+        if (env->v7m.secure) {
+            lr |= R_V7M_EXCRET_S_MASK;
+        }
+    } else {
+        lr = R_V7M_EXCRET_RES1_MASK |
+            R_V7M_EXCRET_S_MASK |
+            R_V7M_EXCRET_DCRS_MASK |
+            R_V7M_EXCRET_FTYPE_MASK |
+            R_V7M_EXCRET_ES_MASK;
+        if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
+            lr |= R_V7M_EXCRET_SPSEL_MASK;
+        }
     }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-    v7m_exception_taken(cpu, lr);
+    v7m_exception_taken(cpu, lr, false);
     qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
 }
 
-- 
2.7.4

Implement the register interface for the SAU: SAU_CTRL,
SAU_TYPE, SAU_RNR, SAU_RBAR and SAU_RLAR. None of the
actual behaviour is implemented here; registers just
read back as written.

When the CPU definition for Cortex-M33 is eventually
added, its initfn will set cpu->sau_sregion, in the same
way that we currently set cpu->pmsav7_dregion for the
M3 and M4.

Number of SAU regions is typically a configurable
CPU parameter, but this patch doesn't provide a
QEMU CPU property for it. We can easily add one when
we have a board that requires it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-14-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  10 +++++
 hw/intc/armv7m_nvic.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.c      |  27 ++++++++++++
 target/arm/machine.c  |  14 ++++++
 4 files changed, 167 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
+    /* v8M SAU */
+    struct {
+        uint32_t *rbar;
+        uint32_t *rlar;
+        uint32_t rnr;
+        uint32_t ctrl;
+    } sau;
+
     void *nvic;
     const struct arm_boot_info *boot_info;
     /* Store GICv3CPUState to access from this struct */
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_mpu;
     /* PMSAv7 MPU number of supported regions */
     uint32_t pmsav7_dregion;
+    /* v8M SAU number of supported regions */
+    uint32_t sau_sregion;
 
     /* PSCI conduit used to invoke PSCI methods
      * 0 - disabled, 1 - smc, 2 - hvc
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             goto bad_offset;
         }
         return cpu->env.pmsav8.mair1[attrs.secure];
+    case 0xdd0: /* SAU_CTRL */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.sau.ctrl;
+    case 0xdd4: /* SAU_TYPE */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->sau_sregion;
+    case 0xdd8: /* SAU_RNR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.sau.rnr;
+    case 0xddc: /* SAU_RBAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        if (region >= cpu->sau_sregion) {
+            return 0;
+        }
+        return cpu->env.sau.rbar[region];
+    }
+    case 0xde0: /* SAU_RLAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        if (region >= cpu->sau_sregion) {
+            return 0;
+        }
+        return cpu->env.sau.rlar[region];
+    }
     case 0xde4: /* SFSR */
         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
             goto bad_offset;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          * only affect cacheability, and we don't implement caching.
          */
         break;
+    case 0xdd0: /* SAU_CTRL */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        cpu->env.sau.ctrl = value & 3;
+    case 0xdd4: /* SAU_TYPE */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        break;
+    case 0xdd8: /* SAU_RNR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        if (value >= cpu->sau_sregion) {
+            qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
+                          PRIu32 "/%" PRIu32 "\n",
+                          value, cpu->sau_sregion);
+        } else {
+            cpu->env.sau.rnr = value;
+        }
+        break;
+    case 0xddc: /* SAU_RBAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        if (region >= cpu->sau_sregion) {
+            return;
+        }
+        cpu->env.sau.rbar[region] = value & ~0x1f;
+        tlb_flush(CPU(cpu));
+        break;
+    }
+    case 0xde0: /* SAU_RLAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        if (region >= cpu->sau_sregion) {
+            return;
+        }
+        cpu->env.sau.rlar[region] = value & ~0x1c;
+        tlb_flush(CPU(cpu));
+        break;
+    }
     case 0xde4: /* SFSR */
         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
             goto bad_offset;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->pmsav8.mair1[M_REG_S] = 0;
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        if (cpu->sau_sregion > 0) {
+            memset(env->sau.rbar, 0, sizeof(*env->sau.rbar) * cpu->sau_sregion);
+            memset(env->sau.rlar, 0, sizeof(*env->sau.rlar) * cpu->sau_sregion);
+        }
+        env->sau.rnr = 0;
+        /* SAU_CTRL reset value is IMPDEF; we choose 0, which is what
+         * the Cortex-M33 does.
+         */
+        env->sau.ctrl = 0;
+    }
+
     set_flush_to_zero(1, &env->vfp.standard_fp_status);
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         }
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        uint32_t nr = cpu->sau_sregion;
+
+        if (nr > 0xff) {
+            error_setg(errp, "v8M SAU #regions invalid %" PRIu32, nr);
+            return;
+        }
+
+        if (nr) {
+            env->sau.rbar = g_new0(uint32_t, nr);
+            env->sau.rlar = g_new0(uint32_t, nr);
+        }
+    }
+
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         set_feature(env, ARM_FEATURE_VBAR);
     }
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     cpu->midr = 0x410fc240; /* r0p0 */
     cpu->pmsav7_dregion = 8;
 }
+
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool s_rnr_vmstate_validate(void *opaque, int version_id)
     return cpu->env.pmsav7.rnr[M_REG_S] < cpu->pmsav7_dregion;
 }
 
+static bool sau_rnr_vmstate_validate(void *opaque, int version_id)
+{
+    ARMCPU *cpu = opaque;
+
+    return cpu->env.sau.rnr < cpu->sau_sregion;
+}
+
 static bool m_security_needed(void *opaque)
 {
     ARMCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
         VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
         VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
         VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
+        VMSTATE_VARRAY_UINT32(env.sau.rbar, ARMCPU, sau_sregion, 0,
+                              vmstate_info_uint32, uint32_t),
+        VMSTATE_VARRAY_UINT32(env.sau.rlar, ARMCPU, sau_sregion, 0,
+                              vmstate_info_uint32, uint32_t),
+        VMSTATE_UINT32(env.sau.rnr, ARMCPU),
+        VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
+        VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.7.4

Implement the security attribute lookups for memory accesses
in the get_phys_addr() functions, causing these to generate
various kinds of SecureFault for bad accesses.

The major subtlety in this code relates to handling of the
case when the security attributes the SAU assigns to the
address don't match the current security state of the CPU.

In the ARM ARM pseudocode for validating instruction
accesses, the security attributes of the address determine
whether the Secure or NonSecure MPU state is used. At face
value, handling this would require us to encode the relevant
bits of state into mmu_idx for both S and NS at once, which
would result in our needing 16 mmu indexes. Fortunately we
don't actually need to do this because a mismatch between
address attributes and CPU state means either:
 * some kind of fault (usually a SecureFault, but in theory
   perhaps a UserFault for unaligned access to Device memory)
 * execution of the SG instruction in NS state from a
   Secure & NonSecure code region

The purpose of SG is simply to flip the CPU into Secure
state, so we can handle it by emulating execution of that
instruction directly in arm_v7m_cpu_do_interrupt(), which
means we can treat all the mismatch cases as "throw an
exception" and we don't need to encode the state of the
other MPU bank into our mmu_idx values.

This commit doesn't include the actual emulation of SG;
it also doesn't include implementation of the IDAU, which
is a per-board way to specify hard-coded memory attributes
for addresses, which override the CPU-internal SAU if they
specify a more secure setting than the SAU is programmed to.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-15-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h |  15 ++++
 target/arm/helper.c    | 182 ++++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 195 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
 FIELD(V7M_EXCRET, S, 6, 1)
 FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
 
+/* We use a few fake FSR values for internal purposes in M profile.
+ * M profile cores don't have A/R format FSRs, but currently our
+ * get_phys_addr() code assumes A/R profile and reports failures via
+ * an A/R format FSR value. We then translate that into the proper
+ * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
+ * Mostly the FSR values we use for this are those defined for v7PMSA,
+ * since we share some of that codepath. A few kinds of fault are
+ * only for M profile and have no A/R equivalent, though, so we have
+ * to pick a value from the reserved range (which we never otherwise
+ * generate) to use for these.
+ * These values will never be visible to the guest.
+ */
+#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
+#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                target_ulong *page_size_ptr, uint32_t *fsr,
                                ARMMMUFaultInfo *fi);
 
+/* Security attributes for an address, as returned by v8m_security_lookup. */
+typedef struct V8M_SAttributes {
+    bool ns;
+    bool nsc;
+    uint8_t sregion;
+    bool srvalid;
+    uint8_t iregion;
+    bool irvalid;
+} V8M_SAttributes;
+
 /* Definitions for the PMCCNTR and PMCR registers */
 #define PMCRD   0x8
 #define PMCRC   0x4
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          * raises the fault, in the A profile short-descriptor format.
          */
         switch (env->exception.fsr & 0xf) {
+        case M_FAKE_FSR_NSC_EXEC:
+            /* Exception generated when we try to execute code at an address
+             * which is marked as Secure & Non-Secure Callable and the CPU
+             * is in the Non-Secure state. The only instruction which can
+             * be executed like this is SG (and that only if both halves of
+             * the SG instruction have the same security attributes.)
+             * Everything else must generate an INVEP SecureFault, so we
+             * emulate the SG instruction here.
+             * TODO: actually emulate SG.
+             */
+            env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really SecureFault with SFSR.INVEP\n");
+            break;
+        case M_FAKE_FSR_SFAULT:
+            /* Various flavours of SecureFault for attempts to execute or
+             * access data in the wrong security state.
+             */
+            switch (cs->exception_index) {
+            case EXCP_PREFETCH_ABORT:
+                if (env->v7m.secure) {
+                    env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
+                    qemu_log_mask(CPU_LOG_INT,
+                                  "...really SecureFault with SFSR.INVTRAN\n");
+                } else {
+                    env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+                    qemu_log_mask(CPU_LOG_INT,
+                                  "...really SecureFault with SFSR.INVEP\n");
+                }
+                break;
+            case EXCP_DATA_ABORT:
+                /* This must be an NS access to S memory */
+                env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
+                qemu_log_mask(CPU_LOG_INT,
+                              "...really SecureFault with SFSR.AUVIOL\n");
+                break;
+            }
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+            break;
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
     return !(*prot & (1 << access_type));
 }
 
+static bool v8m_is_sau_exempt(CPUARMState *env,
+                              uint32_t address, MMUAccessType access_type)
+{
+    /* The architecture specifies that certain address ranges are
+     * exempt from v8M SAU/IDAU checks.
+     */
+    return
+        (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
+        (address >= 0xe0000000 && address <= 0xe0002fff) ||
+        (address >= 0xe000e000 && address <= 0xe000efff) ||
+        (address >= 0xe002e000 && address <= 0xe002efff) ||
+        (address >= 0xe0040000 && address <= 0xe0041fff) ||
+        (address >= 0xe00ff000 && address <= 0xe00fffff);
+}
+
+static void v8m_security_lookup(CPUARMState *env, uint32_t address,
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                                V8M_SAttributes *sattrs)
+{
+    /* Look up the security attributes for this address. Compare the
+     * pseudocode SecurityCheck() function.
+     * We assume the caller has zero-initialized *sattrs.
+     */
+    ARMCPU *cpu = arm_env_get_cpu(env);
+    int r;
+
+    /* TODO: implement IDAU */
+
+    if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
+        /* 0xf0000000..0xffffffff is always S for insn fetches */
+        return;
+    }
+
+    if (v8m_is_sau_exempt(env, address, access_type)) {
+        sattrs->ns = !regime_is_secure(env, mmu_idx);
+        return;
+    }
+
+    switch (env->sau.ctrl & 3) {
+    case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
+        break;
+    case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
+        sattrs->ns = true;
+        break;
+    default: /* SAU.ENABLE == 1 */
+        for (r = 0; r < cpu->sau_sregion; r++) {
+            if (env->sau.rlar[r] & 1) {
+                uint32_t base = env->sau.rbar[r] & ~0x1f;
+                uint32_t limit = env->sau.rlar[r] | 0x1f;
+
+                if (base <= address && limit >= address) {
+                    if (sattrs->srvalid) {
+                        /* If we hit in more than one region then we must report
+                         * as Secure, not NS-Callable, with no valid region
+                         * number info.
+                         */
+                        sattrs->ns = false;
+                        sattrs->nsc = false;
+                        sattrs->sregion = 0;
+                        sattrs->srvalid = false;
+                        break;
+                    } else {
+                        if (env->sau.rlar[r] & 2) {
+                            sattrs->nsc = true;
+                        } else {
+                            sattrs->ns = true;
+                        }
+                        sattrs->srvalid = true;
+                        sattrs->sregion = r;
+                    }
+                }
+            }
+        }
+
+        /* TODO when we support the IDAU then it may override the result here */
+        break;
+    }
+}
+
 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
+                                 hwaddr *phys_ptr, MemTxAttrs *txattrs,
+                                 int *prot, uint32_t *fsr)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
     bool is_user = regime_is_user(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
     int n;
     int matchregion = -1;
     bool hit = false;
+    V8M_SAttributes sattrs = {};
 
     *phys_ptr = address;
     *prot = 0;
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
+        if (access_type == MMU_INST_FETCH) {
+            /* Instruction fetches always use the MMU bank and the
+             * transaction attribute determined by the fetch address,
+             * regardless of CPU state. This is painful for QEMU
+             * to handle, because it would mean we need to encode
+             * into the mmu_idx not just the (user, negpri) information
+             * for the current security state but also that for the
+             * other security state, which would balloon the number
+             * of mmu_idx values needed alarmingly.
+             * Fortunately we can avoid this because it's not actually
+             * possible to arbitrarily execute code from memory with
+             * the wrong security attribute: it will always generate
+             * an exception of some kind or another, apart from the
+             * special case of an NS CPU executing an SG instruction
+             * in S&NSC memory. So we always just fail the translation
+             * here and sort things out in the exception handler
+             * (including possibly emulating an SG instruction).
+             */
+            if (sattrs.ns != !secure) {
+                *fsr = sattrs.nsc ? M_FAKE_FSR_NSC_EXEC : M_FAKE_FSR_SFAULT;
+                return true;
+            }
+        } else {
+            /* For data accesses we always use the MMU bank indicated
+             * by the current CPU state, but the security attributes
+             * might downgrade a secure access to nonsecure.
+             */
+            if (sattrs.ns) {
+                txattrs->secure = false;
+            } else if (!secure) {
+                /* NS access to S memory must fault.
+                 * Architecturally we should first check whether the
+                 * MPU information for this address indicates that we
+                 * are doing an unaligned access to Device memory, which
+                 * should generate a UsageFault instead. QEMU does not
+                 * currently check for that kind of unaligned access though.
+                 * If we added it we would need to do so as a special case
+                 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
+                 */
+                *fsr = M_FAKE_FSR_SFAULT;
+                return true;
+            }
+        }
+    }
+
     /* Unlike the ARM ARM pseudocode, we don't need to check whether this
      * was an exception vector read from the vector table (which is always
      * done using the default system address map), because those accesses
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
         if (arm_feature(env, ARM_FEATURE_V8)) {
             /* PMSAv8 */
             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
-                                       phys_ptr, prot, fsr);
+                                       phys_ptr, attrs, prot, fsr);
         } else if (arm_feature(env, ARM_FEATURE_V7)) {
             /* PMSAv7 */
             ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
-- 
2.7.4

In cpu_mmu_index() we try to do this:
        if (env->v7m.secure) {
            mmu_idx += ARMMMUIdx_MSUser;
        }
but it will give the wrong answer, because ARMMMUIdx_MSUser
includes the 0x40 ARM_MMU_IDX_M field, and so does the
mmu_idx we're adding to, and we'll end up with 0x8n rather
than 0x4n. This error is then nullified by the call to
arm_to_core_mmu_idx() which masks out the high part, but
we're about to factor out the code that calculates the
ARMMMUIdx values so it can be used without passing it through
arm_to_core_mmu_idx(), so fix this bug first.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-16-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
     int el = arm_current_el(env);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
-        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
+        ARMMMUIdx mmu_idx;
 
-        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
-            mmu_idx = ARMMMUIdx_MNegPri;
+        if (el == 0) {
+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
+        } else {
+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
         }
 
-        if (env->v7m.secure) {
-            mmu_idx += ARMMMUIdx_MSUser;
+        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
         }
 
         return arm_to_core_mmu_idx(mmu_idx);
-- 
2.7.4

For the SG instruction and secure function return we are going
to want to do memory accesses using the MMU index of the CPU
in secure state, even though the CPU is currently in non-secure
state. Write arm_v7m_mmu_idx_for_secstate() to do this job,
and use it in cpu_mmu_index().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-17-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     }
 }
 
+/* Return the MMU index for a v7M CPU in the specified security state */
+static inline ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env,
+                                                     bool secstate)
+{
+    int el = arm_current_el(env);
+    ARMMMUIdx mmu_idx;
+
+    if (el == 0) {
+        mmu_idx = secstate ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
+    } else {
+        mmu_idx = secstate ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
+    }
+
+    if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) {
+        mmu_idx = secstate ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
+    }
+
+    return mmu_idx;
+}
+
 /* Determine the current mmu_idx to use for normal loads/stores */
 static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
 {
     int el = arm_current_el(env);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
-        ARMMMUIdx mmu_idx;
-
-        if (el == 0) {
-            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
-        } else {
-            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
-        }
-
-        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
-            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
-        }
+        ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
 
         return arm_to_core_mmu_idx(mmu_idx);
     }
-- 
2.7.4

When we added support for the new SHCSR bits in v8M in commit
437d59c17e9 the code to support writing to the new HARDFAULTPENDED
bit was accidentally only added for non-secure writes; the
secure banked version of the bit should also be writable.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
                 (value & (1 << 18)) != 0;
+            s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
             /* SecureFault not banked, but RAZ/WI to NS */
             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
-- 
2.7.4

Hi; this is the latest target-arm queue; most of this is a refactoring
patchset from RTH for the arm page-table-walk emulation.

thanks
-- PMM

The following changes since commit f1d33f55c47dfdaf8daacd618588ad3ae4c452d1:

Merge tag 'pull-testing-gdbstub-plugins-gitdm-061022-3' of https://github.com/stsquad/qemu into staging (2022-10-06 07:11:56 -0400)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221010

for you to fetch changes up to 915f62844cf62e428c7c178149b5ff1cbe129b07:

docs/system/arm/emulation.rst: Report FEAT_GTG support (2022-10-10 14:52:25 +0100)

----------------------------------------------------------------
target-arm queue:
 * Retry KVM_CREATE_VM call if it fails EINTR
 * allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented
 * docs/nuvoton: Update URL for images
 * refactoring of page table walk code
 * hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3
 * Don't allow guest to use unimplemented granule sizes
 * Report FEAT_GTG support

----------------------------------------------------------------
Jerome Forissier (2):
      target/arm: allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented
      hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3

Joel Stanley (1):
      docs/nuvoton: Update URL for images

Peter Maydell (4):
      target/arm/kvm: Retry KVM_CREATE_VM call if it fails EINTR
      target/arm: Don't allow guest to use unimplemented granule sizes
      target/arm: Use ARMGranuleSize in ARMVAParameters
      docs/system/arm/emulation.rst: Report FEAT_GTG support

Richard Henderson (21):
      target/arm: Split s2walk_secure from ipa_secure in get_phys_addr
      target/arm: Make the final stage1+2 write to secure be unconditional
      target/arm: Add is_secure parameter to get_phys_addr_lpae
      target/arm: Fix S2 disabled check in S1_ptw_translate
      target/arm: Add is_secure parameter to regime_translation_disabled
      target/arm: Split out get_phys_addr_with_secure
      target/arm: Add is_secure parameter to v7m_read_half_insn
      target/arm: Add TBFLAG_M32.SECURE
      target/arm: Merge regime_is_secure into get_phys_addr
      target/arm: Add is_secure parameter to do_ats_write
      target/arm: Fold secure and non-secure a-profile mmu indexes
      target/arm: Reorg regime_translation_disabled
      target/arm: Drop secure check for HCR.TGE vs SCTLR_EL1.M
      target/arm: Introduce arm_hcr_el2_eff_secstate
      target/arm: Hoist read of *is_secure in S1_ptw_translate
      target/arm: Remove env argument from combined_attrs_fwb
      target/arm: Pass HCR to attribute subroutines.
      target/arm: Fix ATS12NSO* from S PL1
      target/arm: Split out get_phys_addr_disabled
      target/arm: Fix cacheattr in get_phys_addr_disabled
      target/arm: Use tlb_set_page_full

Occasionally the KVM_CREATE_VM ioctl can return EINTR, even though
there is no pending signal to be taken. In commit 94ccff13382055
we added a retry-on-EINTR loop to the KVM_CREATE_VM call in the
generic KVM code. Adopt the same approach for the use of the
ioctl in the Arm-specific KVM code (where we use it to create a
scratch VM for probing for various things).

For more information, see the mailing list thread:
https://lore.kernel.org/qemu-devel/8735e0s1zw.wl-maz@kernel.org/

Reported-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Message-id: 20220930113824.1933293-1-peter.maydell@linaro.org
---
 target/arm/kvm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
     if (max_vm_pa_size < 0) {
         max_vm_pa_size = 0;
     }
-    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
+    do {
+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
+    } while (vmfd == -1 && errno == EINTR);
     if (vmfd < 0) {
         goto err;
     }
-- 
2.25.1

From: Jerome Forissier <jerome.forissier@linaro.org>

Updates write_scr() to allow setting SCR_EL3.EnTP2 when FEAT_SME is
implemented. SCR_EL3 being a 64-bit register, valid_mask is changed
to uint64_t and the SCR_* constants in target/arm/cpu.h are extended
to 64-bit so that masking and bitwise not (~) behave as expected.

This enables booting Linux with Trusted Firmware-A at EL3 with
"-M virt,secure=on -cpu max".

Cc: qemu-stable@nongnu.org
Fixes: 78cb9776662a ("target/arm: Enable SME for -cpu max")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221004072354.27037-1-jerome.forissier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 54 ++++++++++++++++++++++-----------------------
 target/arm/helper.c |  5 ++++-
 2 files changed, 31 insertions(+), 28 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 
 #define HPFAR_NS      (1ULL << 63)
 
-#define SCR_NS                (1U << 0)
-#define SCR_IRQ               (1U << 1)
-#define SCR_FIQ               (1U << 2)
-#define SCR_EA                (1U << 3)
-#define SCR_FW                (1U << 4)
-#define SCR_AW                (1U << 5)
-#define SCR_NET               (1U << 6)
-#define SCR_SMD               (1U << 7)
-#define SCR_HCE               (1U << 8)
-#define SCR_SIF               (1U << 9)
-#define SCR_RW                (1U << 10)
-#define SCR_ST                (1U << 11)
-#define SCR_TWI               (1U << 12)
-#define SCR_TWE               (1U << 13)
-#define SCR_TLOR              (1U << 14)
-#define SCR_TERR              (1U << 15)
-#define SCR_APK               (1U << 16)
-#define SCR_API               (1U << 17)
-#define SCR_EEL2              (1U << 18)
-#define SCR_EASE              (1U << 19)
-#define SCR_NMEA              (1U << 20)
-#define SCR_FIEN              (1U << 21)
-#define SCR_ENSCXT            (1U << 25)
-#define SCR_ATA               (1U << 26)
-#define SCR_FGTEN             (1U << 27)
-#define SCR_ECVEN             (1U << 28)
-#define SCR_TWEDEN            (1U << 29)
+#define SCR_NS                (1ULL << 0)
+#define SCR_IRQ               (1ULL << 1)
+#define SCR_FIQ               (1ULL << 2)
+#define SCR_EA                (1ULL << 3)
+#define SCR_FW                (1ULL << 4)
+#define SCR_AW                (1ULL << 5)
+#define SCR_NET               (1ULL << 6)
+#define SCR_SMD               (1ULL << 7)
+#define SCR_HCE               (1ULL << 8)
+#define SCR_SIF               (1ULL << 9)
+#define SCR_RW                (1ULL << 10)
+#define SCR_ST                (1ULL << 11)
+#define SCR_TWI               (1ULL << 12)
+#define SCR_TWE               (1ULL << 13)
+#define SCR_TLOR              (1ULL << 14)
+#define SCR_TERR              (1ULL << 15)
+#define SCR_APK               (1ULL << 16)
+#define SCR_API               (1ULL << 17)
+#define SCR_EEL2              (1ULL << 18)
+#define SCR_EASE              (1ULL << 19)
+#define SCR_NMEA              (1ULL << 20)
+#define SCR_FIEN              (1ULL << 21)
+#define SCR_ENSCXT            (1ULL << 25)
+#define SCR_ATA               (1ULL << 26)
+#define SCR_FGTEN             (1ULL << 27)
+#define SCR_ECVEN             (1ULL << 28)
+#define SCR_TWEDEN            (1ULL << 29)
 #define SCR_TWEDEL            MAKE_64BIT_MASK(30, 4)
 #define SCR_TME               (1ULL << 34)
 #define SCR_AMVOFFEN          (1ULL << 35)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
     /* Begin with base v8.0 state.  */
-    uint32_t valid_mask = 0x3fff;
+    uint64_t valid_mask = 0x3fff;
     ARMCPU *cpu = env_archcpu(env);
 
     /*
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_doublefault, cpu)) {
             valid_mask |= SCR_EASE | SCR_NMEA;
         }
+        if (cpu_isar_feature(aa64_sme, cpu)) {
+            valid_mask |= SCR_ENTP2;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
-- 
2.25.1

From: Joel Stanley <joel@jms.id.au>

openpower.xyz was retired some time ago. The OpenBMC Jenkins is where
images can be found these days.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20221004050042.22681-1-joel@jms.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Boot options
 
 The Nuvoton machines can boot from an OpenBMC firmware image, or directly into
 a kernel using the ``-kernel`` option. OpenBMC images for ``quanta-gsj`` and
-possibly others can be downloaded from the OpenPOWER jenkins :
+possibly others can be downloaded from the OpenBMC jenkins :
 
-   https://openpower.xyz/
+   https://jenkins.openbmc.org/
 
 The firmware image should be attached as an MTD drive. Example :
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The starting security state comes with the translation regime,
not the current state of arm_is_secure_below_el3().

Create a new local variable, s2walk_secure, which does not need
to be written back to result->attrs.secure -- we compute that
value later, after the S2 walk is complete.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221001162318.153420-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s1_prot;
             int ret;
-            bool ipa_secure;
+            bool ipa_secure, s2walk_secure;
             ARMCacheAttrs cacheattrs1;
             ARMMMUIdx s2_mmu_idx;
             bool is_el0;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
             ipa = result->phys;
             ipa_secure = result->attrs.secure;
-            if (arm_is_secure_below_el3(env)) {
-                if (ipa_secure) {
-                    result->attrs.secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
-                } else {
-                    result->attrs.secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
-                }
+            if (is_secure) {
+                /* Select TCR based on the NS bit from the S1 walk. */
+                s2walk_secure = !(ipa_secure
+                                  ? env->cp15.vstcr_el2 & VSTCR_SW
+                                  : env->cp15.vtcr_el2 & VTCR_NSW);
             } else {
                 assert(!ipa_secure);
+                s2walk_secure = false;
             }
 
-            s2_mmu_idx = (result->attrs.secure
+            s2_mmu_idx = (s2walk_secure
                           ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2);
             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
 
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                                                     result->cacheattrs);
 
             /* Check if IPA translates to secure or non-secure PA space. */
-            if (arm_is_secure_below_el3(env)) {
+            if (is_secure) {
                 if (ipa_secure) {
                     result->attrs.secure =
                         !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW));
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

While the stage2 call to get_phys_addr_lpae should never set
attrs.secure when given a non-secure input, it's just as easy
to make the final update to attrs.secure be unconditional and
false in the case of non-secure input.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221007152159.1414065-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             result->cacheattrs = combine_cacheattrs(env, cacheattrs1,
                                                     result->cacheattrs);
 
-            /* Check if IPA translates to secure or non-secure PA space. */
-            if (is_secure) {
-                if (ipa_secure) {
-                    result->attrs.secure =
-                        !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW));
-                } else {
-                    result->attrs.secure =
-                        !((env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))
-                        || (env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)));
-                }
-            }
+            /*
+             * Check if IPA translates to secure or non-secure PA space.
+             * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
+             */
+            result->attrs.secure =
+                (is_secure
+                 && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+                 && (ipa_secure
+                     || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
+
             return 0;
         } else {
             /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove the use of regime_is_secure from get_phys_addr_lpae,
using the new parameter instead.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 
 static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                               bool s1_is_el0, GetPhysAddrResult *result,
-                               ARMMMUFaultInfo *fi)
+                               bool is_secure, bool s1_is_el0,
+                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
     __attribute__((nonnull));
 
 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         GetPhysAddrResult s2 = {};
         int ret;
 
-        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx, false,
-                                 &s2, fi);
+        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx,
+                                 *is_secure, false, &s2, fi);
         if (ret) {
             assert(fi->type != ARMFault_None);
             fi->s2addr = addr;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
  */
 static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                               bool s1_is_el0, GetPhysAddrResult *result,
-                               ARMMMUFaultInfo *fi)
+                               bool is_secure, bool s1_is_el0,
+                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 {
     ARMCPU *cpu = env_archcpu(env);
     /* Read an LPAE long-descriptor translation table. */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      * remain non-secure. We implement this by just ORing in the NSTable/NS
      * bits at each step.
      */
-    tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
+    tableattrs = is_secure ? 0 : (1 << 4);
     for (;;) {
         uint64_t descriptor;
         bool nstable;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             memset(result, 0, sizeof(*result));
 
             ret = get_phys_addr_lpae(env, ipa, access_type, s2_mmu_idx,
-                                     is_el0, result, fi);
+                                     s2walk_secure, is_el0, result, fi);
             fi->s2addr = ipa;
 
             /* Combine the S1 and S2 perms.  */
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     }
 
     if (regime_using_lpae_format(env, mmu_idx)) {
-        return get_phys_addr_lpae(env, address, access_type, mmu_idx, false,
-                                  result, fi);
+        return get_phys_addr_lpae(env, address, access_type, mmu_idx,
+                                  is_secure, false, result, fi);
     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, address, access_type, mmu_idx,
                                 is_secure, result, fi);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Pass the correct stage2 mmu_idx to regime_translation_disabled,
which we computed afterward.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221001162318.153420-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
                                hwaddr addr, bool *is_secure,
                                ARMMMUFaultInfo *fi)
 {
+    ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+
     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
-        !regime_translation_disabled(env, ARMMMUIdx_Stage2)) {
-        ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S
-                                          : ARMMMUIdx_Stage2;
+        !regime_translation_disabled(env, s2_mmu_idx)) {
         GetPhysAddrResult s2 = {};
         int ret;
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove the use of regime_is_secure from regime_translation_disabled,
using the new parameter instead.

This fixes a bug in S1_ptw_translate and get_phys_addr where we had
passed ARMMMUIdx_Stage2 and not ARMMMUIdx_Stage2_S to determine if
Stage2 is disabled, affecting FEAT_SEL2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
 }
 
 /* Return true if the specified stage of address translation is disabled */
-static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx)
+static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
+                                        bool is_secure)
 {
     uint64_t hcr_el2;
 
     if (arm_feature(env, ARM_FEATURE_M)) {
-        switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
+        switch (env->v7m.mpu_ctrl[is_secure] &
                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
         case R_V7M_MPU_CTRL_ENABLE_MASK:
             /* Enabled, but not for HardFault and NMI */
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx)
 
     if (hcr_el2 & HCR_TGE) {
         /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
-        if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
+        if (!is_secure && regime_el(env, mmu_idx) == 1) {
             return true;
         }
     }
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
     ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
 
     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
-        !regime_translation_disabled(env, s2_mmu_idx)) {
+        !regime_translation_disabled(env, s2_mmu_idx, *is_secure)) {
         GetPhysAddrResult s2 = {};
         int ret;
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
     uint32_t base;
     bool is_user = regime_is_user(env, mmu_idx);
 
-    if (regime_translation_disabled(env, mmu_idx)) {
+    if (regime_translation_disabled(env, mmu_idx, is_secure)) {
         /* MPU disabled.  */
         result->phys = address;
         result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
     result->page_size = TARGET_PAGE_SIZE;
     result->prot = 0;
 
-    if (regime_translation_disabled(env, mmu_idx) ||
+    if (regime_translation_disabled(env, mmu_idx, secure) ||
         m_is_ppb_region(env, address)) {
         /*
          * MPU disabled or M profile PPB access: use default memory map.
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
      * are done in arm_v7m_load_vector(), which always does a direct
      * read using address_space_ldl(), rather than going via this function.
      */
-    if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
+    if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */
         hit = true;
     } else if (m_is_ppb_region(env, address)) {
         hit = true;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                                 result, fi);
 
             /* If S1 fails or S2 is disabled, return early.  */
-            if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) {
+            if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2,
+                                                   is_secure)) {
                 return ret;
             }
 
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
     /* Definitely a real MMU, not an MPU */
 
-    if (regime_translation_disabled(env, mmu_idx)) {
+    if (regime_translation_disabled(env, mmu_idx, is_secure)) {
         uint64_t hcr;
         uint8_t memattr;
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Retain the existing get_phys_addr interface using the security
state derived from mmu_idx.  Move the kerneldoc comments to the
header file where they belong.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 40 ++++++++++++++++++++++++++++++++++++++
 target/arm/ptw.c       | 44 ++++++++++++++----------------------------
 2 files changed, 55 insertions(+), 29 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef struct GetPhysAddrResult {
     ARMCacheAttrs cacheattrs;
 } GetPhysAddrResult;
 
+/**
+ * get_phys_addr_with_secure: get the physical address for a virtual address
+ * @env: CPUARMState
+ * @address: virtual address to get physical address for
+ * @access_type: 0 for read, 1 for write, 2 for execute
+ * @mmu_idx: MMU index indicating required translation regime
+ * @is_secure: security state for the access
+ * @result: set on translation success.
+ * @fi: set to fault info if the translation fails
+ *
+ * Find the physical address corresponding to the given virtual address,
+ * by doing a translation table walk on MMU based systems or using the
+ * MPU state on MPU based systems.
+ *
+ * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
+ * prot and page_size may not be filled in, and the populated fsr value provides
+ * information on why the translation aborted, in the format of a
+ * DFSR/IFSR fault register, with the following caveats:
+ *  * we honour the short vs long DFSR format differences.
+ *  * the WnR bit is never set (the caller must do this).
+ *  * for PSMAv5 based systems we don't bother to return a full FSR format
+ *    value.
+ */
+bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
+                               MMUAccessType access_type,
+                               ARMMMUIdx mmu_idx, bool is_secure,
+                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+    __attribute__((nonnull));
+
+/**
+ * get_phys_addr: get the physical address for a virtual address
+ * @env: CPUARMState
+ * @address: virtual address to get physical address for
+ * @access_type: 0 for read, 1 for write, 2 for execute
+ * @mmu_idx: MMU index indicating required translation regime
+ * @result: set on translation success.
+ * @fi: set to fault info if the translation fails
+ *
+ * Similarly, but use the security regime of @mmu_idx.
+ */
 bool get_phys_addr(CPUARMState *env, target_ulong address,
                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
     return ret;
 }
 
-/**
- * get_phys_addr - get the physical address for this virtual address
- *
- * Find the physical address corresponding to the given virtual address,
- * by doing a translation table walk on MMU based systems or using the
- * MPU state on MPU based systems.
- *
- * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
- * prot and page_size may not be filled in, and the populated fsr value provides
- * information on why the translation aborted, in the format of a
- * DFSR/IFSR fault register, with the following caveats:
- *  * we honour the short vs long DFSR format differences.
- *  * the WnR bit is never set (the caller must do this).
- *  * for PSMAv5 based systems we don't bother to return a full FSR format
- *    value.
- *
- * @env: CPUARMState
- * @address: virtual address to get physical address for
- * @access_type: 0 for read, 1 for write, 2 for execute
- * @mmu_idx: MMU index indicating required translation regime
- * @result: set on translation success.
- * @fi: set to fault info if the translation fails
- */
-bool get_phys_addr(CPUARMState *env, target_ulong address,
-                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
+                               MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                               bool is_secure, GetPhysAddrResult *result,
+                               ARMMMUFaultInfo *fi)
 {
     ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
-    bool is_secure = regime_is_secure(env, mmu_idx);
 
     if (mmu_idx != s1_mmu_idx) {
         /*
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             ARMMMUIdx s2_mmu_idx;
             bool is_el0;
 
-            ret = get_phys_addr(env, address, access_type, s1_mmu_idx,
-                                result, fi);
+            ret = get_phys_addr_with_secure(env, address, access_type,
+                                            s1_mmu_idx, is_secure, result, fi);
 
             /* If S1 fails or S2 is disabled, return early.  */
             if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2,
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     }
 }
 
+bool get_phys_addr(CPUARMState *env, target_ulong address,
+                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+{
+    return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
+                                     regime_is_secure(env, mmu_idx),
+                                     result, fi);
+}
+
 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
                                          MemTxAttrs *attrs)
 {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove the use of regime_is_secure from v7m_read_half_insn, using
the new parameter instead.

As it happens, both callers pass true, propagated from the argument
to arm_v7m_mmu_idx_for_secstate which created the mmu_idx argument,
but that is a detail of v7m_handle_execute_nsc we need not expose
to the callee.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
     return true;
 }
 
-static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
+static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
                                uint32_t addr, uint16_t *insn)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
     ARMMMUFaultInfo fi = {};
     MemTxResult txres;
 
-    v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx,
-                        regime_is_secure(env, mmu_idx), &sattrs);
+    v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, secure, &sattrs);
     if (!sattrs.nsc || sattrs.ns) {
         /*
          * This must be the second half of the insn, and it straddles a
@@ -XXX,XX +XXX,XX @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
     /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
     mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
 
-    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
+    if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15], &insn)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
         goto gen_invep;
     }
 
-    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
+    if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15] + 2, &insn)) {
         return false;
     }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove the use of regime_is_secure from arm_tr_init_disas_context.
Instead, provide the value of v8m_secure directly from tb_flags.
Rather than use regime_is_secure, use the env->v7m.secure directly,
as per arm_mmu_idx_el.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       | 2 ++
 target/arm/helper.c    | 4 ++++
 target/arm/translate.c | 3 +--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_M32, NEW_FP_CTXT_NEEDED, 3, 1)     /* Not cached. */
 FIELD(TBFLAG_M32, FPCCR_S_WRONG, 4, 1)          /* Not cached. */
 /* Set if MVE insns are definitely not predicated by VPR or LTPSIZE */
 FIELD(TBFLAG_M32, MVE_NO_PRED, 5, 1)            /* Not cached. */
+/* Set if in secure mode */
+FIELD(TBFLAG_M32, SECURE, 6, 1)
 
 /*
  * Bit usage when in AArch64 state
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el,
         DP_TBFLAG_M32(flags, STACKCHECK, 1);
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) {
+        DP_TBFLAG_M32(flags, SECURE, 1);
+    }
+
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->vfp_enabled = 1;
         dc->be_data = MO_TE;
         dc->v7m_handler_mode = EX_TBFLAG_M32(tb_flags, HANDLER);
-        dc->v8m_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
-            regime_is_secure(env, dc->mmu_idx);
+        dc->v8m_secure = EX_TBFLAG_M32(tb_flags, SECURE);
         dc->v8m_stackcheck = EX_TBFLAG_M32(tb_flags, STACKCHECK);
         dc->v8m_fpccr_s_wrong = EX_TBFLAG_M32(tb_flags, FPCCR_S_WRONG);
         dc->v7m_new_fp_ctxt_needed =
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This is the last use of regime_is_secure; remove it
entirely before changing the layout of ARMMMUIdx.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 42 ----------------------------------------
 target/arm/ptw.c       | 44 ++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 42 insertions(+), 44 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
     }
 }
 
-/* Return true if this address translation regime is secure */
-static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
-    switch (mmu_idx) {
-    case ARMMMUIdx_E10_0:
-    case ARMMMUIdx_E10_1:
-    case ARMMMUIdx_E10_1_PAN:
-    case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_E20_2:
-    case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_Stage1_E0:
-    case ARMMMUIdx_Stage1_E1:
-    case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_E2:
-    case ARMMMUIdx_Stage2:
-    case ARMMMUIdx_MPrivNegPri:
-    case ARMMMUIdx_MUserNegPri:
-    case ARMMMUIdx_MPriv:
-    case ARMMMUIdx_MUser:
-        return false;
-    case ARMMMUIdx_SE3:
-    case ARMMMUIdx_SE10_0:
-    case ARMMMUIdx_SE10_1:
-    case ARMMMUIdx_SE10_1_PAN:
-    case ARMMMUIdx_SE20_0:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
-    case ARMMMUIdx_Stage1_SE0:
-    case ARMMMUIdx_Stage1_SE1:
-    case ARMMMUIdx_Stage1_SE1_PAN:
-    case ARMMMUIdx_SE2:
-    case ARMMMUIdx_Stage2_S:
-    case ARMMMUIdx_MSPrivNegPri:
-    case ARMMMUIdx_MSUserNegPri:
-    case ARMMMUIdx_MSPriv:
-    case ARMMMUIdx_MSUser:
-        return true;
-    default:
-        g_assert_not_reached();
-    }
-}
-
 static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 {
+    bool is_secure;
+
+    switch (mmu_idx) {
+    case ARMMMUIdx_E10_0:
+    case ARMMMUIdx_E10_1:
+    case ARMMMUIdx_E10_1_PAN:
+    case ARMMMUIdx_E20_0:
+    case ARMMMUIdx_E20_2:
+    case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_E1:
+    case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_E2:
+    case ARMMMUIdx_Stage2:
+    case ARMMMUIdx_MPrivNegPri:
+    case ARMMMUIdx_MUserNegPri:
+    case ARMMMUIdx_MPriv:
+    case ARMMMUIdx_MUser:
+        is_secure = false;
+        break;
+    case ARMMMUIdx_SE3:
+    case ARMMMUIdx_SE10_0:
+    case ARMMMUIdx_SE10_1:
+    case ARMMMUIdx_SE10_1_PAN:
+    case ARMMMUIdx_SE20_0:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
+    case ARMMMUIdx_Stage1_SE0:
+    case ARMMMUIdx_Stage1_SE1:
+    case ARMMMUIdx_Stage1_SE1_PAN:
+    case ARMMMUIdx_SE2:
+    case ARMMMUIdx_Stage2_S:
+    case ARMMMUIdx_MSPrivNegPri:
+    case ARMMMUIdx_MSUserNegPri:
+    case ARMMMUIdx_MSPriv:
+    case ARMMMUIdx_MSUser:
+        is_secure = true;
+        break;
+    default:
+        g_assert_not_reached();
+    }
     return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
-                                     regime_is_secure(env, mmu_idx),
-                                     result, fi);
+                                     is_secure, result, fi);
 }
 
 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Use get_phys_addr_with_secure directly.  For a-profile, this is the
one place where the value of is_secure may not equal arm_is_secure(env).

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
 
 #ifdef CONFIG_TCG
 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-                             MMUAccessType access_type, ARMMMUIdx mmu_idx)
+                             MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                             bool is_secure)
 {
     bool ret;
     uint64_t par64;
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
     ARMMMUFaultInfo fi = {};
     GetPhysAddrResult res = {};
 
-    ret = get_phys_addr(env, value, access_type, mmu_idx, &res, &fi);
+    ret = get_phys_addr_with_secure(env, value, access_type, mmu_idx,
+                                    is_secure, &res, &fi);
 
     /*
      * ATS operations only do S1 or S1+S2 translations, so we never
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         switch (el) {
         case 3:
             mmu_idx = ARMMMUIdx_SE3;
+            secure = true;
             break;
         case 2:
             g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         switch (el) {
         case 3:
             mmu_idx = ARMMMUIdx_SE10_0;
+            secure = true;
             break;
         case 2:
             g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     case 4:
         /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
         mmu_idx = ARMMMUIdx_E10_1;
+        secure = false;
         break;
     case 6:
         /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
         mmu_idx = ARMMMUIdx_E10_0;
+        secure = false;
         break;
     default:
         g_assert_not_reached();
     }
 
-    par64 = do_ats_write(env, value, access_type, mmu_idx);
+    par64 = do_ats_write(env, value, access_type, mmu_idx, secure);
 
     A32_BANKED_CURRENT_REG_SET(env, par, par64);
 #else
@@ -XXX,XX +XXX,XX @@ static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
     uint64_t par64;
 
-    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2);
+    /* There is no SecureEL2 for AArch32. */
+    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2, false);
 
     A32_BANKED_CURRENT_REG_SET(env, par, par64);
 #else
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
             break;
         case 6: /* AT S1E3R, AT S1E3W */
             mmu_idx = ARMMMUIdx_SE3;
+            secure = true;
             break;
         default:
             g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         g_assert_not_reached();
     }
 
-    env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
+    env->cp15.par_el[1] = do_ats_write(env, value, access_type,
+                                       mmu_idx, secure);
 #else
     /* Handled by hardware accelerator. */
     g_assert_not_reached();
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

For a-profile aarch64, which does not bank system registers, it takes
quite a lot of code to switch between security states.  In the process,
registers such as TCR_EL{1,2} must be swapped, which in itself requires
the flushing of softmmu tlbs.  Therefore it doesn't buy us anything to
separate tlbs by security state.

Retain the distinction between Stage2 and Stage2_S.

This will be important as we implement FEAT_RME, and do not wish to
add a third set of mmu indexes for Realm state.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-param.h     |   2 +-
 target/arm/cpu.h           |  72 +++++++------------
 target/arm/internals.h     |  31 +-------
 target/arm/helper.c        | 144 +++++++++++++------------------------
 target/arm/ptw.c           |  25 ++-----
 target/arm/translate-a64.c |   8 ---
 target/arm/translate.c     |   6 +-
 7 files changed, 85 insertions(+), 203 deletions(-)

diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -XXX,XX +XXX,XX @@
 # define TARGET_PAGE_BITS_MIN  10
 #endif
 
-#define NB_MMU_MODES 15
+#define NB_MMU_MODES 8
 
 #endif
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  *     table over and over.
  *  6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access
  *     Never (PAN) bit within PSTATE.
+ *  7. we fold together the secure and non-secure regimes for A-profile,
+ *     because there are no banked system registers for aarch64, so the
+ *     process of switching between secure and non-secure is
+ *     already heavyweight.
  *
  * This gives us the following list of cases:
  *
- * NS EL0 EL1&0 stage 1+2 (aka NS PL0)
- * NS EL1 EL1&0 stage 1+2 (aka NS PL1)
- * NS EL1 EL1&0 stage 1+2 +PAN
- * NS EL0 EL2&0
- * NS EL2 EL2&0
- * NS EL2 EL2&0 +PAN
- * NS EL2 (aka NS PL2)
- * S EL0 EL1&0 (aka S PL0)
- * S EL1 EL1&0 (not used if EL3 is 32 bit)
- * S EL1 EL1&0 +PAN
- * S EL3 (aka S PL1)
+ * EL0 EL1&0 stage 1+2 (aka NS PL0)
+ * EL1 EL1&0 stage 1+2 (aka NS PL1)
+ * EL1 EL1&0 stage 1+2 +PAN
+ * EL0 EL2&0
+ * EL2 EL2&0
+ * EL2 EL2&0 +PAN
+ * EL2 (aka NS PL2)
+ * EL3 (aka S PL1)
  *
- * for a total of 11 different mmu_idx.
+ * for a total of 8 different mmu_idx.
  *
  * R profile CPUs have an MPU, but can use the same set of MMU indexes
- * as A profile. They only need to distinguish NS EL0 and NS EL1 (and
- * NS EL2 if we ever model a Cortex-R52).
+ * as A profile. They only need to distinguish EL0 and EL1 (and
+ * EL2 if we ever model a Cortex-R52).
  *
  * M profile CPUs are rather different as they do not have a true MMU.
  * They have the following different MMU indexes:
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 #define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
 #define ARM_MMU_IDX_M     0x40  /* M profile */
 
-/* Meanings of the bits for A profile mmu idx values */
-#define ARM_MMU_IDX_A_NS     0x8
-
 /* Meanings of the bits for M profile mmu idx values */
 #define ARM_MMU_IDX_M_PRIV   0x1
 #define ARM_MMU_IDX_M_NEGPRI 0x2
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     /*
      * A-profile.
      */
-    ARMMMUIdx_SE10_0     =  0 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE20_0     =  1 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE10_1     =  2 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE20_2     =  3 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE10_1_PAN =  4 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE20_2_PAN =  5 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE2        =  6 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE3        =  7 | ARM_MMU_IDX_A,
-
-    ARMMMUIdx_E10_0     = ARMMMUIdx_SE10_0 | ARM_MMU_IDX_A_NS,
-    ARMMMUIdx_E20_0     = ARMMMUIdx_SE20_0 | ARM_MMU_IDX_A_NS,
-    ARMMMUIdx_E10_1     = ARMMMUIdx_SE10_1 | ARM_MMU_IDX_A_NS,
-    ARMMMUIdx_E20_2     = ARMMMUIdx_SE20_2 | ARM_MMU_IDX_A_NS,
-    ARMMMUIdx_E10_1_PAN = ARMMMUIdx_SE10_1_PAN | ARM_MMU_IDX_A_NS,
-    ARMMMUIdx_E20_2_PAN = ARMMMUIdx_SE20_2_PAN | ARM_MMU_IDX_A_NS,
-    ARMMMUIdx_E2        = ARMMMUIdx_SE2 | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E10_0     = 0 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_0     = 1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1     = 2 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2     = 3 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1_PAN = 4 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2_PAN = 5 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
 
     /*
      * These are not allocated TLBs and are used only for AT system
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
-    ARMMMUIdx_Stage1_SE0 = 3 | ARM_MMU_IDX_NOTLB,
-    ARMMMUIdx_Stage1_SE1 = 4 | ARM_MMU_IDX_NOTLB,
-    ARMMMUIdx_Stage1_SE1_PAN = 5 | ARM_MMU_IDX_NOTLB,
     /*
      * Not allocated a TLB: used only for second stage of an S12 page
      * table walk, or for descriptor loads during first stage of an S1
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
      * then various TLB flush insns which currently are no-ops or flush
      * only stage 1 MMU indexes will need to change to flush stage 2.
      */
-    ARMMMUIdx_Stage2     = 6 | ARM_MMU_IDX_NOTLB,
-    ARMMMUIdx_Stage2_S   = 7 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage2     = 3 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage2_S   = 4 | ARM_MMU_IDX_NOTLB,
 
     /*
      * M-profile.
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
     TO_CORE_BIT(E2),
     TO_CORE_BIT(E20_2),
     TO_CORE_BIT(E20_2_PAN),
-    TO_CORE_BIT(SE10_0),
-    TO_CORE_BIT(SE20_0),
-    TO_CORE_BIT(SE10_1),
-    TO_CORE_BIT(SE20_2),
-    TO_CORE_BIT(SE10_1_PAN),
-    TO_CORE_BIT(SE20_2_PAN),
-    TO_CORE_BIT(SE2),
-    TO_CORE_BIT(SE3),
+    TO_CORE_BIT(E3),
 
     TO_CORE_BIT(MUser),
     TO_CORE_BIT(MPriv),
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_Stage1_SE0:
-    case ARMMMUIdx_Stage1_SE1:
-    case ARMMMUIdx_Stage1_SE1_PAN:
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_SE10_0:
-    case ARMMMUIdx_SE10_1:
-    case ARMMMUIdx_SE10_1_PAN:
-    case ARMMMUIdx_SE20_0:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
         return true;
     default:
         return false;
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
     case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_Stage1_SE1_PAN:
     case ARMMMUIdx_E10_1_PAN:
     case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_SE10_1_PAN:
-    case ARMMMUIdx_SE20_2_PAN:
         return true;
     default:
         return false;
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
-    case ARMMMUIdx_SE20_0:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
     case ARMMMUIdx_Stage2:
     case ARMMMUIdx_Stage2_S:
-    case ARMMMUIdx_SE2:
     case ARMMMUIdx_E2:
         return 2;
-    case ARMMMUIdx_SE3:
+    case ARMMMUIdx_E3:
         return 3;
-    case ARMMMUIdx_SE10_0:
-    case ARMMMUIdx_Stage1_SE0:
-        return arm_el_is_aa64(env, 3) ? 1 : 3;
-    case ARMMMUIdx_SE10_1:
-    case ARMMMUIdx_SE10_1_PAN:
+    case ARMMMUIdx_E10_0:
     case ARMMMUIdx_Stage1_E0:
+        return arm_el_is_aa64(env, 3) || !arm_is_secure_below_el3(env) ? 1 : 3;
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_Stage1_SE1:
-    case ARMMMUIdx_Stage1_SE1_PAN:
-    case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
     case ARMMMUIdx_MPrivNegPri:
@@ -XXX,XX +XXX,XX @@ static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_Stage1_SE0:
-    case ARMMMUIdx_Stage1_SE1:
-    case ARMMMUIdx_Stage1_SE1_PAN:
         return true;
     default:
         return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     /* Begin with base v8.0 state.  */
     uint64_t valid_mask = 0x3fff;
     ARMCPU *cpu = env_archcpu(env);
+    uint64_t changed;
 
     /*
      * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 
     /* Clear all-context RES0 bits.  */
     value &= valid_mask;
-    raw_write(env, ri, value);
+    changed = env->cp15.scr_el3 ^ value;
+    env->cp15.scr_el3 = value;
+
+    /*
+     * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then
+     * we must invalidate all TLBs below EL3.
+     */
+    if (changed & SCR_NS) {
+        tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
+                                           ARMMMUIdxBit_E20_0 |
+                                           ARMMMUIdxBit_E10_1 |
+                                           ARMMMUIdxBit_E20_2 |
+                                           ARMMMUIdxBit_E10_1_PAN |
+                                           ARMMMUIdxBit_E20_2_PAN |
+                                           ARMMMUIdxBit_E2));
+    }
 }
 
 static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ static int gt_phys_redir_timeridx(CPUARMState *env)
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_SE20_0:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
         return GTIMER_HYP;
     default:
         return GTIMER_PHYS;
@@ -XXX,XX +XXX,XX @@ static int gt_virt_redir_timeridx(CPUARMState *env)
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_SE20_0:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
         return GTIMER_HYPVIRT;
     default:
         return GTIMER_VIRT;
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */
         switch (el) {
         case 3:
-            mmu_idx = ARMMMUIdx_SE3;
+            mmu_idx = ARMMMUIdx_E3;
             secure = true;
             break;
         case 2:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             /* fall through */
         case 1:
             if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
-                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
-                           : ARMMMUIdx_Stage1_E1_PAN);
+                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
             } else {
-                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
+                mmu_idx = ARMMMUIdx_Stage1_E1;
             }
             break;
         default:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
         switch (el) {
         case 3:
-            mmu_idx = ARMMMUIdx_SE10_0;
+            mmu_idx = ARMMMUIdx_E10_0;
             secure = true;
             break;
         case 2:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             mmu_idx = ARMMMUIdx_Stage1_E0;
             break;
         case 1:
-            mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
+            mmu_idx = ARMMMUIdx_Stage1_E0;
             break;
         default:
             g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         switch (ri->opc1) {
         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
             if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
-                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
-                           : ARMMMUIdx_Stage1_E1_PAN);
+                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
             } else {
-                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
+                mmu_idx = ARMMMUIdx_Stage1_E1;
             }
             break;
         case 4: /* AT S1E2R, AT S1E2W */
-            mmu_idx = secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2;
+            mmu_idx = ARMMMUIdx_E2;
             break;
         case 6: /* AT S1E3R, AT S1E3W */
-            mmu_idx = ARMMMUIdx_SE3;
+            mmu_idx = ARMMMUIdx_E3;
             secure = true;
             break;
         default:
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         }
         break;
     case 2: /* AT S1E0R, AT S1E0W */
-        mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
+        mmu_idx = ARMMMUIdx_Stage1_E0;
         break;
     case 4: /* AT S12E1R, AT S12E1W */
-        mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1;
+        mmu_idx = ARMMMUIdx_E10_1;
         break;
     case 6: /* AT S12E0R, AT S12E0W */
-        mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0;
+        mmu_idx = ARMMMUIdx_E10_0;
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
         uint16_t mask = ARMMMUIdxBit_E20_2 |
                         ARMMMUIdxBit_E20_2_PAN |
                         ARMMMUIdxBit_E20_0;
-
-        if (arm_is_secure_below_el3(env)) {
-            mask >>= ARM_MMU_IDX_A_NS;
-        }
-
         tlb_flush_by_mmuidx(env_cpu(env), mask);
     }
     raw_write(env, ri, value);
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         uint16_t mask = ARMMMUIdxBit_E10_1 |
                         ARMMMUIdxBit_E10_1_PAN |
                         ARMMMUIdxBit_E10_0;
-
-        if (arm_is_secure_below_el3(env)) {
-            mask >>= ARM_MMU_IDX_A_NS;
-        }
-
         tlb_flush_by_mmuidx(cs, mask);
         raw_write(env, ri, value);
     }
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
                ARMMMUIdxBit_E10_1_PAN |
                ARMMMUIdxBit_E10_0;
     }
-
-    if (arm_is_secure_below_el3(env)) {
-        mask >>= ARM_MMU_IDX_A_NS;
-    }
-
     return mask;
 }
 
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbbits(CPUARMState *env, uint64_t addr)
         mmu_idx = ARMMMUIdx_E10_0;
     }
 
-    if (arm_is_secure_below_el3(env)) {
-        mmu_idx &= ~ARM_MMU_IDX_A_NS;
-    }
-
     return tlbbits_for_regime(env, mmu_idx, addr);
 }
 
@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)
      * stage 2 translations, whereas most other scopes only invalidate
      * stage 1 translations.
      */
-    if (arm_is_secure_below_el3(env)) {
-        return ARMMMUIdxBit_SE10_1 |
-               ARMMMUIdxBit_SE10_1_PAN |
-               ARMMMUIdxBit_SE10_0;
-    } else {
-        return ARMMMUIdxBit_E10_1 |
-               ARMMMUIdxBit_E10_1_PAN |
-               ARMMMUIdxBit_E10_0;
-    }
+    return (ARMMMUIdxBit_E10_1 |
+            ARMMMUIdxBit_E10_1_PAN |
+            ARMMMUIdxBit_E10_0);
 }
 
 static int e2_tlbmask(CPUARMState *env)
 {
-    if (arm_is_secure_below_el3(env)) {
-        return ARMMMUIdxBit_SE20_0 |
-               ARMMMUIdxBit_SE20_2 |
-               ARMMMUIdxBit_SE20_2_PAN |
-               ARMMMUIdxBit_SE2;
-    } else {
-        return ARMMMUIdxBit_E20_0 |
-               ARMMMUIdxBit_E20_2 |
-               ARMMMUIdxBit_E20_2_PAN |
-               ARMMMUIdxBit_E2;
-    }
+    return (ARMMMUIdxBit_E20_0 |
+            ARMMMUIdxBit_E20_2 |
+            ARMMMUIdxBit_E20_2_PAN |
+            ARMMMUIdxBit_E2);
 }
 
 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = env_archcpu(env);
     CPUState *cs = CPU(cpu);
 
-    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_SE3);
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3);
 }
 
 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_SE3);
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E3);
 }
 
 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = CPU(cpu);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_SE3);
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E3);
 }
 
 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
-    bool secure = arm_is_secure_below_el3(env);
-    int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
-    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2,
-                                  pageaddr);
+    int bits = tlbbits_for_regime(env, ARMMMUIdx_E2, pageaddr);
 
-    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
+    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
+                                                  ARMMMUIdxBit_E2, bits);
 }
 
 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
-    int bits = tlbbits_for_regime(env, ARMMMUIdx_SE3, pageaddr);
+    int bits = tlbbits_for_regime(env, ARMMMUIdx_E3, pageaddr);
 
     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                  ARMMMUIdxBit_SE3, bits);
+                                                  ARMMMUIdxBit_E3, bits);
 }
 
 #ifdef TARGET_AARCH64
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_rvae1is_write(CPUARMState *env,
 
 static int vae2_tlbmask(CPUARMState *env)
 {
-    return (arm_is_secure_below_el3(env)
-            ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2);
+    return ARMMMUIdxBit_E2;
 }
 
 static void tlbi_aa64_rvae2_write(CPUARMState *env,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_rvae3_write(CPUARMState *env,
      * flush-last-level-only.
      */
 
-    do_rvae_write(env, value, ARMMMUIdxBit_SE3,
-                  tlb_force_broadcast(env));
+    do_rvae_write(env, value, ARMMMUIdxBit_E3, tlb_force_broadcast(env));
 }
 
 static void tlbi_aa64_rvae3is_write(CPUARMState *env,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_rvae3is_write(CPUARMState *env,
      * flush-last-level-only or inner/outer specific flushes.
      */
 
-    do_rvae_write(env, value, ARMMMUIdxBit_SE3, true);
+    do_rvae_write(env, value, ARMMMUIdxBit_E3, true);
 }
 #endif
 
@@ -XXX,XX +XXX,XX @@ uint64_t arm_sctlr(CPUARMState *env, int el)
     /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */
     if (el == 0) {
         ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0);
-        el = (mmu_idx == ARMMMUIdx_E20_0 || mmu_idx == ARMMMUIdx_SE20_0)
-             ? 2 : 1;
+        el = mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1;
     }
     return env->cp15.sctlr_el[el];
 }
@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     switch (mmu_idx) {
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_SE10_0:
-    case ARMMMUIdx_SE20_0:
         return 0;
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
-    case ARMMMUIdx_SE10_1:
-    case ARMMMUIdx_SE10_1_PAN:
         return 1;
     case ARMMMUIdx_E2:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_SE2:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
         return 2;
-    case ARMMMUIdx_SE3:
+    case ARMMMUIdx_E3:
         return 3;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
         }
         break;
     case 3:
-        return ARMMMUIdx_SE3;
+        return ARMMMUIdx_E3;
     default:
         g_assert_not_reached();
     }
 
-    if (arm_is_secure_below_el3(env)) {
-        idx &= ~ARM_MMU_IDX_A_NS;
-    }
-
     return idx;
 }
 
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         switch (mmu_idx) {
         case ARMMMUIdx_E10_1:
         case ARMMMUIdx_E10_1_PAN:
-        case ARMMMUIdx_SE10_1:
-        case ARMMMUIdx_SE10_1_PAN:
             /* TODO: ARMv8.3-NV */
             DP_TBFLAG_A64(flags, UNPRIV, 1);
             break;
         case ARMMMUIdx_E20_2:
         case ARMMMUIdx_E20_2_PAN:
-        case ARMMMUIdx_SE20_2:
-        case ARMMMUIdx_SE20_2_PAN:
             /*
              * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
              * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu)
 ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
-    case ARMMMUIdx_SE10_0:
-        return ARMMMUIdx_Stage1_SE0;
-    case ARMMMUIdx_SE10_1:
-        return ARMMMUIdx_Stage1_SE1;
-    case ARMMMUIdx_SE10_1_PAN:
-        return ARMMMUIdx_Stage1_SE1_PAN;
     case ARMMMUIdx_E10_0:
         return ARMMMUIdx_Stage1_E0;
     case ARMMMUIdx_E10_1:
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
 static bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
-    case ARMMMUIdx_SE10_0:
     case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_SE20_0:
     case ARMMMUIdx_Stage1_E0:
-    case ARMMMUIdx_Stage1_SE0:
     case ARMMMUIdx_MUser:
     case ARMMMUIdx_MSUser:
     case ARMMMUIdx_MUserNegPri:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
 
             s2_mmu_idx = (s2walk_secure
                           ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2);
-            is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
+            is_el0 = mmu_idx == ARMMMUIdx_E10_0;
 
             /*
              * S1 is done, now do S2 translation.
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
     case ARMMMUIdx_E2:
+        is_secure = arm_is_secure_below_el3(env);
+        break;
     case ARMMMUIdx_Stage2:
     case ARMMMUIdx_MPrivNegPri:
     case ARMMMUIdx_MUserNegPri:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     case ARMMMUIdx_MUser:
         is_secure = false;
         break;
-    case ARMMMUIdx_SE3:
-    case ARMMMUIdx_SE10_0:
-    case ARMMMUIdx_SE10_1:
-    case ARMMMUIdx_SE10_1_PAN:
-    case ARMMMUIdx_SE20_0:
-    case ARMMMUIdx_SE20_2:
-    case ARMMMUIdx_SE20_2_PAN:
-    case ARMMMUIdx_Stage1_SE0:
-    case ARMMMUIdx_Stage1_SE1:
-    case ARMMMUIdx_Stage1_SE1_PAN:
-    case ARMMMUIdx_SE2:
+    case ARMMMUIdx_E3:
     case ARMMMUIdx_Stage2_S:
     case ARMMMUIdx_MSPrivNegPri:
     case ARMMMUIdx_MSUserNegPri:
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static int get_a64_user_mem_index(DisasContext *s)
         case ARMMMUIdx_E20_2_PAN:
             useridx = ARMMMUIdx_E20_0;
             break;
-        case ARMMMUIdx_SE10_1:
-        case ARMMMUIdx_SE10_1_PAN:
-            useridx = ARMMMUIdx_SE10_0;
-            break;
-        case ARMMMUIdx_SE20_2:
-        case ARMMMUIdx_SE20_2_PAN:
-            useridx = ARMMMUIdx_SE20_0;
-            break;
         default:
             g_assert_not_reached();
         }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
      *  otherwise, access as if at PL0.
      */
     switch (s->mmu_idx) {
+    case ARMMMUIdx_E3:
     case ARMMMUIdx_E2:        /* this one is UNPREDICTABLE */
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
         return arm_to_core_mmu_idx(ARMMMUIdx_E10_0);
-    case ARMMMUIdx_SE3:
-    case ARMMMUIdx_SE10_0:
-    case ARMMMUIdx_SE10_1:
-    case ARMMMUIdx_SE10_1_PAN:
-        return arm_to_core_mmu_idx(ARMMMUIdx_SE10_0);
     case ARMMMUIdx_MUser:
     case ARMMMUIdx_MPriv:
         return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Use a switch on mmu_idx for the a-profile indexes, instead of
three different if's vs regime_el and arm_mmu_idx_is_stage1_of_2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
 
     hcr_el2 = arm_hcr_el2_eff(env);
 
-    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    switch (mmu_idx) {
+    case ARMMMUIdx_Stage2:
+    case ARMMMUIdx_Stage2_S:
         /* HCR.DC means HCR.VM behaves as 1 */
         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
-    }
 
-    if (hcr_el2 & HCR_TGE) {
+    case ARMMMUIdx_E10_0:
+    case ARMMMUIdx_E10_1:
+    case ARMMMUIdx_E10_1_PAN:
         /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
-        if (!is_secure && regime_el(env, mmu_idx) == 1) {
+        if (!is_secure && (hcr_el2 & HCR_TGE)) {
             return true;
         }
-    }
+        break;
 
-    if ((hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
+    case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_E1:
+    case ARMMMUIdx_Stage1_E1_PAN:
         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
-        return true;
+        if (hcr_el2 & HCR_DC) {
+            return true;
+        }
+        break;
+
+    case ARMMMUIdx_E20_0:
+    case ARMMMUIdx_E20_2:
+    case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_E2:
+    case ARMMMUIdx_E3:
+        break;
+
+    default:
+        g_assert_not_reached();
     }
 
     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The effect of TGE does not only apply to non-secure state,
now that Secure EL2 exists.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
-        /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
-        if (!is_secure && (hcr_el2 & HCR_TGE)) {
+        /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
+        if (hcr_el2 & HCR_TGE) {
             return true;
         }
         break;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

For page walking, we may require HCR for a security state
that is not "current".

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 20 +++++++++++++-------
 target/arm/helper.c | 11 ++++++++---
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
  * Return true if the current security state has AArch64 EL2 or AArch32 Hyp.
  * This corresponds to the pseudocode EL2Enabled()
  */
+static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)
+{
+    return arm_feature(env, ARM_FEATURE_EL2)
+           && (!secure || (env->cp15.scr_el3 & SCR_EEL2));
+}
+
 static inline bool arm_is_el2_enabled(CPUARMState *env)
 {
-    if (arm_feature(env, ARM_FEATURE_EL2)) {
-        if (arm_is_secure_below_el3(env)) {
-            return (env->cp15.scr_el3 & SCR_EEL2) != 0;
-        }
-        return true;
-    }
-    return false;
+    return arm_is_el2_enabled_secstate(env, arm_is_secure_below_el3(env));
 }
 
 #else
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
     return false;
 }
 
+static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)
+{
+    return false;
+}
+
 static inline bool arm_is_el2_enabled(CPUARMState *env)
 {
     return false;
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
  * "for all purposes other than a direct read or write access of HCR_EL2."
  * Not included here is HCR_RW.
  */
+uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure);
 uint64_t arm_hcr_el2_eff(CPUARMState *env);
 uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
 }
 
 /*
- * Return the effective value of HCR_EL2.
+ * Return the effective value of HCR_EL2, at the given security state.
  * Bits that are not included here:
  * RW       (read from SCR_EL3.RW as needed)
  */
-uint64_t arm_hcr_el2_eff(CPUARMState *env)
+uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
 {
     uint64_t ret = env->cp15.hcr_el2;
 
-    if (!arm_is_el2_enabled(env)) {
+    if (!arm_is_el2_enabled_secstate(env, secure)) {
         /*
          * "This register has no effect if EL2 is not enabled in the
          * current Security state".  This is ARMv8.4-SecEL2 speak for
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)
     return ret;
 }
 
+uint64_t arm_hcr_el2_eff(CPUARMState *env)
+{
+    return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
+}
+
 /*
  * Corresponds to ARM pseudocode function ELIsInHost().
  */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename the argument to is_secure_ptr, and introduce a
local variable is_secure with the value.  We only write
back to the pointer toward the end of the function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool ptw_attrs_are_device(CPUARMState *env, ARMCacheAttrs cacheattrs)
 
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-                               hwaddr addr, bool *is_secure,
+                               hwaddr addr, bool *is_secure_ptr,
                                ARMMMUFaultInfo *fi)
 {
-    ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+    bool is_secure = *is_secure_ptr;
+    ARMMMUIdx s2_mmu_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
 
     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
-        !regime_translation_disabled(env, s2_mmu_idx, *is_secure)) {
+        !regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
         GetPhysAddrResult s2 = {};
         int ret;
 
         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx,
-                                 *is_secure, false, &s2, fi);
+                                 is_secure, false, &s2, fi);
         if (ret) {
             assert(fi->type != ARMFault_None);
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
-            fi->s1ns = !*is_secure;
+            fi->s1ns = !is_secure;
             return ~0;
         }
         if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
-            fi->s1ns = !*is_secure;
+            fi->s1ns = !is_secure;
             return ~0;
         }
 
         if (arm_is_secure_below_el3(env)) {
             /* Check if page table walk is to secure or non-secure PA space. */
-            if (*is_secure) {
-                *is_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
+            if (is_secure) {
+                is_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
             } else {
-                *is_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
+                is_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
             }
+            *is_secure_ptr = is_secure;
         } else {
-            assert(!*is_secure);
+            assert(!is_secure);
         }
 
         addr = s2.phys;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This value is unused.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221001162318.153420-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static uint8_t force_cacheattr_nibble_wb(uint8_t attr)
  * s1 and s2 for the HCR_EL2.FWB == 1 case, returning the
  * combined attributes in MAIR_EL1 format.
  */
-static uint8_t combined_attrs_fwb(CPUARMState *env,
-                                  ARMCacheAttrs s1, ARMCacheAttrs s2)
+static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
 {
     switch (s2.attrs) {
     case 7:
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
 
     /* Combine memory type and cacheability attributes */
     if (arm_hcr_el2_eff(env) & HCR_FWB) {
-        ret.attrs = combined_attrs_fwb(env, s1, s2);
+        ret.attrs = combined_attrs_fwb(s1, s2);
     } else {
         ret.attrs = combined_attrs_nofwb(env, s1, s2);
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These subroutines did not need ENV for anything except
retrieving the effective value of HCR anyway.

We have computed the effective value of HCR in the callers,
and this will be especially important for interpreting HCR
in a non-current security state.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
 }
 
-static bool ptw_attrs_are_device(CPUARMState *env, ARMCacheAttrs cacheattrs)
+static bool ptw_attrs_are_device(uint64_t hcr, ARMCacheAttrs cacheattrs)
 {
     /*
      * For an S1 page table walk, the stage 1 attributes are always
@@ -XXX,XX +XXX,XX @@ static bool ptw_attrs_are_device(CPUARMState *env, ARMCacheAttrs cacheattrs)
      * when cacheattrs.attrs bit [2] is 0.
      */
     assert(cacheattrs.is_s2_format);
-    if (arm_hcr_el2_eff(env) & HCR_FWB) {
+    if (hcr & HCR_FWB) {
         return (cacheattrs.attrs & 0x4) == 0;
     } else {
         return (cacheattrs.attrs & 0xc) == 0;
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
         !regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
         GetPhysAddrResult s2 = {};
+        uint64_t hcr;
         int ret;
 
         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx,
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             fi->s1ns = !is_secure;
             return ~0;
         }
-        if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
-            ptw_attrs_are_device(env, s2.cacheattrs)) {
+
+        hcr = arm_hcr_el2_eff(env);
+        if ((hcr & HCR_PTW) && ptw_attrs_are_device(hcr, s2.cacheattrs)) {
             /*
              * PTW set and S1 walk touched S2 Device memory:
              * generate Permission fault.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
  * ref: shared/translation/attrs/S2AttrDecode()
  *      .../S2ConvertAttrsHints()
  */
-static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
+static uint8_t convert_stage2_attrs(uint64_t hcr, uint8_t s2attrs)
 {
     uint8_t hiattr = extract32(s2attrs, 2, 2);
     uint8_t loattr = extract32(s2attrs, 0, 2);
     uint8_t hihint = 0, lohint = 0;
 
     if (hiattr != 0) { /* normal memory */
-        if (arm_hcr_el2_eff(env) & HCR_CD) { /* cache disabled */
+        if (hcr & HCR_CD) { /* cache disabled */
             hiattr = loattr = 1; /* non-cacheable */
         } else {
             if (hiattr != 1) { /* Write-through or write-back */
@@ -XXX,XX +XXX,XX @@ static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
  * s1 and s2 for the HCR_EL2.FWB == 0 case, returning the
  * combined attributes in MAIR_EL1 format.
  */
-static uint8_t combined_attrs_nofwb(CPUARMState *env,
+static uint8_t combined_attrs_nofwb(uint64_t hcr,
                                     ARMCacheAttrs s1, ARMCacheAttrs s2)
 {
     uint8_t s1lo, s2lo, s1hi, s2hi, s2_mair_attrs, ret_attrs;
 
-    s2_mair_attrs = convert_stage2_attrs(env, s2.attrs);
+    s2_mair_attrs = convert_stage2_attrs(hcr, s2.attrs);
 
     s1lo = extract32(s1.attrs, 0, 4);
     s2lo = extract32(s2_mair_attrs, 0, 4);
@@ -XXX,XX +XXX,XX @@ static uint8_t combined_attrs_fwb(ARMCacheAttrs s1, ARMCacheAttrs s2)
  * @s1:      Attributes from stage 1 walk
  * @s2:      Attributes from stage 2 walk
  */
-static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
+static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
                                         ARMCacheAttrs s1, ARMCacheAttrs s2)
 {
     ARMCacheAttrs ret;
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(CPUARMState *env,
     }
 
     /* Combine memory type and cacheability attributes */
-    if (arm_hcr_el2_eff(env) & HCR_FWB) {
+    if (hcr & HCR_FWB) {
         ret.attrs = combined_attrs_fwb(s1, s2);
     } else {
-        ret.attrs = combined_attrs_nofwb(env, s1, s2);
+        ret.attrs = combined_attrs_nofwb(hcr, s1, s2);
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
             ARMCacheAttrs cacheattrs1;
             ARMMMUIdx s2_mmu_idx;
             bool is_el0;
+            uint64_t hcr;
 
             ret = get_phys_addr_with_secure(env, address, access_type,
                                             s1_mmu_idx, is_secure, result, fi);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
             }
 
             /* Combine the S1 and S2 cache attributes. */
-            if (arm_hcr_el2_eff(env) & HCR_DC) {
+            hcr = arm_hcr_el2_eff(env);
+            if (hcr & HCR_DC) {
                 /*
                  * HCR.DC forces the first stage attributes to
                  *  Normal Non-Shareable,
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                 }
                 cacheattrs1.shareability = 0;
             }
-            result->cacheattrs = combine_cacheattrs(env, cacheattrs1,
+            result->cacheattrs = combine_cacheattrs(hcr, cacheattrs1,
                                                     result->cacheattrs);
 
             /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Use arm_hcr_el2_eff_secstate instead of arm_hcr_el2_eff, so
that we use is_secure instead of the current security state.
These AT* operations have been broken since arm_hcr_el2_eff
gained a check for "el2 enabled" for Secure EL2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
         }
     }
 
-    hcr_el2 = arm_hcr_el2_eff(env);
+    hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure);
 
     switch (mmu_idx) {
     case ARMMMUIdx_Stage2:
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             return ~0;
         }
 
-        hcr = arm_hcr_el2_eff(env);
+        hcr = arm_hcr_el2_eff_secstate(env, is_secure);
         if ((hcr & HCR_PTW) && ptw_attrs_are_device(hcr, s2.cacheattrs)) {
             /*
              * PTW set and S1 walk touched S2 Device memory:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
             }
 
             /* Combine the S1 and S2 cache attributes. */
-            hcr = arm_hcr_el2_eff(env);
+            hcr = arm_hcr_el2_eff_secstate(env, is_secure);
             if (hcr & HCR_DC) {
                 /*
                  * HCR.DC forces the first stage attributes to
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
         result->page_size = TARGET_PAGE_SIZE;
 
         /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
-        hcr = arm_hcr_el2_eff(env);
+        hcr = arm_hcr_el2_eff_secstate(env, is_secure);
         result->cacheattrs.shareability = 0;
         result->cacheattrs.is_s2_format = false;
         if (hcr & HCR_DC) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221001162318.153420-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 138 +++++++++++++++++++++++++----------------------
 1 file changed, 74 insertions(+), 64 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
     return ret;
 }
 
+/*
+ * MMU disabled.  S1 addresses within aa64 translation regimes are
+ * still checked for bounds -- see AArch64.S1DisabledOutput().
+ */
+static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
+                                   MMUAccessType access_type,
+                                   ARMMMUIdx mmu_idx, bool is_secure,
+                                   GetPhysAddrResult *result,
+                                   ARMMMUFaultInfo *fi)
+{
+    uint64_t hcr;
+    uint8_t memattr;
+
+    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
+        int r_el = regime_el(env, mmu_idx);
+        if (arm_el_is_aa64(env, r_el)) {
+            int pamax = arm_pamax(env_archcpu(env));
+            uint64_t tcr = env->cp15.tcr_el[r_el];
+            int addrtop, tbi;
+
+            tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
+            if (access_type == MMU_INST_FETCH) {
+                tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
+            }
+            tbi = (tbi >> extract64(address, 55, 1)) & 1;
+            addrtop = (tbi ? 55 : 63);
+
+            if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
+                fi->type = ARMFault_AddressSize;
+                fi->level = 0;
+                fi->stage2 = false;
+                return 1;
+            }
+
+            /*
+             * When TBI is disabled, we've just validated that all of the
+             * bits above PAMax are zero, so logically we only need to
+             * clear the top byte for TBI.  But it's clearer to follow
+             * the pseudocode set of addrdesc.paddress.
+             */
+            address = extract64(address, 0, 52);
+        }
+    }
+
+    result->phys = address;
+    result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+    result->page_size = TARGET_PAGE_SIZE;
+
+    /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
+    hcr = arm_hcr_el2_eff_secstate(env, is_secure);
+    result->cacheattrs.shareability = 0;
+    result->cacheattrs.is_s2_format = false;
+    if (hcr & HCR_DC) {
+        if (hcr & HCR_DCT) {
+            memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
+        } else {
+            memattr = 0xff;  /* Normal, WB, RWA */
+        }
+    } else if (access_type == MMU_INST_FETCH) {
+        if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
+            memattr = 0xee;  /* Normal, WT, RA, NT */
+        } else {
+            memattr = 0x44;  /* Normal, NC, No */
+        }
+        result->cacheattrs.shareability = 2; /* outer sharable */
+    } else {
+        memattr = 0x00;      /* Device, nGnRnE */
+    }
+    result->cacheattrs.attrs = memattr;
+    return 0;
+}
+
 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool is_secure, GetPhysAddrResult *result,
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
     /* Definitely a real MMU, not an MPU */
 
     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
-        uint64_t hcr;
-        uint8_t memattr;
-
-        /*
-         * MMU disabled.  S1 addresses within aa64 translation regimes are
-         * still checked for bounds -- see AArch64.TranslateAddressS1Off.
-         */
-        if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
-            int r_el = regime_el(env, mmu_idx);
-            if (arm_el_is_aa64(env, r_el)) {
-                int pamax = arm_pamax(env_archcpu(env));
-                uint64_t tcr = env->cp15.tcr_el[r_el];
-                int addrtop, tbi;
-
-                tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
-                if (access_type == MMU_INST_FETCH) {
-                    tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
-                }
-                tbi = (tbi >> extract64(address, 55, 1)) & 1;
-                addrtop = (tbi ? 55 : 63);
-
-                if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
-                    fi->type = ARMFault_AddressSize;
-                    fi->level = 0;
-                    fi->stage2 = false;
-                    return 1;
-                }
-
-                /*
-                 * When TBI is disabled, we've just validated that all of the
-                 * bits above PAMax are zero, so logically we only need to
-                 * clear the top byte for TBI.  But it's clearer to follow
-                 * the pseudocode set of addrdesc.paddress.
-                 */
-                address = extract64(address, 0, 52);
-            }
-        }
-        result->phys = address;
-        result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
-        result->page_size = TARGET_PAGE_SIZE;
-
-        /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
-        hcr = arm_hcr_el2_eff_secstate(env, is_secure);
-        result->cacheattrs.shareability = 0;
-        result->cacheattrs.is_s2_format = false;
-        if (hcr & HCR_DC) {
-            if (hcr & HCR_DCT) {
-                memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
-            } else {
-                memattr = 0xff;  /* Normal, WB, RWA */
-            }
-        } else if (access_type == MMU_INST_FETCH) {
-            if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
-                memattr = 0xee;  /* Normal, WT, RA, NT */
-            } else {
-                memattr = 0x44;  /* Normal, NC, No */
-            }
-            result->cacheattrs.shareability = 2; /* outer sharable */
-        } else {
-            memattr = 0x00;      /* Device, nGnRnE */
-        }
-        result->cacheattrs.attrs = memattr;
-        return 0;
+        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
+                                      is_secure, result, fi);
     }
-
     if (regime_using_lpae_format(env, mmu_idx)) {
         return get_phys_addr_lpae(env, address, access_type, mmu_idx,
                                   is_secure, false, result, fi);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Do not apply memattr or shareability for Stage2 translations.
Make sure to apply HCR_{DC,DCT} only to Regime_EL10, per the
pseudocode in AArch64.S1DisabledOutput.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221001162318.153420-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 48 +++++++++++++++++++++++++-----------------------
 1 file changed, 25 insertions(+), 23 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
                                    GetPhysAddrResult *result,
                                    ARMMMUFaultInfo *fi)
 {
-    uint64_t hcr;
-    uint8_t memattr;
+    uint8_t memattr = 0x00;    /* Device nGnRnE */
+    uint8_t shareability = 0;  /* non-sharable */
 
     if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
         int r_el = regime_el(env, mmu_idx);
+
         if (arm_el_is_aa64(env, r_el)) {
             int pamax = arm_pamax(env_archcpu(env));
             uint64_t tcr = env->cp15.tcr_el[r_el];
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
              */
             address = extract64(address, 0, 52);
         }
+
+        /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
+        if (r_el == 1) {
+            uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
+            if (hcr & HCR_DC) {
+                if (hcr & HCR_DCT) {
+                    memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
+                } else {
+                    memattr = 0xff;  /* Normal, WB, RWA */
+                }
+            }
+        }
+        if (memattr == 0 && access_type == MMU_INST_FETCH) {
+            if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
+                memattr = 0xee;  /* Normal, WT, RA, NT */
+            } else {
+                memattr = 0x44;  /* Normal, NC, No */
+            }
+            shareability = 2; /* outer sharable */
+        }
+        result->cacheattrs.is_s2_format = false;
     }
 
     result->phys = address;
     result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     result->page_size = TARGET_PAGE_SIZE;
-
-    /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
-    hcr = arm_hcr_el2_eff_secstate(env, is_secure);
-    result->cacheattrs.shareability = 0;
-    result->cacheattrs.is_s2_format = false;
-    if (hcr & HCR_DC) {
-        if (hcr & HCR_DCT) {
-            memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
-        } else {
-            memattr = 0xff;  /* Normal, WB, RWA */
-        }
-    } else if (access_type == MMU_INST_FETCH) {
-        if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
-            memattr = 0xee;  /* Normal, WT, RA, NT */
-        } else {
-            memattr = 0x44;  /* Normal, NC, No */
-        }
-        result->cacheattrs.shareability = 2; /* outer sharable */
-    } else {
-        memattr = 0x00;      /* Device, nGnRnE */
-    }
+    result->cacheattrs.shareability = shareability;
     result->cacheattrs.attrs = memattr;
     return 0;
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Adjust GetPhysAddrResult to fill in CPUTLBEntryFull,
so that it may be passed directly to tlb_set_page_full.

The change is large, but mostly mechanical.  The major
non-mechanical change is page_size -> lg_page_size.
Most of the time this is obvious, and is related to
TARGET_PAGE_BITS.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221001162318.153420-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h  |   5 +-
 target/arm/helper.c     |  12 +--
 target/arm/m_helper.c   |  20 ++---
 target/arm/ptw.c        | 179 ++++++++++++++++++++--------------------
 target/arm/tlb_helper.c |   9 +-
 5 files changed, 111 insertions(+), 114 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMCacheAttrs {
 
 /* Fields that are valid upon success. */
 typedef struct GetPhysAddrResult {
-    hwaddr phys;
-    target_ulong page_size;
-    int prot;
-    MemTxAttrs attrs;
+    CPUTLBEntryFull f;
     ARMCacheAttrs cacheattrs;
 } GetPhysAddrResult;
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
         /* Create a 64-bit PAR */
         par64 = (1 << 11); /* LPAE bit always set */
         if (!ret) {
-            par64 |= res.phys & ~0xfffULL;
-            if (!res.attrs.secure) {
+            par64 |= res.f.phys_addr & ~0xfffULL;
+            if (!res.f.attrs.secure) {
                 par64 |= (1 << 9); /* NS */
             }
             par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
          */
         if (!ret) {
             /* We do not set any attribute bits in the PAR */
-            if (res.page_size == (1 << 24)
+            if (res.f.lg_page_size == 24
                 && arm_feature(env, ARM_FEATURE_V7)) {
-                par64 = (res.phys & 0xff000000) | (1 << 1);
+                par64 = (res.f.phys_addr & 0xff000000) | (1 << 1);
             } else {
-                par64 = res.phys & 0xfffff000;
+                par64 = res.f.phys_addr & 0xfffff000;
             }
-            if (!res.attrs.secure) {
+            if (!res.f.attrs.secure) {
                 par64 |= (1 << 9); /* NS */
             }
         } else {
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
         }
         goto pend_fault;
     }
-    address_space_stl_le(arm_addressspace(cs, res.attrs), res.phys, value,
-                         res.attrs, &txres);
+    address_space_stl_le(arm_addressspace(cs, res.f.attrs), res.f.phys_addr,
+                         value, res.f.attrs, &txres);
     if (txres != MEMTX_OK) {
         /* BusFault trying to write the data */
         if (mode == STACK_LAZYFP) {
@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
         goto pend_fault;
     }
 
-    value = address_space_ldl(arm_addressspace(cs, res.attrs), res.phys,
-                              res.attrs, &txres);
+    value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
+                              res.f.phys_addr, res.f.attrs, &txres);
     if (txres != MEMTX_OK) {
         /* BusFault trying to read the data */
         qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
         qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
         return false;
     }
-    *insn = address_space_lduw_le(arm_addressspace(cs, res.attrs), res.phys,
-                                  res.attrs, &txres);
+    *insn = address_space_lduw_le(arm_addressspace(cs, res.f.attrs),
+                                  res.f.phys_addr, res.f.attrs, &txres);
     if (txres != MEMTX_OK) {
         env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
         }
         return false;
     }
-    value = address_space_ldl(arm_addressspace(cs, res.attrs), res.phys,
-                              res.attrs, &txres);
+    value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
+                              res.f.phys_addr, res.f.attrs, &txres);
     if (txres != MEMTX_OK) {
         /* BusFault trying to read the data */
         qemu_log_mask(CPU_LOG_INT,
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
         } else {
             mrvalid = true;
         }
-        r = res.prot & PAGE_READ;
-        rw = res.prot & PAGE_WRITE;
+        r = res.f.prot & PAGE_READ;
+        rw = res.f.prot & PAGE_WRITE;
     } else {
         r = false;
         rw = false;
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             assert(!is_secure);
         }
 
-        addr = s2.phys;
+        addr = s2.f.phys_addr;
     }
     return addr;
 }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
         /* 1Mb section.  */
         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
         ap = (desc >> 10) & 3;
-        result->page_size = 1024 * 1024;
+        result->f.lg_page_size = 20; /* 1MB */
     } else {
         /* Lookup l2 entry.  */
         if (type == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
         case 1: /* 64k page.  */
             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
-            result->page_size = 0x10000;
+            result->f.lg_page_size = 16;
             break;
         case 2: /* 4k page.  */
             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
-            result->page_size = 0x1000;
+            result->f.lg_page_size = 12;
             break;
         case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
             if (type == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
                 if (arm_feature(env, ARM_FEATURE_XSCALE)
                     || arm_feature(env, ARM_FEATURE_V6)) {
                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
-                    result->page_size = 0x1000;
+                    result->f.lg_page_size = 12;
                 } else {
                     /*
                      * UNPREDICTABLE in ARMv5; we choose to take a
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
                 }
             } else {
                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
-                result->page_size = 0x400;
+                result->f.lg_page_size = 10;
             }
             ap = (desc >> 4) & 3;
             break;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
             g_assert_not_reached();
         }
     }
-    result->prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
-    result->prot |= result->prot ? PAGE_EXEC : 0;
-    if (!(result->prot & (1 << access_type))) {
+    result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
+    result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
+    if (!(result->f.prot & (1 << access_type))) {
         /* Access permission fault.  */
         fi->type = ARMFault_Permission;
         goto do_fault;
     }
-    result->phys = phys_addr;
+    result->f.phys_addr = phys_addr;
     return false;
 do_fault:
     fi->domain = domain;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
             phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
             phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
-            result->page_size = 0x1000000;
+            result->f.lg_page_size = 24;  /* 16MB */
         } else {
             /* Section.  */
             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
-            result->page_size = 0x100000;
+            result->f.lg_page_size = 20;  /* 1MB */
         }
         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
         xn = desc & (1 << 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         case 1: /* 64k page.  */
             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
             xn = desc & (1 << 15);
-            result->page_size = 0x10000;
+            result->f.lg_page_size = 16;
             break;
         case 2: case 3: /* 4k page.  */
             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
             xn = desc & 1;
-            result->page_size = 0x1000;
+            result->f.lg_page_size = 12;
             break;
         default:
             /* Never happens, but compiler isn't smart enough to tell.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         }
     }
     if (domain_prot == 3) {
-        result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     } else {
         if (pxn && !regime_is_user(env, mmu_idx)) {
             xn = 1;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
                 fi->type = ARMFault_AccessFlag;
                 goto do_fault;
             }
-            result->prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
+            result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
         } else {
-            result->prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
+            result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
         }
-        if (result->prot && !xn) {
-            result->prot |= PAGE_EXEC;
+        if (result->f.prot && !xn) {
+            result->f.prot |= PAGE_EXEC;
         }
-        if (!(result->prot & (1 << access_type))) {
+        if (!(result->f.prot & (1 << access_type))) {
             /* Access permission fault.  */
             fi->type = ARMFault_Permission;
             goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
          * the CPU doesn't support TZ or this is a non-secure translation
          * regime, because the attribute will already be non-secure.
          */
-        result->attrs.secure = false;
+        result->f.attrs.secure = false;
     }
-    result->phys = phys_addr;
+    result->f.phys_addr = phys_addr;
     return false;
 do_fault:
     fi->domain = domain;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
     if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
         xn = extract32(attrs, 11, 2);
-        result->prot = get_S2prot(env, ap, xn, s1_is_el0);
+        result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
         ns = extract32(attrs, 3, 1);
         xn = extract32(attrs, 12, 1);
         pxn = extract32(attrs, 11, 1);
-        result->prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
+        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
     }
 
     fault_type = ARMFault_Permission;
-    if (!(result->prot & (1 << access_type))) {
+    if (!(result->f.prot & (1 << access_type))) {
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          * the CPU doesn't support TZ or this is a non-secure translation
          * regime, because the attribute will already be non-secure.
          */
-        result->attrs.secure = false;
+        result->f.attrs.secure = false;
     }
     /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB.  */
     if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) {
-        arm_tlb_bti_gp(&result->attrs) = true;
+        arm_tlb_bti_gp(&result->f.attrs) = true;
     }
 
     if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         result->cacheattrs.shareability = extract32(attrs, 6, 2);
     }
 
-    result->phys = descaddr;
-    result->page_size = page_size;
+    result->f.phys_addr = descaddr;
+    result->f.lg_page_size = ctz64(page_size);
     return false;
 
 do_fault:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
 
     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
         /* MPU disabled.  */
-        result->phys = address;
-        result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        result->f.phys_addr = address;
+        result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
         return false;
     }
 
-    result->phys = address;
+    result->f.phys_addr = address;
     for (n = 7; n >= 0; n--) {
         base = env->cp15.c6_region[n];
         if ((base & 1) == 0) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
             fi->level = 1;
             return true;
         }
-        result->prot = PAGE_READ | PAGE_WRITE;
+        result->f.prot = PAGE_READ | PAGE_WRITE;
         break;
     case 2:
-        result->prot = PAGE_READ;
+        result->f.prot = PAGE_READ;
         if (!is_user) {
-            result->prot |= PAGE_WRITE;
+            result->f.prot |= PAGE_WRITE;
         }
         break;
     case 3:
-        result->prot = PAGE_READ | PAGE_WRITE;
+        result->f.prot = PAGE_READ | PAGE_WRITE;
         break;
     case 5:
         if (is_user) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
             fi->level = 1;
             return true;
         }
-        result->prot = PAGE_READ;
+        result->f.prot = PAGE_READ;
         break;
     case 6:
-        result->prot = PAGE_READ;
+        result->f.prot = PAGE_READ;
         break;
     default:
         /* Bad permission.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
         fi->level = 1;
         return true;
     }
-    result->prot |= PAGE_EXEC;
+    result->f.prot |= PAGE_EXEC;
     return false;
 }
 
 static void get_phys_addr_pmsav7_default(CPUARMState *env, ARMMMUIdx mmu_idx,
-                                         int32_t address, int *prot)
+                                         int32_t address, uint8_t *prot)
 {
     if (!arm_feature(env, ARM_FEATURE_M)) {
         *prot = PAGE_READ | PAGE_WRITE;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
     int n;
     bool is_user = regime_is_user(env, mmu_idx);
 
-    result->phys = address;
-    result->page_size = TARGET_PAGE_SIZE;
-    result->prot = 0;
+    result->f.phys_addr = address;
+    result->f.lg_page_size = TARGET_PAGE_BITS;
+    result->f.prot = 0;
 
     if (regime_translation_disabled(env, mmu_idx, secure) ||
         m_is_ppb_region(env, address)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
          * which always does a direct read using address_space_ldl(), rather
          * than going via this function, so we don't need to check that here.
          */
-        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->prot);
+        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
     } else { /* MPU enabled */
         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
             /* region search */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 if (ranges_overlap(base, rmask,
                                    address & TARGET_PAGE_MASK,
                                    TARGET_PAGE_SIZE)) {
-                    result->page_size = 1;
+                    result->f.lg_page_size = 0;
                 }
                 continue;
             }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 continue;
             }
             if (rsize < TARGET_PAGE_BITS) {
-                result->page_size = 1 << rsize;
+                result->f.lg_page_size = rsize;
             }
             break;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 fi->type = ARMFault_Background;
                 return true;
             }
-            get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->prot);
+            get_phys_addr_pmsav7_default(env, mmu_idx, address,
+                                         &result->f.prot);
         } else { /* a MPU hit! */
             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
             uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 case 5:
                     break; /* no access */
                 case 3:
-                    result->prot |= PAGE_WRITE;
+                    result->f.prot |= PAGE_WRITE;
                     /* fall through */
                 case 2:
                 case 6:
-                    result->prot |= PAGE_READ | PAGE_EXEC;
+                    result->f.prot |= PAGE_READ | PAGE_EXEC;
                     break;
                 case 7:
                     /* for v7M, same as 6; for R profile a reserved value */
                     if (arm_feature(env, ARM_FEATURE_M)) {
-                        result->prot |= PAGE_READ | PAGE_EXEC;
+                        result->f.prot |= PAGE_READ | PAGE_EXEC;
                         break;
                     }
                     /* fall through */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 case 1:
                 case 2:
                 case 3:
-                    result->prot |= PAGE_WRITE;
+                    result->f.prot |= PAGE_WRITE;
                     /* fall through */
                 case 5:
                 case 6:
-                    result->prot |= PAGE_READ | PAGE_EXEC;
+                    result->f.prot |= PAGE_READ | PAGE_EXEC;
                     break;
                 case 7:
                     /* for v7M, same as 6; for R profile a reserved value */
                     if (arm_feature(env, ARM_FEATURE_M)) {
-                        result->prot |= PAGE_READ | PAGE_EXEC;
+                        result->f.prot |= PAGE_READ | PAGE_EXEC;
                         break;
                     }
                     /* fall through */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
 
             /* execute never */
             if (xn) {
-                result->prot &= ~PAGE_EXEC;
+                result->f.prot &= ~PAGE_EXEC;
             }
         }
     }
 
     fi->type = ARMFault_Permission;
     fi->level = 1;
-    return !(result->prot & (1 << access_type));
+    return !(result->f.prot & (1 << access_type));
 }
 
 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
 
-    result->page_size = TARGET_PAGE_SIZE;
-    result->phys = address;
-    result->prot = 0;
+    result->f.lg_page_size = TARGET_PAGE_BITS;
+    result->f.phys_addr = address;
+    result->f.prot = 0;
     if (mregion) {
         *mregion = -1;
     }
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
                     ranges_overlap(base, limit - base + 1,
                                    addr_page_base,
                                    TARGET_PAGE_SIZE)) {
-                    result->page_size = 1;
+                    result->f.lg_page_size = 0;
                 }
                 continue;
             }
 
             if (base > addr_page_base || limit < addr_page_limit) {
-                result->page_size = 1;
+                result->f.lg_page_size = 0;
             }
 
             if (matchregion != -1) {
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
 
     if (matchregion == -1) {
         /* hit using the background region */
-        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->prot);
+        get_phys_addr_pmsav7_default(env, mmu_idx, address, &result->f.prot);
     } else {
         uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
         uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
             xn = 1;
         }
 
-        result->prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
-        if (result->prot && !xn && !(pxn && !is_user)) {
-            result->prot |= PAGE_EXEC;
+        result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
+        if (result->f.prot && !xn && !(pxn && !is_user)) {
+            result->f.prot |= PAGE_EXEC;
         }
         /*
          * We don't need to look the attribute up in the MAIR0/MAIR1
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
 
     fi->type = ARMFault_Permission;
     fi->level = 1;
-    return !(result->prot & (1 << access_type));
+    return !(result->f.prot & (1 << access_type));
 }
 
 static bool v8m_is_sau_exempt(CPUARMState *env,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
                 } else {
                     fi->type = ARMFault_QEMU_SFault;
                 }
-                result->page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
-                result->phys = address;
-                result->prot = 0;
+                result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
+                result->f.phys_addr = address;
+                result->f.prot = 0;
                 return true;
             }
         } else {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
              * might downgrade a secure access to nonsecure.
              */
             if (sattrs.ns) {
-                result->attrs.secure = false;
+                result->f.attrs.secure = false;
             } else if (!secure) {
                 /*
                  * NS access to S memory must fault.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
                  * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
                  */
                 fi->type = ARMFault_QEMU_SFault;
-                result->page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
-                result->phys = address;
-                result->prot = 0;
+                result->f.lg_page_size = sattrs.subpage ? 0 : TARGET_PAGE_BITS;
+                result->f.phys_addr = address;
+                result->f.prot = 0;
                 return true;
             }
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
                             result, fi, NULL);
     if (sattrs.subpage) {
-        result->page_size = 1;
+        result->f.lg_page_size = 0;
     }
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
         result->cacheattrs.is_s2_format = false;
     }
 
-    result->phys = address;
-    result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
-    result->page_size = TARGET_PAGE_SIZE;
+    result->f.phys_addr = address;
+    result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+    result->f.lg_page_size = TARGET_PAGE_BITS;
     result->cacheattrs.shareability = shareability;
     result->cacheattrs.attrs = memattr;
     return 0;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
-            ipa = result->phys;
-            ipa_secure = result->attrs.secure;
+            ipa = result->f.phys_addr;
+            ipa_secure = result->f.attrs.secure;
             if (is_secure) {
                 /* Select TCR based on the NS bit from the S1 walk. */
                 s2walk_secure = !(ipa_secure
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
              * Save the stage1 results so that we may merge
              * prot and cacheattrs later.
              */
-            s1_prot = result->prot;
+            s1_prot = result->f.prot;
             cacheattrs1 = result->cacheattrs;
             memset(result, 0, sizeof(*result));
 
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
             fi->s2addr = ipa;
 
             /* Combine the S1 and S2 perms.  */
-            result->prot &= s1_prot;
+            result->f.prot &= s1_prot;
 
             /* If S2 fails, return early.  */
             if (ret) {
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
              * Check if IPA translates to secure or non-secure PA space.
              * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
              */
-            result->attrs.secure =
+            result->f.attrs.secure =
                 (is_secure
                  && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
                  && (ipa_secure
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
      * cannot upgrade an non-secure translation regime's attributes
      * to secure.
      */
-    result->attrs.secure = is_secure;
-    result->attrs.user = regime_is_user(env, mmu_idx);
+    result->f.attrs.secure = is_secure;
+    result->f.attrs.user = regime_is_user(env, mmu_idx);
 
     /*
      * Fast Context Switch Extension. This doesn't exist at all in v8.
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
 
     if (arm_feature(env, ARM_FEATURE_PMSA)) {
         bool ret;
-        result->page_size = TARGET_PAGE_SIZE;
+        result->f.lg_page_size = TARGET_PAGE_BITS;
 
         if (arm_feature(env, ARM_FEATURE_V8)) {
             /* PMSAv8 */
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                       (access_type == MMU_DATA_STORE ? "writing" : "execute"),
                       (uint32_t)address, mmu_idx,
                       ret ? "Miss" : "Hit",
-                      result->prot & PAGE_READ ? 'r' : '-',
-                      result->prot & PAGE_WRITE ? 'w' : '-',
-                      result->prot & PAGE_EXEC ? 'x' : '-');
+                      result->f.prot & PAGE_READ ? 'r' : '-',
+                      result->f.prot & PAGE_WRITE ? 'w' : '-',
+                      result->f.prot & PAGE_EXEC ? 'x' : '-');
 
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     bool ret;
 
     ret = get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &res, &fi);
-    *attrs = res.attrs;
+    *attrs = res.f.attrs;
 
     if (ret) {
         return -1;
     }
-    return res.phys;
+    return res.f.phys_addr;
 }
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
          * target page size are handled specially, so for those we
          * pass in the exact addresses.
          */
-        if (res.page_size >= TARGET_PAGE_SIZE) {
-            res.phys &= TARGET_PAGE_MASK;
+        if (res.f.lg_page_size >= TARGET_PAGE_BITS) {
+            res.f.phys_addr &= TARGET_PAGE_MASK;
             address &= TARGET_PAGE_MASK;
         }
         /* Notice and record tagged memory. */
         if (cpu_isar_feature(aa64_mte, cpu) && res.cacheattrs.attrs == 0xf0) {
-            arm_tlb_mte_tagged(&res.attrs) = true;
+            arm_tlb_mte_tagged(&res.f.attrs) = true;
         }
 
-        tlb_set_page_with_attrs(cs, address, res.phys, res.attrs,
-                                res.prot, mmu_idx, res.page_size);
+        tlb_set_page_full(cs, mmu_idx, address, &res.f);
         return true;
     } else if (probe) {
         return false;
-- 
2.25.1

From: Jerome Forissier <jerome.forissier@linaro.org>

According to the Linux kernel booting.rst [1], CPTR_EL3.ESM and
SCR_EL3.EnTP2 must be initialized to 1 when EL3 is present and FEAT_SME
is advertised. This has to be taken care of when QEMU boots directly
into the kernel (i.e., "-M virt,secure=on -cpu max -kernel Image").

Cc: qemu-stable@nongnu.org
Fixes: 78cb9776662a ("target/arm: Enable SME for -cpu max")
Link: [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/arm64/booting.rst?h=v6.0#n321
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Message-id: 20221003145641.1921467-1-jerome.forissier@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     if (cpu_isar_feature(aa64_sve, cpu)) {
                         env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
                     }
+                    if (cpu_isar_feature(aa64_sme, cpu)) {
+                        env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
+                        env->cp15.scr_el3 |= SCR_ENTP2;
+                    }
                     /* AArch64 kernels never boot in secure mode */
                     assert(!info->secure_boot);
                     /* This hook is only supported for AArch32 currently:
-- 
2.25.1

Arm CPUs support some subset of the granule (page) sizes 4K, 16K and
64K.  The guest selects the one it wants using bits in the TCR_ELx
registers.  If it tries to program these registers with a value that
is either reserved or which requests a size that the CPU does not
implement, the architecture requires that the CPU behaves as if the
field was programmed to some size that has been implemented.
Currently we don't implement this, and instead let the guest use any
granule size, even if the CPU ID register fields say it isn't
present.

Make aa64_va_parameters() check against the supported granule size
and force use of a different one if it is not implemented.

(A subsequent commit will make ARMVAParameters use the new enum
rather than the current pair of using16k/using64k bools.)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221003162315.2833797-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       |  33 +++++++++++++
 target/arm/internals.h |   9 ++++
 target/arm/helper.c    | 102 +++++++++++++++++++++++++++++++++++++----
 3 files changed, 136 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_tgran16_2_lpa2(const ARMISARegisters *id)
     return t >= 3 || (t == 0 && isar_feature_aa64_tgran16_lpa2(id));
 }
 
+static inline bool isar_feature_aa64_tgran4(const ARMISARegisters *id)
+{
+    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 0;
+}
+
+static inline bool isar_feature_aa64_tgran16(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 1;
+}
+
+static inline bool isar_feature_aa64_tgran64(const ARMISARegisters *id)
+{
+    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64) >= 0;
+}
+
+static inline bool isar_feature_aa64_tgran4_2(const ARMISARegisters *id)
+{
+    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);
+    return t >= 2 || (t == 0 && isar_feature_aa64_tgran4(id));
+}
+
+static inline bool isar_feature_aa64_tgran16_2(const ARMISARegisters *id)
+{
+    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);
+    return t >= 2 || (t == 0 && isar_feature_aa64_tgran16(id));
+}
+
+static inline bool isar_feature_aa64_tgran64_2(const ARMISARegisters *id)
+{
+    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64_2);
+    return t >= 2 || (t == 0 && isar_feature_aa64_tgran64(id));
+}
+
 static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
     return valid;
 }
 
+/* Granule size (i.e. page size) */
+typedef enum ARMGranuleSize {
+    /* Same order as TG0 encoding */
+    Gran4K,
+    Gran64K,
+    Gran16K,
+    GranInvalid,
+} ARMGranuleSize;
+
 /*
  * Parameters of a given virtual address, as extracted from the
  * translation control register (TCR) for a given regime.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
     }
 }
 
+static ARMGranuleSize tg0_to_gran_size(int tg)
+{
+    switch (tg) {
+    case 0:
+        return Gran4K;
+    case 1:
+        return Gran64K;
+    case 2:
+        return Gran16K;
+    default:
+        return GranInvalid;
+    }
+}
+
+static ARMGranuleSize tg1_to_gran_size(int tg)
+{
+    switch (tg) {
+    case 1:
+        return Gran16K;
+    case 2:
+        return Gran4K;
+    case 3:
+        return Gran64K;
+    default:
+        return GranInvalid;
+    }
+}
+
+static inline bool have4k(ARMCPU *cpu, bool stage2)
+{
+    return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu)
+        : cpu_isar_feature(aa64_tgran4, cpu);
+}
+
+static inline bool have16k(ARMCPU *cpu, bool stage2)
+{
+    return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu)
+        : cpu_isar_feature(aa64_tgran16, cpu);
+}
+
+static inline bool have64k(ARMCPU *cpu, bool stage2)
+{
+    return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu)
+        : cpu_isar_feature(aa64_tgran64, cpu);
+}
+
+static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran,
+                                         bool stage2)
+{
+    switch (gran) {
+    case Gran4K:
+        if (have4k(cpu, stage2)) {
+            return gran;
+        }
+        break;
+    case Gran16K:
+        if (have16k(cpu, stage2)) {
+            return gran;
+        }
+        break;
+    case Gran64K:
+        if (have64k(cpu, stage2)) {
+            return gran;
+        }
+        break;
+    case GranInvalid:
+        break;
+    }
+    /*
+     * If the guest selects a granule size that isn't implemented,
+     * the architecture requires that we behave as if it selected one
+     * that is (with an IMPDEF choice of which one to pick). We choose
+     * to implement the smallest supported granule size.
+     */
+    if (have4k(cpu, stage2)) {
+        return Gran4K;
+    }
+    if (have16k(cpu, stage2)) {
+        return Gran16K;
+    }
+    assert(have64k(cpu, stage2));
+    return Gran64K;
+}
+
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
     bool epd, hpd, using16k, using64k, tsz_oob, ds;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
+    ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
+    bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
         tsz = extract32(tcr, 0, 6);
-        using64k = extract32(tcr, 14, 1);
-        using16k = extract32(tcr, 15, 1);
-        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+        gran = tg0_to_gran_size(extract32(tcr, 14, 2));
+        if (stage2) {
             /* VTCR_EL2 */
             hpd = false;
         } else {
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         select = extract64(va, 55, 1);
         if (!select) {
             tsz = extract32(tcr, 0, 6);
+            gran = tg0_to_gran_size(extract32(tcr, 14, 2));
             epd = extract32(tcr, 7, 1);
             sh = extract32(tcr, 12, 2);
-            using64k = extract32(tcr, 14, 1);
-            using16k = extract32(tcr, 15, 1);
             hpd = extract64(tcr, 41, 1);
         } else {
-            int tg = extract32(tcr, 30, 2);
-            using16k = tg == 1;
-            using64k = tg == 3;
             tsz = extract32(tcr, 16, 6);
+            gran = tg1_to_gran_size(extract32(tcr, 30, 2));
             epd = extract32(tcr, 23, 1);
             sh = extract32(tcr, 28, 2);
             hpd = extract64(tcr, 42, 1);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         ds = extract64(tcr, 59, 1);
     }
 
+    gran = sanitize_gran_size(cpu, gran, stage2);
+    using64k = gran == Gran64K;
+    using16k = gran == Gran16K;
+
     if (cpu_isar_feature(aa64_st, cpu)) {
         max_tsz = 48 - using64k;
     } else {
-- 
2.25.1

Now we have an enum for the granule size, use it in the
ARMVAParameters struct instead of the using16k/using64k bools.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221003162315.2833797-3-peter.maydell@linaro.org
---
 target/arm/internals.h | 23 +++++++++++++++++++++--
 target/arm/helper.c    | 39 ++++++++++++++++++++++++++++-----------
 target/arm/ptw.c       |  8 +-------
 3 files changed, 50 insertions(+), 20 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMGranuleSize {
     GranInvalid,
 } ARMGranuleSize;
 
+/**
+ * arm_granule_bits: Return address size of the granule in bits
+ *
+ * Return the address size of the granule in bits. This corresponds
+ * to the pseudocode TGxGranuleBits().
+ */
+static inline int arm_granule_bits(ARMGranuleSize gran)
+{
+    switch (gran) {
+    case Gran64K:
+        return 16;
+    case Gran16K:
+        return 14;
+    case Gran4K:
+        return 12;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 /*
  * Parameters of a given virtual address, as extracted from the
  * translation control register (TCR) for a given regime.
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
     bool tbi        : 1;
     bool epd        : 1;
     bool hpd        : 1;
-    bool using16k   : 1;
-    bool using64k   : 1;
     bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
     bool ds         : 1;
+    ARMGranuleSize gran : 2;
 } ARMVAParameters;
 
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint64_t length;
 } TLBIRange;
 
+static ARMGranuleSize tlbi_range_tg_to_gran_size(int tg)
+{
+    /*
+     * Note that the TLBI range TG field encoding differs from both
+     * TG0 and TG1 encodings.
+     */
+    switch (tg) {
+    case 1:
+        return Gran4K;
+    case 2:
+        return Gran16K;
+    case 3:
+        return Gran64K;
+    default:
+        return GranInvalid;
+    }
+}
+
 static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
                                      uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
     uint64_t select = sextract64(value, 36, 1);
     ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true);
     TLBIRange ret = { };
+    ARMGranuleSize gran;
 
     page_size_granule = extract64(value, 46, 2);
+    gran = tlbi_range_tg_to_gran_size(page_size_granule);
 
     /* The granule encoded in value must match the granule in use. */
-    if (page_size_granule != (param.using64k ? 3 : param.using16k ? 2 : 1)) {
+    if (gran != param.gran) {
         qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
                       page_size_granule);
         return ret;
     }
 
-    page_shift = (page_size_granule - 1) * 2 + 12;
+    page_shift = arm_granule_bits(gran);
     num = extract64(value, 39, 5);
     scale = extract64(value, 44, 2);
     exponent = (5 * scale) + 1;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    bool epd, hpd, using16k, using64k, tsz_oob, ds;
+    bool epd, hpd, tsz_oob, ds;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
     }
 
     gran = sanitize_gran_size(cpu, gran, stage2);
-    using64k = gran == Gran64K;
-    using16k = gran == Gran16K;
 
     if (cpu_isar_feature(aa64_st, cpu)) {
-        max_tsz = 48 - using64k;
+        max_tsz = 48 - (gran == Gran64K);
     } else {
         max_tsz = 39;
     }
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
      * adjust the effective value of DS, as documented.
      */
     min_tsz = 16;
-    if (using64k) {
+    if (gran == Gran64K) {
         if (cpu_isar_feature(aa64_lva, cpu)) {
             min_tsz = 12;
         }
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         switch (mmu_idx) {
         case ARMMMUIdx_Stage2:
         case ARMMMUIdx_Stage2_S:
-            if (using16k) {
+            if (gran == Gran16K) {
                 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
             } else {
                 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
             }
             break;
         default:
-            if (using16k) {
+            if (gran == Gran16K) {
                 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
             } else {
                 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .tbi = tbi,
         .epd = epd,
         .hpd = hpd,
-        .using16k = using16k,
-        .using64k = using64k,
         .tsz_oob = tsz_oob,
         .ds = ds,
+        .gran = gran,
     };
 }
 
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         }
     }
 
-    if (param.using64k) {
-        stride = 13;
-    } else if (param.using16k) {
-        stride = 11;
-    } else {
-        stride = 9;
-    }
+    stride = arm_granule_bits(param.gran) - 3;
 
     /*
      * Note that QEMU ignores shareability and cacheability attributes,
-- 
2.25.1

FEAT_GTG is a change tho the ID register ID_AA64MMFR0_EL1 so that it
can report a different set of supported granule (page) sizes for
stage 1 and stage 2 translation tables.  As of commit c20281b2a5048
we already report the granule sizes that way for '-cpu max', and now
we also correctly make attempts to use unimplemented granule sizes
fail, so we can report the support of the feature in the
documentation.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221003162315.2833797-4-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_FRINTTS (Floating-point to integer instructions)
 - FEAT_FlagM (Flag manipulation instructions v2)
 - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
+- FEAT_GTG (Guest translation granule size)
 - FEAT_HCX (Support for the HCRX_EL2 register)
 - FEAT_HPDS (Hierarchical permission disables)
 - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
-- 
2.25.1