Hi; this is the latest target-arm queue; most of this is a refactoring

patchset from RTH for the arm page-table-walk emulation.

The following changes since commit f1d33f55c47dfdaf8daacd618588ad3ae4c452d1:

Merge tag 'pull-testing-gdbstub-plugins-gitdm-061022-3' of https://github.com/stsquad/qemu into staging (2022-10-06 07:11:56 -0400)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221010

for you to fetch changes up to 915f62844cf62e428c7c178149b5ff1cbe129b07:

docs/system/arm/emulation.rst: Report FEAT_GTG support (2022-10-10 14:52:25 +0100)

* Retry KVM_CREATE_VM call if it fails EINTR

* allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented

* docs/nuvoton: Update URL for images

* refactoring of page table walk code

* hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3

* Don't allow guest to use unimplemented granule sizes

* Report FEAT_GTG support

Jerome Forissier (2):

target/arm: allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented

hw/arm/boot: set CPTR_EL3.ESM and SCR_EL3.EnTP2 when booting Linux with EL3

Joel Stanley (1):

docs/nuvoton: Update URL for images

Peter Maydell (4):

target/arm/kvm: Retry KVM_CREATE_VM call if it fails EINTR

target/arm: Don't allow guest to use unimplemented granule sizes

target/arm: Use ARMGranuleSize in ARMVAParameters

docs/system/arm/emulation.rst: Report FEAT_GTG support

Richard Henderson (21):

target/arm: Split s2walk_secure from ipa_secure in get_phys_addr

target/arm: Make the final stage1+2 write to secure be unconditional

target/arm: Add is_secure parameter to get_phys_addr_lpae

target/arm: Fix S2 disabled check in S1_ptw_translate

target/arm: Add is_secure parameter to regime_translation_disabled

target/arm: Split out get_phys_addr_with_secure

target/arm: Add is_secure parameter to v7m_read_half_insn

target/arm: Add TBFLAG_M32.SECURE

target/arm: Merge regime_is_secure into get_phys_addr

target/arm: Add is_secure parameter to do_ats_write

target/arm: Fold secure and non-secure a-profile mmu indexes

target/arm: Reorg regime_translation_disabled

target/arm: Drop secure check for HCR.TGE vs SCTLR_EL1.M

target/arm: Introduce arm_hcr_el2_eff_secstate

target/arm: Hoist read of *is_secure in S1_ptw_translate

target/arm: Remove env argument from combined_attrs_fwb

target/arm: Pass HCR to attribute subroutines.

target/arm: Fix ATS12NSO* from S PL1

target/arm: Split out get_phys_addr_disabled

target/arm: Fix cacheattr in get_phys_addr_disabled

target/arm: Use tlb_set_page_full

docs/system/arm/emulation.rst | 1 +

docs/system/arm/nuvoton.rst | 4 +-

target/arm/cpu-param.h | 2 +-

target/arm/cpu.h | 181 ++++++++------

target/arm/internals.h | 150 ++++++-----

hw/arm/boot.c | 4 +

target/arm/helper.c | 332 ++++++++++++++----------

target/arm/kvm.c | 4 +-

target/arm/m_helper.c | 29 ++-

target/arm/ptw.c | 570 ++++++++++++++++++++++--------------------

target/arm/tlb_helper.c | 9 +-

target/arm/translate-a64.c | 8 -

target/arm/translate.c | 9 +-

13 files changed, 717 insertions(+), 586 deletions(-)

Arm CPUs support some subset of the granule (page) sizes 4K, 16K and

64K. The guest selects the one it wants using bits in the TCR_ELx

registers. If it tries to program these registers with a value that

is either reserved or which requests a size that the CPU does not

implement, the architecture requires that the CPU behaves as if the

field was programmed to some size that has been implemented.

Currently we don't implement this, and instead let the guest use any

granule size, even if the CPU ID register fields say it isn't

present.

Make aa64_va_parameters() check against the supported granule size

and force use of a different one if it is not implemented.

(A subsequent commit will make ARMVAParameters use the new enum

rather than the current pair of using16k/using64k bools.)

target/arm/cpu.h | 33 +++++++++++++

target/arm/internals.h | 9 ++++

target/arm/helper.c | 102 +++++++++++++++++++++++++++++++++++++----

3 files changed, 136 insertions(+), 8 deletions(-)

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_tgran16_2_lpa2(const ARMISARegisters *id)

return t >= 3 || (t == 0 && isar_feature_aa64_tgran16_lpa2(id));

+static inline bool isar_feature_aa64_tgran4(const ARMISARegisters *id)

+ return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 0;

+static inline bool isar_feature_aa64_tgran16(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 1;

+}

+

+static inline bool isar_feature_aa64_tgran64(const ARMISARegisters *id)

+{

+ return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64) >= 0;

+}

+

+static inline bool isar_feature_aa64_tgran4_2(const ARMISARegisters *id)

+{

+ unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);

+ return t >= 2 || (t == 0 && isar_feature_aa64_tgran4(id));

+}

+

+static inline bool isar_feature_aa64_tgran16_2(const ARMISARegisters *id)

+{

+ unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);

+ return t >= 2 || (t == 0 && isar_feature_aa64_tgran16(id));

+}

+

+static inline bool isar_feature_aa64_tgran64_2(const ARMISARegisters *id)

+{

+ unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN64_2);

+ return t >= 2 || (t == 0 && isar_feature_aa64_tgran64(id));

+}

+

static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)

return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;

diff --git a/target/arm/internals.h b/target/arm/internals.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)

return valid;

}

+/* Granule size (i.e. page size) */

+typedef enum ARMGranuleSize {

+ /* Same order as TG0 encoding */

+ Gran4K,

+ Gran64K,

+ Gran16K,

+ GranInvalid,

+} ARMGranuleSize;

+

/*

* Parameters of a given virtual address, as extracted from the

* translation control register (TCR) for a given regime.

@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)

}

}

+static ARMGranuleSize tg0_to_gran_size(int tg)

+{

+ switch (tg) {

+ case 0:

+ return Gran4K;

+ case 1:

+ return Gran64K;

+ case 2:

+ return Gran16K;

+ default:

+ return GranInvalid;

+ }

+}

+

+static ARMGranuleSize tg1_to_gran_size(int tg)

+{

+ switch (tg) {

+ case 1:

+ return Gran16K;

+ case 2:

+ return Gran4K;

+ case 3:

+ return Gran64K;

+ default:

+ return GranInvalid;

+ }

+}

+

+static inline bool have4k(ARMCPU *cpu, bool stage2)

+{

+ return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu)

+ : cpu_isar_feature(aa64_tgran4, cpu);

+}

+

+static inline bool have16k(ARMCPU *cpu, bool stage2)

+{

+ return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu)

+ : cpu_isar_feature(aa64_tgran16, cpu);

+}

+

+static inline bool have64k(ARMCPU *cpu, bool stage2)

+{

+ return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu)

+ : cpu_isar_feature(aa64_tgran64, cpu);

+}

+

+static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran,

+ bool stage2)

+{

+ switch (gran) {

+ case Gran4K:

+ if (have4k(cpu, stage2)) {

+ return gran;

+ }

+ break;

+ case Gran16K:

+ if (have16k(cpu, stage2)) {

+ return gran;

+ }

+ break;

+ case Gran64K:

+ if (have64k(cpu, stage2)) {

+ return gran;

+ }

+ break;

+ case GranInvalid:

+ break;

+ }

+ /*

+ * If the guest selects a granule size that isn't implemented,

+ * the architecture requires that we behave as if it selected one

+ * that is (with an IMPDEF choice of which one to pick). We choose

+ * to implement the smallest supported granule size.

+ */

+ if (have4k(cpu, stage2)) {

+ return Gran4K;

+ }

+ if (have16k(cpu, stage2)) {

+ return Gran16K;

+ }

+ assert(have64k(cpu, stage2));

+ return Gran64K;

+}

+

ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,

ARMMMUIdx mmu_idx, bool data)

uint64_t tcr = regime_tcr(env, mmu_idx);

bool epd, hpd, using16k, using64k, tsz_oob, ds;

int select, tsz, tbi, max_tsz, min_tsz, ps, sh;

+ ARMGranuleSize gran;

ARMCPU *cpu = env_archcpu(env);

+ bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;

tsz = extract32(tcr, 0, 6);

- using64k = extract32(tcr, 14, 1);

- using16k = extract32(tcr, 15, 1);

- if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {

+ gran = tg0_to_gran_size(extract32(tcr, 14, 2));

+ if (stage2) {

/* VTCR_EL2 */

hpd = false;

@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,

select = extract64(va, 55, 1);

if (!select) {

tsz = extract32(tcr, 0, 6);

+ gran = tg0_to_gran_size(extract32(tcr, 14, 2));

epd = extract32(tcr, 7, 1);

sh = extract32(tcr, 12, 2);

- using64k = extract32(tcr, 14, 1);

- using16k = extract32(tcr, 15, 1);

hpd = extract64(tcr, 41, 1);

} else {

- int tg = extract32(tcr, 30, 2);

- using16k = tg == 1;

- using64k = tg == 3;

tsz = extract32(tcr, 16, 6);

+ gran = tg1_to_gran_size(extract32(tcr, 30, 2));

epd = extract32(tcr, 23, 1);

sh = extract32(tcr, 28, 2);

hpd = extract64(tcr, 42, 1);

@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,

ds = extract64(tcr, 59, 1);

}

+ gran = sanitize_gran_size(cpu, gran, stage2);

+ using64k = gran == Gran64K;

+ using16k = gran == Gran16K;

+

if (cpu_isar_feature(aa64_st, cpu)) {

max_tsz = 48 - using64k;

} else {

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Do not apply memattr or shareability for Stage2 translations.

Make sure to apply HCR_{DC,DCT} only to Regime_EL10, per the

pseudocode in AArch64.S1DisabledOutput.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20221001162318.153420-20-richard.henderson@linaro.org

target/arm/ptw.c | 48 +++++++++++++++++++++++++-----------------------

1 file changed, 25 insertions(+), 23 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c

--- a/target/arm/ptw.c

+++ b/target/arm/ptw.c

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,

GetPhysAddrResult *result,

ARMMMUFaultInfo *fi)

{

- uint64_t hcr;

- uint8_t memattr;

+ uint8_t memattr = 0x00; /* Device nGnRnE */

+ uint8_t shareability = 0; /* non-sharable */

if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {

int r_el = regime_el(env, mmu_idx);

+

if (arm_el_is_aa64(env, r_el)) {

int pamax = arm_pamax(env_archcpu(env));

uint64_t tcr = env->cp15.tcr_el[r_el];

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,

*/

address = extract64(address, 0, 52);

}

+

+ /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */

+ if (r_el == 1) {

+ uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);

+ if (hcr & HCR_DC) {

+ if (hcr & HCR_DCT) {

+ memattr = 0xf0; /* Tagged, Normal, WB, RWA */

+ } else {

+ memattr = 0xff; /* Normal, WB, RWA */

+ }

+ }

+ }

+ if (memattr == 0 && access_type == MMU_INST_FETCH) {

+ if (regime_sctlr(env, mmu_idx) & SCTLR_I) {

+ memattr = 0xee; /* Normal, WT, RA, NT */

+ } else {

+ memattr = 0x44; /* Normal, NC, No */

+ }

+ shareability = 2; /* outer sharable */

+ }

+ result->cacheattrs.is_s2_format = false;

}

result->phys = address;

result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;

result->page_size = TARGET_PAGE_SIZE;

-

- /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */

- hcr = arm_hcr_el2_eff_secstate(env, is_secure);

- result->cacheattrs.shareability = 0;

- result->cacheattrs.is_s2_format = false;

- if (hcr & HCR_DC) {

- if (hcr & HCR_DCT) {

- memattr = 0xf0; /* Tagged, Normal, WB, RWA */

- } else {

- memattr = 0xff; /* Normal, WB, RWA */

- }

- } else if (access_type == MMU_INST_FETCH) {

- if (regime_sctlr(env, mmu_idx) & SCTLR_I) {

- memattr = 0xee; /* Normal, WT, RA, NT */

- } else {

- memattr = 0x44; /* Normal, NC, No */

- }

- result->cacheattrs.shareability = 2; /* outer sharable */

- } else {

- memattr = 0x00; /* Device, nGnRnE */

- }

+ result->cacheattrs.shareability = shareability;

result->cacheattrs.attrs = memattr;

return 0;

}

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove the use of regime_is_secure from regime_translation_disabled,

using the new parameter instead.

This fixes a bug in S1_ptw_translate and get_phys_addr where we had

passed ARMMMUIdx_Stage2 and not ARMMMUIdx_Stage2_S to determine if

Stage2 is disabled, affecting FEAT_SEL2.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20221001162318.153420-5-richard.henderson@linaro.org

target/arm/ptw.c | 20 +++++++++++---------

1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c

--- a/target/arm/ptw.c

+++ b/target/arm/ptw.c

@@ -XXX,XX +XXX,XX @@ static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)

}

/* Return true if the specified stage of address translation is disabled */

-static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx)

+static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,

+ bool is_secure)

{

uint64_t hcr_el2;

if (arm_feature(env, ARM_FEATURE_M)) {

- switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &

+ switch (env->v7m.mpu_ctrl[is_secure] &

(R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {

case R_V7M_MPU_CTRL_ENABLE_MASK:

/* Enabled, but not for HardFault and NMI */

@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx)

if (hcr_el2 & HCR_TGE) {

/* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */

- if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {

+ if (!is_secure && regime_el(env, mmu_idx) == 1) {

return true;

}

}

@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,

ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;

if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&

- !regime_translation_disabled(env, s2_mmu_idx)) {

+ !regime_translation_disabled(env, s2_mmu_idx, *is_secure)) {

GetPhysAddrResult s2 = {};

int ret;

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,

uint32_t base;

bool is_user = regime_is_user(env, mmu_idx);

- if (regime_translation_disabled(env, mmu_idx)) {

+ if (regime_translation_disabled(env, mmu_idx, is_secure)) {

/* MPU disabled. */

result->phys = address;

result->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,

result->page_size = TARGET_PAGE_SIZE;

result->prot = 0;

- if (regime_translation_disabled(env, mmu_idx) ||

+ if (regime_translation_disabled(env, mmu_idx, secure) ||

m_is_ppb_region(env, address)) {

/*

* MPU disabled or M profile PPB access: use default memory map.

@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,

* are done in arm_v7m_load_vector(), which always does a direct

* read using address_space_ldl(), rather than going via this function.

*/

- if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */

+ if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */

hit = true;

} else if (m_is_ppb_region(env, address)) {

hit = true;

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

result, fi);

/* If S1 fails or S2 is disabled, return early. */

- if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) {

+ if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2,

+ is_secure)) {

return ret;

}

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

/* Definitely a real MMU, not an MPU */

- if (regime_translation_disabled(env, mmu_idx)) {

+ if (regime_translation_disabled(env, mmu_idx, is_secure)) {

uint64_t hcr;

uint8_t memattr;

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Use arm_hcr_el2_eff_secstate instead of arm_hcr_el2_eff, so

that we use is_secure instead of the current security state.

These AT* operations have been broken since arm_hcr_el2_eff

gained a check for "el2 enabled" for Secure EL2.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20221001162318.153420-18-richard.henderson@linaro.org

target/arm/ptw.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c

--- a/target/arm/ptw.c

+++ b/target/arm/ptw.c

@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,

}

}

- hcr_el2 = arm_hcr_el2_eff(env);

+ hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure);

switch (mmu_idx) {

case ARMMMUIdx_Stage2:

@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,

return ~0;

}

- hcr = arm_hcr_el2_eff(env);

+ hcr = arm_hcr_el2_eff_secstate(env, is_secure);

if ((hcr & HCR_PTW) && ptw_attrs_are_device(hcr, s2.cacheattrs)) {

/*

* PTW set and S1 walk touched S2 Device memory:

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,

}

/* Combine the S1 and S2 cache attributes. */

- hcr = arm_hcr_el2_eff(env);

+ hcr = arm_hcr_el2_eff_secstate(env, is_secure);

if (hcr & HCR_DC) {

/*

* HCR.DC forces the first stage attributes to

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,

result->page_size = TARGET_PAGE_SIZE;

/* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */

- hcr = arm_hcr_el2_eff(env);

+ hcr = arm_hcr_el2_eff_secstate(env, is_secure);

result->cacheattrs.shareability = 0;

result->cacheattrs.is_s2_format = false;

if (hcr & HCR_DC) {

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

For page walking, we may require HCR for a security state

that is not "current".

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20221001162318.153420-14-richard.henderson@linaro.org

target/arm/cpu.h | 20 +++++++++++++-------

target/arm/helper.c | 11 ++++++++---

2 files changed, 21 insertions(+), 10 deletions(-)

@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)

* Return true if the current security state has AArch64 EL2 or AArch32 Hyp.

* This corresponds to the pseudocode EL2Enabled()

*/

+static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)

+{

+ return arm_feature(env, ARM_FEATURE_EL2)

+ && (!secure || (env->cp15.scr_el3 & SCR_EEL2));

+}

+

static inline bool arm_is_el2_enabled(CPUARMState *env)

{

- if (arm_feature(env, ARM_FEATURE_EL2)) {

- if (arm_is_secure_below_el3(env)) {

- return (env->cp15.scr_el3 & SCR_EEL2) != 0;

- }

- return true;

- }

- return false;

+ return arm_is_el2_enabled_secstate(env, arm_is_secure_below_el3(env));

}

#else

@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)

return false;

}

+static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)

+{

+ return false;

+}

+

static inline bool arm_is_el2_enabled(CPUARMState *env)

{

return false;

@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el2_enabled(CPUARMState *env)

* "for all purposes other than a direct read or write access of HCR_EL2."

* Not included here is HCR_RW.

*/

+uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure);

uint64_t arm_hcr_el2_eff(CPUARMState *env);

uint64_t arm_hcrx_el2_eff(CPUARMState *env);

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,

}

/*

- * Return the effective value of HCR_EL2.

+ * Return the effective value of HCR_EL2, at the given security state.

* Bits that are not included here:

* RW (read from SCR_EL3.RW as needed)

*/

-uint64_t arm_hcr_el2_eff(CPUARMState *env)

+uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)

{

uint64_t ret = env->cp15.hcr_el2;

- if (!arm_is_el2_enabled(env)) {

+ if (!arm_is_el2_enabled_secstate(env, secure)) {

/*

* "This register has no effect if EL2 is not enabled in the

* current Security state". This is ARMv8.4-SecEL2 speak for

@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)

return ret;

}

+uint64_t arm_hcr_el2_eff(CPUARMState *env)

+{

+ return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));

+}

+

/*

* Corresponds to ARM pseudocode function ELIsInHost().

*/

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

For a-profile aarch64, which does not bank system registers, it takes

quite a lot of code to switch between security states. In the process,

registers such as TCR_EL{1,2} must be swapped, which in itself requires

the flushing of softmmu tlbs. Therefore it doesn't buy us anything to

separate tlbs by security state.

Retain the distinction between Stage2 and Stage2_S.

This will be important as we implement FEAT_RME, and do not wish to

add a third set of mmu indexes for Realm state.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20221001162318.153420-11-richard.henderson@linaro.org

target/arm/cpu-param.h | 2 +-

target/arm/cpu.h | 72 +++++++------------

target/arm/internals.h | 31 +-------

target/arm/helper.c | 144 +++++++++++++------------------------

target/arm/ptw.c | 25 ++-----

target/arm/translate-a64.c | 8 ---

target/arm/translate.c | 6 +-

7 files changed, 85 insertions(+), 203 deletions(-)

@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);

* table over and over.

* 6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access

* Never (PAN) bit within PSTATE.

+ * 7. we fold together the secure and non-secure regimes for A-profile,

+ * because there are no banked system registers for aarch64, so the

+ * process of switching between secure and non-secure is

+ * already heavyweight.

*

* This gives us the following list of cases:

*

- * NS EL0 EL1&0 stage 1+2 (aka NS PL0)

- * NS EL1 EL1&0 stage 1+2 (aka NS PL1)

- * NS EL1 EL1&0 stage 1+2 +PAN

- * NS EL0 EL2&0

- * NS EL2 EL2&0

- * NS EL2 EL2&0 +PAN

- * NS EL2 (aka NS PL2)

- * S EL0 EL1&0 (aka S PL0)

- * S EL1 EL1&0 (not used if EL3 is 32 bit)

- * S EL1 EL1&0 +PAN

- * S EL3 (aka S PL1)

+ * EL0 EL1&0 stage 1+2 (aka NS PL0)

+ * EL1 EL1&0 stage 1+2 (aka NS PL1)

+ * EL1 EL1&0 stage 1+2 +PAN

+ * EL0 EL2&0

+ * EL2 EL2&0

+ * EL2 EL2&0 +PAN

+ * EL2 (aka NS PL2)

+ * EL3 (aka S PL1)

*

- * for a total of 11 different mmu_idx.

+ * for a total of 8 different mmu_idx.

*

* R profile CPUs have an MPU, but can use the same set of MMU indexes

- * as A profile. They only need to distinguish NS EL0 and NS EL1 (and

- * NS EL2 if we ever model a Cortex-R52).

+ * as A profile. They only need to distinguish EL0 and EL1 (and

+ * EL2 if we ever model a Cortex-R52).

*

* M profile CPUs are rather different as they do not have a true MMU.

* They have the following different MMU indexes:

@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);

#define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */

#define ARM_MMU_IDX_M 0x40 /* M profile */

-/* Meanings of the bits for A profile mmu idx values */

-#define ARM_MMU_IDX_A_NS 0x8

-

/* Meanings of the bits for M profile mmu idx values */

#define ARM_MMU_IDX_M_PRIV 0x1

#define ARM_MMU_IDX_M_NEGPRI 0x2

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {

/*

* A-profile.

*/

- ARMMMUIdx_SE10_0 = 0 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE20_0 = 1 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE10_1 = 2 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE20_2 = 3 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE10_1_PAN = 4 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE20_2_PAN = 5 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE2 = 6 | ARM_MMU_IDX_A,

- ARMMMUIdx_SE3 = 7 | ARM_MMU_IDX_A,

-

- ARMMMUIdx_E10_0 = ARMMMUIdx_SE10_0 | ARM_MMU_IDX_A_NS,

- ARMMMUIdx_E20_0 = ARMMMUIdx_SE20_0 | ARM_MMU_IDX_A_NS,

- ARMMMUIdx_E10_1 = ARMMMUIdx_SE10_1 | ARM_MMU_IDX_A_NS,

- ARMMMUIdx_E20_2 = ARMMMUIdx_SE20_2 | ARM_MMU_IDX_A_NS,

- ARMMMUIdx_E10_1_PAN = ARMMMUIdx_SE10_1_PAN | ARM_MMU_IDX_A_NS,

- ARMMMUIdx_E20_2_PAN = ARMMMUIdx_SE20_2_PAN | ARM_MMU_IDX_A_NS,

- ARMMMUIdx_E2 = ARMMMUIdx_SE2 | ARM_MMU_IDX_A_NS,

+ ARMMMUIdx_E10_0 = 0 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E20_0 = 1 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E10_1 = 2 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E20_2 = 3 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E10_1_PAN = 4 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E20_2_PAN = 5 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E2 = 6 | ARM_MMU_IDX_A,

+ ARMMMUIdx_E3 = 7 | ARM_MMU_IDX_A,

/*

* These are not allocated TLBs and are used only for AT system

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {

ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,

ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,

ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,

- ARMMMUIdx_Stage1_SE0 = 3 | ARM_MMU_IDX_NOTLB,

- ARMMMUIdx_Stage1_SE1 = 4 | ARM_MMU_IDX_NOTLB,

- ARMMMUIdx_Stage1_SE1_PAN = 5 | ARM_MMU_IDX_NOTLB,

/*

* Not allocated a TLB: used only for second stage of an S12 page

* table walk, or for descriptor loads during first stage of an S1

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {

* then various TLB flush insns which currently are no-ops or flush

* only stage 1 MMU indexes will need to change to flush stage 2.

*/

- ARMMMUIdx_Stage2 = 6 | ARM_MMU_IDX_NOTLB,

- ARMMMUIdx_Stage2_S = 7 | ARM_MMU_IDX_NOTLB,

+ ARMMMUIdx_Stage2 = 3 | ARM_MMU_IDX_NOTLB,

+ ARMMMUIdx_Stage2_S = 4 | ARM_MMU_IDX_NOTLB,

/*

* M-profile.

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {

TO_CORE_BIT(E2),

TO_CORE_BIT(E20_2),

TO_CORE_BIT(E20_2_PAN),

- TO_CORE_BIT(SE10_0),

- TO_CORE_BIT(SE20_0),

- TO_CORE_BIT(SE10_1),

- TO_CORE_BIT(SE20_2),

- TO_CORE_BIT(SE10_1_PAN),

- TO_CORE_BIT(SE20_2_PAN),

- TO_CORE_BIT(SE2),

- TO_CORE_BIT(SE3),

+ TO_CORE_BIT(E3),

TO_CORE_BIT(MUser),

TO_CORE_BIT(MPriv),

diff --git a/target/arm/internals.h b/target/arm/internals.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)

case ARMMMUIdx_Stage1_E0:

case ARMMMUIdx_Stage1_E1:

case ARMMMUIdx_Stage1_E1_PAN:

- case ARMMMUIdx_Stage1_SE0:

- case ARMMMUIdx_Stage1_SE1:

- case ARMMMUIdx_Stage1_SE1_PAN:

case ARMMMUIdx_E10_0:

case ARMMMUIdx_E10_1:

case ARMMMUIdx_E10_1_PAN:

case ARMMMUIdx_E20_0:

case ARMMMUIdx_E20_2:

case ARMMMUIdx_E20_2_PAN:

- case ARMMMUIdx_SE10_0:

- case ARMMMUIdx_SE10_1:

- case ARMMMUIdx_SE10_1_PAN:

- case ARMMMUIdx_SE20_0:

- case ARMMMUIdx_SE20_2:

- case ARMMMUIdx_SE20_2_PAN:

return true;

default:

return false;

@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)

{

switch (mmu_idx) {

case ARMMMUIdx_Stage1_E1_PAN:

- case ARMMMUIdx_Stage1_SE1_PAN:

case ARMMMUIdx_E10_1_PAN:

case ARMMMUIdx_E20_2_PAN:

- case ARMMMUIdx_SE10_1_PAN:

- case ARMMMUIdx_SE20_2_PAN:

return true;

default:

return false;

@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)

static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)

{

switch (mmu_idx) {

- case ARMMMUIdx_SE20_0:

- case ARMMMUIdx_SE20_2:

- case ARMMMUIdx_SE20_2_PAN:

case ARMMMUIdx_E20_0:

case ARMMMUIdx_E20_2:

case ARMMMUIdx_E20_2_PAN:

case ARMMMUIdx_Stage2:

case ARMMMUIdx_Stage2_S:

- case ARMMMUIdx_SE2:

case ARMMMUIdx_E2:

return 2;

- case ARMMMUIdx_SE3:

+ case ARMMMUIdx_E3:

return 3;

- case ARMMMUIdx_SE10_0:

- case ARMMMUIdx_Stage1_SE0:

- return arm_el_is_aa64(env, 3) ? 1 : 3;

- case ARMMMUIdx_SE10_1:

- case ARMMMUIdx_SE10_1_PAN:

+ case ARMMMUIdx_E10_0:

case ARMMMUIdx_Stage1_E0:

+ return arm_el_is_aa64(env, 3) || !arm_is_secure_below_el3(env) ? 1 : 3;

case ARMMMUIdx_Stage1_E1:

case ARMMMUIdx_Stage1_E1_PAN:

- case ARMMMUIdx_Stage1_SE1:

- case ARMMMUIdx_Stage1_SE1_PAN:

- case ARMMMUIdx_E10_0:

case ARMMMUIdx_E10_1:

case ARMMMUIdx_E10_1_PAN:

case ARMMMUIdx_MPrivNegPri:

@@ -XXX,XX +XXX,XX @@ static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)

case ARMMMUIdx_Stage1_E0:

case ARMMMUIdx_Stage1_E1:

case ARMMMUIdx_Stage1_E1_PAN:

- case ARMMMUIdx_Stage1_SE0:

- case ARMMMUIdx_Stage1_SE1:

- case ARMMMUIdx_Stage1_SE1_PAN:

return true;

default:

return false;

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

/* Begin with base v8.0 state. */

uint64_t valid_mask = 0x3fff;

ARMCPU *cpu = env_archcpu(env);

+ uint64_t changed;

/*

* Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always

@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

/* Clear all-context RES0 bits. */

value &= valid_mask;

- raw_write(env, ri, value);

+ changed = env->cp15.scr_el3 ^ value;

+ env->cp15.scr_el3 = value;

+ /*

+ * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then

+ * we must invalidate all TLBs below EL3.

+ */

+ if (changed & SCR_NS) {

+ tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |

+ ARMMMUIdxBit_E20_0 |

+ ARMMMUIdxBit_E10_1 |

+ ARMMMUIdxBit_E20_2 |

+ ARMMMUIdxBit_E10_1_PAN |

+ ARMMMUIdxBit_E20_2_PAN |

+ ARMMMUIdxBit_E2));

+ }

}

static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri)

@@ -XXX,XX +XXX,XX @@ static int gt_phys_redir_timeridx(CPUARMState *env)

case ARMMMUIdx_E20_0:

case ARMMMUIdx_E20_2:

case ARMMMUIdx_E20_2_PAN:

- case ARMMMUIdx_SE20_0:

- case ARMMMUIdx_SE20_2:

- case ARMMMUIdx_SE20_2_PAN:

return GTIMER_HYP;

default:

return GTIMER_PHYS;

@@ -XXX,XX +XXX,XX @@ static int gt_virt_redir_timeridx(CPUARMState *env)

case ARMMMUIdx_E20_0:

case ARMMMUIdx_E20_2:

case ARMMMUIdx_E20_2_PAN:

- case ARMMMUIdx_SE20_0:

- case ARMMMUIdx_SE20_2:

- case ARMMMUIdx_SE20_2_PAN:

return GTIMER_HYPVIRT;

default:

return GTIMER_VIRT;

@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

/* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */

switch (el) {

case 3:

- mmu_idx = ARMMMUIdx_SE3;

+ mmu_idx = ARMMMUIdx_E3;

secure = true;

break;

case 2:

@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

/* fall through */

case 1:

if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {

- mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN

- : ARMMMUIdx_Stage1_E1_PAN);

+ mmu_idx = ARMMMUIdx_Stage1_E1_PAN;

} else {

- mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;

+ mmu_idx = ARMMMUIdx_Stage1_E1;

}

break;

default:

@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

/* stage 1 current state PL0: ATS1CUR, ATS1CUW */

switch (el) {

case 3:

- mmu_idx = ARMMMUIdx_SE10_0;

+ mmu_idx = ARMMMUIdx_E10_0;

secure = true;

break;

case 2:

@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

mmu_idx = ARMMMUIdx_Stage1_E0;

break;

case 1:

- mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;

+ mmu_idx = ARMMMUIdx_Stage1_E0;

break;

default:

g_assert_not_reached();

@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,

switch (ri->opc1) {

case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */

if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {

- mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN

- : ARMMMUIdx_Stage1_E1_PAN);

+ mmu_idx = ARMMMUIdx_Stage1_E1_PAN;

} else {

- mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;

+ mmu_idx = ARMMMUIdx_Stage1_E1;

}

break;

case 4: /* AT S1E2R, AT S1E2W */

- mmu_idx = secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2;

+ mmu_idx = ARMMMUIdx_E2;

break;

case 6: /* AT S1E3R, AT S1E3W */

- mmu_idx = ARMMMUIdx_SE3;

+ mmu_idx = ARMMMUIdx_E3;

secure = true;

break;

default:

@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,

}

break;

case 2: /* AT S1E0R, AT S1E0W */

- mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;

+ mmu_idx = ARMMMUIdx_Stage1_E0;

break;

case 4: /* AT S12E1R, AT S12E1W */

- mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1;

+ mmu_idx = ARMMMUIdx_E10_1;

break;

case 6: /* AT S12E0R, AT S12E0W */

- mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0;

+ mmu_idx = ARMMMUIdx_E10_0;

break;

default:

g_assert_not_reached();

@@ -XXX,XX +XXX,XX @@ static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,

uint16_t mask = ARMMMUIdxBit_E20_2 |

ARMMMUIdxBit_E20_2_PAN |

ARMMMUIdxBit_E20_0;

-

- if (arm_is_secure_below_el3(env)) {

- mask >>= ARM_MMU_IDX_A_NS;

- }

-

tlb_flush_by_mmuidx(env_cpu(env), mask);

}

raw_write(env, ri, value);

@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,

uint16_t mask = ARMMMUIdxBit_E10_1 |

ARMMMUIdxBit_E10_1_PAN |

ARMMMUIdxBit_E10_0;

-

- if (arm_is_secure_below_el3(env)) {

- mask >>= ARM_MMU_IDX_A_NS;

- }

-

tlb_flush_by_mmuidx(cs, mask);

raw_write(env, ri, value);

}

@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)

ARMMMUIdxBit_E10_1_PAN |

ARMMMUIdxBit_E10_0;

}

-

- if (arm_is_secure_below_el3(env)) {

- mask >>= ARM_MMU_IDX_A_NS;

- }

-

return mask;

}

@@ -XXX,XX +XXX,XX @@ static int vae1_tlbbits(CPUARMState *env, uint64_t addr)

mmu_idx = ARMMMUIdx_E10_0;

}

- if (arm_is_secure_below_el3(env)) {

- mmu_idx &= ~ARM_MMU_IDX_A_NS;

- }

-

return tlbbits_for_regime(env, mmu_idx, addr);

}

@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)

* stage 2 translations, whereas most other scopes only invalidate

* stage 1 translations.

*/

- if (arm_is_secure_below_el3(env)) {

- return ARMMMUIdxBit_SE10_1 |

- ARMMMUIdxBit_SE10_1_PAN |

- ARMMMUIdxBit_SE10_0;

- } else {

- return ARMMMUIdxBit_E10_1 |

- ARMMMUIdxBit_E10_1_PAN |

- ARMMMUIdxBit_E10_0;

- }

+ return (ARMMMUIdxBit_E10_1 |

+ ARMMMUIdxBit_E10_1_PAN |

+ ARMMMUIdxBit_E10_0);

}

static int e2_tlbmask(CPUARMState *env)

{

- if (arm_is_secure_below_el3(env)) {

- return ARMMMUIdxBit_SE20_0 |

- ARMMMUIdxBit_SE20_2 |

- ARMMMUIdxBit_SE20_2_PAN |

- ARMMMUIdxBit_SE2;

- } else {

- return ARMMMUIdxBit_E20_0 |

- ARMMMUIdxBit_E20_2 |

- ARMMMUIdxBit_E20_2_PAN |

- ARMMMUIdxBit_E2;

- }

+ return (ARMMMUIdxBit_E20_0 |

+ ARMMMUIdxBit_E20_2 |

+ ARMMMUIdxBit_E20_2_PAN |

+ ARMMMUIdxBit_E2);

}

static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,

ARMCPU *cpu = env_archcpu(env);

CPUState *cs = CPU(cpu);

- tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_SE3);

+ tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3);

}