|
|
@@ -21,28 +21,35 @@
|
|
|
typedef struct S1Translate {
|
|
|
ARMMMUIdx in_mmu_idx;
|
|
|
ARMMMUIdx in_ptw_idx;
|
|
|
+ ARMSecuritySpace in_space;
|
|
|
bool in_secure;
|
|
|
bool in_debug;
|
|
|
+ /*
|
|
|
+ * If this is stage 2 of a stage 1+2 page table walk, then this must
|
|
|
+ * be true if stage 1 is an EL0 access; otherwise this is ignored.
|
|
|
+ * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
|
|
|
+ */
|
|
|
+ bool in_s1_is_el0;
|
|
|
bool out_secure;
|
|
|
bool out_rw;
|
|
|
bool out_be;
|
|
|
+ ARMSecuritySpace out_space;
|
|
|
hwaddr out_virt;
|
|
|
hwaddr out_phys;
|
|
|
void *out_host;
|
|
|
} S1Translate;
|
|
|
|
|
|
-static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
- uint64_t address,
|
|
|
- MMUAccessType access_type, bool s1_is_el0,
|
|
|
- GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
|
|
|
- __attribute__((nonnull));
|
|
|
+static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
|
|
|
+ target_ulong address,
|
|
|
+ MMUAccessType access_type,
|
|
|
+ GetPhysAddrResult *result,
|
|
|
+ ARMMMUFaultInfo *fi);
|
|
|
|
|
|
-static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
|
|
|
- target_ulong address,
|
|
|
- MMUAccessType access_type,
|
|
|
- GetPhysAddrResult *result,
|
|
|
- ARMMMUFaultInfo *fi)
|
|
|
- __attribute__((nonnull));
|
|
|
+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
|
|
|
+ target_ulong address,
|
|
|
+ MMUAccessType access_type,
|
|
|
+ GetPhysAddrResult *result,
|
|
|
+ ARMMMUFaultInfo *fi);
|
|
|
|
|
|
/* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
|
|
|
static const uint8_t pamax_map[] = {
|
|
|
@@ -215,8 +222,10 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
|
|
|
case ARMMMUIdx_E3:
|
|
|
break;
|
|
|
|
|
|
- case ARMMMUIdx_Phys_NS:
|
|
|
case ARMMMUIdx_Phys_S:
|
|
|
+ case ARMMMUIdx_Phys_NS:
|
|
|
+ case ARMMMUIdx_Phys_Root:
|
|
|
+ case ARMMMUIdx_Phys_Realm:
|
|
|
/* No translation for physical address spaces. */
|
|
|
return true;
|
|
|
|
|
|
@@ -227,6 +236,197 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
|
|
|
return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
|
|
|
}
|
|
|
|
|
|
+static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
|
|
|
+ ARMSecuritySpace pspace,
|
|
|
+ ARMMMUFaultInfo *fi)
|
|
|
+{
|
|
|
+ MemTxAttrs attrs = {
|
|
|
+ .secure = true,
|
|
|
+ .space = ARMSS_Root,
|
|
|
+ };
|
|
|
+ ARMCPU *cpu = env_archcpu(env);
|
|
|
+ uint64_t gpccr = env->cp15.gpccr_el3;
|
|
|
+ unsigned pps, pgs, l0gptsz, level = 0;
|
|
|
+ uint64_t tableaddr, pps_mask, align, entry, index;
|
|
|
+ AddressSpace *as;
|
|
|
+ MemTxResult result;
|
|
|
+ int gpi;
|
|
|
+
|
|
|
+ if (!FIELD_EX64(gpccr, GPCCR, GPC)) {
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+
|
|
|
+ /*
|
|
|
+ * GPC Priority 1 (R_GMGRR):
|
|
|
+ * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
|
|
|
+ * the access fails as GPT walk fault at level 0.
|
|
|
+ */
|
|
|
+
|
|
|
+ /*
|
|
|
+ * Configuration of PPS to a value exceeding the implemented
|
|
|
+ * physical address size is invalid.
|
|
|
+ */
|
|
|
+ pps = FIELD_EX64(gpccr, GPCCR, PPS);
|
|
|
+ if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
|
|
|
+ goto fault_walk;
|
|
|
+ }
|
|
|
+ pps = pamax_map[pps];
|
|
|
+ pps_mask = MAKE_64BIT_MASK(0, pps);
|
|
|
+
|
|
|
+ switch (FIELD_EX64(gpccr, GPCCR, SH)) {
|
|
|
+ case 0b10: /* outer shareable */
|
|
|
+ break;
|
|
|
+ case 0b00: /* non-shareable */
|
|
|
+ case 0b11: /* inner shareable */
|
|
|
+ /* Inner and Outer non-cacheable requires Outer shareable. */
|
|
|
+ if (FIELD_EX64(gpccr, GPCCR, ORGN) == 0 &&
|
|
|
+ FIELD_EX64(gpccr, GPCCR, IRGN) == 0) {
|
|
|
+ goto fault_walk;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ default: /* reserved */
|
|
|
+ goto fault_walk;
|
|
|
+ }
|
|
|
+
|
|
|
+ switch (FIELD_EX64(gpccr, GPCCR, PGS)) {
|
|
|
+ case 0b00: /* 4KB */
|
|
|
+ pgs = 12;
|
|
|
+ break;
|
|
|
+ case 0b01: /* 64KB */
|
|
|
+ pgs = 16;
|
|
|
+ break;
|
|
|
+ case 0b10: /* 16KB */
|
|
|
+ pgs = 14;
|
|
|
+ break;
|
|
|
+ default: /* reserved */
|
|
|
+ goto fault_walk;
|
|
|
+ }
|
|
|
+
|
|
|
+ /* Note this field is read-only and fixed at reset. */
|
|
|
+ l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
|
|
|
+
|
|
|
+ /*
|
|
|
+ * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
|
|
|
+ * R_CPDSB: A NonSecure physical address input exceeding PPS
|
|
|
+ * does not experience any fault.
|
|
|
+ */
|
|
|
+ if (paddress & ~pps_mask) {
|
|
|
+ if (pspace == ARMSS_NonSecure) {
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ goto fault_size;
|
|
|
+ }
|
|
|
+
|
|
|
+ /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
|
|
|
+ tableaddr = env->cp15.gptbr_el3 << 12;
|
|
|
+ if (tableaddr & ~pps_mask) {
|
|
|
+ goto fault_size;
|
|
|
+ }
|
|
|
+
|
|
|
+ /*
|
|
|
+ * BADDR is aligned per a function of PPS and L0GPTSZ.
|
|
|
+ * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
|
|
|
+ * unlike the RES0 bits of the GPT entries (R_XNKFZ).
|
|
|
+ */
|
|
|
+ align = MAX(pps - l0gptsz + 3, 12);
|
|
|
+ align = MAKE_64BIT_MASK(0, align);
|
|
|
+ tableaddr &= ~align;
|
|
|
+
|
|
|
+ as = arm_addressspace(env_cpu(env), attrs);
|
|
|
+
|
|
|
+ /* Level 0 lookup. */
|
|
|
+ index = extract64(paddress, l0gptsz, pps - l0gptsz);
|
|
|
+ tableaddr += index * 8;
|
|
|
+ entry = address_space_ldq_le(as, tableaddr, attrs, &result);
|
|
|
+ if (result != MEMTX_OK) {
|
|
|
+ goto fault_eabt;
|
|
|
+ }
|
|
|
+
|
|
|
+ switch (extract32(entry, 0, 4)) {
|
|
|
+ case 1: /* block descriptor */
|
|
|
+ if (entry >> 8) {
|
|
|
+ goto fault_walk; /* RES0 bits not 0 */
|
|
|
+ }
|
|
|
+ gpi = extract32(entry, 4, 4);
|
|
|
+ goto found;
|
|
|
+ case 3: /* table descriptor */
|
|
|
+ tableaddr = entry & ~0xf;
|
|
|
+ align = MAX(l0gptsz - pgs - 1, 12);
|
|
|
+ align = MAKE_64BIT_MASK(0, align);
|
|
|
+ if (tableaddr & (~pps_mask | align)) {
|
|
|
+ goto fault_walk; /* RES0 bits not 0 */
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ default: /* invalid */
|
|
|
+ goto fault_walk;
|
|
|
+ }
|
|
|
+
|
|
|
+ /* Level 1 lookup */
|
|
|
+ level = 1;
|
|
|
+ index = extract64(paddress, pgs + 4, l0gptsz - pgs - 4);
|
|
|
+ tableaddr += index * 8;
|
|
|
+ entry = address_space_ldq_le(as, tableaddr, attrs, &result);
|
|
|
+ if (result != MEMTX_OK) {
|
|
|
+ goto fault_eabt;
|
|
|
+ }
|
|
|
+
|
|
|
+ switch (extract32(entry, 0, 4)) {
|
|
|
+ case 1: /* contiguous descriptor */
|
|
|
+ if (entry >> 10) {
|
|
|
+ goto fault_walk; /* RES0 bits not 0 */
|
|
|
+ }
|
|
|
+ /*
|
|
|
+ * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
|
|
|
+ * and because we cannot invalidate by pa, and thus will always
|
|
|
+ * flush entire tlbs, we don't actually care about the range here
|
|
|
+ * and can simply extract the GPI as the result.
|
|
|
+ */
|
|
|
+ if (extract32(entry, 8, 2) == 0) {
|
|
|
+ goto fault_walk; /* reserved contig */
|
|
|
+ }
|
|
|
+ gpi = extract32(entry, 4, 4);
|
|
|
+ break;
|
|
|
+ default:
|
|
|
+ index = extract64(paddress, pgs, 4);
|
|
|
+ gpi = extract64(entry, index * 4, 4);
|
|
|
+ break;
|
|
|
+ }
|
|
|
+
|
|
|
+ found:
|
|
|
+ switch (gpi) {
|
|
|
+ case 0b0000: /* no access */
|
|
|
+ break;
|
|
|
+ case 0b1111: /* all access */
|
|
|
+ return true;
|
|
|
+ case 0b1000:
|
|
|
+ case 0b1001:
|
|
|
+ case 0b1010:
|
|
|
+ case 0b1011:
|
|
|
+ if (pspace == (gpi & 3)) {
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ default:
|
|
|
+ goto fault_walk; /* reserved */
|
|
|
+ }
|
|
|
+
|
|
|
+ fi->gpcf = GPCF_Fail;
|
|
|
+ goto fault_common;
|
|
|
+ fault_eabt:
|
|
|
+ fi->gpcf = GPCF_EABT;
|
|
|
+ goto fault_common;
|
|
|
+ fault_size:
|
|
|
+ fi->gpcf = GPCF_AddressSize;
|
|
|
+ goto fault_common;
|
|
|
+ fault_walk:
|
|
|
+ fi->gpcf = GPCF_Walk;
|
|
|
+ fault_common:
|
|
|
+ fi->level = level;
|
|
|
+ fi->paddr = paddress;
|
|
|
+ fi->paddr_space = pspace;
|
|
|
+ return false;
|
|
|
+}
|
|
|
+
|
|
|
static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
|
|
|
{
|
|
|
/*
|
|
|
@@ -249,6 +449,7 @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
|
|
|
static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
|
|
|
hwaddr addr, ARMMMUFaultInfo *fi)
|
|
|
{
|
|
|
+ ARMSecuritySpace space = ptw->in_space;
|
|
|
bool is_secure = ptw->in_secure;
|
|
|
ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
|
|
|
ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
|
|
|
@@ -261,30 +462,27 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
|
|
|
* From gdbstub, do not use softmmu so that we don't modify the
|
|
|
* state of the cpu at all, including softmmu tlb contents.
|
|
|
*/
|
|
|
- if (regime_is_stage2(s2_mmu_idx)) {
|
|
|
- S1Translate s2ptw = {
|
|
|
- .in_mmu_idx = s2_mmu_idx,
|
|
|
- .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
|
|
|
- .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
|
|
|
- .in_debug = true,
|
|
|
- };
|
|
|
- GetPhysAddrResult s2 = { };
|
|
|
-
|
|
|
- if (get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
|
|
|
- false, &s2, fi)) {
|
|
|
- goto fail;
|
|
|
- }
|
|
|
- ptw->out_phys = s2.f.phys_addr;
|
|
|
- pte_attrs = s2.cacheattrs.attrs;
|
|
|
- ptw->out_secure = s2.f.attrs.secure;
|
|
|
- } else {
|
|
|
- /* Regime is physical. */
|
|
|
- ptw->out_phys = addr;
|
|
|
- pte_attrs = 0;
|
|
|
- ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
|
|
|
+ S1Translate s2ptw = {
|
|
|
+ .in_mmu_idx = s2_mmu_idx,
|
|
|
+ .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
|
|
|
+ .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
|
|
|
+ .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
|
|
|
+ : space == ARMSS_Realm ? ARMSS_Realm
|
|
|
+ : ARMSS_NonSecure),
|
|
|
+ .in_debug = true,
|
|
|
+ };
|
|
|
+ GetPhysAddrResult s2 = { };
|
|
|
+
|
|
|
+ if (get_phys_addr_gpc(env, &s2ptw, addr, MMU_DATA_LOAD, &s2, fi)) {
|
|
|
+ goto fail;
|
|
|
}
|
|
|
+
|
|
|
+ ptw->out_phys = s2.f.phys_addr;
|
|
|
+ pte_attrs = s2.cacheattrs.attrs;
|
|
|
ptw->out_host = NULL;
|
|
|
ptw->out_rw = false;
|
|
|
+ ptw->out_secure = s2.f.attrs.secure;
|
|
|
+ ptw->out_space = s2.f.attrs.space;
|
|
|
} else {
|
|
|
#ifdef CONFIG_TCG
|
|
|
CPUTLBEntryFull *full;
|
|
|
@@ -303,6 +501,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
|
|
|
ptw->out_rw = full->prot & PAGE_WRITE;
|
|
|
pte_attrs = full->pte_attrs;
|
|
|
ptw->out_secure = full->attrs.secure;
|
|
|
+ ptw->out_space = full->attrs.space;
|
|
|
#else
|
|
|
g_assert_not_reached();
|
|
|
#endif
|
|
|
@@ -330,6 +529,9 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
|
|
|
|
|
|
fail:
|
|
|
assert(fi->type != ARMFault_None);
|
|
|
+ if (fi->type == ARMFault_GPCFOnOutput) {
|
|
|
+ fi->type = ARMFault_GPCFOnWalk;
|
|
|
+ }
|
|
|
fi->s2addr = addr;
|
|
|
fi->stage2 = true;
|
|
|
fi->s1ptw = true;
|
|
|
@@ -355,7 +557,10 @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
|
|
|
}
|
|
|
} else {
|
|
|
/* Page tables are in MMIO. */
|
|
|
- MemTxAttrs attrs = { .secure = ptw->out_secure };
|
|
|
+ MemTxAttrs attrs = {
|
|
|
+ .secure = ptw->out_secure,
|
|
|
+ .space = ptw->out_space,
|
|
|
+ };
|
|
|
AddressSpace *as = arm_addressspace(cs, attrs);
|
|
|
MemTxResult result = MEMTX_OK;
|
|
|
|
|
|
@@ -398,7 +603,10 @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
|
|
|
#endif
|
|
|
} else {
|
|
|
/* Page tables are in MMIO. */
|
|
|
- MemTxAttrs attrs = { .secure = ptw->out_secure };
|
|
|
+ MemTxAttrs attrs = {
|
|
|
+ .secure = ptw->out_secure,
|
|
|
+ .space = ptw->out_space,
|
|
|
+ };
|
|
|
AddressSpace *as = arm_addressspace(cs, attrs);
|
|
|
MemTxResult result = MEMTX_OK;
|
|
|
|
|
|
@@ -909,6 +1117,7 @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
|
|
|
* regime, because the attribute will already be non-secure.
|
|
|
*/
|
|
|
result->f.attrs.secure = false;
|
|
|
+ result->f.attrs.space = ARMSS_NonSecure;
|
|
|
}
|
|
|
result->f.phys_addr = phys_addr;
|
|
|
return false;
|
|
|
@@ -925,7 +1134,7 @@ do_fault:
|
|
|
* @xn: XN (execute-never) bits
|
|
|
* @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
|
|
|
*/
|
|
|
-static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
|
|
|
+static int get_S2prot_noexecute(int s2ap)
|
|
|
{
|
|
|
int prot = 0;
|
|
|
|
|
|
@@ -935,6 +1144,12 @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
|
|
|
if (s2ap & 2) {
|
|
|
prot |= PAGE_WRITE;
|
|
|
}
|
|
|
+ return prot;
|
|
|
+}
|
|
|
+
|
|
|
+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
|
|
|
+{
|
|
|
+ int prot = get_S2prot_noexecute(s2ap);
|
|
|
|
|
|
if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
|
|
|
switch (xn) {
|
|
|
@@ -972,12 +1187,14 @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
|
|
|
* @mmu_idx: MMU index indicating required translation regime
|
|
|
* @is_aa64: TRUE if AArch64
|
|
|
* @ap: The 2-bit simple AP (AP[2:1])
|
|
|
- * @ns: NS (non-secure) bit
|
|
|
* @xn: XN (execute-never) bit
|
|
|
* @pxn: PXN (privileged execute-never) bit
|
|
|
+ * @in_pa: The original input pa space
|
|
|
+ * @out_pa: The output pa space, modified by NSTable, NS, and NSE
|
|
|
*/
|
|
|
static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
|
|
|
- int ap, int ns, int xn, int pxn)
|
|
|
+ int ap, int xn, int pxn,
|
|
|
+ ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
|
|
|
{
|
|
|
ARMCPU *cpu = env_archcpu(env);
|
|
|
bool is_user = regime_is_user(env, mmu_idx);
|
|
|
@@ -1010,8 +1227,39 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
|
|
|
- return prot_rw;
|
|
|
+ if (in_pa != out_pa) {
|
|
|
+ switch (in_pa) {
|
|
|
+ case ARMSS_Root:
|
|
|
+ /*
|
|
|
+ * R_ZWRVD: permission fault for insn fetched from non-Root,
|
|
|
+ * I_WWBFB: SIF has no effect in EL3.
|
|
|
+ */
|
|
|
+ return prot_rw;
|
|
|
+ case ARMSS_Realm:
|
|
|
+ /*
|
|
|
+ * R_PKTDS: permission fault for insn fetched from non-Realm,
|
|
|
+ * for Realm EL2 or EL2&0. The corresponding fault for EL1&0
|
|
|
+ * happens during any stage2 translation.
|
|
|
+ */
|
|
|
+ switch (mmu_idx) {
|
|
|
+ case ARMMMUIdx_E2:
|
|
|
+ case ARMMMUIdx_E20_0:
|
|
|
+ case ARMMMUIdx_E20_2:
|
|
|
+ case ARMMMUIdx_E20_2_PAN:
|
|
|
+ return prot_rw;
|
|
|
+ default:
|
|
|
+ break;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case ARMSS_Secure:
|
|
|
+ if (env->cp15.scr_el3 & SCR_SIF) {
|
|
|
+ return prot_rw;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ default:
|
|
|
+ /* Input NonSecure must have output NonSecure. */
|
|
|
+ g_assert_not_reached();
|
|
|
+ }
|
|
|
}
|
|
|
|
|
|
/* TODO have_wxn should be replaced with
|
|
|
@@ -1242,22 +1490,16 @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
|
|
|
* @ptw: Current and next stage parameters for the walk.
|
|
|
* @address: virtual address to get physical address for
|
|
|
* @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
|
|
|
- * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
|
|
|
- * (so this is a stage 2 page table walk),
|
|
|
- * must be true if this is stage 2 of a stage 1+2
|
|
|
- * walk for an EL0 access. If @mmu_idx is anything else,
|
|
|
- * @s1_is_el0 is ignored.
|
|
|
* @result: set on translation success,
|
|
|
* @fi: set to fault info if the translation fails
|
|
|
*/
|
|
|
static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
uint64_t address,
|
|
|
- MMUAccessType access_type, bool s1_is_el0,
|
|
|
+ MMUAccessType access_type,
|
|
|
GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
|
|
|
{
|
|
|
ARMCPU *cpu = env_archcpu(env);
|
|
|
ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
|
|
|
- bool is_secure = ptw->in_secure;
|
|
|
int32_t level;
|
|
|
ARMVAParameters param;
|
|
|
uint64_t ttbr;
|
|
|
@@ -1268,12 +1510,12 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
int32_t stride;
|
|
|
int addrsize, inputsize, outputsize;
|
|
|
uint64_t tcr = regime_tcr(env, mmu_idx);
|
|
|
- int ap, ns, xn, pxn;
|
|
|
+ int ap, xn, pxn;
|
|
|
uint32_t el = regime_el(env, mmu_idx);
|
|
|
uint64_t descaddrmask;
|
|
|
bool aarch64 = arm_el_is_aa64(env, el);
|
|
|
uint64_t descriptor, new_descriptor;
|
|
|
- bool nstable;
|
|
|
+ ARMSecuritySpace out_space;
|
|
|
|
|
|
/* TODO: This code does not support shareability levels. */
|
|
|
if (aarch64) {
|
|
|
@@ -1435,32 +1677,32 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
descaddrmask = MAKE_64BIT_MASK(0, 40);
|
|
|
}
|
|
|
descaddrmask &= ~indexmask_grainsize;
|
|
|
-
|
|
|
- /*
|
|
|
- * Secure stage 1 accesses start with the page table in secure memory and
|
|
|
- * can be downgraded to non-secure at any step. Non-secure accesses
|
|
|
- * remain non-secure. We implement this by just ORing in the NSTable/NS
|
|
|
- * bits at each step.
|
|
|
- * Stage 2 never gets this kind of downgrade.
|
|
|
- */
|
|
|
- tableattrs = is_secure ? 0 : (1 << 4);
|
|
|
+ tableattrs = 0;
|
|
|
|
|
|
next_level:
|
|
|
descaddr |= (address >> (stride * (4 - level))) & indexmask;
|
|
|
descaddr &= ~7ULL;
|
|
|
- nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
|
|
|
- if (nstable) {
|
|
|
+
|
|
|
+ /*
|
|
|
+ * Process the NSTable bit from the previous level. This changes
|
|
|
+ * the table address space and the output space from Secure to
|
|
|
+ * NonSecure. With RME, the EL3 translation regime does not change
|
|
|
+ * from Root to NonSecure.
|
|
|
+ */
|
|
|
+ if (ptw->in_space == ARMSS_Secure
|
|
|
+ && !regime_is_stage2(mmu_idx)
|
|
|
+ && extract32(tableattrs, 4, 1)) {
|
|
|
/*
|
|
|
* Stage2_S -> Stage2 or Phys_S -> Phys_NS
|
|
|
- * Assert that the non-secure idx are even, and relative order.
|
|
|
+ * Assert the relative order of the secure/non-secure indexes.
|
|
|
*/
|
|
|
- QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
|
|
|
- QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
|
|
|
- QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
|
|
|
- QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
|
|
|
- ptw->in_ptw_idx &= ~1;
|
|
|
+ QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
|
|
|
+ QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
|
|
|
+ ptw->in_ptw_idx += 1;
|
|
|
ptw->in_secure = false;
|
|
|
+ ptw->in_space = ARMSS_NonSecure;
|
|
|
}
|
|
|
+
|
|
|
if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
|
|
|
goto do_fault;
|
|
|
}
|
|
|
@@ -1563,7 +1805,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
*/
|
|
|
attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
|
|
|
if (!regime_is_stage2(mmu_idx)) {
|
|
|
- attrs |= nstable << 5; /* NS */
|
|
|
+ attrs |= !ptw->in_secure << 5; /* NS */
|
|
|
if (!param.hpd) {
|
|
|
attrs |= extract64(tableattrs, 0, 2) << 53; /* XN, PXN */
|
|
|
/*
|
|
|
@@ -1576,15 +1818,79 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
}
|
|
|
|
|
|
ap = extract32(attrs, 6, 2);
|
|
|
+ out_space = ptw->in_space;
|
|
|
if (regime_is_stage2(mmu_idx)) {
|
|
|
- ns = mmu_idx == ARMMMUIdx_Stage2;
|
|
|
- xn = extract64(attrs, 53, 2);
|
|
|
- result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
|
|
|
+ /*
|
|
|
+ * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
|
|
|
+ * The bit remains ignored for other security states.
|
|
|
+ * R_YMCSL: Executing an insn fetched from non-Realm causes
|
|
|
+ * a stage2 permission fault.
|
|
|
+ */
|
|
|
+ if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
|
|
|
+ out_space = ARMSS_NonSecure;
|
|
|
+ result->f.prot = get_S2prot_noexecute(ap);
|
|
|
+ } else {
|
|
|
+ xn = extract64(attrs, 53, 2);
|
|
|
+ result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
|
|
|
+ }
|
|
|
} else {
|
|
|
- ns = extract32(attrs, 5, 1);
|
|
|
+ int nse, ns = extract32(attrs, 5, 1);
|
|
|
+ switch (out_space) {
|
|
|
+ case ARMSS_Root:
|
|
|
+ /*
|
|
|
+ * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
|
|
|
+ * R_XTYPW: NSE and NS together select the output pa space.
|
|
|
+ */
|
|
|
+ nse = extract32(attrs, 11, 1);
|
|
|
+ out_space = (nse << 1) | ns;
|
|
|
+ if (out_space == ARMSS_Secure &&
|
|
|
+ !cpu_isar_feature(aa64_sel2, cpu)) {
|
|
|
+ out_space = ARMSS_NonSecure;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case ARMSS_Secure:
|
|
|
+ if (ns) {
|
|
|
+ out_space = ARMSS_NonSecure;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case ARMSS_Realm:
|
|
|
+ switch (mmu_idx) {
|
|
|
+ case ARMMMUIdx_Stage1_E0:
|
|
|
+ case ARMMMUIdx_Stage1_E1:
|
|
|
+ case ARMMMUIdx_Stage1_E1_PAN:
|
|
|
+ /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
|
|
|
+ break;
|
|
|
+ case ARMMMUIdx_E2:
|
|
|
+ case ARMMMUIdx_E20_0:
|
|
|
+ case ARMMMUIdx_E20_2:
|
|
|
+ case ARMMMUIdx_E20_2_PAN:
|
|
|
+ /*
|
|
|
+ * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
|
|
|
+ * NS changes the output to non-secure space.
|
|
|
+ */
|
|
|
+ if (ns) {
|
|
|
+ out_space = ARMSS_NonSecure;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ default:
|
|
|
+ g_assert_not_reached();
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case ARMSS_NonSecure:
|
|
|
+ /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
|
|
|
+ break;
|
|
|
+ default:
|
|
|
+ g_assert_not_reached();
|
|
|
+ }
|
|
|
xn = extract64(attrs, 54, 1);
|
|
|
pxn = extract64(attrs, 53, 1);
|
|
|
- result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
|
|
|
+
|
|
|
+ /*
|
|
|
+ * Note that we modified ptw->in_space earlier for NSTable, but
|
|
|
+ * result->f.attrs retains a copy of the original security space.
|
|
|
+ */
|
|
|
+ result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, xn, pxn,
|
|
|
+ result->f.attrs.space, out_space);
|
|
|
}
|
|
|
|
|
|
if (!(result->f.prot & (1 << access_type))) {
|
|
|
@@ -1611,14 +1917,8 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- if (ns) {
|
|
|
- /*
|
|
|
- * The NS bit will (as required by the architecture) have no effect if
|
|
|
- * the CPU doesn't support TZ or this is a non-secure translation
|
|
|
- * regime, because the attribute will already be non-secure.
|
|
|
- */
|
|
|
- result->f.attrs.secure = false;
|
|
|
- }
|
|
|
+ result->f.attrs.space = out_space;
|
|
|
+ result->f.attrs.secure = arm_space_is_secure(out_space);
|
|
|
|
|
|
if (regime_is_stage2(mmu_idx)) {
|
|
|
result->cacheattrs.is_s2_format = true;
|
|
|
@@ -2402,6 +2702,7 @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
|
|
|
*/
|
|
|
if (sattrs.ns) {
|
|
|
result->f.attrs.secure = false;
|
|
|
+ result->f.attrs.space = ARMSS_NonSecure;
|
|
|
} else if (!secure) {
|
|
|
/*
|
|
|
* NS access to S memory must fault.
|
|
|
@@ -2668,14 +2969,16 @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
|
|
|
ARMMMUFaultInfo *fi)
|
|
|
{
|
|
|
uint8_t memattr = 0x00; /* Device nGnRnE */
|
|
|
- uint8_t shareability = 0; /* non-sharable */
|
|
|
+ uint8_t shareability = 0; /* non-shareable */
|
|
|
int r_el;
|
|
|
|
|
|
switch (mmu_idx) {
|
|
|
case ARMMMUIdx_Stage2:
|
|
|
case ARMMMUIdx_Stage2_S:
|
|
|
- case ARMMMUIdx_Phys_NS:
|
|
|
case ARMMMUIdx_Phys_S:
|
|
|
+ case ARMMMUIdx_Phys_NS:
|
|
|
+ case ARMMMUIdx_Phys_Root:
|
|
|
+ case ARMMMUIdx_Phys_Realm:
|
|
|
break;
|
|
|
|
|
|
default:
|
|
|
@@ -2725,7 +3028,7 @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
|
|
|
} else {
|
|
|
memattr = 0x44; /* Normal, NC, No */
|
|
|
}
|
|
|
- shareability = 2; /* outer sharable */
|
|
|
+ shareability = 2; /* outer shareable */
|
|
|
}
|
|
|
result->cacheattrs.is_s2_format = false;
|
|
|
break;
|
|
|
@@ -2750,10 +3053,10 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
|
|
|
bool is_secure = ptw->in_secure;
|
|
|
bool ret, ipa_secure;
|
|
|
ARMCacheAttrs cacheattrs1;
|
|
|
- bool is_el0;
|
|
|
+ ARMSecuritySpace ipa_space;
|
|
|
uint64_t hcr;
|
|
|
|
|
|
- ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
|
|
|
+ ret = get_phys_addr_nogpc(env, ptw, address, access_type, result, fi);
|
|
|
|
|
|
/* If S1 fails, return early. */
|
|
|
if (ret) {
|
|
|
@@ -2762,10 +3065,12 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
|
|
|
|
|
|
ipa = result->f.phys_addr;
|
|
|
ipa_secure = result->f.attrs.secure;
|
|
|
+ ipa_space = result->f.attrs.space;
|
|
|
|
|
|
- is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
|
|
|
+ ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
|
|
|
ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
|
|
|
ptw->in_secure = ipa_secure;
|
|
|
+ ptw->in_space = ipa_space;
|
|
|
ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
|
|
|
|
|
|
/*
|
|
|
@@ -2777,13 +3082,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
|
|
|
cacheattrs1 = result->cacheattrs;
|
|
|
memset(result, 0, sizeof(*result));
|
|
|
|
|
|
- if (arm_feature(env, ARM_FEATURE_PMSA)) {
|
|
|
- ret = get_phys_addr_pmsav8(env, ipa, access_type,
|
|
|
- ptw->in_mmu_idx, is_secure, result, fi);
|
|
|
- } else {
|
|
|
- ret = get_phys_addr_lpae(env, ptw, ipa, access_type,
|
|
|
- is_el0, result, fi);
|
|
|
- }
|
|
|
+ ret = get_phys_addr_nogpc(env, ptw, ipa, access_type, result, fi);
|
|
|
fi->s2addr = ipa;
|
|
|
|
|
|
/* Combine the S1 and S2 perms. */
|
|
|
@@ -2843,7 +3142,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
|
|
|
return false;
|
|
|
}
|
|
|
|
|
|
-static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
|
|
|
+static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
|
|
|
target_ulong address,
|
|
|
MMUAccessType access_type,
|
|
|
GetPhysAddrResult *result,
|
|
|
@@ -2854,15 +3153,18 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
|
|
|
ARMMMUIdx s1_mmu_idx;
|
|
|
|
|
|
/*
|
|
|
- * The page table entries may downgrade secure to non-secure, but
|
|
|
- * cannot upgrade an non-secure translation regime's attributes
|
|
|
- * to secure.
|
|
|
+ * The page table entries may downgrade Secure to NonSecure, but
|
|
|
+ * cannot upgrade a NonSecure translation regime's attributes
|
|
|
+ * to Secure or Realm.
|
|
|
*/
|
|
|
result->f.attrs.secure = is_secure;
|
|
|
+ result->f.attrs.space = ptw->in_space;
|
|
|
|
|
|
switch (mmu_idx) {
|
|
|
case ARMMMUIdx_Phys_S:
|
|
|
case ARMMMUIdx_Phys_NS:
|
|
|
+ case ARMMMUIdx_Phys_Root:
|
|
|
+ case ARMMMUIdx_Phys_Realm:
|
|
|
/* Checking Phys early avoids special casing later vs regime_el. */
|
|
|
return get_phys_addr_disabled(env, address, access_type, mmu_idx,
|
|
|
is_secure, result, fi);
|
|
|
@@ -2908,7 +3210,7 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
|
|
|
|
|
|
default:
|
|
|
/* Single stage uses physical for ptw. */
|
|
|
- ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
|
|
|
+ ptw->in_ptw_idx = arm_space_to_phys(ptw->in_space);
|
|
|
break;
|
|
|
}
|
|
|
|
|
|
@@ -2965,8 +3267,7 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
|
|
|
}
|
|
|
|
|
|
if (regime_using_lpae_format(env, mmu_idx)) {
|
|
|
- return get_phys_addr_lpae(env, ptw, address, access_type, false,
|
|
|
- result, fi);
|
|
|
+ return get_phys_addr_lpae(env, ptw, address, access_type, result, fi);
|
|
|
} else if (arm_feature(env, ARM_FEATURE_V7) ||
|
|
|
regime_sctlr(env, mmu_idx) & SCTLR_XP) {
|
|
|
return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
|
|
|
@@ -2975,6 +3276,23 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
|
|
|
}
|
|
|
}
|
|
|
|
|
|
+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
|
|
|
+ target_ulong address,
|
|
|
+ MMUAccessType access_type,
|
|
|
+ GetPhysAddrResult *result,
|
|
|
+ ARMMMUFaultInfo *fi)
|
|
|
+{
|
|
|
+ if (get_phys_addr_nogpc(env, ptw, address, access_type, result, fi)) {
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ if (!granule_protection_check(env, result->f.phys_addr,
|
|
|
+ result->f.attrs.space, fi)) {
|
|
|
+ fi->type = ARMFault_GPCFOnOutput;
|
|
|
+ return true;
|
|
|
+ }
|
|
|
+ return false;
|
|
|
+}
|
|
|
+
|
|
|
bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
|
|
|
MMUAccessType access_type, ARMMMUIdx mmu_idx,
|
|
|
bool is_secure, GetPhysAddrResult *result,
|
|
|
@@ -2983,16 +3301,19 @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
|
|
|
S1Translate ptw = {
|
|
|
.in_mmu_idx = mmu_idx,
|
|
|
.in_secure = is_secure,
|
|
|
+ .in_space = arm_secure_to_space(is_secure),
|
|
|
};
|
|
|
- return get_phys_addr_with_struct(env, &ptw, address, access_type,
|
|
|
- result, fi);
|
|
|
+ return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
|
|
|
}
|
|
|
|
|
|
bool get_phys_addr(CPUARMState *env, target_ulong address,
|
|
|
MMUAccessType access_type, ARMMMUIdx mmu_idx,
|
|
|
GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
|
|
|
{
|
|
|
- bool is_secure;
|
|
|
+ S1Translate ptw = {
|
|
|
+ .in_mmu_idx = mmu_idx,
|
|
|
+ };
|
|
|
+ ARMSecuritySpace ss;
|
|
|
|
|
|
switch (mmu_idx) {
|
|
|
case ARMMMUIdx_E10_0:
|
|
|
@@ -3005,30 +3326,54 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
|
|
|
case ARMMMUIdx_Stage1_E1:
|
|
|
case ARMMMUIdx_Stage1_E1_PAN:
|
|
|
case ARMMMUIdx_E2:
|
|
|
- is_secure = arm_is_secure_below_el3(env);
|
|
|
+ ss = arm_security_space_below_el3(env);
|
|
|
break;
|
|
|
case ARMMMUIdx_Stage2:
|
|
|
+ /*
|
|
|
+ * For Secure EL2, we need this index to be NonSecure;
|
|
|
+ * otherwise this will already be NonSecure or Realm.
|
|
|
+ */
|
|
|
+ ss = arm_security_space_below_el3(env);
|
|
|
+ if (ss == ARMSS_Secure) {
|
|
|
+ ss = ARMSS_NonSecure;
|
|
|
+ }
|
|
|
+ break;
|
|
|
case ARMMMUIdx_Phys_NS:
|
|
|
case ARMMMUIdx_MPrivNegPri:
|
|
|
case ARMMMUIdx_MUserNegPri:
|
|
|
case ARMMMUIdx_MPriv:
|
|
|
case ARMMMUIdx_MUser:
|
|
|
- is_secure = false;
|
|
|
+ ss = ARMSS_NonSecure;
|
|
|
break;
|
|
|
- case ARMMMUIdx_E3:
|
|
|
case ARMMMUIdx_Stage2_S:
|
|
|
case ARMMMUIdx_Phys_S:
|
|
|
case ARMMMUIdx_MSPrivNegPri:
|
|
|
case ARMMMUIdx_MSUserNegPri:
|
|
|
case ARMMMUIdx_MSPriv:
|
|
|
case ARMMMUIdx_MSUser:
|
|
|
- is_secure = true;
|
|
|
+ ss = ARMSS_Secure;
|
|
|
+ break;
|
|
|
+ case ARMMMUIdx_E3:
|
|
|
+ if (arm_feature(env, ARM_FEATURE_AARCH64) &&
|
|
|
+ cpu_isar_feature(aa64_rme, env_archcpu(env))) {
|
|
|
+ ss = ARMSS_Root;
|
|
|
+ } else {
|
|
|
+ ss = ARMSS_Secure;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case ARMMMUIdx_Phys_Root:
|
|
|
+ ss = ARMSS_Root;
|
|
|
+ break;
|
|
|
+ case ARMMMUIdx_Phys_Realm:
|
|
|
+ ss = ARMSS_Realm;
|
|
|
break;
|
|
|
default:
|
|
|
g_assert_not_reached();
|
|
|
}
|
|
|
- return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
|
|
|
- is_secure, result, fi);
|
|
|
+
|
|
|
+ ptw.in_space = ss;
|
|
|
+ ptw.in_secure = arm_space_is_secure(ss);
|
|
|
+ return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
|
|
|
}
|
|
|
|
|
|
hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
|
|
|
@@ -3036,16 +3381,19 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
|
|
|
{
|
|
|
ARMCPU *cpu = ARM_CPU(cs);
|
|
|
CPUARMState *env = &cpu->env;
|
|
|
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
|
|
|
+ ARMSecuritySpace ss = arm_security_space(env);
|
|
|
S1Translate ptw = {
|
|
|
- .in_mmu_idx = arm_mmu_idx(env),
|
|
|
- .in_secure = arm_is_secure(env),
|
|
|
+ .in_mmu_idx = mmu_idx,
|
|
|
+ .in_space = ss,
|
|
|
+ .in_secure = arm_space_is_secure(ss),
|
|
|
.in_debug = true,
|
|
|
};
|
|
|
GetPhysAddrResult res = {};
|
|
|
ARMMMUFaultInfo fi = {};
|
|
|
bool ret;
|
|
|
|
|
|
- ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
|
|
|
+ ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
|
|
|
*attrs = res.f.attrs;
|
|
|
|
|
|
if (ret) {
|
Richard Henderson