As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the initial PA space used for stage 2 table walks is assigned based on the SW and NSW bits of the VSTCR and VTCR registers. This was already implemented for the recursive stage 2 page table walks in S1_ptw_translate(), but was missing for the final stage 2 walk.
Signed-off-by: Idan Horowitz <idan.horow...@gmail.com> --- target/arm/helper.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/target/arm/helper.c b/target/arm/helper.c index d0265b760f..e2695e846a 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -12657,6 +12657,16 @@ bool get_phys_addr(CPUARMState *env, target_ulong address, return ret; } + if (arm_is_secure_below_el3(env)) { + if (attrs->secure) { + attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW); + } else { + attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW); + } + } else { + assert(!attrs->secure); + } + s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0; -- 2.35.1