@samitouri / QOSamiQemu / commits / 31b8d287b7

target/arm: Don't skip access flag fault for AccessType_AT

As per the pseudo code from DDI0487 M.a.a (on J1-16021) AArch64.S1Walk(): // Check descriptor AF bit elsif (descriptor<10> == '0' && walkparams.ha == '0' && (!accdesc.acctype IN {AccessType_DC, AccessType_IC} || boolean IMPLEMENTATION_DEFINED "Generate access flag fault on IC/DC operations")) then fault.statuscode = Fault_AccessFlag; an access flag fault should be generated for AccessType_AT, if the AF bit is 0 and !param.ha. Besides, we should continue to not raise the access flag fault for in_debug = true which is what we've been doing previously (before commit efebeec13d07) for LPAE and is what intention of the debugger access codepath is. Cc: qemu-stable@nongnu.org Fixes: efebeec13d07 ("target/arm: Skip AF and DB updates for AccessType_AT") Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20260324160321.96347-1-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Zenghui Yu committed Mar 30, 2026 at 16:18 UTC 31b8d287b7fe59d135b836cacaaa364efe598ec0
1 file changed +10 -8
target/arm/ptw.c
+10 -8
@@ -2118,6 +2118,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
2118 descaddr &= ~(hwaddr)(page_size - 1);
2119 descaddr |= (address & (page_size - 1));
2120
2121 + if (likely(!ptw->in_debug)) {
2122 + /* Check descriptor AF bit */
2123 + if (!(descriptor & (1 << 10)) && !param.ha) {
2124 + fi->type = ARMFault_AccessFlag;
2125 + goto do_fault;
2126 + }
2127 + }
2128 +
2129 /*
2130 * For AccessType_AT, DB is not updated (AArch64.SetDirtyFlag),
2131 * and it is IMPLEMENTATION DEFINED whether AF is updated
@@ -2127,15 +2135,9 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
2135 /*
2136 * Access flag.
2137 * If HA is enabled, prepare to update the descriptor below.
2130 - * Otherwise, pass the access fault on to software.
2138 */
2132 - if (!(descriptor & (1 << 10))) {
2133 - if (param.ha) {
2134 - new_descriptor |= 1 << 10; /* AF */
2135 - } else {
2136 - fi->type = ARMFault_AccessFlag;
2137 - goto do_fault;
2138 - }
2139 + if (!(descriptor & (1 << 10)) && param.ha) {
2140 + new_descriptor |= 1 << 10; /* AF */
2141 }
2142
2143 /*