diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index c1f7e8c934..d7b79a6589 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -233,7 +233,7 @@ int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
ARMVAParameters param;
- param = aa64_va_parameters(env, -is_high, mmu_idx, is_data);
+ param = aa64_va_parameters(env, -is_high, mmu_idx, is_data, false);
return gdb_get_reg64(buf, pauth_ptr_mask(param));
}
default:
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2297626bfb..0b7fd2e7e6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4904,7 +4904,7 @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
unsigned int page_size_granule, page_shift, num, scale, exponent;
/* Extract one bit to represent the va selector in use. */
uint64_t select = sextract64(value, 36, 1);
- ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true);
+ ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true, false);
TLBIRange ret = { };
ARMGranuleSize gran;
@@ -11193,7 +11193,8 @@ static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran,
}
ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
- ARMMMUIdx mmu_idx, bool data)
+ ARMMMUIdx mmu_idx, bool data,
+ bool el1_is_aa32)
{
uint64_t tcr = regime_tcr(env, mmu_idx);
bool epd, hpd, tsz_oob, ds, ha, hd;
@@ -11289,6 +11290,16 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
}
}
+ if (stage2 && el1_is_aa32) {
+ /*
+ * For AArch32 EL1 the min txsz (and thus max IPA size) requirements
+ * are loosened: a configured IPA of 40 bits is permitted even if
+ * the implemented PA is less than that (and so a 40 bit IPA would
+ * fault for an AArch64 EL1). See R_DTLMN.
+ */
+ min_tsz = MIN(min_tsz, 24);
+ }
+
if (tsz > max_tsz) {
tsz = max_tsz;
tsz_oob = true;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 0df8f3b8bc..c869d18c38 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1091,8 +1091,18 @@ typedef struct ARMVAParameters {
ARMGranuleSize gran : 2;
} ARMVAParameters;
+/**
+ * aa64_va_parameters: Return parameters for an AArch64 virtual address
+ * @env: CPU
+ * @va: virtual address to look up
+ * @mmu_idx: determines translation regime to use
+ * @data: true if this is a data access
+ * @el1_is_aa32: true if we are asking about stage 2 when EL1 is AArch32
+ * (ignored if @mmu_idx is for a stage 1 regime; only affects tsz/tsz_oob)
+ */
ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
- ARMMMUIdx mmu_idx, bool data);
+ ARMMMUIdx mmu_idx, bool data,
+ bool el1_is_aa32);
int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index a89aa70b8b..69c05cd9da 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1134,17 +1134,6 @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
sl0 = extract32(tcr, 6, 2);
if (is_aa64) {
- /*
- * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
- * get_phys_addr_lpae, that used aa64_va_parameters which apply
- * to aarch64. If Stage1 is aarch32, the min_txsz is larger.
- * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
- * inputsize is 64 - 24 = 40.
- */
- if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
- goto fail;
- }
-
/*
* AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
* so interleave AArch64.S2StartLevel.
@@ -1284,7 +1273,8 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
int ps;
param = aa64_va_parameters(env, address, mmu_idx,
- access_type != MMU_INST_FETCH);
+ access_type != MMU_INST_FETCH,
+ !arm_el_is_aa64(env, 1));
level = 0;
/*
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
index de067fa716..62af569341 100644
--- a/target/arm/tcg/pauth_helper.c
+++ b/target/arm/tcg/pauth_helper.c
@@ -293,7 +293,7 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
ARMPACKey *key, bool data)
{
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
- ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false);
uint64_t pac, ext_ptr, ext, test;
int bot_bit, top_bit;
@@ -355,7 +355,7 @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
ARMPACKey *key, bool data, int keynumber)
{
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
- ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false);
int bot_bit, top_bit;
uint64_t pac, orig_ptr, test;
@@ -379,7 +379,7 @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
static uint64_t pauth_strip(CPUARMState *env, uint64_t ptr, bool data)
{
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
- ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false);
return pauth_original_ptr(ptr, param);
}