Re: [Qemu-devel] [PATCH] ARM MMU translation - fix small (4k) page access

[Scott Oom]

Justin Fletcher wrote:
> 
> I may be confused on this, but it still doesn't seem right to me.
> 
> You have...
> 
> -                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
> +                ap = (desc >> (4 + ((address >> 11) & 6))) & 3; /* SRO */
> 
> For 4K pages, the L2 table is ...
>   b0-1 = 2
>   b2   = B
>   b3   = C
>   b4-5 = AP0
>   b6-7 = AP1
>   b8-9 = AP2
>   b10-11=AP3
>   b12-31=physical address
> (from ARMARM 'D', 3.3.7)
> 
> The use of AP0-AP3 is dependant on bits 10 and 11. So, the code should
> be more like...
> 
>                 ap = (desc >> (4 + ((address >> 10) & 3) )) & 3;
> 
> That is, (address>>10) & 3 => bits 10 and 11
>          add on 4 as the offset to the AP fields in the descriptor
>          shift down and & 3 to leave just those two bits.
> 
Well, we need to take b10-11 and use them to index either 4-5, 6-7, 8-9
or 10-11.
(address >> 10) & 3 gives us 0, 1, 2 or 3, shift that left one to double
it (because each AP field is two bits).  Adding 4 gives 4, 6, 8, 10.  So
I believe the correct solution is:
                ap = (desc >> (4 + ((address >> 9) & 6))) & 3;

I thought if was just 2 bits different from the large page descriptor,
but the difference, the SBZ field, is 4 bits.  Comparing to the large
page descriptor:
                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;


-Scott