target/arm: Honor HCR_E2H and HCR_TGE in ats_write64()

We need to check HCR_E2H and HCR_TGE to select the right MMU index for
the correct translation regime.

To check for EL2&0 translation regime:
- For S1E0*, S1E1* and S12E* ops, check both HCR_E2H and HCR_TGE
- For S1E2* ops, check only HCR_E2H

Signed-off-by: Ake Koomsin <ake@igel.co.jp>
Message-id: 20221101064250.12444-1-ake@igel.co.jp
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

(cherry picked from commit 638d5dbd78ea81c943959e2f2c65c109e5278a78)

target/arm/helper.c

@@ -3826,20 +3826,29 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
     ARMMMUIdx mmu_idx;
     int secure = arm_is_secure_below_el3(env);
+    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
 
     switch (ri->opc2 & 6) {
     case 0:
         switch (ri->opc1) {
         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
             if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
-                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
+                mmu_idx = regime_e20 ?
+                          (secure ? ARMMMUIdx_SE20_2_PAN
+                           : ARMMMUIdx_E20_2_PAN) :
+                          (secure ? ARMMMUIdx_Stage1_SE1_PAN
                            : ARMMMUIdx_Stage1_E1_PAN);
             } else {
-                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
+                mmu_idx = regime_e20 ?
+                          (secure ? ARMMMUIdx_SE20_2 : ARMMMUIdx_E20_2) :
+                          (secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1);
             }
             break;
         case 4: /* AT S1E2R, AT S1E2W */
-            mmu_idx = secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2;
+            mmu_idx = hcr_el2 & HCR_E2H ?
+                      (secure ? ARMMMUIdx_SE20_2 : ARMMMUIdx_E20_2) :
+                      (secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2);
             break;
         case 6: /* AT S1E3R, AT S1E3W */
             mmu_idx = ARMMMUIdx_SE3;
@@ -3849,13 +3858,19 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         }
         break;
     case 2: /* AT S1E0R, AT S1E0W */
-        mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
+        mmu_idx = regime_e20 ?
+                  (secure ? ARMMMUIdx_SE20_0 : ARMMMUIdx_E20_0) :
+                  (secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0);
         break;
     case 4: /* AT S12E1R, AT S12E1W */
-        mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1;
+        mmu_idx = regime_e20 ?
+                  (secure ? ARMMMUIdx_SE20_2 : ARMMMUIdx_E20_2) :
+                  (secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1);
         break;
     case 6: /* AT S12E0R, AT S12E0W */
-        mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0;
+        mmu_idx = regime_e20 ?
+                  (secure ? ARMMMUIdx_SE20_0 : ARMMMUIdx_E20_0) :
+                  (secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0);
         break;
     default:
         g_assert_not_reached();