From c79ebe4965676f9d66b211240b42d9302c40d694 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 16 Aug 2018 06:46:04 -0400
Subject: [PATCH] target/arm: Treat SCTLR_EL1.M as if it were zero when
 HCR_EL2.TGE is set

One of the required effects of setting HCR_EL2.TGE is that when
SCR_EL3.NS is 1 then SCTLR_EL1.M must behave as if it is zero for
all purposes except direct reads. That is, it effectively disables
the MMU for the NS EL0/EL1 translation regime.

Backports commit 3d0e3080d8b7abcddc038d18e8401861c369c4c1 from qemu
---
 qemu/target/arm/helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/qemu/target/arm/helper.c b/qemu/target/arm/helper.c
index 9538855f..15289122 100644
--- a/qemu/target/arm/helper.c
+++ b/qemu/target/arm/helper.c
@@ -7622,6 +7622,14 @@ static inline bool regime_translation_disabled(CPUARMState *env,
     if (mmu_idx == ARMMMUIdx_S2NS) {
         return (env->cp15.hcr_el2 & HCR_VM) == 0;
     }
+
+    if (env->cp15.hcr_el2 & HCR_TGE) {
+        /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
+        if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
+            return true;
+        }
+    }
+
     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
 }