diff options
author | Ard Biesheuvel <ardb@kernel.org> | 2022-11-21 11:45:13 +0000 |
---|---|---|
committer | Peter Maydell <peter.maydell@linaro.org> | 2022-11-21 11:46:46 +0000 |
commit | 312b71abce3005ca7294dc0db7d548dc7cc41fbf (patch) | |
tree | f834b444869786f0c44dcf9626c607152f3d56f9 | |
parent | c4462523ff0790cbefb1c206cc34c85ec686b1d5 (diff) |
target/arm: Limit LPA2 effective output address when TCR.DS == 0
With LPA2, the effective output address size is at most 48 bits when
TCR.DS == 0. This case is currently unhandled in the page table walker,
where we happily assume LVA/64k granule when outputsize > 48 and
param.ds == 0, resulting in the wrong conversion to be used from a
page table descriptor to a physical address.
if (outputsize > 48) {
if (param.ds) {
descaddr |= extract64(descriptor, 8, 2) << 50;
} else {
descaddr |= extract64(descriptor, 12, 4) << 48;
}
So cap the outputsize to 48 when TCR.DS is cleared, as per the
architecture.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221116170316.259695-1-ardb@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r-- | target/arm/ptw.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 3745ac9723..9a6277d862 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -1222,6 +1222,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, ps = MIN(ps, param.ps); assert(ps < ARRAY_SIZE(pamax_map)); outputsize = pamax_map[ps]; + + /* + * With LPA2, the effective output address (OA) size is at most 48 bits + * unless TCR.DS == 1 + */ + if (!param.ds && param.gran != Gran64K) { + outputsize = MIN(outputsize, 48); + } } else { param = aa32_va_parameters(env, address, mmu_idx); level = 1; |