summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorArd Biesheuvel2022-11-21 12:45:13 +0100
committerPeter Maydell2022-11-21 12:46:46 +0100
commit312b71abce3005ca7294dc0db7d548dc7cc41fbf (patch)
treef834b444869786f0c44dcf9626c607152f3d56f9
parenttests/avocado/boot_linux.py: Bump aarch64 virt test timeout to 720s (diff)
downloadqemu-312b71abce3005ca7294dc0db7d548dc7cc41fbf.tar.gz
qemu-312b71abce3005ca7294dc0db7d548dc7cc41fbf.tar.xz
qemu-312b71abce3005ca7294dc0db7d548dc7cc41fbf.zip
target/arm: Limit LPA2 effective output address when TCR.DS == 0
With LPA2, the effective output address size is at most 48 bits when TCR.DS == 0. This case is currently unhandled in the page table walker, where we happily assume LVA/64k granule when outputsize > 48 and param.ds == 0, resulting in the wrong conversion to be used from a page table descriptor to a physical address. if (outputsize > 48) { if (param.ds) { descaddr |= extract64(descriptor, 8, 2) << 50; } else { descaddr |= extract64(descriptor, 12, 4) << 48; } So cap the outputsize to 48 when TCR.DS is cleared, as per the architecture. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221116170316.259695-1-ardb@kernel.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r--target/arm/ptw.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 3745ac9723..9a6277d862 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1222,6 +1222,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
ps = MIN(ps, param.ps);
assert(ps < ARRAY_SIZE(pamax_map));
outputsize = pamax_map[ps];
+
+ /*
+ * With LPA2, the effective output address (OA) size is at most 48 bits
+ * unless TCR.DS == 1
+ */
+ if (!param.ds && param.gran != Gran64K) {
+ outputsize = MIN(outputsize, 48);
+ }
} else {
param = aa32_va_parameters(env, address, mmu_idx);
level = 1;