* [PATCH] target/arm: Limit LPA2 effective output address when TCR.DS == 0
@ 2022-11-16 17:03 Ard Biesheuvel
2022-11-17 3:14 ` Richard Henderson
0 siblings, 1 reply; 3+ messages in thread
From: Ard Biesheuvel @ 2022-11-16 17:03 UTC (permalink / raw)
To: qemu-devel
Cc: Ard Biesheuvel, Peter Maydell, Philippe Mathieu-Daudé,
Richard Henderson
With LPA2, the effective output address size is at most 48 bits when
TCR.DS == 0. This case is currently unhandled in the page table walker,
where we happily assume LVA/64k granule when outputsize > 48 and
param.ds == 0, resulting in the wrong conversion to be used from a
page table descriptor to a physical address.
if (outputsize > 48) {
if (param.ds) {
descaddr |= extract64(descriptor, 8, 2) << 50;
} else {
descaddr |= extract64(descriptor, 12, 4) << 48;
}
So cap the outputsize to 48 when TCR.DS is cleared, as per the
architecture.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
target/arm/ptw.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 3745ac9723474332..9a6277d862fac229 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1222,6 +1222,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
ps = MIN(ps, param.ps);
assert(ps < ARRAY_SIZE(pamax_map));
outputsize = pamax_map[ps];
+
+ /*
+ * With LPA2, the effective output address (OA) size is at most 48 bits
+ * unless TCR.DS == 1
+ */
+ if (!param.ds && param.gran != Gran64K) {
+ outputsize = MIN(outputsize, 48);
+ }
} else {
param = aa32_va_parameters(env, address, mmu_idx);
level = 1;
--
2.35.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] target/arm: Limit LPA2 effective output address when TCR.DS == 0
2022-11-16 17:03 [PATCH] target/arm: Limit LPA2 effective output address when TCR.DS == 0 Ard Biesheuvel
@ 2022-11-17 3:14 ` Richard Henderson
2022-11-17 16:27 ` Peter Maydell
0 siblings, 1 reply; 3+ messages in thread
From: Richard Henderson @ 2022-11-17 3:14 UTC (permalink / raw)
To: Ard Biesheuvel, qemu-devel; +Cc: Peter Maydell, Philippe Mathieu-Daudé
On 11/16/22 09:03, Ard Biesheuvel wrote:
> diff --git a/target/arm/ptw.c b/target/arm/ptw.c
> index 3745ac9723474332..9a6277d862fac229 100644
> --- a/target/arm/ptw.c
> +++ b/target/arm/ptw.c
> @@ -1222,6 +1222,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
> ps = MIN(ps, param.ps);
> assert(ps < ARRAY_SIZE(pamax_map));
> outputsize = pamax_map[ps];
> +
> + /*
> + * With LPA2, the effective output address (OA) size is at most 48 bits
> + * unless TCR.DS == 1
> + */
> + if (!param.ds && param.gran != Gran64K) {
> + outputsize = MIN(outputsize, 48);
> + }
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
I thought about moving this back into aa64_va_parameters, similar to how we bound tsz, but
since this is the only use of param.ps, this placement is as good as any.
r~
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] target/arm: Limit LPA2 effective output address when TCR.DS == 0
2022-11-17 3:14 ` Richard Henderson
@ 2022-11-17 16:27 ` Peter Maydell
0 siblings, 0 replies; 3+ messages in thread
From: Peter Maydell @ 2022-11-17 16:27 UTC (permalink / raw)
To: Richard Henderson; +Cc: Ard Biesheuvel, qemu-devel, Philippe Mathieu-Daudé
On Thu, 17 Nov 2022 at 03:14, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 11/16/22 09:03, Ard Biesheuvel wrote:
> > diff --git a/target/arm/ptw.c b/target/arm/ptw.c
> > index 3745ac9723474332..9a6277d862fac229 100644
> > --- a/target/arm/ptw.c
> > +++ b/target/arm/ptw.c
> > @@ -1222,6 +1222,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
> > ps = MIN(ps, param.ps);
> > assert(ps < ARRAY_SIZE(pamax_map));
> > outputsize = pamax_map[ps];
> > +
> > + /*
> > + * With LPA2, the effective output address (OA) size is at most 48 bits
> > + * unless TCR.DS == 1
> > + */
> > + if (!param.ds && param.gran != Gran64K) {
> > + outputsize = MIN(outputsize, 48);
> > + }
>
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
>
> I thought about moving this back into aa64_va_parameters, similar to how we bound tsz, but
> since this is the only use of param.ps, this placement is as good as any.
Applied to target-arm.next, thanks.
-- PMM
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-11-17 16:28 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-16 17:03 [PATCH] target/arm: Limit LPA2 effective output address when TCR.DS == 0 Ard Biesheuvel
2022-11-17 3:14 ` Richard Henderson
2022-11-17 16:27 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.