From patchwork Fri Nov 20 14:32:51 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 57069 Delivered-To: patches@linaro.org Received: by 10.112.155.196 with SMTP id vy4csp517066lbb; Fri, 20 Nov 2015 06:32:52 -0800 (PST) X-Received: by 10.28.125.73 with SMTP id y70mr2870201wmc.95.1448029972891; Fri, 20 Nov 2015 06:32:52 -0800 (PST) Return-Path: Received: from mnementh.archaic.org.uk (mnementh.archaic.org.uk. [2001:8b0:1d0::1]) by mx.google.com with ESMTPS id lm6si18884563wjb.63.2015.11.20.06.32.52 for (version=TLS1_2 cipher=AES128-SHA bits=128/128); Fri, 20 Nov 2015 06:32:52 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 2001:8b0:1d0::1 as permitted sender) client-ip=2001:8b0:1d0::1; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of pm215@archaic.org.uk designates 2001:8b0:1d0::1 as permitted sender) smtp.mailfrom=pm215@archaic.org.uk Received: from pm215 by mnementh.archaic.org.uk with local (Exim 4.80) (envelope-from ) id 1Zzmk7-0002Zk-VI; Fri, 20 Nov 2015 14:32:51 +0000 From: Peter Maydell To: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org, patches@linaro.org, "Edgar E. Iglesias" , Laurent Desnogues Subject: [PATCH for-2.5] target-arm: Don't mask out bits [47:40] in LPAE descriptors for v8 Date: Fri, 20 Nov 2015 14:32:51 +0000 Message-Id: <1448029971-9875-1-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.7.10.4 In an LPAE format descriptor in ARMv8 the address field extends up to bit 47, not just bit 39. Correct the masking so we don't give incorrect results if the output address size is greater than 40 bits, as it can be for AArch64. (Note that we don't yet support the new-in-v8 Address Size fault which should be generated if any translation table entry or TTBR contains an address with non-zero bits above the most significant bit of the maximum output address size.) Signed-off-by: Peter Maydell --- This is worth fixing for 2.5 I think. As the commit message notes, we don't support the Addres Size faults we ought to take in some cases, but that seems more 2.6-ish. --- target-arm/helper.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 1.9.1 diff --git a/target-arm/helper.c b/target-arm/helper.c index 4ecae61..afc4163 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -6642,6 +6642,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, int ap, ns, xn, pxn; uint32_t el = regime_el(env, mmu_idx); bool ttbr1_valid = true; + uint64_t descaddrmask; /* TODO: * This code does not handle the different format TCR for VTCR_EL2. @@ -6831,6 +6832,15 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, descaddr = extract64(ttbr, 0, 48); descaddr &= ~((1ULL << (inputsize - (stride * (4 - level)))) - 1); + /* The address field in the descriptor goes up to bit 39 for ARMv7 + * but up to bit 47 for ARMv8. + */ + if (arm_feature(env, ARM_FEATURE_V8)) { + descaddrmask = 0xfffffffff000ULL; + } else { + descaddrmask = 0xfffffff000ULL; + } + /* Secure accesses start with the page table in secure memory and * can be downgraded to non-secure at any step. Non-secure accesses * remain non-secure. We implement this by just ORing in the NSTable/NS @@ -6854,7 +6864,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, /* Invalid, or the Reserved level 3 encoding */ goto do_fault; } - descaddr = descriptor & 0xfffffff000ULL; + descaddr = descriptor & descaddrmask; if ((descriptor & 2) && (level < 3)) { /* Table entry. The top five bits are attributes which may