From 312b71abce3005ca7294dc0db7d548dc7cc41fbf Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Mon, 21 Nov 2022 11:45:13 +0000 Subject: target/arm: Limit LPA2 effective output address when TCR.DS == 0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With LPA2, the effective output address size is at most 48 bits when TCR.DS == 0. This case is currently unhandled in the page table walker, where we happily assume LVA/64k granule when outputsize > 48 and param.ds == 0, resulting in the wrong conversion to be used from a page table descriptor to a physical address. if (outputsize > 48) { if (param.ds) { descaddr |= extract64(descriptor, 8, 2) << 50; } else { descaddr |= extract64(descriptor, 12, 4) << 48; } So cap the outputsize to 48 when TCR.DS is cleared, as per the architecture. Cc: Peter Maydell Cc: Philippe Mathieu-Daudé Cc: Richard Henderson Signed-off-by: Ard Biesheuvel Reviewed-by: Richard Henderson Message-id: 20221116170316.259695-1-ardb@kernel.org Signed-off-by: Peter Maydell --- target/arm/ptw.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 3745ac9723..9a6277d862 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -1222,6 +1222,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, ps = MIN(ps, param.ps); assert(ps < ARRAY_SIZE(pamax_map)); outputsize = pamax_map[ps]; + + /* + * With LPA2, the effective output address (OA) size is at most 48 bits + * unless TCR.DS == 1 + */ + if (!param.ds && param.gran != Gran64K) { + outputsize = MIN(outputsize, 48); + } } else { param = aa32_va_parameters(env, address, mmu_idx); level = 1; -- cgit v1.2.3