diff options
| author | Ard Biesheuvel <ardb@kernel.org> | 2022-11-21 11:45:13 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2022-11-21 11:46:46 +0000 |
| commit | 312b71abce3005ca7294dc0db7d548dc7cc41fbf (patch) | |
| tree | f834b444869786f0c44dcf9626c607152f3d56f9 /subprojects/libvhost-user/libvhost-user.c | |
| parent | c4462523ff0790cbefb1c206cc34c85ec686b1d5 (diff) | |
| download | focaccia-qemu-312b71abce3005ca7294dc0db7d548dc7cc41fbf.tar.gz focaccia-qemu-312b71abce3005ca7294dc0db7d548dc7cc41fbf.zip | |
target/arm: Limit LPA2 effective output address when TCR.DS == 0
With LPA2, the effective output address size is at most 48 bits when
TCR.DS == 0. This case is currently unhandled in the page table walker,
where we happily assume LVA/64k granule when outputsize > 48 and
param.ds == 0, resulting in the wrong conversion to be used from a
page table descriptor to a physical address.
if (outputsize > 48) {
if (param.ds) {
descaddr |= extract64(descriptor, 8, 2) << 50;
} else {
descaddr |= extract64(descriptor, 12, 4) << 48;
}
So cap the outputsize to 48 when TCR.DS is cleared, as per the
architecture.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221116170316.259695-1-ardb@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'subprojects/libvhost-user/libvhost-user.c')
0 files changed, 0 insertions, 0 deletions