yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-12-23 23:05:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

target-arm: Fix descriptor address masking in ARM address translation

Browse source 
There is a bug in ARM address translation regime with a long-descriptor
format. On the descriptor reading its address is formed from an index
which is a part of the input address. And on the first iteration this index
is incorrectly masked with 'grainsize' mask. But it can be wider according
to pseudo-code.
On the other hand on the iterations other than first the descriptor address
is formed from the previous level descriptor by masking with 'descaddrmask'
value. It always clears just 12 lower bits, but it must clear 'grainsize'
lower bits instead according to pseudo-code.
The patch fixes both cases.

Backports commit dddb5223413c5425ae6eaeb3b967627efc9675f7 from qemu
This commit is contained in:
Sergey Sorokin 2018-02-23 19:56:52 -05:00 committed by Lioncash
parent 00e751f18e
commit 98a6d44c54
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 11 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
qemu/target-arm/helper.c
View file

@ -6505,7 +6505,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
uint32_t tg;
uint64_t ttbr;
int ttbr_select;
hwaddr descaddr, descmask;
hwaddr descaddr, indexmask, indexmask_grainsize;
uint32_t tableattrs;
target_ulong page_size;
uint32_t attrs;
@ -6694,28 +6694,20 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
level = startlevel;
}
/* Clear the vaddr bits which aren't part of the within-region address,
* so that we don't have to special case things when calculating the
* first descriptor address.
*/
if (va_size != inputsize) {
address &= (1ULL << inputsize) - 1;
}
descmask = (1ULL << (stride + 3)) - 1;
indexmask_grainsize = (1ULL << (stride + 3)) - 1;
indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
/* Now we can extract the actual base address from the TTBR */
descaddr = extract64(ttbr, 0, 48);
descaddr &= ~((1ULL << (inputsize - (stride * (4 - level)))) - 1);
descaddr &= ~indexmask;
/* The address field in the descriptor goes up to bit 39 for ARMv7
* but up to bit 47 for ARMv8.
* but up to bit 47 for ARMv8, but we use the descaddrmask
* up to bit 39 for AArch32, because we don't need other bits in that case
* to construct next descriptor address (anyway they should be all zeroes).
*/
if (arm_feature(env, ARM_FEATURE_V8)) {
descaddrmask = 0xfffffffff000ULL;
} else {
descaddrmask = 0xfffffff000ULL;
}
descaddrmask = ((1ull << (va_size == 64 ? 48 : 40)) - 1) &
~indexmask_grainsize;
/* Secure accesses start with the page table in secure memory and
* can be downgraded to non-secure at any step. Non-secure accesses
@ -6727,7 +6719,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
uint64_t descriptor;
bool nstable;
descaddr |= (address >> (stride * (4 - level))) & descmask;
descaddr |= (address >> (stride * (4 - level))) & indexmask;
descaddr &= ~7ULL;
nstable = extract32(tableattrs, 4, 1);
descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fsr, fi);
@ -6749,6 +6741,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
*/
tableattrs |= extract64(descriptor, 59, 5);
level++;
indexmask = indexmask_grainsize;
continue;
}
/* Block entry at level 1 or 2, or page entry at level 3.