[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 24/33] target/arm: Correct calculation of tlb range invalidate len
From: |
Peter Maydell |
Subject: |
[PULL 24/33] target/arm: Correct calculation of tlb range invalidate length |
Date: |
Wed, 15 Dec 2021 10:40:40 +0000 |
The calculation of the length of TLB range invalidate operations
in tlbi_aa64_range_get_length() is incorrect in two ways:
* the NUM field is 5 bits, but we read only 4 bits
* we miscalculate the page_shift value, because of an
off-by-one error:
TG 0b00 is invalid
TG 0b01 is 4K granule size == 4096 == 2^12
TG 0b10 is 16K granule size == 16384 == 2^14
TG 0b11 is 64K granule size == 65536 == 2^16
so page_shift should be (TG - 1) * 2 + 12
Thanks to the bug report submitter Cha HyunSoo for identifying
both these errors.
Fixes: 84940ed82552d3c ("target/arm: Add support for FEAT_TLBIRANGE")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/734
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20211130173257.1274194-1-peter.maydell@linaro.org
---
target/arm/helper.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 9b317899a66..db837d53bd9 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4519,18 +4519,18 @@ static uint64_t tlbi_aa64_range_get_length(CPUARMState
*env,
uint64_t exponent;
uint64_t length;
- num = extract64(value, 39, 4);
+ num = extract64(value, 39, 5);
scale = extract64(value, 44, 2);
page_size_granule = extract64(value, 46, 2);
- page_shift = page_size_granule * 2 + 12;
-
if (page_size_granule == 0) {
qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
page_size_granule);
return 0;
}
+ page_shift = (page_size_granule - 1) * 2 + 12;
+
exponent = (5 * scale) + 1;
length = (num + 1) << (exponent + page_shift);
--
2.25.1
- [PULL 14/33] target/arm: Split compute_fsr_fsc out of arm_deliver_fault, (continued)
- [PULL 14/33] target/arm: Split compute_fsr_fsc out of arm_deliver_fault, Peter Maydell, 2021/12/15
- [PULL 09/33] target/arm: Hoist pc_next to a local variable in aarch64_tr_translate_insn, Peter Maydell, 2021/12/15
- [PULL 15/33] target/arm: Take an exception if PC is misaligned, Peter Maydell, 2021/12/15
- [PULL 16/33] target/arm: Assert thumb pc is aligned, Peter Maydell, 2021/12/15
- [PULL 17/33] target/arm: Suppress bp for exceptions with more priority, Peter Maydell, 2021/12/15
- [PULL 20/33] include/hw/i386: Don't include qemu-common.h in .h files, Peter Maydell, 2021/12/15
- [PULL 21/33] target/hexagon/cpu.h: don't include qemu-common.h, Peter Maydell, 2021/12/15
- [PULL 13/33] target/arm: Advance pc for arch single-step exception, Peter Maydell, 2021/12/15
- [PULL 18/33] tests/tcg: Add arm and aarch64 pc alignment tests, Peter Maydell, 2021/12/15
- [PULL 19/33] target/i386: Use assert() to sanity-check b1 in SSE decode, Peter Maydell, 2021/12/15
- [PULL 24/33] target/arm: Correct calculation of tlb range invalidate length,
Peter Maydell <=
- [PULL 27/33] hw/arm/virt: Remove device tree restriction for virtio-iommu, Peter Maydell, 2021/12/15
- [PULL 28/33] hw/arm/virt: Reject instantiation of multiple IOMMUs, Peter Maydell, 2021/12/15
- [PULL 08/33] hw/intc/arm_gicv3: Introduce CONFIG_ARM_GIC_TCG Kconfig selector, Peter Maydell, 2021/12/15
- [PULL 32/33] tests/acpi: add expected blobs for VIOT test on q35 machine, Peter Maydell, 2021/12/15
- [PULL 25/33] hw/net: npcm7xx_emc fix missing queue_flush, Peter Maydell, 2021/12/15
- [PULL 26/33] hw/arm/virt-acpi-build: Add VIOT table for virtio-iommu, Peter Maydell, 2021/12/15
- [PULL 22/33] target/rx/cpu.h: Don't include qemu-common.h, Peter Maydell, 2021/12/15
- [PULL 23/33] hw/arm: Don't include qemu-common.h unnecessarily, Peter Maydell, 2021/12/15
- [PULL 30/33] tests/acpi: allow updates of VIOT expected data files, Peter Maydell, 2021/12/15
- [PULL 31/33] tests/acpi: add test case for VIOT, Peter Maydell, 2021/12/15