diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2024-03-11 08:56:44 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-03-18 22:53:23 +0100 |
| commit | 2cc68629a6fc198f4a972698bdd6477f883aedfb (patch) | |
| tree | 0e48b9abedb434cda8e5bbf4889609cff2707fe0 | |
| parent | ba49d760eb04630e7b15f423ebecf6c871b8f77b (diff) | |
| download | qemu-2cc68629a6fc198f4a972698bdd6477f883aedfb.zip qemu-2cc68629a6fc198f4a972698bdd6477f883aedfb.tar.gz qemu-2cc68629a6fc198f4a972698bdd6477f883aedfb.tar.bz2 | |
target/i386: fix direction of "32-bit MMU" test
The low bit of MMU indices for x86 TCG indicates whether the processor is
in 32-bit mode and therefore linear addresses have to be masked to 32 bits.
However, the index was computed incorrectly, leading to possible conflicts
in the TLB for any address above 4G.
Analyzed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: b1661801c18 ("target/i386: Fix physical address truncation", 2024-02-28)
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2206
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | target/i386/cpu.c | 2 | ||||
| -rw-r--r-- | target/i386/cpu.h | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/target/i386/cpu.c b/target/i386/cpu.c index 9a210d8..33760a2 100644 --- a/target/i386/cpu.c +++ b/target/i386/cpu.c @@ -7735,7 +7735,7 @@ static bool x86_cpu_has_work(CPUState *cs) static int x86_cpu_mmu_index(CPUState *cs, bool ifetch) { CPUX86State *env = cpu_env(cs); - int mmu_index_32 = (env->hflags & HF_CS64_MASK) ? 1 : 0; + int mmu_index_32 = (env->hflags & HF_CS64_MASK) ? 0 : 1; int mmu_index_base = (env->hflags & HF_CPL_MASK) == 3 ? MMU_USER64_IDX : !(env->hflags & HF_SMAP_MASK) ? MMU_KNOSMAP64_IDX : diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 952174b..6b05738 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -2334,7 +2334,7 @@ static inline bool is_mmu_index_32(int mmu_index) static inline int cpu_mmu_index_kernel(CPUX86State *env) { - int mmu_index_32 = (env->hflags & HF_LMA_MASK) ? 1 : 0; + int mmu_index_32 = (env->hflags & HF_LMA_MASK) ? 0 : 1; int mmu_index_base = !(env->hflags & HF_SMAP_MASK) ? MMU_KNOSMAP64_IDX : ((env->hflags & HF_CPL_MASK) < 3 && (env->eflags & AC_MASK)) ? MMU_KNOSMAP64_IDX : MMU_KSMAP64_IDX; |