helper_lddir and helper_ldpte used TARGET_PHYS_MASK (bits 0-47) when extracting the base address from a directory entry. This retained flag bits (V, D, PLV, MAT, etc.) at positions 0-11, which were then OR'd with the next-level index, producing a wrong physical address whenever the directory entry carried non-zero flags.
Fix both helpers to extract only the PPN field (bits 12-47) before computing the address of the next-level page table entry. Signed-off-by: numpy1314 <[email protected]> --- target/loongarch/tcg/tlb_helper.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c index 40cc076424..529b22347d 100644 --- a/target/loongarch/tcg/tlb_helper.c +++ b/target/loongarch/tcg/tlb_helper.c @@ -750,7 +750,7 @@ target_ulong helper_lddir(CPULoongArchState *env, target_ulong base, } badvaddr = sys->CSR_TLBRBADV; - base = base & palen_mask; + base = base & palen_mask & ~MAKE_64BIT_MASK(0, 12); get_dir_base_width(env, &dir_base, &dir_width, level); index = (badvaddr >> dir_base) & ((1 << dir_width) - 1); phys = base | index << 3; @@ -773,7 +773,6 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd, uint64_t dir_base, dir_width; uint8_t ps; - /* * The parameter "base" has only two types, * one is the page table base address, @@ -815,9 +814,7 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd, } } else { badv = sys->CSR_TLBRBADV; - - base = base & palen_mask; - + base = base & palen_mask & ~MAKE_64BIT_MASK(0, 12); ptindex = (badv >> ptbase) & ((1 << ptwidth) - 1); ptindex = ptindex & ~0x1; /* clear bit 0 */ ptoffset0 = ptindex << 3; -- 2.55.0
