From: dodochicha <[email protected]> Reserved Svnapot PTE encodings must raise a page fault without modifying the PTE. Currently the A/D bits may be updated before the Svnapot encoding is validated.
Move the Svnapot validation before the A/D update so reserved PTEs fault without changing the PTE. Cc: [email protected] Signed-off-by: dodochicha <[email protected]> Message-ID: <[email protected]> Reviewed-by: Alistair Francis <[email protected]> Signed-off-by: Alistair Francis <[email protected]> --- target/riscv/tcg/cpu_helper.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index b22ecc2eeb..58e98e975c 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -1498,6 +1498,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL; } + if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) { + napot_bits = ctzl(ppn) + 1; + if ((i != (levels - 1)) || (napot_bits != 4)) { + return TRANSLATE_FAIL; + } + } + target_ulong updated_pte = pte; /* @@ -1590,13 +1597,6 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, /* For superpage mappings, make a fake leaf PTE for the TLB's benefit. */ target_ulong vpn = addr >> PGSHIFT; - if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) { - napot_bits = ctzl(ppn) + 1; - if ((i != (levels - 1)) || (napot_bits != 4)) { - return TRANSLATE_FAIL; - } - } - napot_mask = (1 << napot_bits) - 1; *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) | (vpn & (((target_ulong)1 << ptshift) - 1)) -- 2.55.0
