On Fri, Feb 23, 2024 at 02:09:42PM +0100, Paolo Bonzini wrote:
> Date: Fri, 23 Feb 2024 14:09:42 +0100
> From: Paolo Bonzini <pbonz...@redhat.com>
> Subject: [PATCH v2 1/7] target/i386: mask high bits of CR3 in 32-bit mode
> X-Mailer: git-send-email 2.43.0
>
> CR3 bits 63:32 are ignored in 32-bit mode (either legacy 2-level
> paging or PAE paging). Do this in mmu_translate() to remove
> the last case where get_physical_address() meaningfully drops
> the high bits of the address.
>
> Suggested-by: Richard Henderson <richard.hender...@linaro.org>
> Fixes: 4a1e9d4d11c ("target/i386: Use atomic operations for pte updates",
> 2022-10-18)
> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
> ---
> target/i386/tcg/sysemu/excp_helper.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Reviewed-by: Zhao Liu <zhao1....@intel.com>
>
> diff --git a/target/i386/tcg/sysemu/excp_helper.c
> b/target/i386/tcg/sysemu/excp_helper.c
> index 5b86f439add..11126c860d4 100644
> --- a/target/i386/tcg/sysemu/excp_helper.c
> +++ b/target/i386/tcg/sysemu/excp_helper.c
> @@ -238,7 +238,7 @@ static bool mmu_translate(CPUX86State *env, const
> TranslateParams *in,
> /*
> * Page table level 3
> */
> - pte_addr = ((in->cr3 & ~0x1f) + ((addr >> 27) & 0x18)) &
> a20_mask;
> + pte_addr = ((in->cr3 & 0xffffffe0ULL) + ((addr >> 27) & 0x18)) &
> a20_mask;
> if (!ptw_translate(&pte_trans, pte_addr)) {
> return false;
> }
> @@ -306,7 +306,7 @@ static bool mmu_translate(CPUX86State *env, const
> TranslateParams *in,
> /*
> * Page table level 2
> */
> - pte_addr = ((in->cr3 & ~0xfff) + ((addr >> 20) & 0xffc)) & a20_mask;
> + pte_addr = ((in->cr3 & 0xfffff000ULL) + ((addr >> 20) & 0xffc)) &
> a20_mask;
> if (!ptw_translate(&pte_trans, pte_addr)) {
> return false;
> }
> --
> 2.43.0
>
>
