From nobody Sat Sep 26 20:51:08 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=krgm.moe Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17896181746941010.7711484631066; Wed, 16 Sep 2026 21:09:34 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x73Qb-0008Uh-Gz; Thu, 17 Sep 2026 00:08:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x73QX-0008UY-7R for qemu-devel@nongnu.org; Thu, 17 Sep 2026 00:08:49 -0400 Received: from krgm.moe ([103.47.186.116]) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x73QU-0004xc-45 for qemu-devel@nongnu.org; Thu, 17 Sep 2026 00:08:48 -0400 Received: from yuno-loong (unknown [103.47.186.116]) by krgm.moe (Postfix) with ESMTPSA id 5975181E; Thu, 17 Sep 2026 09:38:38 +0530 (IST) From: SignKirigami To: qemu-devel@nongnu.org Cc: Bibo Mao , SignKirigami , numpy1314 Subject: [PATCH] tcg/loongarch: strip flag bits in lddir/ldpte address calculation Date: Thu, 17 Sep 2026 12:08:28 +0800 Message-ID: <20260917040828.32648-1-prcups@krgm.moe> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.47.186.116; envelope-from=prcups@krgm.moe; helo=krgm.moe X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1789618178160158500 Content-Type: text/plain; charset="utf-8" helper_lddir and helper_ldpte used TARGET_PHYS_MASK (bits 0-47) when extracting the base address from a directory entry. This retained flag bits (V, D, PLV, MAT, etc.) at positions 0-11, which were then OR'd with the next-level index, producing a wrong physical address whenever the directory entry carried non-zero flags. Fix both helpers to extract only the PPN field (bits 12-47) before computing the address of the next-level page table entry. Signed-off-by: numpy1314 --- target/loongarch/tcg/tlb_helper.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_h= elper.c index 40cc076424..f63cac0392 100644 --- a/target/loongarch/tcg/tlb_helper.c +++ b/target/loongarch/tcg/tlb_helper.c @@ -750,7 +750,13 @@ target_ulong helper_lddir(CPULoongArchState *env, targ= et_ulong base, } =20 badvaddr =3D sys->CSR_TLBRBADV; - base =3D base & palen_mask; + /* + * Extract only the PPN field (bits 12-47) from the directory entry. + * Flag bits (V, D, PLV, MAT, etc.) at positions 0-11 must not + * participate in the next-level address calculation. + */ + base =3D (target_ulong)FIELD_EX64(base, TLBENTRY_64, PPN) + << TARGET_PAGE_BITS; get_dir_base_width(env, &dir_base, &dir_width, level); index =3D (badvaddr >> dir_base) & ((1 << dir_width) - 1); phys =3D base | index << 3; @@ -769,11 +775,9 @@ void helper_ldpte(CPULoongArchState *env, target_ulong= base, target_ulong odd, uint64_t badv; uint64_t ptbase =3D FIELD_EX64(sys->CSR_PWCL, CSR_PWCL, PTBASE); uint64_t ptwidth =3D FIELD_EX64(sys->CSR_PWCL, CSR_PWCL, PTWIDTH); - uint64_t palen_mask =3D loongarch_palen_mask(env); uint64_t dir_base, dir_width; uint8_t ps; =20 - /* * The parameter "base" has only two types, * one is the page table base address, @@ -815,9 +819,9 @@ void helper_ldpte(CPULoongArchState *env, target_ulong = base, target_ulong odd, } } else { badv =3D sys->CSR_TLBRBADV; - - base =3D base & palen_mask; - + /* Strip flag bits (0-11) from base before address calculation. */ + base =3D (target_ulong)FIELD_EX64(base, TLBENTRY_64, PPN) + << TARGET_PAGE_BITS; ptindex =3D (badv >> ptbase) & ((1 << ptwidth) - 1); ptindex =3D ptindex & ~0x1; /* clear bit 0 */ ptoffset0 =3D ptindex << 3; --=20 2.55.0