diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2019-01-29 11:46:03 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2019-01-29 11:46:03 +0000 |
| commit | 36d820af0eddf4fc6a533579b052d8f0085a9fb8 (patch) | |
| tree | fc11ba8cd6313c2007b652778ecf090a26dbae71 /target/arm/helper.c | |
| parent | 3a183e330dbd7dbcac3841737ac874979552cca2 (diff) | |
| download | qemu-36d820af0eddf4fc6a533579b052d8f0085a9fb8.zip | |
target/arm: Fix validation of 32-bit address spaces for aa32
When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.
Fixes: ba97be9f4a4
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190125184913.5970-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'target/arm/helper.c')
| -rw-r--r-- | target/arm/helper.c | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/target/arm/helper.c b/target/arm/helper.c index 92666e5208..e24689f767 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -10447,7 +10447,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, uint64_t ttbr; hwaddr descaddr, indexmask, indexmask_grainsize; uint32_t tableattrs; - target_ulong page_size, top_bits; + target_ulong page_size; uint32_t attrs; int32_t stride; int addrsize, inputsize; @@ -10487,12 +10487,19 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, * We determined the region when collecting the parameters, but we * have not yet validated that the address is valid for the region. * Extract the top bits and verify that they all match select. - */ - top_bits = sextract64(address, inputsize, addrsize - inputsize); - if (-top_bits != param.select || (param.select && !ttbr1_valid)) { - /* In the gap between the two regions, this is a Translation fault */ - fault_type = ARMFault_Translation; - goto do_fault; + * + * For aa32, if inputsize == addrsize, then we have selected the + * region by exclusion in aa32_va_parameters and there is no more + * validation to do here. + */ + if (inputsize < addrsize) { + target_ulong top_bits = sextract64(address, inputsize, + addrsize - inputsize); + if (-top_bits != param.select || (param.select && !ttbr1_valid)) { + /* The gap between the two regions is a Translation fault */ + fault_type = ARMFault_Translation; + goto do_fault; + } } if (param.using64k) { |