Commit 36d820af authored by Richard Henderson's avatar Richard Henderson Committed by Peter Maydell
Browse files

target/arm: Fix validation of 32-bit address spaces for aa32 



When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.

Fixes: ba97be9f
Reported-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarRichard Henderson <richard.henderson@linaro.org>
Message-id: 20190125184913.5970-1-richard.henderson@linaro.org
Reviewed-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 3a183e33

target/arm/helper.c

+14 −7
Original line number Diff line number Diff line
@@ -10447,7 +10447,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 
    uint64_t ttbr;

    hwaddr descaddr, indexmask, indexmask_grainsize;

    uint32_t tableattrs;

    target_ulong page_size, top_bits;

    target_ulong page_size;

    uint32_t attrs;

    int32_t stride;

    int addrsize, inputsize;
@@ -10487,13 +10487,20 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 
     * We determined the region when collecting the parameters, but we

     * have not yet validated that the address is valid for the region.

     * Extract the top bits and verify that they all match select.

     *

     * For aa32, if inputsize == addrsize, then we have selected the

     * region by exclusion in aa32_va_parameters and there is no more

     * validation to do here.

     */

    top_bits = sextract64(address, inputsize, addrsize - inputsize);

    if (inputsize < addrsize) {

        target_ulong top_bits = sextract64(address, inputsize,

                                           addrsize - inputsize);

        if (-top_bits != param.select || (param.select && !ttbr1_valid)) {

        /* In the gap between the two regions, this is a Translation fault */

            /* The gap between the two regions is a Translation fault */

            fault_type = ARMFault_Translation;

            goto do_fault;

        }

    }



    if (param.using64k) {

        stride = 13;