Commit 9aea1ea3 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Peter Maydell
Browse files

target/arm: Fix 32-bit address truncation 



Commit ("3b39d734 target/arm: Handle page table walk load failures
correctly") modified both versions of the page table walking code (i.e.,
arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in
a temporary 'data' variable so that it can be inspected before being
returned. However, arm_ldq_ptw() returns an uint64_t, and using a
temporary uint32_t variable truncates the upper bits, corrupting the
result. This causes problems when using more than 4 GB of memory in
a TCG guest. So use a uint64_t instead.

Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Message-id: 20180119194648.25501-1-ard.biesheuvel@linaro.org
Reviewed-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 0f79bfe3

target/arm/helper.c

+1 −1
Original line number Diff line number Diff line
@@ -8360,7 +8360,7 @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 
    MemTxAttrs attrs = {};

    MemTxResult result = MEMTX_OK;

    AddressSpace *as;

    uint32_t data;

    uint64_t data;



    attrs.secure = is_secure;

    as = arm_addressspace(cs, attrs);