From 36d820af0eddf4fc6a533579b052d8f0085a9fb8 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Tue, 29 Jan 2019 11:46:03 +0000 Subject: [PATCH] target/arm: Fix validation of 32-bit address spaces for aa32 When tsz == 0, aarch32 selects the address space via exclusion, and there are no "top_bits" remaining that require validation. Fixes: ba97be9f4a4 Reported-by: Peter Maydell Signed-off-by: Richard Henderson Message-id: 20190125184913.5970-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- target/arm/helper.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index 92666e5208..e24689f767 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -10447,7 +10447,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, uint64_t ttbr; hwaddr descaddr, indexmask, indexmask_grainsize; uint32_t tableattrs; - target_ulong page_size, top_bits; + target_ulong page_size; uint32_t attrs; int32_t stride; int addrsize, inputsize; @@ -10487,12 +10487,19 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, * We determined the region when collecting the parameters, but we * have not yet validated that the address is valid for the region. * Extract the top bits and verify that they all match select. - */ - top_bits = sextract64(address, inputsize, addrsize - inputsize); - if (-top_bits != param.select || (param.select && !ttbr1_valid)) { - /* In the gap between the two regions, this is a Translation fault */ - fault_type = ARMFault_Translation; - goto do_fault; + * + * For aa32, if inputsize == addrsize, then we have selected the + * region by exclusion in aa32_va_parameters and there is no more + * validation to do here. + */ + if (inputsize < addrsize) { + target_ulong top_bits = sextract64(address, inputsize, + addrsize - inputsize); + if (-top_bits != param.select || (param.select && !ttbr1_valid)) { + /* The gap between the two regions is a Translation fault */ + fault_type = ARMFault_Translation; + goto do_fault; + } } if (param.using64k) { -- 2.11.4.GIT