yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-03-28 22:47:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

target/arm: Fix validation of 32-bit address spaces for aa32

Browse source 
When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.

Fixes: ba97be9f4a4

Backports commit 36d820af0eddf4fc6a533579b052d8f0085a9fb8 from qemu
This commit is contained in:
Richard Henderson 2019-01-29 16:46:34 -05:00 committed by Lioncash
parent 3f0781e39b
commit 64f10fa075
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 13 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
qemu/target/arm/helper.c
View file

@ -9618,7 +9618,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
uint64_t ttbr;
hwaddr descaddr, indexmask, indexmask_grainsize;
uint32_t tableattrs;
target_ulong page_size, top_bits;
target_ulong page_size;
uint32_t attrs;
int32_t stride;
int addrsize, inputsize;
@ -9659,12 +9659,19 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
* We determined the region when collecting the parameters, but we
* have not yet validated that the address is valid for the region.
* Extract the top bits and verify that they all match select.
*
* For aa32, if inputsize == addrsize, then we have selected the
* region by exclusion in aa32_va_parameters and there is no more
* validation to do here.
*/
top_bits = sextract64(address, inputsize, addrsize - inputsize);
if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
/* In the gap between the two regions, this is a Translation fault */
fault_type = ARMFault_Translation;
goto do_fault;
if (inputsize < addrsize) {
target_ulong top_bits = sextract64(address, inputsize,
addrsize - inputsize);
if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
/* The gap between the two regions is a Translation fault */
fault_type = ARMFault_Translation;
goto do_fault;
}
}
if (param.using64k) {