From 64f10fa075fe1af3265c77118cd0a22c4972f95a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jan 2019 16:46:34 -0500
Subject: [PATCH] target/arm: Fix validation of 32-bit address spaces for aa32
When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.
Fixes: ba97be9f4a4
Backports commit 36d820af0eddf4fc6a533579b052d8f0085a9fb8 from qemu
---
qemu/target/arm/helper.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/qemu/target/arm/helper.c b/qemu/target/arm/helper.c
index baffa3c0..ef978689 100644
--- a/qemu/target/arm/helper.c
+++ b/qemu/target/arm/helper.c
@@ -9618,7 +9618,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
uint64_t ttbr;
hwaddr descaddr, indexmask, indexmask_grainsize;
uint32_t tableattrs;
- target_ulong page_size, top_bits;
+ target_ulong page_size;
uint32_t attrs;
int32_t stride;
int addrsize, inputsize;
@@ -9659,12 +9659,19 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
* We determined the region when collecting the parameters, but we
* have not yet validated that the address is valid for the region.
* Extract the top bits and verify that they all match select.
+ *
+ * For aa32, if inputsize == addrsize, then we have selected the
+ * region by exclusion in aa32_va_parameters and there is no more
+ * validation to do here.
*/
- top_bits = sextract64(address, inputsize, addrsize - inputsize);
- if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
- /* In the gap between the two regions, this is a Translation fault */
- fault_type = ARMFault_Translation;
- goto do_fault;
+ if (inputsize < addrsize) {
+ target_ulong top_bits = sextract64(address, inputsize,
+ addrsize - inputsize);
+ if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
+ /* The gap between the two regions is a Translation fault */
+ fault_type = ARMFault_Translation;
+ goto do_fault;
+ }
}
if (param.using64k) {