[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 01/26] target/arm: Fix validation of 32-bit address s
From: |
Peter Maydell |
Subject: |
[Qemu-devel] [PULL 01/26] target/arm: Fix validation of 32-bit address spaces for aa32 |
Date: |
Mon, 28 Jan 2019 18:10:22 +0000 |
From: Richard Henderson <address@hidden>
When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.
Fixes: ba97be9f4a4
Reported-by: Peter Maydell <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
---
target/arm/helper.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 92666e52085..e24689f7677 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -10447,7 +10447,7 @@ static bool get_phys_addr_lpae(CPUARMState *env,
target_ulong address,
uint64_t ttbr;
hwaddr descaddr, indexmask, indexmask_grainsize;
uint32_t tableattrs;
- target_ulong page_size, top_bits;
+ target_ulong page_size;
uint32_t attrs;
int32_t stride;
int addrsize, inputsize;
@@ -10487,12 +10487,19 @@ static bool get_phys_addr_lpae(CPUARMState *env,
target_ulong address,
* We determined the region when collecting the parameters, but we
* have not yet validated that the address is valid for the region.
* Extract the top bits and verify that they all match select.
+ *
+ * For aa32, if inputsize == addrsize, then we have selected the
+ * region by exclusion in aa32_va_parameters and there is no more
+ * validation to do here.
*/
- top_bits = sextract64(address, inputsize, addrsize - inputsize);
- if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
- /* In the gap between the two regions, this is a Translation fault */
- fault_type = ARMFault_Translation;
- goto do_fault;
+ if (inputsize < addrsize) {
+ target_ulong top_bits = sextract64(address, inputsize,
+ addrsize - inputsize);
+ if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
+ /* The gap between the two regions is a Translation fault */
+ fault_type = ARMFault_Translation;
+ goto do_fault;
+ }
}
if (param.using64k) {
--
2.20.1
- [Qemu-devel] [PULL 00/26] target-arm queue, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 01/26] target/arm: Fix validation of 32-bit address spaces for aa32,
Peter Maydell <=
- [Qemu-devel] [PULL 03/26] gdbstub: fix gdb_get_cpu(s, pid, tid) when pid and/or tid are 0, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 02/26] target/arm: v8m: Ensure IDAU is respected if SAU is disabled, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 08/26] MAINTAINERS: update microbit ARM board files, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 05/26] tests/microbit-test: add TWI stub device test, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 07/26] accel/tcg/user-exec: Don't parse aarch64 insns to test for read vs write, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 09/26] target/arm: Don't clear supported PMU events when initializing PMCEID1, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 10/26] memory: add memory_region_flush_rom_device(), Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 06/26] exec.c: Use correct attrs in cpu_memory_rw_debug(), Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 04/26] arm: Stub out NRF51 TWI magnetometer/accelerometer detection, Peter Maydell, 2019/01/28
- [Qemu-devel] [PULL 12/26] arm: Instantiate NRF51 special NVM's and NVMC, Peter Maydell, 2019/01/28