diff options
| author | Weiwei Li <liweiwei@iscas.ac.cn> | 2023-04-22 21:03:27 +0800 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2023-05-02 12:31:50 -0700 |
| commit | ac01ec6fe59458978b32624a6e93b5f2e55b593f (patch) | |
| tree | 86d9a5bf3091c8eaaeac730495f90d8a343f5b58 /accel | |
| parent | 6a6447fe252e2f1c48d6e8cc1bd36515852e8040 (diff) | |
| download | qemu-ac01ec6fe59458978b32624a6e93b5f2e55b593f.zip qemu-ac01ec6fe59458978b32624a6e93b5f2e55b593f.tar.gz qemu-ac01ec6fe59458978b32624a6e93b5f2e55b593f.tar.bz2 | |
accel/tcg: Uncache the host address for instruction fetch when tlb size < 1
When PMP entry overlap part of the page, we'll set the tlb_size to 1, which
will make the address in tlb entry set with TLB_INVALID_MASK, and the next
access will again go through tlb_fill.However, this way will not work in
tb_gen_code() => get_page_addr_code_hostp(): the TLB host address will be
cached, and the following instructions can use this host address directly
which may lead to the bypass of PMP related check.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1542.
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230422130329.23555-6-liweiwei@iscas.ac.cn>
Diffstat (limited to 'accel')
| -rw-r--r-- | accel/tcg/cputlb.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c index e984a98..efa0cb6 100644 --- a/accel/tcg/cputlb.c +++ b/accel/tcg/cputlb.c @@ -1696,6 +1696,11 @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr, if (p == NULL) { return -1; } + + if (full->lg_page_size < TARGET_PAGE_BITS) { + return -1; + } + if (hostp) { *hostp = p; } |