From ac01ec6fe59458978b32624a6e93b5f2e55b593f Mon Sep 17 00:00:00 2001 From: Weiwei Li Date: Sat, 22 Apr 2023 21:03:27 +0800 Subject: [PATCH] accel/tcg: Uncache the host address for instruction fetch when tlb size < 1 When PMP entry overlap part of the page, we'll set the tlb_size to 1, which will make the address in tlb entry set with TLB_INVALID_MASK, and the next access will again go through tlb_fill.However, this way will not work in tb_gen_code() => get_page_addr_code_hostp(): the TLB host address will be cached, and the following instructions can use this host address directly which may lead to the bypass of PMP related check. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1542. Signed-off-by: Weiwei Li Signed-off-by: Junqiang Wang Reviewed-by: LIU Zhiwei Reviewed-by: Richard Henderson Message-Id: <20230422130329.23555-6-liweiwei@iscas.ac.cn> --- accel/tcg/cputlb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c index e984a98dc4..efa0cb67c9 100644 --- a/accel/tcg/cputlb.c +++ b/accel/tcg/cputlb.c @@ -1696,6 +1696,11 @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr, if (p == NULL) { return -1; } + + if (full->lg_page_size < TARGET_PAGE_BITS) { + return -1; + } + if (hostp) { *hostp = p; }