[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 31/36] tcg: Enforce single page access in probe_writ
From: |
Richard Henderson |
Subject: |
[Qemu-devel] [PATCH 31/36] tcg: Enforce single page access in probe_write() |
Date: |
Tue, 3 Sep 2019 09:08:53 -0700 |
From: David Hildenbrand <address@hidden>
Let's enforce the interface restriction.
Signed-off-by: David Hildenbrand <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
---
accel/tcg/cputlb.c | 2 ++
accel/tcg/user-exec.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 010c4c6e3c..707adf7631 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1088,6 +1088,8 @@ void probe_write(CPUArchState *env, target_ulong addr,
int size, int mmu_idx,
CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
target_ulong tlb_addr = tlb_addr_write(entry);
+ g_assert(-(addr | TARGET_PAGE_MASK) >= size);
+
if (unlikely(!tlb_hit(tlb_addr, addr))) {
if (!VICTIM_TLB_HIT(addr_write, addr)) {
tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE,
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 86e6827201..625c33f893 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -191,6 +191,8 @@ static inline int handle_cpu_signal(uintptr_t pc, siginfo_t
*info,
void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
uintptr_t retaddr)
{
+ g_assert(-(addr | TARGET_PAGE_MASK) >= size);
+
if (!guest_addr_valid(addr) ||
page_check_range(addr, size, PAGE_WRITE) < 0) {
CPUState *cpu = env_cpu(env);
--
2.17.1
- [Qemu-devel] [PATCH 23/36] exec: Factor out cpu_watchpoint_address_matches, (continued)
- [Qemu-devel] [PATCH 23/36] exec: Factor out cpu_watchpoint_address_matches, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 22/36] cputlb: Fold TLB_RECHECK into TLB_INVALID_MASK, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 25/36] cputlb: Remove double-alignment in store_helper, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 27/36] tcg: Check for watchpoints in probe_write(), Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 29/36] s390x/tcg: Fix length calculation in probe_write_access(), Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 26/36] cputlb: Handle watchpoints via TLB_WATCHPOINT, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 28/36] s390x/tcg: Use guest_addr_valid() instead of h2g_valid() in probe_write_access(), Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 30/36] tcg: Factor out CONFIG_USER_ONLY probe_write() from s390x code, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 31/36] tcg: Enforce single page access in probe_write(),
Richard Henderson <=
- [Qemu-devel] [PATCH 32/36] mips/tcg: Call probe_write() for CONFIG_USER_ONLY as well, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 33/36] hppa/tcg: Call probe_write() also for CONFIG_USER_ONLY, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 34/36] s390x/tcg: Pass a size to probe_write() in do_csst(), Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 35/36] tcg: Make probe_write() return a pointer to the host page, Richard Henderson, 2019/09/03
- [Qemu-devel] [PATCH 36/36] tcg: Factor out probe_write() logic into probe_access(), Richard Henderson, 2019/09/03
- Re: [Qemu-devel] [PATCH 00/36] tcg patch queue, Mark Cave-Ayland, 2019/09/03
- Re: [Qemu-devel] [PATCH 00/36] tcg patch queue, Philippe Mathieu-Daudé, 2019/09/03
- Re: [Qemu-devel] [PATCH 00/36] tcg patch queue, Peter Maydell, 2019/09/04