mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
be355a44ca
qemu/target/xtensa
History
Max Filippov 604927e357 target/xtensa: fix OOB TLB entry access 
r[id]tlb[01], [iw][id]tlb opcodes use TLB way index passed in a register
by the guest. The host uses 3 bits of the index for ITLB indexing and 4
bits for DTLB, but there's only 7 entries in the ITLB array and 10 in
the DTLB array, so a malicious guest may trigger out-of-bound access to
these arrays.

Change split_tlb_entry_spec return type to bool to indicate whether TLB
way passed to it is valid. Change get_tlb_entry to return NULL in case
invalid TLB way is requested. Add assertion to xtensa_tlb_get_entry that
requested TLB way and entry indices are valid. Add checks to the
[rwi]tlb helpers that requested TLB way is valid and return 0 or do
nothing when it's not.

Cc: qemu-stable@nongnu.org
Fixes: b67ea0cd74 ("target-xtensa: implement memory protection options")
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20231215120307.545381-1-jcmvbkbc@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-01-26 11:30:47 +00:00
..
core-dc232b meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-dc233c meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-de212 meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-de233_fpu Clean up decorations and whitespace around header guards 2022-05-11 16:50:32 +02:00
core-dsp3400 Clean up decorations and whitespace around header guards 2022-05-11 16:50:32 +02:00
core-fsf meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-lx106 target/xtensa: import core lx106 2022-05-06 15:27:40 -07:00
core-sample_controller meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-test_kc705_be meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-test_mmuhifi_c3 meson: rename included C source files to .c.inc 2020-08-21 06:18:30 -04:00
core-dc232b.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-dc233c.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-de212.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-de233_fpu.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-dsp3400.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-fsf.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-lx106.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-sample_controller.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-test_kc705_be.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
core-test_mmuhifi_c3.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
cores.list target/xtensa: import core lx106 2022-05-06 15:27:40 -07:00
cpu-param.h target/xtensa: Remove NB_MMU_MODES define 2023-03-13 06:44:37 -07:00
cpu-qom.h target: Move ArchCPUClass definition to 'cpu.h' 2023-11-07 13:08:48 +01:00
cpu.c target/xtensa: use generic instruction breakpoint infrastructure 2024-01-19 12:28:59 +01:00
cpu.h target/xtensa: use generic instruction breakpoint infrastructure 2024-01-19 12:28:59 +01:00
dbg_helper.c target/xtensa: use generic instruction breakpoint infrastructure 2024-01-19 12:28:59 +01:00
exc_helper.c system/cpus: rename qemu_mutex_lock_iothread() to bql_lock() 2024-01-08 10:45:43 -05:00
fpu_helper.c target/helpers: Remove unnecessary 'qemu/main-loop.h' header 2023-08-31 19:47:43 +02:00
gdbstub.c gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
helper.c target/xtensa: use generic instruction breakpoint infrastructure 2024-01-19 12:28:59 +01:00
helper.h target/xtensa: implement FPU division and square root 2020-08-21 12:48:15 -07:00
import_core.sh gdbstub: move register helpers into standalone include 2023-03-07 20:44:08 +00:00
Kconfig meson: Introduce target-specific Kconfig 2021-07-09 18:21:34 +02:00
meson.build meson: Rename target_softmmu_arch -> target_system_arch 2023-10-07 19:03:07 +02:00
mmu_helper.c target/xtensa: fix OOB TLB entry access 2024-01-26 11:30:47 +00:00
monitor.c hmp: Pass monitor to mon_get_cpu_env() 2020-11-13 12:45:51 +00:00
op_helper.c target/xtensa: Use env_archcpu() in update_c[compare|count]() 2023-11-07 12:13:27 +01:00
overlay_tool.h Replace TARGET_WORDS_BIGENDIAN 2022-04-06 10:50:37 +02:00
translate.c target/xtensa: use generic instruction breakpoint infrastructure 2024-01-19 12:28:59 +01:00
win_helper.c target/helpers: Remove unnecessary 'qemu/main-loop.h' header 2023-08-31 19:47:43 +02:00
xtensa-isa-internal.h Clean up decorations and whitespace around header guards 2019-05-13 08:58:55 +02:00
xtensa-isa.c Clean up includes 2018-02-09 05:05:11 +01:00
xtensa-isa.h Use #include "..." for our own headers, <...> for others 2018-02-09 05:05:11 +01:00
xtensa-semi.c target/xtensa/xtensa-semi: Fix compilation problem on Haiku 2021-07-09 18:42:46 +02:00