[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-8.0.3 44/54] target/tricore: Add CHECK_REG_PAIR() for insn acces
From: |
Michael Tokarev |
Subject: |
[Stable-8.0.3 44/54] target/tricore: Add CHECK_REG_PAIR() for insn accessing 64 bit regs |
Date: |
Mon, 26 Jun 2023 21:49:51 +0300 |
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
some insns were not checking if an even index was used to access a 64
bit register. In the worst case that could lead to a buffer overflow as
reported in https://gitlab.com/qemu-project/qemu/-/issues/1698.
Reported-by: Siqi Chen <coc.cyqh@gmail.com>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230612113245.56667-4-kbastian@mail.uni-paderborn.de>
(cherry picked from commit 6991777ec4b2a344d47bddec62744bedd9883d78)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 1921b7bfb5..43920b20ee 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -305,6 +305,7 @@ static void gen_cmpswap(DisasContext *ctx, int reg, TCGv ea)
{
TCGv temp = tcg_temp_new();
TCGv temp2 = tcg_temp_new();
+ CHECK_REG_PAIR(reg);
tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
tcg_gen_movcond_tl(TCG_COND_EQ, temp2, cpu_gpr_d[reg+1], temp,
cpu_gpr_d[reg], temp);
@@ -317,7 +318,7 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
TCGv temp = tcg_temp_new();
TCGv temp2 = tcg_temp_new();
TCGv temp3 = tcg_temp_new();
-
+ CHECK_REG_PAIR(reg);
tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
tcg_gen_and_tl(temp2, cpu_gpr_d[reg], cpu_gpr_d[reg+1]);
tcg_gen_andc_tl(temp3, temp, cpu_gpr_d[reg+1]);
@@ -3215,6 +3216,7 @@ static void decode_src_opc(DisasContext *ctx, int op1)
break;
case OPC1_16_SRC_MOV_E:
if (has_feature(ctx, TRICORE_FEATURE_16)) {
+ CHECK_REG_PAIR(r1);
tcg_gen_movi_tl(cpu_gpr_d[r1], const4);
tcg_gen_sari_tl(cpu_gpr_d[r1+1], cpu_gpr_d[r1], 31);
} else {
@@ -6168,6 +6170,7 @@ static void decode_rr_divide(DisasContext *ctx)
tcg_gen_sari_tl(cpu_gpr_d[r3+1], cpu_gpr_d[r1], 31);
break;
case OPC2_32_RR_DVINIT_U:
+ CHECK_REG_PAIR(r3);
/* overflow = (D[b] == 0) */
tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
@@ -6196,6 +6199,7 @@ static void decode_rr_divide(DisasContext *ctx)
break;
case OPC2_32_RR_DIV:
if (has_feature(ctx, TRICORE_FEATURE_16)) {
+ CHECK_REG_PAIR(r3);
GEN_HELPER_RR(divide, cpu_gpr_d[r3], cpu_gpr_d[r3+1],
cpu_gpr_d[r1],
cpu_gpr_d[r2]);
} else {
@@ -6204,6 +6208,7 @@ static void decode_rr_divide(DisasContext *ctx)
break;
case OPC2_32_RR_DIV_U:
if (has_feature(ctx, TRICORE_FEATURE_16)) {
+ CHECK_REG_PAIR(r3);
GEN_HELPER_RR(divide_u, cpu_gpr_d[r3], cpu_gpr_d[r3+1],
cpu_gpr_d[r1], cpu_gpr_d[r2]);
} else {
@@ -6730,6 +6735,8 @@ static void decode_rrr2_msub(DisasContext *ctx)
cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
break;
case OPC2_32_RRR2_MSUB_U_64:
+ CHECK_REG_PAIR(r4);
+ CHECK_REG_PAIR(r3);
gen_msubu64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
break;
@@ -7813,7 +7820,7 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
break;
case OPC2_32_RRRW_IMASK:
temp2 = tcg_temp_new();
-
+ CHECK_REG_PAIR(r4);
tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
tcg_gen_movi_tl(temp2, (1 << width) - 1);
tcg_gen_shl_tl(temp2, temp2, temp);
--
2.39.2
- [PATCH 0/6] migration: Test the new "file:" migration, Fabiano Rosas, 2023/06/26
- [PATCH 2/6] tests/qtest: migration: Expose migrate_set_capability, Fabiano Rosas, 2023/06/26
- [PATCH 1/6] migration: Set migration status early in incoming side, Fabiano Rosas, 2023/06/26
- [PATCH 3/6] tests/qtest: migration: Add migrate_incoming_qmp helper, Fabiano Rosas, 2023/06/26
- [PATCH 4/6] tests/qtest: migration: Use migrate_incoming_qmp where appropriate, Fabiano Rosas, 2023/06/26
- [PATCH 5/6] tests/qtest: migration: Add support for negative testing of qmp_migrate, Fabiano Rosas, 2023/06/26
- [PATCH 6/6] tests/qtest: migration-test: Add tests for file-based migration, Fabiano Rosas, 2023/06/26