| Message ID | 20231106093605.1349201-2-iii@linux.ibm.com |
|---|---|
| State | New |
| Headers | show |
| Series | target/s390x: CC fixes | expand |
On 06.11.23 10:31, Ilya Leoshkevich wrote: > CLC updates cc_src before accessing the second operand; if the latter > is inaccessible, the former ends up containing a bogus value. > > Fix by reading cc_src into a temporary first. > > Fixes: 4f7403d52b1c ("target-s390: Convert CLC") > Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865 > Cc: qemu-stable@nongnu.org > Reviewed-by: Richard Henderson <richard.henderson@linaro.org> > Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> > --- > target/s390x/tcg/translate.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c > index 4bae1509f50..a0d6a2a35dd 100644 > --- a/target/s390x/tcg/translate.c > +++ b/target/s390x/tcg/translate.c > @@ -2007,6 +2007,7 @@ static DisasJumpType op_cksm(DisasContext *s, DisasOps *o) > static DisasJumpType op_clc(DisasContext *s, DisasOps *o) > { > int l = get_field(s, l1); > + TCGv_i64 src; > TCGv_i32 vl; > MemOp mop; > > @@ -2016,9 +2017,11 @@ static DisasJumpType op_clc(DisasContext *s, DisasOps *o) > case 4: > case 8: > mop = ctz32(l + 1) | MO_TE; > - tcg_gen_qemu_ld_tl(cc_src, o->addr1, get_mem_index(s), mop); > + /* Do not update cc_src yet: loading cc_dst may cause an exception. */ > + src = tcg_temp_new_i64(); > + tcg_gen_qemu_ld_tl(src, o->addr1, get_mem_index(s), mop); > tcg_gen_qemu_ld_tl(cc_dst, o->in2, get_mem_index(s), mop); > - gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, cc_src, cc_dst); > + gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, src, cc_dst); > return DISAS_NEXT; > default: > vl = tcg_constant_i32(l); Reviewed-by: David Hildenbrand <david@redhat.com>
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c index 4bae1509f50..a0d6a2a35dd 100644 --- a/target/s390x/tcg/translate.c +++ b/target/s390x/tcg/translate.c @@ -2007,6 +2007,7 @@ static DisasJumpType op_cksm(DisasContext *s, DisasOps *o) static DisasJumpType op_clc(DisasContext *s, DisasOps *o) { int l = get_field(s, l1); + TCGv_i64 src; TCGv_i32 vl; MemOp mop; @@ -2016,9 +2017,11 @@ static DisasJumpType op_clc(DisasContext *s, DisasOps *o) case 4: case 8: mop = ctz32(l + 1) | MO_TE; - tcg_gen_qemu_ld_tl(cc_src, o->addr1, get_mem_index(s), mop); + /* Do not update cc_src yet: loading cc_dst may cause an exception. */ + src = tcg_temp_new_i64(); + tcg_gen_qemu_ld_tl(src, o->addr1, get_mem_index(s), mop); tcg_gen_qemu_ld_tl(cc_dst, o->in2, get_mem_index(s), mop); - gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, cc_src, cc_dst); + gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, src, cc_dst); return DISAS_NEXT; default: vl = tcg_constant_i32(l);
CLC updates cc_src before accessing the second operand; if the latter is inaccessible, the former ends up containing a bogus value. Fix by reading cc_src into a temporary first. Fixes: 4f7403d52b1c ("target-s390: Convert CLC") Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865 Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> --- target/s390x/tcg/translate.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)