diff mbox series

[v2,1/5] target/s390x: Fix CLC corrupting cc_src

Message ID 20231106093605.1349201-2-iii@linux.ibm.com (mailing list archive)
State New, archived
Headers show
Series target/s390x: CC fixes | expand

Commit Message

Ilya Leoshkevich Nov. 6, 2023, 9:31 a.m. UTC
CLC updates cc_src before accessing the second operand; if the latter
is inaccessible, the former ends up containing a bogus value.

Fix by reading cc_src into a temporary first.

Fixes: 4f7403d52b1c ("target-s390: Convert CLC")
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
 target/s390x/tcg/translate.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

David Hildenbrand Nov. 6, 2023, 8:17 p.m. UTC | #1
On 06.11.23 10:31, Ilya Leoshkevich wrote:
> CLC updates cc_src before accessing the second operand; if the latter
> is inaccessible, the former ends up containing a bogus value.
> 
> Fix by reading cc_src into a temporary first.
> 
> Fixes: 4f7403d52b1c ("target-s390: Convert CLC")
> Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
> ---
>   target/s390x/tcg/translate.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
> index 4bae1509f50..a0d6a2a35dd 100644
> --- a/target/s390x/tcg/translate.c
> +++ b/target/s390x/tcg/translate.c
> @@ -2007,6 +2007,7 @@ static DisasJumpType op_cksm(DisasContext *s, DisasOps *o)
>   static DisasJumpType op_clc(DisasContext *s, DisasOps *o)
>   {
>       int l = get_field(s, l1);
> +    TCGv_i64 src;
>       TCGv_i32 vl;
>       MemOp mop;
>   
> @@ -2016,9 +2017,11 @@ static DisasJumpType op_clc(DisasContext *s, DisasOps *o)
>       case 4:
>       case 8:
>           mop = ctz32(l + 1) | MO_TE;
> -        tcg_gen_qemu_ld_tl(cc_src, o->addr1, get_mem_index(s), mop);
> +        /* Do not update cc_src yet: loading cc_dst may cause an exception. */
> +        src = tcg_temp_new_i64();
> +        tcg_gen_qemu_ld_tl(src, o->addr1, get_mem_index(s), mop);
>           tcg_gen_qemu_ld_tl(cc_dst, o->in2, get_mem_index(s), mop);
> -        gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, cc_src, cc_dst);
> +        gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, src, cc_dst);
>           return DISAS_NEXT;
>       default:
>           vl = tcg_constant_i32(l);

Reviewed-by: David Hildenbrand <david@redhat.com>
diff mbox series

Patch

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 4bae1509f50..a0d6a2a35dd 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -2007,6 +2007,7 @@  static DisasJumpType op_cksm(DisasContext *s, DisasOps *o)
 static DisasJumpType op_clc(DisasContext *s, DisasOps *o)
 {
     int l = get_field(s, l1);
+    TCGv_i64 src;
     TCGv_i32 vl;
     MemOp mop;
 
@@ -2016,9 +2017,11 @@  static DisasJumpType op_clc(DisasContext *s, DisasOps *o)
     case 4:
     case 8:
         mop = ctz32(l + 1) | MO_TE;
-        tcg_gen_qemu_ld_tl(cc_src, o->addr1, get_mem_index(s), mop);
+        /* Do not update cc_src yet: loading cc_dst may cause an exception. */
+        src = tcg_temp_new_i64();
+        tcg_gen_qemu_ld_tl(src, o->addr1, get_mem_index(s), mop);
         tcg_gen_qemu_ld_tl(cc_dst, o->in2, get_mem_index(s), mop);
-        gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, cc_src, cc_dst);
+        gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, src, cc_dst);
         return DISAS_NEXT;
     default:
         vl = tcg_constant_i32(l);