From: Richard Henderson <richard.henderson@linaro.org>
To: qemu-devel@nongnu.org
Cc: qemu-ppc@nongnu.org, david@gibson.dropbear.id.au
Subject: [PATCH v4 16/17] linux-user/ppc: Fix msr updates for signal handling
Date: Mon, 15 Mar 2021 12:46:14 -0600 [thread overview]
Message-ID: <20210315184615.1985590-17-richard.henderson@linaro.org> (raw)
In-Reply-To: <20210315184615.1985590-1-richard.henderson@linaro.org>
In save_user_regs, there are two bugs where we OR in a bit number
instead of the bit, clobbering the low bits of MSR. However:
The MSR_VR and MSR_SPE bits control the availability of the insns.
If the bits were not already set in MSR, then any attempt to access
those registers would result in SIGILL.
For linux-user, we always initialize MSR to the capabilities
of the cpu. We *could* add checks vs MSR where we currently
check insn_flags and insn_flags2, but we know they match.
Also, there's a stray cut-and-paste comment in restore.
Then, do not force little-endian binaries into big-endian mode.
Finally, use ppc_store_msr for the update to affect hflags.
Which is the reason none of these bugs were previously noticed.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
linux-user/ppc/cpu_loop.c | 5 +++--
linux-user/ppc/signal.c | 23 +++++++++++------------
2 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/linux-user/ppc/cpu_loop.c b/linux-user/ppc/cpu_loop.c
index df71e15a25..4a0f6c8dc2 100644
--- a/linux-user/ppc/cpu_loop.c
+++ b/linux-user/ppc/cpu_loop.c
@@ -492,11 +492,12 @@ void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
#if defined(TARGET_PPC64)
int flag = (env->insns_flags2 & PPC2_BOOKE206) ? MSR_CM : MSR_SF;
#if defined(TARGET_ABI32)
- env->msr &= ~((target_ulong)1 << flag);
+ ppc_store_msr(env, env->msr & ~((target_ulong)1 << flag));
#else
- env->msr |= (target_ulong)1 << flag;
+ ppc_store_msr(env, env->msr | (target_ulong)1 << flag);
#endif
#endif
+
env->nip = regs->nip;
for(i = 0; i < 32; i++) {
env->gpr[i] = regs->gpr[i];
diff --git a/linux-user/ppc/signal.c b/linux-user/ppc/signal.c
index b78613f7c8..bad38f8ed9 100644
--- a/linux-user/ppc/signal.c
+++ b/linux-user/ppc/signal.c
@@ -261,9 +261,6 @@ static void save_user_regs(CPUPPCState *env, struct target_mcontext *frame)
__put_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);
__put_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);
}
- /* Set MSR_VR in the saved MSR value to indicate that
- frame->mc_vregs contains valid data. */
- msr |= MSR_VR;
#if defined(TARGET_PPC64)
vrsave = (uint32_t *)&frame->mc_vregs.altivec[33];
/* 64-bit needs to put a pointer to the vectors in the frame */
@@ -300,9 +297,6 @@ static void save_user_regs(CPUPPCState *env, struct target_mcontext *frame)
for (i = 0; i < ARRAY_SIZE(env->gprh); i++) {
__put_user(env->gprh[i], &frame->mc_vregs.spe[i]);
}
- /* Set MSR_SPE in the saved MSR value to indicate that
- frame->mc_vregs contains valid data. */
- msr |= MSR_SPE;
__put_user(env->spe_fscr, &frame->mc_vregs.spe[32]);
}
#endif
@@ -354,8 +348,10 @@ static void restore_user_regs(CPUPPCState *env,
__get_user(msr, &frame->mc_gregs[TARGET_PT_MSR]);
/* If doing signal return, restore the previous little-endian mode. */
- if (sig)
- env->msr = (env->msr & ~(1ull << MSR_LE)) | (msr & (1ull << MSR_LE));
+ if (sig) {
+ ppc_store_msr(env, ((env->msr & ~(1ull << MSR_LE)) |
+ (msr & (1ull << MSR_LE))));
+ }
/* Restore Altivec registers if necessary. */
if (env->insns_flags & PPC_ALTIVEC) {
@@ -376,8 +372,6 @@ static void restore_user_regs(CPUPPCState *env,
__get_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);
__get_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);
}
- /* Set MSR_VEC in the saved MSR value to indicate that
- frame->mc_vregs contains valid data. */
#if defined(TARGET_PPC64)
vrsave = (uint32_t *)&v_regs[33];
#else
@@ -468,7 +462,7 @@ void setup_frame(int sig, struct target_sigaction *ka,
env->nip = (target_ulong) ka->_sa_handler;
/* Signal handlers are entered in big-endian mode. */
- env->msr &= ~(1ull << MSR_LE);
+ ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));
unlock_user_struct(frame, frame_addr, 1);
return;
@@ -563,8 +557,13 @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
env->nip = (target_ulong) ka->_sa_handler;
#endif
+#ifdef TARGET_WORDS_BIGENDIAN
/* Signal handlers are entered in big-endian mode. */
- env->msr &= ~(1ull << MSR_LE);
+ ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));
+#else
+ /* Signal handlers are entered in little-endian mode. */
+ ppc_store_msr(env, env->msr | (1ull << MSR_LE));
+#endif
unlock_user_struct(rt_sf, rt_sf_addr, 1);
return;
--
2.25.1
next prev parent reply other threads:[~2021-03-15 19:05 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-15 18:45 [PATCH v4 00/17] target/ppc: Fix truncation of env->hflags Richard Henderson
2021-03-15 18:45 ` [PATCH v4 01/17] target/ppc: Move helper_regs.h functions out-of-line Richard Henderson
2021-03-16 8:12 ` Cédric Le Goater
2021-03-22 3:25 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 02/17] target/ppc: Move 601 hflags adjustment to hreg_compute_hflags Richard Henderson
2021-03-16 8:12 ` Cédric Le Goater
2021-03-22 3:35 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 03/17] target/ppc: Properly sync cpu state with new msr in cpu_load_old Richard Henderson
2021-03-16 8:15 ` Cédric Le Goater
2021-03-22 16:53 ` Richard Henderson
2021-03-22 23:19 ` David Gibson
2021-03-22 3:38 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 04/17] target/ppc: Do not call hreg_compute_mem_idx after ppc_store_msr Richard Henderson
2021-03-16 8:16 ` Cédric Le Goater
2021-03-22 3:39 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 05/17] target/ppc: Retain hflags_nmsr only for migration Richard Henderson
2021-03-16 8:16 ` Cédric Le Goater
2021-03-22 3:41 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 06/17] target/ppc: Fix comment for MSR_FE{0,1} Richard Henderson
2021-03-16 8:16 ` Cédric Le Goater
2021-03-22 3:42 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 07/17] target/ppc: Disconnect hflags from MSR Richard Henderson
2021-03-22 3:52 ` David Gibson
2021-03-22 16:55 ` Richard Henderson
2021-03-22 23:54 ` David Gibson
2021-03-23 17:04 ` Richard Henderson
2021-03-24 1:42 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 08/17] target/ppc: Reduce env->hflags to uint32_t Richard Henderson
2021-03-16 8:17 ` Cédric Le Goater
2021-03-22 3:53 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 09/17] target/ppc: Put dbcr0 single-step bits into hflags Richard Henderson
2021-03-22 3:55 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 10/17] target/ppc: Create helper_scv Richard Henderson
2021-03-22 4:00 ` David Gibson
2021-03-22 17:05 ` Richard Henderson
2021-03-22 23:55 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 11/17] target/ppc: Put LPCR[GTSE] in hflags Richard Henderson
2021-03-22 4:18 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 12/17] target/ppc: Remove MSR_SA and MSR_AP from hflags Richard Henderson
2021-03-22 4:20 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 13/17] target/ppc: Remove env->immu_idx and env->dmmu_idx Richard Henderson
2021-03-22 4:26 ` David Gibson
2021-03-22 17:27 ` Richard Henderson
2021-03-23 0:01 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 14/17] hw/ppc/pnv_core: Update hflags after setting msr Richard Henderson
2021-03-22 4:27 ` David Gibson
2021-03-15 18:46 ` [PATCH v4 15/17] hw/ppc/spapr_rtas: " Richard Henderson
2021-03-22 4:27 ` David Gibson
2021-03-15 18:46 ` Richard Henderson [this message]
2021-03-15 18:46 ` [PATCH v4 17/17] target/ppc: Validate hflags with CONFIG_DEBUG_TCG Richard Henderson
2021-03-16 8:11 ` [PATCH v4 00/17] target/ppc: Fix truncation of env->hflags Cédric Le Goater
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210315184615.1985590-17-richard.henderson@linaro.org \
--to=richard.henderson@linaro.org \
--cc=david@gibson.dropbear.id.au \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).