* [PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions.
@ 2020-06-07 21:10 agrecascino123
2020-06-26 15:37 ` Richard Henderson
0 siblings, 1 reply; 2+ messages in thread
From: agrecascino123 @ 2020-06-07 21:10 UTC (permalink / raw)
To: qemu-devel; +Cc: Catherine A. Frederick, rth
From: "Catherine A. Frederick" <chocola@animebitch.es>
Signed-off-by: Catherine A. Frederick <chocola@animebitch.es>
---
Okay, I removed the bad "fix" on sar_i64, and the asserts in the various functions.
Crossing my fingers here.
tcg/ppc/tcg-target.inc.c | 34 +++++++++++++++++++++++++++++-----
1 file changed, 29 insertions(+), 5 deletions(-)
diff --git a/tcg/ppc/tcg-target.inc.c b/tcg/ppc/tcg-target.inc.c
index 7da67086c6..5cb1556912 100644
--- a/tcg/ppc/tcg-target.inc.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -2610,21 +2610,33 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
case INDEX_op_shl_i32:
if (const_args[2]) {
- tcg_out_shli32(s, args[0], args[1], args[2]);
+ /*
+ * Limit shift immediate to prevent illegal instruction
+ * from bitmask corruption
+ */
+ tcg_out_shli32(s, args[0], args[1], args[2] & 31);
} else {
tcg_out32(s, SLW | SAB(args[1], args[0], args[2]));
}
break;
case INDEX_op_shr_i32:
if (const_args[2]) {
- tcg_out_shri32(s, args[0], args[1], args[2]);
+ /*
+ * Both use RLWINM, which has a 5 bit field for the
+ * shift mask.
+ */
+ tcg_out_shri32(s, args[0], args[1], args[2] & 31);
} else {
tcg_out32(s, SRW | SAB(args[1], args[0], args[2]));
}
break;
case INDEX_op_sar_i32:
if (const_args[2]) {
- tcg_out32(s, SRAWI | RS(args[1]) | RA(args[0]) | SH(args[2]));
+ /*
+ * SRAWI has a 5 bit sized field for the shift mask
+ * as well.
+ */
+ tcg_out32(s, SRAWI | RS(args[1]) | RA(args[0]) | SH(args[2] & 31));
} else {
tcg_out32(s, SRAW | SAB(args[1], args[0], args[2]));
}
@@ -2696,20 +2708,32 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc, const TCGArg *args,
case INDEX_op_shl_i64:
if (const_args[2]) {
- tcg_out_shli64(s, args[0], args[1], args[2]);
+ /*
+ * Limit shift immediate to prevent illegal instruction from
+ * from bitmask corruption
+ */
+ tcg_out_shli64(s, args[0], args[1], args[2] & 63);
} else {
tcg_out32(s, SLD | SAB(args[1], args[0], args[2]));
}
break;
case INDEX_op_shr_i64:
if (const_args[2]) {
- tcg_out_shri64(s, args[0], args[1], args[2]);
+ /*
+ * Same applies here, as both RLDICL, and RLDICR have a
+ * 6 bit large mask for the shift value
+ */
+ tcg_out_shri64(s, args[0], args[1], args[2] & 63);
} else {
tcg_out32(s, SRD | SAB(args[1], args[0], args[2]));
}
break;
case INDEX_op_sar_i64:
if (const_args[2]) {
+ /*
+ * Already done here, as it's a split field, and
+ * somebody noticed it would have overflowed.
+ */
int sh = SH(args[2] & 0x1f) | (((args[2] >> 5) & 1) << 1);
tcg_out32(s, SRADI | RA(args[0]) | RS(args[1]) | sh);
} else {
--
2.26.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions.
2020-06-07 21:10 [PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions agrecascino123
@ 2020-06-26 15:37 ` Richard Henderson
0 siblings, 0 replies; 2+ messages in thread
From: Richard Henderson @ 2020-06-26 15:37 UTC (permalink / raw)
To: agrecascino123, qemu-devel; +Cc: Catherine A. Frederick, rth
On 6/7/20 2:10 PM, agrecascino123@gmail.com wrote:
> From: "Catherine A. Frederick" <chocola@animebitch.es>
>
> Signed-off-by: Catherine A. Frederick <chocola@animebitch.es>
> ---
> Okay, I removed the bad "fix" on sar_i64, and the asserts in the various functions.
> Crossing my fingers here.
>
> tcg/ppc/tcg-target.inc.c | 34 +++++++++++++++++++++++++++++-----
> 1 file changed, 29 insertions(+), 5 deletions(-)
Sorry for losing track of this. Now queued to tcg-next.
r~
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-06-26 15:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-07 21:10 [PATCH v5] tcg: Sanitize shift constants on ppc64le so that shift operations with large constants don't generate invalid instructions agrecascino123
2020-06-26 15:37 ` Richard Henderson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).