mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

target/s390x: Fix CLC corrupting cc_src

Browse Source 
CLC updates cc_src before accessing the second operand; if the latter
is inaccessible, the former ends up containing a bogus value.

Fix by reading cc_src into a temporary first.

Fixes: 4f7403d52b ("target-s390: Convert CLC")
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-ID: <20231106093605.1349201-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit aba2ec341c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Ilya Leoshkevich 2023-11-06 10:31:22 +01:00 committed by Michael Tokarev
parent 07c2a9c0fa
commit 88b778e4c2
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
target/s390x/tcg/translate.c
View File

@ -2007,6 +2007,7 @@ static DisasJumpType op_cksm(DisasContext *s, DisasOps *o)
static DisasJumpType op_clc(DisasContext *s, DisasOps *o)
{
int l = get_field(s, l1);
TCGv_i64 src;
TCGv_i32 vl;
MemOp mop;
@ -2016,9 +2017,11 @@ static DisasJumpType op_clc(DisasContext *s, DisasOps *o)
case 4:
case 8:
mop = ctz32(l + 1) | MO_TE;
tcg_gen_qemu_ld_tl(cc_src, o->addr1, get_mem_index(s), mop);
/* Do not update cc_src yet: loading cc_dst may cause an exception. */
src = tcg_temp_new_i64();
tcg_gen_qemu_ld_tl(src, o->addr1, get_mem_index(s), mop);
tcg_gen_qemu_ld_tl(cc_dst, o->in2, get_mem_index(s), mop);
gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, cc_src, cc_dst);
gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, src, cc_dst);
return DISAS_NEXT;
default:
vl = tcg_constant_i32(l);