diff options
| author | Ilya Leoshkevich <iii@linux.ibm.com> | 2023-11-06 10:31:22 +0100 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2023-11-07 19:27:08 +0100 |
| commit | aba2ec341c6d20c8dc3e6ecf87fa7c1a71e30c1e (patch) | |
| tree | bbbfc3c688b79cfdd4cf329a255f7af9fc8ff0d9 /target/s390x/tcg | |
| parent | ad63e6d69326a2db0ed5ab8c9277b5b504a919a8 (diff) | |
| download | qemu-aba2ec341c6d20c8dc3e6ecf87fa7c1a71e30c1e.zip qemu-aba2ec341c6d20c8dc3e6ecf87fa7c1a71e30c1e.tar.gz qemu-aba2ec341c6d20c8dc3e6ecf87fa7c1a71e30c1e.tar.bz2 | |
target/s390x: Fix CLC corrupting cc_src
CLC updates cc_src before accessing the second operand; if the latter
is inaccessible, the former ends up containing a bogus value.
Fix by reading cc_src into a temporary first.
Fixes: 4f7403d52b1c ("target-s390: Convert CLC")
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1865
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-ID: <20231106093605.1349201-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'target/s390x/tcg')
| -rw-r--r-- | target/s390x/tcg/translate.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c index 4bae150..a0d6a2a 100644 --- a/target/s390x/tcg/translate.c +++ b/target/s390x/tcg/translate.c @@ -2007,6 +2007,7 @@ static DisasJumpType op_cksm(DisasContext *s, DisasOps *o) static DisasJumpType op_clc(DisasContext *s, DisasOps *o) { int l = get_field(s, l1); + TCGv_i64 src; TCGv_i32 vl; MemOp mop; @@ -2016,9 +2017,11 @@ static DisasJumpType op_clc(DisasContext *s, DisasOps *o) case 4: case 8: mop = ctz32(l + 1) | MO_TE; - tcg_gen_qemu_ld_tl(cc_src, o->addr1, get_mem_index(s), mop); + /* Do not update cc_src yet: loading cc_dst may cause an exception. */ + src = tcg_temp_new_i64(); + tcg_gen_qemu_ld_tl(src, o->addr1, get_mem_index(s), mop); tcg_gen_qemu_ld_tl(cc_dst, o->in2, get_mem_index(s), mop); - gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, cc_src, cc_dst); + gen_op_update2_cc_i64(s, CC_OP_LTUGTU_64, src, cc_dst); return DISAS_NEXT; default: vl = tcg_constant_i32(l); |