On Tue, Mar 23, 2021 at 12:43:39PM -0600, Richard Henderson wrote: > In save_user_regs, there are two bugs where we OR in a bit number > instead of the bit, clobbering the low bits of MSR. However: > > The MSR_VR and MSR_SPE bits control the availability of the insns. > If the bits were not already set in MSR, then any attempt to access > those registers would result in SIGILL. > > For linux-user, we always initialize MSR to the capabilities > of the cpu. We *could* add checks vs MSR where we currently > check insn_flags and insn_flags2, but we know they match. > > Also, there's a stray cut-and-paste comment in restore. > > Then, do not force little-endian binaries into big-endian mode. > > Finally, use ppc_store_msr for the update to affect hflags. > Which is the reason none of these bugs were previously noticed. > > Signed-off-by: Richard Henderson <[email protected]>
Applied to ppc-for-6.0.
> ---
> linux-user/ppc/cpu_loop.c | 5 +++--
> linux-user/ppc/signal.c | 23 +++++++++++------------
> 2 files changed, 14 insertions(+), 14 deletions(-)
>
> diff --git a/linux-user/ppc/cpu_loop.c b/linux-user/ppc/cpu_loop.c
> index df71e15a25..4a0f6c8dc2 100644
> --- a/linux-user/ppc/cpu_loop.c
> +++ b/linux-user/ppc/cpu_loop.c
> @@ -492,11 +492,12 @@ void target_cpu_copy_regs(CPUArchState *env, struct
> target_pt_regs *regs)
> #if defined(TARGET_PPC64)
> int flag = (env->insns_flags2 & PPC2_BOOKE206) ? MSR_CM : MSR_SF;
> #if defined(TARGET_ABI32)
> - env->msr &= ~((target_ulong)1 << flag);
> + ppc_store_msr(env, env->msr & ~((target_ulong)1 << flag));
> #else
> - env->msr |= (target_ulong)1 << flag;
> + ppc_store_msr(env, env->msr | (target_ulong)1 << flag);
> #endif
> #endif
> +
> env->nip = regs->nip;
> for(i = 0; i < 32; i++) {
> env->gpr[i] = regs->gpr[i];
> diff --git a/linux-user/ppc/signal.c b/linux-user/ppc/signal.c
> index b78613f7c8..bad38f8ed9 100644
> --- a/linux-user/ppc/signal.c
> +++ b/linux-user/ppc/signal.c
> @@ -261,9 +261,6 @@ static void save_user_regs(CPUPPCState *env, struct
> target_mcontext *frame)
> __put_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);
> __put_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);
> }
> - /* Set MSR_VR in the saved MSR value to indicate that
> - frame->mc_vregs contains valid data. */
> - msr |= MSR_VR;
> #if defined(TARGET_PPC64)
> vrsave = (uint32_t *)&frame->mc_vregs.altivec[33];
> /* 64-bit needs to put a pointer to the vectors in the frame */
> @@ -300,9 +297,6 @@ static void save_user_regs(CPUPPCState *env, struct
> target_mcontext *frame)
> for (i = 0; i < ARRAY_SIZE(env->gprh); i++) {
> __put_user(env->gprh[i], &frame->mc_vregs.spe[i]);
> }
> - /* Set MSR_SPE in the saved MSR value to indicate that
> - frame->mc_vregs contains valid data. */
> - msr |= MSR_SPE;
> __put_user(env->spe_fscr, &frame->mc_vregs.spe[32]);
> }
> #endif
> @@ -354,8 +348,10 @@ static void restore_user_regs(CPUPPCState *env,
> __get_user(msr, &frame->mc_gregs[TARGET_PT_MSR]);
>
> /* If doing signal return, restore the previous little-endian mode. */
> - if (sig)
> - env->msr = (env->msr & ~(1ull << MSR_LE)) | (msr & (1ull << MSR_LE));
> + if (sig) {
> + ppc_store_msr(env, ((env->msr & ~(1ull << MSR_LE)) |
> + (msr & (1ull << MSR_LE))));
> + }
>
> /* Restore Altivec registers if necessary. */
> if (env->insns_flags & PPC_ALTIVEC) {
> @@ -376,8 +372,6 @@ static void restore_user_regs(CPUPPCState *env,
> __get_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);
> __get_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);
> }
> - /* Set MSR_VEC in the saved MSR value to indicate that
> - frame->mc_vregs contains valid data. */
> #if defined(TARGET_PPC64)
> vrsave = (uint32_t *)&v_regs[33];
> #else
> @@ -468,7 +462,7 @@ void setup_frame(int sig, struct target_sigaction *ka,
> env->nip = (target_ulong) ka->_sa_handler;
>
> /* Signal handlers are entered in big-endian mode. */
> - env->msr &= ~(1ull << MSR_LE);
> + ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));
>
> unlock_user_struct(frame, frame_addr, 1);
> return;
> @@ -563,8 +557,13 @@ void setup_rt_frame(int sig, struct target_sigaction *ka,
> env->nip = (target_ulong) ka->_sa_handler;
> #endif
>
> +#ifdef TARGET_WORDS_BIGENDIAN
> /* Signal handlers are entered in big-endian mode. */
> - env->msr &= ~(1ull << MSR_LE);
> + ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));
> +#else
> + /* Signal handlers are entered in little-endian mode. */
> + ppc_store_msr(env, env->msr | (1ull << MSR_LE));
> +#endif
>
> unlock_user_struct(rt_sf, rt_sf_addr, 1);
> return;
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
signature.asc
Description: PGP signature
