diff mbox series

[v5,09/10] linux-user/ppc: Fix msr updates for signal handling

Message ID 20210323184340.619757-10-richard.henderson@linaro.org
State Superseded
Headers show
Series target/ppc: Fix truncation of env->hflags | expand

Commit Message

Richard Henderson March 23, 2021, 6:43 p.m. UTC 
In save_user_regs, there are two bugs where we OR in a bit number
instead of the bit, clobbering the low bits of MSR.  However:

The MSR_VR and MSR_SPE bits control the availability of the insns.
If the bits were not already set in MSR, then any attempt to access
those registers would result in SIGILL.

For linux-user, we always initialize MSR to the capabilities
of the cpu.  We *could* add checks vs MSR where we currently
check insn_flags and insn_flags2, but we know they match.

Also, there's a stray cut-and-paste comment in restore.

Then, do not force little-endian binaries into big-endian mode.

Finally, use ppc_store_msr for the update to affect hflags.
Which is the reason none of these bugs were previously noticed.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

---
 linux-user/ppc/cpu_loop.c |  5 +++--
 linux-user/ppc/signal.c   | 23 +++++++++++------------
 2 files changed, 14 insertions(+), 14 deletions(-)

-- 
2.25.1

Comments

David Gibson March 24, 2021, 12:10 a.m. UTC | #1 
On Tue, Mar 23, 2021 at 12:43:39PM -0600, Richard Henderson wrote:
> In save_user_regs, there are two bugs where we OR in a bit number

> instead of the bit, clobbering the low bits of MSR.  However:

> 

> The MSR_VR and MSR_SPE bits control the availability of the insns.

> If the bits were not already set in MSR, then any attempt to access

> those registers would result in SIGILL.

> 

> For linux-user, we always initialize MSR to the capabilities

> of the cpu.  We *could* add checks vs MSR where we currently

> check insn_flags and insn_flags2, but we know they match.

> 

> Also, there's a stray cut-and-paste comment in restore.

> 

> Then, do not force little-endian binaries into big-endian mode.

> 

> Finally, use ppc_store_msr for the update to affect hflags.

> Which is the reason none of these bugs were previously noticed.

> 

> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>


Applied to ppc-for-6.0.

> ---

>  linux-user/ppc/cpu_loop.c |  5 +++--

>  linux-user/ppc/signal.c   | 23 +++++++++++------------

>  2 files changed, 14 insertions(+), 14 deletions(-)

> 

> diff --git a/linux-user/ppc/cpu_loop.c b/linux-user/ppc/cpu_loop.c

> index df71e15a25..4a0f6c8dc2 100644

> --- a/linux-user/ppc/cpu_loop.c

> +++ b/linux-user/ppc/cpu_loop.c

> @@ -492,11 +492,12 @@ void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)

>  #if defined(TARGET_PPC64)

>      int flag = (env->insns_flags2 & PPC2_BOOKE206) ? MSR_CM : MSR_SF;

>  #if defined(TARGET_ABI32)

> -    env->msr &= ~((target_ulong)1 << flag);

> +    ppc_store_msr(env, env->msr & ~((target_ulong)1 << flag));

>  #else

> -    env->msr |= (target_ulong)1 << flag;

> +    ppc_store_msr(env, env->msr | (target_ulong)1 << flag);

>  #endif

>  #endif

> +

>      env->nip = regs->nip;

>      for(i = 0; i < 32; i++) {

>          env->gpr[i] = regs->gpr[i];

> diff --git a/linux-user/ppc/signal.c b/linux-user/ppc/signal.c

> index b78613f7c8..bad38f8ed9 100644

> --- a/linux-user/ppc/signal.c

> +++ b/linux-user/ppc/signal.c

> @@ -261,9 +261,6 @@ static void save_user_regs(CPUPPCState *env, struct target_mcontext *frame)

>              __put_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);

>              __put_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);

>          }

> -        /* Set MSR_VR in the saved MSR value to indicate that

> -           frame->mc_vregs contains valid data.  */

> -        msr |= MSR_VR;

>  #if defined(TARGET_PPC64)

>          vrsave = (uint32_t *)&frame->mc_vregs.altivec[33];

>          /* 64-bit needs to put a pointer to the vectors in the frame */

> @@ -300,9 +297,6 @@ static void save_user_regs(CPUPPCState *env, struct target_mcontext *frame)

>          for (i = 0; i < ARRAY_SIZE(env->gprh); i++) {

>              __put_user(env->gprh[i], &frame->mc_vregs.spe[i]);

>          }

> -        /* Set MSR_SPE in the saved MSR value to indicate that

> -           frame->mc_vregs contains valid data.  */

> -        msr |= MSR_SPE;

>          __put_user(env->spe_fscr, &frame->mc_vregs.spe[32]);

>      }

>  #endif

> @@ -354,8 +348,10 @@ static void restore_user_regs(CPUPPCState *env,

>      __get_user(msr, &frame->mc_gregs[TARGET_PT_MSR]);

>  

>      /* If doing signal return, restore the previous little-endian mode.  */

> -    if (sig)

> -        env->msr = (env->msr & ~(1ull << MSR_LE)) | (msr & (1ull << MSR_LE));

> +    if (sig) {

> +        ppc_store_msr(env, ((env->msr & ~(1ull << MSR_LE)) |

> +                            (msr & (1ull << MSR_LE))));

> +    }

>  

>      /* Restore Altivec registers if necessary.  */

>      if (env->insns_flags & PPC_ALTIVEC) {

> @@ -376,8 +372,6 @@ static void restore_user_regs(CPUPPCState *env,

>              __get_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);

>              __get_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);

>          }

> -        /* Set MSR_VEC in the saved MSR value to indicate that

> -           frame->mc_vregs contains valid data.  */

>  #if defined(TARGET_PPC64)

>          vrsave = (uint32_t *)&v_regs[33];

>  #else

> @@ -468,7 +462,7 @@ void setup_frame(int sig, struct target_sigaction *ka,

>      env->nip = (target_ulong) ka->_sa_handler;

>  

>      /* Signal handlers are entered in big-endian mode.  */

> -    env->msr &= ~(1ull << MSR_LE);

> +    ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));

>  

>      unlock_user_struct(frame, frame_addr, 1);

>      return;

> @@ -563,8 +557,13 @@ void setup_rt_frame(int sig, struct target_sigaction *ka,

>      env->nip = (target_ulong) ka->_sa_handler;

>  #endif

>  

> +#ifdef TARGET_WORDS_BIGENDIAN

>      /* Signal handlers are entered in big-endian mode.  */

> -    env->msr &= ~(1ull << MSR_LE);

> +    ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));

> +#else

> +    /* Signal handlers are entered in little-endian mode.  */

> +    ppc_store_msr(env, env->msr | (1ull << MSR_LE));

> +#endif

>  

>      unlock_user_struct(rt_sf, rt_sf_addr, 1);

>      return;


-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson
diff mbox series

Patch

diff --git a/linux-user/ppc/cpu_loop.c b/linux-user/ppc/cpu_loop.c
index df71e15a25..4a0f6c8dc2 100644
--- a/linux-user/ppc/cpu_loop.c
+++ b/linux-user/ppc/cpu_loop.c
@@ -492,11 +492,12 @@  void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
 #if defined(TARGET_PPC64)
     int flag = (env->insns_flags2 & PPC2_BOOKE206) ? MSR_CM : MSR_SF;
 #if defined(TARGET_ABI32)
-    env->msr &= ~((target_ulong)1 << flag);
+    ppc_store_msr(env, env->msr & ~((target_ulong)1 << flag));
 #else
-    env->msr |= (target_ulong)1 << flag;
+    ppc_store_msr(env, env->msr | (target_ulong)1 << flag);
 #endif
 #endif
+
     env->nip = regs->nip;
     for(i = 0; i < 32; i++) {
         env->gpr[i] = regs->gpr[i];
diff --git a/linux-user/ppc/signal.c b/linux-user/ppc/signal.c
index b78613f7c8..bad38f8ed9 100644
--- a/linux-user/ppc/signal.c
+++ b/linux-user/ppc/signal.c
@@ -261,9 +261,6 @@  static void save_user_regs(CPUPPCState *env, struct target_mcontext *frame)
             __put_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);
             __put_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);
         }
-        /* Set MSR_VR in the saved MSR value to indicate that
-           frame->mc_vregs contains valid data.  */
-        msr |= MSR_VR;
 #if defined(TARGET_PPC64)
         vrsave = (uint32_t *)&frame->mc_vregs.altivec[33];
         /* 64-bit needs to put a pointer to the vectors in the frame */
@@ -300,9 +297,6 @@  static void save_user_regs(CPUPPCState *env, struct target_mcontext *frame)
         for (i = 0; i < ARRAY_SIZE(env->gprh); i++) {
             __put_user(env->gprh[i], &frame->mc_vregs.spe[i]);
         }
-        /* Set MSR_SPE in the saved MSR value to indicate that
-           frame->mc_vregs contains valid data.  */
-        msr |= MSR_SPE;
         __put_user(env->spe_fscr, &frame->mc_vregs.spe[32]);
     }
 #endif
@@ -354,8 +348,10 @@  static void restore_user_regs(CPUPPCState *env,
     __get_user(msr, &frame->mc_gregs[TARGET_PT_MSR]);
 
     /* If doing signal return, restore the previous little-endian mode.  */
-    if (sig)
-        env->msr = (env->msr & ~(1ull << MSR_LE)) | (msr & (1ull << MSR_LE));
+    if (sig) {
+        ppc_store_msr(env, ((env->msr & ~(1ull << MSR_LE)) |
+                            (msr & (1ull << MSR_LE))));
+    }
 
     /* Restore Altivec registers if necessary.  */
     if (env->insns_flags & PPC_ALTIVEC) {
@@ -376,8 +372,6 @@  static void restore_user_regs(CPUPPCState *env,
             __get_user(avr->u64[PPC_VEC_HI], &vreg->u64[0]);
             __get_user(avr->u64[PPC_VEC_LO], &vreg->u64[1]);
         }
-        /* Set MSR_VEC in the saved MSR value to indicate that
-           frame->mc_vregs contains valid data.  */
 #if defined(TARGET_PPC64)
         vrsave = (uint32_t *)&v_regs[33];
 #else
@@ -468,7 +462,7 @@  void setup_frame(int sig, struct target_sigaction *ka,
     env->nip = (target_ulong) ka->_sa_handler;
 
     /* Signal handlers are entered in big-endian mode.  */
-    env->msr &= ~(1ull << MSR_LE);
+    ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));
 
     unlock_user_struct(frame, frame_addr, 1);
     return;
@@ -563,8 +557,13 @@  void setup_rt_frame(int sig, struct target_sigaction *ka,
     env->nip = (target_ulong) ka->_sa_handler;
 #endif
 
+#ifdef TARGET_WORDS_BIGENDIAN
     /* Signal handlers are entered in big-endian mode.  */
-    env->msr &= ~(1ull << MSR_LE);
+    ppc_store_msr(env, env->msr & ~(1ull << MSR_LE));
+#else
+    /* Signal handlers are entered in little-endian mode.  */
+    ppc_store_msr(env, env->msr | (1ull << MSR_LE));
+#endif
 
     unlock_user_struct(rt_sf, rt_sf_addr, 1);
     return;