fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

target/s390x: Use address generation for register branch targets

Browse source 
Indirect branches to addresses taken from registers go through address
generation, e.g., for BRANCH ON CONDITION Principles of Operation says:

    In the RR format, the contents of general register R2 are used to
    generate the branch address

QEMU uses r2_nz handler for the respective register operands. Currently
it does not zero out extra bits in 24- and 31-bit addressing modes as
required by address generation. The very frequently used
s390x_tr_init_disas_context() function has a workaround for this,
but the code for saving an old PSW during an interrupt does not.

Add the missing masking to r2_nz. Enforce PSW validity by replacing the
workaround with an assertion.

Reported-by: Thomas Weißschuh <linux@weissschuh.net>
Reported-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/lkml/ab3131a2-c42a-47ff-bf03-e9f68ac053c0@t-8ch.de/
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Thomas Weißschuh <linux@weissschuh.net>
Message-ID: <20251016175954.41153-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
This commit is contained in:
Ilya Leoshkevich 2025-10-16 19:58:32 +02:00 • committed by Thomas Huth
parent dacfec5157
commit fc976a67de
1 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
target/s390x/tcg/translate.c
View file

@ -5613,6 +5613,7 @@ static void in2_r2_nz(DisasContext *s, DisasOps *o)
int r2 = get_field(s, r2);
if (r2 != 0) {
o->in2 = load_reg(r2);
gen_addi_and_wrap_i64(s, o->in2, o->in2, 0);
}
}
#define SPEC_in2_r2_nz 0
@ -6379,10 +6380,12 @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
{
DisasContext *dc = container_of(dcbase, DisasContext, base);
/* 31-bit mode */
if (!(dc->base.tb->flags & FLAG_MASK_64)) {
dc->base.pc_first &= 0x7fffffff;
dc->base.pc_next = dc->base.pc_first;
if (dc->base.tb->flags & FLAG_MASK_32) {
if (!(dc->base.tb->flags & FLAG_MASK_64)) {
assert(!(dc->base.pc_first & ~((1ULL << 31) - 1)));
}
} else {
assert(!(dc->base.pc_first & ~((1ULL << 24) - 1)));
}
dc->cc_op = CC_OP_DYNAMIC;