Book-E architecture does not set the error code in 31:27 bits
of SRR1, but instead uses these bits for custom fields such
as GS (Guest Supervisor).

Wrongly setting these fields will result in QEMU crashes
when attempting to execute not executable code due to the attempts
to use Guest Supervisor mode.

Cc: "Cédric Le Goater" <clg@kaod.org>
Cc: Daniel Henrique Barboza <danielhb413@gmail.com>
Cc: David Gibson <david@gibson.dropbear.id.au>
Cc: Greg Kurz <groug@kaod.org>
Cc: qemu-ppc@nongnu.org
Cc: qemu-devel@nongnu.org
Cc: qemu-stable@nongnu.org
Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
---
 target/ppc/mmu_common.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
index 91270c1f17..6512ee031c 100644
--- a/target/ppc/mmu_common.c
+++ b/target/ppc/mmu_common.c
@@ -1367,22 +1367,34 @@ static bool ppc_jumbo_xlate(PowerPCCPU *cpu, vaddr eaddr,
             case -2:
                 /* Access rights violation */
                 cs->exception_index = POWERPC_EXCP_ISI;
-                env->error_code = 0x08000000;
+                if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
+                    (env->mmu_model == POWERPC_MMU_BOOKE206)) {
+                    env->error_code = 0;
+                } else {
+                    env->error_code = 0x08000000;
+                }
                 break;
             case -3:
                 /* No execute protection violation */
                 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
                     (env->mmu_model == POWERPC_MMU_BOOKE206)) {
                     env->spr[SPR_BOOKE_ESR] = 0x00000000;
+                    env->error_code = 0;
+                } else {
+                    env->error_code = 0x10000000;
                 }
                 cs->exception_index = POWERPC_EXCP_ISI;
-                env->error_code = 0x10000000;
                 break;
             case -4:
                 /* Direct store exception */
                 /* No code fetch is allowed in direct-store areas */
                 cs->exception_index = POWERPC_EXCP_ISI;
-                env->error_code = 0x10000000;
+                if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
+                    (env->mmu_model == POWERPC_MMU_BOOKE206)) {
+                    env->error_code = 0;
+                } else {
+                    env->error_code = 0x10000000;
+                }
                 break;
             }
         } else {
-- 
2.32.0 (Apple Git-132)

On 1/21/22 10:31, Vitaly Cheptsov wrote:
> Book-E architecture does not set the error code in 31:27 bits
> of SRR1, but instead uses these bits for custom fields such
> as GS (Guest Supervisor).
> 
> Wrongly setting these fields will result in QEMU crashes
> when attempting to execute not executable code due to the attempts
> to use Guest Supervisor mode.
> 
> Cc: "Cédric Le Goater" <clg@kaod.org>
> Cc: Daniel Henrique Barboza <danielhb413@gmail.com>
> Cc: David Gibson <david@gibson.dropbear.id.au>
> Cc: Greg Kurz <groug@kaod.org>
> Cc: qemu-ppc@nongnu.org
> Cc: qemu-devel@nongnu.org
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Thanks,

C.


> ---
>   target/ppc/mmu_common.c | 18 +++++++++++++++---
>   1 file changed, 15 insertions(+), 3 deletions(-)
> 
> diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
> index 91270c1f17..6512ee031c 100644
> --- a/target/ppc/mmu_common.c
> +++ b/target/ppc/mmu_common.c
> @@ -1367,22 +1367,34 @@ static bool ppc_jumbo_xlate(PowerPCCPU *cpu, vaddr eaddr,
>               case -2:
>                   /* Access rights violation */
>                   cs->exception_index = POWERPC_EXCP_ISI;
> -                env->error_code = 0x08000000;
> +                if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
> +                    (env->mmu_model == POWERPC_MMU_BOOKE206)) {
> +                    env->error_code = 0;
> +                } else {
> +                    env->error_code = 0x08000000;
> +                }
>                   break;
>               case -3:
>                   /* No execute protection violation */
>                   if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
>                       (env->mmu_model == POWERPC_MMU_BOOKE206)) {
>                       env->spr[SPR_BOOKE_ESR] = 0x00000000;
> +                    env->error_code = 0;
> +                } else {
> +                    env->error_code = 0x10000000;
>                   }
>                   cs->exception_index = POWERPC_EXCP_ISI;
> -                env->error_code = 0x10000000;
>                   break;
>               case -4:
>                   /* Direct store exception */
>                   /* No code fetch is allowed in direct-store areas */
>                   cs->exception_index = POWERPC_EXCP_ISI;
> -                env->error_code = 0x10000000;
> +                if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
> +                    (env->mmu_model == POWERPC_MMU_BOOKE206)) {
> +                    env->error_code = 0;
> +                } else {
> +                    env->error_code = 0x10000000;
> +                }
>                   break;
>               }
>           } else {
>