From nobody Sun May 5 13:14:35 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1669920346; cv=none; d=zohomail.com; s=zohoarc; b=j7DZ9lnUXMxtVo1Mkea42CsFJUgFng80as2h6/5trSyjXiUcyTzHjo5AqHXBqhtSqUr/xR+PIH8P5PCS2ZiNydx/7xjrx7V9YBzTtgsYrBiLnk3H1qP1zmngEZdJ8AcfvIEQcDce8eNyytV+BbtLpO5rMiwzrVwl9uJ1o+nJ27o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1669920346; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=iggJL6njhe9QxIYbvBTC2U/SfNx4+10AOuNqZ/ZorOg=; b=aFeqI8eh5r5NaUEThwCiYs1RFYqqarfi5b8afUhDznFfBuQr0AxOMY0p9flb4f6DUpP7OGNs0FhDBo+0Kp7sY3vTLPcAjfgjabO2CjKhTCoYipiB3nOzQVkqX0aEOV5NcgOU7UbW+FFf2knIjGOKslRdmS6H9/Y4FrSSGBQEVgI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1669920346357741.696978214598; Thu, 1 Dec 2022 10:45:46 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1p0oYM-0007Q5-1Q; Thu, 01 Dec 2022 13:44:58 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p0oYK-0007Pc-8c for qemu-devel@nongnu.org; Thu, 01 Dec 2022 13:44:56 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p0oYG-0002vx-Tg for qemu-devel@nongnu.org; Thu, 01 Dec 2022 13:44:56 -0500 Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-389-bXaa625bOWqgbRFtSQ--cA-1; Thu, 01 Dec 2022 13:44:50 -0500 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 117B43817963; Thu, 1 Dec 2022 18:44:50 +0000 (UTC) Received: from thuth.com (unknown [10.39.192.132]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8CDA34B3FC8; Thu, 1 Dec 2022 18:44:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1669920291; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=iggJL6njhe9QxIYbvBTC2U/SfNx4+10AOuNqZ/ZorOg=; b=B9WLmAkbXOoOA42JAxzcgKkAscaQTEstsTX4ilLP/28dcvotpZCXMTqvZAj/4EOQzT7X5w /gySZJxDkmXrgLT3GdeE8Et7A1O2VBGyJVmnYUV3UZ5uCKcVAzcoEKSLXIVJ23PeBy5WDS JovL5FJTCJlBQCipnoo8McfGDzC6lxc= X-MC-Unique: bXaa625bOWqgbRFtSQ--cA-1 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson , David Hildenbrand , Ilya Leoshkevich Cc: qemu-s390x@nongnu.org Subject: [PATCH v2 for-8.0] target/s390x/tcg: Fix and improve the SACF instruction Date: Thu, 1 Dec 2022 19:44:43 +0100 Message-Id: <20221201184443.136355-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1669920347203100002 Content-Type: text/plain; charset="utf-8" The SET ADDRESS SPACE CONTROL FAST instruction is not privileged, it can be used from problem space, too. Just the switching to the home address space is privileged and should still generate a privilege exception. This bug is e.g. causing programs like Java that use the "getcpu" vdso kernel function to crash (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D990417#26= ). While we're at it, also check if DAT is not enabled. In that case the instruction is supposed to generate a special operation exception. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/655 Signed-off-by: Thomas Huth Reviewed-by: David Hildenbrand Reviewed-by: Ilya Leoshkevich Reviewed-by: Richard Henderson --- target/s390x/tcg/insn-data.h.inc | 2 +- target/s390x/tcg/cc_helper.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/target/s390x/tcg/insn-data.h.inc b/target/s390x/tcg/insn-data.= h.inc index 7e952bdfc8..54d4250c9f 100644 --- a/target/s390x/tcg/insn-data.h.inc +++ b/target/s390x/tcg/insn-data.h.inc @@ -1365,7 +1365,7 @@ /* SERVICE CALL LOGICAL PROCESSOR (PV hypercall) */ F(0xb220, SERVC, RRE, Z, r1_o, r2_o, 0, 0, servc, 0, IF_PRIV | I= F_IO) /* SET ADDRESS SPACE CONTROL FAST */ - F(0xb279, SACF, S, Z, 0, a2, 0, 0, sacf, 0, IF_PRIV) + C(0xb279, SACF, S, Z, 0, a2, 0, 0, sacf, 0) /* SET CLOCK */ F(0xb204, SCK, S, Z, 0, m2_64a, 0, 0, sck, 0, IF_PRIV | IF_I= O) /* SET CLOCK COMPARATOR */ diff --git a/target/s390x/tcg/cc_helper.c b/target/s390x/tcg/cc_helper.c index b2e8d3d9f5..b36f8cdc8b 100644 --- a/target/s390x/tcg/cc_helper.c +++ b/target/s390x/tcg/cc_helper.c @@ -487,6 +487,10 @@ void HELPER(sacf)(CPUS390XState *env, uint64_t a1) { HELPER_LOG("%s: %16" PRIx64 "\n", __func__, a1); =20 + if (!(env->psw.mask & PSW_MASK_DAT)) { + tcg_s390_program_interrupt(env, PGM_SPECIAL_OP, GETPC()); + } + switch (a1 & 0xf00) { case 0x000: env->psw.mask &=3D ~PSW_MASK_ASC; @@ -497,6 +501,9 @@ void HELPER(sacf)(CPUS390XState *env, uint64_t a1) env->psw.mask |=3D PSW_ASC_SECONDARY; break; case 0x300: + if ((env->psw.mask & PSW_MASK_PSTATE) !=3D 0) { + tcg_s390_program_interrupt(env, PGM_PRIVILEGED, GETPC()); + } env->psw.mask &=3D ~PSW_MASK_ASC; env->psw.mask |=3D PSW_ASC_HOME; break; --=20 2.31.1