target/ppc: use MAKE_64BIT_MASK for mcrfs exception clear mask

[PATCH] target/ppc: use MAKE_64BIT_MASK for mcrfs exception clear mask

Posted by Denis Sergeev 1 week, 6 days ago

In gen_mcrfs() the FPSCR nibble mask is computed as:
      `~((0xF << shift) & FP_EX_CLEAR_BITS)`

Here, 0xF is of type int, so the left shift is performed in
32-bit signed arithmetic. For bfa=0 we get shift=28,
and (0xF << 28) = 0xF0000000, which is not representable as a 32-bit
signed int. Static analyzers flag this as a potential integer
overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Sergeev <zeff@altlinux.org>
---
 target/ppc/translate/fp-impl.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
index a66b83398b..d01c0b5aba 100644
--- a/target/ppc/translate/fp-impl.c.inc
+++ b/target/ppc/translate/fp-impl.c.inc
@@ -479,7 +479,7 @@ static void gen_mcrfs(DisasContext *ctx)
     tcg_gen_extu_tl_i64(tnew_fpscr, cpu_fpscr);
     /* Only the exception bits (including FX) should be cleared if read */
     tcg_gen_andi_i64(tnew_fpscr, tnew_fpscr,
-                     ~((0xF << shift) & FP_EX_CLEAR_BITS));
+                     ~(MAKE_64BIT_MASK(shift, 4) & FP_EX_CLEAR_BITS));
     /* FEX and VX need to be updated, so don't set fpscr directly */
     tmask = tcg_constant_i32(1 << nibble);
     gen_helper_store_fpscr(tcg_env, tnew_fpscr, tmask);
-- 
2.50.1

Re: [PATCH] target/ppc: use MAKE_64BIT_MASK for mcrfs exception clear mask

Posted by Chinmay Rath 1 week, 6 days ago

On 9/15/25 13:31, Denis Sergeev wrote:
> In gen_mcrfs() the FPSCR nibble mask is computed as:
>        `~((0xF << shift) & FP_EX_CLEAR_BITS)`
>
> Here, 0xF is of type int, so the left shift is performed in
> 32-bit signed arithmetic. For bfa=0 we get shift=28,
> and (0xF << 28) = 0xF0000000, which is not representable as a 32-bit
> signed int. Static analyzers flag this as a potential integer
> overflow.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Denis Sergeev <zeff@altlinux.org>
> ---
>   target/ppc/translate/fp-impl.c.inc | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
> index a66b83398b..d01c0b5aba 100644
> --- a/target/ppc/translate/fp-impl.c.inc
> +++ b/target/ppc/translate/fp-impl.c.inc
> @@ -479,7 +479,7 @@ static void gen_mcrfs(DisasContext *ctx)
>       tcg_gen_extu_tl_i64(tnew_fpscr, cpu_fpscr);
>       /* Only the exception bits (including FX) should be cleared if read */
>       tcg_gen_andi_i64(tnew_fpscr, tnew_fpscr,
> -                     ~((0xF << shift) & FP_EX_CLEAR_BITS));
> +                     ~(MAKE_64BIT_MASK(shift, 4) & FP_EX_CLEAR_BITS));
>       /* FEX and VX need to be updated, so don't set fpscr directly */
>       tmask = tcg_constant_i32(1 << nibble);
>       gen_helper_store_fpscr(tcg_env, tnew_fpscr, tmask);
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>

Thanks,

Chinmay