Indirect branches to addresses taken from registers go through address
generation, e.g., for BRANCH ON CONDITION Principles of Operation says:
In the RR format, the contents of general register R2 are used to
generate the branch address
QEMU uses r2_nz handler for the respective register operands. Currently
it does not zero out extra bits in 24- and 31-bit addressing modes as
required by address generation. The very frequently used
s390x_tr_init_disas_context() function has a workaround for this,
but the code for saving an old PSW during an interrupt does not.
Add the missing masking to r2_nz. Enforce PSW validity by replacing the
workaround with an assersion.
Reported-by: Thomas Weißschuh <linux@weissschuh.net>
Reported-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/lkml/ab3131a2-c42a-47ff-bf03-e9f68ac053c0@t-8ch.de/
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
---
target/s390x/tcg/translate.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index c7e8574438c..f9487f4044d 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -5613,6 +5613,7 @@ static void in2_r2_nz(DisasContext *s, DisasOps *o)
int r2 = get_field(s, r2);
if (r2 != 0) {
o->in2 = load_reg(r2);
+ gen_addi_and_wrap_i64(s, o->in2, o->in2, 0);
}
}
#define SPEC_in2_r2_nz 0
@@ -6379,10 +6380,12 @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
{
DisasContext *dc = container_of(dcbase, DisasContext, base);
- /* 31-bit mode */
- if (!(dc->base.tb->flags & FLAG_MASK_64)) {
- dc->base.pc_first &= 0x7fffffff;
- dc->base.pc_next = dc->base.pc_first;
+ if (dc->base.tb->flags & FLAG_MASK_32) {
+ if (!(dc->base.tb->flags & FLAG_MASK_64)) {
+ assert(!(dc->base.pc_first & ~((1ULL << 31) - 1)));
+ }
+ } else {
+ assert(!(dc->base.pc_first & ~((1ULL << 24) - 1)));
}
dc->cc_op = CC_OP_DYNAMIC;
--
2.51.0