From nobody Fri Aug 28 00:13:27 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=qq.com ARC-Seal: i=1; a=rsa-sha256; t=1786699690; cv=none; d=zohomail.com; s=zohoarc; b=DvFucJ70Fmb7zvKVKrWQ2BQSMYqycWFe9bU2Gzuueknsm59bPVoeOBLVv/oC1tjxzmGS2vedcLx7tWmLQiTKMyAPJs15OjFLRBA7A0kzJuDyQdOc4+PYjMgQ3Va0umiujwIXul1cA85qX84DT0bN4F7N/FAeff95/+WSmDyH7II= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1786699690; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=O0lDOfouMdo8i2BuxKzy9r8LJlvLyh+vzzzpsTcJAD4=; b=hmq4qUR59iBsm97Dw+fQA44SwJ7+96bg1IUftamrFcsHJ2gSDQk53KuyCSKy8+GzBF4rL33GC9JPKv8Z6B5VeSRxq+8Gplk3aoYOox8nrtpehBpqFFW+Cg0cjVUarl3TBqOKH5IhQtyKGY1QXgjRKZuS7jRsEhmd0fx8RX9XGzM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1786699690088995.7051239165169; Fri, 14 Aug 2026 02:28:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wuoCk-0003Hl-4W; Fri, 14 Aug 2026 05:27:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuoCh-0003Gr-DE; Fri, 14 Aug 2026 05:27:56 -0400 Received: from out162-62-58-216.mail.qq.com ([162.62.58.216]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wuoCe-0003rR-Eq; Fri, 14 Aug 2026 05:27:55 -0400 Received: from minhang-zhang-KVM.. ([116.128.244.169]) by newxmesmtplogicsvrszb51-1.qq.com (NewEsmtp) with SMTP id 6D616A0C; Fri, 14 Aug 2026 17:27:22 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1786699662; bh=O0lDOfouMdo8i2BuxKzy9r8LJlvLyh+vzzzpsTcJAD4=; h=From:To:Cc:Subject:Date; b=Skc1vH+SGQ0Dv1OMSUS8S0T5/GqMRBIkFCLcbTIMkNxrpyH0e40QDbRUd7Lgowkqx 1AKzn+ktEuDeuCWZ9iEgDaN4xPtT+63LIm9WSqARIE/o8O5E9xOnwPbpLY9Up6GC+B VKIPkqPk6KmzT3D/+IeJo/AaFtFZGwdDVWg81yFQ= X-QQ-mid: xmsmtpt1786699642tviz1w3mr Message-ID: X-QQ-XMAILINFO: N/WmRbclY25GxvR7LcNe/OOOrsJ9xoLCObJZ6vdAfRcMKMpNyzh2DnyS8xcCM3 b9omLIUad0anYxWUA4QRFCS4NWOf7elFsLDx/HrflW2TR8PaZQ5YG9OSIlcMCsYI8kS4vCJB71Sv sOfsJKiFgOoQSgC3rhN7wIjIvLdKGU+Fyw5DWO41Og9iklxbri6h8/1x4G7BHUth+5RKjf1aSiSt cRl34rtP80tYTaidWNpInSGIYy1jdH/gAjBpjX2ts/Z4sDUBNhzrEJpY9t7PFlmUWR0SKCQxUJ4A ZNX0MZsSUHIE7hPL+BuIUd5YxJteYmJLEGdNAgXyXkKJOqMDmIGYqC11suYeJjPWUjtQmfGGZ6jy 41by7fRl7r1cSlBcSQNtTNZDMIRBFQdZw7iNaGyTJ9GIcYpyhJp34Da07etInXYPAxEnRVuDng/T Rv0NgnWQy7WgsrsvMjb0MrrQjLKixkz/pz3LcB++WWpjZ7JKGSKD6bZ1dxesy/jji4/YJgPJmDgu FUrXtNk9KJxe0bYHIbg/5dvYl2inj8odyMNcJbB6VzCoC7h3mJmce6qqkwYAnn4ot5z/NbW0QVdJ PP73v++y4WLRscGxLmPvIrPbFfYcNXEH2g/jzHuYbwLb0GdxSHydmNDNpbrja+ZwVPf3o9sopio4 gPjsyh1tf1op8Da+KMESJPkiv8XLcIgZymVIbxtl+yYNO1G/toTPRQ3NDuZBbNtU227aLz9vbkLk 3tUB/zQGS8q9xkoLwuuHRd3per6LLU+RbSeN6aQC9IvKGEcywqneyavt2bTV9x4FuyFxuB7kzc63 xVtgCtKZrXsJ43bWB8u9Jbs+tu5hTXjevyJ/cMDkTt4U+VwC7o9+u+XcJvsdUgDt+2V9r8jlHnbT R/SHi4FarvkOyoN3utCX6di6uO6JcYZw3qeG3oSRXZv6329SFeiSKTRPzI1UJkyBWVxVWRgdZa3G idmkEdMmOBov/Bo9DWzGCG6vVruNB/Bz4SAtXi1IWWV1EPnJ+ATD/7TDvuY4+WiW6GbIewxnqW+d hed/+JgVe4HLVuClFNUDkqbd01ZEyh8G+vgAVViks/54OAzl7f2l9MPcUBcds= X-QQ-XMRINFO: NI4Ajvh11aEjEMj13RCX7UuhPEoou2bs1g== From: sesame_h@qq.com To: qemu-devel@nongnu.org, qemu-ppc@nongnu.org Cc: npiggin@gmail.com, adityag@linux.ibm.com, milesg@linux.vnet.ibm.com, harshpb@linux.ibm.com, Minhang Zhang , Chinmay Rath Subject: [PATCH v4] target/ppc: Validate HTABMASK and reserved bits in SDR1 for 32-bit mode Date: Fri, 14 Aug 2026 17:26:32 +0800 X-OQ-MSGID: <20260814092632.48390-1-sesame_h@qq.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=162.62.58.216; envelope-from=sesame_h@qq.com; helo=out162-62-58-216.mail.qq.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HELO_STATIC_HOST=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qq.com) X-ZM-MESSAGEID: 1786699692772158500 Content-Type: text/plain; charset="utf-8" From: Minhang Zhang ppc_store_sdr1() had validation for 64-bit SDR1 values but lacked corresponding checks for the 32-bit case. According to the Power ISA, in 32-bit mode SDR1 bits 16-22 are reserved (must be zero) and HTABMASK (bits 23-31) must consist of a consecutive string of 1-bits starting from the LSB, i.e., be of the form 2^n-1. Add checks to reject invalid HTABMASK values and log a guest error for non-zero reserved bits, following the same pattern used by the existing 64-bit validation. Reviewed-by: Chinmay Rath Signed-off-by: Minhang Zhang --- target/ppc/mmu_common.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c index 2499e61..2a36817 100644 --- a/target/ppc/mmu_common.c +++ b/target/ppc/mmu_common.c @@ -42,24 +42,39 @@ void ppc_store_sdr1(CPUPPCState *env, target_ulong valu= e) PowerPCCPU *cpu =3D env_archcpu(env); qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value); assert(!cpu->env.has_hv_mode || !cpu->vhyp); -#if defined(TARGET_PPC64) if (mmu_is_64bit(env->mmu_model)) { +#if defined(TARGET_PPC64) target_ulong sdr_mask =3D SDR_64_HTABORG | SDR_64_HTABSIZE; target_ulong htabsize =3D value & SDR_64_HTABSIZE; =20 if (value & ~sdr_mask) { qemu_log_mask(LOG_GUEST_ERROR, "Invalid bits 0x"TARGET_FMT_lx - " set in SDR1", value & ~sdr_mask); + " set in SDR1\n", value & ~sdr_mask); value &=3D sdr_mask; } if (htabsize > 28) { qemu_log_mask(LOG_GUEST_ERROR, "Invalid HTABSIZE 0x" TARGET_FM= T_lx - " stored in SDR1", htabsize); + " stored in SDR1\n", htabsize); return; } - } #endif /* defined(TARGET_PPC64) */ - /* FIXME: Should check for valid HTABMASK values in 32-bit case */ + } else { + target_ulong sdr_mask =3D SDR_32_HTABORG | SDR_32_HTABMASK; + target_ulong htabmask =3D value & SDR_32_HTABMASK; + + if (value & ~sdr_mask) { + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid bits 0x" TARGET_FMT_lx + " set in SDR1\n", value & ~sdr_mask); + value &=3D sdr_mask; + } + if ((htabmask & (htabmask + 1)) !=3D 0) { + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid HTABMASK 0x" TARGET_FMT_lx + " in SDR1 (must be of form 2^n-1)\n", htabmask); + return; + } + } env->spr[SPR_SDR1] =3D value; } =20 --=20 2.43.0