From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E629FC636F9 for ; Mon, 5 Dec 2022 10:10:34 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1p28Ct-0003kn-2W; Mon, 05 Dec 2022 04:56:15 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p28Cp-0003hu-2j for qemu-devel@nongnu.org; Mon, 05 Dec 2022 04:56:11 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p28Cm-0007Zo-2h for qemu-devel@nongnu.org; Mon, 05 Dec 2022 04:56:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1670234167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Hw3P8H5TEBArqeghTjjseYw/s4nFSWWkJ9rmhoVRUno=; b=ThItRtsGxSqrT4amTe7Ud1D9e+ZoH28P6RlxJvgQefspWgsK6LBSQUhZTSLzaq/ystgHS7 NlAtlPtGmwypmoJ2Z0AUy73EWtyBQfWZ/nrGrLUT8+AySCdrhGg+m5IX1JQ8AjH2wUgNyC vBsWMQqqfUyqGIQulxowinXQ0SPx8jA= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-86-kb_4S__COQ6ApFpRLzKmiA-1; Mon, 05 Dec 2022 04:56:04 -0500 X-MC-Unique: kb_4S__COQ6ApFpRLzKmiA-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3B3B9185A7A3; Mon, 5 Dec 2022 09:56:03 +0000 (UTC) Received: from secure.mitica (unknown [10.39.194.135]) by smtp.corp.redhat.com (Postfix) with ESMTP id DCE292166B2E; Mon, 5 Dec 2022 09:55:55 +0000 (UTC) From: Juan Quintela To: qemu-devel@nongnu.org Cc: Fam Zheng , Thomas Huth , Viresh Kumar , Kevin Wolf , Mathieu Poirier , Laurent Vivier , Eric Blake , Richard Henderson , Raphael Norwitz , Stefan Hajnoczi , Juan Quintela , virtio-fs@redhat.com, =?UTF-8?q?Alex=20Benn=C3=A9e?= , Christian Borntraeger , "Gonglei (Arei)" , qemu-block@nongnu.org, Xiaojuan Yang , Thomas Huth , Ilya Leoshkevich , Eduardo Habkost , Gerd Hoffmann , "Dr. David Alan Gilbert" , Alex Williamson , Eric Farman , Halil Pasic , Peter Maydell , Vladimir Sementsov-Ogievskiy , Jason Wang , Laurent Vivier , Song Gao , qemu-s390x@nongnu.org, Pavel Dovgalyuk , Klaus Jensen , John Snow , Michael Tokarev , qemu-arm@nongnu.org, Paolo Bonzini , "Michael S. Tsirkin" , Keith Busch , David Hildenbrand , qemu-trivial@nongnu.org, Hanna Reitz Subject: [PATCH v2 26/51] target/s390x/tcg: Fix and improve the SACF instruction Date: Mon, 5 Dec 2022 10:52:03 +0100 Message-Id: <20221205095228.1314-27-quintela@redhat.com> In-Reply-To: <20221205095228.1314-1-quintela@redhat.com> References: <20221205095228.1314-1-quintela@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 Received-SPF: pass client-ip=170.10.133.124; envelope-from=quintela@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org From: Thomas Huth The SET ADDRESS SPACE CONTROL FAST instruction is not privileged, it can be used from problem space, too. Just the switching to the home address space is privileged and should still generate a privilege exception. This bug is e.g. causing programs like Java that use the "getcpu" vdso kernel function to crash (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990417#26 ). While we're at it, also check if DAT is not enabled. In that case the instruction is supposed to generate a special operation exception. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/655 Message-Id: <20221201184443.136355-1-thuth@redhat.com> Reviewed-by: Ilya Leoshkevich Reviewed-by: David Hildenbrand Reviewed-by: Richard Henderson Signed-off-by: Thomas Huth --- target/s390x/tcg/insn-data.h.inc | 2 +- target/s390x/tcg/cc_helper.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/target/s390x/tcg/insn-data.h.inc b/target/s390x/tcg/insn-data.h.inc index 7e952bdfc8..54d4250c9f 100644 --- a/target/s390x/tcg/insn-data.h.inc +++ b/target/s390x/tcg/insn-data.h.inc @@ -1365,7 +1365,7 @@ /* SERVICE CALL LOGICAL PROCESSOR (PV hypercall) */ F(0xb220, SERVC, RRE, Z, r1_o, r2_o, 0, 0, servc, 0, IF_PRIV | IF_IO) /* SET ADDRESS SPACE CONTROL FAST */ - F(0xb279, SACF, S, Z, 0, a2, 0, 0, sacf, 0, IF_PRIV) + C(0xb279, SACF, S, Z, 0, a2, 0, 0, sacf, 0) /* SET CLOCK */ F(0xb204, SCK, S, Z, 0, m2_64a, 0, 0, sck, 0, IF_PRIV | IF_IO) /* SET CLOCK COMPARATOR */ diff --git a/target/s390x/tcg/cc_helper.c b/target/s390x/tcg/cc_helper.c index b2e8d3d9f5..b36f8cdc8b 100644 --- a/target/s390x/tcg/cc_helper.c +++ b/target/s390x/tcg/cc_helper.c @@ -487,6 +487,10 @@ void HELPER(sacf)(CPUS390XState *env, uint64_t a1) { HELPER_LOG("%s: %16" PRIx64 "\n", __func__, a1); + if (!(env->psw.mask & PSW_MASK_DAT)) { + tcg_s390_program_interrupt(env, PGM_SPECIAL_OP, GETPC()); + } + switch (a1 & 0xf00) { case 0x000: env->psw.mask &= ~PSW_MASK_ASC; @@ -497,6 +501,9 @@ void HELPER(sacf)(CPUS390XState *env, uint64_t a1) env->psw.mask |= PSW_ASC_SECONDARY; break; case 0x300: + if ((env->psw.mask & PSW_MASK_PSTATE) != 0) { + tcg_s390_program_interrupt(env, PGM_PRIVILEGED, GETPC()); + } env->psw.mask &= ~PSW_MASK_ASC; env->psw.mask |= PSW_ASC_HOME; break; -- 2.38.1