Re: [PATCH] target/ppc/mmu_common: Fix SRR1/MSR error code on Book-E

["Cédric Le Goater" <clg@kaod.org>]

On 1/21/22 10:31, Vitaly Cheptsov wrote:
> Book-E architecture does not set the error code in 31:27 bits
> of SRR1, but instead uses these bits for custom fields such
> as GS (Guest Supervisor).
> 
> Wrongly setting these fields will result in QEMU crashes
> when attempting to execute not executable code due to the attempts
> to use Guest Supervisor mode.
> 
> Cc: "Cédric Le Goater" <clg@kaod.org>
> Cc: Daniel Henrique Barboza <danielhb413@gmail.com>
> Cc: David Gibson <david@gibson.dropbear.id.au>
> Cc: Greg Kurz <groug@kaod.org>
> Cc: qemu-ppc@nongnu.org
> Cc: qemu-devel@nongnu.org
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Thanks,

C.


> ---
>   target/ppc/mmu_common.c | 18 +++++++++++++++---
>   1 file changed, 15 insertions(+), 3 deletions(-)
> 
> diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
> index 91270c1f17..6512ee031c 100644
> --- a/target/ppc/mmu_common.c
> +++ b/target/ppc/mmu_common.c
> @@ -1367,22 +1367,34 @@ static bool ppc_jumbo_xlate(PowerPCCPU *cpu, vaddr eaddr,
>               case -2:
>                   /* Access rights violation */
>                   cs->exception_index = POWERPC_EXCP_ISI;
> -                env->error_code = 0x08000000;
> +                if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
> +                    (env->mmu_model == POWERPC_MMU_BOOKE206)) {
> +                    env->error_code = 0;
> +                } else {
> +                    env->error_code = 0x08000000;
> +                }
>                   break;
>               case -3:
>                   /* No execute protection violation */
>                   if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
>                       (env->mmu_model == POWERPC_MMU_BOOKE206)) {
>                       env->spr[SPR_BOOKE_ESR] = 0x00000000;
> +                    env->error_code = 0;
> +                } else {
> +                    env->error_code = 0x10000000;
>                   }
>                   cs->exception_index = POWERPC_EXCP_ISI;
> -                env->error_code = 0x10000000;
>                   break;
>               case -4:
>                   /* Direct store exception */
>                   /* No code fetch is allowed in direct-store areas */
>                   cs->exception_index = POWERPC_EXCP_ISI;
> -                env->error_code = 0x10000000;
> +                if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
> +                    (env->mmu_model == POWERPC_MMU_BOOKE206)) {
> +                    env->error_code = 0;
> +                } else {
> +                    env->error_code = 0x10000000;
> +                }
>                   break;
>               }
>           } else {
>