[PATCH] target/hppa: clear the PSW 'N' bit when delivering signals

[PATCH] target/hppa: clear the PSW 'N' bit when delivering signals

[Mikulas Patocka]

qemu-hppa may crash when delivering a signal. It can be demonstrated with 
this program. Compile the program with "hppa-linux-gnu-gcc -O2 signal.c" 
and run it with "qemu-hppa -one-insn-per-tb a.out". It reports that the 
address of the flag is 0xb4 and it crashes when attempting to touch it.

#include <stdio.h>
#include <stdlib.h>
#include <sys/time.h>
#include <signal.h>

sig_atomic_t flag;

void sig(int n)
{
	printf("&flag: %p\n", &flag);
	flag = 1;
}

int main(void)
{
	struct sigaction sa;
	struct itimerval it;

	sa.sa_handler = sig;
	sigemptyset(&sa.sa_mask);
	sa.sa_flags = SA_RESTART;
	if (sigaction(SIGALRM, &sa, NULL)) perror("sigaction"), exit(1);

	it.it_interval.tv_sec = 0;
	it.it_interval.tv_usec = 100;
	it.it_value.tv_sec = it.it_interval.tv_sec;
	it.it_value.tv_usec = it.it_interval.tv_usec;

	if (setitimer(ITIMER_REAL, &it, NULL)) perror("setitimer"), exit(1);

	while (1) {
	}
}

The reason for the crash is that the signal handling routine doesn't clear 
the 'N' flag in the PSW. If the signal interrupts a thread when the 'N' 
flag is set, the flag remains set at the beginning of the signal handler 
and the first instruction of the signal handler is skipped.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

---
 linux-user/hppa/signal.c |    1 +
 1 file changed, 1 insertion(+)

Index: qemu/linux-user/hppa/signal.c
===================================================================
--- qemu.orig/linux-user/hppa/signal.c
+++ qemu/linux-user/hppa/signal.c
@@ -159,6 +159,7 @@ void setup_rt_frame(int sig, struct targ
     }
     env->iaoq_f = haddr;
     env->iaoq_b = haddr + 4;
+    env->psw_n = 0;
     return;
 
  give_sigsegv:

Re: [PATCH] target/hppa: clear the PSW 'N' bit when delivering signals

[Helge Deller]

On 9/16/23 15:49, Mikulas Patocka wrote:
> qemu-hppa may crash when delivering a signal. It can be demonstrated with
> this program. Compile the program with "hppa-linux-gnu-gcc -O2 signal.c"
> and run it with "qemu-hppa -one-insn-per-tb a.out". It reports that the
> address of the flag is 0xb4 and it crashes when attempting to touch it.
>
> #include <stdio.h>
> #include <stdlib.h>
> #include <sys/time.h>
> #include <signal.h>
>
> sig_atomic_t flag;
>
> void sig(int n)
> {
> 	printf("&flag: %p\n", &flag);
> 	flag = 1;
> }
>
> int main(void)
> {
> 	struct sigaction sa;
> 	struct itimerval it;
>
> 	sa.sa_handler = sig;
> 	sigemptyset(&sa.sa_mask);
> 	sa.sa_flags = SA_RESTART;
> 	if (sigaction(SIGALRM, &sa, NULL)) perror("sigaction"), exit(1);
>
> 	it.it_interval.tv_sec = 0;
> 	it.it_interval.tv_usec = 100;
> 	it.it_value.tv_sec = it.it_interval.tv_sec;
> 	it.it_value.tv_usec = it.it_interval.tv_usec;
>
> 	if (setitimer(ITIMER_REAL, &it, NULL)) perror("setitimer"), exit(1);
>
> 	while (1) {
> 	}
> }
>
> The reason for the crash is that the signal handling routine doesn't clear
> the 'N' flag in the PSW. If the signal interrupts a thread when the 'N'
> flag is set, the flag remains set at the beginning of the signal handler
> and the first instruction of the signal handler is skipped.
>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

Acked-by: Helge Deller <deller@gmx.de>

Thank you!

Helge

>
> ---
>   linux-user/hppa/signal.c |    1 +
>   1 file changed, 1 insertion(+)
>
> Index: qemu/linux-user/hppa/signal.c
> ===================================================================
> --- qemu.orig/linux-user/hppa/signal.c
> +++ qemu/linux-user/hppa/signal.c
> @@ -159,6 +159,7 @@ void setup_rt_frame(int sig, struct targ
>       }
>       env->iaoq_f = haddr;
>       env->iaoq_b = haddr + 4;
> +    env->psw_n = 0;
>       return;
>
>    give_sigsegv:
>

Re: [PATCH] target/hppa: clear the PSW 'N' bit when delivering signals

[Helge Deller]

On 9/16/23 18:49, Helge Deller wrote:
>> The reason for the crash is that the signal handling routine doesn't clear
>> the 'N' flag in the PSW. If the signal interrupts a thread when the 'N'
>> flag is set, the flag remains set at the beginning of the signal handler
>> and the first instruction of the signal handler is skipped.
>>
>> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
>
> Acked-by: Helge Deller <deller@gmx.de>

FYI, I've queued by both patches in my btlb branch and added backport
to stable request.

Helge