diff options
| author | Pavel Zbitskiy <pavel.zbitskiy@gmail.com> | 2018-08-20 22:51:01 -0400 |
|---|---|---|
| committer | Cornelia Huck <cohuck@redhat.com> | 2018-08-28 17:37:01 +0200 |
| commit | 478d360cd937afe01a1234044ab04a26b73020be (patch) | |
| tree | 972511fbff6d9bcc71d13811e7412ed6c9944cf7 /target | |
| parent | dc95b31dac65adb92256e67a5f0fc88ab37404c2 (diff) | |
| download | qemu-478d360cd937afe01a1234044ab04a26b73020be.zip | |
target/s390x: fix IPM polluting irrelevant bits
Suppose psw.mask=0x0000000080000000, cc=2, r1=0 and we do "ipm 1".
This command must touch only bits 32-39, so the expected output
is r1=0x20000000. However, currently qemu yields r1=0x20008000,
because irrelevant parts of PSW leak into r1 during program mask
transfer.
Signed-off-by: Pavel Zbitskiy <pavel.zbitskiy@gmail.com>
Message-Id: <20180821025104.19604-5-pavel.zbitskiy@gmail.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Diffstat (limited to 'target')
| -rw-r--r-- | target/s390x/translate.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/target/s390x/translate.c b/target/s390x/translate.c index 4f62a38c97..40e12ca2c4 100644 --- a/target/s390x/translate.c +++ b/target/s390x/translate.c @@ -2444,20 +2444,17 @@ static DisasJumpType op_insi(DisasContext *s, DisasOps *o) static DisasJumpType op_ipm(DisasContext *s, DisasOps *o) { - TCGv_i64 t1; + TCGv_i64 t1, t2; gen_op_calc_cc(s); - tcg_gen_andi_i64(o->out, o->out, ~0xff000000ull); - t1 = tcg_temp_new_i64(); - tcg_gen_shli_i64(t1, psw_mask, 20); - tcg_gen_shri_i64(t1, t1, 36); - tcg_gen_or_i64(o->out, o->out, t1); - - tcg_gen_extu_i32_i64(t1, cc_op); - tcg_gen_shli_i64(t1, t1, 28); - tcg_gen_or_i64(o->out, o->out, t1); + tcg_gen_extract_i64(t1, psw_mask, 40, 4); + t2 = tcg_temp_new_i64(); + tcg_gen_extu_i32_i64(t2, cc_op); + tcg_gen_deposit_i64(t1, t1, t2, 4, 60); + tcg_gen_deposit_i64(o->out, o->out, t1, 24, 8); tcg_temp_free_i64(t1); + tcg_temp_free_i64(t2); return DISAS_NEXT; } |