From b826044fc0c21d90a7fcfcf883cc8a8bf1bd7424 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 1 Apr 2022 11:08:13 -0600 Subject: [PATCH 1/6] accel/tcg: Assert mmu_idx in range before use in cputlb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity reports out-of-bound accesses within cputlb.c. This should be a false positive due to how the index is decoded from MemOpIdx. To be fair, nothing is checking the correct bounds during encoding either. Assert index in range before use, both to catch user errors and to pacify static analysis. Fixes: Coverity CID 1487120, 1487127, 1487170, 1487196, 1487215, 1487238 Signed-off-by: Richard Henderson Reviewed-by: Peter Maydell Reviewed-by: Alex Bennée Message-Id: <20220401170813.318609-1-richard.henderson@linaro.org> --- accel/tcg/cputlb.c | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c index dd45e0467b..f90f4312ea 100644 --- a/accel/tcg/cputlb.c +++ b/accel/tcg/cputlb.c @@ -1761,7 +1761,7 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr, MemOpIdx oi, int size, int prot, uintptr_t retaddr) { - size_t mmu_idx = get_mmuidx(oi); + uintptr_t mmu_idx = get_mmuidx(oi); MemOp mop = get_memop(oi); int a_bits = get_alignment_bits(mop); uintptr_t index; @@ -1769,6 +1769,8 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr, target_ulong tlb_addr; void *hostaddr; + tcg_debug_assert(mmu_idx < NB_MMU_MODES); + /* Adjust the given return address. */ retaddr -= GETPC_ADJ; @@ -1908,18 +1910,20 @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi, uintptr_t retaddr, MemOp op, bool code_read, FullLoadHelper *full_load) { - uintptr_t mmu_idx = get_mmuidx(oi); - uintptr_t index = tlb_index(env, mmu_idx, addr); - CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr); - target_ulong tlb_addr = code_read ? entry->addr_code : entry->addr_read; const size_t tlb_off = code_read ? offsetof(CPUTLBEntry, addr_code) : offsetof(CPUTLBEntry, addr_read); const MMUAccessType access_type = code_read ? MMU_INST_FETCH : MMU_DATA_LOAD; - unsigned a_bits = get_alignment_bits(get_memop(oi)); + const unsigned a_bits = get_alignment_bits(get_memop(oi)); + const size_t size = memop_size(op); + uintptr_t mmu_idx = get_mmuidx(oi); + uintptr_t index; + CPUTLBEntry *entry; + target_ulong tlb_addr; void *haddr; uint64_t res; - size_t size = memop_size(op); + + tcg_debug_assert(mmu_idx < NB_MMU_MODES); /* Handle CPU specific unaligned behaviour */ if (addr & ((1 << a_bits) - 1)) { @@ -1927,6 +1931,10 @@ load_helper(CPUArchState *env, target_ulong addr, MemOpIdx oi, mmu_idx, retaddr); } + index = tlb_index(env, mmu_idx, addr); + entry = tlb_entry(env, mmu_idx, addr); + tlb_addr = code_read ? entry->addr_code : entry->addr_read; + /* If the TLB entry is for a different page, reload and try again. */ if (!tlb_hit(tlb_addr, addr)) { if (!victim_tlb_hit(env, mmu_idx, index, tlb_off, @@ -2310,14 +2318,16 @@ static inline void QEMU_ALWAYS_INLINE store_helper(CPUArchState *env, target_ulong addr, uint64_t val, MemOpIdx oi, uintptr_t retaddr, MemOp op) { - uintptr_t mmu_idx = get_mmuidx(oi); - uintptr_t index = tlb_index(env, mmu_idx, addr); - CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr); - target_ulong tlb_addr = tlb_addr_write(entry); const size_t tlb_off = offsetof(CPUTLBEntry, addr_write); - unsigned a_bits = get_alignment_bits(get_memop(oi)); + const unsigned a_bits = get_alignment_bits(get_memop(oi)); + const size_t size = memop_size(op); + uintptr_t mmu_idx = get_mmuidx(oi); + uintptr_t index; + CPUTLBEntry *entry; + target_ulong tlb_addr; void *haddr; - size_t size = memop_size(op); + + tcg_debug_assert(mmu_idx < NB_MMU_MODES); /* Handle CPU specific unaligned behaviour */ if (addr & ((1 << a_bits) - 1)) { @@ -2325,6 +2335,10 @@ store_helper(CPUArchState *env, target_ulong addr, uint64_t val, mmu_idx, retaddr); } + index = tlb_index(env, mmu_idx, addr); + entry = tlb_entry(env, mmu_idx, addr); + tlb_addr = tlb_addr_write(entry); + /* If the TLB entry is for a different page, reload and try again. */ if (!tlb_hit(tlb_addr, addr)) { if (!victim_tlb_hit(env, mmu_idx, index, tlb_off, From 21641ee5a9b31568c990c7fc949eeb9bcd0f6a0f Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 1 Apr 2022 13:36:59 -0600 Subject: [PATCH 2/6] target/s390x: Fix the accumulation of ccm in op_icm Coverity rightly reports that 0xff << pos can overflow. This would affect the ICMH instruction. Fixes: Coverity CID 1487161 Signed-off-by: Richard Henderson Reviewed-by: David Hildenbrand Reviewed-by: Thomas Huth Message-Id: <20220401193659.332079-1-richard.henderson@linaro.org> --- target/s390x/tcg/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c index ae70368966..8f092dab95 100644 --- a/target/s390x/tcg/translate.c +++ b/target/s390x/tcg/translate.c @@ -2622,7 +2622,7 @@ static DisasJumpType op_icm(DisasContext *s, DisasOps *o) tcg_gen_qemu_ld8u(tmp, o->in2, get_mem_index(s)); tcg_gen_addi_i64(o->in2, o->in2, 1); tcg_gen_deposit_i64(o->out, o->out, tmp, pos, 8); - ccm |= 0xff << pos; + ccm |= 0xffull << pos; } m3 = (m3 << 1) & 0xf; pos -= 8; From 0cbc135917141053c80480fefbe55f70bb3b1562 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 1 Apr 2022 12:46:35 -0600 Subject: [PATCH 3/6] target/i386: Suppress coverity warning on fsave/frstor Coverity warns that 14 << data32 may overflow with respect to the target_ulong to which it is subsequently added. We know this wasn't true because data32 is in [1,2], but the suggested fix is perfectly fine. Fixes: Coverity CID 1487135, 1487256 Signed-off-by: Richard Henderson Reviewed-by: Damien Hedde Message-Id: <20220401184635.327423-1-richard.henderson@linaro.org> --- target/i386/tcg/fpu_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c index ebf5e73df9..30bc44fcf8 100644 --- a/target/i386/tcg/fpu_helper.c +++ b/target/i386/tcg/fpu_helper.c @@ -2466,7 +2466,7 @@ static void do_fsave(CPUX86State *env, target_ulong ptr, int data32, do_fstenv(env, ptr, data32, retaddr); - ptr += (14 << data32); + ptr += (target_ulong)14 << data32; for (i = 0; i < 8; i++) { tmp = ST(i); do_fstt(env, tmp, ptr, retaddr); @@ -2488,7 +2488,7 @@ static void do_frstor(CPUX86State *env, target_ulong ptr, int data32, int i; do_fldenv(env, ptr, data32, retaddr); - ptr += (14 << data32); + ptr += (target_ulong)14 << data32; for (i = 0; i < 8; i++) { tmp = do_fldt(env, ptr, retaddr); From b880867f15623b2e82b0fa6b149753d7c18c615c Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 1 Apr 2022 07:22:38 -0600 Subject: [PATCH 4/6] softfloat: Fix declaration of partsN_compare The declaration used 'int', while the definition used 'FloatRelation'. This should have resulted in a compiler error, but mysteriously didn't. Signed-off-by: Richard Henderson Reviewed-by: Peter Maydell Message-Id: <20220401132240.79730-2-richard.henderson@linaro.org> --- fpu/softfloat.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fpu/softfloat.c b/fpu/softfloat.c index 5e2cf20448..e7d7ad56bc 100644 --- a/fpu/softfloat.c +++ b/fpu/softfloat.c @@ -874,10 +874,10 @@ static FloatParts128 *parts128_minmax(FloatParts128 *a, FloatParts128 *b, #define parts_minmax(A, B, S, F) \ PARTS_GENERIC_64_128(minmax, A)(A, B, S, F) -static int parts64_compare(FloatParts64 *a, FloatParts64 *b, - float_status *s, bool q); -static int parts128_compare(FloatParts128 *a, FloatParts128 *b, - float_status *s, bool q); +static FloatRelation parts64_compare(FloatParts64 *a, FloatParts64 *b, + float_status *s, bool q); +static FloatRelation parts128_compare(FloatParts128 *a, FloatParts128 *b, + float_status *s, bool q); #define parts_compare(A, B, S, Q) \ PARTS_GENERIC_64_128(compare, A)(A, B, S, Q) From 9343c884445201cfd84955f199b13783fa829372 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 1 Apr 2022 07:22:39 -0600 Subject: [PATCH 5/6] softfloat: Use FloatRelation within partsN_compare As the return type is FloatRelation, it's clearer to use the type for 'cmp' within the function. Signed-off-by: Richard Henderson Reviewed-by: Peter Maydell Message-Id: <20220401132240.79730-3-richard.henderson@linaro.org> --- fpu/softfloat-parts.c.inc | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc index db3e1f393d..bbeadaa189 100644 --- a/fpu/softfloat-parts.c.inc +++ b/fpu/softfloat-parts.c.inc @@ -1327,16 +1327,19 @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b, float_status *s, bool is_quiet) { int ab_mask = float_cmask(a->cls) | float_cmask(b->cls); - int cmp; if (likely(ab_mask == float_cmask_normal)) { + FloatRelation cmp; + if (a->sign != b->sign) { goto a_sign; } - if (a->exp != b->exp) { - cmp = a->exp < b->exp ? -1 : 1; - } else { + if (a->exp == b->exp) { cmp = frac_cmp(a, b); + } else if (a->exp < b->exp) { + cmp = float_relation_less; + } else { + cmp = float_relation_greater; } if (a->sign) { cmp = -cmp; From dee3fcfbb399a0e4ccedbf737b5b0b7f56ecd398 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 1 Apr 2022 07:22:40 -0600 Subject: [PATCH 6/6] softfloat: Use FloatRelation for fracN_cmp Since the caller, partsN_compare, is now exclusively using FloatRelation, it's clearer to use it here too. Signed-off-by: Richard Henderson Reviewed-by: Peter Maydell Message-Id: <20220401132240.79730-4-richard.henderson@linaro.org> --- fpu/softfloat.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/fpu/softfloat.c b/fpu/softfloat.c index e7d7ad56bc..4a871ef2a1 100644 --- a/fpu/softfloat.c +++ b/fpu/softfloat.c @@ -957,21 +957,23 @@ static void frac128_allones(FloatParts128 *a) #define frac_allones(A) FRAC_GENERIC_64_128(allones, A)(A) -static int frac64_cmp(FloatParts64 *a, FloatParts64 *b) +static FloatRelation frac64_cmp(FloatParts64 *a, FloatParts64 *b) { - return a->frac == b->frac ? 0 : a->frac < b->frac ? -1 : 1; + return (a->frac == b->frac ? float_relation_equal + : a->frac < b->frac ? float_relation_less + : float_relation_greater); } -static int frac128_cmp(FloatParts128 *a, FloatParts128 *b) +static FloatRelation frac128_cmp(FloatParts128 *a, FloatParts128 *b) { uint64_t ta = a->frac_hi, tb = b->frac_hi; if (ta == tb) { ta = a->frac_lo, tb = b->frac_lo; if (ta == tb) { - return 0; + return float_relation_equal; } } - return ta < tb ? -1 : 1; + return ta < tb ? float_relation_less : float_relation_greater; } #define frac_cmp(A, B) FRAC_GENERIC_64_128(cmp, A)(A, B)