diff options
| author | Greg Kurz | 2019-03-27 19:12:32 +0100 |
|---|---|---|
| committer | David Gibson | 2019-03-29 00:22:22 +0100 |
| commit | 3e5365b7aa6cb2593665c201e1b37681ac25c55d (patch) | |
| tree | 8743d550c046fe756f9be0abba7ede6a38674d74 /include/hw/ppc/spapr.h | |
| parent | target/ppc: Improve comment of bcctr used for spectre v2 mitigation (diff) | |
| download | qemu-3e5365b7aa6cb2593665c201e1b37681ac25c55d.tar.gz qemu-3e5365b7aa6cb2593665c201e1b37681ac25c55d.tar.xz qemu-3e5365b7aa6cb2593665c201e1b37681ac25c55d.zip | |
target/ppc: Fix QEMU crash with stxsdx
I've been hitting several QEMU crashes while running a fedora29 ppc64le
guest under TCG. Each time, this would occur several minutes after the
guest reached login:
Fedora 29 (Twenty Nine)
Kernel 4.20.6-200.fc29.ppc64le on an ppc64le (hvc0)
Web console: https://localhost:9090/
localhost login:
tcg/tcg.c:3211: tcg fatal error
This happens because a bug crept up in the gen_stxsdx() helper when it
was converted to use VSR register accessors by commit 8b3b2d75c7c04
"target/ppc: introduce get_cpu_vsr{l,h}() and set_cpu_vsr{l,h}() helpers
for VSR register access".
The code creates a temporary, passes it directly to gen_qemu_st64_i64()
and then to set_cpu_vrsh()... which looks like this was mistakenly
coded as a load instead of a store.
Reverse the logic: read the VSR to the temporary first and then store
it to memory.
Fixes: 8b3b2d75c7c0481544e277dad226223245e058eb
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <155371035249.2038502.12364252604337688538.stgit@bahia.lan>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'include/hw/ppc/spapr.h')
0 files changed, 0 insertions, 0 deletions