From 65a27df92779207c3005e7f0462f4bcc9b6545f7 Mon Sep 17 00:00:00 2001 From: David Hildenbrand Date: Wed, 4 Sep 2019 17:09:01 +0200 Subject: [PATCH] s390x/tcg: MVCIN: Fault-safe handling We can process a maximum of 256 bytes, crossing two pages. Calculate the accessed range upfront - src is accessed right-to-left. Reviewed-by: Richard Henderson Signed-off-by: David Hildenbrand --- target/s390x/mem_helper.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c index a97e4aa535..eeb2552979 100644 --- a/target/s390x/mem_helper.c +++ b/target/s390x/mem_helper.c @@ -479,12 +479,21 @@ void HELPER(mvc)(CPUS390XState *env, uint32_t l, uint64_t dest, uint64_t src) /* move inverse */ void HELPER(mvcin)(CPUS390XState *env, uint32_t l, uint64_t dest, uint64_t src) { + const int mmu_idx = cpu_mmu_index(env, false); + S390Access srca, desta; uintptr_t ra = GETPC(); int i; - for (i = 0; i <= l; i++) { - uint8_t v = cpu_ldub_data_ra(env, src - i, ra); - cpu_stb_data_ra(env, dest + i, v, ra); + /* MVCIN always copies one more byte than specified - maximum is 256 */ + l++; + + src = wrap_address(env, src - l + 1); + srca = access_prepare(env, src, l, MMU_DATA_LOAD, mmu_idx, ra); + desta = access_prepare(env, dest, l, MMU_DATA_STORE, mmu_idx, ra); + for (i = 0; i < l; i++) { + const uint8_t x = access_get_byte(env, &srca, l - i - 1, ra); + + access_set_byte(env, &desta, i, x, ra); } }