@samitouri / QOSamiQemu / commits / 2c32c273da

target/s390x/tcg: Set STCK/STCKF condition code after the store

STORE CLOCK [FAST] to an inaccessible address aborts QEMU: $ qemu-s390x ./stckf ERROR:cc_helper.c:128:cc_calc_addu: assertion failed: (carry_out <= 1) op_stck() sets the condition code with gen_op_movi_cc() before the output operand store, which is deferred to wout_m1_64(). Assigning a constant condition code discards the lazy CC values, so the optimizer drops the writes that produced them. When the store then raises an exception, the instruction is suppressed and s390x_restore_state_to_opc() reinstates the cc_op recorded at the start of STCK[F], but cc_src/cc_dst now hold stale values, so the next condition code evaluation reads garbage. Fix by performing the store manually. The alternative of not discarding in gen_op_movi_cc() keeps the inputs live, but results in less optimal code. Reported-by: Ido Plat <Ido.Plat1@ibm.com> Fixes: 434c91a5f4ed ("target-s390: Convert STCK") Cc: qemu-stable@nongnu.org Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Eric Farman <farman@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260714203206.363028-2-iii@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>

Ilya Leoshkevich committed Jul 14, 2026 at 22:29 UTC 2c32c273da6d4ecead76441adf96cb685f31df3c
2 files changed +4 -2
target/s390x/tcg/insn-data.h.inc
+2 -2
@@ -887,8 +887,8 @@
887 C(0xe32f, STRVG, RXY_a, Z, la2, r1_o, new, m1_64, rev64, 0)
888
889 /* STORE CLOCK */
890 - F(0xb205, STCK, S, Z, la2, 0, new, m1_64, stck, 0, IF_IO)
891 - F(0xb27c, STCKF, S, SCF, la2, 0, new, m1_64, stck, 0, IF_IO)
890 + F(0xb205, STCK, S, Z, la2, 0, new, 0, stck, 0, IF_IO)
891 + F(0xb27c, STCKF, S, SCF, la2, 0, new, 0, stck, 0, IF_IO)
892 /* STORE CLOCK EXTENDED */
893 F(0xb278, STCKE, S, Z, 0, a2, 0, 0, stcke, 0, IF_IO)
894
target/s390x/tcg/translate.c
+2
@@ -4108,7 +4108,9 @@ static DisasJumpType op_stap(DisasContext *s, DisasOps *o)
4108 static DisasJumpType op_stck(DisasContext *s, DisasOps *o)
4109 {
4110 gen_helper_stck(o->out, tcg_env);
4111 + tcg_gen_qemu_st_i64(o->out, o->addr1, get_mem_index(s), MO_BEUQ);
4112 /* ??? We don't implement clock states. */
4113 + /* Set the CC after the store; a suppressed store must preserve it. */
4114 gen_op_movi_cc(s, 0);
4115 return DISAS_NEXT;
4116 }