Re: [PATCH v2 3/3] KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form

[Shrikanth Hegde <sshegde@linux.ibm.com>]

On 9/30/26 11:07 PM, Amit Machhiwal wrote:
> get_d_signext() has two compounding bugs since its introduction in 2010:
> 
> 1. The extraction mask 0x8FF silently drops bits 8-10 of the 12-bit D
>     field (PPC ISA bits 21-23), corrupting any displacement that has any
>     of those bits set.
> 
> 2. The sign-magnitude idiom "-(d & 0x7ff)" is wrong for two's-complement:
>     for D=0xFFC (encoding of -4) it returns -252 instead of -4.
> 
> Together these errors produce a wrong effective address for psq_l, psq_lu,
> psq_st, and psq_stu whenever the displacement is negative or is a positive
> value >= 0x100 with bits 8-10 set — essentially any real-world paired-
> single stack-relative access.
> 
> The D field occupies the bottom 12 bits of the instruction word (confirmed
> by the adjacent W and I extractions via inst_get_field(inst,16,16) and
> inst_get_field(inst,17,19)). Replace the open-coded logic with the standard
> sign_extend32(inst & 0xfff, 11), which correctly performs two's-complement
> sign extension from 12 bits to 32 bits.
> 
> Fixes: 831317b605e7 ("KVM: PPC: Implement Paired Single emulation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com>
> ---
>   arch/powerpc/kvm/book3s_paired_singles.c | 7 +------
>   1 file changed, 1 insertion(+), 6 deletions(-)
> 
> diff --git a/arch/powerpc/kvm/book3s_paired_singles.c b/arch/powerpc/kvm/book3s_paired_singles.c
> index bc39c76c9d9f..532f96293de0 100644
> --- a/arch/powerpc/kvm/book3s_paired_singles.c
> +++ b/arch/powerpc/kvm/book3s_paired_singles.c
> @@ -479,12 +479,7 @@ static bool kvmppc_inst_is_paired_single(struct kvm_vcpu *vcpu, u32 inst)
>   
>   static int get_d_signext(u32 inst)
>   {
> -	int d = inst & 0x8ff;
> -
> -	if (d & 0x800)
> -		return -(d & 0x7ff);
> -
> -	return (d & 0x7ff);
> +	return sign_extend32(inst & 0xfff, 11);
>   }
>   
>   static int kvmppc_ps_three_in(struct kvm_vcpu *vcpu, bool rc,

If the intent was just to get the signed value based on bit11 (0 based index)
then patch looks right.

Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>