From patchwork Fri Sep 6 11:12:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825930 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp744071wrb; Fri, 6 Sep 2024 04:14:37 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUtNGZo5cOq16lzVcs/hiZbRVopzN0PIvM8aen4Q86KyyaHtNfJwrSqmHcvEyzjJxXkqenE/A==@linaro.org X-Google-Smtp-Source: AGHT+IFZtiQ65Y3JMyFmM6QgRz2dLVhjK6x39wCHVP+q+SGf0GRVSLw4CvWINkWOmmxml/Qv2EwC X-Received: by 2002:a05:6214:3c88:b0:6c3:3d7e:7152 with SMTP id 6a1803df08f44-6c5284f56e4mr28811056d6.25.1725621277165; Fri, 06 Sep 2024 04:14:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621277; cv=none; d=google.com; s=arc-20240605; b=N5GzsUy12uquGX9YJPYRLa/Sf5VXcfTb+cBKwlSSV4yS8AC2bZg1sfNG9Uf+ddbfQc yW11DEWT1YWhFmZj9zsSKfxdSUNoGhFoumINWUGl5IU0x8NcQRCxworYdj6rpIxIqVqb kfDwW9p0CGGAMa1Z42n9SUAa/7xwi5vyvl8uM7P5neIDKBhfUdltWEQsUqd7kTkW1lss t9mFq0cCR/NNMXlhNh4pNK2AfA8JHc8Nb3fisiqxCpcm2ez/lxoAVdzf2d7HW21b612y gpUgKX3gV8PjSroKbV32KMDlcGK2nuUlNASbtC8Q/HbI6MMDzq/er2qdsRBvYSGF8Utl /vMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=duDrgkBcYk6Vwi7K00VEjySNR3G0h1nog9wKYFtbUCc=; fh=taStO74W/EZXcDvsT3Zoyq1h58w93JzpEc66fmdrq4s=; b=DJl9yDX44yxABlDzPHJ2b9BK8dBJaKhMmRK4/AkykWvNCqkv0CaWJv8bArWyo8bIDW dqe+EWP7IXh/wo/VVpV0MVPFr+KkIrl3L6rVFzqUuMhTjDa/2nlDxrkwXs1z858tPjo9 g6zEcKq7jqDbcuu7iJlbUaljy3vhR5iFGtBymboo/8nBBKbxCUSi6e7nmdPCTWqjubAi CM2SLhQFIxKOojOKE6eI9rBl3mBfd0dgihO8eH5JngDmDwJ4CAeHasL9Moqckd2jDiR9 2uysGIQBJBPQPvtIbulcRpAnA9TcmMuQmql8ZEHH9ZLHoZrDb3NSP8vXPWY4uhDkgagn VVCg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c5306a8e3bsi427686d6.548.2024.09.06.04.14.37 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:14:37 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWuJ-0000Z9-Ke; Fri, 06 Sep 2024 07:13:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWuH-0000Rh-6Z; Fri, 06 Sep 2024 07:13:37 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWuF-0007fp-Hq; Fri, 06 Sep 2024 07:13:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B92D68C474; Fri, 6 Sep 2024 14:12:06 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id C49111336DE; Fri, 6 Sep 2024 14:13:24 +0300 (MSK) Received: (nullmailer pid 353552 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 04/69] target/arm: Fix handling of LDAPR/STLR with negative offset Date: Fri, 6 Sep 2024 14:12:13 +0300 Message-Id: <20240906111324.353230-4-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When we converted the LDAPR/STLR instructions to decodetree we accidentally introduced a regression where the offset is negative. The 9-bit immediate field is signed, and the old hand decoder correctly used sextract32() to get it out of the insn word, but the ldapr_stlr_i pattern in the decode file used "imm:9" instead of "imm:s9", so it treated the field as unsigned. Fix the pattern to treat the field as a signed immediate. Cc: qemu-stable@nongnu.org Fixes: 2521b6073b7 ("target/arm: Convert LDAPR/STLR (imm) to decodetree") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2419 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-id: 20240709134504.3500007-2-peter.maydell@linaro.org (cherry picked from commit 5669d26ec614b3f4c56cf1489b9095ed327938b1) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode index 8a20dce3c8..6cc29a4bce 100644 --- a/target/arm/tcg/a64.decode +++ b/target/arm/tcg/a64.decode @@ -467,7 +467,7 @@ LDAPR sz:2 111 0 00 1 0 1 11111 1100 00 rn:5 rt:5 LDRA 11 111 0 00 m:1 . 1 ......... w:1 1 rn:5 rt:5 imm=%ldra_imm &ldapr_stlr_i rn rt imm sz sign ext -@ldapr_stlr_i .. ...... .. . imm:9 .. rn:5 rt:5 &ldapr_stlr_i +@ldapr_stlr_i .. ...... .. . imm:s9 .. rn:5 rt:5 &ldapr_stlr_i STLR_i sz:2 011001 00 0 ......... 00 ..... ..... @ldapr_stlr_i sign=0 ext=0 LDAPR_i sz:2 011001 01 0 ......... 00 ..... ..... @ldapr_stlr_i sign=0 ext=0 LDAPR_i 00 011001 10 0 ......... 00 ..... ..... @ldapr_stlr_i sign=1 ext=0 sz=0 From patchwork Fri Sep 6 11:12:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825929 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp744020wrb; Fri, 6 Sep 2024 04:14:29 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUgzsAU62dtKbDDUdjamqiJ0aJVzGrwKEAl6yq4L7PWPHkIbD6+0YfB7oV2MqyhHe4h+CWdww==@linaro.org X-Google-Smtp-Source: AGHT+IFDfRHBbsrSy5dqNAyhDsOi9SZ+YeH7XQ6u5UR41lkVZl0Ij3OXzR0wW1ExA9bx8JQZJ61Z X-Received: by 2002:a05:6830:3687:b0:704:7b8c:ba0c with SMTP id 46e09a7af769-710cc26fb63mr2341624a34.30.1725621269291; Fri, 06 Sep 2024 04:14:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621269; cv=none; d=google.com; s=arc-20240605; b=cUiSDQkmGT4gtrSU078MOR6T1XI7nmpcbBC4N+z96pQtKq2iM7q9WxUUr2B/vr5a/3 4hQihLTE+VXIwphAuBxiMKzGGB/s1B6SMpfxB3WfmXY7Jc30W8c7KaeqYsApYpW3pDuX GcguEMkLUbxMxcIWVIi0ohi9lq1zsl5mJLX4h50L+igBm5az256hzP3olef/MSZzzYlS H9AsOk5SPcZKUFrKrZO115hGDt0RPn1JXP3zCQ1O6a8BUwqc24TYguRhAuWeooszekNe m98aBhZe/6D+Us1gYkIcN063K6r7yEMDjzA0Zo4VdPU/xJMmygTaH1A/KMQIn6kz8702 IriQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=pHRHu3t2m8pF3KKfDjBkPJDQ/CHwLGw/RJF2VgvmDAg=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=j/vZhtz5/FdeYHnKH7B9iLA4RNxmkEa7ww3klgMP4eUobznsvkiS6lonQ2nwWjjJKX cVeZXZUR07OVvb88Aw5KuKqOmNjeW6uhSvlQnpEfhEbYt8uv//UhX+okWkv8w2NSeCqZ jJWL4jaCQ7dHkZ7Wa9hyn+P01GR/d21uifOVSBhFzR01Og5eu6xZSuqKY6myXf/fmF1U p1/FWaAO4LSpQBybVyQXOTPVrv1RcYG6i1pFNwAbstN1pyBUlahSb0wEbQX+xePOTMGP U6CKuDfegFpZ1zPU9ipN/4FeiOzJCg3s0j45yyYp7JqBjVOjDpljJX83BEpdYGGhnEn8 4nXA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c98adbsi26561861cf.610.2024.09.06.04.14.29 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:14:29 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWuJ-0000ZR-Lb; Fri, 06 Sep 2024 07:13:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWuH-0000Sl-Ep; Fri, 06 Sep 2024 07:13:37 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWuF-0007ft-LE; Fri, 06 Sep 2024 07:13:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C6FC58C475; Fri, 6 Sep 2024 14:12:06 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id D3D3E1336DF; Fri, 6 Sep 2024 14:13:24 +0300 (MSK) Received: (nullmailer pid 353555 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 05/69] target/arm: LDAPR should honour SCTLR_ELx.nAA Date: Fri, 6 Sep 2024 14:12:14 +0300 Message-Id: <20240906111324.353230-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In commit c1a1f80518d360b when we added the FEAT_LSE2 relaxations to the alignment requirements for atomic and ordered loads and stores, we didn't quite get it right for LDAPR/LDAPRH/LDAPRB with no immediate offset. These instructions were handled in the old decoder as part of disas_ldst_atomic(), but unlike all the other insns that function decoded (LDADD, LDCLR, etc) these insns are "ordered", not "atomic", so they should be using check_ordered_align() rather than check_atomic_align(). Commit c1a1f80518d360b used check_atomic_align() regardless for everything in disas_ldst_atomic(). We then carried that incorrect check over in the decodetree conversion, where LDAPR/LDAPRH/LDAPRB are now handled by trans_LDAPR(). The effect is that when FEAT_LSE2 is implemented, these instructions don't honour the SCTLR_ELx.nAA bit and will generate alignment faults when they should not. (The LDAPR insns with an immediate offset were in disas_ldst_ldapr_stlr() and then in trans_LDAPR_i() and trans_STLR_i(), and have always used the correct check_ordered_align().) Use check_ordered_align() in trans_LDAPR(). Cc: qemu-stable@nongnu.org Fixes: c1a1f80518d360b ("target/arm: Relax ordered/atomic alignment checks for LSE2") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240709134504.3500007-3-peter.maydell@linaro.org (cherry picked from commit 25489b521b61b874c4c6583956db0012a3674e3a) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c index 2666d52711..922a16e5d4 100644 --- a/target/arm/tcg/translate-a64.c +++ b/target/arm/tcg/translate-a64.c @@ -3428,7 +3428,7 @@ static bool trans_LDAPR(DisasContext *s, arg_LDAPR *a) if (a->rn == 31) { gen_check_sp_alignment(s); } - mop = check_atomic_align(s, a->rn, a->sz); + mop = check_ordered_align(s, a->rn, 0, false, a->sz); clean_addr = gen_mte_check1(s, cpu_reg_sp(s, a->rn), false, a->rn != 31, mop); /* From patchwork Fri Sep 6 11:12:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825928 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp743987wrb; Fri, 6 Sep 2024 04:14:24 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUL/s5LQZtQFFmnpIgSjlqvBZA8rpQVBH+0YOxnbzk11Hx7FIJrFtqrTy6jCmWDF4s5GnGKIg==@linaro.org X-Google-Smtp-Source: AGHT+IGVE86UUwpyG0MKytBFeVXYLRtNN4d2l4mxrvnv+7k/52ZO869ecLQnblbEznlHuR1O3oGH X-Received: by 2002:a05:6122:3c48:b0:4f6:a85d:38b3 with SMTP id 71dfb90a1353d-5022104d011mr1745310e0c.13.1725621264420; Fri, 06 Sep 2024 04:14:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621264; cv=none; d=google.com; s=arc-20240605; b=C+oofvDNeAalCFkV7xEL4ieOLR3tC7E3PbWFORS74yjOXKxtHlGBbSogO36bHOHkXo YnuNZ/y3y4H+t7D8GtVqtQ3etFLUYS1SrpappH7aBF05Zbv5KJ8NihsG9BGShCtN0ySS 33ZJ4gkmi9LjOPE7feEqQrEW5J9BnV72gJ92NgJNJNYskb1ZnkDxzkBEJaouuQt6p7SM xSDzZDDsgszXaF2eF10cEH0fPK+ztl3zVEHj6hQLo2wz6y4/FqwvGapiixpbZe/Mf4uN L2Y9zGSJ4anbRstdFZAlre5Y2nELF9knXpyEaaBoZe1JKrSt54030t+tlAwtSktVxrvc reVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=2v/itSbhrsvC+OQ9czB9xUrt9HijAS9HoAxkePOeUAI=; fh=xcz4BIk6UKjOo0wG05W3ZY0KrLZqRuYba2k7grc93iY=; b=EX4JcM9UNZftwxxXxpuMflW/GCMKXtDPNtO2g7sMWbg7gI48QRyE3eMFAysaOBCOtQ gfLXDWshNCEtxokm7JiGq/clpMLgvKBwm67NSnjdfIEbkmRNYsKfb/3PFODOA89QvP5U N6Kq1nmGRgk/IfKgOkrHBIohxldDgkG4bTP1Z+9JcljF0hTWHI/o+yAGwm4n4WMjb3Wa QeVS2BYNtaMnZFQHuhGTlrjkoFURSoSJvC8TuCmSPaisSe662cCfPneiLnXMrqUL+RGa RG3kBlf96hp2PXEkgkSpASfSMROgrPbPxn5FXYiiSh0v+CIWceQL4Zd8K82J2j9IwiTu gisw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a1074300si4307585a.471.2024.09.06.04.14.24 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:14:24 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWuO-0000yE-VP; Fri, 06 Sep 2024 07:13:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWuL-0000hB-2f; Fri, 06 Sep 2024 07:13:41 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWuJ-0007gp-AY; Fri, 06 Sep 2024 07:13:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E96E88C477; Fri, 6 Sep 2024 14:12:06 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id F3B981336E1; Fri, 6 Sep 2024 14:13:24 +0300 (MSK) Received: (nullmailer pid 353561 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Daniyal Khan , =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Maydell , Michael Tokarev Subject: [Stable-9.0.3 07/69] target/arm: Use FPST_F16 for SME FMOPA (widening) Date: Fri, 6 Sep 2024 14:12:16 +0300 Message-Id: <20240906111324.353230-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson This operation has float16 inputs and thus must use the FZ16 control not the FZ control. Cc: qemu-stable@nongnu.org Fixes: 3916841ac75 ("target/arm: Implement FMOPA, FMOPS (widening)") Reported-by: Daniyal Khan Signed-off-by: Richard Henderson Reviewed-by: Alex Bennée Message-id: 20240717060149.204788-3-richard.henderson@linaro.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2374 Signed-off-by: Richard Henderson Reviewed-by: Alex Bennée Signed-off-by: Peter Maydell (cherry picked from commit 207d30b5fdb5b45a36f26eefcf52fe2c1714dd4f) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c index 46c7fce8b4..185a8a917b 100644 --- a/target/arm/tcg/translate-sme.c +++ b/target/arm/tcg/translate-sme.c @@ -304,6 +304,7 @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz, } static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, + ARMFPStatusFlavour e_fpst, gen_helper_gvec_5_ptr *fn) { int svl = streaming_vec_reg_size(s); @@ -319,15 +320,18 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, zm = vec_full_reg_ptr(s, a->zm); pn = pred_full_reg_ptr(s, a->pn); pm = pred_full_reg_ptr(s, a->pm); - fpst = fpstatus_ptr(FPST_FPCR); + fpst = fpstatus_ptr(e_fpst); fn(za, zn, zm, pn, pm, fpst, tcg_constant_i32(desc)); return true; } -TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, MO_32, gen_helper_sme_fmopa_h) -TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, gen_helper_sme_fmopa_s) -TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, MO_64, gen_helper_sme_fmopa_d) +TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, + MO_32, FPST_FPCR_F16, gen_helper_sme_fmopa_h) +TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, + MO_32, FPST_FPCR, gen_helper_sme_fmopa_s) +TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, + MO_64, FPST_FPCR, gen_helper_sme_fmopa_d) /* TODO: FEAT_EBF16 */ TRANS_FEAT(BFMOPA, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_bfmopa) From patchwork Fri Sep 6 11:12:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825932 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp744681wrb; Fri, 6 Sep 2024 04:16:04 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXCElEfTnqw0az8OZhWUf3VDrHEpSVI/ry5O8xm0UiXbSfO678FZQ2ktq4mTKP38lIKJpfzcg==@linaro.org X-Google-Smtp-Source: AGHT+IGHs3iT73YLDBq8/MHQdo0t3jOAAqxYRtAtjVZtexKO39zGNjCw513kjHvy5ybjglT5J0Bx X-Received: by 2002:a05:6214:5f0c:b0:6c3:7061:6d26 with SMTP id 6a1803df08f44-6c5285170e9mr36953466d6.26.1725621364323; Fri, 06 Sep 2024 04:16:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621364; cv=none; d=google.com; s=arc-20240605; b=WlyJdxSM2pctHgR/Pejrz2jkILXFeTYjUtLEf/AW5NSHTddCUgP7t1lZRgWogJ4vOX Yf4TBEXY2kuwux49kTrNfvt2UFvcbE/T4F9G7eiBJYHp40XeGkeLYZARuIaoGDZOhbks 0FOzm+Jj7s6G4NGPBTkkamYLDGNzMpS7u+5CZT+elKo6S+omQjA5RIbfV+2SPZgMnXL0 c71ZHN6hAUAOGhQ+yFr981Id60RpMsoS+nLG66pf7Jtb9SLsHUYYQJ2vhEt0W9J24ck+ RoPj8pjTdFU/knPSiBPpnbAe8jtO1gTa38zYWVfpBkddgpr0LDCf7DXp8XlxlBYhKtxd nVig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=PKxVIhJANFze+xmMcM8uP7S6Bd/ydxpmSXBo3WWzjJs=; fh=02U8TvTxRncM3RwMcFSoxHIXE7TbcrtGfM+dWJbu/Mg=; b=HxWbp35VkjOICP+8HFeHTGTuSCnhLmk1enbPnNfTLZuXYPhf8aq0zl5WZuVQ7cMnPO XLhP0M3iDCYsNwA7aMCAThMRzlsTapJeTU/3PxakZYa3ufMRjegOZYM40hRgHDEk9ojx x0Md6vxKQ1Mpc8cThYKkPCMsvY601p0jPAQNhseRiCoBB9QFLiVmGqYZ341JrPofHeGi +5bCZ3P3Ko8mVF+D8AXAmASMJjy0SlPvUhhByavexPf1jb88clL4uF0vWmhu25Bn2U7h zcm2Q3heLltf/ToP5nBrlU3chVidY//4TfjBqN50WNuxzC17NS4m5d9aG4lK1nL1Aq4s 21FQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c530633363si624856d6.144.2024.09.06.04.16.04 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:16:04 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWvM-0005iE-Qn; Fri, 06 Sep 2024 07:14:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvH-00057f-RX; Fri, 06 Sep 2024 07:14:39 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvD-0007kQ-Lc; Fri, 06 Sep 2024 07:14:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8FE488C481; Fri, 6 Sep 2024 14:12:07 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 9CD6F1336EB; Fri, 6 Sep 2024 14:13:25 +0300 (MSK) Received: (nullmailer pid 353595 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Song Gao , Michael Tokarev Subject: [Stable-9.0.3 17/69] hw/intc/loongson_ipi: Fix resource leak Date: Fri, 6 Sep 2024 14:12:26 +0300 Message-Id: <20240906111324.353230-17-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé Once initialised, QOM objects can be realized and unrealized multiple times before being finalized. Resources allocated in REALIZE must be deallocated in an equivalent UNREALIZE handler. Free the CPU array in loongson_ipi_unrealize() instead of loongson_ipi_finalize(). Cc: qemu-stable@nongnu.org Fixes: 5e90b8db382 ("hw/loongarch: Set iocsr address space per-board rather than percpu") Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Song Gao Message-Id: <20240723111405.14208-3-philmd@linaro.org> (cherry picked from commit 0c2086bc7360565dfb9933181dafaefe2c94cddf) Signed-off-by: Michael Tokarev (Mjt: rename loongson back to longarch for 9.0 due to lack of v9.0.0-582-gb4a12dfc2132 "hw/intc/loongarch_ipi: Rename as loongson_ipi") diff --git a/hw/intc/loongarch_ipi.c b/hw/intc/loongarch_ipi.c index 521731342c..c210b51811 100644 --- a/hw/intc/loongarch_ipi.c +++ b/hw/intc/loongarch_ipi.c @@ -301,6 +301,13 @@ static void loongarch_ipi_realize(DeviceState *dev, Error **errp) } } +static void loongarch_ipi_unrealize(DeviceState *dev) +{ + LoongArchIPI *s = LOONGARCH_IPI(dev); + + g_free(s->cpu); +} + static const VMStateDescription vmstate_ipi_core = { .name = "ipi-single", .version_id = 2, @@ -336,23 +343,16 @@ static void loongarch_ipi_class_init(ObjectClass *klass, void *data) DeviceClass *dc = DEVICE_CLASS(klass); dc->realize = loongarch_ipi_realize; + dc->unrealize = loongarch_ipi_unrealize; device_class_set_props(dc, ipi_properties); dc->vmsd = &vmstate_loongarch_ipi; } -static void loongarch_ipi_finalize(Object *obj) -{ - LoongArchIPI *s = LOONGARCH_IPI(obj); - - g_free(s->cpu); -} - static const TypeInfo loongarch_ipi_info = { .name = TYPE_LOONGARCH_IPI, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(LoongArchIPI), .class_init = loongarch_ipi_class_init, - .instance_finalize = loongarch_ipi_finalize, }; static void loongarch_ipi_register_types(void) From patchwork Fri Sep 6 11:12:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825940 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747050wrb; Fri, 6 Sep 2024 04:22:03 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCX03HH7m4fjtB2OQ/HeWhR8hMiYW4wEnG6NJgUht8UlKE+IEhzidowEHH7IYI724h8yH6tIUg==@linaro.org X-Google-Smtp-Source: AGHT+IHu9V1LvpNhgDnKLGfC+5RLLB784Tx7Hm8ysKyOPhXoIMa79CQqRvgpPACUjDqEPTGaQYGw X-Received: by 2002:a05:622a:44d:b0:454:f3d6:39c with SMTP id d75a77b69052e-4580c66bcb2mr22381971cf.7.1725621723725; Fri, 06 Sep 2024 04:22:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621723; cv=none; d=google.com; s=arc-20240605; b=Nhv/7HpNer/4aZJNaifWVQPRcNJBsxKUau6rLQfK8/93SgI9VOFs9Qm6m4toIdqfl5 HcKtq4z36ewuhRLVPbrpmQWxQlk7g1lHYYRB+YnO8GkzNDX9DUljkQqtx54YC6POg3ox SCBigOy3oy4wmeQdPG0xVXQ1B1Mgww+HVitdDINNvmC+CWeTvVcOVRrfCtHIIuYwDi67 IJHGcJ6MCT5lGiG2FFmTnmfVGYahuTQ2bAbqBXCOznAtPKJ5xYv3BEJ+x3LZ41ioFG3X U8VqBG3bEuucmQTIM9O/nKhHbhyeUKkoUdiy10hX2aAA6qQkrvi8e8VhZv61ckfDBC59 p/sA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=HFNFS5E5vdT1ugmx69GOxmDydAY7UrIB8MP+W/uaw6A=; fh=OJ0ls6GFiMU4hHpJ98tlecWoPYidhilmxQvB4+9yVtk=; b=Mbr5IOc6frUSegVk04khZPS4QFIfrNBMCgWXB877TucHkRZDii0+44+dXsAu4pYhHW Ti30uFuzWnnstM2p9mUUGBRqW1nALt0S4rltiIFfHhFh37Hq/llzxuC5xt/UnRD26vZY YtSPrSBviBTDj4v/AZHabbd09Ho6UuOdmgslIP0MdCK9mr55P8zK4+JNSXEdzko4WR4B FvYpuen32LzhiYZEapb2rHyenusgPKgrjZfh+3SPNzBpxw9HROrluZ2czxkmUfnal8uN kQDGz//8CTHbUsBbDiJznK+Hzr29PXW3clQ5F1F+oSI4w1i6uptt46XA4L6HizYJRxyn YOAw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c85d1csi28766021cf.347.2024.09.06.04.22.03 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:03 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWvO-0005vH-Vi; Fri, 06 Sep 2024 07:14:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvM-0005ff-BT; Fri, 06 Sep 2024 07:14:44 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvJ-0007ku-Ug; Fri, 06 Sep 2024 07:14:43 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AD7C38C483; Fri, 6 Sep 2024 14:12:07 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id B92A11336ED; Fri, 6 Sep 2024 14:13:25 +0300 (MSK) Received: (nullmailer pid 353601 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Stefan Hajnoczi , Michael Tokarev Subject: [Stable-9.0.3 19/69] util/async.c: Forbid negative min/max in aio_context_set_thread_pool_params() Date: Fri, 6 Sep 2024 14:12:28 +0300 Message-Id: <20240906111324.353230-19-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell aio_context_set_thread_pool_params() takes two int64_t arguments to set the minimum and maximum number of threads in the pool. We do some bounds checking on these, but we don't catch the case where the inputs are negative. This means that later in the function when we assign these inputs to the AioContext::thread_pool_min and ::thread_pool_max fields, which are of type int, the values might overflow the smaller type. A negative number of threads is meaningless, so make aio_context_set_thread_pool_params() return an error if either min or max are negative. Resolves: Coverity CID 1547605 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20240723150927.1396456-1-peter.maydell@linaro.org Signed-off-by: Stefan Hajnoczi (cherry picked from commit 851495571d14fe2226c52b9d423f88a4f5460836) Signed-off-by: Michael Tokarev diff --git a/util/async.c b/util/async.c index 0467890052..3e3e4fc712 100644 --- a/util/async.c +++ b/util/async.c @@ -746,7 +746,7 @@ void aio_context_set_thread_pool_params(AioContext *ctx, int64_t min, int64_t max, Error **errp) { - if (min > max || !max || min > INT_MAX || max > INT_MAX) { + if (min > max || max <= 0 || min < 0 || min > INT_MAX || max > INT_MAX) { error_setg(errp, "bad thread-pool-min/thread-pool-max values"); return; } From patchwork Fri Sep 6 11:12:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825931 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp744633wrb; Fri, 6 Sep 2024 04:15:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUy/CcKc3qWDqmSYVJFFSnhcfM8x4iMOkSgdaRI+QLpYzYG3A5YSQzV+SCfCIYICKs+8QCK5g==@linaro.org X-Google-Smtp-Source: AGHT+IEAtZb8BoUAQkDa11ZFm/RIFt3uw0rnDiJoXZzwwDtqj9mXNk69mFwrpOvP2ShUyn4FZlvO X-Received: by 2002:a05:620a:450a:b0:7a6:56f7:7b2a with SMTP id af79cd13be357-7a997331b99mr296827185a.26.1725621359197; Fri, 06 Sep 2024 04:15:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621359; cv=none; d=google.com; s=arc-20240605; b=NBdmdn2fngOM3OtY0LeyttsME157jgYmRxzYyFfX2WHbEx92QUYCDWPtFcP1qdpq4r 0h8110ye/Fm+VM9H5AvbajWVRuQIqn3+LLMonOmHwec8j4ImcG4dCE4flJ9EcGw1avph Hem5FPRP6Y3nArxCt8K5kJ29FJogPo+9Z+diwterZXhT/jQ8OhnmbLjJUUyqI62Opc0b 4xkoCF68ccgk5cAQl4fI3zKMcYnZdJvPphFuC4olpAq5GFvt+qjDAZkGbmadjMVynkpV +4bKW/Nqbuf647o0zQjtICnHENUnPqTSM2A/7cp1FKKYRJ9QAN/V0Kp5rk1J5DE2j/jY qIKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=MmdrbkmAv/D/0qlb5/k65O2mQHAFbFRl6/byTdfhs08=; fh=o/5N7/kxpeWjynMRXgRTkeR2GWte7sLJ7m091+z4hMo=; b=ImdmCnPyh/Szeqs4Q7KMg5fCUNMM4EbJy3FhOTSj/8nvmJEDzmZU/xF3Z0zwKCEo8J R+flCzbiA9MDxPbz5mne8igo55iW43C1msHjqFzPRiCGVYGftQV6ghMGEZsHeArwj6Fx Kjq5g0qWqfQ9McgyGSKu4XR+0T4A5HVr2K/BJ9KAELJg4aWpEiifhJ9ESqU3eCzcYAO/ 0Ous46rHYyTNgwXLrKMoU+4rfNwlGaHiqzTVziFWy4GO3PdZkgZcJq4EGGkUgTQsovV0 eGRmIOhNhvlqomfCQrKyl7E4WNz0YApvyksLG6lZjsn95bfBt8oFMfIyh8OmpAa0e6xI FCkg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a106a1adsi5194985a.345.2024.09.06.04.15.58 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:15:59 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWwS-0002d2-Jl; Fri, 06 Sep 2024 07:15:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvp-0000Hz-Bk; Fri, 06 Sep 2024 07:15:16 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvl-0007yG-PF; Fri, 06 Sep 2024 07:15:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id F09C48C486; Fri, 6 Sep 2024 14:12:07 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 095171336F0; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353610 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Thomas Huth , Michael Tokarev Subject: [Stable-9.0.3 22/69] target/rx: Use target_ulong for address in LI Date: Fri, 6 Sep 2024 14:12:31 +0300 Message-Id: <20240906111324.353230-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Using int32_t meant that the address was sign-extended to uint64_t when passing to translator_ld*, triggering an assert. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2453 Signed-off-by: Richard Henderson Tested-by: Thomas Huth (cherry picked from commit 83340193b991e7a974f117baa86a04db1fd835a9) Signed-off-by: Michael Tokarev diff --git a/target/rx/translate.c b/target/rx/translate.c index f6e9e0ec90..30d30770ac 100644 --- a/target/rx/translate.c +++ b/target/rx/translate.c @@ -86,7 +86,8 @@ static uint32_t decode_load_bytes(DisasContext *ctx, uint32_t insn, static uint32_t li(DisasContext *ctx, int sz) { - int32_t tmp, addr; + target_ulong addr; + uint32_t tmp; CPURXState *env = ctx->env; addr = ctx->base.pc_next; From patchwork Fri Sep 6 11:12:33 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825952 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp749336wrb; Fri, 6 Sep 2024 04:28:00 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCX9tO9jd5p0quc3oZ/8lTzGbHay1ZZYB9AJCOrgWv86+XkKgyGNJMSyvSuKxGSMY3fIRo5ovQ==@linaro.org X-Google-Smtp-Source: AGHT+IH9y80UmVcELefpNLMm2wBZmxgQoA+CwXvGENXoD2uQnBtOhsqpD4aSaaXln+RBdfVwAxiy X-Received: by 2002:a05:600c:4592:b0:42b:a9d7:93 with SMTP id 5b1f17b1804b1-42c9f9d7472mr17418345e9.28.1725622080636; Fri, 06 Sep 2024 04:28:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725622080; cv=none; d=google.com; s=arc-20240605; b=g6S6P4YhiHIa/jTgpnQCDjGGRsct61T5g7a0qglfjF5z8BTidK1yl9SkTMswpR0i1D Brx41wwaitamFaHUgvMKvy7op7R5rtNF/PhYCnwwZkheNWDXZyJLdgjKCm+ORQXNfW69 6hSR9dH+XPMegO+yV3RvuSOsxxYOLrWrsE1U21ObIDP+nfNDojd8uOwDdLzD7BHvwj+0 sRwNAUxe/B+CXOWTja57+340V7ZH5L0XsuqwK/TnTXR4UTjVugUDTMbhXJFhv6vTM22L GVxc6XQQv6DUSonrQz25+oRd4zKyfUn8GTFjaOgK8NW09RLJYh8gg3FF54dtT492jwIV fATw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=B4M7CY/9YUGT6RoEh/tR1M0jOZRNw6iBjTAFfuYSR0U=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=VPPYgMx1hDWzaDTp+KvjU/ngZoZPare1zFuJOdtClsHOnXBr9o4YtD0yxQOa3NQuIk zJoHZopm76dfRMpP4LhOHnaoWRaiCQ8gil6ow107NkwI6RKCz86kfdtfD+LNaXwQ3iRL kX3LAJeRErmcwlwOp3Zc01mdjDHIyavH3SejLWqlVYQtYHIWDVurqjBNAcFgTayNu1gs a8a1oZDvrE1ry1vt0INdtJRQNMLIrcqkM7x2x8EAtJirtoU/j4Wit5+Fgen9FZfwWl3r cT08C5aeVpdwtR0ETxo0c2ZNJxtm0mQemRwBQSrcX2rOBoJxu6/ybXSUaA+xlPKEw2Z4 C0dQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 5b1f17b1804b1-42ca05d7e69si6294535e9.148.2024.09.06.04.28.00 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:28:00 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWwm-0003oR-TQ; Fri, 06 Sep 2024 07:16:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvr-0000Mt-IA; Fri, 06 Sep 2024 07:15:16 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWvp-0007yu-Ki; Fri, 06 Sep 2024 07:15:15 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 28D968C488; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 295FA1336F2; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353618 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.0.3 24/69] hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE Date: Fri, 6 Sep 2024 14:12:33 +0300 Message-Id: <20240906111324.353230-24-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The documentation of the "Set palette" mailbox property at https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface#set-palette says it has the form: Length: 24..1032 Value: u32: offset: first palette index to set (0-255) u32: length: number of palette entries to set (1-256) u32...: RGBA palette values (offset to offset+length-1) We get this wrong in a couple of ways: * we aren't checking the offset and length are in range, so the guest can make us spin for a long time by providing a large length * the bounds check on our loop is wrong: we should iterate through 'length' palette entries, not 'length - offset' entries Fix the loop to implement the bounds checks and get the loop condition right. In the process, make the variables local to this switch case, rather than function-global, so it's clearer what type they are when reading the code. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20240723131029.1159908-2-peter.maydell@linaro.org (cherry picked from commit 0892fffc2abaadfb5d8b79bb0250ae1794862560) Signed-off-by: Michael Tokarev (Mjt: context fix due to lack of v9.0.0-1812-g5d5f1b60916a "hw/misc: Implement mailbox properties for customer OTP and device specific private keys" also remove now-unused local `n' variable which gets removed in the next change in this file, v9.0.0-2720-g32f1c201eedf "hw/misc/bcm2835_property: Avoid overflow in OTP access properties") diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c index bdd9a6bbce..faa489491c 100644 --- a/hw/misc/bcm2835_property.c +++ b/hw/misc/bcm2835_property.c @@ -30,8 +30,6 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value) uint32_t tot_len; size_t resplen; uint32_t tmp; - int n; - uint32_t offset, length, color; /* * Copy the current state of the framebuffer config; we will update @@ -273,19 +271,25 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value) resplen = 16; break; case RPI_FWREQ_FRAMEBUFFER_SET_PALETTE: - offset = ldl_le_phys(&s->dma_as, value + 12); - length = ldl_le_phys(&s->dma_as, value + 16); - n = 0; - while (n < length - offset) { - color = ldl_le_phys(&s->dma_as, value + 20 + (n << 2)); - stl_le_phys(&s->dma_as, - s->fbdev->vcram_base + ((offset + n) << 2), color); - n++; + { + uint32_t offset = ldl_le_phys(&s->dma_as, value + 12); + uint32_t length = ldl_le_phys(&s->dma_as, value + 16); + int resp; + + if (offset > 255 || length < 1 || length > 256) { + resp = 1; /* invalid request */ + } else { + for (uint32_t e = 0; e < length; e++) { + uint32_t color = ldl_le_phys(&s->dma_as, value + 20 + (e << 2)); + stl_le_phys(&s->dma_as, + s->fbdev->vcram_base + ((offset + e) << 2), color); + } + resp = 0; } - stl_le_phys(&s->dma_as, value + 12, 0); + stl_le_phys(&s->dma_as, value + 12, resp); resplen = 4; break; - + } case RPI_FWREQ_FRAMEBUFFER_GET_NUM_DISPLAYS: stl_le_phys(&s->dma_as, value + 12, 1); resplen = 4; From patchwork Fri Sep 6 11:12:34 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825936 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp746098wrb; Fri, 6 Sep 2024 04:19:32 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUY3kCen04Yv5V8fP/UbK/zpvtI8vExwJJy5u8f38YnB4ZTTgiivjTw1aMGwGvLRSecQ63C8g==@linaro.org X-Google-Smtp-Source: AGHT+IHooJZm6RZEHeZbqF3dLEXXKh8nBnLUWCALHjxG1XMfqbdBM2WzHlFQFEI/G87b+Iqv8vBq X-Received: by 2002:a05:620a:17a7:b0:79d:55f0:d092 with SMTP id af79cd13be357-7a997326ef2mr285838185a.8.1725621572322; Fri, 06 Sep 2024 04:19:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621572; cv=none; d=google.com; s=arc-20240605; b=S2wk7GX2XEjAwqbBPrvXtNacOsg1gyctrbzpfmbFYUtBrNc6oFqwYlDoDjopEkApCg bK++3xz+pNKcO+mlK/aq/XweCCWsiav6oYTSSmlJlIGD9H7tlD0prI5h0AwFh+zg0tz0 Bqxjc4ieqvptp0AoW9GYRK8v8Tn8HJX6cQLftWr6JjVkx6Pu8fyENbD/qZ8sedcm4IOc k2YzqYaXnZSKc3f6CL3LPWgl00LYEl8wDDJUAsUogYZeuf4pLMZTQDcULebsM0FN+kMl BVOPlILsi9WElFkT3xMSEWzTScfrdtF/Sk0XtJtTmsIqzZqRb07pMcyhXrrus/SApbLF o1NA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=n27VxaASKisTka2Xg9LM+6ajDouYxMxIIcJz3kE/bt0=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=DqkYruf1+FvPZ3Y6vSfeyiy6OzmQCcnc1rq+PqvflEaJA2JmHHWw9+frAkTP5/zmgM AGhKDlWvGvWAS6e5SLG0VJPA+BSU/prilXfUBSJk/nHCed15epREOruzEfYBAMdDUnGU lKDofbQT/xz6a/XmiGaukvEhjiiFGeNNWsQRK9pbSXQsJ8gKer+6hfDOzzzQgqWopKge ki1FushKKvoby9eE6hx4wnkPzZTBssFxZxu/zYKYmJFBZqKbRRFm4ixRGf6fHwvsxrcH jLeMrr5uT/tuAYnMdwxyJos+Aimh9mO9KGbDGSBBduk7n/V+9NYw181MPrHHbmB3Zwul +ZfA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a1068db3si5776385a.287.2024.09.06.04.19.32 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:19:32 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWxY-0007pt-53; Fri, 06 Sep 2024 07:17:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwF-0001yL-2s; Fri, 06 Sep 2024 07:15:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwB-0007zB-KJ; Fri, 06 Sep 2024 07:15:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3700E8C489; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 43F501336F3; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353621 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 25/69] target/arm: Don't assert for 128-bit tile accesses when SVL is 128 Date: Fri, 6 Sep 2024 14:12:34 +0300 Message-Id: <20240906111324.353230-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell For an instruction which accesses a 128-bit element tile when the SVL is also 128 (for example MOV z0.Q, p0/M, ZA0H.Q[w0,0]), we will assert in get_tile_rowcol(): qemu-system-aarch64: ../../tcg/tcg-op.c:926: tcg_gen_deposit_z_i32: Assertion `len > 0' failed. This happens because we calculate len = ctz32(streaming_vec_reg_size(s)) - esz;$ but if the SVL and the element size are the same len is 0, and the deposit operation asserts. In this case the ZA storage contains exactly one 128 bit element ZA tile, and the horizontal or vertical slice is just that tile. This means that regardless of the index value in the Ws register, we always access that tile. (In pseudocode terms, we calculate (index + offset) MOD 1, which is 0.) Special case the len == 0 case to avoid hitting the assertion in tcg_gen_deposit_z_i32(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-2-peter.maydell@linaro.org (cherry picked from commit 56f1c0db928aae0b83fd91c89ddb226b137e2b21) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c index 185a8a917b..a50a419af2 100644 --- a/target/arm/tcg/translate-sme.c +++ b/target/arm/tcg/translate-sme.c @@ -49,7 +49,15 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs, /* Prepare a power-of-two modulo via extraction of @len bits. */ len = ctz32(streaming_vec_reg_size(s)) - esz; - if (vertical) { + if (!len) { + /* + * SVL is 128 and the element size is 128. There is exactly + * one 128x128 tile in the ZA storage, and so we calculate + * (Rs + imm) MOD 1, which is always 0. We need to special case + * this because TCG doesn't allow deposit ops with len 0. + */ + tcg_gen_movi_i32(tmp, 0); + } else if (vertical) { /* * Compute the byte offset of the index within the tile: * (index % (svl / size)) * size From patchwork Fri Sep 6 11:12:35 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825945 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747416wrb; Fri, 6 Sep 2024 04:22:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW24BkhBLVqm7u7UNqNhxSkKRO153u5L2BryBrM7pdPSepVqRyswi1R7YAmp6clGCr0WKh8Jw==@linaro.org X-Google-Smtp-Source: AGHT+IExj85Wrl6BCrgIPzWKertwC7iXWaCZs8bLQc9ErVqN3wDqhwFEe2BrLa0hPXr1fXtAyecp X-Received: by 2002:a05:620a:4512:b0:79e:f878:7ffb with SMTP id af79cd13be357-7a996bb9ccdmr408986085a.9.1725621779195; Fri, 06 Sep 2024 04:22:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621779; cv=none; d=google.com; s=arc-20240605; b=dchuBeWV0srx5wtwwgiT2eR9GsPqq5RMByad/LMvmqZ2zK9fF2nQCkMP+w7epwgGjp wBv6GuBzBE6LwqZeOj8q0yzteDGraV5iccUZ5jWHGEtAfznAbhu6AxvalAhrNENE511m Q7ylvhmel4nX8jk3Vm7s1T0z96wDKEtyC0poWgRUwgZTR6EgHkgr0MW6fattmBbmOono e26f8J1dc4L0jP/p8nydArmW/tdRml63KNE3Cjze6RSG4ypUPm0ZXsomOILOsiihMxOr RsNB5Eoyrb1pcaKgoeTcuVUtH4WA8ak7eMN4nSoog9dQxfntQ8zVtRJHgdn+GtIDDv/S autA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=XOxtLhZ5tCE/URPeqJzT+qG9oFSUPUp/UoLzaMkVVtc=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=lP/4rzuhaMd1sLmRjxfaPjj/HVUAJ2RsZViV48Pfp7ryMkhGFYMQheokL0bumkiFV8 l5YYSvl3PadbwqFo6z4iVJcokyifDYAfofRr3MZc4MyvJ+POr3wKOVJFFpr3cGG48L0D O+1FFQa948yAwYHdbjfV++q2CcoWMZW1D9v9sJMLvRgQ9E/C6ySDxPOhc+EyAsaQpjf7 c6sirIizRL3odOTSb2U3cls29++hlgiHIIJlDqmNQeR1tJF5fE2d/dYFywvU8PzV5h9z k0PDXjS0HzarAVieRsJoRGfYLGz02jo3wHiclapWeM3gymK864qHHav7vKnVyUi2ISKq OCHw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a101c990si7552485a.26.2024.09.06.04.22.59 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:59 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWxI-0006yK-Hf; Fri, 06 Sep 2024 07:16:44 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwF-0001yM-6W; Fri, 06 Sep 2024 07:15:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwC-0007zO-Vh; Fri, 06 Sep 2024 07:15:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 4548B8C48A; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 51F411336F4; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353624 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 26/69] target/arm: Fix UMOPA/UMOPS of 16-bit values Date: Fri, 6 Sep 2024 14:12:35 +0300 Message-Id: <20240906111324.353230-26-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -57 X-Spam_score: -5.8 X-Spam_bar: ----- X-Spam_report: (-5.8 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, THIS_AD=1.099, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The UMOPA/UMOPS instructions are supposed to multiply unsigned 8 or 16 bit elements and accumulate the products into a 64-bit element. In the Arm ARM pseudocode, this is done with the usual infinite-precision signed arithmetic. However our implementation doesn't quite get it right, because in the DEF_IMOP_64() macro we do: sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0); where NTYPE and MTYPE are uint16_t or int16_t. In the uint16_t case, the C usual arithmetic conversions mean the values are converted to "int" type and the multiply is done as a 32-bit multiply. This means that if the inputs are, for example, 0xffff and 0xffff then the result is 0xFFFE0001 as an int, which is then promoted to uint64_t for the accumulation into sum; this promotion incorrectly sign extends the multiply. Avoid the incorrect sign extension by casting to int64_t before the multiply, so we do the multiply as 64-bit signed arithmetic, which is a type large enough that the multiply can never overflow into the sign bit. (The equivalent 8-bit operations in DEF_IMOP_32() are fine, because the 8-bit multiplies can never overflow into the sign bit of a 32-bit integer.) Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2372 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-3-peter.maydell@linaro.org (cherry picked from commit ea3f5a90f036734522e9af3bffd77e69e9f47355) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c index 5a6dd76489..f9001f5213 100644 --- a/target/arm/tcg/sme_helper.c +++ b/target/arm/tcg/sme_helper.c @@ -1146,10 +1146,10 @@ static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \ uint64_t sum = 0; \ /* Apply P to N as a mask, making the inactive elements 0. */ \ n &= expand_pred_h(p); \ - sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0); \ - sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16); \ - sum += (NTYPE)(n >> 32) * (MTYPE)(m >> 32); \ - sum += (NTYPE)(n >> 48) * (MTYPE)(m >> 48); \ + sum += (int64_t)(NTYPE)(n >> 0) * (MTYPE)(m >> 0); \ + sum += (int64_t)(NTYPE)(n >> 16) * (MTYPE)(m >> 16); \ + sum += (int64_t)(NTYPE)(n >> 32) * (MTYPE)(m >> 32); \ + sum += (int64_t)(NTYPE)(n >> 48) * (MTYPE)(m >> 48); \ return neg ? a - sum : a + sum; \ } From patchwork Fri Sep 6 11:12:36 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825949 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp748222wrb; Fri, 6 Sep 2024 04:25:10 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV1+BLKFVxBe0hqGD51/Uktx24sZyv2ZfLErLNP8yD8r8aLJz7K6qwrZfMSns+blRFBeBH/LQ==@linaro.org X-Google-Smtp-Source: AGHT+IGEHSfq1nVAXduHct6g0k7LbIqGFRLiztxjW5Sg3J+MxQUW9aTBSsT+VAZ83TaZWArMWao4 X-Received: by 2002:adf:ed0b:0:b0:374:c1c5:859e with SMTP id ffacd0b85a97d-3788967e478mr1530593f8f.42.1725621910334; Fri, 06 Sep 2024 04:25:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621910; cv=none; d=google.com; s=arc-20160816; b=vIdkd8SzFiVvNcAuT40plqzDutpSRZSaSyeXvW/Sw8aLtGsd1SiY3GDV10NEYgEOc1 M7gMbDj3rSEXpUpYE4AZ1C9P6bUK2kcECWJsU/BlkF3ETSqsDNsZy4KRlkc6vtaffikK YfUc/PUSoJvuCR878y6tiGBcvOvohdlZd89GFRxmV/9g7lHqX4xbeN5blJdGx74e/C2s efnkMZg8i9KKGlG50vB55QevHkLA3GGysKdmeYaPmL1NTDhZhN6PlBPMBW8pDL7x+b2W QGnhontTBg7VgsVwLkaDKfjvEtgyeB1YT4fQ1Ozj4MJTHcPiTzS60LuwotoHP2nvOc/m NCoQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=WXUELjxTo9H93go5y3CUd6H99Sq/VS7DyTeWtKTKIX0=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=mlZ8FHHUYxM1F8T19qsto548UuCjtPH46/bynq20LltJrYosk7OOOnq34hDpx503hG YlRnApJIz3Xe8gGuKjHjv3tngqYOJwHAefVYLA76C7R5pukrrwKYr8Wb22ZbLbkEORNH pbfmSXqL8iHCasJjfbqVCnwzyAAKbnXDi3ylKSGblD+ALnC4mvCSDNfZMHfcd2VodIfj 5LajbJpgVwvH24XVER0oja2sT0F3a+0/xtKgPHImdlZlusF5UQgSvW1fg7vy0z1UEIgI OdvpFHrnstyhjqhF/rpTyih56DmhOvf4aj70NNkEK7VYmMgXlHB7lEmDHgUPl7+x9+jB E78A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id ffacd0b85a97d-374c8d201desi5413106f8f.978.2024.09.06.04.25.10 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:25:10 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWxO-0007L3-Ng; Fri, 06 Sep 2024 07:16:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwI-0001yV-Af; Fri, 06 Sep 2024 07:15:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwG-00080o-Hj; Fri, 06 Sep 2024 07:15:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 532E98C48B; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 602371336F5; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353630 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 27/69] target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl() Date: Fri, 6 Sep 2024 14:12:36 +0300 Message-Id: <20240906111324.353230-27-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The function tszimm_esz() returns a shift amount, or possibly -1 in certain cases that correspond to unallocated encodings in the instruction set. We catch these later in the trans_ functions (generally with an "a-esz < 0" check), but before we do the decodetree-generated code will also call tszimm_shr() or tszimm_sl(), which will use the tszimm_esz() return value as a shift count without checking that it is not negative, which is undefined behaviour. Avoid the UB by checking the return value in tszimm_shr() and tszimm_shl(). Cc: qemu-stable@nongnu.org Resolves: Coverity CID 1547617, 1547694 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-4-peter.maydell@linaro.org (cherry picked from commit 76916dfa89e8900639c1055c07a295c06628a0bc) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c index ada05aa530..466a19c25a 100644 --- a/target/arm/tcg/translate-sve.c +++ b/target/arm/tcg/translate-sve.c @@ -50,13 +50,27 @@ static int tszimm_esz(DisasContext *s, int x) static int tszimm_shr(DisasContext *s, int x) { - return (16 << tszimm_esz(s, x)) - x; + /* + * We won't use the tszimm_shr() value if tszimm_esz() returns -1 (the + * trans function will check for esz < 0), so we can return any + * value we like from here in that case as long as we avoid UB. + */ + int esz = tszimm_esz(s, x); + if (esz < 0) { + return esz; + } + return (16 << esz) - x; } /* See e.g. LSL (immediate, predicated). */ static int tszimm_shl(DisasContext *s, int x) { - return x - (8 << tszimm_esz(s, x)); + /* As with tszimm_shr(), value will be unused if esz < 0 */ + int esz = tszimm_esz(s, x); + if (esz < 0) { + return esz; + } + return x - (8 << esz); } /* The SH bit is in bit 8. Extract the low 8 and shift. */ From patchwork Fri Sep 6 11:12:37 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825953 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp749451wrb; Fri, 6 Sep 2024 04:28:18 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXFZjdcGanAZv399n5OSiaSn3L2HS9IexCOPJ06svr/Sn9Qy82CrmRh7mNhbRKdjDSYZvgNTA==@linaro.org X-Google-Smtp-Source: AGHT+IFzs+Yg7BqKd8VBK2/pZVQZyB5ragUKSFxlFOV3X1xemdbjgtPS7UZ4FGI5t6EGeO9q4zuW X-Received: by 2002:a05:600c:3b9a:b0:426:62df:bdf0 with SMTP id 5b1f17b1804b1-42c9f983b92mr16306325e9.10.1725622097911; Fri, 06 Sep 2024 04:28:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725622097; cv=none; d=google.com; s=arc-20240605; b=CUJnAAOIliy1f9PgYfToS++71zegpGdK0rB5fyaSG2zTSrXJ9/9/X3iTHW21wyS6lO RT35NRbDSyBRBA7TqLTir9MvPVnofUFi5epB6wpYlRoydAYONZgM9l4z/msFrevrO2Ei ibKoezQXoSUvOXnoDkn8tQYlQpb8pp/n6YQfyyfCYYuhkgMUpXk2QVPNr6vMFk2BTxyp m5B0UFalIKs85kC1Rc/OrL9wMrflmgqcZfvLGmu3GTFcI0g8XSJM4ON2rKFSWHkvooqx dfArZ2c9qK+aG2yzKkuTQNkCAUjtm90HeCr4H1nuh7XmyaNxbVBooOEWEQKl8i0N8UE+ Ag4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=3IvW9hu07ExpPxcrbPRslYgjxhr7uj5vhgS/mPWpNBI=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=gTyMY8e56fCgVWwr4C4W/j6pDB7oEiV/Jr0bYJTEWfcsUomLdLxzmvop18IcFnCi4f BiCe2uVyilh8RR4/TObkmd9ET2PvQKLiK8BgsBFY4DFQnhTulnRuO18XIDvYuEu9ImvV 41XohTYXsjIudok3NFQDkq//3k/rKDSAbSp2HHq2w2c6Pw4ZkMPkdv1t9cyIho4BHPNJ a+I+8QxSe7QciuZ9ZHYX4bf7tjUxUWTLxElOjHtTjbZUA+6TUgLaOdiVpjYbWPhDlkV+ 0Wz4XFkLvxWuamYBdzua/y/mOtta4Ea97Z0EpDUOxZ+2skFfbkqUAxLVEOG/xc3ShJuV g9uw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 5b1f17b1804b1-42ca05bedcesi6220105e9.14.2024.09.06.04.28.17 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:28:17 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWx1-0005TS-II; Fri, 06 Sep 2024 07:16:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwI-0001yU-9Z; Fri, 06 Sep 2024 07:15:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwG-00080r-IQ; Fri, 06 Sep 2024 07:15:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 612858C48C; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 6E0C21336F6; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353633 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 28/69] target/arm: Ignore SMCR_EL2.LEN and SVCR_EL2.LEN if EL2 is not enabled Date: Fri, 6 Sep 2024 14:12:37 +0300 Message-Id: <20240906111324.353230-28-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When determining the current vector length, the SMCR_EL2.LEN and SVCR_EL2.LEN settings should only be considered if EL2 is enabled (compare the pseudocode CurrentSVL and CurrentNSVL which call EL2Enabled()). We were checking against ARM_FEATURE_EL2 rather than calling arm_is_el2_enabled(), which meant that we would look at SMCR_EL2/SVCR_EL2 when in Secure EL1 or Secure EL0 even if Secure EL2 was not enabled. Use the correct check in sve_vqm1_for_el_sm(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-5-peter.maydell@linaro.org (cherry picked from commit f573ac059ed060234fcef4299fae9e500d357c33) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index a620481d7c..42044ae14b 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -7191,7 +7191,7 @@ uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm) if (el <= 1 && !el_is_in_host(env, el)) { len = MIN(len, 0xf & (uint32_t)cr[1]); } - if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) { + if (el <= 2 && arm_is_el2_enabled(env)) { len = MIN(len, 0xf & (uint32_t)cr[2]); } if (arm_feature(env, ARM_FEATURE_EL3)) { From patchwork Fri Sep 6 11:12:38 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825935 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp745995wrb; Fri, 6 Sep 2024 04:19:13 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXQT6zN4Ev8sNTVoOd6pMZEdccgRY6MF7C8wCFHvqBr50dGcg5FvQCBYwwbjZFkXrIxtCn7FA==@linaro.org X-Google-Smtp-Source: AGHT+IGlUr1V8WypV3X1j8vO8r9MWLWUxus1AOECFGjynd8DSrIOzqTUMp/ymGzErtqapzPST0dA X-Received: by 2002:a05:6902:2482:b0:e0b:b85b:b8c3 with SMTP id 3f1490d57ef6-e1d349f1a0fmr2632871276.39.1725621553445; Fri, 06 Sep 2024 04:19:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621553; cv=none; d=google.com; s=arc-20240605; b=YzvISzq+UZgaJmWhPTdHsSnSJvK6bHTeDxFcWQvLFFSNkvxWMbJEp0oPKQje5H8MPF TaORgz7+KpJaIHIRSgBvG4ycMmMWhemibYJQFDq5Z7+IwHwhuRHiFBR2u27dQoJuar24 eVezJCNpUULrJx1PCWFMy6a3ORl+ePRsCBozSyN+9grmrYLHsvXLXQUDsxMYNcRS86vS QbKlVnqvm2xH+JiLTN4EA2f/ldspQ1/SUpIX1OrHUJH8D8Oml3roatfA0UMr+wvUJRVB FDdv+ZGji5rRkiOcUx6EKnbfMWSV4TPZNTf/ooHdETOpCIy0Li265A5AiXnQ6vyMMAoG LyNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=LxVt8Zqzx+mHsb5SPIqxofKuCv6ai9lg4miz52rF5Qk=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=Mo5txhSaBY37yBZHx1zypDfRLLZQ6rCMoAEXKF7uSwLdBlPLnX16AEdG+UA8xRn1LD PT0HF7p28K8QNKoN3NP4C8gDzNgxoNAt8/DwVddjgo+5H8gqTJ7wWl01e7+kYIpBqC13 GQCn16cPV+YCUHF7f5+i7+7fyffC7XOPED7C+8FcpRrM/AbyORoGdVtWTn0ThLpgzWot 2R0mv6TL15FUfHljjWn9y/fmdg+Q6owdrP8chpexl5mx85nSRFZtTSoBwodS7qxkvKpv vyGpWPsfxfo+1vQbRy+py61VP03o2yqpl5RlitOxYJDVwRmZFs7UqiMLA7EOAs89W7xn B0MA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c5306a89ddsi511116d6.518.2024.09.06.04.19.13 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:19:13 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWxr-0000fx-TW; Fri, 06 Sep 2024 07:17:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwL-00028l-Cx; Fri, 06 Sep 2024 07:15:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwJ-00081A-JO; Fri, 06 Sep 2024 07:15:45 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 6F4D58C48D; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 7C17D1336F7; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353637 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.0.3 29/69] docs/sphinx/depfile.py: Handle env.doc2path() returning a Path not a str Date: Fri, 6 Sep 2024 14:12:38 +0300 Message-Id: <20240906111324.353230-29-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In newer versions of Sphinx the env.doc2path() API is going to change to return a Path object rather than a str. This was originally visible in Sphinx 8.0.0rc1, but has been rolled back for the final 8.0.0 release. However it will probably emit a deprecation warning and is likely to change for good in 9.0: https://github.com/sphinx-doc/sphinx/issues/12686 Our use in depfile.py assumes a str, and if it is passed a Path it will fall over: Handler for event 'build-finished' threw an exception (exception: unsupported operand type(s) for +: 'PosixPath' and 'str') Wrapping the env.doc2path() call in str() will coerce a Path object to the str we expect, and have no effect in older Sphinx versions that do return a str. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2458 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240729120533.2486427-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 48e5b5f994bccf161dd88a67fdd819d4bfb400f1) Signed-off-by: Michael Tokarev diff --git a/docs/sphinx/depfile.py b/docs/sphinx/depfile.py index afdcbcec6e..e74be6af98 100644 --- a/docs/sphinx/depfile.py +++ b/docs/sphinx/depfile.py @@ -19,7 +19,7 @@ def get_infiles(env): for x in env.found_docs: - yield env.doc2path(x) + yield str(env.doc2path(x)) yield from ((os.path.join(env.srcdir, dep) for dep in env.dependencies[x])) for mod in sys.modules.values(): From patchwork Fri Sep 6 11:12:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825933 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp745679wrb; Fri, 6 Sep 2024 04:18:20 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWLDQzUGe6iOpYY6fhYOHZ2RU9hrmAKwceyLgl6OVRjlnfqLOo3hBn+JEcft+wC9qZpUSWKUA==@linaro.org X-Google-Smtp-Source: AGHT+IHehQcf+c+fRXhPAAZEpdCiOHFQKWBlxSTV1EakXn1suTaTD9td2DBeQfXRMw1ANdUaCB7s X-Received: by 2002:a05:6830:6c84:b0:70f:6eca:d48a with SMTP id 46e09a7af769-70f6ecad923mr23032817a34.10.1725621500417; Fri, 06 Sep 2024 04:18:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621500; cv=none; d=google.com; s=arc-20240605; b=Q49ybqxki8X6RCkOpyhce9sZ7jFfMSYQ83Qoh1Ar+oIXFhysp8ur+IVgGw9bJfeoPY UHggPPFTnXUqJTt68wligIEqO0wSDIBLuPmhuNjkTfd1ceq2o45O4nbQk4m+beMdDltC JK88q0phFa5wGp0DzuuZhB2y5B0LonAMLhYLYe2ZwHXKgMa05coQ3t/0X0/hEheU+wnb gO7J8R2tzKdjRgkPtVusqxgtntV5z7VbZ4SZVhsqeNB416VjNs+HCf791pEuvzKRF4YD zvV+AlS62WG6fUn+s9mV0ApgWUQbw5uxetDGfWPOqmmCXgOGQ0t5+9rM1ScmPPlZ8cyr FmZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=jeOI5JJ7IzF9+6PTzm7Q+MGfwvrRj6Mw8ga8jsxj3yY=; fh=lkSFXoxMdr4qZMbOju3jrj6agwaYXwlSFfKSAqY95WM=; b=DqPVR7I/OTzl+Bl487dCV2pvl5HauEZ4JDaNOWeIEZLZI00cgvUlBPwTVOf8jvmrST TXRHbd+vuBnqU6DIorSXQss+9/+2JDY5zUacCti9//ZDBPnhppRbvsfxRvtxGu495aPP GEU1IZIhW8hOPYf/h4KZy4Q88ENJLMrCEbTIJwdgQeQ59r5w9FUay45ZuvNqm1efXCuQ a7DTkWKkAW6aEGJCENQ+ZTN9xWq7kjRTFeS+m/pBSvZcFfATv5jKXpEU/xESfkFWwteN L0BRhBm7vxecFfxbvsE2F7q34zPGrb4w7FNFZXXlvkSlAAtNXKSSe+bc8MbmZf7sD7Wj uRQw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c4cdf0si25518741cf.100.2024.09.06.04.18.20 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:18:20 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWxG-0006nj-SZ; Fri, 06 Sep 2024 07:16:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwg-000485-IG; Fri, 06 Sep 2024 07:16:10 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwd-00081D-T0; Fri, 06 Sep 2024 07:16:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7D2A48C48E; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 8A1C81336F8; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353640 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , "Michael S . Tsirkin" , Michael Tokarev Subject: [Stable-9.0.3 30/69] hw/i386/amd_iommu: Don't leak memory in amdvi_update_iotlb() Date: Fri, 6 Sep 2024 14:12:39 +0300 Message-Id: <20240906111324.353230-30-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In amdvi_update_iotlb() we will only put a new entry in the hash table if to_cache.perm is not IOMMU_NONE. However we allocate the memory for the new AMDVIIOTLBEntry and for the hash table key regardless. This means that in the IOMMU_NONE case we will leak the memory we alloacted. Move the allocations into the if() to the point where we know we're going to add the item to the hash table. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2452 Signed-off-by: Peter Maydell Message-Id: <20240731170019.3590563-1-peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 9a45b0761628cc59267b3283a85d15294464ac31) Signed-off-by: Michael Tokarev diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c index 6d4fde72f9..87643d2891 100644 --- a/hw/i386/amd_iommu.c +++ b/hw/i386/amd_iommu.c @@ -357,12 +357,12 @@ static void amdvi_update_iotlb(AMDVIState *s, uint16_t devid, uint64_t gpa, IOMMUTLBEntry to_cache, uint16_t domid) { - AMDVIIOTLBEntry *entry = g_new(AMDVIIOTLBEntry, 1); - uint64_t *key = g_new(uint64_t, 1); - uint64_t gfn = gpa >> AMDVI_PAGE_SHIFT_4K; - /* don't cache erroneous translations */ if (to_cache.perm != IOMMU_NONE) { + AMDVIIOTLBEntry *entry = g_new(AMDVIIOTLBEntry, 1); + uint64_t *key = g_new(uint64_t, 1); + uint64_t gfn = gpa >> AMDVI_PAGE_SHIFT_4K; + trace_amdvi_cache_update(domid, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), gpa, to_cache.translated_addr); From patchwork Fri Sep 6 11:12:41 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825938 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp746581wrb; Fri, 6 Sep 2024 04:20:50 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVpsL+iJ+9bWk6AB0BV+UQSgLmS1LFI2BYkGUM7HL9lcZBocSG6JqUoZL/v3Gw/9Wy9qGKiUA==@linaro.org X-Google-Smtp-Source: AGHT+IED3eiu6VWaK77RffZNGI/umD1oDcg2CaY0VuNA2xU6eYcmgbzOXTkDtWywsV7nrQK5lgL7 X-Received: by 2002:a05:6830:911:b0:703:6ac4:2ab8 with SMTP id 46e09a7af769-710cc1cd2e8mr2348526a34.0.1725621649720; Fri, 06 Sep 2024 04:20:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621649; cv=none; d=google.com; s=arc-20240605; b=NZT8whhocrKgq1q+Y5yIglvKFBGmngojQLIb95bS6lwaLhASVX5Xn5ef3Gcb+BocE9 lhW653S861eozJwTZ0Wpq9Bi8Z0cLcEpGoxwnO0705L0GmFG+gPYA5i5T3o2iFE6Q1T+ 1y7RuBC8KP3bN2Xxk0X4Lp9V09+6GGZN3LTfjsHZigf6LK0k6yX6wrGK2KNKqsWrA2Bb XdkSApp4YbD1Ptbl385PRvfU/521BVKch3gey2Qyji2T0xn2G9jy9aakmtB4jLxfubnt HCtuxOAwsvkodyr6datiIBagZbUBYB4N87k8htc48IcpK0GGyWxTkgGRI8HxrAGU6glN S9VQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=gmFVaIR/B+pwV8/QFmFWNFKhLR9EVK5Jw2DEXJkWPBU=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=Xcats37c//Q/SE3U3++5r0BhLzoOvO8edCn30xaaYLO7dldguGK7DeSCRK/Cwyfb+H WGV2Lng9bnGTHa20blYr1bk6Y5YmQKdQsiqZm/PsLyccg2QnrnJWjhbYiK80BjopEBeB NskjmlbHg0ShzALykjNhvq2sNNFchh+xDBrEKZksF0TV32kf2nYbRuWqR9tYVaOsqgkK Vqk7sVDt5HeGz9WPtBevn8HsVwE9qis6N1PcyKYZFjLgPRKX+uMbyLlCxcLxxPt/+ZFR E8EYesi9oSTtmMo1D7enAXczpndeXmj/UKrhYexg79pwPGwVquq8rmIFLVMWfDMWEL/f gCJA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c53062a25csi742086d6.22.2024.09.06.04.20.48 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:20:49 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWxN-0007HT-E5; Fri, 06 Sep 2024 07:16:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwk-0004O3-HN; Fri, 06 Sep 2024 07:16:14 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWwi-00083J-Ei; Fri, 06 Sep 2024 07:16:10 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9A76C8C490; Fri, 6 Sep 2024 14:12:08 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id A61131336FA; Fri, 6 Sep 2024 14:13:26 +0300 (MSK) Received: (nullmailer pid 353647 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 32/69] target/arm: Handle denormals correctly for FMOPA (widening) Date: Fri, 6 Sep 2024 14:12:41 +0300 Message-Id: <20240906111324.353230-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The FMOPA (widening) SME instruction takes pairs of half-precision floating point values, widens them to single-precision, does a two-way dot product and accumulates the results into a single-precision destination. We don't quite correctly handle the FPCR bits FZ and FZ16 which control flushing of denormal inputs and outputs. This is because at the moment we pass a single float_status value to the helper function, which then uses that configuration for all the fp operations it does. However, because the inputs to this operation are float16 and the outputs are float32 we need to use the fp_status_f16 for the float16 input widening but the normal fp_status for everything else. Otherwise we will apply the flushing control FPCR.FZ16 to the 32-bit output rather than the FPCR.FZ control, and incorrectly flush a denormal output to zero when we should not (or vice-versa). (In commit 207d30b5fdb5b we tried to fix the FZ handling but didn't get it right, switching from "use FPCR.FZ for everything" to "use FPCR.FZ16 for everything".) (Mjt: it is commit 43929c818c4b in stable-9.0) Pass the CPU env to the sme_fmopa_h helper instead of an fp_status pointer, and have the helper pass an extra fp_status into the f16_dotadd() function so that we can use the right status for the right parts of this operation. Cc: qemu-stable@nongnu.org Fixes: 207d30b5fdb5 ("target/arm: Use FPST_F16 for SME FMOPA (widening)") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2373 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson (cherry picked from commit 55f9f4ee018c5ccea81d8c8c586756d7711ae46f) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/helper-sme.h b/target/arm/tcg/helper-sme.h index 27eef49a11..d22bf9d21b 100644 --- a/target/arm/tcg/helper-sme.h +++ b/target/arm/tcg/helper-sme.h @@ -121,7 +121,7 @@ DEF_HELPER_FLAGS_5(sme_addha_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32) DEF_HELPER_FLAGS_5(sme_addva_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32) DEF_HELPER_FLAGS_7(sme_fmopa_h, TCG_CALL_NO_RWG, - void, ptr, ptr, ptr, ptr, ptr, ptr, i32) + void, ptr, ptr, ptr, ptr, ptr, env, i32) DEF_HELPER_FLAGS_7(sme_fmopa_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, ptr, i32) DEF_HELPER_FLAGS_7(sme_fmopa_d, TCG_CALL_NO_RWG, diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c index f9001f5213..3906bb51c0 100644 --- a/target/arm/tcg/sme_helper.c +++ b/target/arm/tcg/sme_helper.c @@ -976,12 +976,23 @@ static inline uint32_t f16mop_adj_pair(uint32_t pair, uint32_t pg, uint32_t neg) } static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2, - float_status *s_std, float_status *s_odd) + float_status *s_f16, float_status *s_std, + float_status *s_odd) { - float64 e1r = float16_to_float64(e1 & 0xffff, true, s_std); - float64 e1c = float16_to_float64(e1 >> 16, true, s_std); - float64 e2r = float16_to_float64(e2 & 0xffff, true, s_std); - float64 e2c = float16_to_float64(e2 >> 16, true, s_std); + /* + * We need three different float_status for different parts of this + * operation: + * - the input conversion of the float16 values must use the + * f16-specific float_status, so that the FPCR.FZ16 control is applied + * - operations on float32 including the final accumulation must use + * the normal float_status, so that FPCR.FZ is applied + * - we have pre-set-up copy of s_std which is set to round-to-odd, + * for the multiply (see below) + */ + float64 e1r = float16_to_float64(e1 & 0xffff, true, s_f16); + float64 e1c = float16_to_float64(e1 >> 16, true, s_f16); + float64 e2r = float16_to_float64(e2 & 0xffff, true, s_f16); + float64 e2c = float16_to_float64(e2 >> 16, true, s_f16); float64 t64; float32 t32; @@ -1003,20 +1014,23 @@ static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2, } void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn, - void *vpm, void *vst, uint32_t desc) + void *vpm, CPUARMState *env, uint32_t desc) { intptr_t row, col, oprsz = simd_maxsz(desc); uint32_t neg = simd_data(desc) * 0x80008000u; uint16_t *pn = vpn, *pm = vpm; - float_status fpst_odd, fpst_std; + float_status fpst_odd, fpst_std, fpst_f16; /* - * Make a copy of float_status because this operation does not - * update the cumulative fp exception status. It also produces - * default nans. Make a second copy with round-to-odd -- see above. + * Make copies of fp_status and fp_status_f16, because this operation + * does not update the cumulative fp exception status. It also + * produces default NaNs. We also need a second copy of fp_status with + * round-to-odd -- see above. */ - fpst_std = *(float_status *)vst; + fpst_f16 = env->vfp.fp_status_f16; + fpst_std = env->vfp.fp_status; set_default_nan_mode(true, &fpst_std); + set_default_nan_mode(true, &fpst_f16); fpst_odd = fpst_std; set_float_rounding_mode(float_round_to_odd, &fpst_odd); @@ -1036,7 +1050,8 @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn, uint32_t m = *(uint32_t *)(vzm + H1_4(col)); m = f16mop_adj_pair(m, pcol, 0); - *a = f16_dotadd(*a, n, m, &fpst_std, &fpst_odd); + *a = f16_dotadd(*a, n, m, + &fpst_f16, &fpst_std, &fpst_odd); } col += 4; pcol >>= 4; diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c index a50a419af2..ae42ddef7b 100644 --- a/target/arm/tcg/translate-sme.c +++ b/target/arm/tcg/translate-sme.c @@ -334,8 +334,29 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, return true; } -TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, - MO_32, FPST_FPCR_F16, gen_helper_sme_fmopa_h) +static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz, + gen_helper_gvec_5_ptr *fn) +{ + int svl = streaming_vec_reg_size(s); + uint32_t desc = simd_desc(svl, svl, a->sub); + TCGv_ptr za, zn, zm, pn, pm; + + if (!sme_smza_enabled_check(s)) { + return true; + } + + za = get_tile(s, esz, a->zad); + zn = vec_full_reg_ptr(s, a->zn); + zm = vec_full_reg_ptr(s, a->zm); + pn = pred_full_reg_ptr(s, a->pn); + pm = pred_full_reg_ptr(s, a->pm); + + fn(za, zn, zm, pn, pm, tcg_env, tcg_constant_i32(desc)); + return true; +} + +TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a, + MO_32, gen_helper_sme_fmopa_h) TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, FPST_FPCR, gen_helper_sme_fmopa_s) TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, From patchwork Fri Sep 6 11:12:47 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825943 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747291wrb; Fri, 6 Sep 2024 04:22:40 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW/hdPjS3tX75ww0R2Oi6x4d1S+1VgZn9+MkXRpYPnEooLLFXGDPA4e+h/FrqBIp1Yf+T/M5g==@linaro.org X-Google-Smtp-Source: AGHT+IG0rYvYvmXIWqJF6PnNZ4nL++Jvgoyd+/mtaxATooDvM4+6Hzfn2HeDf883raB0ZKsptp6k X-Received: by 2002:a05:620a:458c:b0:795:e9cd:f5b8 with SMTP id af79cd13be357-7a9888f0d41mr1450565185a.23.1725621759973; Fri, 06 Sep 2024 04:22:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621759; cv=none; d=google.com; s=arc-20240605; b=k+DcwsKp4hAfb7DUgADr1OKpojuEoKKBz74IW6kEWIy8a4oVbjzACNzWk37PpbmAfj BnQJtfyM3yT0ldAzmYruKTswvYmtSnEZuYFVLh/OIttj+Wgruhcgee9DFwjy6jx2k2aX VNxUIKrSBfgECZRC3thurvaxQRyHHlczrzsvXKJ6SO1FamPi/gkvQm/Xh05wTn0j3i48 addC8WXtiOFKz8YuFnIU5xrrIMuZdTt7l89uCwdwhUOx6fUqnLPt0oJftzCms27zePa2 WcPC06sFvTsT8WxIOsH4XT0gBps57HzNv2inJOzAUszePvH4J0Vwp6CKsyecCAskik/L HhOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=4z14kBQIUutr5CFqWlDgS0oV0xFE7lEhUOQyhp6gj3M=; fh=73++FxpCBH5KDXgG1Nqvg9f5zGI68qj4hqVYWy1KEho=; b=Ni6xCTgu/5XNuXnfVgk5rKqk2PkZRByPQlVJ/qbkykEtQlyje5P79Hx/460Xa35LVx h9zMFSEkWTzL8nzoLlesptczCCiHTdZD7UU9J5CSqpBRNEPeIxuo8WvL+V7OE3u9FV6J WW4UPT7ovMhLDQZqeoAF8rRwGvGIzUaMNw8XqsKxBE7C/LZA1BFeiYOOkUuka756Yvyv fsq41SMVzJ/jE0A34HF6lA+BZ8x4xLuztTVO05Klrz+6+36pkMoTCv2d7/D+AAaC5XnN r9lOmdLnJRPlEWWsCfDguBJK/OIpzhlRIP02txWgLMwGZz6jORftCIO1sYoJqne6PQQY BMdQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a101d903si7332285a.91.2024.09.06.04.22.39 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:39 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWy9-0001iD-Jx; Fri, 06 Sep 2024 07:17:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWxF-0006lc-Mz; Fri, 06 Sep 2024 07:16:41 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWxD-00087X-Cj; Fri, 06 Sep 2024 07:16:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0D4728C496; Fri, 6 Sep 2024 14:12:09 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 18F50133700; Fri, 6 Sep 2024 14:13:27 +0300 (MSK) Received: (nullmailer pid 353667 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Paolo Bonzini , Michael Tokarev Subject: [Stable-9.0.3 38/69] target/i386: Fix VSIB decode Date: Fri, 6 Sep 2024 14:12:47 +0300 Message-Id: <20240906111324.353230-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson With normal SIB, index == 4 indicates no index. With VSIB, there is no exception for VR4/VR12. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2474 Signed-off-by: Richard Henderson Link: https://lore.kernel.org/r/20240805003130.1421051-3-richard.henderson@linaro.org Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini (cherry picked from commit ac63755b20013ec6a3d2aef4538d37dc90bc3d10) Signed-off-by: Michael Tokarev (Mjt: modify the change to pre-new-decoder introduced past qemu 9.0) diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc index 4209d59ca8..2ca874b59d 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -1135,7 +1135,8 @@ static int decode_modrm(DisasContext *s, CPUX86State *env, X86DecodedInsn *decod } else { op->has_ea = true; op->n = -1; - decode->mem = gen_lea_modrm_0(env, s, get_modrm(s, env)); + decode->mem = gen_lea_modrm_0(env, s, modrm, + decode->e.vex_class == 12); } return modrm; } diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 26ed900f34..e2e3b3d7c3 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -2187,7 +2187,7 @@ typedef struct AddressParts { } AddressParts; static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s, - int modrm) + int modrm, bool is_vsib) { int def_seg, base, index, scale, mod, rm; target_long disp; @@ -2216,7 +2216,7 @@ static AddressParts gen_lea_modrm_0(CPUX86State *env, DisasContext *s, int code = x86_ldub_code(env, s); scale = (code >> 6) & 3; index = ((code >> 3) & 7) | REX_X(s); - if (index == 4) { + if (index == 4 && !is_vsib) { index = -1; /* no index */ } base = (code & 7) | REX_B(s); @@ -2346,21 +2346,21 @@ static TCGv gen_lea_modrm_1(DisasContext *s, AddressParts a, bool is_vsib) static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm) { - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); TCGv ea = gen_lea_modrm_1(s, a, false); gen_lea_v_seg(s, s->aflag, ea, a.def_seg, s->override); } static void gen_nop_modrm(CPUX86State *env, DisasContext *s, int modrm) { - (void)gen_lea_modrm_0(env, s, modrm); + (void)gen_lea_modrm_0(env, s, modrm, false); } /* Used for BNDCL, BNDCU, BNDCN. */ static void gen_bndck(CPUX86State *env, DisasContext *s, int modrm, TCGCond cond, TCGv_i64 bndv) { - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); TCGv ea = gen_lea_modrm_1(s, a, false); tcg_gen_extu_tl_i64(s->tmp1_i64, ea); @@ -4179,7 +4179,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) goto illegal_op; reg = ((modrm >> 3) & 7) | REX_R(s); { - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); TCGv ea = gen_lea_modrm_1(s, a, false); gen_lea_v_seg(s, s->aflag, ea, -1, -1); gen_op_mov_reg_v(s, dflag, reg, s->A0); @@ -4400,7 +4400,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) op = ((b & 7) << 3) | ((modrm >> 3) & 7); if (mod != 3) { /* memory op */ - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); TCGv ea = gen_lea_modrm_1(s, a, false); TCGv last_addr = tcg_temp_new(); bool update_fdp = true; @@ -5348,7 +5348,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) rm = (modrm & 7) | REX_B(s); gen_op_mov_v_reg(s, MO_32, s->T1, reg); if (mod != 3) { - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); /* specific case: we need to add a displacement */ gen_exts(ot, s->T1); tcg_gen_sari_tl(s->tmp0, s->T1, 3 + ot); @@ -6343,7 +6343,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) } } else if (mod != 3) { /* bndldx */ - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16 @@ -6387,7 +6387,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) || s->aflag == MO_16) { goto illegal_op; } - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); if (a.base >= 0) { tcg_gen_extu_tl_i64(cpu_bndl[reg], cpu_regs[a.base]); if (!CODE64(s)) { @@ -6448,7 +6448,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) } } else if (mod != 3) { /* bndstx */ - AddressParts a = gen_lea_modrm_0(env, s, modrm); + AddressParts a = gen_lea_modrm_0(env, s, modrm, false); if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16 From patchwork Fri Sep 6 11:12:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825947 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747479wrb; Fri, 6 Sep 2024 04:23:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWGCvKTs0/8eWmDlWQhlmaFLdMP3dfYVCRLquN+hDSG/U/rXeN9EY6E/OfwnPjLrCHEyKkw7Q==@linaro.org X-Google-Smtp-Source: AGHT+IGcw8zT9ILUtTQmXIbePj9ykBKFE+xVF7ICG94fUEqlvely6OXASHod0ZEvEOAGrPqHztPr X-Received: by 2002:a05:6102:510b:b0:492:abbe:8923 with SMTP id ada2fe7eead31-49bde14671dmr2157735137.6.1725621787541; Fri, 06 Sep 2024 04:23:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621787; cv=none; d=google.com; s=arc-20240605; b=JIWzHAsnjYq6jg6Zz1vdz4StTqalz4y7OwjZ+cSx1bHhjLgKKofkZiLGEFaRwjUOqn IN6E7qS1FRXrmc6pZh46kZCUgRjara/3TJ44FzJNcjG6y2kmtVw5GwhmwIHwbO4mFR41 0o5zeinpt3zwgZ9DMgyEoiTpcqd8nJnGx4VjyMH69noNJ/BRMdQfU+AUQAiv0eXolJqI wPGKBOdZ38O0uWh/OoQd4uUg/C20W4VczJaxe4wjCvxjJ0Pgozvl5Ty7l7Npg7kdkpuL jA5msB3jsYtpiIxtYEHyvu0ph5rSdc0TD9TZju2HQSLrUQtYVTUUoby9Q/QBbl/TQfSe RKEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=zSlG5KPYctJ/8eNI4yjj6IBMa87EUwiUJpb1qGpdH4o=; fh=K4abbxCgZAPvqzOXA+PZ7RIZh+KufMVJze7rXLOwES0=; b=HllX6JcLHC71DTFAyKgLk7tCWkRotRZ4Rpvg0VBA4hrz0koIkbFpSEILWCIUc2bDQ1 SlHKnTALWBhxk7j2/Avn5jvdtObDscipxS2+xA/90LC//8nDNwo33NxG4CgPuinHZYxg hvDTDJZmeIxpi0Z98k/KGerSah9GpRzxtY/BmaZ3HWbVWGuu10oQzkteqywFYPNtQqmV PXR86i670J1srjqstkAJp2jQyHi1o9qut/Jh2jfr3Q6YBbL67YA83is1FfU6uBR5UPWq pL7Eh/waShg8KwoYUGXhTkJmRAuPGgI7C55fnvs5p2vNAvF5sp+KjiFgp60THdaIVIMu TlAw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a108d465si5267485a.737.2024.09.06.04.23.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:23:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWyZ-0003yS-1V; Fri, 06 Sep 2024 07:18:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWxc-0008DY-9r; Fri, 06 Sep 2024 07:17:04 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWxa-00087s-AN; Fri, 06 Sep 2024 07:17:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1B42D8C497; Fri, 6 Sep 2024 14:12:09 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 283A3133701; Fri, 6 Sep 2024 14:13:27 +0300 (MSK) Received: (nullmailer pid 353670 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.0.3 39/69] tcg/ppc: Sync tcg_out_test and constraints Date: Fri, 6 Sep 2024 14:12:48 +0300 Message-Id: <20240906111324.353230-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Ensure the code structure is the same for matching constraints and emitting code, lest we allow constants that cannot be trivially tested. Cc: qemu-stable@nongnu.org Fixes: ad788aebbab ("tcg/ppc: Support TCG_COND_TST{EQ,NE}") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2487 Signed-off-by: Richard Henderson Message-Id: <44328324-af73-4439-9d2b-d414e0e13dd7@linaro.org> Reviewed-by: Philippe Mathieu-Daudé (cherry picked from commit 682a05280504d2fab32e16096b58d7ea068435c2) Signed-off-by: Michael Tokarev diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc index 7f3829beeb..3553a47ba9 100644 --- a/tcg/ppc/tcg-target.c.inc +++ b/tcg/ppc/tcg-target.c.inc @@ -325,9 +325,11 @@ static bool tcg_target_const_match(int64_t sval, int ct, if ((uval & ~0xffff) == 0 || (uval & ~0xffff0000ull) == 0) { return 1; } - if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32 - ? mask_operand(uval, &mb, &me) - : mask64_operand(uval << clz64(uval), &mb, &me)) { + if (uval == (uint32_t)uval && mask_operand(uval, &mb, &me)) { + return 1; + } + if (TCG_TARGET_REG_BITS == 64 && + mask64_operand(uval << clz64(uval), &mb, &me)) { return 1; } return 0; @@ -1749,8 +1751,6 @@ static void tcg_out_test(TCGContext *s, TCGReg dest, TCGReg arg1, TCGArg arg2, if (type == TCG_TYPE_I32) { arg2 = (uint32_t)arg2; - } else if (arg2 == (uint32_t)arg2) { - type = TCG_TYPE_I32; } if ((arg2 & ~0xffff) == 0) { @@ -1761,12 +1761,11 @@ static void tcg_out_test(TCGContext *s, TCGReg dest, TCGReg arg1, TCGArg arg2, tcg_out32(s, ANDIS | SAI(arg1, dest, arg2 >> 16)); return; } - if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) { - if (mask_operand(arg2, &mb, &me)) { - tcg_out_rlw_rc(s, RLWINM, dest, arg1, 0, mb, me, rc); - return; - } - } else { + if (arg2 == (uint32_t)arg2 && mask_operand(arg2, &mb, &me)) { + tcg_out_rlw_rc(s, RLWINM, dest, arg1, 0, mb, me, rc); + return; + } + if (TCG_TARGET_REG_BITS == 64) { int sh = clz64(arg2); if (mask64_operand(arg2 << sh, &mb, &me)) { tcg_out_rld_rc(s, RLDICR, dest, arg1, sh, me, rc); From patchwork Fri Sep 6 11:12:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825934 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp745794wrb; Fri, 6 Sep 2024 04:18:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVzOjkL9q/NhLeOFv1JJLCtUaJF2ItsnFo96XKOZeNcwAoXG5x0jqc5QQkSlUtgHWSmdYWzHg==@linaro.org X-Google-Smtp-Source: AGHT+IHd8g3/nHpWzFv/22GZJkCxT/x1q8cFbewlGoggZYR2AUFE7VaAbno+yv7yLffbZR3YklEO X-Received: by 2002:a05:6902:1684:b0:e1a:a13e:cc07 with SMTP id 3f1490d57ef6-e1d3486ef87mr2598945276.1.1725621517848; Fri, 06 Sep 2024 04:18:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621517; cv=none; d=google.com; s=arc-20240605; b=YWTphdT9b9ohIWZOISD+armtQjR2reSvfmUNJz0o+8j+iWL0184bLuMGXB8fWENp6s NW/BJYouKE968RnFR/3xY4iv1kuKoHUkmExFnnaX/DEPCdOSeMKopXdUC99JWrHNZQfZ bwtzmPwI2j9gPWO0FnVx28kNw5qY91cP+AUthRyVal8tnywNfzhKHqfgFH+6xMzreiq3 cYerAcC9c0+/wLHrwImH10ZLudY8GqIRK3SuHWcW1n36VXHCmITqdbI2HG4ayduMC3sW lACKNR8HfrjKjewmq67FNT/qRYjt7BgtE/GpxJRW+Ifocugq/ShXTVPrH/010AU4cUIO uvPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=/7TWBNjBHievxBVj2ZRQvsMG8acNJyhnPeiah5F/DWU=; fh=5bR2Ckfc1WOYjVTih8W/ByZTKk2PNsQ3J6+3vQjlF0I=; b=XHM5SiyF2WHcQOLp5xez4EjAlAjHTIhDYbxDrpsbr1IHM3zYvpoPXihCAGxjsdc+LK xpGdy61NtyIBhsKx8GwaKsQfHjA183zGVqqxaR/P3ar4sL9Gh/jr62uqBPOHlh3yJxqp AEfYd/uHw1FL5RrD6kKmP0w7jWKeHCdn7whi6Utb6Lkk8NUrzaVKyoUMKQw4aMBW6K7E F4P8Stho/VoHJW9J373WRxQQY6gn4BW2Ax9nxNEN3LytryNrUZWO2wDMn5x4ZdCA6WMv GiKd3dw4l2541mjyfjGM9fId3H6V5HNKq+8tGd0WQMHnP/Cee/nx48T9NIr44W5deiX7 kEkQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c530635fffsi688636d6.187.2024.09.06.04.18.37 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:18:37 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWyY-0003st-1w; Fri, 06 Sep 2024 07:18:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWxd-0008HU-FY; Fri, 06 Sep 2024 07:17:05 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWxb-00088E-CX; Fri, 06 Sep 2024 07:17:05 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2AEA88C499; Fri, 6 Sep 2024 14:12:09 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 36B03133702; Fri, 6 Sep 2024 14:13:27 +0300 (MSK) Received: (nullmailer pid 353674 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zheyu Ma , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 40/69] hw/sd/sdhci: Reset @data_count index on invalid ADMA transfers Date: Fri, 6 Sep 2024 14:12:49 +0300 Message-Id: <20240906111324.353230-40-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé We neglected to clear the @data_count index on ADMA error, allowing to trigger assertion in sdhci_read_dataport() or sdhci_write_dataport(). Cc: qemu-stable@nongnu.org Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Reported-by: Zheyu Ma Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2455 Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-Id: <20240730092138.32443-4-philmd@linaro.org> (cherry picked from commit ed5a159c3de48a581f46de4c8c02b4b295e6c52d) Signed-off-by: Michael Tokarev diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 27673e1c70..8c5eab1b83 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -846,6 +846,7 @@ static void sdhci_do_adma(SDHCIState *s) } } if (res != MEMTX_OK) { + s->data_count = 0; if (s->errintstsen & SDHC_EISEN_ADMAERR) { trace_sdhci_error("Set ADMA error flag"); s->errintsts |= SDHC_EIS_ADMAERR; From patchwork Fri Sep 6 11:13:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825948 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747901wrb; Fri, 6 Sep 2024 04:24:17 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXUw04Cy9rJZTDbun4WKDu23pVTMWcFj0v1SkK/JPBV/ZaRufxFcPSeX5OpHHJxl/YiptPDTg==@linaro.org X-Google-Smtp-Source: AGHT+IEdJCmhtblBqXDGPdnhA6bKhZe7kKbuzvnD2+LD3pgxhrWbvYwYs/HrXcnQO9xBtGaNUFGW X-Received: by 2002:a05:622a:15d2:b0:44f:f39b:331c with SMTP id d75a77b69052e-4580c787b8bmr32330091cf.51.1725621857581; Fri, 06 Sep 2024 04:24:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621857; cv=none; d=google.com; s=arc-20240605; b=KFnCAtX8N4cgyrf9JAL5acvDpjyLk72XArlariCZJIDhPKHtcN9v4OrX67dn7lTHcK 9pW0kQd4DzMqHghBEbQc7GVOTh1KZVxEWKqndHBf40Znc3Lc+quLLDVm59jVq5ME6TSq SW2+E4SCTuUY2Trsi6erugCEJg7ZUFLQ1SnfJUu1y5D3yxy5FHFD3c0Y2G8LLoqBugzK AUPHVjW9FYYa4pxEnn9uCbbIlT/0r2m3mknjHJuKX61/R1CyLvhCiH2S5jhmYWNpHkV2 J1dXvupYJz8Y//RgeZvtCiNPHugAq99w/DIsqegFUS5Kkemw/mPRx/zK7V8QgCilAU0f 3ynQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=7/1KvtMdpHfy5lDUb8mWnExa/MmHe6DR7Ajh7vo/QfE=; fh=73++FxpCBH5KDXgG1Nqvg9f5zGI68qj4hqVYWy1KEho=; b=Vo+MixsSOdr8LUh890SR+OcIUzv67pIgQHZ9LB9V95xab9/Tzk6Yzu7EK8IV+nXbtq AKXv/wgnOvLWdD9JQSoEMK/jO+xuF9kJLZvQrgPQs4mlZtaFsIISQqfMEhnQlhgGJ5ys pvizOLeS03ZreRWZrOrL9ShgnxKuWvkXcCd54raejVG0q8wLjlwu7HR5P6pJiLipWuhK JVeb8ITgBPYN2P4OWUZ+Rue1OmNmXqhPkUMoOB3b1IyTcezzFeNFRxcoAgEiVVPfolq2 wWJRiCvDgiYilTehDf7qO8KCrB4C1Tvmj+FdgK+6G51RovpxYnS0734AXSutYCmhNVWM RMSQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c97e36si26997911cf.576.2024.09.06.04.24.17 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:24:17 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWz6-00087Q-A9; Fri, 06 Sep 2024 07:18:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz2-0007j1-Mm; Fri, 06 Sep 2024 07:18:32 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz0-0008Em-Kz; Fri, 06 Sep 2024 07:18:32 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0AA098C4A7; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 179B5133710; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353722 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Paolo Bonzini , Michael Tokarev Subject: [Stable-9.0.3 54/69] target/i386: Do not apply REX to MMX operands Date: Fri, 6 Sep 2024 14:13:03 +0300 Message-Id: <20240906111324.353230-54-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Cc: qemu-stable@nongnu.org Fixes: b3e22b2318a ("target/i386: add core of new i386 decoder") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2495 Signed-off-by: Richard Henderson Link: https://lore.kernel.org/r/20240812025844.58956-2-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini (cherry picked from commit 416f2b16c02c618c0f233372ebfe343f9ee667d4) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc index 2ca874b59d..27e1666f5d 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -1272,7 +1272,10 @@ static bool decode_op(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode, op->unit = X86_OP_SSE; } get_reg: - op->n = ((get_modrm(s, env) >> 3) & 7) | REX_R(s); + op->n = ((get_modrm(s, env) >> 3) & 7); + if (op->unit != X86_OP_MMX) { + op->n |= REX_R(s); + } break; case X86_TYPE_E: /* ALU modrm operand */ From patchwork Fri Sep 6 11:13:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825941 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747164wrb; Fri, 6 Sep 2024 04:22:21 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV4Myay59nk8k3RZq9jrqo4IPOu5r9N/0rDSqb0uePiVWMtpO/mCms6ZliJBSTf974ILi4yRw==@linaro.org X-Google-Smtp-Source: AGHT+IGeu1UNQ0g2/7Lug1S9k11dVRRhZMPIGnU68rXJ2jeeZcBczdQ0DB2YIsVjRfgmKxqaqQhe X-Received: by 2002:a05:6902:844:b0:e16:49d6:43e3 with SMTP id 3f1490d57ef6-e1d3488356fmr2664690276.22.1725621741722; Fri, 06 Sep 2024 04:22:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621741; cv=none; d=google.com; s=arc-20240605; b=PxBjEo4AyMy1ZlcA3m+ndgnEWgZ7+f4z7YZEzaF1bzctRRWFv/DgPzJ4BdhG36Z8el X/YU78wB1tCX685rbwHf1gPAhJEit1l+olNnFofpR9ASvkoFqi3jDpOj+kCMtUvJwmMp B+fPwBfRJrzxIt79W9ujh47m105VtZgY5D8US25FkqRh0I2050eMaenIDB18h/n3+u6E UfesRSzXLXLsUqzijEMa0tfYQ55y4BKyrI3GvCJCbvVUElCq8oJi1pSTS8iwP0jErNkt GCYxaAbAe13M1857u8P1YOPuWOHTlbCOMy4EEO1u72jqxM3oQwynf+EMRKuIft6Zzi1v ehQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=p4GHXT3prViI3Gp1dAUK2gn/S075W4YwP7vrCTnTuCo=; fh=NoJ7n5JVE2hviRF6uNBFRIJvWH7igafuy1AIwg26ToM=; b=jG5epuaX+P9FHmYXKD9zR6NKX8QVnSsiNpAVZhjnU3DfcvmHWUsJiE4qXN6gfc6MFy MqzpSxcw9z5THO4xGQ/VL+w7p15WxXzxZ5XlRFuxuAEW0N/3gWtVWHW7CRJhFKxGJDLN JFEZYKW5vYezhToBKesfxQlJ2oWatsYw/Rz+QiftAWT6PmVTohyOPRajQ2dt+yiEgwWQ uGVi0e6kNkOb1Y/nly1giVOi7JKwke5wf+1hIibVEtfnXesk8gEVjXkDRZdCKttiSnmS R3BG7if/rz0dWRm0QAz1pEOLPD0uo9CV/XL9slRueR6EVEdviqAQJq1OeLn7yCNUIpRI EqgQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a1026f4dsi7134685a.221.2024.09.06.04.22.21 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:21 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWz8-000071-NY; Fri, 06 Sep 2024 07:18:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz4-0007wo-3j; Fri, 06 Sep 2024 07:18:34 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz1-0008GE-S0; Fri, 06 Sep 2024 07:18:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 18DF88C4A8; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 257CC133711; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353726 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Peter Maydell , Michael Tokarev Subject: [Stable-9.0.3 55/69] target/arm: Clear high SVE elements in handle_vec_simd_wshli Date: Fri, 6 Sep 2024 14:13:04 +0300 Message-Id: <20240906111324.353230-55-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson AdvSIMD instructions are supposed to zero bits beyond 128. Affects SSHLL, USHLL, SSHLL2, USHLL2. Cc: qemu-stable@nongnu.org Signed-off-by: Richard Henderson Message-id: 20240717060903.205098-15-richard.henderson@linaro.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 8e0c9a9efa21a16190cbac288e414bbf1d80f639) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c index 922a16e5d4..7d620ef109 100644 --- a/target/arm/tcg/translate-a64.c +++ b/target/arm/tcg/translate-a64.c @@ -10263,6 +10263,7 @@ static void handle_vec_simd_wshli(DisasContext *s, bool is_q, bool is_u, tcg_gen_shli_i64(tcg_rd, tcg_rd, shift); write_vec_element(s, tcg_rd, rd, i, size + 1); } + clear_vec_high(s, true, rd); } /* SHRN/RSHRN - Shift right with narrowing (and potential rounding) */ From patchwork Fri Sep 6 11:13:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825939 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747022wrb; Fri, 6 Sep 2024 04:22:00 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUSzztDd/ORKJRDIgaebUh1kR0pZWhE691xdtG++dPwmgtMDoB2tusrLct/8FCFwzHaEvtKIg==@linaro.org X-Google-Smtp-Source: AGHT+IHb0LsCZgViz62WiB8WTc99mJf5GqCoKgOUaMOhOsGzNfbF2ffhFtxMnKG34ctBITd1d87u X-Received: by 2002:a05:622a:47cf:b0:458:176f:8b3f with SMTP id d75a77b69052e-458176f8cfcmr5161501cf.18.1725621720668; Fri, 06 Sep 2024 04:22:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621720; cv=none; d=google.com; s=arc-20240605; b=jkzdpW/+7Dp0p9t/clxUf3Gu1tNsFkpZAVtw7+kxshuqX2L2eH7EPf76S3YTKeh029 4tfOEhLjopPjTE+RHEU8WtQ9eazIToI+RzofHqvioZev63LERXoqRSHb9HZoGfF4mM5w Rx22JIfB5me10//1E/7Sbl3ULwEHur5E98imUSQ18kV4qdjMnYD+kqO/iRGag5rlHXnP Dm8epyGZvHGB0Er4UGsifNieufzkPyLrGnRVThyQIXbAPt87vTRnDc975ssruyLE59Hm g6WdKqK2Tx0RdOaA4aKQv+E0YHcxh+J1HM1F0CcLgaHkSTwEM3Ygpd9CSoXksvr5VPC5 xgew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=JrfoACI/mTym/l4G+knHbzvTj28cS+hTZFZ1+Ijd0s0=; fh=GVpxzWVgxCvvCXX3SAS+60z9LiN7Up5XMzFHdPNgzgQ=; b=bjSsJf4oy7RrPIm/mqGtYLwoLnSxc2X+Jzk7FXgybqaqwhbVpnBdmE8dFAqVLtKdjT PfxnJ3yvLJFBTtq8W7gti+FVajQm7I6AB7ytFd470uxIeSFpkK4cTcB0EqctX7VsrP3+ A8vfhzLY+mJPqr1aDMER1nRncjwKJAO/IzXcI4XVl2OHJB359byvmDi/ecPQjb7CBoAD 7CO2/DMLyE4rVrImqAOA8Wx5wJbeQrzPHzfIBQnLH42DffedIMCS3K9kxsZYAki3A/Bw x76BQbJkMqiGNm3H1UiuYDT4bjihjtYrY27MZ5Ahld7EvCY8u579hNuzhKjHHbZYvqXf oilQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c8c397si24306591cf.412.2024.09.06.04.22.00 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:00 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWzA-0000Uh-K5; Fri, 06 Sep 2024 07:18:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz5-00088J-U1; Fri, 06 Sep 2024 07:18:36 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz4-0008Gf-3u; Fri, 06 Sep 2024 07:18:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 27FF98C4A9; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 33806133712; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353729 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Bernhard Beschow , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 56/69] target/arm: Update translation regime comment for new features Date: Fri, 6 Sep 2024 14:13:05 +0300 Message-Id: <20240906111324.353230-56-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell We have a long comment describing the Arm architectural translation regimes and how we map them to QEMU MMU indexes. This comment has got a bit out of date: * FEAT_SEL2 allows Secure EL2 and corresponding new regimes * FEAT_RME introduces Realm state and its translation regimes * We now model the Cortex-R52 so that is no longer a hypothetical * We separated Secure Stage 2 and NonSecure Stage 2 MMU indexes * We have an MMU index per physical address spacea Add the missing pieces so that the list of architectural translation regimes matches the Arm ARM, and the list and count of QEMU MMU indexes in the comment matches the enum. Signed-off-by: Peter Maydell Tested-by: Bernhard Beschow Reviewed-by: Richard Henderson Message-id: 20240809160430.1144805-2-peter.maydell@linaro.org (cherry picked from commit 150c24f34e9c3388c0f0ad04ddd997e5559db800) Signed-off-by: Michael Tokarev (Mjt: pick this one for stable-9.0 so the next commit applies cleanly) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index bc0c84873f..7c721f22bd 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -2687,8 +2687,14 @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync); * + NonSecure EL1 & 0 stage 2 * + NonSecure EL2 * + NonSecure EL2 & 0 (ARMv8.1-VHE) - * + Secure EL1 & 0 - * + Secure EL3 + * + Secure EL1 & 0 stage 1 + * + Secure EL1 & 0 stage 2 (FEAT_SEL2) + * + Secure EL2 (FEAT_SEL2) + * + Secure EL2 & 0 (FEAT_SEL2) + * + Realm EL1 & 0 stage 1 (FEAT_RME) + * + Realm EL1 & 0 stage 2 (FEAT_RME) + * + Realm EL2 (FEAT_RME) + * + EL3 * If EL3 is 32-bit: * + NonSecure PL1 & 0 stage 1 * + NonSecure PL1 & 0 stage 2 @@ -2720,10 +2726,12 @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync); * table over and over. * 6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access * Never (PAN) bit within PSTATE. - * 7. we fold together the secure and non-secure regimes for A-profile, + * 7. we fold together most secure and non-secure regimes for A-profile, * because there are no banked system registers for aarch64, so the * process of switching between secure and non-secure is * already heavyweight. + * 8. we cannot fold together Stage 2 Secure and Stage 2 NonSecure, + * because both are in use simultaneously for Secure EL2. * * This gives us the following list of cases: * @@ -2735,14 +2743,15 @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync); * EL2 EL2&0 +PAN * EL2 (aka NS PL2) * EL3 (aka S PL1) - * Physical (NS & S) - * Stage2 (NS & S) + * Stage2 Secure + * Stage2 NonSecure + * plus one TLB per Physical address space: S, NS, Realm, Root * - * for a total of 12 different mmu_idx. + * for a total of 14 different mmu_idx. * * R profile CPUs have an MPU, but can use the same set of MMU indexes * as A profile. They only need to distinguish EL0 and EL1 (and - * EL2 if we ever model a Cortex-R52). + * EL2 for cores like the Cortex-R52). * * M profile CPUs are rather different as they do not have a true MMU. * They have the following different MMU indexes: From patchwork Fri Sep 6 11:13:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825946 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747474wrb; Fri, 6 Sep 2024 04:23:06 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXOk76ZWcziOF3wGV0/fjvoaF5YI9bgfPcOEXjDPO0se8o20be6VdvwgV7YMB/lpu6fvdaj6Q==@linaro.org X-Google-Smtp-Source: AGHT+IH5v0hChChNsSBTjlpafgJQIBwic2WRz0o0830TrjVV0u3kWxMGMC6Q9VAXvadLpHJ57Geh X-Received: by 2002:a05:620a:3942:b0:7a2:c96:8737 with SMTP id af79cd13be357-7a99735e76fmr275234485a.52.1725621786684; Fri, 06 Sep 2024 04:23:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621786; cv=none; d=google.com; s=arc-20240605; b=Ct6kWgTXiIK3VsithJpqOLI2wcWz+O+4iJLFay1T7DOqYzOUJDyFh0oqRiA0g1tJei WJJmyE6tSLH6FRr+3KOK2/NidnG7n8TC3UQchI0U2MLGUa+mF3zSVhgJOm3NZWAvwW30 0ncCV+in0gybxWwH6mn14z3t4xqniOwOgzl6+D/JxclQYV44a86lNtYTjdQWXEjls/lE NT504g3tk2qwlz5A/RBhGu8YdQK/H2OwFXtX5/tLG/TMjg88/0GuSRPp9uVqyqRKnLIv m9/0BGA1mAfjFvZKZj/YYQGV1fjCgaYfRqI/60UBxVaeET+lH7Z6Pl/ZfNpBgsCgg8+T MUfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=oQx+ZiyutnVPX7puKCDzYzLveRyzLR8AifE8ERrKV2k=; fh=GVpxzWVgxCvvCXX3SAS+60z9LiN7Up5XMzFHdPNgzgQ=; b=jAARIKbnkUe/LVWAmMWmLXvJKMOQk1vEJDP89BD525J1KZQIXX0AVZKjRwJ7BgsMF4 do3SagSckqYo2cACsnGPdEUDXyMKkxldtwSKJWRs132y5PJbJp7av3TGaaWYUQUJKMFU tcKljZTmm5CkIFChdDoFXmnU0+g3Yke+BRom2tHEVZPx/cLgNYIEzqUySsmKYbjJSuFV uhSgwWO6Id/MnfpTQHxAwCaR0cjYGR6RdUErfGTec0HvpUtv93BlnDD+5sdg7K9Z9Y8h wQkDeBTRvKFXFJrr/gl2r6UTVcG1CzozFufGaDm6ZhhHOX237df55xxMaPuESzun09pb RiOA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809cc00b3si24500511cf.731.2024.09.06.04.23.06 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:23:06 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWzD-00010a-JK; Fri, 06 Sep 2024 07:18:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz8-0000AY-N2; Fri, 06 Sep 2024 07:18:38 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWz5-0008Gx-Lw; Fri, 06 Sep 2024 07:18:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 385BF8C4AA; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 42D2E133713; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353732 invoked by uid 1000); Fri, 06 Sep 2024 11:13:24 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Bernhard Beschow , Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 57/69] target/arm: Fix usage of MMU indexes when EL3 is AArch32 Date: Fri, 6 Sep 2024 14:13:06 +0300 Message-Id: <20240906111324.353230-57-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Our current usage of MMU indexes when EL3 is AArch32 is confused. Architecturally, when EL3 is AArch32, all Secure code runs under the Secure PL1&0 translation regime: * code at EL3, which might be Mon, or SVC, or any of the other privileged modes (PL1) * code at EL0 (Secure PL0) This is different from when EL3 is AArch64, in which case EL3 is its own translation regime, and EL1 and EL0 (whether AArch32 or AArch64) have their own regime. We claimed to be mapping Secure PL1 to our ARMMMUIdx_EL3, but didn't do anything special about Secure PL0, which meant it used the same ARMMMUIdx_EL10_0 that NonSecure PL0 does. This resulted in a bug where arm_sctlr() incorrectly picked the NonSecure SCTLR as the controlling register when in Secure PL0, which meant we were spuriously generating alignment faults because we were looking at the wrong SCTLR control bits. The use of ARMMMUIdx_EL3 for Secure PL1 also resulted in the bug that we wouldn't honour the PAN bit for Secure PL1, because there's no equivalent _PAN mmu index for it. We could fix this in one of two ways: * The most straightforward is to add new MMU indexes EL30_0, EL30_3, EL30_3_PAN to correspond to "Secure PL1&0 at PL0", "Secure PL1&0 at PL1", and "Secure PL1&0 at PL1 with PAN". This matches how we use indexes for the AArch64 regimes, and preserves propirties like being able to determine the privilege level from an MMU index without any other information. However it would add two MMU indexes (we can share one with ARMMMUIdx_EL3), and we are already using 14 of the 16 the core TLB code permits. * The more complicated approach is the one we take here. We use the same MMU indexes (E10_0, E10_1, E10_1_PAN) for Secure PL1&0 than we do for NonSecure PL1&0. This saves on MMU indexes, but means we need to check in some places whether we're in the Secure PL1&0 regime or not before we interpret an MMU index. The changes in this commit were created by auditing all the places where we use specific ARMMMUIdx_ values, and checking whether they needed to be changed to handle the new index value usage. Note for potential stable backports: taking also the previous (comment-change-only) commit might make the backport easier. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2326 Signed-off-by: Peter Maydell Tested-by: Bernhard Beschow Reviewed-by: Richard Henderson Message-id: 20240809160430.1144805-3-peter.maydell@linaro.org (cherry picked from commit 4c2c0474693229c1f533239bb983495c5427784d) Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index 7c721f22bd..dfd877cd03 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -2699,8 +2699,7 @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync); * + NonSecure PL1 & 0 stage 1 * + NonSecure PL1 & 0 stage 2 * + NonSecure PL2 - * + Secure PL0 - * + Secure PL1 + * + Secure PL1 & 0 * (reminder: for 32 bit EL3, Secure PL1 is *EL3*, not EL1.) * * For QEMU, an mmu_idx is not quite the same as a translation regime because: @@ -2718,37 +2717,39 @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync); * The only use of stage 2 translations is either as part of an s1+2 * lookup or when loading the descriptors during a stage 1 page table walk, * and in both those cases we don't use the TLB. - * 4. we can also safely fold together the "32 bit EL3" and "64 bit EL3" - * translation regimes, because they map reasonably well to each other - * and they can't both be active at the same time. - * 5. we want to be able to use the TLB for accesses done as part of a + * 4. we want to be able to use the TLB for accesses done as part of a * stage1 page table walk, rather than having to walk the stage2 page * table over and over. - * 6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access + * 5. we need separate EL1/EL2 mmu_idx for handling the Privileged Access * Never (PAN) bit within PSTATE. - * 7. we fold together most secure and non-secure regimes for A-profile, + * 6. we fold together most secure and non-secure regimes for A-profile, * because there are no banked system registers for aarch64, so the * process of switching between secure and non-secure is * already heavyweight. - * 8. we cannot fold together Stage 2 Secure and Stage 2 NonSecure, + * 7. we cannot fold together Stage 2 Secure and Stage 2 NonSecure, * because both are in use simultaneously for Secure EL2. * * This gives us the following list of cases: * - * EL0 EL1&0 stage 1+2 (aka NS PL0) - * EL1 EL1&0 stage 1+2 (aka NS PL1) - * EL1 EL1&0 stage 1+2 +PAN + * EL0 EL1&0 stage 1+2 (or AArch32 PL0 PL1&0 stage 1+2) + * EL1 EL1&0 stage 1+2 (or AArch32 PL1 PL1&0 stage 1+2) + * EL1 EL1&0 stage 1+2 +PAN (or AArch32 PL1 PL1&0 stage 1+2 +PAN) * EL0 EL2&0 * EL2 EL2&0 * EL2 EL2&0 +PAN * EL2 (aka NS PL2) - * EL3 (aka S PL1) + * EL3 (not used when EL3 is AArch32) * Stage2 Secure * Stage2 NonSecure * plus one TLB per Physical address space: S, NS, Realm, Root * * for a total of 14 different mmu_idx. * + * Note that when EL3 is AArch32, the usage is potentially confusing + * because the MMU indexes are named for their AArch64 use, so code + * using the ARMMMUIdx_E10_1 might be at EL3, not EL1. This is because + * Secure PL1 is always at EL3. + * * R profile CPUs have an MPU, but can use the same set of MMU indexes * as A profile. They only need to distinguish EL0 and EL1 (and * EL2 for cores like the Cortex-R52). @@ -3041,6 +3042,10 @@ FIELD(TBFLAG_A32, NS, 10, 1) * This requires an SME trap from AArch32 mode when using NEON. */ FIELD(TBFLAG_A32, SME_TRAP_NONSTREAMING, 11, 1) +/* + * Indicates whether we are in the Secure PL1&0 translation regime + */ +FIELD(TBFLAG_A32, S_PL1_0, 12, 1) /* * Bit usage when in AArch32 state, for M-profile only. diff --git a/target/arm/helper.c b/target/arm/helper.c index 42044ae14b..f5cfae3654 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -3687,7 +3687,7 @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value, */ format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); - if (arm_feature(env, ARM_FEATURE_EL2)) { + if (arm_feature(env, ARM_FEATURE_EL2) && !arm_aa32_secure_pl1_0(env)) { if (mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_E10_1 || mmu_idx == ARMMMUIdx_E10_1_PAN) { @@ -3761,13 +3761,11 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) case 0: /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */ switch (el) { - case 3: - mmu_idx = ARMMMUIdx_E3; - break; case 2: g_assert(ss != ARMSS_Secure); /* ARMv8.4-SecEL2 is 64-bit only */ /* fall through */ case 1: + case 3: if (ri->crm == 9 && arm_pan_enabled(env)) { mmu_idx = ARMMMUIdx_Stage1_E1_PAN; } else { @@ -11768,8 +11766,11 @@ void arm_cpu_do_interrupt(CPUState *cs) uint64_t arm_sctlr(CPUARMState *env, int el) { - /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */ - if (el == 0) { + if (arm_aa32_secure_pl1_0(env)) { + /* In Secure PL1&0 SCTLR_S is always controlling */ + el = 3; + } else if (el == 0) { + /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */ ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); el = mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1; } @@ -12429,8 +12430,12 @@ int fp_exception_el(CPUARMState *env, int cur_el) return 0; } -/* Return the exception level we're running at if this is our mmu_idx */ -int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) +/* + * Return the exception level we're running at if this is our mmu_idx. + * s_pl1_0 should be true if this is the AArch32 Secure PL1&0 translation + * regime. + */ +int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx, bool s_pl1_0) { if (mmu_idx & ARM_MMU_IDX_M) { return mmu_idx & ARM_MMU_IDX_M_PRIV; @@ -12442,7 +12447,7 @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) return 0; case ARMMMUIdx_E10_1: case ARMMMUIdx_E10_1_PAN: - return 1; + return s_pl1_0 ? 3 : 1; case ARMMMUIdx_E2: case ARMMMUIdx_E20_2: case ARMMMUIdx_E20_2_PAN: @@ -12480,6 +12485,15 @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) idx = ARMMMUIdx_E10_0; } break; + case 3: + /* + * AArch64 EL3 has its own translation regime; AArch32 EL3 + * uses the Secure PL1&0 translation regime. + */ + if (arm_el_is_aa64(env, 3)) { + return ARMMMUIdx_E3; + } + /* fall through */ case 1: if (arm_pan_enabled(env)) { idx = ARMMMUIdx_E10_1_PAN; @@ -12499,8 +12513,6 @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) idx = ARMMMUIdx_E2; } break; - case 3: - return ARMMMUIdx_E3; default: g_assert_not_reached(); } diff --git a/target/arm/internals.h b/target/arm/internals.h index dd3da211a3..810b85a409 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -265,6 +265,20 @@ FIELD(CNTHCTL, CNTPMASK, 19, 1) #define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */ #define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */ +/** + * arm_aa32_secure_pl1_0(): Return true if in Secure PL1&0 regime + * + * Return true if the CPU is in the Secure PL1&0 translation regime. + * This requires that EL3 exists and is AArch32 and we are currently + * Secure. If this is the case then the ARMMMUIdx_E10* apply and + * mean we are in EL3, not EL1. + */ +static inline bool arm_aa32_secure_pl1_0(CPUARMState *env) +{ + return arm_feature(env, ARM_FEATURE_EL3) && + !arm_el_is_aa64(env, 3) && arm_is_secure(env); +} + /** * raise_exception: Raise the specified exception. * Raise a guest exception with the specified value, syndrome register @@ -791,7 +805,12 @@ static inline ARMMMUIdx core_to_aa64_mmu_idx(int mmu_idx) return mmu_idx | ARM_MMU_IDX_A; } -int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx); +/** + * Return the exception level we're running at if our current MMU index + * is @mmu_idx. @s_pl1_0 should be true if this is the AArch32 + * Secure PL1&0 translation regime. + */ +int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx, bool s_pl1_0); /* Return the MMU index for a v7M CPU in the specified security state */ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate); @@ -886,11 +905,11 @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) return 3; case ARMMMUIdx_E10_0: case ARMMMUIdx_Stage1_E0: - return arm_el_is_aa64(env, 3) || !arm_is_secure_below_el3(env) ? 1 : 3; - case ARMMMUIdx_Stage1_E1: - case ARMMMUIdx_Stage1_E1_PAN: case ARMMMUIdx_E10_1: case ARMMMUIdx_E10_1_PAN: + case ARMMMUIdx_Stage1_E1: + case ARMMMUIdx_Stage1_E1_PAN: + return arm_el_is_aa64(env, 3) || !arm_is_secure_below_el3(env) ? 1 : 3; case ARMMMUIdx_MPrivNegPri: case ARMMMUIdx_MUserNegPri: case ARMMMUIdx_MPriv: diff --git a/target/arm/ptw.c b/target/arm/ptw.c index 31ae43f60e..2cb0e981a5 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -3575,7 +3575,11 @@ bool get_phys_addr(CPUARMState *env, target_ulong address, case ARMMMUIdx_Stage1_E1: case ARMMMUIdx_Stage1_E1_PAN: case ARMMMUIdx_E2: - ss = arm_security_space_below_el3(env); + if (arm_aa32_secure_pl1_0(env)) { + ss = ARMSS_Secure; + } else { + ss = arm_security_space_below_el3(env); + } break; case ARMMMUIdx_Stage2: /* diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c index f03977b4b0..bab7822ef6 100644 --- a/target/arm/tcg/hflags.c +++ b/target/arm/tcg/hflags.c @@ -198,6 +198,10 @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el, DP_TBFLAG_A32(flags, SME_TRAP_NONSTREAMING, 1); } + if (arm_aa32_secure_pl1_0(env)) { + DP_TBFLAG_A32(flags, S_PL1_0, 1); + } + return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); } diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c index 7d620ef109..396ddfefb0 100644 --- a/target/arm/tcg/translate-a64.c +++ b/target/arm/tcg/translate-a64.c @@ -14093,7 +14093,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase, dc->tbii = EX_TBFLAG_A64(tb_flags, TBII); dc->tbid = EX_TBFLAG_A64(tb_flags, TBID); dc->tcma = EX_TBFLAG_A64(tb_flags, TCMA); - dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx); + dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx, false); #if !defined(CONFIG_USER_ONLY) dc->user = (dc->current_el == 0); #endif diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c index dc49a8d806..d4b79c08cb 100644 --- a/target/arm/tcg/translate.c +++ b/target/arm/tcg/translate.c @@ -9135,10 +9135,6 @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs) core_mmu_idx = EX_TBFLAG_ANY(tb_flags, MMUIDX); dc->mmu_idx = core_to_arm_mmu_idx(env, core_mmu_idx); - dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx); -#if !defined(CONFIG_USER_ONLY) - dc->user = (dc->current_el == 0); -#endif dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL); dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM); dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL); @@ -9169,7 +9165,12 @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs) } dc->sme_trap_nonstreaming = EX_TBFLAG_A32(tb_flags, SME_TRAP_NONSTREAMING); + dc->s_pl1_0 = EX_TBFLAG_A32(tb_flags, S_PL1_0); } + dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx, dc->s_pl1_0); +#if !defined(CONFIG_USER_ONLY) + dc->user = (dc->current_el == 0); +#endif dc->lse2 = false; /* applies only to aarch64 */ dc->cp_regs = cpu->cp_regs; dc->features = env->features; diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h index dc66ff2190..f8dd23ec41 100644 --- a/target/arm/tcg/translate.h +++ b/target/arm/tcg/translate.h @@ -167,6 +167,8 @@ typedef struct DisasContext { bool guarded_page; /* True if the current insn_start has been updated. */ bool insn_start_updated; + /* True if this is the AArch32 Secure PL1&0 translation regime */ + bool s_pl1_0; /* Bottom two bits of XScale c15_cpar coprocessor access control reg */ int c15_cpar; /* Offset from VNCR_EL2 when FEAT_NV2 redirects this reg to memory */ From patchwork Fri Sep 6 11:13:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825942 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747270wrb; Fri, 6 Sep 2024 04:22:37 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCU2qLDc97bhWvXtP5X4JFqWPwg9fg8g6+z3ewzA/fx1k1Uu78o3y3vh9tvpbCLgrEyZTH7sOA==@linaro.org X-Google-Smtp-Source: AGHT+IGCyP+0wHNYJHS2Nnrxoiouw1A8+OCz1pHsWOAAV0G0baXi4cFSZMKZogYAMu98r08gpm2K X-Received: by 2002:a05:6214:5d8a:b0:6c3:5f8f:2745 with SMTP id 6a1803df08f44-6c528506eacmr27283136d6.27.1725621757156; Fri, 06 Sep 2024 04:22:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621757; cv=none; d=google.com; s=arc-20240605; b=DvFUvEpsakweMyCVt7fROSNKr2IyX6kNLcHxSAzvBRsJ9t1rzf4h5tV8mYcnKC0BWt Ixk+csiScI1R7QzWsUEsV9owzocEj8OBJBhyxcHMRJ2dnF3AosqqAePqLLdUYaclK9HA mGgUG4mzpTBethJZThgV0twzTudTDWEadK6QLRLsrk/8TCso2AapLo72lE+iTLzGZqgn tR7mrbFeP6VyePEHkP1TOcnlVYOLUmqHActa9LD1uC4IshTH7v0f8meZp0fLLk4Yr3h8 4H/4ppmNehTT6Z5uh6Jmiw9Xec6z6s6NO+xJWflPn1tKbOT8AJsDmxk/QnX8CwDkg40+ X6Zw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=/YtHAho5vfNpliWF9E5Pr93sYum2HQ7bbExz/hkBmJ8=; fh=bMaafE1clBtiBaCrlbrbcY1DSEPhhFUklUk4XoVHiPU=; b=Ytk65CShEX4LTcTij9kKanXLk/+/kL+cDEO4H76+LggB6WrBsOokHur41jzgTZ5iMX 9C7twjxglLkEQYyTRxDa9hBMvwHYFiJdjiNP4YYvvSWrczeIol00hodE1yRD2cInWF6t ByckZ5SMBjJc8wS6gvK9nZc1fjgdtcT6gZ0Cw+dEAAzQ9t0nY2dlISFf/qs9hLP86Gxl JuRU+bBZOaDkUGlpPiEnpwksR4OuFKGiLGxB8SLI53gcF0EEfPLfBr0OOGyRrymvxgW6 KHIL/MnR9QppMCIav8TcbTrPR8/P3BIbfkkjjThZR6pGFlJ86hyllmlcij3/Yzn7Kqpy 7n5A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c530674aa4si586686d6.398.2024.09.06.04.22.37 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:37 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWze-0005MA-Oy; Fri, 06 Sep 2024 07:19:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzW-0004gh-VA; Fri, 06 Sep 2024 07:19:02 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzU-0008Jr-R3; Fri, 06 Sep 2024 07:19:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 65C3A8C4AD; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 73E80133716; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353742 invoked by uid 1000); Fri, 06 Sep 2024 11:13:25 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Michael Tokarev Subject: [Stable-9.0.3 60/69] linux-user: Preserve NULL hit in target_mmap subroutines Date: Fri, 6 Sep 2024 14:13:09 +0300 Message-Id: <20240906111324.353230-60-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Do not pass guest_base to the host mmap instead of zero hint. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2353 Signed-off-by: Richard Henderson (cherry picked from commit 3aefee3ec01e607529a9918e2978f365c5c3b5e9) Signed-off-by: Michael Tokarev diff --git a/linux-user/mmap.c b/linux-user/mmap.c index be3b9a68eb..2a11d921ab 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -559,9 +559,13 @@ static abi_long mmap_h_eq_g(abi_ulong start, abi_ulong len, int host_prot, int flags, int page_flags, int fd, off_t offset) { - void *p, *want_p = g2h_untagged(start); + void *p, *want_p = NULL; abi_ulong last; + if (start || (flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) { + want_p = g2h_untagged(start); + } + p = mmap(want_p, len, host_prot, flags, fd, offset); if (p == MAP_FAILED) { return -1; @@ -609,11 +613,15 @@ static abi_long mmap_h_lt_g(abi_ulong start, abi_ulong len, int host_prot, int mmap_flags, int page_flags, int fd, off_t offset, int host_page_size) { - void *p, *want_p = g2h_untagged(start); + void *p, *want_p = NULL; off_t fileend_adj = 0; int flags = mmap_flags; abi_ulong last, pass_last; + if (start || (flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) { + want_p = g2h_untagged(start); + } + if (!(flags & MAP_ANONYMOUS)) { struct stat sb; @@ -739,12 +747,16 @@ static abi_long mmap_h_gt_g(abi_ulong start, abi_ulong len, int flags, int page_flags, int fd, off_t offset, int host_page_size) { - void *p, *want_p = g2h_untagged(start); + void *p, *want_p = NULL; off_t host_offset = offset & -host_page_size; abi_ulong last, real_start, real_last; bool misaligned_offset = false; size_t host_len; + if (start || (flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) { + want_p = g2h_untagged(start); + } + if (!(flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) { /* * Adjust the offset to something representable on the host. From patchwork Fri Sep 6 11:13:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825944 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp747300wrb; Fri, 6 Sep 2024 04:22:42 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUHv1t2BfZPUDExdBB3GY4mZqAvcwWJQdKaUYhJ0PSjLt3FuNNWI0PDFn9KD9I9k7VqrHKGGA==@linaro.org X-Google-Smtp-Source: AGHT+IHauOnGqowm53ooGTa33aixBIOkwrErcvclO0hkecYwFp86YkfAJxv3VwVYoqNZsJXkyROU X-Received: by 2002:a05:6102:3907:b0:498:dd44:32c with SMTP id ada2fe7eead31-49a5af81969mr31191977137.28.1725621762040; Fri, 06 Sep 2024 04:22:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621762; cv=none; d=google.com; s=arc-20240605; b=by3a4QoJfL0t+14sQuBuaRlnvIpBJI8pLU+pz8yc1VL/b06RQmByOGHes3av6/1TYk r/f7DFkzbuCE4U6RJC3J31FGKcHkbh6VelUrMBTcU7AAQWpNVCimoYhCp6wMy/fBvsQ2 LUnmfT8GaqwZmLwW/9/HXym1qpeE/HJXc6Lq4ym8kJYgNVZR7vjl2+DwprqDMunEJR0B xOxJAhBw+Cxu3OuL34Uzj7OOFomYZwwQBOWlVsmgDdy9qN+LOP1PgRnKYbJuk6nkVDwa GlUYQDTlTXIvhAqKhrCGlKF409/nMHL+F0hpgrsYYbjNX3u2zlNbZdYkYj0vpZ+Yz42c zk7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=NKUFIJBQb+CBqs9blaoqXhBAvpIZOP/pqZD9V3LBP8U=; fh=K4abbxCgZAPvqzOXA+PZ7RIZh+KufMVJze7rXLOwES0=; b=Hs65MjsZHUk0GHdK6qKNp2bKdG5h6Bb7OPcvFXCPmj6V4ORqX08X/7RtjsVhX6tmfK 2j7qaQBdvBwMUbzFjRQ4vnEF5Idhe9hLmPQw+Q4Mp/apvQsbpoH3aQUEYoI4xy6EkrBu FU4IUvXA5/PvE//Fdo5QmOm3rVq4+K47D00P98v2+a94imaNo0IPLYBzV75kAd1/mkly 9NTeRYSBeBhGf9eDsegfZ8bMPObJr+ZFhFDbzR54ODuH4huYYsh969hVEn/qCnOpzQWV U68DMYiaS2Vcns0MjF6tVVH5+W+19uHuE2GqWf932dL24EAtD7OOKghETbzuJcw24cS0 +NQw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a1068fbfsi6380985a.255.2024.09.06.04.22.41 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:22:42 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWze-0005Th-Mf; Fri, 06 Sep 2024 07:19:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzZ-0004uW-8N; Fri, 06 Sep 2024 07:19:05 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzX-0008KB-Hd; Fri, 06 Sep 2024 07:19:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 735588C4AE; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 806FA133717; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353745 invoked by uid 1000); Fri, 06 Sep 2024 11:13:25 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.0.3 61/69] target/sparc: Restrict STQF to sparcv9 Date: Fri, 6 Sep 2024 14:13:10 +0300 Message-Id: <20240906111324.353230-61-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Prior to sparcv9, the same encoding was STDFQ. Cc: qemu-stable@nongnu.org Fixes: 06c060d9e5b ("target/sparc: Move simple fp load/store to decodetree") Signed-off-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240816072311.353234-2-richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 12d36294a2d978faf893101862118d1ac1815e85) Signed-off-by: Michael Tokarev diff --git a/target/sparc/insns.decode b/target/sparc/insns.decode index e2d8a07dc4..d2b29de084 100644 --- a/target/sparc/insns.decode +++ b/target/sparc/insns.decode @@ -484,7 +484,7 @@ STF 11 ..... 100100 ..... . ............. @r_r_ri_na STFSR 11 00000 100101 ..... . ............. @n_r_ri STXFSR 11 00001 100101 ..... . ............. @n_r_ri { - STQF 11 ..... 100110 ..... . ............. @q_r_ri_na + STQF 11 ..... 100110 ..... . ............. @q_r_ri_na # v9 STDFQ 11 ----- 100110 ----- - ------------- } STDF 11 ..... 100111 ..... . ............. @d_r_ri_na diff --git a/target/sparc/translate.c b/target/sparc/translate.c index 99c6f3cc72..9d5d0ae47c 100644 --- a/target/sparc/translate.c +++ b/target/sparc/translate.c @@ -4151,7 +4151,7 @@ static bool do_st_fpr(DisasContext *dc, arg_r_r_ri_asi *a, MemOp sz) TRANS(STF, ALL, do_st_fpr, a, MO_32) TRANS(STDF, ALL, do_st_fpr, a, MO_64) -TRANS(STQF, ALL, do_st_fpr, a, MO_128) +TRANS(STQF, 64, do_st_fpr, a, MO_128) TRANS(STFA, 64, do_st_fpr, a, MO_32) TRANS(STDFA, 64, do_st_fpr, a, MO_64) From patchwork Fri Sep 6 11:13:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825937 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp746529wrb; Fri, 6 Sep 2024 04:20:44 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVFM0CE8qhOLZ/92M15z0iAGUYQUQH9w5kMuD6c9PLmnOFbNIKLR8LEdTzlVqxHHq4kTM9nog==@linaro.org X-Google-Smtp-Source: AGHT+IG52RxH0v0eIlMRr2mBBS0eX8MwG358wPrMw2Mbp9H/50QPDzxZweBilOcKgpb91pZ+5Zpr X-Received: by 2002:a05:620a:4494:b0:79f:12e9:1e50 with SMTP id af79cd13be357-7a99733f328mr235632285a.35.1725621644665; Fri, 06 Sep 2024 04:20:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725621644; cv=none; d=google.com; s=arc-20240605; b=I55CXNzwnSa6oW30k/OvwHm1AaT7Xru9gR94tDx5vxLKiDr7SGWDSfMoshycB6Yt6j wATw/nmdUlbFzLy7yNV2AcodRmXqpqWsmaKQmBEao53Dwi5BbhFAdTUvVwYLRpCbzash AI5zpzQY4iYLolipcZzVFe4e4WY3mpBo2PWINaJ/U4mdZD6iCQzyW8OuYC7cCFqw+OAh yfgSV+tBWbtty4IEzDZx1MXxsXh++7YHIVqupo3kNY2q+RO3V/LHzN4+jpBt7hKw15O0 qmdFkR4UlQekTapR4euuDjGPk3kDrGUFVqKIj5LWGsN1kyVpKOid9M97EucKwbC+Cs+W ckqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=8WAFiRoMNMFSxEhAH0VURHMNNFDw6dFyTjxgSQ6GU+o=; fh=QCiO3s1cvaqADEyfPI2NiS1m5l7Cs6ciWF636GXs0Bw=; b=IXQELxM79eWDtWllP81v9yJgN8HGKTlNMb47UZfnWPE9QS2+jycWCXyi04kHzf0L1t AQPZZ438cBY39MU7YeBRlZgqpp+G1M4IvjlAaTraCb600VUazGiNZUOsYpVjmHJGPGxp nJ1YWQmV8lQx1XuPPCWldRZGONsGSDuUvqE4QfOdrVhnfyvFa5a0GNih0C7PVWXH6vLA ZLQYpwwkqx/X4VpZDEyEiSnOpFi07N4aSa1KaozSFxumGj+Ar4dpIMTvNkJ8u6t7Iy3F Pu+9lVk5wdCDMNMz/g0YaAVQfq76leomrsmIMtuOhwxiLm4hV8OACuG0I3bLk6rer6Aq eqIQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a9a1068fa8si6071385a.302.2024.09.06.04.20.44 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:20:44 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smWzw-0008Jz-LN; Fri, 06 Sep 2024 07:19:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzu-000842-Dd; Fri, 06 Sep 2024 07:19:26 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzs-0008KK-Cq; Fri, 06 Sep 2024 07:19:26 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 83C2D8C4AF; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 8E84E133718; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353748 invoked by uid 1000); Fri, 06 Sep 2024 11:13:25 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Daniel_P_=2E_Berrang=C3=A9?= , =?utf-8?q?Phi?= =?utf-8?q?lippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.0.3 62/69] crypto/tlscredspsk: Free username on finalize Date: Fri, 6 Sep 2024 14:13:11 +0300 Message-Id: <20240906111324.353230-62-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When the creds->username property is set we allocate memory for it in qcrypto_tls_creds_psk_prop_set_username(), but we never free this when the QCryptoTLSCredsPSK is destroyed. Free the memory in finalize. This fixes a LeakSanitizer complaint in migration-test: $ (cd build/asan; ASAN_OPTIONS="fast_unwind_on_malloc=0" QTEST_QEMU_BINARY=./qemu-system-x86_64 ./tests/qtest/migration-test --tap -k -p /x86_64/migration/precopy/unix/tls/psk) ================================================================= ==3867512==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x5624e5c99dee in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218edee) (BuildId: a9e623fa1009a9435c0142c037cd7b8c1ad04ce3) #1 0x7fb199ae9738 in g_malloc debian/build/deb/../../../glib/gmem.c:128:13 #2 0x7fb199afe583 in g_strdup debian/build/deb/../../../glib/gstrfuncs.c:361:17 #3 0x5624e82ea919 in qcrypto_tls_creds_psk_prop_set_username /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../crypto/tlscredspsk.c:255:23 #4 0x5624e812c6b5 in property_set_str /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object.c:2277:5 #5 0x5624e8125ce5 in object_property_set /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object.c:1463:5 #6 0x5624e8136e7c in object_set_properties_from_qdict /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:55:14 #7 0x5624e81372d2 in user_creatable_add_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:112:5 #8 0x5624e8137964 in user_creatable_add_qapi /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:157:11 #9 0x5624e891ba3c in qmp_object_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/qom-qmp-cmds.c:227:5 #10 0x5624e8af9118 in qmp_marshal_object_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qapi/qapi-commands-qom.c:337:5 #11 0x5624e8bd1d49 in do_qmp_dispatch_bh /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qapi/qmp-dispatch.c:128:5 #12 0x5624e8cb2531 in aio_bh_call /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:171:5 #13 0x5624e8cb340c in aio_bh_poll /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:218:13 #14 0x5624e8c0be98 in aio_dispatch /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/aio-posix.c:423:5 #15 0x5624e8cba3ce in aio_ctx_dispatch /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:360:5 #16 0x7fb199ae0d3a in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #17 0x7fb199ae0d3a in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #18 0x5624e8cbe1d9 in glib_pollfds_poll /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:287:9 #19 0x5624e8cbcb13 in os_host_main_loop_wait /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:310:5 #20 0x5624e8cbc6dc in main_loop_wait /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:589:11 #21 0x5624e6f3f917 in qemu_main_loop /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/runstate.c:801:9 #22 0x5624e893379c in qemu_default_main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/main.c:37:14 #23 0x5624e89337e7 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/main.c:48:12 #24 0x7fb197972d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #25 0x7fb197972e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #26 0x5624e5c16fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: a9e623fa1009a9435c0142c037cd7b8c1ad04ce3) SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Daniel P. Berrangé Message-ID: <20240819145021.38524-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 87e012f29f2e47dcd8c385ff8bb8188f9e06d4ea) Signed-off-by: Michael Tokarev diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c index 546cad1c5a..0d6b71a37c 100644 --- a/crypto/tlscredspsk.c +++ b/crypto/tlscredspsk.c @@ -243,6 +243,7 @@ qcrypto_tls_creds_psk_finalize(Object *obj) QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj); qcrypto_tls_creds_psk_unload(creds); + g_free(creds->username); } static void From patchwork Fri Sep 6 11:13:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825950 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp748961wrb; Fri, 6 Sep 2024 04:27:04 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXWynVnvirV4BjlePWxnQbrrowaK13/usn3Oft9ffHDUa9z4zxsem5LqisF83Dx5aockKwq6w==@linaro.org X-Google-Smtp-Source: AGHT+IHYFKOCLKFzEYhRS591pgGBveS+TLtOUeeqbToMDgMc2HsL/7OcEA9wGRPTwDzeTFEq4Pn/ X-Received: by 2002:a05:6000:184e:b0:378:7e74:cc25 with SMTP id ffacd0b85a97d-3788967e4e6mr2272496f8f.39.1725622024392; Fri, 06 Sep 2024 04:27:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725622024; cv=none; d=google.com; s=arc-20240605; b=H2/wX4xUCfFs+nNQodO4Q4qx1MO74p1hf5gdQt5CQ7+3il37vYArV7HfjCmxvfzH9t /dvDgRzC8/u+ArBqpoSCbQ/JXtrVn7pDDwZFGM0Fm+46Q3rPilOfc3K3Iz+9mqNwnYZN BPCUdv0EBCeEXjzdgtvKhR0CPQRupxLdqA5IeloBNrKkxXC1yWCwmmtzUqhy+waAzsGB bC59Q09pRH//AM/g11MgB9DmHFlUs+kCf+khbwjbq7UiacVb/cOFrEKbK4YHFI6K4wo4 cQpoGZsLxnmVkW1JqkMZXk382Vx3UfBy4M6DYYFyq83aLZubytvmwT2seIlH05Ca50Wc 3I6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=MmxvUhSRMR+q0DlAIJoQD297lGCLNM/EBmZcun/zMxg=; fh=QOAy0A4213tdVVW86waZHa7h/mQ/YddeVyEp4HCmTP4=; b=RCynehWEp2+126mTEZBSLo2EsUzZUqV708jyeGPyAqyjhYZXSVwWLiXadaA1whsOWP 7KF2Z9SsHEg0JcBTh+TSoiyhQQ5GhjM6u/ZGuSli/S0dlHdQ+GN0g/SuUD7pFGR2P26G GTH91SN/OUJGK6p4uTQQsd5Oz4i1PKiuTm0k3UmUNqSH71U6Cug+R60Nc3AM4UackWAV ZWzDObgmYBxlSRerBiLewC9yjKzqBsguJUu8OcInOMFy/3RXkGbiwIYK77+kKDapX0Se 2eZTgB7pAYQ3Mi6aWYfAd3BB2bormYnHrP60qqVE7UWHOd8yt0f7QgcWu1FwFKofz68I qTsQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 5b1f17b1804b1-42ca05c65ffsi6213185e9.26.2024.09.06.04.27.04 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:27:04 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smX03-0001CP-BG; Fri, 06 Sep 2024 07:19:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smX00-0000a6-1i; Fri, 06 Sep 2024 07:19:32 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smWzx-0008MG-TK; Fri, 06 Sep 2024 07:19:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BC3018C4B2; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id C7C8713371B; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353759 invoked by uid 1000); Fri, 06 Sep 2024 11:13:25 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Fabiano Rosas , Michael Tokarev Subject: [Stable-9.0.3 65/69] migration/multifd: Free MultiFDRecvParams::data Date: Fri, 6 Sep 2024 14:13:14 +0300 Message-Id: <20240906111324.353230-65-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In multifd_recv_setup() we allocate (among other things) * a MultiFDRecvData struct to multifd_recv_state::data * a MultiFDRecvData struct to each multfd_recv_state->params[i].data (Then during execution we might swap these pointers around.) But in multifd_recv_cleanup() we free multifd_recv_state->data in multifd_recv_cleanup_state() but we don't ever free the multifd_recv_state->params[i].data. This results in a memory leak reported by LeakSanitizer: (cd build/asan && \ ASAN_OPTIONS="fast_unwind_on_malloc=0:strip_path_prefix=/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../" \ QTEST_QEMU_BINARY=./qemu-system-x86_64 \ ./tests/qtest/migration-test --tap -k -p /x86_64/migration/multifd/file/mapped-ram ) [...] Direct leak of 72 byte(s) in 3 object(s) allocated from: #0 0x561cc0afcfd8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218efd8) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) #1 0x7f89d37acc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13 #2 0x561cc1e9c83c in multifd_recv_setup migration/multifd.c:1606:19 #3 0x561cc1e68618 in migration_ioc_process_incoming migration/migration.c:972:9 #4 0x561cc1e3ac59 in migration_channel_process_incoming migration/channel.c:45:9 #5 0x561cc1e4fa0b in file_accept_incoming_migration migration/file.c:132:5 #6 0x561cc30f2c0c in qio_channel_fd_source_dispatch io/channel-watch.c:84:12 #7 0x7f89d37a3c43 in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #8 0x7f89d37a3c43 in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #9 0x561cc3b21659 in glib_pollfds_poll util/main-loop.c:287:9 #10 0x561cc3b1ff93 in os_host_main_loop_wait util/main-loop.c:310:5 #11 0x561cc3b1fb5c in main_loop_wait util/main-loop.c:589:11 #12 0x561cc1da2917 in qemu_main_loop system/runstate.c:801:9 #13 0x561cc3796c1c in qemu_default_main system/main.c:37:14 #14 0x561cc3796c67 in main system/main.c:48:12 #15 0x7f89d163bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #16 0x7f89d163be3f in __libc_start_main csu/../csu/libc-start.c:392:3 #17 0x561cc0a79fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) Direct leak of 24 byte(s) in 1 object(s) allocated from: #0 0x561cc0afcfd8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218efd8) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) #1 0x7f89d37acc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13 #2 0x561cc1e9bed9 in multifd_recv_setup migration/multifd.c:1588:32 #3 0x561cc1e68618 in migration_ioc_process_incoming migration/migration.c:972:9 #4 0x561cc1e3ac59 in migration_channel_process_incoming migration/channel.c:45:9 #5 0x561cc1e4fa0b in file_accept_incoming_migration migration/file.c:132:5 #6 0x561cc30f2c0c in qio_channel_fd_source_dispatch io/channel-watch.c:84:12 #7 0x7f89d37a3c43 in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #8 0x7f89d37a3c43 in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #9 0x561cc3b21659 in glib_pollfds_poll util/main-loop.c:287:9 #10 0x561cc3b1ff93 in os_host_main_loop_wait util/main-loop.c:310:5 #11 0x561cc3b1fb5c in main_loop_wait util/main-loop.c:589:11 #12 0x561cc1da2917 in qemu_main_loop system/runstate.c:801:9 #13 0x561cc3796c1c in qemu_default_main system/main.c:37:14 #14 0x561cc3796c67 in main system/main.c:48:12 #15 0x7f89d163bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #16 0x7f89d163be3f in __libc_start_main csu/../csu/libc-start.c:392:3 #17 0x561cc0a79fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: be72e086d4e47b172b0a72779972213fd9916466) SUMMARY: AddressSanitizer: 96 byte(s) leaked in 4 allocation(s). Free the params[i].data too. Cc: qemu-stable@nongnu.org Fixes: d117ed0699d41 ("migration/multifd: Allow receiving pages without packets") Signed-off-by: Peter Maydell Reviewed-by: Fabiano Rosas Signed-off-by: Fabiano Rosas (cherry picked from commit 4c107870e8b2ba3951ee0c46123f1c3b5d3a19d3) Signed-off-by: Michael Tokarev diff --git a/migration/multifd.c b/migration/multifd.c index fa55586f89..ac3742343f 100644 --- a/migration/multifd.c +++ b/migration/multifd.c @@ -1351,6 +1351,8 @@ static void multifd_recv_cleanup_channel(MultiFDRecvParams *p) qemu_mutex_destroy(&p->mutex); qemu_sem_destroy(&p->sem_sync); qemu_sem_destroy(&p->sem); + g_free(p->data); + p->data = NULL; g_free(p->name); p->name = NULL; p->packet_len = 0; From patchwork Fri Sep 6 11:13:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825951 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp749071wrb; Fri, 6 Sep 2024 04:27:24 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXaFwAxvpxxKxSmMImn2gfxTjr657pmG2c3v3QekQWAb44dntcpy05rtiM+n8SA39RLIHYu/w==@linaro.org X-Google-Smtp-Source: AGHT+IHdg/ubLESRBWNLG9wD6pOMwTsTLnxyf7boVqfbMMlueBaHHO0zy7ug2jgTwTtfdU0aKJsT X-Received: by 2002:a17:907:7d8a:b0:a86:8a89:3d7e with SMTP id a640c23a62f3a-a8a888492bcmr173601366b.41.1725622043875; Fri, 06 Sep 2024 04:27:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725622043; cv=none; d=google.com; s=arc-20240605; b=gjEn4GZ0omvGyLWQr8hJL9taw//Zby3HRM6Qf2j5djkBAOIiAgXEBtCsNZ/Wnblwx8 gb4/lhnrRHVELN9clh1PHOZ9NYzoAgRDLc0Bvh/Hcpcg6dec0BMPaOETdOT+umZiFQ0K nJ+1dHMeYcf3axNx55lOElpMzQ6WHgeDXgJEyAjy5ZWHYebcXlT9NPR7qFwMaNw7EUcX MOCD/zgLoIMIAS35/nCef0jp629Gyy2qEc+2uFKFUs/53eqRR/qqFV2eiauedLT7Wv3G k16+hhn8ZePXZf7XbgSwWBXjBAj5RNoMlwjfOh7yxO1UYsxO0ZaeUjiUhd0EVkJGn0Bj xgzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=4qb5qNOuS/E7yCXyc++RvoGdlLSpyYv8wPu0AsrKm1Y=; fh=K4abbxCgZAPvqzOXA+PZ7RIZh+KufMVJze7rXLOwES0=; b=cfjjNhADFk+F+ux7iAFKToBHBcdkeFgGdEFuvW7VZCV3hxpKFV1m3ToZ9cNu/TYuL1 Jrucbz1LLoMG7RFPU0ksW0mjtdfm1XI9fiZsA/e3O+zW2t0AdmhbyQsourWdrLE7eqtA nNgv4qtB+j+lyyb59Yv8f+xawDgkFPYuIWqJr35DjEnHElVlvPCDzNfRDdSvikUyYfzb eONdNqoxIAvYoNADIUI7pQeH+qqKkdjsymPZbTIdnZCacYe3XPI1DbC+4CMsbcV1USdX jolX1RCmIrv2YRYkfpYQddcV3JwtbD6Z/tYw/9snMsnxyhzQ6edmIY4SpbYtIUH9M/YW izFg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id a640c23a62f3a-a8a93a9d6a2si53221166b.712.2024.09.06.04.27.23 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 06 Sep 2024 04:27:23 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smX03-0001HA-Qh; Fri, 06 Sep 2024 07:19:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smX02-000143-8k; Fri, 06 Sep 2024 07:19:34 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smX00-0008Mg-68; Fri, 06 Sep 2024 07:19:33 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CA3EE8C4B3; Fri, 6 Sep 2024 14:12:10 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id D71F813371C; Fri, 6 Sep 2024 14:13:28 +0300 (MSK) Received: (nullmailer pid 353762 invoked by uid 1000); Fri, 06 Sep 2024 11:13:25 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-9.0.3 66/69] linux-user: Handle short reads in mmap_h_gt_g Date: Fri, 6 Sep 2024 14:13:15 +0300 Message-Id: <20240906111324.353230-66-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson In particular, if an image has a large bss, we can hit EOF before reading all host_len bytes of the mapping. Create a helper, mmap_pread to handle the job for both the larger block in mmap_h_gt_g itself, as well as the smaller block in mmap_frag. Cc: qemu-stable@nongnu.org Fixes: eb5027ac618 ("linux-user: Split out mmap_h_gt_g") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2504 Signed-off-by: Richard Henderson Message-Id: <20240820050848.165253-2-richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé (cherry picked from commit a4ad4a9d98f7fbde806f07da21e69f39e134cdf1) Signed-off-by: Michael Tokarev diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 2a11d921ab..9e94f36ba2 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -282,6 +282,40 @@ static int do_munmap(void *addr, size_t len) return munmap(addr, len); } +/* + * Perform a pread on behalf of target_mmap. We can reach EOF, we can be + * interrupted by signals, and in general there's no good error return path. + * If @zero, zero the rest of the block at EOF. + * Return true on success. + */ +static bool mmap_pread(int fd, void *p, size_t len, off_t offset, bool zero) +{ + while (1) { + ssize_t r = pread(fd, p, len, offset); + + if (likely(r == len)) { + /* Complete */ + return true; + } + if (r == 0) { + /* EOF */ + if (zero) { + memset(p, 0, len); + } + return true; + } + if (r > 0) { + /* Short read */ + p += r; + len -= r; + offset += r; + } else if (errno != EINTR) { + /* Error */ + return false; + } + } +} + /* * Map an incomplete host page. * @@ -356,10 +390,9 @@ static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last, /* Read or zero the new guest pages. */ if (flags & MAP_ANONYMOUS) { memset(g2h_untagged(start), 0, last - start + 1); - } else { - if (pread(fd, g2h_untagged(start), last - start + 1, offset) == -1) { - return false; - } + } else if (!mmap_pread(fd, g2h_untagged(start), last - start + 1, + offset, true)) { + return false; } /* Put final protection */ @@ -852,8 +885,7 @@ static abi_long mmap_h_gt_g(abi_ulong start, abi_ulong len, } if (misaligned_offset) { - /* TODO: The read could be short. */ - if (pread(fd, p, host_len, offset + real_start - start) != host_len) { + if (!mmap_pread(fd, p, host_len, offset + real_start - start, false)) { do_munmap(p, host_len); return -1; }