Handful of arm fixes for the rc.

The following changes since commit 555249a59e9cdd6b58da103aba5cf3a2d45c899f:

Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-04-10 16:58:56 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210412

for you to fetch changes up to 52c01ada86611136e3122dd139788dbcbc292d86:

exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1 (2021-04-12 11:06:24 +0100)

* hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interrupts

* hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDs

* accel/tcg: Preserve PAGE_ANON when changing page permissions

* target/arm: Check PAGE_WRITE_ORG for MTE writeability

* exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1

Richard Henderson (3):

accel/tcg: Preserve PAGE_ANON when changing page permissions

target/arm: Check PAGE_WRITE_ORG for MTE writeability

exec: Fix overlap of PAGE_ANON and PAGE_TARGET_1

Zenghui Yu (2):

hw/arm/virt-acpi-build: Fix GSIV values of the {GERR, Sync} interrupts

hw/arm/smmuv3: Emulate CFGI_STE_RANGE for an aligned range of StreamIDs

include/exec/cpu-all.h | 4 ++--

tests/tcg/aarch64/mte.h | 3 ++-

accel/tcg/translate-all.c | 9 ++++++--

hw/arm/smmuv3.c | 12 +++++++----

hw/arm/virt-acpi-build.c | 4 ++--

target/arm/mte_helper.c | 2 +-

tests/tcg/aarch64/mte-6.c | 43 +++++++++++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 2 +-

8 files changed, 66 insertions(+), 13 deletions(-)

create mode 100644 tests/tcg/aarch64/mte-6.c

Using mprotect() to change PROT_* does not change the MAP_ANON

previously set with mmap(). Our linux-user version of MTE only

works with MAP_ANON pages, so losing PAGE_ANON caused MTE to

stop working.

Reported-by: Stephen Long <steplong@quicinc.com>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Tested-by: Alex Bennée <alex.bennee@linaro.org>

tests/tcg/aarch64/mte.h | 3 ++-

accel/tcg/translate-all.c | 9 +++++--

tests/tcg/aarch64/mte-6.c | 43 +++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 2 +-

4 files changed, 53 insertions(+), 4 deletions(-)

create mode 100644 tests/tcg/aarch64/mte-6.c

diff --git a/tests/tcg/aarch64/mte.h b/tests/tcg/aarch64/mte.h

--- a/tests/tcg/aarch64/mte.h

+++ b/tests/tcg/aarch64/mte.h

@@ -XXX,XX +XXX,XX @@ static void enable_mte(int tcf)

}

}

-static void *alloc_mte_mem(size_t size)

+static void * alloc_mte_mem(size_t size) __attribute__((unused));

+static void * alloc_mte_mem(size_t size)

{

void *p = mmap(NULL, size, PROT_READ | PROT_WRITE | PROT_MTE,

MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c

index XXXXXXX..XXXXXXX 100644

--- a/accel/tcg/translate-all.c

+++ b/accel/tcg/translate-all.c

@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)

a missing call to h2g_valid. */

assert(end - 1 <= GUEST_ADDR_MAX);

assert(start < end);

+ /* Only set PAGE_ANON with new mappings. */

+ assert(!(flags & PAGE_ANON) || (flags & PAGE_RESET));

assert_memory_lock();

start = start & TARGET_PAGE_MASK;

@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)

p->first_tb) {

tb_invalidate_phys_page(addr, 0);

}

- if (reset_target_data && p->target_data) {

+ if (reset_target_data) {

g_free(p->target_data);

p->target_data = NULL;

+ p->flags = flags;

+ } else {

+ /* Using mprotect on a page does not change MAP_ANON. */

+ p->flags = (p->flags & PAGE_ANON) | flags;

}

- p->flags = flags;

}

}

diff --git a/tests/tcg/aarch64/mte-6.c b/tests/tcg/aarch64/mte-6.c

+++ b/tests/tcg/aarch64/mte-6.c

+#include "mte.h"

+void pass(int sig, siginfo_t *info, void *uc)

+ assert(info->si_code == SEGV_MTESERR);

+ exit(0);

+int main(void)

+ enable_mte(PR_MTE_TCF_SYNC);

+ void *brk = sbrk(16);

+ if (brk == (void *)-1) {

+ perror("sbrk");

+ return 2;

+ }

+ if (mprotect(brk, 16, PROT_READ | PROT_WRITE | PROT_MTE)) {

+ perror("mprotect");

+ return 2;

+ }

+ int *p1, *p2;

+ long excl = 1;

+

+ asm("irg %0,%1,%2" : "=r"(p1) : "r"(brk), "r"(excl));

+ asm("gmi %0,%1,%0" : "+r"(excl) : "r"(p1));

+ asm("irg %0,%1,%2" : "=r"(p2) : "r"(brk), "r"(excl));

+ asm("stg %0,[%0]" : : "r"(p1));

+

+ *p1 = 0;

+

+ struct sigaction sa;

+ memset(&sa, 0, sizeof(sa));

+ sa.sa_sigaction = pass;

+ sa.sa_flags = SA_SIGINFO;

+ sigaction(SIGSEGV, &sa, NULL);

+

+ *p2 = 0;

+

+ abort();

@@ -XXX,XX +XXX,XX @@ AARCH64_TESTS += bti-2

# MTE Tests

ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_MTE),)

-AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4

+AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-6

mte-%: CFLAGS += -march=armv8.5-a+memtag

2.20.1

We can remove PAGE_WRITE when (internally) marking a page

read-only because it contains translated code.

This can be triggered by tests/tcg/aarch64/bti-2, after

having serviced SIGILL trampolines on the stack.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

target/arm/mte_helper.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c

--- a/target/arm/mte_helper.c

+++ b/target/arm/mte_helper.c

@@ -XXX,XX +XXX,XX @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,

uint8_t *tags;

uintptr_t index;

- if (!(flags & (ptr_access == MMU_DATA_STORE ? PAGE_WRITE : PAGE_READ))) {

+ if (!(flags & (ptr_access == MMU_DATA_STORE ? PAGE_WRITE_ORG : PAGE_READ))) {

/* SIGSEGV */

arm_cpu_tlb_fill(env_cpu(env), ptr, ptr_size, ptr_access,

ptr_mmu_idx, false, ra);