The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:

Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901

for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:

target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)

Respect PROT_EXEC in user-only mode.

Fix s390x, i386 and riscv for translations crossing a page.

Ilya Leoshkevich (4):

linux-user: Clear translations on mprotect()

accel/tcg: Introduce is_same_page()

target/s390x: Make translator stop before the end of a page

target/i386: Make translator stop before the end of a page

Richard Henderson (16):

linux-user/arm: Mark the commpage executable

linux-user/hppa: Allocate page zero as a commpage

linux-user/x86_64: Allocate vsyscall page as a commpage

linux-user: Honor PT_GNU_STACK

tests/tcg/i386: Move smc_code2 to an executable section

accel/tcg: Properly implement get_page_addr_code for user-only

accel/tcg: Unlock mmap_lock after longjmp

accel/tcg: Make tb_htable_lookup static

accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c

accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp

accel/tcg: Document the faulting lookup in tb_lookup_cmp

accel/tcg: Remove translator_ldsw

accel/tcg: Add pc and host_pc params to gen_intermediate_code

accel/tcg: Add fast path for translator_ld*

target/riscv: Add MAX_INSN_LEN and insn_len

target/riscv: Make translator stop before the end of a page

While there are no target-specific nonfaulting probes,

generic code may grow some uses at some point.

Note that the attrs argument was incorrect -- it should have

been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------

1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c

--- a/target/avr/helper.c

+++ b/target/avr/helper.c

@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,

MMUAccessType access_type, int mmu_idx,

bool probe, uintptr_t retaddr)

{

- int prot = 0;

- MemTxAttrs attrs = {};

+ int prot, page_size = TARGET_PAGE_SIZE;

uint32_t paddr;

address &= TARGET_PAGE_MASK;

if (mmu_idx == MMU_CODE_IDX) {

- /* access to code in flash */

+ /* Access to code in flash. */

paddr = OFFSET_CODE + address;

prot = PAGE_READ | PAGE_EXEC;

- if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {

+ if (paddr >= OFFSET_DATA) {

+ /*

+ * This should not be possible via any architectural operations.

+ * There is certainly not an exception that we can deliver.

+ * Accept probing that might come from generic code.

+ */

+ if (probe) {

+ return false;

+ }

error_report("execution left flash memory");

abort();

}

- } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {

- /*

- * access to CPU registers, exit and rebuilt this TB to use full access

- * incase it touches specially handled registers like SREG or SP

- */

- AVRCPU *cpu = AVR_CPU(cs);

- CPUAVRState *env = &cpu->env;

- env->fullacc = 1;

- cpu_loop_exit_restore(cs, retaddr);

} else {

- /* access to memory. nothing special */

+ /* Access to memory. */

paddr = OFFSET_DATA + address;

prot = PAGE_READ | PAGE_WRITE;

+ if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {

+ /*

+ * Access to CPU registers, exit and rebuilt this TB to use

+ * full access in case it touches specially handled registers

+ * like SREG or SP. For probing, set page_size = 1, in order

+ * to force tlb_fill to be called for the next access.

+ */

+ if (probe) {

+ page_size = 1;

+ } else {

+ AVRCPU *cpu = AVR_CPU(cs);

+ CPUAVRState *env = &cpu->env;

+ env->fullacc = 1;

+ cpu_loop_exit_restore(cs, retaddr);

+ }

+ }

}

- tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,

- mmu_idx, TARGET_PAGE_SIZE);

-

+ tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);

return true;

}

2.34.1

There is no need to go through cc->tcg_ops when

we know what value that must have.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

target/avr/helper.c | 5 ++---

1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c

--- a/target/avr/helper.c

+++ b/target/avr/helper.c

@@ -XXX,XX +XXX,XX @@

bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

bool ret = false;

- CPUClass *cc = CPU_GET_CLASS(cs);

AVRCPU *cpu = AVR_CPU(cs);

CPUAVRState *env = &cpu->env;

if (interrupt_request & CPU_INTERRUPT_RESET) {

if (cpu_interrupts_enabled(env)) {

cs->exception_index = EXCP_RESET;

- cc->tcg_ops->do_interrupt(cs);

+ avr_cpu_do_interrupt(cs);

cs->interrupt_request &= ~CPU_INTERRUPT_RESET;

@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

if (cpu_interrupts_enabled(env) && env->intsrc != 0) {

int index = ctz32(env->intsrc);

cs->exception_index = EXCP_INT(index);

- cc->tcg_ops->do_interrupt(cs);

+ avr_cpu_do_interrupt(cs);

env->intsrc &= env->intsrc - 1; /* clear the interrupt */

if (!env->intsrc) {

2.34.1

We're about to start validating PAGE_EXEC, which means that we've

got to mark page zero executable. We had been special casing this

entirely within translate.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---

1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,

regs->gr[31] = infop->entry;

}

+#define LO_COMMPAGE 0

+static bool init_guest_commpage(void)

+ void *want = g2h_untagged(LO_COMMPAGE);

+ void *addr = mmap(want, qemu_host_page_size, PROT_NONE,

+ MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);

+

+ if (addr == MAP_FAILED) {

+ perror("Allocating guest commpage");

+ exit(EXIT_FAILURE);

+ }

+ if (addr != want) {

+ return false;

+ }

+

+ /*

+ * On Linux, page zero is normally marked execute only + gateway.

+ * Normal read or write is supposed to fail (thus PROT_NONE above),

+ * but specific offsets have kernel code mapped to raise permissions

+ * and implement syscalls. Here, simply mark the page executable.

+ * Special case the entry points during translation (see do_page_zero).

+ */

+ page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,

+ PAGE_EXEC | PAGE_VALID);

+ return true;

#endif /* TARGET_HPPA */

#ifdef TARGET_XTENSA

@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,

#if defined(HI_COMMPAGE)

-#define LO_COMMPAGE 0

+#define LO_COMMPAGE -1

#elif defined(LO_COMMPAGE)

#define HI_COMMPAGE 0

#else

#define HI_COMMPAGE 0

-#define LO_COMMPAGE 0

+#define LO_COMMPAGE -1

#define init_guest_commpage() true

#endif

@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,

} else {

offset = -(HI_COMMPAGE & -align);

}

- } else if (LO_COMMPAGE != 0) {

+ } else if (LO_COMMPAGE != -1) {

loaddr = MIN(loaddr, LO_COMMPAGE & -align);

}

2.34.1

We cannot deliver two interrupts simultaneously;

the first interrupt handler must execute first.

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

target/avr/helper.c | 9 +++------

1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c

--- a/target/avr/helper.c

+++ b/target/avr/helper.c

@@ -XXX,XX +XXX,XX @@

bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

{

- bool ret = false;

AVRCPU *cpu = AVR_CPU(cs);

CPUAVRState *env = &cpu->env;

@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

avr_cpu_do_interrupt(cs);

cs->interrupt_request &= ~CPU_INTERRUPT_RESET;

- ret = true;

+ return true;

}

if (interrupt_request & CPU_INTERRUPT_HARD) {

@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

if (!env->intsrc) {

cs->interrupt_request &= ~CPU_INTERRUPT_HARD;

}

-

- ret = true;

+ return true;

}

- return ret;

+ return false;

}

void avr_cpu_do_interrupt(CPUState *cs)

2.34.1

This bit is not saved across interrupts, so we must

delay delivering the interrupt until the skip has

been processed.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

target/avr/helper.c | 9 +++++++++

target/avr/translate.c | 26 ++++++++++++++++++++++----

2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c

--- a/target/avr/helper.c

+++ b/target/avr/helper.c

@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

AVRCPU *cpu = AVR_CPU(cs);

CPUAVRState *env = &cpu->env;

+ /*

+ * We cannot separate a skip from the next instruction,

+ * as the skip would not be preserved across the interrupt.

+ * Separating the two insn normally only happens at page boundaries.

+ */

+ if (env->skip) {

+ return false;

+ }

+

if (interrupt_request & CPU_INTERRUPT_RESET) {

if (cpu_interrupts_enabled(env)) {

cs->exception_index = EXCP_RESET;

diff --git a/target/avr/translate.c b/target/avr/translate.c

--- a/target/avr/translate.c

+++ b/target/avr/translate.c

@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)

if (skip_label) {

canonicalize_skip(ctx);

gen_set_label(skip_label);

- if (ctx->base.is_jmp == DISAS_NORETURN) {

+

+ switch (ctx->base.is_jmp) {

+ case DISAS_NORETURN:

ctx->base.is_jmp = DISAS_CHAIN;

+ break;

+ case DISAS_NEXT:

+ if (ctx->base.tb->flags & TB_FLAGS_SKIP) {

+ ctx->base.is_jmp = DISAS_TOO_MANY;

+ }

+ break;

+ default:

+ break;

}

}

@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

{

DisasContext *ctx = container_of(dcbase, DisasContext, base);

bool nonconst_skip = canonicalize_skip(ctx);

+ /*

+ * Because we disable interrupts while env->skip is set,

+ * we must return to the main loop to re-evaluate afterward.

+ */

+ bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;

switch (ctx->base.is_jmp) {

case DISAS_NORETURN:

@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

case DISAS_NEXT:

case DISAS_TOO_MANY:

case DISAS_CHAIN:

- if (!nonconst_skip) {

+ if (!nonconst_skip && !force_exit) {

/* Note gen_goto_tb checks singlestep. */

gen_goto_tb(ctx, 1, ctx->npc);

break;

@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

tcg_gen_movi_tl(cpu_pc, ctx->npc);

/* fall through */

case DISAS_LOOKUP:

- tcg_gen_lookup_and_goto_ptr();

- break;

+ if (!force_exit) {

+ tcg_gen_lookup_and_goto_ptr();

+ break;

+ }

+ /* fall through */

case DISAS_EXIT:

tcg_gen_exit_tb(NULL, 0);

break;

2.34.1

The mmap_lock is held around tb_gen_code. While the comment

is correct that the lock is dropped when tb_gen_code runs out

of memory, the lock is *not* dropped when an exception is

raised reading code for translation.

Acked-by: Alistair Francis <alistair.francis@wdc.com>

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

accel/tcg/cpu-exec.c | 12 ++++++------

accel/tcg/user-exec.c | 3 ---

2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c

--- a/accel/tcg/cpu-exec.c

+++ b/accel/tcg/cpu-exec.c

@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)

cpu_tb_exec(cpu, tb, &tb_exit);

cpu_exec_exit(cpu);

} else {

- /*

- * The mmap_lock is dropped by tb_gen_code if it runs out of

- * memory.

- */

#ifndef CONFIG_SOFTMMU

clear_helper_retaddr();

- tcg_debug_assert(!have_mmap_lock());

+ if (have_mmap_lock()) {

+ mmap_unlock();

+ }

#endif

if (qemu_mutex_iothread_locked()) {

qemu_mutex_unlock_iothread();

@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)

#ifndef CONFIG_SOFTMMU

clear_helper_retaddr();

- tcg_debug_assert(!have_mmap_lock());

+ if (have_mmap_lock()) {

+ mmap_unlock();

+ }

#endif

if (qemu_mutex_iothread_locked()) {

qemu_mutex_unlock_iothread();

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c

--- a/accel/tcg/user-exec.c

+++ b/accel/tcg/user-exec.c

@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)

* (and if the translator doesn't handle page boundaries correctly

* there's little we can do about that here). Therefore, do not

* trigger the unwinder.

- *

- * Like tb_gen_code, release the memory lock before cpu_loop_exit.

*/

- mmap_unlock();

*pc = 0;

return MMU_INST_FETCH;

2.34.1

The function is not used outside of cpu-exec.c. Move it and

its subroutines up in the file, before the first use.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

include/exec/exec-all.h | 3 -

accel/tcg/cpu-exec.c | 122 ++++++++++++++++++++--------------------

2 files changed, 61 insertions(+), 64 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h