Some small arm bug fixes for rc3.

The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:

Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401

for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)

* target/arm: Fix some bugs in secure EL2 handling

* target/arm: Fix assert when !HAVE_CMPXCHG128

* MAINTAINERS: change Fred Konrad's email address

Frederic Konrad (1):

MAINTAINERS: change Fred Konrad's email address

Idan Horowitz (4):

target/arm: Fix MTE access checks for disabled SEL2

target/arm: Check VSTCR.SW when assigning the stage 2 output PA space

target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk

target/arm: Determine final stage 2 output PA space based on original IPA

Peter Maydell (1):

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen

target/arm/internals.h | 2 +-

target/arm/helper.c | 18 +++++++++++++++---

target/arm/translate-a64.c | 7 ++++++-

.mailmap | 3 ++-

MAINTAINERS | 2 +-

5 files changed, 25 insertions(+), 7 deletions(-)

From: Idan Horowitz <idan.horowitz@gmail.com>

While not mentioned anywhere in the actual specification text, the

HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current

security state. This can be observed in the psuedo-code implementation

of AArch64.AllocationTagAccessIsEnabled().

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com

target/arm/internals.h | 2 +-

target/arm/helper.c | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,

&& !(env->cp15.scr_el3 & SCR_ATA)) {

return false;

}

- if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {

+ if (el < 2 && arm_is_el2_enabled(env)) {

uint64_t hcr = arm_hcr_el2_eff(env);

if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {

return false;

@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,

int el = arm_current_el(env);

- if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {

+ if (el < 2 && arm_is_el2_enabled(env)) {

uint64_t hcr = arm_hcr_el2_eff(env);

if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {

return CP_ACCESS_TRAP_EL2;

2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the

PA space of the IPA is non secure, the output PA space is secure if and only

if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com

target/arm/helper.c | 2 +-

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

} else {

attrs->secure =

!((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))

- || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));

+ || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));

}

}

return 0;

2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the

initial PA space used for stage 2 table walks is assigned based on the SW

and NSW bits of the VSTCR and VTCR registers.

This was already implemented for the recursive stage 2 page table walks

in S1_ptw_translate(), but was missing for the final stage 2 walk.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>

Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com

target/arm/helper.c | 10 ++++++++++

1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

return ret;

}

+ if (arm_is_secure_below_el3(env)) {

+ if (attrs->secure) {

+ attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);

+ } else {

+ attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);

+ }

+ } else {

+ assert(!attrs->secure);

+ }

+

s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;

is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;

2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final

decision as to the output address's PA space based on the SA/SW/NSA/NSW

bits needs to take the input IPA's PA space into account, and not the

PA space of the result of the stage 2 walk itself.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com

[PMM: fixed commit message typo]

target/arm/helper.c | 8 +++++---

1 file changed, 5 insertions(+), 3 deletions(-)

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

hwaddr ipa;

int s2_prot;

int ret;

+ bool ipa_secure;

ARMCacheAttrs cacheattrs2 = {};

ARMMMUIdx s2_mmu_idx;

bool is_el0;

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

return ret;

}

+ ipa_secure = attrs->secure;

if (arm_is_secure_below_el3(env)) {

- if (attrs->secure) {

+ if (ipa_secure) {

attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);

} else {

attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);

}

} else {

- assert(!attrs->secure);

+ assert(!ipa_secure);

}

s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

/* Check if IPA translates to secure or non-secure PA space. */

if (arm_is_secure_below_el3(env)) {

- if (attrs->secure) {

+ if (ipa_secure) {

attrs->secure =

!(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));

} else {

2.25.1

From: Frederic Konrad <konrad@adacore.com>

frederic.konrad@adacore.com and konrad@adacore.com will stop working starting

2022-04-01.

Use my personal email instead.

Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>

Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com

.mailmap | 3 ++-

MAINTAINERS | 2 +-

2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap

--- a/.mailmap

+++ b/.mailmap

@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>

Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>

Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>

Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>

-Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>

+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>

+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>

Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>

Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>

Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>

@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h

Leon3

M: Fabien Chouteau <chouteau@adacore.com>

-M: KONRAD Frederic <frederic.konrad@adacore.com>

+M: Frederic Konrad <konrad.frederic@yahoo.fr>

S: Maintained

F: hw/sparc/leon3.c

F: hw/*/grlib*

2.25.1

In gen_store_exclusive(), if the host does not have a cmpxchg128

primitive then we generate bad code for STXP for storing two 64-bit

values. We generate a call to the exit_atomic helper, which never

returns, and set is_jmp to DISAS_NORETURN. However, this is

forgetting that we have already emitted a brcond that jumps over this

call for the case where we don't hold the exclusive. The effect is

that we don't generate any code to end the TB for the

exclusive-not-held execution path, which falls into the "exit with

TB_EXIT_REQUESTED" code that gen_tb_end() emits. This then causes an

assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB

return that wasn't for an interrupt or icount.

In particular, you can hit this case when using the clang sanitizers

and trying to run the xlnx-versal-virt acceptance test in 'make

check-acceptance'. This bug was masked until commit 848126d11e93ff

("meson: move int128 checks from configure") because we used to set

CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we

do not.

Fix the bug by not setting is_jmp. The code after the exit_atomic

call up to the fail_label is dead, but TCG is smart enough to

eliminate it. We do need to set 'tmp' to some valid value, though

(in the same way the exit_atomic-using code in tcg/tcg-op.c does).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953

Message-id: 20220331150858.96348-1-peter.maydell@linaro.org

target/arm/translate-a64.c | 7 ++++++-

1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,

} else if (tb_cflags(s->base.tb) & CF_PARALLEL) {

if (!HAVE_CMPXCHG128) {

gen_helper_exit_atomic(cpu_env);

- s->base.is_jmp = DISAS_NORETURN;

+ /*

+ * Produce a result so we have a well-formed opcode

+ * stream when the following (dead) code uses 'tmp'.

+ * TCG will remove the dead ops for us.

+ */

+ tcg_gen_movi_i64(tmp, 0);

} else if (s->be_data == MO_LE) {

gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,

cpu_exclusive_addr,

2.25.1