Some small arm bug fixes for rc3.

The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:

Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401

for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)

* target/arm: Fix some bugs in secure EL2 handling

* target/arm: Fix assert when !HAVE_CMPXCHG128

* MAINTAINERS: change Fred Konrad's email address

Frederic Konrad (1):

MAINTAINERS: change Fred Konrad's email address

Idan Horowitz (4):

target/arm: Fix MTE access checks for disabled SEL2

target/arm: Check VSTCR.SW when assigning the stage 2 output PA space

target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk

target/arm: Determine final stage 2 output PA space based on original IPA

Peter Maydell (1):

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the

initial PA space used for stage 2 table walks is assigned based on the SW

and NSW bits of the VSTCR and VTCR registers.

This was already implemented for the recursive stage 2 page table walks

in S1_ptw_translate(), but was missing for the final stage 2 walk.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.c | 10 ++++++++++

1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

return ret;

}

+ if (arm_is_secure_below_el3(env)) {

+ if (attrs->secure) {

+ attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);

+ } else {

+ attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);

+ }

+ } else {

+ assert(!attrs->secure);

+ }

s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;

is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final

decision as to the output address's PA space based on the SA/SW/NSA/NSW

bits needs to take the input IPA's PA space into account, and not the

PA space of the result of the stage 2 walk itself.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com

[PMM: fixed commit message typo]

target/arm/helper.c | 8 +++++---

1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

hwaddr ipa;

int s2_prot;

int ret;

+ bool ipa_secure;

ARMCacheAttrs cacheattrs2 = {};

ARMMMUIdx s2_mmu_idx;

bool is_el0;

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

return ret;

}

+ ipa_secure = attrs->secure;

if (arm_is_secure_below_el3(env)) {

- if (attrs->secure) {

+ if (ipa_secure) {

attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);

} else {

attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);

}

} else {

- assert(!attrs->secure);

+ assert(!ipa_secure);

}

s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

/* Check if IPA translates to secure or non-secure PA space. */

if (arm_is_secure_below_el3(env)) {

- if (attrs->secure) {

+ if (ipa_secure) {

attrs->secure =

!(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));

} else {

From: Frederic Konrad <konrad@adacore.com>

frederic.konrad@adacore.com and konrad@adacore.com will stop working starting

2022-04-01.

.mailmap | 3 ++-

MAINTAINERS | 2 +-

2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap

--- a/.mailmap

+++ b/.mailmap

@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>

Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>

Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>

Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>

-Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>

+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>

+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>

Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>

Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>

Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h

Leon3

M: Fabien Chouteau <chouteau@adacore.com>

-M: KONRAD Frederic <frederic.konrad@adacore.com>

+M: Frederic Konrad <konrad.frederic@yahoo.fr>

S: Maintained

F: hw/sparc/leon3.c

F: hw/*/grlib*

In gen_store_exclusive(), if the host does not have a cmpxchg128

primitive then we generate bad code for STXP for storing two 64-bit

values. We generate a call to the exit_atomic helper, which never

returns, and set is_jmp to DISAS_NORETURN. However, this is

forgetting that we have already emitted a brcond that jumps over this

call for the case where we don't hold the exclusive. The effect is

that we don't generate any code to end the TB for the

exclusive-not-held execution path, which falls into the "exit with

TB_EXIT_REQUESTED" code that gen_tb_end() emits. This then causes an

assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB

return that wasn't for an interrupt or icount.

In particular, you can hit this case when using the clang sanitizers

and trying to run the xlnx-versal-virt acceptance test in 'make

check-acceptance'. This bug was masked until commit 848126d11e93ff

("meson: move int128 checks from configure") because we used to set

CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we

do not.

target/arm/translate-a64.c | 7 ++++++-

1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,

} else if (tb_cflags(s->base.tb) & CF_PARALLEL) {

if (!HAVE_CMPXCHG128) {

gen_helper_exit_atomic(cpu_env);

- s->base.is_jmp = DISAS_NORETURN;

+ /*

+ * Produce a result so we have a well-formed opcode

+ * stream when the following (dead) code uses 'tmp'.

+ * TCG will remove the dead ops for us.

+ */

+ tcg_gen_movi_i64(tmp, 0);

} else if (s->be_data == MO_LE) {

gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,

cpu_exclusive_addr,