From: Richard Henderson <richard.henderson@linaro.org>

For both ldnt1 and stnt1, the meaning of the Rn and Rm are different

from ld1 and st1: the vector and integer registers are reversed, and

the integer register 31 refers to XZR instead of SP.

Secondly, the 64-bit version of ldnt1 was being interpreted as

32-bit unpacked unscaled offset instead of 64-bit unscaled offset,

which discarded the upper 32 bits of the address coming from

the vector argument.

Thirdly, validate that the memory element size is in range for the

vector element size for ldnt1. For ld1, we do this via independent

decode patterns, but for ldnt1 we need to do it manually.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20220308031655.240710-1-richard.henderson@linaro.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/sve.decode | 5 ++-

target/arm/translate-sve.c | 51 +++++++++++++++++++++++++++++--

tests/tcg/aarch64/test-826.c | 50 ++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 4 +++

tests/tcg/configure.sh | 4 +++

5 files changed, 109 insertions(+), 5 deletions(-)

create mode 100644 tests/tcg/aarch64/test-826.c

diff --git a/target/arm/sve.decode b/target/arm/sve.decode

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/sve.decode

+++ b/target/arm/sve.decode

@@ -XXX,XX +XXX,XX @@ USDOT_zzzz 01000100 .. 0 ..... 011 110 ..... ..... @rda_rn_rm

### SVE2 Memory Gather Load Group

-# SVE2 64-bit gather non-temporal load

-# (scalar plus unpacked 32-bit unscaled offsets)

+# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)

LDNT1_zprz 1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \

- &rprr_gather_load xs=0 esz=3 scale=0 ff=0

+ &rprr_gather_load xs=2 esz=3 scale=0 ff=0

# SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)

LDNT1_zprz 1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-sve.c

+++ b/target/arm/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)

static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)

{

+ gen_helper_gvec_mem_scatter *fn = NULL;

+ bool be = s->be_data == MO_BE;

+ bool mte = s->mte_active[0];

+

+ if (a->esz < a->msz + !a->u) {

+ return false;

+ }

if (!dc_isar_feature(aa64_sve2, s)) {

return false;

}

- return trans_LD1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];

+ break;

+ case MO_64:

+ fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];

+ break;

+ }

+ assert(fn != NULL);

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, false, fn);

+ return true;

}

/* Indexed by [mte][be][xs][msz]. */

@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)

static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)

{

+ gen_helper_gvec_mem_scatter *fn;

+ bool be = s->be_data == MO_BE;

+ bool mte = s->mte_active[0];

+

+ if (a->esz < a->msz) {

+ return false;

+ }

if (!dc_isar_feature(aa64_sve2, s)) {

return false;

}

- return trans_ST1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = scatter_store_fn32[mte][be][0][a->msz];

+ break;

+ case MO_64:

+ fn = scatter_store_fn64[mte][be][2][a->msz];

+ break;

+ default:

+ g_assert_not_reached();

+ }

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, true, fn);

+ return true;

}

/*

diff --git a/tests/tcg/aarch64/test-826.c b/tests/tcg/aarch64/test-826.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/tcg/aarch64/test-826.c

@@ -XXX,XX +XXX,XX @@

+#include <sys/mman.h>

+#include <unistd.h>

+#include <signal.h>

+#include <stdlib.h>

+#include <stdio.h>

+#include <assert.h>

+

+static void *expected;

+

+void sigsegv(int sig, siginfo_t *info, void *vuc)

+{

+ ucontext_t *uc = vuc;

+

+ assert(info->si_addr == expected);

+ uc->uc_mcontext.pc += 4;

+}

+

+int main()

+{

+ struct sigaction sa = {

+ .sa_sigaction = sigsegv,

+ .sa_flags = SA_SIGINFO

+ };

+

+ void *page;

+ long ofs;

+

+ if (sigaction(SIGSEGV, &sa, NULL) < 0) {

+ perror("sigaction");

+ return EXIT_FAILURE;

+ }

+

+ page = mmap(0, getpagesize(), PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);

+ if (page == MAP_FAILED) {

+ perror("mmap");

+ return EXIT_FAILURE;

+ }

+

+ ofs = 0x124;

+ expected = page + ofs;

+

+ asm("ptrue p0.d, vl1\n\t"

+ "dup z0.d, %0\n\t"

+ "ldnt1h {z1.d}, p0/z, [z0.d, %1]\n\t"

+ "dup z1.d, %1\n\t"

+ "ldnt1h {z0.d}, p0/z, [z1.d, %0]"

+ : : "r"(page), "r"(ofs) : "v0", "v1");

+

+ return EXIT_SUCCESS;

+}

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/Makefile.target

+++ b/tests/tcg/aarch64/Makefile.target

@@ -XXX,XX +XXX,XX @@ run-gdbstub-sve-ioctls: sve-ioctls

EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls

endif

+endif

+ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_SVE2),)

+AARCH64_TESTS += test-826

+test-826: CFLAGS+=-march=armv8.1-a+sve2

endif

TESTS += $(AARCH64_TESTS)

diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh

index XXXXXXX..XXXXXXX 100755

--- a/tests/tcg/configure.sh

+++ b/tests/tcg/configure.sh

@@ -XXX,XX +XXX,XX @@ for target in $target_list; do

-march=armv8.1-a+sve -o $TMPE $TMPC; then

echo "CROSS_CC_HAS_SVE=y" >> $config_target_mak

fi

+ if do_compiler "$target_compiler" $target_compiler_cflags \

+ -march=armv8.1-a+sve2 -o $TMPE $TMPC; then

+ echo "CROSS_CC_HAS_SVE2=y" >> $config_target_mak

+ fi

if do_compiler "$target_compiler" $target_compiler_cflags \

-march=armv8.3-a -o $TMPE $TMPC; then

echo "CROSS_CC_HAS_ARMV8_3=y" >> $config_target_mak

--

2.25.1

LPAE descriptors come in three forms:

* table descriptors, giving the address of the next level page table

* page descriptors, which occur only at level 3 and describe the

mapping of one page (which might be 4K, 16K or 64K)

* block descriptors, which occur at higher page table levels, and

describe the mapping of huge pages

QEMU's page-table-walk code treats block and page entries

identically, simply ORing in a number of bits from the input virtual

address that depends on the level of the page table that we stopped

at; we depend on the previous masking of descaddr with descaddrmask

to have already cleared out the low bits of the descriptor word.

This is not quite right: the address field in a block descriptor is

smaller, and so there are bits which are valid address bits in a page

descriptor or a table descriptor but which are not supposed to be

part of the address in a block descriptor, and descaddrmask does not

clear them. We previously mostly got away with this because those

descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)

block descriptor bit 16 is defined to be the nT bit. No emulated

QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might

see it when using KVM or hvf.

Explicitly zero out all the descaddr bits we're about to OR vaddr

bits into.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220304165628.2345765-1-peter.maydell@linaro.org

---

target/arm/helper.c | 10 ++++++++--

1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,

indexmask = indexmask_grainsize;

continue;

}

- /* Block entry at level 1 or 2, or page entry at level 3.

+ /*

+ * Block entry at level 1 or 2, or page entry at level 3.

* These are basically the same thing, although the number

- * of bits we pull in from the vaddr varies.

+ * of bits we pull in from the vaddr varies. Note that although

+ * descaddrmask masks enough of the low bits of the descriptor

+ * to give a correct page or table address, the address field

+ * in a block descriptor is smaller; so we need to explicitly

+ * clear the lower bits here before ORing in the low vaddr bits.

*/

page_size = (1ULL << ((stride * (4 - level)) + 3));

+ descaddr &= ~(page_size - 1);

descaddr |= (address & (page_size - 1));

/* Extract attributes from the descriptor */

attrs = extract64(descriptor, 2, 10)

--

2.25.1

In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its

own class struct, but forgot to update the TypeInfo::class_size

accordingly. This meant that not enough memory was allocated for the

class struct, and the initialization of xcdc->read in the class init

function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang

address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8

WRITE of size 8 at 0x61000000ab00 thread T0

#0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16

#1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

#3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)

#4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5

#5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5

#6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24

#7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35

#8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5

#9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5

#10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

#11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)

allocated by thread T0 here:

#0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)

#1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org

---

hw/dma/xlnx_csu_dma.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/dma/xlnx_csu_dma.c

+++ b/hw/dma/xlnx_csu_dma.c

@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {

.parent = TYPE_SYS_BUS_DEVICE,

.instance_size = sizeof(XlnxCSUDMA),

.class_init = xlnx_csu_dma_class_init,

+ .class_size = sizeof(XlnxCSUDMAClass),

.instance_init = xlnx_csu_dma_init,

.interfaces = (InterfaceInfo[]) {

{ TYPE_STREAM_SINK },

--

2.25.1

When we build our Windows installer, it emits the warning:

warning 7998: ANSI targets are deprecated

Fix this by making our installer a Unicode installer instead. These

won't work on Win95/98/ME, but we already do not support those.

See

https://nsis.sourceforge.io/Docs/Chapter4.html#aunicodetarget

for the documentation of the Unicode directive.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Stefan Weil <sw@weilnetz.de>

Message-id: 20220305105743.2384766-3-peter.maydell@linaro.org

---

qemu.nsi | 3 +++

1 file changed, 3 insertions(+)

diff --git a/qemu.nsi b/qemu.nsi

index XXXXXXX..XXXXXXX 100644

--- a/qemu.nsi

+++ b/qemu.nsi

@@ -XXX,XX +XXX,XX @@

!define OUTFILE "qemu-setup.exe"

!endif

+; Build a unicode installer

+Unicode true

+

; Use maximum compression.

SetCompressor /SOLID lzma

--

2.25.1

We use the nsis.py script to write out an installer script Section

for each emulator executable, so the exact set of Sections depends on

which executables were built. However the part of qemu.nsi which

specifies mouse-over descriptions for each Section still has a

hard-coded and very outdated list (with just i386 and alpha). This

causes two problems. Firstly, if you build the installer for a

configuration where you didn't build the i386 binaries you get

warnings like this:

warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)

warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)

(this happens in our gitlab CI jobs, for instance).

Secondly, most of the emulators in the generated installer don't have

any mouseover text.

Make nsis.py generate a second output file which has the necessary

MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can

include that at the right point in qemu.nsi to set the mouse-over

text.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>