Series comparison

-[PULL 0/6] target-arm queue
+[PULL 0/3] target-arm queue
-Some small arm bug fixes for rc3.
+Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code.
 -- PMM
-The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:
+The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236:
-  Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)
+  Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801
-for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:
+for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc:
-  target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)
+  target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * target/arm: Fix some bugs in secure EL2 handling
+ * Fix KVM SVE ID register probe code
  * target/arm: Fix assert when !HAVE_CMPXCHG128
  * MAINTAINERS: change Fred Konrad's email address
 ----------------------------------------------------------------
-Frederic Konrad (1):
+Richard Henderson (3):
-      MAINTAINERS: change Fred Konrad's email address
+      target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
       target/arm: Set KVM_ARM_VCPU_SVE while probing the host
       target/arm: Move sve probe inside kvm >= 4.15 branch
-Idan Horowitz (4):
+ target/arm/kvm64.c | 45 ++++++++++++++++++++++-----------------------
-      target/arm: Fix MTE access checks for disabled SEL2
+file changed, 22 insertions(+), 23 deletions(-)
       target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
       target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
       target/arm: Determine final stage 2 output PA space based on original IPA
 Peter Maydell (1):
       target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
  target/arm/internals.h     |  2 +-
  target/arm/helper.c        | 18 +++++++++++++++---
  target/arm/translate-a64.c |  7 ++++++-
  .mailmap                   |  3 ++-
  MAINTAINERS                |  2 +-
 files changed, 25 insertions(+), 7 deletions(-)

-[PULL 2/6] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
+[PULL 1/3] target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
-From: Idan Horowitz <idan.horowitz@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
+Indication for support for SVE will not depend on whether we
-PA space of the IPA is non secure, the output PA space is secure if and only
+perform the query on the main kvm_state or the temp vcpu.
 if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220726045828.53697-2-richard.henderson@linaro.org
-Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 2 +-
+ target/arm/kvm64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/kvm64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-                 } else {
+         }
-                     attrs->secure =
+     }
-                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
--                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
+-    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
-+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
++    sve_supported = kvm_arm_sve_supported();
-                 }
-             }
+     /* Add feature bits that can't appear until after VCPU init. */
-             return 0;
+     if (sve_supported) {
 --
 .25.1

-[PULL 1/6] target/arm: Fix MTE access checks for disabled SEL2
+[PULL 2/3] target/arm: Set KVM_ARM_VCPU_SVE while probing the host
-From: Idan Horowitz <idan.horowitz@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-While not mentioned anywhere in the actual specification text, the
+Because we weren't setting this flag, our probe of ID_AA64ZFR0
-HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
+was always returning zero.  This also obviates the adjustment
-security state. This can be observed in the psuedo-code implementation
+of ID_AA64PFR0, which had sanitized the SVE field.
 of AArch64.AllocationTagAccessIsEnabled().
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+The effects of the bug are not visible, because the only thing that
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+ID_AA64ZFR0 is used for within qemu at present is tcg translation.
-Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
+The other tests for SVE within KVM are via ID_AA64PFR0.SVE.
 Reported-by: Zenghui Yu <yuzenghui@huawei.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220726045828.53697-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 2 +-
+ target/arm/kvm64.c | 27 +++++++++++++--------------
- target/arm/helper.c    | 2 +-
+file changed, 13 insertions(+), 14 deletions(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/kvm64.c
-+++ b/target/arm/internals.h
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-         && !(env->cp15.scr_el3 & SCR_ATA)) {
+     bool sve_supported;
-         return false;
+     bool pmu_supported = false;
      uint64_t features = 0;
 -    uint64_t t;
      int err;
      /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      struct kvm_vcpu_init init = { .target = -1, };
      /*
 -     * Ask for Pointer Authentication if supported. We can't play the
 -     * SVE trick of synthesising the ID reg as KVM won't tell us
 -     * whether we have the architected or IMPDEF version of PAuth, so
 -     * we have to use the actual ID regs.
 +     * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
 +     * which is otherwise RAZ.
 +     */
 +    sve_supported = kvm_arm_sve_supported();
 +    if (sve_supported) {
 +        init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
 +    }
 +
 +    /*
 +     * Ask for Pointer Authentication if supported, so that we get
 +     * the unsanitized field values for AA64ISAR1_EL1.
       */
      if (kvm_arm_pauth_supported()) {
          init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          }
      }
--    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-+    if (el < 2 && arm_is_el2_enabled(env)) {
+-    sve_supported = kvm_arm_sve_supported();
-         uint64_t hcr = arm_hcr_el2_eff(env);
+-
-         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
+-    /* Add feature bits that can't appear until after VCPU init. */
-             return false;
+     if (sve_supported) {
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+-        t = ahcf->isar.id_aa64pfr0;
-index XXXXXXX..XXXXXXX 100644
+-        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
---- a/target/arm/helper.c
+-        ahcf->isar.id_aa64pfr0 = t;
-+++ b/target/arm/helper.c
+-
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
+         /*
- {
+          * There is a range of kernels between kernel commit 73433762fcae
-     int el = arm_current_el(env);
+          * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
+          * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
--    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+-         * SVE support, so we only read it here, rather than together with all
-+    if (el < 2 && arm_is_el2_enabled(env)) {
+-         * the other ID registers earlier.
-         uint64_t hcr = arm_hcr_el2_eff(env);
++         * SVE support, which resulted in an error rather than RAZ.
-         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
++         * So only read the register if we set KVM_ARM_VCPU_SVE above.
-             return CP_ACCESS_TRAP_EL2;
+          */
          err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
                                ARM64_SYS_REG(3, 0, 0, 4, 4));
 --
 .25.1

-[PULL 3/6] target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
+Deleted patch
-From: Idan Horowitz <idan.horowitz@gmail.com>
-As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
-initial PA space used for stage 2 table walks is assigned based on the SW
-and NSW bits of the VSTCR and VTCR registers.
-This was already implemented for the recursive stage 2 page table walks
-in S1_ptw_translate(), but was missing for the final stage 2 walk.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                 return ret;
-             }
-+            if (arm_is_secure_below_el3(env)) {
-+                if (attrs->secure) {
-+                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
-+                } else {
-+                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
-+                }
-+            } else {
-+                assert(!attrs->secure);
-+            }
-+
-             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
---
-.25.1

-[PULL 4/6] target/arm: Determine final stage 2 output PA space based on original IPA
+[PULL 3/3] target/arm: Move sve probe inside kvm >= 4.15 branch
-From: Idan Horowitz <idan.horowitz@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
+The test for the IF block indicates no ID registers are exposed, much
-decision as to the output address's PA space based on the SA/SW/NSA/NSW
+less host support for SVE.  Move the SVE probe into the ELSE block.
 bits needs to take the input IPA's PA space into account, and not the
 PA space of the result of the stage 2 walk itself.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220726045828.53697-4-richard.henderson@linaro.org
-Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: fixed commit message typo]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 8 +++++---
+ target/arm/kvm64.c | 22 +++++++++++-----------
-file changed, 5 insertions(+), 3 deletions(-)
+file changed, 11 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/kvm64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-             hwaddr ipa;
+             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
-             int s2_prot;
+                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
-             int ret;
+         }
-+            bool ipa_secure;
+-    }
-             ARMCacheAttrs cacheattrs2 = {};
-             ARMMMUIdx s2_mmu_idx;
+-    if (sve_supported) {
-             bool is_el0;
+-        /*
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+-         * There is a range of kernels between kernel commit 73433762fcae
-                 return ret;
+-         * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-             }
+-         * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
+-         * SVE support, which resulted in an error rather than RAZ.
-+            ipa_secure = attrs->secure;
+-         * So only read the register if we set KVM_ARM_VCPU_SVE above.
-             if (arm_is_secure_below_el3(env)) {
+-         */
--                if (attrs->secure) {
+-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-+                if (ipa_secure) {
+-                              ARM64_SYS_REG(3, 0, 0, 4, 4));
-                     attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
++        if (sve_supported) {
-                 } else {
++            /*
-                     attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
++             * There is a range of kernels between kernel commit 73433762fcae
-                 }
++             * and f81cb2c3ad41 which have a bug where the kernel doesn't
-             } else {
++             * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
--                assert(!attrs->secure);
++             * enabled SVE support, which resulted in an error rather than RAZ.
-+                assert(!ipa_secure);
++             * So only read the register if we set KVM_ARM_VCPU_SVE above.
-             }
++             */
++            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
++                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
++        }
+     }
-             /* Check if IPA translates to secure or non-secure PA space. */
-             if (arm_is_secure_below_el3(env)) {
+     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 -                if (attrs->secure) {
 +                if (ipa_secure) {
                      attrs->secure =
                          !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
                  } else {
 --
 .25.1

-[PULL 5/6] MAINTAINERS: change Fred Konrad's email address
+Deleted patch
-From: Frederic Konrad <konrad@adacore.com>
-frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
--04-01.
-Use my personal email instead.
-Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
-Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- .mailmap    | 3 ++-
- MAINTAINERS | 2 +-
-files changed, 3 insertions(+), 2 deletions(-)
-diff --git a/.mailmap b/.mailmap
-index XXXXXXX..XXXXXXX 100644
---- a/.mailmap
-+++ b/.mailmap
-@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
- Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
- Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
- Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
--Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
-+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
-+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
- Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
- Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
- Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
- Leon3
- M: Fabien Chouteau <chouteau@adacore.com>
--M: KONRAD Frederic <frederic.konrad@adacore.com>
-+M: Frederic Konrad <konrad.frederic@yahoo.fr>
- S: Maintained
- F: hw/sparc/leon3.c
- F: hw/*/grlib*
---
-.25.1

-[PULL 6/6] target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
+Deleted patch
-In gen_store_exclusive(), if the host does not have a cmpxchg128
-primitive then we generate bad code for STXP for storing two 64-bit
-values.  We generate a call to the exit_atomic helper, which never
-returns, and set is_jmp to DISAS_NORETURN.  However, this is
-forgetting that we have already emitted a brcond that jumps over this
-call for the case where we don't hold the exclusive.  The effect is
-that we don't generate any code to end the TB for the
-exclusive-not-held execution path, which falls into the "exit with
-TB_EXIT_REQUESTED" code that gen_tb_end() emits.  This then causes an
-assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
-return that wasn't for an interrupt or icount.
-In particular, you can hit this case when using the clang sanitizers
-and trying to run the xlnx-versal-virt acceptance test in 'make
-check-acceptance'.  This bug was masked until commit 848126d11e93ff
-("meson: move int128 checks from configure") because we used to set
-CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
-do not.
-Fix the bug by not setting is_jmp.  The code after the exit_atomic
-call up to the fail_label is dead, but TCG is smart enough to
-eliminate it.  We do need to set 'tmp' to some valid value, though
-(in the same way the exit_atomic-using code in tcg/tcg-op.c does).
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
----
- target/arm/translate-a64.c | 7 ++++++-
-file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-         } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
-             if (!HAVE_CMPXCHG128) {
-                 gen_helper_exit_atomic(cpu_env);
--                s->base.is_jmp = DISAS_NORETURN;
-+                /*
-+                 * Produce a result so we have a well-formed opcode
-+                 * stream when the following (dead) code uses 'tmp'.
-+                 * TCG will remove the dead ops for us.
-+                 */
-+                tcg_gen_movi_i64(tmp, 0);
-             } else if (s->be_data == MO_LE) {
-                 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
-                                                         cpu_exclusive_addr,
---
-.25.1

Some small arm bug fixes for rc3.

-- PMM

The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:

Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401

for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Fix some bugs in secure EL2 handling
 * target/arm: Fix assert when !HAVE_CMPXCHG128
 * MAINTAINERS: change Fred Konrad's email address

----------------------------------------------------------------
Frederic Konrad (1):
      MAINTAINERS: change Fred Konrad's email address

Idan Horowitz (4):
      target/arm: Fix MTE access checks for disabled SEL2
      target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
      target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
      target/arm: Determine final stage 2 output PA space based on original IPA

Peter Maydell (1):
      target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen

From: Idan Horowitz <idan.horowitz@gmail.com>

While not mentioned anywhere in the actual specification text, the
HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
security state. This can be observed in the psuedo-code implementation
of AArch64.AllocationTagAccessIsEnabled().

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 2 +-
 target/arm/helper.c    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
         && !(env->cp15.scr_el3 & SCR_ATA)) {
         return false;
     }
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
             return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     int el = arm_current_el(env);
 
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
             return CP_ACCESS_TRAP_EL2;
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
PA space of the IPA is non secure, the output PA space is secure if and only
if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 } else {
                     attrs->secure =
                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
-                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
                 }
             }
             return 0;
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
initial PA space used for stage 2 table walks is assigned based on the SW
and NSW bits of the VSTCR and VTCR registers.
This was already implemented for the recursive stage 2 page table walks
in S1_ptw_translate(), but was missing for the final stage 2 walk.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            if (arm_is_secure_below_el3(env)) {
+                if (attrs->secure) {
+                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+                } else {
+                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+                }
+            } else {
+                assert(!attrs->secure);
+            }
+
             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
 
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
decision as to the output address's PA space based on the SA/SW/NSA/NSW
bits needs to take the input IPA's PA space into account, and not the
PA space of the result of the stage 2 walk itself.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
[PMM: fixed commit message typo]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s2_prot;
             int ret;
+            bool ipa_secure;
             ARMCacheAttrs cacheattrs2 = {};
             ARMMMUIdx s2_mmu_idx;
             bool is_el0;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            ipa_secure = attrs->secure;
             if (arm_is_secure_below_el3(env)) {
-                if (attrs->secure) {
+                if (ipa_secure) {
                     attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
                 } else {
                     attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
                 }
             } else {
-                assert(!attrs->secure);
+                assert(!ipa_secure);
             }
 
             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
             /* Check if IPA translates to secure or non-secure PA space. */
             if (arm_is_secure_below_el3(env)) {
-                if (attrs->secure) {
+                if (ipa_secure) {
                     attrs->secure =
                         !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
                 } else {
-- 
2.25.1

From: Frederic Konrad <konrad@adacore.com>

frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
2022-04-01.

Use my personal email instead.

Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 .mailmap    | 3 ++-
 MAINTAINERS | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index XXXXXXX..XXXXXXX 100644
--- a/.mailmap
+++ b/.mailmap
@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
 Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
 Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
-Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
 Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
 
 Leon3
 M: Fabien Chouteau <chouteau@adacore.com>
-M: KONRAD Frederic <frederic.konrad@adacore.com>
+M: Frederic Konrad <konrad.frederic@yahoo.fr>
 S: Maintained
 F: hw/sparc/leon3.c
 F: hw/*/grlib*
-- 
2.25.1

In gen_store_exclusive(), if the host does not have a cmpxchg128
primitive then we generate bad code for STXP for storing two 64-bit
values.  We generate a call to the exit_atomic helper, which never
returns, and set is_jmp to DISAS_NORETURN.  However, this is
forgetting that we have already emitted a brcond that jumps over this
call for the case where we don't hold the exclusive.  The effect is
that we don't generate any code to end the TB for the
exclusive-not-held execution path, which falls into the "exit with
TB_EXIT_REQUESTED" code that gen_tb_end() emits.  This then causes an
assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
return that wasn't for an interrupt or icount.

In particular, you can hit this case when using the clang sanitizers
and trying to run the xlnx-versal-virt acceptance test in 'make
check-acceptance'.  This bug was masked until commit 848126d11e93ff
("meson: move int128 checks from configure") because we used to set
CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
do not.

Fix the bug by not setting is_jmp.  The code after the exit_atomic
call up to the fail_label is dead, but TCG is smart enough to
eliminate it.  We do need to set 'tmp' to some valid value, though
(in the same way the exit_atomic-using code in tcg/tcg-op.c does).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
---
 target/arm/translate-a64.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
         } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
             if (!HAVE_CMPXCHG128) {
                 gen_helper_exit_atomic(cpu_env);
-                s->base.is_jmp = DISAS_NORETURN;
+                /*
+                 * Produce a result so we have a well-formed opcode
+                 * stream when the following (dead) code uses 'tmp'.
+                 * TCG will remove the dead ops for us.
+                 */
+                tcg_gen_movi_i64(tmp, 0);
             } else if (s->be_data == MO_LE) {
                 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
                                                         cpu_exclusive_addr,
-- 
2.25.1

Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code.

-- PMM

The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236:

Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801

for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc:

target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix KVM SVE ID register probe code

----------------------------------------------------------------
Richard Henderson (3):
      target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
      target/arm: Set KVM_ARM_VCPU_SVE while probing the host
      target/arm: Move sve probe inside kvm >= 4.15 branch

target/arm/kvm64.c | 45 ++++++++++++++++++++++-----------------------
 1 file changed, 22 insertions(+), 23 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Because we weren't setting this flag, our probe of ID_AA64ZFR0
was always returning zero.  This also obviates the adjustment
of ID_AA64PFR0, which had sanitized the SVE field.

The effects of the bug are not visible, because the only thing that
ID_AA64ZFR0 is used for within qemu at present is tcg translation.
The other tests for SVE within KVM are via ID_AA64PFR0.SVE.

Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220726045828.53697-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     bool sve_supported;
     bool pmu_supported = false;
     uint64_t features = 0;
-    uint64_t t;
     int err;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     struct kvm_vcpu_init init = { .target = -1, };
 
     /*
-     * Ask for Pointer Authentication if supported. We can't play the
-     * SVE trick of synthesising the ID reg as KVM won't tell us
-     * whether we have the architected or IMPDEF version of PAuth, so
-     * we have to use the actual ID regs.
+     * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
+     * which is otherwise RAZ.
+     */
+    sve_supported = kvm_arm_sve_supported();
+    if (sve_supported) {
+        init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
+    }
+
+    /*
+     * Ask for Pointer Authentication if supported, so that we get
+     * the unsanitized field values for AA64ISAR1_EL1.
      */
     if (kvm_arm_pauth_supported()) {
         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         }
     }
 
-    sve_supported = kvm_arm_sve_supported();
-
-    /* Add feature bits that can't appear until after VCPU init. */
     if (sve_supported) {
-        t = ahcf->isar.id_aa64pfr0;
-        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-        ahcf->isar.id_aa64pfr0 = t;
-
         /*
          * There is a range of kernels between kernel commit 73433762fcae
          * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
          * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-         * SVE support, so we only read it here, rather than together with all
-         * the other ID registers earlier.
+         * SVE support, which resulted in an error rather than RAZ.
+         * So only read the register if we set KVM_ARM_VCPU_SVE above.
          */
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
                               ARM64_SYS_REG(3, 0, 0, 4, 4));
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The test for the IF block indicates no ID registers are exposed, much
less host support for SVE.  Move the SVE probe into the ELSE block.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220726045828.53697-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
         }
-    }
 
-    if (sve_supported) {
-        /*
-         * There is a range of kernels between kernel commit 73433762fcae
-         * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-         * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-         * SVE support, which resulted in an error rather than RAZ.
-         * So only read the register if we set KVM_ARM_VCPU_SVE above.
-         */
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-                              ARM64_SYS_REG(3, 0, 0, 4, 4));
+        if (sve_supported) {
+            /*
+             * There is a range of kernels between kernel commit 73433762fcae
+             * and f81cb2c3ad41 which have a bug where the kernel doesn't
+             * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
+             * enabled SVE support, which resulted in an error rather than RAZ.
+             * So only read the register if we set KVM_ARM_VCPU_SVE above.
+             */
+            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
+                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
+        }
     }
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
-- 
2.25.1