Series comparison

-[PULL 0/6] target-arm queue
+[PULL 0/2] target-arm queue
-Some small arm bug fixes for rc3.
+This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
 we were using uninitialized data for the guarded bit when
 combining stage 1 and stage 2 attrs.
+thanks
 -- PMM
-The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:
+The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:
-  Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)
+  Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410
-for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:
+for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:
-  target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)
+  target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)
 ----------------------------------------------------------------
-target-arm queue:
+target-arm: Fix bug where we weren't initializing
- * target/arm: Fix some bugs in secure EL2 handling
+            guarded bit state when combining S1/S2 attrs
  * target/arm: Fix assert when !HAVE_CMPXCHG128
  * MAINTAINERS: change Fred Konrad's email address
 ----------------------------------------------------------------
-Frederic Konrad (1):
+Richard Henderson (2):
-      MAINTAINERS: change Fred Konrad's email address
+      target/arm: PTE bit GP only applies to stage1
       target/arm: Copy guarded bit in combine_cacheattrs
-Idan Horowitz (4):
+ target/arm/ptw.c | 11 ++++++-----
-      target/arm: Fix MTE access checks for disabled SEL2
+file changed, 6 insertions(+), 5 deletions(-)
       target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
       target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
       target/arm: Determine final stage 2 output PA space based on original IPA
 Peter Maydell (1):
       target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
  target/arm/internals.h     |  2 +-
  target/arm/helper.c        | 18 +++++++++++++++---
  target/arm/translate-a64.c |  7 ++++++-
  .mailmap                   |  3 ++-
  MAINTAINERS                |  2 +-
 files changed, 25 insertions(+), 7 deletions(-)

-[PULL 1/6] target/arm: Fix MTE access checks for disabled SEL2
+[PULL 1/2] target/arm: PTE bit GP only applies to stage1
-From: Idan Horowitz <idan.horowitz@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-While not mentioned anywhere in the actual specification text, the
+Only perform the extract of GP during the stage1 walk.
 HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
 security state. This can be observed in the psuedo-code implementation
 of AArch64.AllocationTagAccessIsEnabled().
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 2 +-
+ target/arm/ptw.c | 10 +++++-----
- target/arm/helper.c    | 2 +-
+file changed, 5 insertions(+), 5 deletions(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/ptw.c
-+++ b/target/arm/internals.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         && !(env->cp15.scr_el3 & SCR_ATA)) {
+         result->f.attrs.secure = false;
          return false;
      }
--    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-+    if (el < 2 && arm_is_el2_enabled(env)) {
+-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-         uint64_t hcr = arm_hcr_el2_eff(env);
+-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
+-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-             return false;
+-    }
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+-
-index XXXXXXX..XXXXXXX 100644
+     if (regime_is_stage2(mmu_idx)) {
---- a/target/arm/helper.c
+         result->cacheattrs.is_s2_format = true;
-+++ b/target/arm/helper.c
+         result->cacheattrs.attrs = extract32(attrs, 2, 4);
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
- {
+         assert(attrindx <= 7);
-     int el = arm_current_el(env);
+         result->cacheattrs.is_s2_format = false;
+         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
--    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
++
-+    if (el < 2 && arm_is_el2_enabled(env)) {
++        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
-         uint64_t hcr = arm_hcr_el2_eff(env);
++        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
++            result->f.guarded = extract64(attrs, 50, 1); /* GP */
-             return CP_ACCESS_TRAP_EL2;
++        }
      }
      /*
 --
-.25.1
+.34.1

-[PULL 2/6] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
+Deleted patch
-From: Idan Horowitz <idan.horowitz@gmail.com>
-As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
-PA space of the IPA is non secure, the output PA space is secure if and only
-if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                 } else {
-                     attrs->secure =
-                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
--                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
-+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
-                 }
-             }
-             return 0;
---
-.25.1

-[PULL 3/6] target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
+Deleted patch
-From: Idan Horowitz <idan.horowitz@gmail.com>
-As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
-initial PA space used for stage 2 table walks is assigned based on the SW
-and NSW bits of the VSTCR and VTCR registers.
-This was already implemented for the recursive stage 2 page table walks
-in S1_ptw_translate(), but was missing for the final stage 2 walk.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                 return ret;
-             }
-+            if (arm_is_secure_below_el3(env)) {
-+                if (attrs->secure) {
-+                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
-+                } else {
-+                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
-+                }
-+            } else {
-+                assert(!attrs->secure);
-+            }
-+
-             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
---
-.25.1

-[PULL 4/6] target/arm: Determine final stage 2 output PA space based on original IPA
+Deleted patch
-From: Idan Horowitz <idan.horowitz@gmail.com>
-As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
-decision as to the output address's PA space based on the SA/SW/NSA/NSW
-bits needs to take the input IPA's PA space into account, and not the
-PA space of the result of the stage 2 walk itself.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
-[PMM: fixed commit message typo]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 8 +++++---
-file changed, 5 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-             hwaddr ipa;
-             int s2_prot;
-             int ret;
-+            bool ipa_secure;
-             ARMCacheAttrs cacheattrs2 = {};
-             ARMMMUIdx s2_mmu_idx;
-             bool is_el0;
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                 return ret;
-             }
-+            ipa_secure = attrs->secure;
-             if (arm_is_secure_below_el3(env)) {
--                if (attrs->secure) {
-+                if (ipa_secure) {
-                     attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
-                 } else {
-                     attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
-                 }
-             } else {
--                assert(!attrs->secure);
-+                assert(!ipa_secure);
-             }
-             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-             /* Check if IPA translates to secure or non-secure PA space. */
-             if (arm_is_secure_below_el3(env)) {
--                if (attrs->secure) {
-+                if (ipa_secure) {
-                     attrs->secure =
-                         !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
-                 } else {
---
-.25.1

-[PULL 5/6] MAINTAINERS: change Fred Konrad's email address
+[PULL 2/2] target/arm: Copy guarded bit in combine_cacheattrs
-From: Frederic Konrad <konrad@adacore.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
+The guarded bit comes from the stage1 walk.
 -04-01.
-Use my personal email instead.
+Fixes: Coverity CID 1507929
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
+Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- .mailmap    | 3 ++-
+ target/arm/ptw.c | 1 +
- MAINTAINERS | 2 +-
+file changed, 1 insertion(+)
 files changed, 3 insertions(+), 2 deletions(-)
-diff --git a/.mailmap b/.mailmap
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/.mailmap
+--- a/target/arm/ptw.c
-+++ b/.mailmap
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
+@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
- Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
- Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
+     assert(!s1.is_s2_format);
- Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
+     ret.is_s2_format = false;
--Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
++    ret.guarded = s1.guarded;
-+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
-+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
+     if (s1.attrs == 0xf0) {
- Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
+         tagged = true;
  Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
  Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
  Leon3
  M: Fabien Chouteau <chouteau@adacore.com>
 -M: KONRAD Frederic <frederic.konrad@adacore.com>
 +M: Frederic Konrad <konrad.frederic@yahoo.fr>
  S: Maintained
  F: hw/sparc/leon3.c
  F: hw/*/grlib*
 --
-.25.1
+.34.1

-[PULL 6/6] target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
+Deleted patch
-In gen_store_exclusive(), if the host does not have a cmpxchg128
-primitive then we generate bad code for STXP for storing two 64-bit
-values.  We generate a call to the exit_atomic helper, which never
-returns, and set is_jmp to DISAS_NORETURN.  However, this is
-forgetting that we have already emitted a brcond that jumps over this
-call for the case where we don't hold the exclusive.  The effect is
-that we don't generate any code to end the TB for the
-exclusive-not-held execution path, which falls into the "exit with
-TB_EXIT_REQUESTED" code that gen_tb_end() emits.  This then causes an
-assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
-return that wasn't for an interrupt or icount.
-In particular, you can hit this case when using the clang sanitizers
-and trying to run the xlnx-versal-virt acceptance test in 'make
-check-acceptance'.  This bug was masked until commit 848126d11e93ff
-("meson: move int128 checks from configure") because we used to set
-CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
-do not.
-Fix the bug by not setting is_jmp.  The code after the exit_atomic
-call up to the fail_label is dead, but TCG is smart enough to
-eliminate it.  We do need to set 'tmp' to some valid value, though
-(in the same way the exit_atomic-using code in tcg/tcg-op.c does).
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
----
- target/arm/translate-a64.c | 7 ++++++-
-file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-         } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
-             if (!HAVE_CMPXCHG128) {
-                 gen_helper_exit_atomic(cpu_env);
--                s->base.is_jmp = DISAS_NORETURN;
-+                /*
-+                 * Produce a result so we have a well-formed opcode
-+                 * stream when the following (dead) code uses 'tmp'.
-+                 * TCG will remove the dead ops for us.
-+                 */
-+                tcg_gen_movi_i64(tmp, 0);
-             } else if (s->be_data == MO_LE) {
-                 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
-                                                         cpu_exclusive_addr,
---
-.25.1

Some small arm bug fixes for rc3.

-- PMM

The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:

Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401

for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Fix some bugs in secure EL2 handling
 * target/arm: Fix assert when !HAVE_CMPXCHG128
 * MAINTAINERS: change Fred Konrad's email address

----------------------------------------------------------------
Frederic Konrad (1):
      MAINTAINERS: change Fred Konrad's email address

Idan Horowitz (4):
      target/arm: Fix MTE access checks for disabled SEL2
      target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
      target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
      target/arm: Determine final stage 2 output PA space based on original IPA

Peter Maydell (1):
      target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen

From: Idan Horowitz <idan.horowitz@gmail.com>

While not mentioned anywhere in the actual specification text, the
HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
security state. This can be observed in the psuedo-code implementation
of AArch64.AllocationTagAccessIsEnabled().

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 2 +-
 target/arm/helper.c    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
         && !(env->cp15.scr_el3 & SCR_ATA)) {
         return false;
     }
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
             return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     int el = arm_current_el(env);
 
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
             return CP_ACCESS_TRAP_EL2;
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
PA space of the IPA is non secure, the output PA space is secure if and only
if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 } else {
                     attrs->secure =
                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
-                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
                 }
             }
             return 0;
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
initial PA space used for stage 2 table walks is assigned based on the SW
and NSW bits of the VSTCR and VTCR registers.
This was already implemented for the recursive stage 2 page table walks
in S1_ptw_translate(), but was missing for the final stage 2 walk.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            if (arm_is_secure_below_el3(env)) {
+                if (attrs->secure) {
+                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+                } else {
+                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+                }
+            } else {
+                assert(!attrs->secure);
+            }
+
             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
 
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
decision as to the output address's PA space based on the SA/SW/NSA/NSW
bits needs to take the input IPA's PA space into account, and not the
PA space of the result of the stage 2 walk itself.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
[PMM: fixed commit message typo]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s2_prot;
             int ret;
+            bool ipa_secure;
             ARMCacheAttrs cacheattrs2 = {};
             ARMMMUIdx s2_mmu_idx;
             bool is_el0;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            ipa_secure = attrs->secure;
             if (arm_is_secure_below_el3(env)) {
-                if (attrs->secure) {
+                if (ipa_secure) {
                     attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
                 } else {
                     attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
                 }
             } else {
-                assert(!attrs->secure);
+                assert(!ipa_secure);
             }
 
             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
             /* Check if IPA translates to secure or non-secure PA space. */
             if (arm_is_secure_below_el3(env)) {
-                if (attrs->secure) {
+                if (ipa_secure) {
                     attrs->secure =
                         !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
                 } else {
-- 
2.25.1

From: Frederic Konrad <konrad@adacore.com>

frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
2022-04-01.

Use my personal email instead.

Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 .mailmap    | 3 ++-
 MAINTAINERS | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index XXXXXXX..XXXXXXX 100644
--- a/.mailmap
+++ b/.mailmap
@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
 Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
 Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
-Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
 Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
 
 Leon3
 M: Fabien Chouteau <chouteau@adacore.com>
-M: KONRAD Frederic <frederic.konrad@adacore.com>
+M: Frederic Konrad <konrad.frederic@yahoo.fr>
 S: Maintained
 F: hw/sparc/leon3.c
 F: hw/*/grlib*
-- 
2.25.1

In gen_store_exclusive(), if the host does not have a cmpxchg128
primitive then we generate bad code for STXP for storing two 64-bit
values.  We generate a call to the exit_atomic helper, which never
returns, and set is_jmp to DISAS_NORETURN.  However, this is
forgetting that we have already emitted a brcond that jumps over this
call for the case where we don't hold the exclusive.  The effect is
that we don't generate any code to end the TB for the
exclusive-not-held execution path, which falls into the "exit with
TB_EXIT_REQUESTED" code that gen_tb_end() emits.  This then causes an
assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
return that wasn't for an interrupt or icount.

In particular, you can hit this case when using the clang sanitizers
and trying to run the xlnx-versal-virt acceptance test in 'make
check-acceptance'.  This bug was masked until commit 848126d11e93ff
("meson: move int128 checks from configure") because we used to set
CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
do not.

Fix the bug by not setting is_jmp.  The code after the exit_atomic
call up to the fail_label is dead, but TCG is smart enough to
eliminate it.  We do need to set 'tmp' to some valid value, though
(in the same way the exit_atomic-using code in tcg/tcg-op.c does).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
---
 target/arm/translate-a64.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
         } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
             if (!HAVE_CMPXCHG128) {
                 gen_helper_exit_atomic(cpu_env);
-                s->base.is_jmp = DISAS_NORETURN;
+                /*
+                 * Produce a result so we have a well-formed opcode
+                 * stream when the following (dead) code uses 'tmp'.
+                 * TCG will remove the dead ops for us.
+                 */
+                tcg_gen_movi_i64(tmp, 0);
             } else if (s->be_data == MO_LE) {
                 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
                                                         cpu_exclusive_addr,
-- 
2.25.1

This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
we were using uninitialized data for the guarded bit when
combining stage 1 and stage 2 attrs.

thanks
-- PMM

The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:

Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410

for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:

target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)

----------------------------------------------------------------
target-arm: Fix bug where we weren't initializing
            guarded bit state when combining S1/S2 attrs

----------------------------------------------------------------
Richard Henderson (2):
      target/arm: PTE bit GP only applies to stage1
      target/arm: Copy guarded bit in combine_cacheattrs

target/arm/ptw.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Only perform the extract of GP during the stage1 walk.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.attrs.secure = false;
     }
 
-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-    }
-
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
+
+        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
+        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
+            result->f.guarded = extract64(attrs, 50, 1); /* GP */
+        }
     }
 
     /*
-- 
2.34.1