The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:

Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)

https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901

for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:

target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)

Respect PROT_EXEC in user-only mode.

Fix s390x, i386 and riscv for translations crossing a page.

Ilya Leoshkevich (4):

linux-user: Clear translations on mprotect()

accel/tcg: Introduce is_same_page()

target/s390x: Make translator stop before the end of a page

target/i386: Make translator stop before the end of a page

linux-user/arm: Mark the commpage executable

linux-user/hppa: Allocate page zero as a commpage

linux-user/x86_64: Allocate vsyscall page as a commpage

linux-user: Honor PT_GNU_STACK

tests/tcg/i386: Move smc_code2 to an executable section

accel/tcg: Properly implement get_page_addr_code for user-only

accel/tcg: Unlock mmap_lock after longjmp

accel/tcg: Make tb_htable_lookup static

accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c

accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp

accel/tcg: Document the faulting lookup in tb_lookup_cmp

accel/tcg: Remove translator_ldsw

accel/tcg: Add pc and host_pc params to gen_intermediate_code

accel/tcg: Add fast path for translator_ld*

target/riscv: Add MAX_INSN_LEN and insn_len

target/riscv: Make translator stop before the end of a page

include/elf.h | 1 +

include/exec/cpu-common.h | 1 +

include/exec/exec-all.h | 89 ++++++++----------------

include/exec/translator.h | 96 ++++++++++++++++---------

linux-user/arm/target_cpu.h | 4 +-

linux-user/qemu.h | 1 +

accel/tcg/cpu-exec.c | 143 ++++++++++++++++++++------------------

accel/tcg/cputlb.c | 93 +++++++------------------

accel/tcg/translate-all.c | 29 ++++----

accel/tcg/translator.c | 135 ++++++++++++++++++++++++++---------

accel/tcg/user-exec.c | 17 ++++-

linux-user/elfload.c | 82 ++++++++++++++++++++--

linux-user/mmap.c | 6 +-

softmmu/physmem.c | 12 ++++

target/alpha/translate.c | 5 +-

target/arm/translate.c | 5 +-

target/avr/translate.c | 5 +-

target/cris/translate.c | 5 +-

target/hexagon/translate.c | 6 +-

target/hppa/translate.c | 5 +-

target/i386/tcg/translate.c | 71 +++++++++++--------

target/loongarch/translate.c | 6 +-

target/m68k/translate.c | 5 +-

target/microblaze/translate.c | 5 +-

target/mips/tcg/translate.c | 5 +-

target/nios2/translate.c | 5 +-

target/openrisc/translate.c | 6 +-

target/ppc/translate.c | 5 +-

target/riscv/translate.c | 32 +++++++--

target/rx/translate.c | 5 +-

target/s390x/tcg/translate.c | 20 ++++--

target/sh4/translate.c | 5 +-

target/sparc/translate.c | 5 +-

target/tricore/translate.c | 6 +-

target/xtensa/translate.c | 6 +-

tests/tcg/i386/test-i386.c | 2 +-

tests/tcg/riscv64/noexec.c | 79 +++++++++++++++++++++

tests/tcg/s390x/noexec.c | 106 ++++++++++++++++++++++++++++

tests/tcg/x86_64/noexec.c | 75 ++++++++++++++++++++

tests/tcg/multiarch/noexec.c.inc | 139 ++++++++++++++++++++++++++++++++++++

tests/tcg/riscv64/Makefile.target | 1 +

tests/tcg/s390x/Makefile.target | 1 +

tests/tcg/x86_64/Makefile.target | 3 +-

43 files changed, 966 insertions(+), 367 deletions(-)

create mode 100644 tests/tcg/riscv64/noexec.c

create mode 100644 tests/tcg/s390x/noexec.c

create mode 100644 tests/tcg/x86_64/noexec.c

create mode 100644 tests/tcg/multiarch/noexec.c.inc

From: Ilya Leoshkevich <iii@linux.ibm.com>

Introduce a function that checks whether a given address is on the same

page as where disassembly started. Having it improves readability of

the following patches.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>

Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>

[rth: Make the DisasContextBase parameter const.]

include/exec/translator.h | 10 ++++++++++

1 file changed, 10 insertions(+)

diff --git a/include/exec/translator.h b/include/exec/translator.h

--- a/include/exec/translator.h

+++ b/include/exec/translator.h

@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)

#undef GEN_TRANSLATOR_LD

+ * Return whether addr is on the same page as where disassembly started.

+ * Translators can use this to enforce the rule that only single-insn

+ * translation blocks are allowed to cross page boundaries.

+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)

+{

+ return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;

+}

+

#endif /* EXEC__TRANSLATOR_H */

From: Ilya Leoshkevich <iii@linux.ibm.com>

Currently it's possible to execute pages that do not have PAGE_EXEC

if there is an existing translation block. Fix by invalidating TBs

that touch the affected pages.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>

Message-Id: <20220817150506.592862-2-iii@linux.ibm.com>

linux-user/mmap.c | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c

--- a/linux-user/mmap.c

+++ b/linux-user/mmap.c

@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)

goto error;

}

The base qemu_ram_addr_from_host function is already in

softmmu/physmem.c; move the nofail version to be adjacent.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

include/exec/cpu-common.h | 1 +

accel/tcg/cputlb.c | 12 ------------

softmmu/physmem.c | 12 ++++++++++++

3 files changed, 13 insertions(+), 12 deletions(-)

prot, mmu_idx, size);

-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)

-{

- ram_addr_t ram_addr;

- ram_addr = qemu_ram_addr_from_host(ptr);

- if (ram_addr == RAM_ADDR_INVALID) {

- error_report("Bad ram pointer %p", ptr);

- abort();

- }

- return ram_addr;

-}

-

/*

* Note: tlb_fill() can trigger a resize of the TLB. This means that all of the

* caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must

diff --git a/softmmu/physmem.c b/softmmu/physmem.c

index XXXXXXX..XXXXXXX 100644

--- a/softmmu/physmem.c

+++ b/softmmu/physmem.c

@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)

return block->offset + offset;

+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)

+{

+ ram_addr_t ram_addr;

+

+ ram_addr = qemu_ram_addr_from_host(ptr);

+ if (ram_addr == RAM_ADDR_INVALID) {

+ error_report("Bad ram pointer %p", ptr);

+ abort();

+ }

+ return ram_addr;

+}

+

static MemTxResult flatview_read(FlatView *fv, hwaddr addr,

MemTxAttrs attrs, void *buf, hwaddr len);

static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,

Map the stack executable if required by default or on demand.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

include/elf.h | 1 +

linux-user/qemu.h | 1 +

linux-user/elfload.c | 19 ++++++++++++++++++-

3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/elf.h b/include/elf.h

--- a/include/elf.h

+++ b/include/elf.h

@@ -XXX,XX +XXX,XX @@ typedef int64_t Elf64_Sxword;

#define PT_LOPROC 0x70000000

#define PT_HIPROC 0x7fffffff

+#define PT_GNU_STACK (PT_LOOS + 0x474e551)

#define PT_GNU_PROPERTY (PT_LOOS + 0x474e553)

#define PT_MIPS_REGINFO 0x70000000

diff --git a/linux-user/qemu.h b/linux-user/qemu.h

--- a/linux-user/qemu.h

+++ b/linux-user/qemu.h

@@ -XXX,XX +XXX,XX @@ struct image_info {

uint32_t elf_flags;

int personality;

abi_ulong alignment;

+ bool exec_stack;

/* Generic semihosting knows about these pointers. */

abi_ulong arg_strings; /* strings for argv */

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)

#define ELF_ARCH EM_386

#define ELF_PLATFORM get_elf_platform()

+#define EXSTACK_DEFAULT true

static const char *get_elf_platform(void)

{

@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en

#define ELF_ARCH EM_ARM

#define ELF_CLASS ELFCLASS32

+#define EXSTACK_DEFAULT true

static inline void init_thread(struct target_pt_regs *regs,

struct image_info *infop)

@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,

#define ELF_CLASS ELFCLASS32

+#define EXSTACK_DEFAULT true

@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en

#define ELF_CLASS ELFCLASS64

#define ELF_ARCH EM_LOONGARCH

+#define EXSTACK_DEFAULT true

#define elf_check_arch(x) ((x) == EM_LOONGARCH)

@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)

#define ELF_CLASS ELFCLASS32

#define ELF_ARCH EM_MIPS

+#define EXSTACK_DEFAULT true

#ifdef TARGET_ABI_MIPSN32

#define elf_check_abi(x) ((x) & EF_MIPS_ABI2)

@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,

#define bswaptls(ptr) bswap32s(ptr)

#endif

+#ifndef EXSTACK_DEFAULT

+#define EXSTACK_DEFAULT false

+#endif

+

#include "elf.h"

/* We must delay the following stanzas until after "elf.h". */

@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,

struct image_info *info)

{

abi_ulong size, error, guard;

+ int prot;

size = guest_stack_size;

if (size < STACK_LOWER_LIMIT) {

@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,

guard = qemu_real_host_page_size();

}

- error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,

+ prot = PROT_READ | PROT_WRITE;

+ if (info->exec_stack) {

+ prot |= PROT_EXEC;

+ }

+ error = target_mmap(0, size + guard, prot,

MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

if (error == -1) {

perror("mmap stack");

@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,

*/

loaddr = -1, hiaddr = 0;

info->alignment = 0;

+ info->exec_stack = EXSTACK_DEFAULT;

for (i = 0; i < ehdr->e_phnum; ++i) {

struct elf_phdr *eppnt = phdr + i;

if (eppnt->p_type == PT_LOAD) {

@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,

if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {

goto exit_errmsg;

}

+ } else if (eppnt->p_type == PT_GNU_STACK) {

+ info->exec_stack = eppnt->p_flags & PF_X;

}

}

This bit is not saved across interrupts, so we must

delay delivering the interrupt until the skip has

been processed.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118

Reviewed-by: Michael Rolnik <mrolnik@gmail.com>

target/avr/helper.c | 9 +++++++++

target/avr/translate.c | 26 ++++++++++++++++++++++----

2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c

--- a/target/avr/helper.c

+++ b/target/avr/helper.c

@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

AVRCPU *cpu = AVR_CPU(cs);

CPUAVRState *env = &cpu->env;

+ /*

+ * We cannot separate a skip from the next instruction,

+ * as the skip would not be preserved across the interrupt.

+ * Separating the two insn normally only happens at page boundaries.

+ */

+ if (env->skip) {

+ return false;

+ }

+

if (interrupt_request & CPU_INTERRUPT_RESET) {

if (cpu_interrupts_enabled(env)) {

cs->exception_index = EXCP_RESET;

diff --git a/target/avr/translate.c b/target/avr/translate.c

--- a/target/avr/translate.c

+++ b/target/avr/translate.c

@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)

if (skip_label) {

canonicalize_skip(ctx);

gen_set_label(skip_label);

- if (ctx->base.is_jmp == DISAS_NORETURN) {

+

+ switch (ctx->base.is_jmp) {

+ case DISAS_NORETURN:

ctx->base.is_jmp = DISAS_CHAIN;

+ break;

+ case DISAS_NEXT:

+ if (ctx->base.tb->flags & TB_FLAGS_SKIP) {

+ ctx->base.is_jmp = DISAS_TOO_MANY;

+ }

+ break;

+ default:

+ break;

}

}

@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

DisasContext *ctx = container_of(dcbase, DisasContext, base);

bool nonconst_skip = canonicalize_skip(ctx);

+ /*

+ * Because we disable interrupts while env->skip is set,

+ * we must return to the main loop to re-evaluate afterward.

+ */

+ bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;

switch (ctx->base.is_jmp) {

case DISAS_NORETURN:

@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

case DISAS_NEXT:

case DISAS_TOO_MANY:

case DISAS_CHAIN:

- if (!nonconst_skip) {

+ if (!nonconst_skip && !force_exit) {

/* Note gen_goto_tb checks singlestep. */

gen_goto_tb(ctx, 1, ctx->npc);

break;

@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

tcg_gen_movi_tl(cpu_pc, ctx->npc);

/* fall through */

case DISAS_LOOKUP:

- tcg_gen_lookup_and_goto_ptr();

- break;

+ if (!force_exit) {

+ tcg_gen_lookup_and_goto_ptr();

+ break;

+ }

+ /* fall through */

case DISAS_EXIT:

tcg_gen_exit_tb(NULL, 0);

break;

Right now the translator stops right *after* the end of a page, which

breaks reporting of fault locations when the last instruction of a

multi-insn translation block crosses a page boundary.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

target/riscv/translate.c | 17 +++++--

tests/tcg/riscv64/noexec.c | 79 +++++++++++++++++++++++++++++++

tests/tcg/riscv64/Makefile.target | 1 +

3 files changed, 93 insertions(+), 4 deletions(-)

create mode 100644 tests/tcg/riscv64/noexec.c

diff --git a/target/riscv/translate.c b/target/riscv/translate.c

--- a/target/riscv/translate.c

+++ b/target/riscv/translate.c

@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

ctx->nftemp = 0;

+ /* Only the first insn within a TB is allowed to cross a page boundary. */

if (ctx->base.is_jmp == DISAS_NEXT) {

- target_ulong page_start;

-

- page_start = ctx->base.pc_first & TARGET_PAGE_MASK;

- if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {

+ if (!is_same_page(&ctx->base, ctx->base.pc_next)) {

ctx->base.is_jmp = DISAS_TOO_MANY;

+ } else {

+ unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;

+ if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {

+ uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);

+ int len = insn_len(next_insn);

+

+ if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {

+ ctx->base.is_jmp = DISAS_TOO_MANY;

+ }

+ }

}

diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/tcg/riscv64/noexec.c

@@ -XXX,XX +XXX,XX @@

+#include "../multiarch/noexec.c.inc"

+

+static void *arch_mcontext_pc(const mcontext_t *ctx)

+{

+ return (void *)ctx->__gregs[REG_PC];

+}

+

+static int arch_mcontext_arg(const mcontext_t *ctx)

+{

+ return ctx->__gregs[REG_A0];

+}

+

+static void arch_flush(void *p, int len)

+{

+ __builtin___clear_cache(p, p + len);

+}

+

+extern char noexec_1[];

+extern char noexec_2[];

+extern char noexec_end[];

+

+asm(".option push\n"

+ ".option norvc\n"

+ "noexec_1:\n"

+ " li a0,1\n" /* a0 is 0 on entry, set 1. */

+ "noexec_2:\n"

+ " li a0,2\n" /* a0 is 0/1; set 2. */

+ " ret\n"

+ "noexec_end:\n"

+ ".option pop");

+

+int main(void)

+{

+ struct noexec_test noexec_tests[] = {

+ {

+ .name = "fallthrough",

+ .test_code = noexec_1,

+ .test_len = noexec_end - noexec_1,

+ .page_ofs = noexec_1 - noexec_2,

+ .entry_ofs = noexec_1 - noexec_2,

+ .expected_si_ofs = 0,

+ .expected_pc_ofs = 0,

+ .expected_arg = 1,

+ },

+ {

+ .name = "jump",

+ .test_code = noexec_1,

+ .test_len = noexec_end - noexec_1,

+ .page_ofs = noexec_1 - noexec_2,

+ .entry_ofs = 0,

+ .expected_si_ofs = 0,

+ .expected_pc_ofs = 0,

+ .expected_arg = 0,

+ },

+ {

+ .name = "fallthrough [cross]",

+ .test_code = noexec_1,

+ .test_len = noexec_end - noexec_1,

+ .page_ofs = noexec_1 - noexec_2 - 2,

+ .entry_ofs = noexec_1 - noexec_2 - 2,

+ .expected_si_ofs = 0,

+ .expected_pc_ofs = -2,

+ .expected_arg = 1,

+ },

+ {

+ .name = "jump [cross]",

+ .test_code = noexec_1,

+ .test_len = noexec_end - noexec_1,

+ .page_ofs = noexec_1 - noexec_2 - 2,

+ .entry_ofs = -2,

+ .expected_si_ofs = 0,

+ .expected_pc_ofs = -2,

+ .expected_arg = 0,

+ },

+ };

+

+ return test_noexec(noexec_tests,

+ sizeof(noexec_tests) / sizeof(noexec_tests[0]));

+}

diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target

--- a/tests/tcg/riscv64/Makefile.target

+++ b/tests/tcg/riscv64/Makefile.target

@@ -XXX,XX +XXX,XX @@

VPATH += $(SRC_PATH)/tests/tcg/riscv64

TESTS += test-div

+TESTS += noexec

The current implementation is a no-op, simply returning addr.

This is incorrect, because we ought to be checking the page

permissions for execution.

Make get_page_addr_code inline for both implementations.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>

Acked-by: Alistair Francis <alistair.francis@wdc.com>

include/exec/exec-all.h | 85 ++++++++++++++---------------------------

accel/tcg/cputlb.c | 5 ---

accel/tcg/user-exec.c | 14 +++++++

3 files changed, 42 insertions(+), 62 deletions(-)

@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,

hwaddr index, MemTxAttrs attrs);

#endif

-#if defined(CONFIG_USER_ONLY)

-void mmap_lock(void);

-void mmap_unlock(void);

-bool have_mmap_lock(void);

-

/**

- * get_page_addr_code() - user-mode version

+ * get_page_addr_code_hostp()

* @env: CPUArchState

* @addr: guest virtual address of guest code

*

- * Returns @addr.

+ * See get_page_addr_code() (full-system version) for documentation on the

+ * return value.

+ * Sets *@hostp (when @hostp is non-NULL) as follows.

+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp

+ * to the host address where @addr's content is kept.

+ *

+ * Note: this function can trigger an exception.

+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,

+ void **hostp);

+/**

+ * get_page_addr_code()

+ * @env: CPUArchState

+ * @addr: guest virtual address of guest code

+ *

+ * If we cannot translate and execute from the entire RAM page, or if

+ * the region is not backed by RAM, returns -1. Otherwise, returns the

+ * ram_addr_t corresponding to the guest code at @addr.

+ *

+ * Note: this function can trigger an exception.

*/

static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,

target_ulong addr)

{

- return addr;