For v2, drop the PAGE_EXEC patch that appeared to cause

problems during Peter's testing.

The following changes since commit f34edbc760b0f689deddd175fc08732ecb46665f:

Merge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2019-07-08-1' into staging (2019-07-08 17:40:05 +0100)

https://github.com/rth7680/qemu.git tags/pull-tcg-20190709

for you to fetch changes up to 11978f6f58f1d3d66429f7ff897524f693d823ce:

tcg: Fix expansion of INDEX_op_not_vec (2019-07-09 08:26:11 +0200)

Minor gvec fix for as-yet uncommitted altivec host.

Build fix for riscv host.

Alistair Francis (1):

tcg/riscv: Fix RISC-VH host build failure

Richard Henderson (1):

tcg: Fix expansion of INDEX_op_not_vec

tcg/riscv/tcg-target.inc.c | 4 ++--

tcg/tcg-op-vec.c | 6 ++++++

2 files changed, 8 insertions(+), 2 deletions(-)

Check page flags before letting an invalid pc cause a SIGSEGV.

Prepare for eventially validating PROT_EXEC. The current wrinkle being

that we have a problem with our implementation of signals. We should

be using a vdso like the kernel, but we instead put the trampoline on

the stack. In the meantime, let PROT_READ match PROT_EXEC.

Fixes: https://bugs.launchpad.net/qemu/+bug/1832353

include/exec/cpu-all.h | 1 +

include/exec/cpu_ldst_useronly_template.h | 8 +++++--

accel/tcg/translate-all.c | 29 +++++++++++++++++++++++

3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h

--- a/include/exec/cpu-all.h

+++ b/include/exec/cpu-all.h

@@ -XXX,XX +XXX,XX @@ int walk_memory_regions(void *, walk_memory_regions_fn);

int page_get_flags(target_ulong address);

void page_set_flags(target_ulong start, target_ulong end, int flags);

int page_check_range(target_ulong start, target_ulong len, int flags);

+void validate_exec_access(CPUArchState *env, target_ulong s, target_ulong l);

#endif

CPUArchState *cpu_copy(CPUArchState *env);

diff --git a/include/exec/cpu_ldst_useronly_template.h b/include/exec/cpu_ldst_useronly_template.h

index XXXXXXX..XXXXXXX 100644

--- a/include/exec/cpu_ldst_useronly_template.h

+++ b/include/exec/cpu_ldst_useronly_template.h

@@ -XXX,XX +XXX,XX @@

static inline RES_TYPE

glue(glue(cpu_ld, USUFFIX), MEMSUFFIX)(CPUArchState *env, abi_ptr ptr)

{

-#if !defined(CODE_ACCESS)

+#ifdef CODE_ACCESS

+ validate_exec_access(env, ptr, DATA_SIZE);

+#else

trace_guest_mem_before_exec(

env_cpu(env), ptr,

trace_mem_build_info(SHIFT, false, MO_TE, false));

@@ -XXX,XX +XXX,XX @@ glue(glue(glue(cpu_ld, USUFFIX), MEMSUFFIX), _ra)(CPUArchState *env,

static inline int

glue(glue(cpu_lds, SUFFIX), MEMSUFFIX)(CPUArchState *env, abi_ptr ptr)

{

-#if !defined(CODE_ACCESS)

+#ifdef CODE_ACCESS

+ validate_exec_access(env, ptr, DATA_SIZE);

+#else

trace_guest_mem_before_exec(

env_cpu(env), ptr,

trace_mem_build_info(SHIFT, true, MO_TE, false));

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c

index XXXXXXX..XXXXXXX 100644

--- a/accel/tcg/translate-all.c

+++ b/accel/tcg/translate-all.c

@@ -XXX,XX +XXX,XX @@ int page_check_range(target_ulong start, target_ulong len, int flags)

}

}

}

+ /*

+ * FIXME: We place the signal trampoline on the stack,

+ * even when the guest expects that to be in the vdso.

+ * Until we fix that, allow execute on any readable page.

+ */

+ if ((flags & PAGE_EXEC) && !(p->flags & (PAGE_EXEC | PAGE_READ))) {

+ return -1;

+ }

}

return 0;

}

+/*

+ * Called for each code read, longjmp out to issue SIGSEGV if the page(s)

+ * do not have execute access.

+ */

+void validate_exec_access(CPUArchState *env,

+ target_ulong ptr, target_ulong len)

+ if (page_check_range(ptr, len, PAGE_EXEC) < 0) {

+ CPUState *cs = env_cpu(env);

+ CPUClass *cc = CPU_GET_CLASS(cs);

+

+ /* Like tb_gen_code, release the memory lock before cpu_loop_exit. */

+ assert_memory_lock();

+ mmap_unlock();

+

+ /* This is user-only. The target must raise an exception. */

+ cc->tlb_fill(cs, ptr, 0, MMU_INST_FETCH, MMU_USER_IDX, false, 0);

+ g_assert_not_reached();

+ }

/* called from signal handler: invalidate the code and unprotect the

* page. Return 0 if the fault was not handled, 1 if it was handled,

* and 2 if it was handled but the caller must cause the TB to be

2.17.1

From: Alistair Francis <alistair.francis@wdc.com>

Commit 269bd5d8 "cpu: Move the softmmu tlb to CPUNegativeOffsetState'

broke the RISC-V host build as there are two variables that are used but

not defined.

This patch renames the undefined variables mask_off and table_off to the

existing (but unused) mask_ofs and table_ofs variables.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Message-Id: <79729cc88ca509e08b5c4aa0aa8a52847af70c0f.1561039316.git.alistair.francis@wdc.com>

tcg/riscv/tcg-target.inc.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c

--- a/tcg/riscv/tcg-target.inc.c

+++ b/tcg/riscv/tcg-target.inc.c

@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,

int table_ofs = fast_ofs + offsetof(CPUTLBDescFast, table);

TCGReg mask_base = TCG_AREG0, table_base = TCG_AREG0;

- tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP0, mask_base, mask_off);

- tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP1, table_base, table_off);

+ tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP0, mask_base, mask_ofs);

+ tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP1, table_base, table_ofs);

tcg_out_opc_imm(s, OPC_SRLI, TCG_REG_TMP2, addrl,

TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);

2.17.1

This operation can always be emitted, even if we need to

fall back to xor. Adjust the assertions to match.

tcg/tcg-op-vec.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c

--- a/tcg/tcg-op-vec.c

+++ b/tcg/tcg-op-vec.c

@@ -XXX,XX +XXX,XX @@ bool tcg_can_emit_vecop_list(const TCGOpcode *list,

case INDEX_op_bitsel_vec:

/* These opcodes are mandatory and should not be listed. */

g_assert_not_reached();

+ case INDEX_op_not_vec:

+ /* These opcodes have generic expansions using the above. */

+ g_assert_not_reached();

default:

break;

}

@@ -XXX,XX +XXX,XX @@ static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)

void tcg_gen_not_vec(unsigned vece, TCGv_vec r, TCGv_vec a)

{

+ const TCGOpcode *hold_list = tcg_swap_vecop_list(NULL);

+

if (!TCG_TARGET_HAS_not_vec || !do_op2(vece, r, a, INDEX_op_not_vec)) {

TCGv_vec t = tcg_const_ones_vec_matching(r);

tcg_gen_xor_vec(0, r, a, t);

tcg_temp_free_vec(t);

}

+ tcg_swap_vecop_list(hold_list);

}

void tcg_gen_neg_vec(unsigned vece, TCGv_vec r, TCGv_vec a)

2.17.1

This operation can always be emitted, even if we need to

fall back to xor. Adjust the assertions to match.

tcg/tcg-op-vec.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c

--- a/tcg/tcg-op-vec.c

+++ b/tcg/tcg-op-vec.c

@@ -XXX,XX +XXX,XX @@ bool tcg_can_emit_vecop_list(const TCGOpcode *list,

case INDEX_op_bitsel_vec:

/* These opcodes are mandatory and should not be listed. */

g_assert_not_reached();

+ case INDEX_op_not_vec:

+ /* These opcodes have generic expansions using the above. */

+ g_assert_not_reached();

default:

break;

}

@@ -XXX,XX +XXX,XX @@ static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)

void tcg_gen_not_vec(unsigned vece, TCGv_vec r, TCGv_vec a)

{

+ const TCGOpcode *hold_list = tcg_swap_vecop_list(NULL);

+

if (!TCG_TARGET_HAS_not_vec || !do_op2(vece, r, a, INDEX_op_not_vec)) {

TCGv_vec t = tcg_const_ones_vec_matching(r);

tcg_gen_xor_vec(0, r, a, t);

tcg_temp_free_vec(t);

+ tcg_swap_vecop_list(hold_list);

2.17.1