From patchwork Sat Mar 15 07:42:07 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873852 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080416wrq; Sat, 15 Mar 2025 00:44:18 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUYoZeEaHf3CatgVZL86eFPMKj0a1X3lN46oY5qpju0DBnxjfuU9JF7ZplHqKhMYwpFewXs4A==@linaro.org X-Google-Smtp-Source: AGHT+IHRGeKVgprg6iZEhdG9YjvCU98jWdMQV7LYS9zRMtMNpbM0Kdlprc8+D8Gdx2EFT8TryOMO X-Received: by 2002:a05:620a:1996:b0:7c5:3b3b:c9d8 with SMTP id af79cd13be357-7c57c8c0344mr771547585a.45.1742024657814; Sat, 15 Mar 2025 00:44:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024657; cv=none; d=google.com; s=arc-20240605; b=HPTFLZoxaKDSe1yBs2b5qdh+RBhjx0keLnWCoWygAadrNQEF3mwlsuuh6Nu9lVKGYq houFue6bQcHAI/NJH5iGYnxNkkOl7q0xOP8x6HIV+bnO0U37Gw71eJgVlDECLXY/yZge gWTOEvJ0N9VfVVhzE9ztKZpOUMA8VmzQp1/56ux/aICgUtznIBheKRsz0sCi6D/jjlyz bTcY8fbOui78Y2nG2sJJJAty/HsGdj8c/42WJuq8hrVpfKUz4LtZnXXEzdWB4Ya5iJaB 6HiNkMwmU1PXBAJxV1dZwpV/Uc2VoiD27DYEKygEutg5mKdfPmm6zhD+M3qtdJVUvOK6 oqGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=SBBJHKlyWUZGR2ogDkvIQPGBHWn7hWdTIUUIEfJIkr8=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=LHCfXUsIE6EYqpwY7CqanHPXsGwAVEHxnUVduhzgv5LEhV/w8IFqRGqmMtcJk3O3oW JQr9qodtsDIDQdSfu6F1ZPjVuCQsRn2BwHLXrNR7olgipxFcd9ZOYEvO1NtwVXycE5oW d4tCpB7430l9TqRCpyE4YEDIQwnW8JhOabDRXSSF3ZwdqKp+2ajldAX4RSLA/FdK0FWB xyXeGEmn/6ZPOwU4D+14bmhOY2Hfu0pfqIZW3/izPH1/tdlffJjbGwhdtAQjBCGO8RMT hI5C3sHTxJXTKf8/ESn8V9zvMN6I8Flve110l710X4bUAAPGFQWkL9dL3TOJ3FkNSEa+ oFLQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b72f8esi588645685a.114.2025.03.15.00.44.17 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:44:17 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMAm-0001yO-5T; Sat, 15 Mar 2025 03:43:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAi-0001ws-Cf; Sat, 15 Mar 2025 03:43:04 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAg-0004mD-JJ; Sat, 15 Mar 2025 03:43:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 92CB3FFAF9; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 816AB1CACC3; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 649B1559DE; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-8.2.10 05/42] hw/net/smc91c111: Ignore attempt to pop from empty RX fifo Date: Sat, 15 Mar 2025 10:42:07 +0300 Message-Id: <20250315074249.634718-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The SMC91C111 includes an MMU Command register which permits the guest to remove entries from the RX FIFO. The datasheet does not specify what happens if the guest tries to do this when the FIFO is already empty; there are no status registers containing error bits which might be applicable. Currently we don't guard at all against pop of an empty RX FIFO, with the result that we allow the guest to drive the rx_fifo_len index to negative values, which will cause smc91c111_receive() to write to the rx_fifo[] array out of bounds when we receive the next packet. Instead ignore attempts to pop an empty RX FIFO. Cc: qemu-stable@nongnu.org Fixes: 80337b66a8e7 ("NIC emulation for qemu arm-softmmu") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2780 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250207151157.3151776-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 937df81af6757638a7f1908747560dd342947213) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 876a78456a..dcf6e5117f 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -183,6 +183,15 @@ static void smc91c111_pop_rx_fifo(smc91c111_state *s) { int i; + if (s->rx_fifo_len == 0) { + /* + * The datasheet doesn't document what the behaviour is if the + * guest tries to pop an empty RX FIFO, and there's no obvious + * error status register to report it. Just ignore the attempt. + */ + return; + } + s->rx_fifo_len--; if (s->rx_fifo_len) { for (i = 0; i < s->rx_fifo_len; i++) From patchwork Sat Mar 15 07:42:09 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873849 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080229wrq; Sat, 15 Mar 2025 00:43:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWp7vEWIRKx6ExTaUROYGjoOBdRtlPMmDUdSWatvvIpuJC/Z91j/9Q56fM9OnVb1GIl8ZiE7g==@linaro.org X-Google-Smtp-Source: AGHT+IHgxxPEM9FIxhZYK8M9/rZEJQE9VI2p2AC9WiHKQNY5dcv8oN8FL3a0lN7iaODkxuUKXKK/ X-Received: by 2002:ad4:5d46:0:b0:6e8:fe60:fded with SMTP id 6a1803df08f44-6eaeaaeac6amr89110686d6.30.1742024613086; Sat, 15 Mar 2025 00:43:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024613; cv=none; d=google.com; s=arc-20240605; b=c5k5X4fK92omCk3znPQm5P6zKEBiLPjZ/Ku2T7JcyFlWm95utMEiNlKGzc3kGJTlvX KIZyx7PKu+G/K1+r0Runr/Jj+0WW+nTS+dohzuB5cRmTYu18cusi0v1G94I1dxqCYMoi msQdaiRz/oPHj3VJVBFeoRGhYiAQyAZP0KvhEkygj+C05Eu6AGQkYDfYRg/+qT11l6ZN bFrHAAZ2lUdotHzC0D7nr0yqSKl+YgnQE2cNLAOzMU8O4he5WlvGroe36Q1kDBoMug9O r0WqjMbRVI8zaez0FU+TUCWJh0Cv8QbAffQ1wRZQiSsFrMr5N6M0NKsIvzwoHJTZhwh5 bc6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=MfO7qcqJfixa0mAFGNekWqKkSLnf+J+ZmUo+rGFB1NE=; fh=bMaafE1clBtiBaCrlbrbcY1DSEPhhFUklUk4XoVHiPU=; b=ZN6My9mb+0yVCyRDjNSbKP4+kUxRyOjWzSrKkt7HGcX4WCQ0Z1gLiyaOMkXYBhzJZK 37gFmuzhBSk8YI46q+bFYR6bsi6sw2VaOdfCba1u4PCam5mcl17pX1MDupgufmVPWZ6S S8TGdV35H3cZTUhQz5UjFi0thtvvmycIHM0oEB52+W3DQZeijask8yzxipUgGQV6SFbO hmFGbYliTA4FfMozNxo5SaiyxjriUEva/yuCm+lNBBBuOn30glfAuKEqD6XFKU9nrzvc /2VWOpzbqId3zoRu39mg+GrPP2QNWunKuWgEJV12ZxlmN8n4P2WDqpSSSnf74k8LB1fK Z86A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade3579dcsi22905246d6.270.2025.03.15.00.43.32 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:43:33 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMAo-00022b-9r; Sat, 15 Mar 2025 03:43:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAl-0001zA-Sa; Sat, 15 Mar 2025 03:43:08 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAj-0004nC-PM; Sat, 15 Mar 2025 03:43:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9A9DEFFAFB; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 895E31CACC5; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 6930F559E2; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 07/42] linux-user: Honor elf alignment when placing images Date: Sat, 15 Mar 2025 10:42:09 +0300 Message-Id: <20250315074249.634718-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Most binaries don't actually depend on more than page alignment, but any binary can request it. Not honoring this was a bug. This became obvious when gdb reported Failed to read a valid object file image from memory when examining some vdso which are marked as needing more than page alignment. Signed-off-by: Richard Henderson (cherry picked from commit c81d1fafa6233448bcc2d8fcd2ba63a4ae834f3a) Signed-off-by: Michael Tokarev diff --git a/linux-user/elfload.c b/linux-user/elfload.c index 17cd547c0c..e1a8b102d4 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -3278,7 +3278,8 @@ static void load_elf_image(const char *image_name, const ImageSource *src, char **pinterp_name) { g_autofree struct elf_phdr *phdr = NULL; - abi_ulong load_addr, load_bias, loaddr, hiaddr, error; + abi_ulong load_addr, load_bias, loaddr, hiaddr, error, align; + size_t reserve_size, align_size; int i, prot_exec; Error *err = NULL; @@ -3362,6 +3363,9 @@ static void load_elf_image(const char *image_name, const ImageSource *src, load_addr = loaddr; + align = pow2ceil(info->alignment); + info->alignment = align; + if (pinterp_name != NULL) { if (ehdr->e_type == ET_EXEC) { /* @@ -3370,8 +3374,6 @@ static void load_elf_image(const char *image_name, const ImageSource *src, */ probe_guest_base(image_name, loaddr, hiaddr); } else { - abi_ulong align; - /* * The binary is dynamic, but we still need to * select guest_base. In this case we pass a size. @@ -3389,10 +3391,7 @@ static void load_elf_image(const char *image_name, const ImageSource *src, * Since we do not have complete control over the guest * address space, we prefer the kernel to choose some address * rather than force the use of LOAD_ADDR via MAP_FIXED. - * But without MAP_FIXED we cannot guarantee alignment, - * only suggest it. */ - align = pow2ceil(info->alignment); if (align) { load_addr &= -align; } @@ -3416,13 +3415,35 @@ static void load_elf_image(const char *image_name, const ImageSource *src, * In both cases, we will overwrite pages in this range with mappings * from the executable. */ - load_addr = target_mmap(load_addr, (size_t)hiaddr - loaddr + 1, PROT_NONE, + reserve_size = (size_t)hiaddr - loaddr + 1; + align_size = reserve_size; + + if (ehdr->e_type != ET_EXEC && align > qemu_real_host_page_size()) { + align_size += align - 1; + } + + load_addr = target_mmap(load_addr, align_size, PROT_NONE, MAP_PRIVATE | MAP_ANON | MAP_NORESERVE | (ehdr->e_type == ET_EXEC ? MAP_FIXED_NOREPLACE : 0), -1, 0); if (load_addr == -1) { goto exit_mmap; } + + if (align_size != reserve_size) { + abi_ulong align_addr = ROUND_UP(load_addr, align); + abi_ulong align_end = align_addr + reserve_size; + abi_ulong load_end = load_addr + align_size; + + if (align_addr != load_addr) { + target_munmap(load_addr, align_addr - load_addr); + } + if (align_end != load_end) { + target_munmap(align_end, load_end - align_end); + } + load_addr = align_addr; + } + load_bias = load_addr - loaddr; if (elf_is_fdpic(ehdr)) { From patchwork Sat Mar 15 07:42:11 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873859 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1081489wrq; Sat, 15 Mar 2025 00:49:02 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCX+w1Hk4Xc+frOme6qo3YExa1nHQskdl1Narc23pBEO3lsAldLpdLDc18Rzk/pzroh834Aw8A==@linaro.org X-Google-Smtp-Source: AGHT+IHsjPyCYxeHe+wmhgg3H3d3yqKqTVR2t7s4sU6O95tuECnfVVGgl0et81IhRu3nbf+xY6FW X-Received: by 2002:a05:620a:470e:b0:7c5:59a6:bae6 with SMTP id af79cd13be357-7c57c73d882mr648174685a.3.1742024942254; Sat, 15 Mar 2025 00:49:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024942; cv=none; d=google.com; s=arc-20240605; b=Q10QPQW/nylMGaXlqrq0PDUDWZfnnxX7Ml+SCyXKPC1CiTteDA8KzwDvqRfsz9yL2L MpC4USVI61jimq7KOHemNgAoO0sH9G1p6eB842k3m0Rc8XTPnYvZwh2A8Y29ARp9r0yH 4+YCoTdHepNKixC3lz9o7P0I+QBWwiuNlZ7IFnxvY/e2JU3TJ8O3AQv82M+YjYFRti8r UnCqiDVUIbW137R7va/t8AqlZtx+yRbedjratFw4+eQi/MzBrerqrHdYUDNKL5guH/3e wv6s/fjJIisUMCzSYdqmSLsgtAps3NoNNdXAZuOTmELUKb6ev7/sBRU1/2jIJCv3OEN9 ezeQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=fBb9m0YwWtut93SJjWvQ7jwv4BukV2TiJycyaUhmqjs=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=Ub2n5hQ2ZY3ROoy2AdtMTfFvL++LAU7ukt26kUW35hzAL6/MtYPsfV8u9VOYZX0Dh5 RtjBMmT2qnE+28QoZElSxvxqgUBH4sjS63es3jYO5eKGZSpgCpSJRzVAYTTxNWBRM1hS kYp8hMLyK1JLp/0i7p1qNoHKTMZRKZiDvuEjRaHgzQ55hBY+2NVhyXeluTBpNv5hGWWn /ExlGDUKsuO/dZSspD3YdiwwFzqG9KFehtliMnAv8JcKkpr2IF0vsEyXlXkegBynHl0Q MyIlKvFWubG/5En55/ygRZfWtBCmpBJQ9I30Y4W3/iYpFpvavg+dr2DVFSRqHhz7QWkC I6Sw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573ccb174si534068385a.322.2025.03.15.00.49.02 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:49:02 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMAs-00026c-VR; Sat, 15 Mar 2025 03:43:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAp-00023E-Fd; Sat, 15 Mar 2025 03:43:11 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAn-0004oJ-Cf; Sat, 15 Mar 2025 03:43:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A29B6FFAFD; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 914661CACC7; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 6DBD7559E6; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 09/42] target/arm: Report correct syndrome for UNDEFINED CNTPS_*_EL1 from EL2 and NS EL1 Date: Sat, 15 Mar 2025 10:42:11 +0300 Message-Id: <20250315074249.634718-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The access pseudocode for the CNTPS_TVAL_EL1, CNTPS_CTL_EL1 and CNTPS_CVAL_EL1 secure timer registers says that they are UNDEFINED from EL2 or NS EL1. We incorrectly return CP_ACCESS_TRAP from the access function in these cases, which means that we report the wrong syndrome value to the target EL. Use CP_ACCESS_TRAP_UNCATEGORIZED, which reports the correct syndrome value for an UNDEFINED instruction. Cc: qemu-stable@nongnu.org Fixes: b4d3978c2fd ("target-arm: Add the AArch64 view of the Secure physical timer") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-2-peter.maydell@linaro.org (cherry picked from commit b819fd6994243aee6f9613edbbacedce4f511c32) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 7bef2c6675..92d5ee95e6 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2579,7 +2579,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, switch (arm_current_el(env)) { case 1: if (!arm_is_secure(env)) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } if (!(env->cp15.scr_el3 & SCR_ST)) { return CP_ACCESS_TRAP_EL3; @@ -2587,7 +2587,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, return CP_ACCESS_OK; case 0: case 2: - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; case 3: return CP_ACCESS_OK; default: From patchwork Sat Mar 15 07:42:12 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873857 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1081045wrq; Sat, 15 Mar 2025 00:47:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUoeDI1LXcr4+QgJyHKvM2y0cvEAUixBj2H9VgVJdoTmSyxexZFybyO/pMLPTPLet7O31IeSw==@linaro.org X-Google-Smtp-Source: AGHT+IFewlzpehXMp6klmy5gxtvQgI65jH8f5RMHQgmPamPpp5rz+8W2/3qIfi7gYoIotAaYixRW X-Received: by 2002:a05:620a:3904:b0:7c5:5585:6c8b with SMTP id af79cd13be357-7c57c92850emr743644785a.50.1742024827627; Sat, 15 Mar 2025 00:47:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024827; cv=none; d=google.com; s=arc-20240605; b=XQ+Stk0ei5JxK3kFpqFRSUCQSEymqEqypyOaz1CzWbLv6j/QpB8rnPhmfZnlpwCj72 I1ewwJlzBLTII7lUgjgyVyyObU1FLJAp6Nke1VtQANcDeveW3yRVcE2IZK1IF8xZSC58 k165SEMJKTHpxh37wJ2P0gjQG47zOIN5nQgbhATlI5h+gkpJAtDZeSxuCOVZ+owRNnzU 1FNrtZ76u3lEWzVQhJmeRvbr514L51/yFwZlWqG+brQYkFqwmCCXagxA9larzYAaDiIN Oi4Jhjzaq6kOPB1bcRgnZkAkJuTSDNrEGU441dCbTvkUTsaw/XSuyvvJaOsQGnBv5Sz8 y+cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=DwppJ7u5C5fT/hfxQ0iHLfDkDUNC6PlStF5zhA5C3Uk=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=gpw73aeMMJb3yAqDHbKJScuXCiM9H3sFhVpdjWH4P07DhM04dIiRkaUFsnfX5Wknps hRWmu+r3hPHr4UciFc/BkGCRa/0aMY24E9+km3ylXwi5ZJVsjx5QQbQiZc2g/57nDXCq tGEgrYhhQAulYgWI6RRgfRud7uhkuGekj1eayNDIiACOn1dWAh9fsLrC/2XQiWlrLdGB 88xn170f4SHu9lHR0aniktk5NqrRfspyM833IGAIt31DpyNXVceO3kow5ABPkijxzNAs TmYYnolVh9f8bVwsp8ELvPlQ6nudycTgrV9y7bSjI4gLlfb4nQqDEiqd6vTdd15reGqF iIUg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb81f030si51376881cf.417.2025.03.15.00.47.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:47:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMAu-00027N-IT; Sat, 15 Mar 2025 03:43:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAr-00025r-RQ; Sat, 15 Mar 2025 03:43:13 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMAq-0004p9-4u; Sat, 15 Mar 2025 03:43:13 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id A67E2FFAFE; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 952981CACC8; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 70037559E8; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 10/42] target/arm: Report correct syndrome for UNDEFINED AT ops with wrong NSE, NS Date: Sat, 15 Mar 2025 10:42:12 +0300 Message-Id: <20250315074249.634718-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell R_NYXTL says that these AT insns should be UNDEFINED if they would operate on an EL lower than EL3 and SCR_EL3.{NSE,NS} is set to the Reserved {1, 0}. We were incorrectly reporting them with the wrong syndrome; use CP_ACCESS_TRAP_UNCATEGORIZED so they are reported as UNDEFINED. Cc: qemu-stable@nongnu.org Fixes: 1acd00ef1410 ("target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for AT instructions") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-3-peter.maydell@linaro.org (cherry picked from commit 1960d9701ef7ed8d24e98def767bbf05d63e6992) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 92d5ee95e6..5d7ab46c09 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -3680,7 +3680,7 @@ static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri, * scr_write() ensures that the NSE bit is not set otherwise. */ if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } return CP_ACCESS_OK; } From patchwork Sat Mar 15 07:42:13 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873862 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1082273wrq; Sat, 15 Mar 2025 00:52:34 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWqiOTDKlpnJk7wORrS5CyrSvP9u+Y+ZpnvIiMsi3vWaqyOi+fNbHI26xcySI/aeXL9sj6n3A==@linaro.org X-Google-Smtp-Source: AGHT+IGrTo+YYivSQHQvuQBx9VtztJTsp1LXOI4/BcM7C8OHH1LMqYlcxdP5nV8TbwzzO6G1WI9G X-Received: by 2002:a05:620a:248a:b0:7c5:674c:eec9 with SMTP id af79cd13be357-7c57c7d451bmr732014385a.28.1742025153836; Sat, 15 Mar 2025 00:52:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742025153; cv=none; d=google.com; s=arc-20240605; b=Nwk7Oex8iIHNE5KUvceXEv7ks5ftWzyyyRhJFZCpPHzz3/ydYgLnNSUzw1/PEDTl3V 8C7AyF+fQZ3nnAjadbq34/nbOuhQ5CAouXhCv8BjNVajUiyWfjpuHDkAd4+/AXhtDkcZ X2NXElfWUBt1Zy1ELRl/fXjfgctg4DGmKF32TkmPUcwg1HzSX0+slo4nz7RhN8IwwB2o T036czDmG2jY9OwxCvLZjrwXkEbWnm0t/1HSDponwRqpgmXnClfqXz8GokhQrzndGkxQ lOdxvpIG91LFifkfUlawCe2RHBjYoVXAs7ZcWKdDY1kZIFJY+WBbhz5bqq+4Bo2sMDdM IwpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=6GUN6BNdIWsGZf/bnUBgp5Y4sRX7svN9UDl1gmF/YC0=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=dPH9aM3w+JWVUAUejG2yLSIaVVjeEZ3UMywMNvG2Fj3XcU2hnDyUb0RnGald4CBhor mGtybI+91n7lGJZfEMnRwGJVcYiofJrA0He9unMQJoW88+BjvZrmecH2ckogI5KrduS0 d99A1L0sWQRuUnqaOKGk4MUwFBrqY4f4VjV9eC+vIp6rbBBxzyF2RMg2pGLLZuyTldAC TrYn7B2UEIu2JiVzbhJeaEDKyml4JXxtAf9yvG+F39OLo6pSdiypVGoK8P2Oy1f882lD H47PyoOOEfR5uflCH4NPjJjou0X8Ie4ca4T+KYgRo2XJ1RFiXaML14I9TxnbuBs2QKYV /hQA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b73c4fsi526819985a.105.2025.03.15.00.52.33 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:52:33 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMBE-0002Tt-6k; Sat, 15 Mar 2025 03:43:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBC-0002TB-Mf; Sat, 15 Mar 2025 03:43:34 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBB-0004pS-2I; Sat, 15 Mar 2025 03:43:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AA6B4FFAFF; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 993771CACC9; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7255B559EA; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 11/42] target/arm: Report correct syndrome for UNDEFINED S1E2 AT ops at EL3 Date: Sat, 15 Mar 2025 10:42:13 +0300 Message-Id: <20250315074249.634718-11-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The pseudocode for AT S1E2R and AT S1E2W says that they should be UNDEFINED if executed at EL3 when EL2 is not enabled. We were incorrectly using CP_ACCESS_TRAP and reporting the wrong exception syndrome as a result. Use CP_ACCESS_TRAP_UNCATEGORIZED. Cc: qemu-stable@nongnu.org Fixes: 2a47df953202e1 ("target-arm: Wire up AArch64 EL2 and EL3 address translation ops") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-4-peter.maydell@linaro.org (cherry picked from commit ccda792945d650bce4609c8dbce8814a220df1bb) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 5d7ab46c09..fa56cb5f92 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -3690,7 +3690,7 @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, { if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } return at_e012_access(env, ri, isread); } From patchwork Sat Mar 15 07:42:14 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873851 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080403wrq; Sat, 15 Mar 2025 00:44:16 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXLCWPCR2Kib+cEcOrBzEqpRNM2iSmz6tasea1XG+I9NdnTKBpbYQCA26YfBZkh5K76WpqyCw==@linaro.org X-Google-Smtp-Source: AGHT+IFQlFxkoVwz1yxfKlEpxO0fUooAU+kq8gQOTDwOQWCJmjTpndssT5M/U+G1ayaqQaieeeOR X-Received: by 2002:a05:622a:1a89:b0:476:add4:d2b7 with SMTP id d75a77b69052e-476c81ee0d9mr81294211cf.51.1742024655937; Sat, 15 Mar 2025 00:44:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024655; cv=none; d=google.com; s=arc-20240605; b=izCvrUQuR9SWNFTkfMOVeJ1+Uh2g6TQHIGAQkvThR2rJd2s4TdZZcetRGR+btQKrL7 ulmridcfGk6H2NooMfD41J3pnl8+Wu+GV7R0A4d7dPdoFQmmSRbSm0gUsNqcJOngBe93 tc2l2Ao1Sjg8HET+aO1RS64jcaOfH+MuS1rgn1lbQtiCh6eJi31BSaMIjDmY7Nuq3ghx nAW5J+0RAnxqi7lLYGzI5wktXReIw8vCqE/eBDs5dTDE/1GvFJeHq2SFGxPzcsdZJJki LKPCuDrdISVyB/arsF8VN0krTHsV+LYSDQgOufLbVC4nZYAjfl8BJ7XVV4V+SwyKaZc3 fWWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=In21PAzdAY+qE5L127YSEx6CNIJz/Ku3iUo9wWjZB4w=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=kZivNh26+oPBN+3AnxPArv7NOfqZfYKH8QxyUDlhnfOnQyeWwX8ocC8EBVbf6Qo4FF 9cMJG8IA/gJdEjYstdCdgfeSFmSasZJGhzlGyUoMIRfDwFCJ0tIu+DyChteOu9QMZoF6 5GCjUMqRpU+5mu5rTtpdWXSV6ka4/z4f0LYyMUQWtgU5IiSz7srPZa/AQrgWj7zqebXs XUWWpzjCWjAsL5l7p7E2XD7hVW3id4xVUL2sfo50nfITAkgW8Nf896T9Umg2dr5XhdYu ixYdYXuuisXOkmsT2dTQD8oYaB/huPy/T8R2GP198/Qsl/7O7i8NdhwBaRibgcxat0xD fpow==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb8196d8si55776681cf.375.2025.03.15.00.44.15 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:44:15 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMBI-0002eR-1f; Sat, 15 Mar 2025 03:43:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBF-0002YR-9E; Sat, 15 Mar 2025 03:43:37 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBD-0004qI-6Q; Sat, 15 Mar 2025 03:43:36 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AE2A9FFB00; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 9CF141CACCA; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 74B75559EC; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 12/42] target/arm: Report correct syndrome for UNDEFINED LOR sysregs when NS=0 Date: Sat, 15 Mar 2025 10:42:14 +0300 Message-Id: <20250315074249.634718-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The pseudocode for the accessors for the LOR sysregs says they are UNDEFINED if SCR_EL3.NS is 0. We were reporting the wrong syndrome value here; use CP_ACCESS_TRAP_UNCATEGORIZED. Cc: qemu-stable@nongnu.org Fixes: 2d7137c10faf ("target/arm: Implement the ARMv8.1-LOR extension") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-5-peter.maydell@linaro.org (cherry picked from commit 707d478ed8f2da6f2327e5af780890c1fd9c371a) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index fa56cb5f92..aec02c14ed 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -7300,8 +7300,8 @@ static CPAccessResult access_lor_other(CPUARMState *env, const ARMCPRegInfo *ri, bool isread) { if (arm_is_secure_below_el3(env)) { - /* Access denied in secure mode. */ - return CP_ACCESS_TRAP; + /* UNDEF if SCR_EL3.NS == 0 */ + return CP_ACCESS_TRAP_UNCATEGORIZED; } return access_lor_ns(env, ri, isread); } From patchwork Sat Mar 15 07:42:15 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873850 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080284wrq; Sat, 15 Mar 2025 00:43:46 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXyCYVwcaMPGXEyFVZ0LldXyG6yRmYA7TWFf79oSiUZT48y7Db48ZkKnWF7U9V78D5oN8wWww==@linaro.org X-Google-Smtp-Source: AGHT+IHbkavDN+aMKDbR8OpXcrBByVh1Mp47jffDUJ+YH87Dc9HAzL0BA5lz8qVM4s/zkmVHCE3u X-Received: by 2002:a05:622a:1823:b0:476:afd2:5b5d with SMTP id d75a77b69052e-476c8123bcfmr78817421cf.4.1742024626749; Sat, 15 Mar 2025 00:43:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024626; cv=none; d=google.com; s=arc-20240605; b=CL1aIDe7B5I+0x6Ij6C7OIzPxfgD68jSFzeucYVkaHdoXEvW/q5aYqNGU1e7+17G2c tpwWhu0YmaiWwIbKSXiCEQfsQbrsNBAlaGwloOl7uzdPkCuq6mbViCP0mtdm0S47GWsD 1FYEbOuxdyIKG6EP7Q5DxHaq+7ixXR5qFo0K0cQCIlENs8QGqQVQr2ZhE+en/PpYp2es oLf1Lh2bJ/4UewfZTgCOZVZkZDEhDSmfsD5WYg4h7QV01OSytJd/ovMlie77t7wngeh/ kcknCjU9Epdn4sOVeTUd1wr7RjgKopCDEzy+rrH21/hbnb3mlcM8+73QB37KWJKoWQmT PXSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=S3K+W+u0n4lVjS18bYSUQ3bLdr/53LfgxpvqQPewfTg=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=i632t/bSxt92WGNKQHJmw3/QRJqV3jFREki2NRiGfffFCU75X8EblO5fu8LYX8n/cy ZwXLfWoEyiWt+ZNCJYYdGMbMjOoTS/cFoHupMt2iAyjmSTxT0DImZF5VKL2dqS1LzEWH lsm6H/03MJqxCAjTJFzHfc5KMSmB3JLIkWpddBh45VBq+W/SAKYi2R2CV87LreaebKaf ngPRd4og6Kk4bRX1dJOA7n89iIxECe+JUD3S8CXO4H3NR0gmdmuz9tDk87H4SpXY4qm7 NddHBUzsVDyjY2vvA5I0nNEb+LmmQsraGCcB/0itQCB9seFXogwK9tcNJpUwVtaaPmJC Pl7g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb815524si57952041cf.369.2025.03.15.00.43.46 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:43:46 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMBL-0002kq-PG; Sat, 15 Mar 2025 03:43:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBG-0002cP-PL; Sat, 15 Mar 2025 03:43:39 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBE-0004vf-5A; Sat, 15 Mar 2025 03:43:38 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B2213FFB01; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A0D7D1CACCB; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7742C559EE; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 13/42] target/arm: Make CP_ACCESS_TRAPs to AArch32 EL3 be Monitor traps Date: Sat, 15 Mar 2025 10:42:15 +0300 Message-Id: <20250315074249.634718-13-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In system register access pseudocode the common pattern for AArch32 registers with access traps to EL3 is: at EL1 and EL2: if HaveEL(EL3) && !ELUsingAArch32(EL3) && (SCR_EL3.TERR == 1) then AArch64.AArch32SystemAccessTrap(EL3, 0x03); elsif HaveEL(EL3) && ELUsingAArch32(EL3) && (SCR.TERR == 1) then AArch32.TakeMonitorTrapException(); at EL3: if (PSTATE.M != M32_Monitor) && (SCR.TERR == 1) then AArch32.TakeMonitorTrapException(); (taking as an example the ERRIDR access pseudocode). This implements the behaviour of (in this case) SCR.TERR that "Accesses to the specified registers from modes other than Monitor mode generate a Monitor Trap exception" and of SCR_EL3.TERR that "Accesses of the specified Error Record registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception". In QEMU we don't implement this pattern correctly in two ways: * in access_check_cp_reg() we turn the CP_ACCESS_TRAP_EL3 into an UNDEF, not a trap to Monitor mode * in the access functions, we check trap bits like SCR.TERR only when arm_current_el(env) < 3 -- this is correct for AArch64 EL3, but misses the "trap non-Monitor-mode execution at EL3 into Monitor mode" case for AArch32 EL3 In this commit we fix the first of these two issues, by making access_check_cp_reg() handle CP_ACCESS_TRAP_EL3 as a Monitor trap. This is a kind of exception that we haven't yet implemented(!), so we need a new EXCP_MON_TRAP for it. This diverges from the pseudocode approach, where every access check function explicitly checks for "if EL3 is AArch32" and takes a monitor trap; if we wanted to be closer to the pseudocode we could add a new CP_ACCESS_TRAP_MONITOR and make all the accessfns use it when appropriate. But because there are no non-standard cases in the pseudocode (i.e. where either it raises a Monitor trap that doesn't correspond to an AArch64 SystemAccessTrap or where it raises a SystemAccessTrap that doesn't correspond to a Monitor trap), handling this all in one place seems less likely to result in future bugs where we forgot again about this special case when writing an accessor. (The cc of stable here is because "hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3" which is also cc:stable will implicitly use the new EXCP_MON_TRAP code path.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-6-peter.maydell@linaro.org (cherry picked from commit 4cf4948651615181c5bc3d0e4a9f5c46be576bb2) (Mjt: context fix due to missing v9.0.0-151-gb36a32ead159 "target/arm: Add support for Non-maskable Interrupt") Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index a0282e0d28..3a45c35b75 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -58,6 +58,7 @@ #define EXCP_DIVBYZERO 23 /* v7M DIVBYZERO UsageFault */ #define EXCP_VSERR 24 #define EXCP_GPC 25 /* v9 Granule Protection Check Fault */ +#define EXCP_MON_TRAP 29 /* AArch32 trap to Monitor mode */ /* NB: add new EXCP_ defines to the array in arm_log_exception() too */ #define ARMV7M_EXCP_RESET 1 diff --git a/target/arm/helper.c b/target/arm/helper.c index aec02c14ed..0d092bc99b 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -10399,6 +10399,7 @@ void arm_log_exception(CPUState *cs) [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault", [EXCP_VSERR] = "Virtual SERR", [EXCP_GPC] = "Granule Protection Check", + [EXCP_MON_TRAP] = "Monitor Trap", }; if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { @@ -10965,6 +10966,16 @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs) mask = CPSR_A | CPSR_I | CPSR_F; offset = 0; break; + case EXCP_MON_TRAP: + new_mode = ARM_CPU_MODE_MON; + addr = 0x04; + mask = CPSR_A | CPSR_I | CPSR_F; + if (env->thumb) { + offset = 2; + } else { + offset = 4; + } + break; default: cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); return; /* Never happens. Keep compiler happy. */ diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c index ea08936a85..3268dabf65 100644 --- a/target/arm/tcg/op_helper.c +++ b/target/arm/tcg/op_helper.c @@ -632,6 +632,7 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, key); CPAccessResult res = CP_ACCESS_OK; int target_el; + uint32_t excp; assert(ri != NULL); @@ -716,8 +717,18 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, } fail: + excp = EXCP_UDEF; switch (res & ~CP_ACCESS_EL_MASK) { case CP_ACCESS_TRAP: + /* + * If EL3 is AArch32 then there's no syndrome register; the cases + * where we would raise a SystemAccessTrap to AArch64 EL3 all become + * raising a Monitor trap exception. (Because there's no visible + * syndrome it doesn't matter what we pass to raise_exception().) + */ + if ((res & CP_ACCESS_EL_MASK) == 3 && !arm_el_is_aa64(env, 3)) { + excp = EXCP_MON_TRAP; + } break; case CP_ACCESS_TRAP_UNCATEGORIZED: /* Only CP_ACCESS_TRAP traps are direct to a specified EL */ @@ -753,7 +764,7 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, g_assert_not_reached(); } - raise_exception(env, EXCP_UDEF, syndrome, target_el); + raise_exception(env, excp, syndrome, target_el); } const void *HELPER(lookup_cp_reg)(CPUARMState *env, uint32_t key) From patchwork Sat Mar 15 07:42:16 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873855 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080955wrq; Sat, 15 Mar 2025 00:46:37 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWitYMnrP4SfgLZVRd0mNVZs1bi1EzWVXMGzW2gshjc4RprJbaVvRA4Boo40iPg5htKLz/VFQ==@linaro.org X-Google-Smtp-Source: AGHT+IGGkiunxTGk8mXSuTb2rGj4tUzX+q3n2ScAa5VV+Z/xA1RLbB6vsZCuhkgX5KmP0dlJilIx X-Received: by 2002:ac8:590b:0:b0:476:80ce:a614 with SMTP id d75a77b69052e-476c814a1camr83766201cf.19.1742024797324; Sat, 15 Mar 2025 00:46:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024797; cv=none; d=google.com; s=arc-20240605; b=aqjnlrVdRiY4VAuL1KlXJ/cKy3Q/v3/Qz8XN/40z7znShXpcvaUFmndStwgc0eeUF1 HRWpsv1tK+C1kV2lK/dtpFl7joiigz1c6LBH6eMYo87XQrM/ayADmaslusM33ycDZyR8 qiKNhU3ESACTh32ADN31pv1Km8vNTJKZc93EsJABEtTa/rA0Dit80QamHoesxj6s0sVi W24T9LBpRESEom8mjtMxlLZkzXBaidBpxOcL2w7eTu0h6pafaOmWmRtJB9fKk0rZNe+7 CTfZb9jXOTF1e0IrGxbQTVxSDn1rIBCWVSNZt0oOK8t14r+DXtuPUCSae7AcjGF/QRHB MJ8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=xdAGl00dVyw1SjWAruqa6Pj0qUccNQ4RQdnWOvDKNSI=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=D77wWZX3RasBXiWmAXbNhfrRnDvxS53fQ9Nfg4/PpyMUp1x28AH6/OBmSOZUv/7aDL qY4Z4bGzopJ8orUoZh3uaPXhjTJv1RTgmaUUEr1AszgDrKJ2TxwN1jT0M0Y6fnqvoQAt 4yc97AJgUK+npO7LiJxUvluxWG5Xbv5YdTfUWfMuecImkfujL7Qp6nQ1ooH8lvmSs9lt tEBp+gOdHiHELYdsTC1RGVfaBMGyrwLRJXllK72LHrQsv24FRAdy0UOLs9YFQLh3YgOC XOZipo/7m+hyX6FZqVbubXrlxr15a8Kv85F+/yVMo0b06reEPYNm7o1wW9jBfm+7+Jqa omWQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb6147ecsi51313851cf.21.2025.03.15.00.46.37 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:46:37 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMBK-0002iw-EJ; Sat, 15 Mar 2025 03:43:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBI-0002fi-8P; Sat, 15 Mar 2025 03:43:40 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBG-0004wX-IM; Sat, 15 Mar 2025 03:43:39 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B6185FFB02; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A4CAE1CACCC; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 79B32559F0; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 14/42] hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3 Date: Sat, 15 Mar 2025 10:42:16 +0300 Message-Id: <20250315074249.634718-14-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In the gicv3_{irq,fiq,irqfiq}_access() functions, there is a check which downgrades a CP_ACCESS_TRAP_EL3 to CP_ACCESS_TRAP if EL3 is not AArch64. This has been there since the GIC was first implemented, but it isn't right: if we are trapping because of SCR.IRQ or SCR.FIQ then we definitely want to be going to EL3 (doing AArch32.TakeMonitorTrapException() in pseudocode terms). We might want to not take a trap at all, but we don't ever want to go to the default target EL, because that would mean, for instance, taking a trap to Hyp mode if the trapped access was made from Hyp mode. (This might have been an attempt to work around our failure to properly implement Monitor Traps.) Remove the bogus check. Cc: qemu-stable@nongnu.org Fixes: 359fbe65e01e ("hw/intc/arm_gicv3: Implement GICv3 CPU interface registers") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-7-peter.maydell@linaro.org (cherry picked from commit d04c6c3c000ab3e588a2b91641310aeea89408f7) Signed-off-by: Michael Tokarev diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c index 8eacf4101c..f2440597ea 100644 --- a/hw/intc/arm_gicv3_cpuif.c +++ b/hw/intc/arm_gicv3_cpuif.c @@ -2099,9 +2099,6 @@ static CPAccessResult gicv3_irqfiq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } @@ -2164,9 +2161,6 @@ static CPAccessResult gicv3_fiq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } @@ -2203,9 +2197,6 @@ static CPAccessResult gicv3_irq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } From patchwork Sat Mar 15 07:42:17 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873853 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080545wrq; Sat, 15 Mar 2025 00:44:57 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWzWXlnm1ew1wd01VbGm3z+kSB2Z2tIXAzQB5/T9EAHeMbok2M02XRlMnzIJKHX+r9xLSePmQ==@linaro.org X-Google-Smtp-Source: AGHT+IGhaVvnwLDlfwAdnL4um8+kVhOLRrl3uyIZ2uV6C87as9AZbtvTp2Y1dM34N+nqv7ddU5/u X-Received: by 2002:a05:620a:2624:b0:7c5:4be5:b0b3 with SMTP id af79cd13be357-7c57c91ee37mr869510885a.48.1742024697576; Sat, 15 Mar 2025 00:44:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024697; cv=none; d=google.com; s=arc-20240605; b=ZrGhjCJOA7H3onvHxsquvy0XkZ7S0CrfatUAEUoH5MIgSELNG3mjvmBb2mWZewqMN3 LsdVgU+RAghuqZLMTMGBG36D4CrzZR49IAAOamhMqXigs4FpdWK5Ergn7LRb3QMFgRfh 2zUOp4vj9QplkEskOA8Xke4aACRd5p8qcBsw5Vgj3LEt/UQDHsX0dHwUKh786NGYAIY7 BVB6aVAbfdMqlctW0KgooqGqdis5ElUmssgca+vLaoeVpeBygY2dezY7xJdqJp9Ywjmw 54G+LzPlzO76rl4bkQcglyyxUlswLiFyHZCsWdAnZZsbdArnnVHJbEGGq/9SJenRPPnx PxAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=RHl52CdB2+xY3fCHNTgGM0+e06yUqAAVJ9bDXeyhh20=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=cLdu4zAspR4APz0M+nvT2urAHJhCPPowgHa+P2aZz+ME8odCrnQ36e+eXH2yKAnfvS N6rZcxfJaYfDRglJwK3PzFhjGniGNsyQL5SHq7oM/ijjsEjdRDipz1PeOxKj6qY8d+Td IhI7XPKKCTjV83S9jOrx7prac37u9M2q9S9k8YY/IUziUUUZPRsnNaG3Vhh46XU++0w/ 8YtZpb4tPthrtSedOUyRs09hwDzpKI3go5FFBRYwNRrHsVSz088UEbuEsGGz/+q9goP5 gRS9Z24tGr569BI36x+TkDIiR1xIArfy0o59/39zPjy5WofMRRhSRXyFxDS2dqPGUmtO csAA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573d18d7asi524799085a.554.2025.03.15.00.44.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:44:57 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMBN-0002ms-5J; Sat, 15 Mar 2025 03:43:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBK-0002k0-Fe; Sat, 15 Mar 2025 03:43:42 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMBI-0004xB-85; Sat, 15 Mar 2025 03:43:42 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BBAF8FFB03; Sat, 15 Mar 2025 10:41:55 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id A8B141CACCD; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 7C142559F2; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 15/42] target/arm: Honour SDCR.TDCC and SCR.TERR in AArch32 EL3 non-Monitor modes Date: Sat, 15 Mar 2025 10:42:17 +0300 Message-Id: <20250315074249.634718-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell There are not many traps in AArch32 which should trap to Monitor mode, but these trap bits should trap not just lower ELs to Monitor mode but also the non-Monitor modes running at EL3 (i.e. Secure System, Secure Undef, etc). We get this wrong because the relevant access functions implement the AArch64-style logic of if (el < 3 && trap_bit_set) { return CP_ACCESS_TRAP_EL3; } which won't trap the non-Monitor modes at EL3. Correct this error by using arm_is_el3_or_mon() instead, which returns true when the CPU is at AArch64 EL3 or AArch32 Monitor mode. (Since the new callsites are compiled also for the linux-user mode, we need to provide a dummy implementation for CONFIG_USER_ONLY.) This affects only: * trapping of ERRIDR via SCR.TERR * trapping of the debug channel registers via SDCR.TDCC * trapping of GICv3 registers via SCR.IRQ and SCR.FIQ (which we already used arm_is_el3_or_mon() for) This patch changes the handling of SCR.TERR and SDCR.TDCC. This patch only changes guest-visible behaviour for "-cpu max" on the qemu-system-arm binary, because SCR.TERR and SDCR.TDCC (and indeed the entire SDCR register) only arrived in Armv8, and the only guest CPU we support which has any v8 features and also starts in AArch32 EL3 is the 32-bit 'max'. Other uses of CP_ACCESS_TRAP_EL3 don't need changing: * uses in code paths that can't happen when EL3 is AArch32: access_trap_aa32s_el1, cpacr_access, cptr_access, nsacr_access * uses which are in accessfns for AArch64-only registers: gt_stimer_access, gt_cntpoff_access, access_hxen, access_tpidr2, access_smpri, access_smprimap, access_lor_ns, access_pauth, access_mte, access_tfsr_el2, access_scxtnum, access_fgt * trap bits which exist only in the AArch64 version of the trap register, not the AArch32 one: access_tpm, pmreg_access, access_dbgvcr32, access_tdra, access_tda, access_tdosa (TPM, TDA and TDOSA exist only in MDCR_EL3, not in SDCR, and we enforce this in sdcr_write()) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-8-peter.maydell@linaro.org (cherry picked from commit 4d436fb05c2a1fff7befc815ebcbb04a14977448) Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index 3a45c35b75..c1b18b8478 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -2630,6 +2630,11 @@ static inline bool arm_is_secure_below_el3(CPUARMState *env) return false; } +static inline bool arm_is_el3_or_mon(CPUARMState *env) +{ + return false; +} + static inline ARMSecuritySpace arm_security_space(CPUARMState *env) { return ARMSS_NonSecure; diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c index cbfba532f5..d0666500fa 100644 --- a/target/arm/debug_helper.c +++ b/target/arm/debug_helper.c @@ -870,7 +870,8 @@ static CPAccessResult access_tdcc(CPUARMState *env, const ARMCPRegInfo *ri, if (el < 2 && (mdcr_el2_tda || mdcr_el2_tdcc)) { return CP_ACCESS_TRAP_EL2; } - if (el < 3 && ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { + if (!arm_is_el3_or_mon(env) && + ((env->cp15.mdcr_el3 & MDCR_TDA) || mdcr_el3_tdcc)) { return CP_ACCESS_TRAP_EL3; } return CP_ACCESS_OK; diff --git a/target/arm/helper.c b/target/arm/helper.c index 0d092bc99b..eff8563527 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6664,7 +6664,7 @@ static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri, if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) { return CP_ACCESS_TRAP_EL2; } - if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) { + if (!arm_is_el3_or_mon(env) && (env->cp15.scr_el3 & SCR_TERR)) { return CP_ACCESS_TRAP_EL3; } return CP_ACCESS_OK; From patchwork Sat Mar 15 07:42:32 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873856 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1081034wrq; Sat, 15 Mar 2025 00:47:03 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXLE6AijSYHeJD5eTJWWlJXl6f1UEPPXcIetKf05Zz9dB4SOq0R1BwiH8MIHUng6v3qlSOB5A==@linaro.org X-Google-Smtp-Source: AGHT+IHqJLWSUg4AW8vUjXHYvpde9ssfRIbD1X+egtvWWjuPR8D3c9UKmI8AjltTUz1yuhrZYD2E X-Received: by 2002:a05:622a:255:b0:476:80b3:ee with SMTP id d75a77b69052e-476c811efb0mr66802491cf.6.1742024823077; Sat, 15 Mar 2025 00:47:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024823; cv=none; d=google.com; s=arc-20240605; b=Zk07KA7O+E4nZigAbS6JeN+8QYOoKxF/55rc0xT4jqw9xdXwiadCZewKY/E5NOP0Ya FX5AhrVLjpPV581yKFBo2EFs3jqyqiSL18soZBjyeRlRUAG6Q/scyniwQKgHj9ijntYe 1vEY4Qegbmj9xftj+NwiAbLaN5MYbmviaNjxC3aWKCathY7NUtv9I/wLuJYdQePFH5Sj RELH/m4bAfLyntq9xlrclY7tsw0W6f5wsC7KhKNn4uhedX/0p+HKKnZCrZNpQRzlMKPD VXPsJOdqMr+zUcqwYc8i8OQpx8ujSY8qzi1Gw1ULMyYja5c9Ur26YhXd4iZIYr6PBNCo MuyQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=dD0lQ3Uk+SF5rxtxr1likiNkZTIlZl2/C1Pd2e4N5Ak=; fh=Iucn2sB5qVZfRGgZGrLj0rflcdBmTbFcpQYc4ERoywQ=; b=lXYZ/4cstcvgDULZOWsm9iIwsoKzSlyKeY5v1Tyt63GbQe7f+CSa7VKPnWVXdWjkEC MOSk8NFisOmEZkOoKQVOVbq38wTwu7N0/9k1hyVOj2spXCCJC7OWSLrybdRgd6+l5U7X oyWmHTrzhTe6JHWWpkHrRK+42rmEIdYjEUlMCPZzNeNxfl4hFTRfKe357RRJCcH+foNF oP8H2Xja7K5KMEOCrZu/ZfYL0aEB9LXCUpBCsedfeR080bXu0h6OhHf1puJk91h5/N73 hc2jDSTNaF8mWvs8E6Ll0IuJ3eGVfzgpOnn3nXfhPzGSKmR5i93yGivRY25Ad1WdCGLN x1og==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb881245si51068091cf.612.2025.03.15.00.47.02 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:47:03 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMDO-0000hC-0e; Sat, 15 Mar 2025 03:45:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMD5-0008PP-M4; Sat, 15 Mar 2025 03:45:32 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMD3-00056L-Oc; Sat, 15 Mar 2025 03:45:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 032AAFFB12; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id E5F531CACDC; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A00AD55A10; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Stu Grossman , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 30/42] target/arm: Correct LDRD atomicity and fault behaviour Date: Sat, 15 Mar 2025 10:42:32 +0300 Message-Id: <20250315074249.634718-30-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Our LDRD implementation is wrong in two respects: * if the address is 4-aligned and the load crosses a page boundary and the second load faults and the first load was to the base register (as in cases like "ldrd r2, r3, [r2]", then we must not update the base register before taking the fault * if the address is 8-aligned the access must be a 64-bit single-copy atomic access, not two 32-bit accesses Rewrite the handling of the loads in LDRD to use a single tcg_gen_qemu_ld_i64() and split the result into the destination registers. This allows us to get the atomicity requirements right, and also implicitly means that we won't update the base register too early for the page-crossing case. Note that because we no longer increment 'addr' by 4 in the course of performing the LDRD we must change the adjustment value we pass to op_addr_ri_post() and op_addr_rr_post(): it no longer needs to subtract 4 to get the correct value to use if doing base register writeback. STRD has the same problem with not getting the atomicity right; we will deal with that in the following commit. Cc: qemu-stable@nongnu.org Reported-by: Stu Grossman Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250227142746.1698904-2-peter.maydell@linaro.org (cherry picked from commit cde3247651dc998da5dc1005148302a90d72f21f) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c index e555e885a1..08ae9484de 100644 --- a/target/arm/tcg/translate.c +++ b/target/arm/tcg/translate.c @@ -6588,10 +6588,49 @@ static bool op_store_rr(DisasContext *s, arg_ldst_rr *a, return true; } -static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) +static void do_ldrd_load(DisasContext *s, TCGv_i32 addr, int rt, int rt2) { + /* + * LDRD is required to be an atomic 64-bit access if the + * address is 8-aligned, two atomic 32-bit accesses if + * it's only 4-aligned, and to give an alignment fault + * if it's not 4-aligned. This is MO_ALIGN_4 | MO_ATOM_SUBALIGN. + * Rt is always the word from the lower address, and Rt2 the + * data from the higher address, regardless of endianness. + * So (like gen_load_exclusive) we avoid gen_aa32_ld_i64() + * so we don't get its SCTLR_B check, and instead do a 64-bit access + * using MO_BE if appropriate and then split the two halves. + * + * For M-profile, and for A-profile before LPAE, the 64-bit + * atomicity is not required. We could model that using + * the looser MO_ATOM_IFALIGN_PAIR, but providing a higher + * level of atomicity than required is harmless (we would not + * currently generate better code for IFALIGN_PAIR here). + * + * This also gives us the correct behaviour of not updating + * rt if the load of rt2 faults; this is required for cases + * like "ldrd r2, r3, [r2]" where rt is also the base register. + */ int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + MemOp opc = MO_64 | MO_ALIGN_4 | MO_ATOM_SUBALIGN | s->be_data; + TCGv taddr = gen_aa32_addr(s, addr, opc); + TCGv_i64 t64 = tcg_temp_new_i64(); + TCGv_i32 tmp = tcg_temp_new_i32(); + TCGv_i32 tmp2 = tcg_temp_new_i32(); + + tcg_gen_qemu_ld_i64(t64, taddr, mem_idx, opc); + if (s->be_data == MO_BE) { + tcg_gen_extr_i64_i32(tmp2, tmp, t64); + } else { + tcg_gen_extr_i64_i32(tmp, tmp2, t64); + } + store_reg(s, rt, tmp); + store_reg(s, rt2, tmp2); +} + +static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) +{ + TCGv_i32 addr; if (!ENABLE_ARCH_5TE) { return false; @@ -6602,18 +6641,10 @@ static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) } addr = op_addr_rr_pre(s, a); - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, a->rt, tmp); - - tcg_gen_addi_i32(addr, addr, 4); - - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, a->rt + 1, tmp); + do_ldrd_load(s, addr, a->rt, a->rt + 1); /* LDRD w/ base writeback is undefined if the registers overlap. */ - op_addr_rr_post(s, a, addr, -4); + op_addr_rr_post(s, a, addr, 0); return true; } @@ -6737,23 +6768,14 @@ static bool op_store_ri(DisasContext *s, arg_ldst_ri *a, static bool op_ldrd_ri(DisasContext *s, arg_ldst_ri *a, int rt2) { - int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + TCGv_i32 addr; addr = op_addr_ri_pre(s, a); - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, a->rt, tmp); - - tcg_gen_addi_i32(addr, addr, 4); - - tmp = tcg_temp_new_i32(); - gen_aa32_ld_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - store_reg(s, rt2, tmp); + do_ldrd_load(s, addr, a->rt, rt2); /* LDRD w/ base writeback is undefined if the registers overlap. */ - op_addr_ri_post(s, a, addr, -4); + op_addr_ri_post(s, a, addr, 0); return true; } From patchwork Sat Mar 15 07:42:33 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873854 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1080923wrq; Sat, 15 Mar 2025 00:46:25 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWMHA2ICKOh6L1tQbv6gQe3I+5oh8zKVdvLx2L6YtLrTmzMDJhlUOjHYtiBT57IOZNhaJlHig==@linaro.org X-Google-Smtp-Source: AGHT+IFJjoPPypyBJ4QeIo1QztBSZFnmcfdAqTvGxBf5l6GPXclEt2eHJLmhvV1RqTIrAwTp16uo X-Received: by 2002:a05:622a:1a89:b0:476:add4:d2b7 with SMTP id d75a77b69052e-476c81ee0d9mr81344681cf.51.1742024785060; Sat, 15 Mar 2025 00:46:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024785; cv=none; d=google.com; s=arc-20240605; b=cjrvTApDDKYAHUbFZ8vp1J+Sz42Wuh75FajQNXRG3rdNPmP6vImKw2yFQYzhXTCn9g 4ezmy4/SZqvor/4aZC2QJIof+F8vEYY/sj8so3KvsGwKwghFjSnGiyTj+oeFJC58w58r /Zlvq26SP605CRFhjgwVIYxlm8ObAywAnGSJhsOZmTyoJHLWk8CGQ+1vr64NGJGW8XWH JMExTiPKCVb8UvU+/mAYCpQGMbZu/CM7YbJrPLVJ2WPHq5Lbee+hhPfrf88O/01wQ5M+ UPFVCCHmdOlgIv9x/KWk1DfRG9Kejik466VSJaP6YcxrL57/djOdz5jk1iB5AYIC/6HI 2AtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=ukRWMv/Hs26A3fC/CQkvvJ+jAAxRTFOpXQj+F8Hy5eo=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=HgPrKCeaTfY/szynfS915a0P925UxJME4iXeYH+OQKGPZ1FDuNf1sWKeOVoUvv+1gq 9YuREcUyYJ/4KYrS2KB+pnSuNiFX/pE0btIWxQ3okj/yenQjbSwBrMIxqGeiWamHbdVF 6fWcx4LxMxsuWMUjIVbB/X9WJl6XHSuKNXKxUvPXiqNWJ6Tm3mM9bp/l7tXUbPKp2rUI 8/rtUjH2aduuWZLi+yvLr1fItm1KFR9be9th/6BxnRzO8NL7050urfRAP8LfO+Re3CJ9 fyErWBu8mYR1NH7ZBmuQBEf829lXbgphDYNeMtFfaZ/EswlYIhs+uDF0BK1ylu9skaDX C8JA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb881245si51060751cf.612.2025.03.15.00.46.24 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:46:25 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMDJ-0000I9-Cv; Sat, 15 Mar 2025 03:45:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMD6-0008Q8-9g; Sat, 15 Mar 2025 03:45:33 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMD4-00056c-EM; Sat, 15 Mar 2025 03:45:31 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 071A2FFB13; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id E9EAE1CACDD; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A268755A12; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 31/42] target/arm: Correct STRD atomicity Date: Sat, 15 Mar 2025 10:42:33 +0300 Message-Id: <20250315074249.634718-31-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Our STRD implementation doesn't correctly implement the requirement: * if the address is 8-aligned the access must be a 64-bit single-copy atomic access, not two 32-bit accesses Rewrite the handling of STRD to use a single tcg_gen_qemu_st_i64() of a value produced by concatenating the two 32 bit source registers. This allows us to get the atomicity right. As with the LDRD change, now that we don't update 'addr' in the course of performing the store we need to adjust the offset we pass to op_addr_ri_post() and op_addr_rr_post(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250227142746.1698904-3-peter.maydell@linaro.org (cherry picked from commit ee786ca115045a2b7e86ac3073b0761cb99e0d49) Signed-off-by: Michael Tokarev diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c index 08ae9484de..0d37dfbfe6 100644 --- a/target/arm/tcg/translate.c +++ b/target/arm/tcg/translate.c @@ -6648,10 +6648,42 @@ static bool trans_LDRD_rr(DisasContext *s, arg_ldst_rr *a) return true; } -static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr *a) +static void do_strd_store(DisasContext *s, TCGv_i32 addr, int rt, int rt2) { + /* + * STRD is required to be an atomic 64-bit access if the + * address is 8-aligned, two atomic 32-bit accesses if + * it's only 4-aligned, and to give an alignment fault + * if it's not 4-aligned. + * Rt is always the word from the lower address, and Rt2 the + * data from the higher address, regardless of endianness. + * So (like gen_store_exclusive) we avoid gen_aa32_ld_i64() + * so we don't get its SCTLR_B check, and instead do a 64-bit access + * using MO_BE if appropriate, using a value constructed + * by putting the two halves together in the right order. + * + * As with LDRD, the 64-bit atomicity is not required for + * M-profile, or for A-profile before LPAE, and we provide + * the higher guarantee always for simplicity. + */ int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + MemOp opc = MO_64 | MO_ALIGN_4 | MO_ATOM_SUBALIGN | s->be_data; + TCGv taddr = gen_aa32_addr(s, addr, opc); + TCGv_i32 t1 = load_reg(s, rt); + TCGv_i32 t2 = load_reg(s, rt2); + TCGv_i64 t64 = tcg_temp_new_i64(); + + if (s->be_data == MO_BE) { + tcg_gen_concat_i32_i64(t64, t2, t1); + } else { + tcg_gen_concat_i32_i64(t64, t1, t2); + } + tcg_gen_qemu_st_i64(t64, taddr, mem_idx, opc); +} + +static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr *a) +{ + TCGv_i32 addr; if (!ENABLE_ARCH_5TE) { return false; @@ -6662,15 +6694,9 @@ static bool trans_STRD_rr(DisasContext *s, arg_ldst_rr *a) } addr = op_addr_rr_pre(s, a); - tmp = load_reg(s, a->rt); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); + do_strd_store(s, addr, a->rt, a->rt + 1); - tcg_gen_addi_i32(addr, addr, 4); - - tmp = load_reg(s, a->rt + 1); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - - op_addr_rr_post(s, a, addr, -4); + op_addr_rr_post(s, a, addr, 0); return true; } @@ -6798,20 +6824,13 @@ static bool trans_LDRD_ri_t32(DisasContext *s, arg_ldst_ri2 *a) static bool op_strd_ri(DisasContext *s, arg_ldst_ri *a, int rt2) { - int mem_idx = get_mem_index(s); - TCGv_i32 addr, tmp; + TCGv_i32 addr; addr = op_addr_ri_pre(s, a); - tmp = load_reg(s, a->rt); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); - - tcg_gen_addi_i32(addr, addr, 4); - - tmp = load_reg(s, rt2); - gen_aa32_st_i32(s, tmp, addr, mem_idx, MO_UL | MO_ALIGN); + do_strd_store(s, addr, a->rt, rt2); - op_addr_ri_post(s, a, addr, -4); + op_addr_ri_post(s, a, addr, 0); return true; } From patchwork Sat Mar 15 07:42:34 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873861 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1081853wrq; Sat, 15 Mar 2025 00:50:31 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVDwO5jNgyJeFsEcEDQceCddYlk+ahl583KutFI4HdyMHHxIVeZUbsFH1SOnvcJAJj+Mkeagw==@linaro.org X-Google-Smtp-Source: AGHT+IHWmqMbGOZEupfD2oeFckjHkwC0PsATU/bZwfrG6vhCgH5FR6MoWJmAWpmIhG3yhVbkybFY X-Received: by 2002:a05:622a:1807:b0:476:b7e2:385c with SMTP id d75a77b69052e-476c8130ec1mr78392711cf.2.1742025031665; Sat, 15 Mar 2025 00:50:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742025031; cv=none; d=google.com; s=arc-20240605; b=UGusUZ2GhVz73+uTKu7HhXYyO980tOEGKUYOWOxFrbHIIzenToEGX3GjfYxEhxHm9g 2UvV2H/akDry7dSqIaegRLAj9t1ESxyx/hMUwWH1zUDbsnjWqFIYvji2xYOaBTrlKjdQ eNoPRqhPO3Z+1KzdLCGjYl2ojqNl2kY/1q82l8QWYu7wQ5Cs2XdtCD6S3ZOjJTNMikAD ctWq9TDCUwg77l8s5IB4JL4Ft/aCt9FBiH3x1G5Jl16haWplWCf8TseW/Anak4xY7BR4 BZUN11d+rCRhjYEI77cuBNELZTeGYNW8IZRuZMnOb6thDsM+6T0LgSiA+1pKgUQK8Nub /NgA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=9fjyVnErh/VyUVu3bBqpGsdFbnPmpr60c240xPyLWBY=; fh=GanseRjrcQuAMREH5dzTEIrzdKej3kFdmGlqcUMu4ko=; b=W2ct3xVn89PKu3kOUAlqnaQs9qDWgTHMwTb9l+LSwWfz2GdHHK26713zNWiY7TFtPg P3RZed6fVlh/z9f9yr5OLW2X+iu6GwBMwyAadmiCUCfQsUqNleyZTTaqH63uL2T6EKeq II7uw88JvS4CdKUIvwK76IchPU/rXPzx6pD7W+q9dF49DlvUMiDpfWt/jaYtQ/1AqNrA Cfir8+fAlQPm5l7Fjm1mMgE81HLFykE3tXcoCq6b66uuOciMv4SLG4jw55SZaZN+5TIb LBMOLMKlmxAZG+LOfLe/fmjYduA/3iwLN2rUEFNkgSfiKLmEl7fp6tLpevwoRkGKtsuN qbbw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb64ba6bsi51341851cf.147.2025.03.15.00.50.31 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:50:31 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMDN-0000hP-Vr; Sat, 15 Mar 2025 03:45:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMD9-0008T8-Sv; Sat, 15 Mar 2025 03:45:39 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMD7-0005JQ-2f; Sat, 15 Mar 2025 03:45:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0B2D1FFB14; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id EDF321CACDE; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A4CE155A14; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , =?utf-8?q?Alex_Benn=C3=A9?= =?utf-8?q?e?= , Michael Tokarev Subject: [Stable-8.2.10 32/42] util/qemu-timer.c: Don't warp timer from timerlist_rearm() Date: Sat, 15 Mar 2025 10:42:34 +0300 Message-Id: <20250315074249.634718-32-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Currently we call icount_start_warp_timer() from timerlist_rearm(). This produces incorrect behaviour, because timerlist_rearm() is called, for instance, when a timer callback modifies its timer. We cannot decide here to warp the timer forwards to the next timer deadline merely because all_cpu_threads_idle() is true, because the timer callback we were called from (or some other callback later in the list of callbacks being invoked) may be about to raise a CPU interrupt and move a CPU from idle to ready. The only valid place to choose to warp the timer forward is from the main loop, when we know we have no outstanding IO or timer callbacks that might be about to wake up a CPU. For Arm guests, this bug was mostly latent until the refactoring commit f6fc36deef6abc ("target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK"), which exposed it because it refactored a timer callback so that it happened to call timer_mod() first and raise the interrupt second, when it had previously raised the interrupt first and called timer_mod() afterwards. This call seems to have originally derived from the pre-record-and-replay icount code, which (as of e.g. commit db1a49726c3c in 2010) in this location did a call to qemu_notify_event(), necessary to get the icount code in the vCPU round-robin thread to stop and recalculate the icount deadline when a timer was reprogrammed from the IO thread. In current QEMU, everything is done on the vCPU thread when we are in icount mode, so there's no need to try to notify another thread here. I suspect that the other reason why this call was doing icount timer warping is that it pre-dates commit efab87cf79077a from 2015, which added a call to icount_start_warp_timer() to main_loop_wait(). Once the call in timerlist_rearm() has been removed, if the timer callbacks don't cause any CPU to be woken up then we will end up calling icount_start_warp_timer() from main_loop_wait() when the rr main loop code calls rr_wait_io_event(). Remove the incorrect call from timerlist_rearm(). Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2703 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Reviewed-by: Alex Bennée Tested-by: Alex Bennée Message-id: 20250210135804.3526943-1-peter.maydell@linaro.org (cherry picked from commit 02ae315467cee589d02dfb89e13a2a6a8de09fc5) Signed-off-by: Michael Tokarev diff --git a/util/qemu-timer.c b/util/qemu-timer.c index 6a0de33dd2..84db26b8dd 100644 --- a/util/qemu-timer.c +++ b/util/qemu-timer.c @@ -419,10 +419,6 @@ static bool timer_mod_ns_locked(QEMUTimerList *timer_list, static void timerlist_rearm(QEMUTimerList *timer_list) { - /* Interrupt execution to force deadline recalculation. */ - if (icount_enabled() && timer_list->clock->type == QEMU_CLOCK_VIRTUAL) { - icount_start_warp_timer(); - } timerlist_notify(timer_list); } From patchwork Sat Mar 15 07:42:38 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873865 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1082342wrq; Sat, 15 Mar 2025 00:52:56 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWhgTIbpAr7qytkfcUqbL5SeRu5nCMz6G7fNLLW8RnsqDbnHkGoYPwg2LsmoUXW/Jnrg+LEHw==@linaro.org X-Google-Smtp-Source: AGHT+IGVRBSlRKlAFaSmGRH3/mIm+bYOBgRawhIzBGrKwvC8nXO3kBwFYmGtg0qw8W+FwfJE/Zu+ X-Received: by 2002:a05:6214:b6c:b0:6ea:d629:f47d with SMTP id 6a1803df08f44-6eaeab391b3mr76780476d6.44.1742025176693; Sat, 15 Mar 2025 00:52:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742025176; cv=none; d=google.com; s=arc-20240605; b=H6GQgrnE/WW7teouYoqKKzw+R/es080f10z06Z5YA6pt0gJEb2BnbDRknQ3B94b9h8 boy1Y3MwFoyEr0e1fHbYwTQiwjt+pqXPaDnJLQPkllWdmm48GiLfY14vSSO8078mdpm6 x1HpoWaf7mkr8Kq8X64vz9wuZ9jF7duCMFVr5aDht0QVPMKl0+9pjWhQEkI6B6fJY+GH qUBB9oeFRAQgykpUsLEzaHj4soKfNhlqryp6QkIPDlL3AjdIvT4bgS6DtQtYnid9l+Z9 /uKs0tO5x698Ppm17YvBoojrkqjuqR4M+Ela5WCpPuBb/T0ZktfAg+9kMDGosyCvHwRo yplg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=INeOcD0abq1jf7wxWWQTweSbdCTmv6VeIsUc8nYQNYc=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=JdElTMF9CrlwEEQDxPmBbWxA/bQURwpPspEcf7cbuwoZX814lQBTFtr1OpVBwjt3jP cMt3zvsUT58HVAACOxzRoTLoBn9kCeXYKOp01teJVD7Fkznmw1JHcndGfaGfRaatWVGg ELTkaI+GgFYAy2a2R6Q1wSvHM25UNno05ru8BZG7l7Gb3waG5yzG/D7ErAPh0A+qOMWf T78NdLppQ6jEt88BwrZjavmWBQY720mszx+XZ1JqCbLI6nz35t84Zke0B6NjPk4ssi75 6yTXZRJW7hitqKJOdsh7VuZ1rXhrPWLsEzrB6KLR+MpDPsLAiO/sQ0CCNC/HdTOtrQ0A SFuw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade38685esi54303766d6.482.2025.03.15.00.52.56 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:52:56 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMDq-0002ln-NT; Sat, 15 Mar 2025 03:46:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDb-0001wD-H6; Sat, 15 Mar 2025 03:46:03 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDZ-0005KS-Fy; Sat, 15 Mar 2025 03:46:03 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1ADE1FFB18; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 099681CACE2; Sat, 15 Mar 2025 10:42:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id AE5B355A1C; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-8.2.10 36/42] hw/net/smc91c111: Sanitize packet numbers Date: Sat, 15 Mar 2025 10:42:38 +0300 Message-Id: <20250315074249.634718-36-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The smc91c111 uses packet numbers as an index into its internal s->data[][] array. Valid packet numbers are between 0 and 3, but the code does not generally check this, and there are various places where the guest can hand us an arbitrary packet number and cause an out-of-bounds access to the data array. Add validation of packet numbers. The datasheet is not very helpful about how guest errors like this should be handled: it says nothing on the subject, and none of the documented error conditions are relevant. We choose to log the situation with LOG_GUEST_ERROR and silently ignore the attempted operation. In the places where we are about to access the data[][] array using a packet number and we know the number is valid because we got it from somewhere that has already validated, we add an assert() to document that belief. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228174802.1945417-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 2fa3a5b9469615d06091cf473d172794148e1248) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index dcf6e5117f..3a3cfa1f6a 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -119,6 +119,11 @@ static const VMStateDescription vmstate_smc91c111 = { #define RS_TOOSHORT 0x0400 #define RS_MULTICAST 0x0001 +static inline bool packetnum_valid(int packet_num) +{ + return packet_num >= 0 && packet_num < NUM_PACKETS; +} + /* Update interrupt status. */ static void smc91c111_update(smc91c111_state *s) { @@ -219,6 +224,17 @@ static void smc91c111_pop_tx_fifo_done(smc91c111_state *s) /* Release the memory allocated to a packet. */ static void smc91c111_release_packet(smc91c111_state *s, int packet) { + if (!packetnum_valid(packet)) { + /* + * Data sheet doesn't document behaviour in this guest error + * case, and there is no error status register to report it. + * Log and ignore the attempt. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to release invalid packet %d\n", + packet); + return; + } s->allocated &= ~(1 << packet); if (s->tx_alloc == 0x80) smc91c111_tx_alloc(s); @@ -240,6 +256,8 @@ static void smc91c111_do_tx(smc91c111_state *s) return; for (i = 0; i < s->tx_fifo_len; i++) { packetnum = s->tx_fifo[i]; + /* queue_tx checked the packet number was valid */ + assert(packetnum_valid(packetnum)); p = &s->data[packetnum][0]; /* Set status word. */ *(p++) = 0x01; @@ -288,6 +306,17 @@ static void smc91c111_do_tx(smc91c111_state *s) /* Add a packet to the TX FIFO. */ static void smc91c111_queue_tx(smc91c111_state *s, int packet) { + if (!packetnum_valid(packet)) { + /* + * Datasheet doesn't document behaviour in this error case, and + * there's no error status register we could report it in. + * Log and ignore. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to queue invalid packet %d\n", + packet); + return; + } if (s->tx_fifo_len == NUM_PACKETS) return; s->tx_fifo[s->tx_fifo_len++] = packet; @@ -458,6 +487,13 @@ static void smc91c111_writeb(void *opaque, hwaddr offset, n = s->rx_fifo[0]; else n = s->packet_num; + if (!packetnum_valid(n)) { + /* Datasheet doesn't document what to do here */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to write data to invalid packet %d\n", + n); + return; + } p = s->ptr & 0x07ff; if (s->ptr & 0x4000) { s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); @@ -606,6 +642,13 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset) n = s->rx_fifo[0]; else n = s->packet_num; + if (!packetnum_valid(n)) { + /* Datasheet doesn't document what to do here */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to read data from invalid packet %d\n", + n); + return 0; + } p = s->ptr & 0x07ff; if (s->ptr & 0x4000) { s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); @@ -714,6 +757,8 @@ static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t return -1; s->rx_fifo[s->rx_fifo_len++] = packetnum; + /* allocate_packet() will not hand us back an invalid packet number */ + assert(packetnum_valid(packetnum)); p = &s->data[packetnum][0]; /* ??? Multicast packets? */ status = 0; From patchwork Sat Mar 15 07:42:39 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873864 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1082297wrq; Sat, 15 Mar 2025 00:52:42 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCW09n2isTJNE+BPZ9ND4Ebk9Y6a+/4PNac+2z/10mxD+cnlxHY2xGZXmxcK6nBLYxfeLlxqEg==@linaro.org X-Google-Smtp-Source: AGHT+IHqk4SPVOTc6vCfhyHDvP73fUbq4w2mAN2ttUcch/TkajrWLpt2doNoRm/np8c1U/vqp5nB X-Received: by 2002:a05:620a:31aa:b0:7c5:5d13:f186 with SMTP id af79cd13be357-7c57c79b6eemr605005585a.10.1742025161841; Sat, 15 Mar 2025 00:52:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742025161; cv=none; d=google.com; s=arc-20240605; b=AD2ziTGv7mIftbdmPDZFwuqbcXE5Kmb1fRsbQe9rDF+ovrrXTI+opG4KMBa86WJq0t hjy8LCQ5cjnsFHztMr4o2SsTLcXdAX3IRMtvEjgSH0GyGAGir2uTtZa4Wlu+spaKedv9 wN9hLJSRT8iE2DoLSHNEcNhAHLeLm3NgQXaYUeqFMRTEsxZmuCxLjwv8WxjJKwX1OUgs 3YUWpQBvE4UBkeW0JodtLYogdMmdB6Tp3HH9xjZ3ohVmBuv/QQRYAcfyZ37592rjDBL1 4DjesW/bKVazX4YANH6F7xy9G9DNNez8ZIImPjppazp7CFds82KJe7h9s+W1rtSkKvJr QCfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=/g8n+68a3sXSjQsPCrfrF+wUjJqfqbR0xb5ukhqlrqM=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=aB9Qg5A/scgmtrkoqvtX4J4eAvLJmmAggqsPSovXzHoEqS2Vob0eL5zdV1ggw9Glbv sCfBrta1c4/744cENqisrlECEJZiT0DHYo7IoypJwkSkRzg/eHpYEudw+z472B1Yt8c8 eaGzNug9qa2ywBd9HIbgXw2tQKcojP5dW4r78wg8H4lcwfuQBWuh4Pdi/Q7mEtmcR9JU E+ImWPHakPvdBIB211/doihnJuGd5sF/6pUa0baC6iMHaCVaqtzun4Ef5o0OGmfcpyHm r0WE65wxPbbIBBtf1/gRTYF7PA7M+DeviyP7I+yYSGM2DzkMbDX829MSPSYb75BwbPu3 5qiQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb858294si54864121cf.577.2025.03.15.00.52.41 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:52:41 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMDq-0002dj-3T; Sat, 15 Mar 2025 03:46:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDd-00024B-3a; Sat, 15 Mar 2025 03:46:05 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDZ-0005LN-Jh; Sat, 15 Mar 2025 03:46:04 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1EEDFFFB19; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 0DB171CACE3; Sat, 15 Mar 2025 10:42:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B0FB855A1E; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-8.2.10 37/42] hw/net/smc91c111: Sanitize packet length on tx Date: Sat, 15 Mar 2025 10:42:39 +0300 Message-Id: <20250315074249.634718-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When the smc91c111 transmits a packet, it must read a control byte which is at the end of the data area and CRC. However, we don't sanitize the length field in the packet buffer, so if the guest sets the length field to something large we will try to read past the end of the packet data buffer when we access the control byte. As usual, the datasheet says nothing about the behaviour of the hardware if the guest misprograms it in this way. It says only that the maximum valid length is 2048 bytes. We choose to log the guest error and silently drop the packet. This requires us to factor out the "mark the tx packet as complete" logic, so we can call it for this "drop packet" case as well as at the end of the loop when we send a valid packet. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2742 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228174802.1945417-3-peter.maydell@linaro.org> [PMD: Update smc91c111_do_tx() as len > MAX_PACKET_SIZE] Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit aad6f264add3f2be72acb660816588fe09110069) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 3a3cfa1f6a..36415425db 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -23,6 +23,13 @@ /* Number of 2k memory pages available. */ #define NUM_PACKETS 4 +/* + * Maximum size of a data frame, including the leading status word + * and byte count fields and the trailing CRC, last data byte + * and control byte (per figure 8-1 in the Microchip Technology + * LAN91C111 datasheet). + */ +#define MAX_PACKET_SIZE 2048 #define TYPE_SMC91C111 "smc91c111" OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111) @@ -241,6 +248,16 @@ static void smc91c111_release_packet(smc91c111_state *s, int packet) smc91c111_flush_queued_packets(s); } +static void smc91c111_complete_tx_packet(smc91c111_state *s, int packetnum) +{ + if (s->ctr & CTR_AUTO_RELEASE) { + /* Race? */ + smc91c111_release_packet(s, packetnum); + } else if (s->tx_fifo_done_len < NUM_PACKETS) { + s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; + } +} + /* Flush the TX FIFO. */ static void smc91c111_do_tx(smc91c111_state *s) { @@ -264,6 +281,17 @@ static void smc91c111_do_tx(smc91c111_state *s) *(p++) = 0x40; len = *(p++); len |= ((int)*(p++)) << 8; + if (len > MAX_PACKET_SIZE) { + /* + * Datasheet doesn't say what to do here, and there is no + * relevant tx error condition listed. Log, and drop the packet. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: tx packet with bad length %d, dropping\n", + len); + smc91c111_complete_tx_packet(s, packetnum); + continue; + } len -= 6; control = p[len + 1]; if (control & 0x20) @@ -292,11 +320,7 @@ static void smc91c111_do_tx(smc91c111_state *s) } } #endif - if (s->ctr & CTR_AUTO_RELEASE) - /* Race? */ - smc91c111_release_packet(s, packetnum); - else if (s->tx_fifo_done_len < NUM_PACKETS) - s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; + smc91c111_complete_tx_packet(s, packetnum); qemu_send_packet(qemu_get_queue(s->nic), p, len); } s->tx_fifo_len = 0; From patchwork Sat Mar 15 07:42:40 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873858 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1081282wrq; Sat, 15 Mar 2025 00:48:16 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV4Lye2JnuCNEz23RqsQKyDgmsPmuOGlglW4UiYfGWXf1N0G2+Nk6glDPKNOSqfyiTm1Tpmhg==@linaro.org X-Google-Smtp-Source: AGHT+IFOdRbuVBWHJZ+pRo9Iq+lGTM/zZe+YzZflEjBQUo4ez3M4ImZeo3oe0uSzHqHn2QuDHDxi X-Received: by 2002:a0c:c203:0:b0:6e8:ff2a:a658 with SMTP id 6a1803df08f44-6eaea9e9168mr55378366d6.5.1742024896092; Sat, 15 Mar 2025 00:48:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024896; cv=none; d=google.com; s=arc-20240605; b=Rr8qIzo8gaxszxaQ0+3jVSI6Fv3a+Ag97YREry2wknicOcA+uvIR8NC2dwmFwwRO43 Y7I3Ft/b9+KRdgooHEtxsFzK/vSCQd8O5dF22KxIQh3HjsfxX8NhGncePiRB9QnJHd7Y S/y+u9ubOVh1cIkeGsIJ7kDZ56jYa0hVt1IX4EcKQfHSV+VJ6mAplp895lCFYnsDjMQm Dzend86w639HpmhRMA8mcBXMKKJ2G05FwoAjDhusypzO3xRFue97qAAunAJxFSZprz3k ccrFXFzYIgi8XnS6CdjIlfvKeHZg8ai4s76mdQvSOIt38mKkVpQV6dfRWuPC4jcY6U0U q6vg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=ZPRLGOkgAA0VClANvoTgkqEGsunXUjyiVYT6Ai5pdGY=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=H/jt2iE+z9gbn4W6ttPNDorqw2lDzIMy5d2SiFj0B+5Z0pGezWCkdrT9mQuk/0VGza 8RMzv8odVdNjU5m3dWEdFlKKdtPhbcaR+vJgFloMty/ucMzINJLDKA5dfJgw7s5Jwir0 hscDNb8H6rv0fuFg9vUcR4auXlXYHvFMMvJPjyc5wfrFy+ZCcPGCAh5ACc85NA3J4qZm v8FiVgc5qn+nvp1I2eDjo2ZbKREBiXGuncgAPcOJkNd8pr3Zv3ba4fM/+43zi3BPyRPc 83N4C0t05lZHvXmr41hP6CbnxhszFmHTtBKwDwW8KYzrGh6yGOI2myWE03pOJLhv0CD0 y+qg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade3706c8si51976586d6.427.2025.03.15.00.48.15 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:48:16 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMDx-0003Lr-Rl; Sat, 15 Mar 2025 03:46:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDf-0002BS-Hy; Sat, 15 Mar 2025 03:46:08 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDd-0005Lk-1U; Sat, 15 Mar 2025 03:46:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 22C35FFB1A; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 118761CACE4; Sat, 15 Mar 2025 10:42:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B3AA455A20; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-8.2.10 38/42] hw/net/smc91c111: Don't allow data register access to overrun buffer Date: Sat, 15 Mar 2025 10:42:40 +0300 Message-Id: <20250315074249.634718-38-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell For accesses to the 91c111 data register, the address within the packet's data frame is determined by a combination of the pointer register and the offset used to access the data register, so that you can access data at effectively wider than byte width. The pointer register's pointer field is 11 bits wide, which is exactly the size to index a 2048-byte data frame. We weren't quite getting the logic right for ensuring that we end up with a pointer value to use in the s->data[][] array that isn't out of bounds: * we correctly mask when getting the initial pointer value * for the "autoincrement the pointer register" case, we correctly mask after adding 1 so that the pointer register wraps back around at the 2048 byte mark * but for the non-autoincrement case where we have to add the low 2 bits of the data register offset, we don't account for the possibility that the pointer register is 0x7ff and the addition should wrap Fix this bug by factoring out the "get the p value to use as an array index" into a function, making it use FIELD macro names rather than hard-coded constants, and having a utility function that does "add a value and wrap it" that we can use both for the "autoincrement" and "add the offset bits" codepaths. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2758 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228191652.1957208-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 700d3d6dd41de3bd3f1153e3cfe00b93f99b1441) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 36415425db..22b3cede5c 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -13,6 +13,7 @@ #include "net/net.h" #include "hw/irq.h" #include "hw/net/smc91c111.h" +#include "hw/registerfields.h" #include "hw/qdev-properties.h" #include "qapi/error.h" #include "qemu/log.h" @@ -126,6 +127,13 @@ static const VMStateDescription vmstate_smc91c111 = { #define RS_TOOSHORT 0x0400 #define RS_MULTICAST 0x0001 +FIELD(PTR, PTR, 0, 11) +FIELD(PTR, NOT_EMPTY, 11, 1) +FIELD(PTR, RESERVED, 12, 1) +FIELD(PTR, READ, 13, 1) +FIELD(PTR, AUTOINCR, 14, 1) +FIELD(PTR, RCV, 15, 1) + static inline bool packetnum_valid(int packet_num) { return packet_num >= 0 && packet_num < NUM_PACKETS; @@ -372,6 +380,49 @@ static void smc91c111_reset(DeviceState *dev) #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8) +/* + * The pointer register's pointer is an 11 bit value (so it exactly + * indexes a 2048-byte data frame). Add the specified offset to it, + * wrapping around at the 2048 byte mark, and return the resulting + * wrapped value. There are flag bits in the top part of the register, + * but we can ignore them here as the mask will mask them out. + */ +static int ptr_reg_add(smc91c111_state *s, int offset) +{ + return (s->ptr + offset) & R_PTR_PTR_MASK; +} + +/* + * For an access to the Data Register at @offset, return the + * required offset into the packet's data frame. This will + * perform the pointer register autoincrement if required, and + * guarantees to return an in-bounds offset. + */ +static int data_reg_ptr(smc91c111_state *s, int offset) +{ + int p; + + if (s->ptr & R_PTR_AUTOINCR_MASK) { + /* + * Autoincrement: use the current pointer value, and + * increment the pointer register's pointer field. + */ + p = FIELD_EX32(s->ptr, PTR, PTR); + s->ptr = FIELD_DP32(s->ptr, PTR, PTR, ptr_reg_add(s, 1)); + } else { + /* + * No autoincrement: register offset determines which + * byte we're addressing. Setting the pointer to the top + * of the data buffer and then using the pointer wrapping + * to read the bottom byte of the buffer is not something + * sensible guest software will do, but the datasheet + * doesn't say what the behaviour is, so we don't forbid it. + */ + p = ptr_reg_add(s, offset & 3); + } + return p; +} + static void smc91c111_writeb(void *opaque, hwaddr offset, uint32_t value) { @@ -518,12 +569,7 @@ static void smc91c111_writeb(void *opaque, hwaddr offset, n); return; } - p = s->ptr & 0x07ff; - if (s->ptr & 0x4000) { - s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); - } else { - p += (offset & 3); - } + p = data_reg_ptr(s, offset); s->data[n][p] = value; } return; @@ -673,12 +719,7 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset) n); return 0; } - p = s->ptr & 0x07ff; - if (s->ptr & 0x4000) { - s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); - } else { - p += (offset & 3); - } + p = data_reg_ptr(s, offset); return s->data[n][p]; } case 12: /* Interrupt status. */ From patchwork Sat Mar 15 07:42:41 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873860 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1081530wrq; Sat, 15 Mar 2025 00:49:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXiPG0SdLtXFBqZ/GfCQgJ5xINzBj7ALJn3csCsUHDgpQI7IZOyUPCdf+2QUXll5wghu/0OQg==@linaro.org X-Google-Smtp-Source: AGHT+IEO+xBqFTYPSBkuD0ozvwYWmCTqWygzkm34CVJCZyegvWH+oqHG4Z5s8T679gUaWEVMk4B4 X-Received: by 2002:a05:622a:56:b0:472:28d:62b0 with SMTP id d75a77b69052e-476c81c4a77mr91617721cf.41.1742024947428; Sat, 15 Mar 2025 00:49:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742024947; cv=none; d=google.com; s=arc-20240605; b=F6p8mRU+9k1/uRtyLWeQJ0hpNNwZowjlU774RVK/0PZB1i4w/uy1E+Vcyu1PAlAo5w 03hxeSgcC5AgkwKXCziwO+7IfP8UkW4r/QT4zEGzcC4Rgh9zhKM+fkSEHmEMxGhGXqEl olHtVHzF3Hl84MZ4JvJIEEPhHfSGAFz3ZcZwXlswLHEwiX/pJxPtzuRN2+8Q5q736PQc SPZsdbS/Z6mDCnvzQU0EIBPOVCK4dwofGd831EQxiUJW9ipMnfleTLx+LA48sfCIcwSn Lo1qFoKps0crHfN56mDhDGJSyKW5b6BoGV+0lA9KZmcrcGsxd7z+UG/t+7im/wpU27o9 2HAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=uK2VWVCcjUT6XG8AvCzRCURo35eF/LydgZUNC+/RupQ=; fh=inIU3bgjueJc/0tVVGuzaeZ4IMkZrXwNnxEmi4ce+ts=; b=DcXA7rwSgEM8Ua6cGy8ReLPwrFg6ONUsFUPvEQP2bciaZjb8bqyX9un4zMcW31p4XV RQ0aFPR5t7LHELn+LJYS0GerBzgQpwxwbBzQd+AG8S7vCsY80Pt+GlvlLC2wvVngPw7M Uah9yMVAxQ7sHheheQkHLWT9GWpL4+ZPOLIzO3exsKqUD1AP/LEHkwW9DDpbFuDMwnyf mitZUJuOddJqokSXr4cFdS7GhWbVUbizAEoMskx2uV6XV7XjYRC58gbS8kr7Outp8QT1 98UEnNdvCYJPewTa3lOX+/X2hnbfZtSgMiyzjkE7tTP5aoqRIeI+8tCEuBzgqrHpD5W7 Ek8g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb617cc6si51230581cf.10.2025.03.15.00.49.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:49:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttME5-0003ox-6m; Sat, 15 Mar 2025 03:46:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttME0-0003bR-8T; Sat, 15 Mar 2025 03:46:29 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttMDy-0005M0-LW; Sat, 15 Mar 2025 03:46:27 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 26A9EFFB1B; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 157031CACE5; Sat, 15 Mar 2025 10:42:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id B617255A22; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Pierrick Bouvier , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.10 39/42] hw/xen/hvm: Fix Aarch64 typo Date: Sat, 15 Mar 2025 10:42:41 +0300 Message-Id: <20250315074249.634718-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé There is no TARGET_ARM_64 definition. Luckily enough, when TARGET_AARCH64 is defined, TARGET_ARM also is. Fixes: 733766cd373 ("hw/arm: introduce xenpvh machine") Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Pierrick Bouvier Reviewed-by: Richard Henderson Message-Id: <20250305153929.43687-2-philmd@linaro.org> (cherry picked from commit 3a11b653a63fee0e43f4ab84b93f068b961d8fe7) Signed-off-by: Michael Tokarev diff --git a/include/hw/xen/arch_hvm.h b/include/hw/xen/arch_hvm.h index c7c515220d..df39c819c8 100644 --- a/include/hw/xen/arch_hvm.h +++ b/include/hw/xen/arch_hvm.h @@ -1,5 +1,5 @@ #if defined(TARGET_I386) || defined(TARGET_X86_64) #include "hw/i386/xen_arch_hvm.h" -#elif defined(TARGET_ARM) || defined(TARGET_ARM_64) +#elif defined(TARGET_ARM) || defined(TARGET_AARCH64) #include "hw/arm/xen_arch_hvm.h" #endif From patchwork Sat Mar 15 07:42:44 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873863 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1082278wrq; Sat, 15 Mar 2025 00:52:35 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVfAqdjz2jwa/xrj87fcjsQYLDEMYE/UTYV1TDpDZpMnjzkXSOJjkev3mNChgpp3q5/qx4Skw==@linaro.org X-Google-Smtp-Source: AGHT+IFVcL6VclWsGWYFTLEEvY/MRpctiSPQBau2D+n5NV26lKllXqVC6EURRXrxpi0hrp9Fm3Rg X-Received: by 2002:a05:620a:28c2:b0:7c5:5fa0:4617 with SMTP id af79cd13be357-7c57c8c0489mr710433785a.40.1742025155241; Sat, 15 Mar 2025 00:52:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742025155; cv=none; d=google.com; s=arc-20240605; b=JxmCvQUS2nemblSNKipv8yPlABbrJPkt37e2z4He2e3hqTg27gnsK2iD5Raxn5+I35 YOaSb7fzFFSdu/NL4/ZHHp4YgCoHYU0+rNMYKY7uPFynM5ww8acDbNpB1BsG7XueV8lC hlRLBEruoE8j6E3aDYy1ZRkQT49bUxxyTIn5NiygHMjqyREpvEpF40Hjrm2lbwP9c6ep l6M7Z5Yln284DKhkw98i5lmPNU7TflXrg26ChiFazZlUhUQehBKRYrZXEx/oVrhymZz2 66VHfYdgEjWR4wTeRL9RDT9rs+Srh90RTkSInm3UNCjFSxIfkcHlFagsxyCYdaSazBBs Lo1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=Bqf895SQwfcuALHhlQIGLo9uG8bt2f/rIs3KHMgzQ3Y=; fh=5oVmStqGuoGWv45/EbxONKrPK29uvxtzTFtoCqy9TIA=; b=FPOKrw/Qu2kTMq87BwafeT0rDfTX22qE/haRR+v7xuw4NFvGqBRIFv7sl5SD5ADqw8 E36rg2qyGm9My9D20TvKFxO0JLbFRLShg/J+sQwE4/SEhBF+oZHEk0HBGdaL3rJOTgWo 2szB7heTG6fecjsOBLT7FF2IAyzuuatsLdEpOujlxFw2bCdmbMUQ/QxR1YKciyItjQWw V/9ULeWpZ5d1k5I3Ioeecu//8+a5mVLTvKRlQV6fzxtePS4lzbOCqxOF3oQio1wpDGVJ zOLb6rnMuPha8lj8D07qEh2wXO1usv7PLRAfIzdul0D5dOirn+AINrLZLGjf7mujLLMP nF+g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b72f8esi589641585a.114.2025.03.15.00.52.35 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 00:52:35 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttMEE-0004HL-Gi; Sat, 15 Mar 2025 03:46:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttME6-00042T-UH; Sat, 15 Mar 2025 03:46:35 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttME4-0005OX-OD; Sat, 15 Mar 2025 03:46:34 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 32699FFB1E; Sat, 15 Mar 2025 10:41:56 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 213421CACE8; Sat, 15 Mar 2025 10:42:50 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id BD53655A28; Sat, 15 Mar 2025 10:42:49 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Phil Dennis-Jordan , Michael Tokarev Subject: [Stable-8.2.10 42/42] ui/cocoa: Temporarily ignore annoying deprecated declaration warnings Date: Sat, 15 Mar 2025 10:42:44 +0300 Message-Id: <20250315074249.634718-42-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé These warnings are breaking some build configurations since 2 months now (https://gitlab.com/qemu-project/qemu/-/issues/2575): ui/cocoa.m:662:14: error: 'CVDisplayLinkCreateWithCGDisplay' is deprecated: first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:), or NSScreen.displayLink(target:selector:) [-Werror,-Wdeprecated-declarations] 662 | if (!CVDisplayLinkCreateWithCGDisplay(display, &displayLink)) { | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:89:20: note: 'CVDisplayLinkCreateWithCGDisplay' has been explicitly marked deprecated here 89 | CV_EXPORT CVReturn CVDisplayLinkCreateWithCGDisplay( | ^ ui/cocoa.m:663:29: error: 'CVDisplayLinkGetNominalOutputVideoRefreshPeriod' is deprecated: first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:), or NSScreen.displayLink(target:selector:) [-Werror,-Wdeprecated-declarations] 663 | CVTime period = CVDisplayLinkGetNominalOutputVideoRefreshPeriod(displayLink); | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:182:18: note: 'CVDisplayLinkGetNominalOutputVideoRefreshPeriod' has been explicitly marked deprecated here 182 | CV_EXPORT CVTime CVDisplayLinkGetNominalOutputVideoRefreshPeriod( CVDisplayLinkRef CV_NONNULL displayLink ); | ^ ui/cocoa.m:664:13: error: 'CVDisplayLinkRelease' is deprecated: first deprecated in macOS 15.0 - use NSView.displayLink(target:selector:), NSWindow.displayLink(target:selector:), or NSScreen.displayLink(target:selector:) [-Werror,-Wdeprecated-declarations] 664 | CVDisplayLinkRelease(displayLink); | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreVideo.framework/Headers/CVDisplayLink.h:249:16: note: 'CVDisplayLinkRelease' has been explicitly marked deprecated here 249 | CV_EXPORT void CVDisplayLinkRelease( CV_RELEASES_ARGUMENT CVDisplayLinkRef CV_NULLABLE displayLink ); | ^ 3 errors generated. For the next release, ignore the warnings using #pragma directives. At least until we figure the correct new API usage. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Phil Dennis-Jordan Tested-by: Phil Dennis-Jordan Message-Id: <20241121131954.98949-1-philmd@linaro.org> (cherry picked from commit 9cf6e41fe293dd56089faac94c36ff5cb3d96726) Signed-off-by: Michael Tokarev diff --git a/ui/cocoa.m b/ui/cocoa.m index d39c9e2a3b..4bca03ae1a 100644 --- a/ui/cocoa.m +++ b/ui/cocoa.m @@ -553,6 +553,9 @@ - (void) setContentDimensions } } +#pragma clang diagnostic push +#pragma clang diagnostic ignored "-Wdeprecated-declarations" + - (void) updateUIInfoLocked { /* Must be called with the iothread lock, i.e. via updateUIInfo */ @@ -598,6 +601,8 @@ - (void) updateUIInfoLocked dpy_set_ui_info(dcl.con, &info, TRUE); } +#pragma clang diagnostic pop + - (void) updateUIInfo { if (!allow_events) {