From patchwork Tue Mar 25 06:50:24 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 875989 Delivered-To: patch@linaro.org Received: by 2002:a5d:5f4c:0:b0:38f:210b:807b with SMTP id cm12csp2504590wrb; Mon, 24 Mar 2025 23:56:03 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXqPRqT7/1APVeo5ZBFAA0rZEqaJdC3Z7FXhCJXFU5j3WUFSNp6td6n5Q/C6M+zcomvsmWHyQ==@linaro.org X-Google-Smtp-Source: AGHT+IFKa3Ln/gj9REFQT+qrZs1kvSImCOGmZ8mNVGJrAlY/J0T6GMqJ+xpBLhLmJL7C2NIn/U2L X-Received: by 2002:a5d:64a8:0:b0:391:4914:3c6a with SMTP id ffacd0b85a97d-3997f913190mr13751470f8f.29.1742885762870; Mon, 24 Mar 2025 23:56:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742885762; cv=none; d=google.com; s=arc-20240605; b=ViuoUcYqOc3bEjQzDsYDfvhxGmTSOuKJlwVsm8WmX4gEp5XuBvBiuYryplmYztUAlJ 4PCKUniEd/xuFzQ+G1YUiNEROPN8CJbYdidF4Bw0+rEG9ESxcWdh74ncHFC6Ir0HSe+x I/rA6P5WImrlT7cenNLCHfjqfkgthYScRtFbeyRuJ+sj4V9YIH0UmMdTX8Hfrn/fzHe0 4MkCX+8lKVMvDOAekCVVvfWcwULopQyJro05GqF4tR+6aChhWli0hBRrt7vE/AqsV1dB ykykkUfskmUXxGjqczm4fxTDTNgR73A/EYvodcWfeJsnIJAyF4tjkOMB2G3Ny9Vq/UZA X2Tg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=SEOzHDbijm3nml7DmPfsZTpnmEC+zVjDxAZyDpAupfg=; fh=NoJ7n5JVE2hviRF6uNBFRIJvWH7igafuy1AIwg26ToM=; b=I8db7t+wjz23aMusJfUXRd0BMn7qeSLTTzukW27KPerV/sbRjT88vz/GGBeBIWaY1f yMBRDXjhCPw464Di/WJzONEJnppY/relb4sOItz5omYzaDOOJUQRES44JI/ZBCVyUovt UvKGfDRiU3D2UmN5PXX1kyQvfUeq3tWvvMyk181nV0pHuJJToKNQ0VljXWm2OEG0TPJH I1u6Q0EAjxzl1hx4FUS26PwyfCvbs8cIjYJJvhQwmN1OR16DkbGEIBENV/BR+rOskBc7 US8Of5itEH/Xkr/eHboM5iIXb2EJeQAhTmUCdwYjrV6UYBtO3R6axCFfRVBw0xIYjmr6 Hw3Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id ffacd0b85a97d-3997f9e383asi7010782f8f.780.2025.03.24.23.56.02 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 24 Mar 2025 23:56:02 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1twy7h-0004YZ-3W; Tue, 25 Mar 2025 02:50:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1twy7f-0004Y7-LY; Tue, 25 Mar 2025 02:50:51 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1twy7d-0001dQ-B0; Tue, 25 Mar 2025 02:50:51 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9EF2C107D62; Tue, 25 Mar 2025 09:49:21 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 41B5B1D5E71; Tue, 25 Mar 2025 09:50:31 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 3313F5702A; Tue, 25 Mar 2025 09:50:31 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Peter Maydell , Michael Tokarev Subject: [Stable-7.2.17 29/34] target/arm: Make DisasContext.{fp, sve}_access_checked tristate Date: Tue, 25 Mar 2025 09:50:24 +0300 Message-Id: <20250325065031.3263718-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson The check for fp_excp_el in assert_fp_access_checked is incorrect. For SME, with StreamingMode enabled, the access is really against the streaming mode vectors, and access to the normal fp registers is allowed to be disabled. C.f. sme_enabled_check. Convert sve_access_checked to match, even though we don't currently check the exception state. Cc: qemu-stable@nongnu.org Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks") Signed-off-by: Richard Henderson Message-id: 20250307190415.982049-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 298a04998fa4a6dc977abe9234d98dfcdab98423) (Mjt: minor context fix in target/arm/tcg/translate.h, target/arm/tcg/translate-a64.c is target/arm/translate-a64.c) Signed-off-by: Michael Tokarev diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index f0b8db7ce5..00463a1e35 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -1176,14 +1176,14 @@ static bool fp_access_check_only(DisasContext *s) { if (s->fp_excp_el) { assert(!s->fp_access_checked); - s->fp_access_checked = true; + s->fp_access_checked = -1; gen_exception_insn_el(s, 0, EXCP_UDEF, syn_fp_access_trap(1, 0xe, false, 0), s->fp_excp_el); return false; } - s->fp_access_checked = true; + s->fp_access_checked = 1; return true; } @@ -1217,13 +1217,13 @@ bool sve_access_check(DisasContext *s) syn_sve_access_trap(), s->sve_excp_el); goto fail_exit; } - s->sve_access_checked = true; + s->sve_access_checked = 1; return fp_access_check(s); fail_exit: /* Assert that we only raise one exception per instruction. */ assert(!s->sve_access_checked); - s->sve_access_checked = true; + s->sve_access_checked = -1; return false; } @@ -1252,8 +1252,9 @@ bool sme_enabled_check(DisasContext *s) * sme_excp_el by itself for cpregs access checks. */ if (!s->fp_excp_el || s->sme_excp_el < s->fp_excp_el) { - s->fp_access_checked = true; - return sme_access_check(s); + bool ret = sme_access_check(s); + s->fp_access_checked = (ret ? 1 : -1); + return ret; } return fp_access_check_only(s); } @@ -14870,8 +14871,8 @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu) s->insn = insn; s->base.pc_next = pc + 4; - s->fp_access_checked = false; - s->sve_access_checked = false; + s->fp_access_checked = 0; + s->sve_access_checked = 0; if (s->pstate_il) { /* diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h index ad3762d1ac..f01d2d973c 100644 --- a/target/arm/translate-a64.h +++ b/target/arm/translate-a64.h @@ -66,7 +66,7 @@ TCGv_i64 gen_mte_checkN(DisasContext *s, TCGv_i64 addr, bool is_write, static inline void assert_fp_access_checked(DisasContext *s) { #ifdef CONFIG_DEBUG_TCG - if (unlikely(!s->fp_access_checked || s->fp_excp_el)) { + if (unlikely(s->fp_access_checked <= 0)) { fprintf(stderr, "target-arm: FP access check missing for " "instruction 0x%08x\n", s->insn); abort(); diff --git a/target/arm/translate.h b/target/arm/translate.h index 3cdc7dbc2f..3856df8060 100644 --- a/target/arm/translate.h +++ b/target/arm/translate.h @@ -85,15 +85,19 @@ typedef struct DisasContext { uint64_t features; /* CPU features bits */ bool aarch64; bool thumb; - /* Because unallocated encodings generate different exception syndrome + /* + * Because unallocated encodings generate different exception syndrome * information from traps due to FP being disabled, we can't do a single * "is fp access disabled" check at a high level in the decode tree. * To help in catching bugs where the access check was forgotten in some * code path, we set this flag when the access check is done, and assert * that it is set at the point where we actually touch the FP regs. + * 0: not checked, + * 1: checked, access ok + * -1: checked, access denied */ - bool fp_access_checked; - bool sve_access_checked; + int8_t fp_access_checked; + int8_t sve_access_checked; /* ARMv8 single-step state (this is distinct from the QEMU gdbstub * single-step support). */