From patchwork Fri Sep 6 05:15:51 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825901 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp638168wrb; Thu, 5 Sep 2024 22:20:50 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVP0YCzxT3Hh/NsobNtsndDk4c+FFx7Q/mqNHRrlN3pu/YYsgxK54bpf8nVHtPs2UsUWleCSQ==@linaro.org X-Google-Smtp-Source: AGHT+IGUtme1ggrtIDoqM0Rsm1JzTI4JZwtfLOTg3ppWVtYYQ9Mr1zE0jIpswwElOgaUQXHUoJZU X-Received: by 2002:a05:620a:450e:b0:7a7:df2a:63c8 with SMTP id af79cd13be357-7a99732f45fmr143396085a.23.1725600050206; Thu, 05 Sep 2024 22:20:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600050; cv=none; d=google.com; s=arc-20240605; b=Zo38ttOJ4fidXawKFJD4kznFxee0QLGOHA8U9AXPCh1V/wye7MorrsxGDHnbWWUV1X 94TVJkx3ZcgSDw+rcomqT4cswZ/1fRqEy7Da68CMvwBMG/mjVq7Wu580I9eE/q9rljNO CGOQRhaDuKr2+9dPIfWXJw4Q65H1oPQQ3guOKMPN30a1rQQAqOv6U5mqiL5vCLeqnv4p wPOHCBDhxntNWcabFX7zxTJsPRa4WE3uJJ40lvYg/hL9SrvOiaJlnlc/VWKND340XDRU uUS6jQizpBz6vvENnSWQyIV/ZjVaCti5L/bxvsLdX+ZcbAPLBTQlWXalp2i49QB50ahb a/fA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=nSI26V6/OYeSFmQp5BagzwvslihiM/Ir1hFQkTTspuw=; fh=xcz4BIk6UKjOo0wG05W3ZY0KrLZqRuYba2k7grc93iY=; b=KzwTSddt2fAuKROJmHkYSqjM5O7sGMsgaLbOmQPT09516SmnoiUQgQsP6GL1x5EBhN kM5JFXXpt4Mne9OYxnUM6Lej5/suFWUjHQPxTRZb+EpuamZ3wfmhMkytjHpdHsYXa6iu /5WpPHaxOOiYeqH4Wyt89+rRdle7bkohRM1modtnxP7MajLwEWetvXI7bS+YaXZV3i3+ yIHyYSx5pAusxBD0QidJ/MuWQhdxgYZTGr93u6ETt/Nq2BCTvp98JFQXrxB9fumY0Mw+ 31uQVX/GuHxkekRPGIjZ4mkG1m2Th/x2aN8Ris01qgKO6bNRcEHhtnimNBCQHDS/kWkz 6ZXQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98efe8957si361937885a.281.2024.09.05.22.20.50 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:20:50 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRLX-0004DY-NU; Fri, 06 Sep 2024 01:17:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRL3-0003uU-Uk; Fri, 06 Sep 2024 01:16:55 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRKy-0007jg-Tm; Fri, 06 Sep 2024 01:16:51 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 547938C117; Fri, 6 Sep 2024 08:15:16 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 0240713335D; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10393 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Daniyal Khan , =?utf-8?q?Alex_Benn=C3=A9e?= , Peter Maydell , Michael Tokarev Subject: [Stable-7.2.14 03/40] target/arm: Use FPST_F16 for SME FMOPA (widening) Date: Fri, 6 Sep 2024 08:15:51 +0300 Message-Id: <20240906051633.10288-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson This operation has float16 inputs and thus must use the FZ16 control not the FZ control. Cc: qemu-stable@nongnu.org Fixes: 3916841ac75 ("target/arm: Implement FMOPA, FMOPS (widening)") Reported-by: Daniyal Khan Signed-off-by: Richard Henderson Reviewed-by: Alex Bennée Message-id: 20240717060149.204788-3-richard.henderson@linaro.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2374 Signed-off-by: Richard Henderson Reviewed-by: Alex Bennée Signed-off-by: Peter Maydell (cherry picked from commit 207d30b5fdb5b45a36f26eefcf52fe2c1714dd4f) Signed-off-by: Michael Tokarev diff --git a/target/arm/translate-sme.c b/target/arm/translate-sme.c index 65f8495bdd..8cce34e117 100644 --- a/target/arm/translate-sme.c +++ b/target/arm/translate-sme.c @@ -340,6 +340,7 @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz, } static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, + ARMFPStatusFlavour e_fpst, gen_helper_gvec_5_ptr *fn) { int svl = streaming_vec_reg_size(s); @@ -355,7 +356,7 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, zm = vec_full_reg_ptr(s, a->zm); pn = pred_full_reg_ptr(s, a->pn); pm = pred_full_reg_ptr(s, a->pm); - fpst = fpstatus_ptr(FPST_FPCR); + fpst = fpstatus_ptr(e_fpst); fn(za, zn, zm, pn, pm, fpst, tcg_constant_i32(desc)); @@ -367,9 +368,12 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, return true; } -TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, MO_32, gen_helper_sme_fmopa_h) -TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, gen_helper_sme_fmopa_s) -TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, MO_64, gen_helper_sme_fmopa_d) +TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, + MO_32, FPST_FPCR_F16, gen_helper_sme_fmopa_h) +TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, + MO_32, FPST_FPCR, gen_helper_sme_fmopa_s) +TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, + MO_64, FPST_FPCR, gen_helper_sme_fmopa_d) /* TODO: FEAT_EBF16 */ TRANS_FEAT(BFMOPA, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_bfmopa) From patchwork Fri Sep 6 05:15:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825897 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp637812wrb; Thu, 5 Sep 2024 22:19:45 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVCi7fWLwzPgwaABlpBxidc/boKXlL6+k0+x2ozegJeeujtFUBu1Iof3/WyFSh3QwYIprp4tw==@linaro.org X-Google-Smtp-Source: AGHT+IG9vx0c+eYOm01QXvuj2U3akxANxrQlz9b02ugw9vIZRzWBiA+MQtGsv7QABWjRLECcgn+r X-Received: by 2002:a05:620a:170d:b0:79d:7cfb:884e with SMTP id af79cd13be357-7a9973284efmr155447985a.4.1725599985326; Thu, 05 Sep 2024 22:19:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725599985; cv=none; d=google.com; s=arc-20240605; b=IIpkQ8Ury8tIj/ARQW6HMPvoBbAuqL8dqpEd1bPnzJkhhJUws3W5vrs1+fRO0EGaRf CboKPQ00+0pyqelK8ygPHrvWfsk6qQX69yjJ10AY0cJmbdM5nUKSSVwWbDamiX25wfLO ZxMsDTQmX7WP3t0VaIHpGNP42ov02JPnDRuDneK4By0G0bWNOpsrxUmzDj8ZaxV+HcA7 3kXQ4+irj8PTQlHjfeZWGMIskPLpE2PKIB5Sf6ihcdZGt6FshoALkPcvjLLZKXVPFvAw LVWZIG3l8pDjfAOYyuIsDsP5C9U/p+hyrSirQdfqJlIp/IVZXU4+CmlHlqfxyh8YaOf/ BDEQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=6vdZGZnr4aaZ5SGU4AcjaXQ9baNkMXpPH2FPAI1Joyo=; fh=OJ0ls6GFiMU4hHpJ98tlecWoPYidhilmxQvB4+9yVtk=; b=Z7wMSkx97SOKZM9/xdFM8kGFi9cuyc69aBjL7AzUSNMZBb7favpz5CpUdSIle7hJBW NInTAkBuX9FOv5IKu1yqKXvNm2vPtHuIrTzmciO3GInYxhrPdaoocn/prbB8eyMFO9ET gFVbx9cu2okBuXG8nOImIO7viDjrpX6JioX0FVTuS61k71dTXefrTVNX5gHlwhlSIL/E X40Kna+IHHCCZUCz3AYCR0LSwKrqiQb5fhYInrju3DgOchbsEAaTaDA2dfCuRIQectVf XFiOE48pstKHarOCzMJhUP9pTG7Rng9MpnhKEzd/RuH2JoeVVzYLTgY6Wls9iPVG1CH2 C0XA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98ef1e036si366365585a.104.2024.09.05.22.19.45 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:19:45 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRLm-00057a-8X; Fri, 06 Sep 2024 01:17:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLL-000407-Tn; Fri, 06 Sep 2024 01:17:17 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLG-0007sb-ID; Fri, 06 Sep 2024 01:17:07 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C058E8C11E; Fri, 6 Sep 2024 08:15:16 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 6FACC133364; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10414 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Stefan Hajnoczi , Michael Tokarev Subject: [Stable-7.2.14 10/40] util/async.c: Forbid negative min/max in aio_context_set_thread_pool_params() Date: Fri, 6 Sep 2024 08:15:58 +0300 Message-Id: <20240906051633.10288-10-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell aio_context_set_thread_pool_params() takes two int64_t arguments to set the minimum and maximum number of threads in the pool. We do some bounds checking on these, but we don't catch the case where the inputs are negative. This means that later in the function when we assign these inputs to the AioContext::thread_pool_min and ::thread_pool_max fields, which are of type int, the values might overflow the smaller type. A negative number of threads is meaningless, so make aio_context_set_thread_pool_params() return an error if either min or max are negative. Resolves: Coverity CID 1547605 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20240723150927.1396456-1-peter.maydell@linaro.org Signed-off-by: Stefan Hajnoczi (cherry picked from commit 851495571d14fe2226c52b9d423f88a4f5460836) Signed-off-by: Michael Tokarev diff --git a/util/async.c b/util/async.c index a1f07fc5a7..0cc3037e0c 100644 --- a/util/async.c +++ b/util/async.c @@ -744,7 +744,7 @@ void aio_context_set_thread_pool_params(AioContext *ctx, int64_t min, int64_t max, Error **errp) { - if (min > max || !max || min > INT_MAX || max > INT_MAX) { + if (min > max || max <= 0 || min < 0 || min > INT_MAX || max > INT_MAX) { error_setg(errp, "bad thread-pool-min/thread-pool-max values"); return; } From patchwork Fri Sep 6 05:16:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825906 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp639472wrb; Thu, 5 Sep 2024 22:26:48 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXmw64sXdaRgz2dZCUzNW+uLohoqlanWFsKDopmnsK9GOU0DSfHalsNizDMCIMoqJUdMaICvQ==@linaro.org X-Google-Smtp-Source: AGHT+IHzeLqmPlQ/D9X6yZo/v5AULJZQtXeTyg+TdehyEQg43BYqhOJ0f3d9AzFihg3yr2owvoDT X-Received: by 2002:a05:620a:4591:b0:7a6:7613:3883 with SMTP id af79cd13be357-7a98887363fmr1319855585a.2.1725600408139; Thu, 05 Sep 2024 22:26:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600408; cv=none; d=google.com; s=arc-20240605; b=NiO7hwKZbNj2+fhM3Sb/fHwMoPXpxn2k4q1xj7nD+KSh1LdwzV3dVE8ZWuWrFdWUlF 39+0Sk475DjnwATLyXKEQAYp7rk/PBuLt5SGRMmTyc0ujJkBcrFQIFMo947v0/UOD+mX VMa2rcMgUkTS1ymbKbTgyF4p0lKantKZwdjDqGEbrONUbbp63gMRAAhKMdwwUlGAgJnf 8dgTGOitGpLaZHTJK5i4uF/h/sSmtasOdjguRUP2ZFRmePb/fbaKdDYNxESOaMXwN/hC WjLyAe8bWqVcogYkhwTjfo/HJo8YjITO8zD/qRUujjV7EdLmmJ5uYJ8HTCgS6p27At4b 1zlQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=DFVDCpDwaFaSrHrhlC0YU4ttHfIT7MCaKVw+9D945G4=; fh=o/5N7/kxpeWjynMRXgRTkeR2GWte7sLJ7m091+z4hMo=; b=SswxhF/zRFlJvmtVD4G1o2aQcP3tReLTv9G70VJYOJHW4IBz/fuy7qhgsbM2adhbO+ teD8DzizmXEMXosj3gk4ac9RrFXhNMYHtPJQAj+SPG5vulz2+RfTJ7f30XDCoek89X7r NSZb54ErNzBoXt3MmdneCaSV9lqLzAH+PTnJ5Eu6AQP1R7JBxWvmrdoFXJohixWJfPQh Vse4t8PeHdyJ3odU0tCU34pFt/hDjzCz0RyZ6aWxMBS0bMQ0eVNLWF5O30kjWTzfJZz7 J5OSdiJ8hIcHTch4OoCBR3A826dqLZS98krk3J3uzMNXLrryrNwDAeB6j0cjWXFt0jU+ /nfw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98f02ce1csi342871585a.676.2024.09.05.22.26.48 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:26:48 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRLt-0005ob-Ge; Fri, 06 Sep 2024 01:17:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLQ-00041n-Qi; Fri, 06 Sep 2024 01:17:20 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLN-0007v5-Ul; Fri, 06 Sep 2024 01:17:16 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id E86A88C120; Fri, 6 Sep 2024 08:15:16 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 98C67133366; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10420 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Thomas Huth , Michael Tokarev Subject: [Stable-7.2.14 12/40] target/rx: Use target_ulong for address in LI Date: Fri, 6 Sep 2024 08:16:00 +0300 Message-Id: <20240906051633.10288-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Using int32_t meant that the address was sign-extended to uint64_t when passing to translator_ld*, triggering an assert. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2453 Signed-off-by: Richard Henderson Tested-by: Thomas Huth (cherry picked from commit 83340193b991e7a974f117baa86a04db1fd835a9) Signed-off-by: Michael Tokarev diff --git a/target/rx/translate.c b/target/rx/translate.c index 87a3f54adb..4233622c4e 100644 --- a/target/rx/translate.c +++ b/target/rx/translate.c @@ -83,7 +83,8 @@ static uint32_t decode_load_bytes(DisasContext *ctx, uint32_t insn, static uint32_t li(DisasContext *ctx, int sz) { - int32_t tmp, addr; + target_ulong addr; + uint32_t tmp; CPURXState *env = ctx->env; addr = ctx->base.pc_next; From patchwork Fri Sep 6 05:16:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825898 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp637827wrb; Thu, 5 Sep 2024 22:19:50 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVYecdaiquwPi8xRNLL07XtEsUnyiRJvGkbpTIc6DuAYWSaLhUpK3yfK64s8+ARTuske05RVg==@linaro.org X-Google-Smtp-Source: AGHT+IGj7TXmJu63JT8Dq4glwmqfPcSerKMxexk34HCoxMaPpxgx1jkJAfJL11FmXcaXpztrlwxj X-Received: by 2002:a05:6102:cc7:b0:492:9927:a5c6 with SMTP id ada2fe7eead31-49bde1a49bamr1841825137.12.1725599989863; Thu, 05 Sep 2024 22:19:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725599989; cv=none; d=google.com; s=arc-20240605; b=ED0C/DfP2Wvf7jdoA08w3SATbtz0nSABd0GPOFxUyBsYDR5loXzRjlX6KDddtey3gv 5CIcO1vY91EYAS76cU/VzH57sL/4C0QaGy+hw1tvwIIaGfkXp9kq123K7rFlavOpbooR +t5xEGwFD8QfKHSRv4U21e+/eoZ/4AVbnHHAklhwccJekeGtAK2RN6TYq7WftOrktogm NnkYx9MeyQcut7FhrTOKb3+fesCgEEOYP+YscrHQneEUEPa6gw/edGDYO6VqbDqM/0O8 ECzfVioaLzX5BBYpOM0hnCUAuyi+Rcvldtl/jYUglL8oWjUSuOIOrFJxS96EhNcUFJg1 2MTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=R3PjRuRZ738AdzM9Utg+MrPtMSYq0U+qCw4Pq74mML8=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=glXdtf7UrgCUCB4zcoORtdxn4qpLR77SrzpaeWisKmLQtgqVWmKBrTz8l/FyJq9Db4 3i5eVHcbC11pK6CsP1kqgZfYI7asCC8m3m/Jsm3Zz7/q/96ufEv00DZcwtyHz13jQ7bR EqZZusVMu5r/uGcHeXCMkLtvQjEIJXwb8MxNdA8pi4Eomz/8DvX4uz8PyUCZfGtRn1Uc 1DZ/fe3+SU8N4F9eAuIJK5PhJ295heybpd3o4nH9+ldpiBeePknK6K+v0dGpIF4cvOoL CHyTIXaBkPT09Qp2Jw6SdsTl98n6B1nIXV2hqh42IeUWdoyZ12lA+uTW2JEjoLSADDSd nW0g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98ef1e32csi356199685a.114.2024.09.05.22.19.49 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:19:49 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRLs-0005V5-Lo; Fri, 06 Sep 2024 01:17:45 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLp-0005Nt-4N; Fri, 06 Sep 2024 01:17:41 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLm-0007wr-U9; Fri, 06 Sep 2024 01:17:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 1EF8E8C122; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id B7447133368; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10427 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.14 14/40] hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE Date: Fri, 6 Sep 2024 08:16:02 +0300 Message-Id: <20240906051633.10288-14-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The documentation of the "Set palette" mailbox property at https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface#set-palette says it has the form: Length: 24..1032 Value: u32: offset: first palette index to set (0-255) u32: length: number of palette entries to set (1-256) u32...: RGBA palette values (offset to offset+length-1) We get this wrong in a couple of ways: * we aren't checking the offset and length are in range, so the guest can make us spin for a long time by providing a large length * the bounds check on our loop is wrong: we should iterate through 'length' palette entries, not 'length - offset' entries Fix the loop to implement the bounds checks and get the loop condition right. In the process, make the variables local to this switch case, rather than function-global, so it's clearer what type they are when reading the code. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20240723131029.1159908-2-peter.maydell@linaro.org (cherry picked from commit 0892fffc2abaadfb5d8b79bb0250ae1794862560) Signed-off-by: Michael Tokarev (Mjt: context fix due to lack of v9.0.0-1812-g5d5f1b60916a "hw/misc: Implement mailbox properties for customer OTP and device specific private keys" v8.0.0-1924-g251918266666 "hw/misc/bcm2835_property: Use 'raspberrypi-fw-defs.h' definitions" also remove now-unused local `n' variable which gets removed in the next change in this file, v9.0.0-2720-g32f1c201eedf "hw/misc/bcm2835_property: Avoid overflow in OTP access properties") diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c index de056ea2df..c7834d3fc7 100644 --- a/hw/misc/bcm2835_property.c +++ b/hw/misc/bcm2835_property.c @@ -26,8 +26,6 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value) uint32_t tot_len; size_t resplen; uint32_t tmp; - int n; - uint32_t offset, length, color; /* * Copy the current state of the framebuffer config; we will update @@ -258,18 +256,25 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value) resplen = 16; break; case 0x0004800b: /* Set palette */ - offset = ldl_le_phys(&s->dma_as, value + 12); - length = ldl_le_phys(&s->dma_as, value + 16); - n = 0; - while (n < length - offset) { - color = ldl_le_phys(&s->dma_as, value + 20 + (n << 2)); - stl_le_phys(&s->dma_as, - s->fbdev->vcram_base + ((offset + n) << 2), color); - n++; + { + uint32_t offset = ldl_le_phys(&s->dma_as, value + 12); + uint32_t length = ldl_le_phys(&s->dma_as, value + 16); + int resp; + + if (offset > 255 || length < 1 || length > 256) { + resp = 1; /* invalid request */ + } else { + for (uint32_t e = 0; e < length; e++) { + uint32_t color = ldl_le_phys(&s->dma_as, value + 20 + (e << 2)); + stl_le_phys(&s->dma_as, + s->fbdev->vcram_base + ((offset + e) << 2), color); + } + resp = 0; } - stl_le_phys(&s->dma_as, value + 12, 0); + stl_le_phys(&s->dma_as, value + 12, resp); resplen = 4; break; + } case 0x00040013: /* Get number of displays */ stl_le_phys(&s->dma_as, value + 12, 1); resplen = 4; From patchwork Fri Sep 6 05:16:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825908 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp639579wrb; Thu, 5 Sep 2024 22:27:15 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXefy7R7dvYiLi9n0uyZrofM1fs/VweOWYck3aj7Ibq+cCBiIb72cz+p8Psop/NVMAkxaVsPQ==@linaro.org X-Google-Smtp-Source: AGHT+IFYXImKxvnRQ1RJ/n3U1Uvivh/CWz7n/8t8ZH9aH/uj8rGHBax/afj8ggPUWtKsLT88HIy9 X-Received: by 2002:a05:620a:4309:b0:7a1:c40b:b1e4 with SMTP id af79cd13be357-7a80426a586mr2813214385a.55.1725600435176; Thu, 05 Sep 2024 22:27:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600435; cv=none; d=google.com; s=arc-20240605; b=OCJ4MXSIcun2KZWwAFUFf69A0KVuKz6aSymhaByfeFHS8k5tBWHXq7xMJYT3kDtNVv l5ZXMJcZ3w8gYO915z6QY+DbTTDc4boVFi37CVqeEtvDmYS81P8MHTHazrUUC6s2GB0x 4dNR4mqtaw+1FZVhvGDw4nY8Pohy7kZ9KL3XSuk72kCnNuDh0IDJ2ouZMcpDbmgJrO04 VctQ1HZ6kxIb88VtbKjXrFyVNPXSsG0P5RBe2X/vcMFsGcY0lb+OhN1nMStLBTUp5FPq 22RN0wS88ZAUIHQ5uTubW8uiwhpPbPJSpt0+s9DuAEzqTBunuRXk3xRhwEj5AJ8G2/yd pj7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=HRX3RL+o7l8L2GklnMecuMgs6/ktWMXLr+qgum/gqB0=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=AL5b3BRIS5kJo2AVajyO3ip5dzHZ9UhUO8Eg9ln1NBZza/op5J+C6fXJfzLUvH3mm4 MDlD+tpxgTft1OrgzStwREWGevms4Szw5urqJISqYGDrQ/aUz4PUSv0h+o6Qqnq8WC3t scF8lpriULPv6fraXwoBjWLDM/GVi+pMUspfX4MLfNsNbvFLPTbMD4Z4dVh2JITlehuk zz4pw4gn6FgIuP+yoMenhVf9yeYm+f4FNsr49UiZgX5iGLABradLhLTe3AR0cnC2U9p+ 4zgL4hmj4CalAyxysvPvGLFCxFJZUQf636WnMsxwrlnibcOwofmPngwo7XDbvZzeXGkV 9c8A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98f00b568si357116685a.493.2024.09.05.22.27.15 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:27:15 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRLv-00060Y-Oc; Fri, 06 Sep 2024 01:17:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLt-0005of-8S; Fri, 06 Sep 2024 01:17:45 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLq-000827-Gd; Fri, 06 Sep 2024 01:17:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 2D05C8C123; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id D1565133369; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10430 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.14 15/40] target/arm: Don't assert for 128-bit tile accesses when SVL is 128 Date: Fri, 6 Sep 2024 08:16:03 +0300 Message-Id: <20240906051633.10288-15-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell For an instruction which accesses a 128-bit element tile when the SVL is also 128 (for example MOV z0.Q, p0/M, ZA0H.Q[w0,0]), we will assert in get_tile_rowcol(): qemu-system-aarch64: ../../tcg/tcg-op.c:926: tcg_gen_deposit_z_i32: Assertion `len > 0' failed. This happens because we calculate len = ctz32(streaming_vec_reg_size(s)) - esz;$ but if the SVL and the element size are the same len is 0, and the deposit operation asserts. In this case the ZA storage contains exactly one 128 bit element ZA tile, and the horizontal or vertical slice is just that tile. This means that regardless of the index value in the Ws register, we always access that tile. (In pseudocode terms, we calculate (index + offset) MOD 1, which is 0.) Special case the len == 0 case to avoid hitting the assertion in tcg_gen_deposit_z_i32(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-2-peter.maydell@linaro.org (cherry picked from commit 56f1c0db928aae0b83fd91c89ddb226b137e2b21) Signed-off-by: Michael Tokarev diff --git a/target/arm/translate-sme.c b/target/arm/translate-sme.c index 8cce34e117..0fcd4ad950 100644 --- a/target/arm/translate-sme.c +++ b/target/arm/translate-sme.c @@ -56,7 +56,15 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs, /* Prepare a power-of-two modulo via extraction of @len bits. */ len = ctz32(streaming_vec_reg_size(s)) - esz; - if (vertical) { + if (!len) { + /* + * SVL is 128 and the element size is 128. There is exactly + * one 128x128 tile in the ZA storage, and so we calculate + * (Rs + imm) MOD 1, which is always 0. We need to special case + * this because TCG doesn't allow deposit ops with len 0. + */ + tcg_gen_movi_i32(tmp, 0); + } else if (vertical) { /* * Compute the byte offset of the index within the tile: * (index % (svl / size)) * size From patchwork Fri Sep 6 05:16:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825899 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp637878wrb; Thu, 5 Sep 2024 22:20:01 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVpyvs8t9BJx0ME2+MiCSwRr9gtH0KGFQ1APgjqLqMTMcR2yD8QKnWGAhidbYCWCXWtI5YJyw==@linaro.org X-Google-Smtp-Source: AGHT+IFEC81ZiyM7AFxwySJmj6rz6dDppaEUy6sGCWTKCFkMTDrXEo3R9Fjq4h7yT7sFWtL2XD1C X-Received: by 2002:a05:690c:3585:b0:664:8646:4d02 with SMTP id 00721157ae682-6db44d9fc35mr20071907b3.12.1725600001259; Thu, 05 Sep 2024 22:20:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600001; cv=none; d=google.com; s=arc-20240605; b=fbvgHMIR1ZRfYToo2oMIcTiIAuDpOnGpdGRLTFKX/D24obGxHkUgIz6keKHPU/WyVR ZrYJb1AyRgqhamGony7nhjQ+ns5qz40XA9G4zKsR+8N/3AXvTzHGR8EbPlMElaKoqfRO nCH/6UFVPd/+Q1WczXjz5CMx/DlvcNFF1urtBv73uxlQL/x1tCu1dvhxBmMz3LCpXVhh 7T2MKG0kBXXTjyb19D1p1+cYLfcfP3Wf7dliWPVVzaGXZLylKFIjC4QV8rtmdmHKNkLs j+5OsxI4V+wXbu9Kr1Es8ftuAHrdlA1Gt1tcd4MEvvFe7LqWVTy+Z4HNix2yQzThlghw GsLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=f3JwBPK+TLlGpWXnv/Pwp9XES+mq3I741tvjHEE1yfw=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=je8Pe8+fKMg1evSFapPfuZwZdlUyZQAkaG4lxJWRq6ChhuUCSKdqxRJ53EFFEyU7Km dgImHGd4WGaScHQgesNbEn9X6PnxdbgI65Xr0u1rpUEM28eIaoDwvm+a3n/Yt8EseZJn OJcZG7dnlegXZeDtUbOETLMdFGgTb7iP6npnSry9Dm+tK3GgLcUzRZ+J4WOZpou/UUNp 4R9ZZ3Kp5WW8A8dJYylUC+ANyKWpJ+tU0YRnMhzWb3NeTp4/kPX3G4HHHqk/zYAAUu0F Z2B94nFI1P6//yOttTWkPRYVKw6hHS3B2T7GW1Wd8Zrc0RPD6alEH511EH5A+u/SB/gx +fZw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98ef1e714si360502385a.68.2024.09.05.22.20.01 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:20:01 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRLz-0006Nr-GV; Fri, 06 Sep 2024 01:17:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLs-0005jE-QO; Fri, 06 Sep 2024 01:17:44 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLq-000829-JJ; Fri, 06 Sep 2024 01:17:44 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 3AFBB8C124; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id DF64313336A; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10433 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.14 16/40] target/arm: Fix UMOPA/UMOPS of 16-bit values Date: Fri, 6 Sep 2024 08:16:04 +0300 Message-Id: <20240906051633.10288-16-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -57 X-Spam_score: -5.8 X-Spam_bar: ----- X-Spam_report: (-5.8 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, THIS_AD=1.099, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The UMOPA/UMOPS instructions are supposed to multiply unsigned 8 or 16 bit elements and accumulate the products into a 64-bit element. In the Arm ARM pseudocode, this is done with the usual infinite-precision signed arithmetic. However our implementation doesn't quite get it right, because in the DEF_IMOP_64() macro we do: sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0); where NTYPE and MTYPE are uint16_t or int16_t. In the uint16_t case, the C usual arithmetic conversions mean the values are converted to "int" type and the multiply is done as a 32-bit multiply. This means that if the inputs are, for example, 0xffff and 0xffff then the result is 0xFFFE0001 as an int, which is then promoted to uint64_t for the accumulation into sum; this promotion incorrectly sign extends the multiply. Avoid the incorrect sign extension by casting to int64_t before the multiply, so we do the multiply as 64-bit signed arithmetic, which is a type large enough that the multiply can never overflow into the sign bit. (The equivalent 8-bit operations in DEF_IMOP_32() are fine, because the 8-bit multiplies can never overflow into the sign bit of a 32-bit integer.) Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2372 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-3-peter.maydell@linaro.org (cherry picked from commit ea3f5a90f036734522e9af3bffd77e69e9f47355) Signed-off-by: Michael Tokarev diff --git a/target/arm/sme_helper.c b/target/arm/sme_helper.c index e55bc51d69..f12f3288fd 100644 --- a/target/arm/sme_helper.c +++ b/target/arm/sme_helper.c @@ -1167,10 +1167,10 @@ static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \ uint64_t sum = 0; \ /* Apply P to N as a mask, making the inactive elements 0. */ \ n &= expand_pred_h(p); \ - sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0); \ - sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16); \ - sum += (NTYPE)(n >> 32) * (MTYPE)(m >> 32); \ - sum += (NTYPE)(n >> 48) * (MTYPE)(m >> 48); \ + sum += (int64_t)(NTYPE)(n >> 0) * (MTYPE)(m >> 0); \ + sum += (int64_t)(NTYPE)(n >> 16) * (MTYPE)(m >> 16); \ + sum += (int64_t)(NTYPE)(n >> 32) * (MTYPE)(m >> 32); \ + sum += (int64_t)(NTYPE)(n >> 48) * (MTYPE)(m >> 48); \ return neg ? a - sum : a + sum; \ } From patchwork Fri Sep 6 05:16:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825905 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp639255wrb; Thu, 5 Sep 2024 22:25:55 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCVUrSVUzldWt1qkfDWX5g651B7KkAfhroeV/tU8icKvCYudcdx5LggPKbdAlf3I17vlbgSypg==@linaro.org X-Google-Smtp-Source: AGHT+IHj44iHSVAxPfEIFvrBguYQCos4vWx5gxOLGFTCIIj3n300zsrF334x1DD9D+oVnrxbvVL1 X-Received: by 2002:a05:6214:3285:b0:6c3:55be:23a4 with SMTP id 6a1803df08f44-6c5282f9259mr16240536d6.1.1725600354919; Thu, 05 Sep 2024 22:25:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600354; cv=none; d=google.com; s=arc-20240605; b=ipZvVfhvD401GC+e1nBwIqeeXqiKBl6MtPBxTUHL2PRN+cw5mHc0o31zKRETcmrGog S8kHWlISORjMv3n/T5d5a2+7gCYc/MdV6vEsIX9nXAz7PjKSVJTdnFdnnpLBVPob0Rmz 3/8fggmq5qHsXAeR3IW4YiuXnrlKwhshC7Jla+9G3r5/s0z8ya112XzM5GpuCT6WlnnV DKnBpwmatkPdreKRgdmHRSOXDPZMPsEJ0SlD66q5IEDyy69qOuhcY9lQC3tni7p5nzuK jNdFZ4VKTSreJC0GC8b2svLZIbT/uI9d9bmnZ29d8Fidjrqb1Tl/fh/VKjL8NEMehofW N6MQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=z83USwdbJV8YHV8q41qGAN35o8jholCy4Zzhj/HDo9E=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=B/X3KVtFAPeldxPOjzroJS6XMlLbBEOJxhi9TrJSwPa3hyazLS11s7xI6tkX/TTvdb iofwEkxPFvYrxmI/FNwfRcJRSnVS4OrAQV4zRCktHlbmJc/jsPee4ZVNHYKv9UgccKHh HVTTQOePiEZtbtPJS1KdEmGzxrsKMP/jQWefu4jYCSpzCz5h5ZZD5x2qyvtpd9hozIws tTfFvhpw6dgyf8pjK86IJSZa2i/ZrQGbwiUo9JHZpxpr2uhsADUSX2g9psbJP00wFkj7 VpZ+KfXykpArf2xmpTNi7yr2N6pM41SHlVPFlxkLB9T4b/e6Mwo5vRwV3JOWjOEx38FL saMA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c520525c93si36561836d6.598.2024.09.05.22.25.54 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:25:54 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRM2-0006mB-7w; Fri, 06 Sep 2024 01:17:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLw-00063b-6l; Fri, 06 Sep 2024 01:17:48 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRLu-000830-HE; Fri, 06 Sep 2024 01:17:47 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 492828C125; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id ED25C13336B; Fri, 6 Sep 2024 08:16:34 +0300 (MSK) Received: (nullmailer pid 10436 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.14 17/40] target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl() Date: Fri, 6 Sep 2024 08:16:05 +0300 Message-Id: <20240906051633.10288-17-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The function tszimm_esz() returns a shift amount, or possibly -1 in certain cases that correspond to unallocated encodings in the instruction set. We catch these later in the trans_ functions (generally with an "a-esz < 0" check), but before we do the decodetree-generated code will also call tszimm_shr() or tszimm_sl(), which will use the tszimm_esz() return value as a shift count without checking that it is not negative, which is undefined behaviour. Avoid the UB by checking the return value in tszimm_shr() and tszimm_shl(). Cc: qemu-stable@nongnu.org Resolves: Coverity CID 1547617, 1547694 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-4-peter.maydell@linaro.org (cherry picked from commit 76916dfa89e8900639c1055c07a295c06628a0bc) Signed-off-by: Michael Tokarev diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c index 7388e1dbc7..034e816491 100644 --- a/target/arm/translate-sve.c +++ b/target/arm/translate-sve.c @@ -61,13 +61,27 @@ static int tszimm_esz(DisasContext *s, int x) static int tszimm_shr(DisasContext *s, int x) { - return (16 << tszimm_esz(s, x)) - x; + /* + * We won't use the tszimm_shr() value if tszimm_esz() returns -1 (the + * trans function will check for esz < 0), so we can return any + * value we like from here in that case as long as we avoid UB. + */ + int esz = tszimm_esz(s, x); + if (esz < 0) { + return esz; + } + return (16 << esz) - x; } /* See e.g. LSL (immediate, predicated). */ static int tszimm_shl(DisasContext *s, int x) { - return x - (8 << tszimm_esz(s, x)); + /* As with tszimm_shr(), value will be unused if esz < 0 */ + int esz = tszimm_esz(s, x); + if (esz < 0) { + return esz; + } + return x - (8 << esz); } /* The SH bit is in bit 8. Extract the low 8 and shift. */ From patchwork Fri Sep 6 05:16:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825895 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp637545wrb; Thu, 5 Sep 2024 22:18:53 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXByqtnOOLcnETdM4wNl5r/o4VHrFuW4StVYCZlYpNOMNUJLjFPSa0vpP2/EvZZGR2d5KDO7A==@linaro.org X-Google-Smtp-Source: AGHT+IG4t1XrQ+En1ydyJhsthKtYZzy3zZ0FahkwRW4NaWCtOqupauAxMwHz1yzWwQ0L0gM2JAoI X-Received: by 2002:a05:6122:92a:b0:4f6:a7f7:164d with SMTP id 71dfb90a1353d-50221423548mr1651437e0c.8.1725599933718; Thu, 05 Sep 2024 22:18:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725599933; cv=none; d=google.com; s=arc-20240605; b=E5wYtDW+yleW0fiGnF21q0NxHyjEw40aUCgVtXd3rCV9GyyiG1svLJSYLK21j2kwjD 56y4DyoFJygwz2SNlA3H0gT0iVw7UfK6XjGXim5l2A15VoV0lYdW7vvSBkRGzsgVbya0 nV2a8FzqhH2HCtCMtwp31gJwUvWFKh8fLzQ93G1X545wN1GZoffXZc9sEKDLCvCsZKys OaP8dJQLDrJfWmWHLZn8fMQ94YY2IjUiGERiHbqwOaddI8qtS5rjgMzek5G8Ivjo1pyj BU4S2FU/S9wn5Frl2s3/B+1W3kwhTkMJMcPPcoMt65fxFfqaQu3icjSxJHAuwwHCtmW+ Z6TA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=JTlM5nxQbkJr/OsHMk1hDNcjl9gtAPvPaaxbxJSCbQU=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=OUiXs8n+8P43dRIoEzSscfANotAQ28GIgKHL9nC5L8jYy9m9bILEDda3S2hW4ZyN4X 2Y0ioWBisP/rrTufq53KhAKa1HZ403EzadILb4fU9BZDp84s8C4lFGwYK3E1OGJ3YL2t xof6bO3Yk0zMZGvB+mTKPs7i7Ak4D0NDO58n2kwdOU/ZIjBlECmzYQuQTzILsQ6dxWbo 4UStZQfwwbZAG22Noeg1/IsLiShSgqZ+8PjyQQjjo3pysHkbbK8VTSzTn2O9RAhumREk RIRIzZ+eQ7BDc8AFhqPI9GowxRsV9oQaHPdDNuaQIpCr0N3nRFCCfps3/05Qm707zT8r CwEA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c4d110si18867231cf.132.2024.09.05.22.18.53 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:18:53 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRMJ-00088P-UE; Fri, 06 Sep 2024 01:18:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMH-0007xr-4F; Fri, 06 Sep 2024 01:18:09 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMF-00083S-Kw; Fri, 06 Sep 2024 01:18:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 565AA8C126; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 06E5813336C; Fri, 6 Sep 2024 08:16:35 +0300 (MSK) Received: (nullmailer pid 10439 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.14 18/40] target/arm: Ignore SMCR_EL2.LEN and SVCR_EL2.LEN if EL2 is not enabled Date: Fri, 6 Sep 2024 08:16:06 +0300 Message-Id: <20240906051633.10288-18-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When determining the current vector length, the SMCR_EL2.LEN and SVCR_EL2.LEN settings should only be considered if EL2 is enabled (compare the pseudocode CurrentSVL and CurrentNSVL which call EL2Enabled()). We were checking against ARM_FEATURE_EL2 rather than calling arm_is_el2_enabled(), which meant that we would look at SMCR_EL2/SVCR_EL2 when in Secure EL1 or Secure EL0 even if Secure EL2 was not enabled. Use the correct check in sve_vqm1_for_el_sm(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20240722172957.1041231-5-peter.maydell@linaro.org (cherry picked from commit f573ac059ed060234fcef4299fae9e500d357c33) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index acc0470e86..5c22626b80 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6335,7 +6335,7 @@ uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm) if (el <= 1 && !el_is_in_host(env, el)) { len = MIN(len, 0xf & (uint32_t)cr[1]); } - if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) { + if (el <= 2 && arm_is_el2_enabled(env)) { len = MIN(len, 0xf & (uint32_t)cr[2]); } if (arm_feature(env, ARM_FEATURE_EL3)) { From patchwork Fri Sep 6 05:16:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825896 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp637622wrb; Thu, 5 Sep 2024 22:19:08 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXUQfGFRP+h/gPFPp5jo5wcSr3gZII9xJBfyyZh39c2SAE5YIBHUxmZXpfWMbYQOuNeXFpxHA==@linaro.org X-Google-Smtp-Source: AGHT+IEjMbvX7G1cXcaq+7J54Vlb3VwA4R1ENxP1m/gfKen1WMVLGiHaVVkZgjGh64pLFCVhbRsY X-Received: by 2002:a05:6102:3a06:b0:49b:dbf9:7b3d with SMTP id ada2fe7eead31-49bde1cfefemr1804535137.16.1725599948460; Thu, 05 Sep 2024 22:19:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725599948; cv=none; d=google.com; s=arc-20240605; b=lXLYst0kQgstjyHjYg3umPbjf5CxbETlBWQ8sQ1CGODXsgxghmbE98qRvFiAnuchqK Ji5JZtsLr6HCVMLOWACJv6U8jrbyuqWsdfwbI/5Ac0J06BnEX61aJR7axaSzCyRD1No9 tYqTrlJJ3bkGKLRYzTHNRtG/hW3EMl3IOdTcv8YaJ47Oiwux6vu68sOBGcSkeNf57NJW sj0uwoSsPa/KvTpzZl/iKirS8P+MTOWxVVmhiY9mE4X6zf7l3SaZyv+BjYPZcRrqV0Z5 ZIts2x8DFhA97BHw+Kgu1FkCXdk1Ars2luI1THl2KUFruohElcCGHDDgfVZRozL1pk4T koCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=LxVt8Zqzx+mHsb5SPIqxofKuCv6ai9lg4miz52rF5Qk=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=BIexAjveFDJfjGbckGA88I7jJKPOCZnAKX6RZ0ocaCmBUHsx2s9kEuEN2z4F7lAUOQ 1WjcXNL6TBbe0S+lfSp5jlj4KOacihNq4JLzTUrKPtrBIOKGeORbVg7c+j/FS/2GjvZm 6oNnRJIkMiF4z5W4IZe6uniU6ttPtOdNTu1dDJ6TTY5wqF2AfXjY0F2QcDlFCdzW/q51 hAwIIf0piJ85wllxVSM7SJKdPLm7XJ1yA8zTkHzqy4XRo2LTIU1cfLNAyxOfaodqgAVU KzZxo9bRO+o3y/kI+8CJEE5ue2H/8Kc+T/6/L8y4rv8+phWON72eiS/dSc3NdQgKEMrB hLAw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98f03c413si351415685a.772.2024.09.05.22.19.08 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:19:08 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRML-0008K5-I5; Fri, 06 Sep 2024 01:18:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMJ-00087k-GB; Fri, 06 Sep 2024 01:18:11 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMH-000840-IO; Fri, 06 Sep 2024 01:18:11 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 63FEB8C127; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 1494A13336D; Fri, 6 Sep 2024 08:16:35 +0300 (MSK) Received: (nullmailer pid 10442 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.14 19/40] docs/sphinx/depfile.py: Handle env.doc2path() returning a Path not a str Date: Fri, 6 Sep 2024 08:16:07 +0300 Message-Id: <20240906051633.10288-19-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In newer versions of Sphinx the env.doc2path() API is going to change to return a Path object rather than a str. This was originally visible in Sphinx 8.0.0rc1, but has been rolled back for the final 8.0.0 release. However it will probably emit a deprecation warning and is likely to change for good in 9.0: https://github.com/sphinx-doc/sphinx/issues/12686 Our use in depfile.py assumes a str, and if it is passed a Path it will fall over: Handler for event 'build-finished' threw an exception (exception: unsupported operand type(s) for +: 'PosixPath' and 'str') Wrapping the env.doc2path() call in str() will coerce a Path object to the str we expect, and have no effect in older Sphinx versions that do return a str. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2458 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240729120533.2486427-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 48e5b5f994bccf161dd88a67fdd819d4bfb400f1) Signed-off-by: Michael Tokarev diff --git a/docs/sphinx/depfile.py b/docs/sphinx/depfile.py index afdcbcec6e..e74be6af98 100644 --- a/docs/sphinx/depfile.py +++ b/docs/sphinx/depfile.py @@ -19,7 +19,7 @@ def get_infiles(env): for x in env.found_docs: - yield env.doc2path(x) + yield str(env.doc2path(x)) yield from ((os.path.join(env.srcdir, dep) for dep in env.dependencies[x])) for mod in sys.modules.values(): From patchwork Fri Sep 6 05:16:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825904 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp638908wrb; Thu, 5 Sep 2024 22:24:20 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUUGs8oHF9Homj862FHPJnTaIXVby7aHPAf+pqbn+Ew5/e7ky7cWAnnmZclj08CIL9gU8jNGA==@linaro.org X-Google-Smtp-Source: AGHT+IFvWmhxYywIe893vTyZpbv8Bv5EiBH2lM3KnJylvSBkgExAVozGdneJu4AW3DKoN5DQYDKl X-Received: by 2002:a05:620a:390c:b0:79f:1915:5b3a with SMTP id af79cd13be357-7a8041d8d40mr2488131485a.38.1725600260154; Thu, 05 Sep 2024 22:24:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600260; cv=none; d=google.com; s=arc-20240605; b=OJTp7Wd4A9ki3jxA46DBJ9DAd5cKiklaf55wdLiRDSCVmUIstG3N3WpsCI2hM1Tq1T fwV86wcQK1wRLFPw4p7b2jgam9XcWvSij0TLNZXe3HkZKNI/tb9AVCCuAH8WFZ27Tsi8 EVXFNY5EBBxe7irxIp06pkv8MoRaJlyErKsmQIG0XedRT0pSWSj5jNIk0tU9frxJFYZm NUYBgnDGqSCon4wZxbGH15b3Nb4xQmd8fmAbyK4SFNqRsjRqKII8dBggDs1CiM2qURe+ kUnDvuqRzDFm0+Gjr+FpZFCGTGlOqqQElkFuADSd+XGA1/WTqcB0EH4pFbypKZuSg58M v8dg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=WJRRs02xkFh+dxyDnU5kOCS60NB0QTJVr2veB99lXMY=; fh=lkSFXoxMdr4qZMbOju3jrj6agwaYXwlSFfKSAqY95WM=; b=HiN02XMsyaM64iw3uVQRMKJ/YBzD/t1p2I9fXwfV4uIRvmbmPUVYqpkBoMA8ppRVBN fHOIepKS18yk6IoF0T5Vto0/PYtG1QjuWI62xm93ArZvKvVC+HQA1LCw1bP0yRDWc9vk vAV7vQ3zMDSFKHiFVHdAmNJB9PowrZvEOpGqi1YZ0wa8yQt8OIa0k5XAYKl1zozDrN42 7OcfcCoQtanBX8/y+xn6oNRjdjVihLDeWzYEJuIMW1wYZvbRpA7FIS8l5bAYUx+jm8Kx i+VoKWY9270nno93ZLJJL/AygiEoRm4XTu1zv3Z3iBrUHWqpkRoZp+q5Nh0UXLU8iBOy FCSg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98ef1df1dsi355983685a.100.2024.09.05.22.24.19 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:24:20 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRMO-0000C8-HW; Fri, 06 Sep 2024 01:18:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMK-0008Cv-Bx; Fri, 06 Sep 2024 01:18:12 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMI-00087y-J0; Fri, 06 Sep 2024 01:18:12 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 71E258C128; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 222E113336E; Fri, 6 Sep 2024 08:16:35 +0300 (MSK) Received: (nullmailer pid 10445 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , "Michael S . Tsirkin" , Michael Tokarev Subject: [Stable-7.2.14 20/40] hw/i386/amd_iommu: Don't leak memory in amdvi_update_iotlb() Date: Fri, 6 Sep 2024 08:16:08 +0300 Message-Id: <20240906051633.10288-20-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In amdvi_update_iotlb() we will only put a new entry in the hash table if to_cache.perm is not IOMMU_NONE. However we allocate the memory for the new AMDVIIOTLBEntry and for the hash table key regardless. This means that in the IOMMU_NONE case we will leak the memory we alloacted. Move the allocations into the if() to the point where we know we're going to add the item to the hash table. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2452 Signed-off-by: Peter Maydell Message-Id: <20240731170019.3590563-1-peter.maydell@linaro.org> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 9a45b0761628cc59267b3283a85d15294464ac31) Signed-off-by: Michael Tokarev diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c index a20f3e1d50..02597db1e1 100644 --- a/hw/i386/amd_iommu.c +++ b/hw/i386/amd_iommu.c @@ -346,12 +346,12 @@ static void amdvi_update_iotlb(AMDVIState *s, uint16_t devid, uint64_t gpa, IOMMUTLBEntry to_cache, uint16_t domid) { - AMDVIIOTLBEntry *entry = g_new(AMDVIIOTLBEntry, 1); - uint64_t *key = g_new(uint64_t, 1); - uint64_t gfn = gpa >> AMDVI_PAGE_SHIFT_4K; - /* don't cache erroneous translations */ if (to_cache.perm != IOMMU_NONE) { + AMDVIIOTLBEntry *entry = g_new(AMDVIIOTLBEntry, 1); + uint64_t *key = g_new(uint64_t, 1); + uint64_t gfn = gpa >> AMDVI_PAGE_SHIFT_4K; + trace_amdvi_cache_update(domid, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), gpa, to_cache.translated_addr); From patchwork Fri Sep 6 05:16:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825902 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp638194wrb; Thu, 5 Sep 2024 22:20:56 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXvVffXv8RyEder5DZ0Y1RyKMprtE6f0TVrUFt+pfUa3kOjfD2ZQ7DMBdYrD8gSglXH6/mN4Q==@linaro.org X-Google-Smtp-Source: AGHT+IGs+grXz8sMyaP0kohVPITVdyAYD+AC//DKlsXkEKUAYS+mCLL0CCIJ3mkM4n3qmJ/64xXy X-Received: by 2002:a05:6214:2b90:b0:6bf:8890:ae17 with SMTP id 6a1803df08f44-6c52851af66mr15461036d6.53.1725600056086; Thu, 05 Sep 2024 22:20:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600056; cv=none; d=google.com; s=arc-20240605; b=HY4u/sPeOVjEOCeWpzeGnW19t2M8Ofo2sWv+s6XlJOOpKzsUm112ZkuzN3xxkokiI8 rZLFLLPSDq1TKI7XEqW+iNeVkIE3zu0k8ImkXZGh88qvBQBfYL/LraiIAdFfQy1yXW8L oohxmvfKyl9q6T921rUmuPGcw19mfNKvwJLOY7ythCnM5l0DnMudGpcfO0keA+PCAXC6 dizVKKbabFbmYvwWOho7uLjR1X81beibbRLuVB3rP1qYHJ3ETLQCoVCfGoQaD9iuEeP1 zAUsofZZdM/2y7tmJDn/j7VrYdr+GHJcq5qXnlr/h3Ks1ZcdFVl9FsoOPCpKOm43vrhy xUQg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=LKEvWcM5Bzn5qv1cu3izn+xzgw4xUpU8I/lX0t+5qUs=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=dAA6LOm0Eknux2uE2rxs2LuQ2rb8vspHzZ9WxXnR7zWkn9s/qFbBqUPiZF85pJJgMK 0wefOaX45pCT+ymHqM5VtWF22Tleue+SCGvnDVs3M6iWrdP+TOroivu60v7bg3BZXIx3 WHM8Hs+4Y8XuJAZPVwFxwSUCAGigiSiaflnDw9bkJ1DAJjztUzMmpIHlbsLWyRBATbLK IftbjqfLdbvBrt3b0xK6GmBm0e80wleM0Dy+AptbtPI5IXs0eyXflVCsP1hTE8zrwgVE gJd+LT+tWal1C4ZSOenr12DrDg98ymMLqCw1tlHUU5wYd8OlUH4w29qNyC/nVDnoXpYu qbOQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c520525962si36458816d6.596.2024.09.05.22.20.55 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:20:56 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRNH-0004UU-V0; Fri, 06 Sep 2024 01:19:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMi-00021F-6j; Fri, 06 Sep 2024 01:18:40 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMf-00088x-Tm; Fri, 06 Sep 2024 01:18:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 8F1198C12B; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 3E20C133370; Fri, 6 Sep 2024 08:16:35 +0300 (MSK) Received: (nullmailer pid 10451 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.14 22/40] target/arm: Handle denormals correctly for FMOPA (widening) Date: Fri, 6 Sep 2024 08:16:10 +0300 Message-Id: <20240906051633.10288-22-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The FMOPA (widening) SME instruction takes pairs of half-precision floating point values, widens them to single-precision, does a two-way dot product and accumulates the results into a single-precision destination. We don't quite correctly handle the FPCR bits FZ and FZ16 which control flushing of denormal inputs and outputs. This is because at the moment we pass a single float_status value to the helper function, which then uses that configuration for all the fp operations it does. However, because the inputs to this operation are float16 and the outputs are float32 we need to use the fp_status_f16 for the float16 input widening but the normal fp_status for everything else. Otherwise we will apply the flushing control FPCR.FZ16 to the 32-bit output rather than the FPCR.FZ control, and incorrectly flush a denormal output to zero when we should not (or vice-versa). (In commit 207d30b5fdb5b we tried to fix the FZ handling but didn't get it right, switching from "use FPCR.FZ for everything" to "use FPCR.FZ16 for everything".) (Mjt: it is commit d5373d7bdbee in stable-7.2) Pass the CPU env to the sme_fmopa_h helper instead of an fp_status pointer, and have the helper pass an extra fp_status into the f16_dotadd() function so that we can use the right status for the right parts of this operation. Cc: qemu-stable@nongnu.org Fixes: 207d30b5fdb5 ("target/arm: Use FPST_F16 for SME FMOPA (widening)") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2373 Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson (cherry picked from commit 55f9f4ee018c5ccea81d8c8c586756d7711ae46f) Signed-off-by: Michael Tokarev (Mjt: s/tcg_env/cpu_env/ due to missingv 8.1.0-1189-gad75a51e84af "tcg: Rename cpu_env to tcg_env") diff --git a/target/arm/helper-sme.h b/target/arm/helper-sme.h index d2d544a696..d33fbcd8fd 100644 --- a/target/arm/helper-sme.h +++ b/target/arm/helper-sme.h @@ -122,7 +122,7 @@ DEF_HELPER_FLAGS_5(sme_addha_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32) DEF_HELPER_FLAGS_5(sme_addva_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32) DEF_HELPER_FLAGS_7(sme_fmopa_h, TCG_CALL_NO_RWG, - void, ptr, ptr, ptr, ptr, ptr, ptr, i32) + void, ptr, ptr, ptr, ptr, ptr, env, i32) DEF_HELPER_FLAGS_7(sme_fmopa_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, ptr, ptr, i32) DEF_HELPER_FLAGS_7(sme_fmopa_d, TCG_CALL_NO_RWG, diff --git a/target/arm/sme_helper.c b/target/arm/sme_helper.c index f12f3288fd..98a4840970 100644 --- a/target/arm/sme_helper.c +++ b/target/arm/sme_helper.c @@ -1009,12 +1009,23 @@ static inline uint32_t f16mop_adj_pair(uint32_t pair, uint32_t pg, uint32_t neg) } static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2, - float_status *s_std, float_status *s_odd) + float_status *s_f16, float_status *s_std, + float_status *s_odd) { - float64 e1r = float16_to_float64(e1 & 0xffff, true, s_std); - float64 e1c = float16_to_float64(e1 >> 16, true, s_std); - float64 e2r = float16_to_float64(e2 & 0xffff, true, s_std); - float64 e2c = float16_to_float64(e2 >> 16, true, s_std); + /* + * We need three different float_status for different parts of this + * operation: + * - the input conversion of the float16 values must use the + * f16-specific float_status, so that the FPCR.FZ16 control is applied + * - operations on float32 including the final accumulation must use + * the normal float_status, so that FPCR.FZ is applied + * - we have pre-set-up copy of s_std which is set to round-to-odd, + * for the multiply (see below) + */ + float64 e1r = float16_to_float64(e1 & 0xffff, true, s_f16); + float64 e1c = float16_to_float64(e1 >> 16, true, s_f16); + float64 e2r = float16_to_float64(e2 & 0xffff, true, s_f16); + float64 e2c = float16_to_float64(e2 >> 16, true, s_f16); float64 t64; float32 t32; @@ -1036,20 +1047,23 @@ static float32 f16_dotadd(float32 sum, uint32_t e1, uint32_t e2, } void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn, - void *vpm, void *vst, uint32_t desc) + void *vpm, CPUARMState *env, uint32_t desc) { intptr_t row, col, oprsz = simd_maxsz(desc); uint32_t neg = simd_data(desc) * 0x80008000u; uint16_t *pn = vpn, *pm = vpm; - float_status fpst_odd, fpst_std; + float_status fpst_odd, fpst_std, fpst_f16; /* - * Make a copy of float_status because this operation does not - * update the cumulative fp exception status. It also produces - * default nans. Make a second copy with round-to-odd -- see above. + * Make copies of fp_status and fp_status_f16, because this operation + * does not update the cumulative fp exception status. It also + * produces default NaNs. We also need a second copy of fp_status with + * round-to-odd -- see above. */ - fpst_std = *(float_status *)vst; + fpst_f16 = env->vfp.fp_status_f16; + fpst_std = env->vfp.fp_status; set_default_nan_mode(true, &fpst_std); + set_default_nan_mode(true, &fpst_f16); fpst_odd = fpst_std; set_float_rounding_mode(float_round_to_odd, &fpst_odd); @@ -1069,7 +1083,8 @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn, uint32_t m = *(uint32_t *)(vzm + H1_4(col)); m = f16mop_adj_pair(m, pcol, 0); - *a = f16_dotadd(*a, n, m, &fpst_std, &fpst_odd); + *a = f16_dotadd(*a, n, m, + &fpst_f16, &fpst_std, &fpst_odd); } col += 4; pcol >>= 4; diff --git a/target/arm/translate-sme.c b/target/arm/translate-sme.c index 0fcd4ad950..c864bd016c 100644 --- a/target/arm/translate-sme.c +++ b/target/arm/translate-sme.c @@ -376,8 +376,29 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz, return true; } -TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, - MO_32, FPST_FPCR_F16, gen_helper_sme_fmopa_h) +static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz, + gen_helper_gvec_5_ptr *fn) +{ + int svl = streaming_vec_reg_size(s); + uint32_t desc = simd_desc(svl, svl, a->sub); + TCGv_ptr za, zn, zm, pn, pm; + + if (!sme_smza_enabled_check(s)) { + return true; + } + + za = get_tile(s, esz, a->zad); + zn = vec_full_reg_ptr(s, a->zn); + zm = vec_full_reg_ptr(s, a->zm); + pn = pred_full_reg_ptr(s, a->pn); + pm = pred_full_reg_ptr(s, a->pm); + + fn(za, zn, zm, pn, pm, cpu_env, tcg_constant_i32(desc)); + return true; +} + +TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a, + MO_32, gen_helper_sme_fmopa_h) TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, FPST_FPCR, gen_helper_sme_fmopa_s) TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, From patchwork Fri Sep 6 05:16:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825900 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp637884wrb; Thu, 5 Sep 2024 22:20:02 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV007Ta4eNdkxG5h/Y7ET0E2gTFxVlBbDPQO5YGODTjFJZ2mlnb1RfmmZegBYx9YM8eGEhfpA==@linaro.org X-Google-Smtp-Source: AGHT+IGoAr5UGHlfSBNfMvuZUV1nPUoXm7zUo52STvIThiVxXjYxiCxsK76PmUSSwvOYscxgZIEJ X-Received: by 2002:a05:620a:280c:b0:7a1:e3e5:c8c with SMTP id af79cd13be357-7a99731be3emr154000485a.5.1725600002616; Thu, 05 Sep 2024 22:20:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600002; cv=none; d=google.com; s=arc-20240605; b=Z0xcFRu22R2D6kKgPa6yLEFqGwo2Qi+hTN/aVwHfADOl+ktqFCuhK+jnmz/urNkLu6 FMxfyZD9bW8GVyHdKoDaajacD70GLHUE28W//YHJ6e43FSnPTHs+h/a1rYLLN76kDq8A Qc5pos1hfhWP6mTEV7U1A9NAEP8F0rKJwHAYnAECkMH6SoYO5sFulX7RZHIPj+0AwgNK NxiiQZ8gxRdV+2WFKHLsgvyJyRDJ92I7Irs0mE2rYbYdL+GIEjUNBrhhBuf6C1LWkSQ6 e0Grb8eh7A0oZPJLhqoS8258BcuIJYm+3hbuZlr66dNrpcVgodp2jg0kSa39wN8R3GP2 2zpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=GsUyc2muy/ozpnoyZ9n/uEyuepQV6Xw8Y5kZil2s/GY=; fh=5bR2Ckfc1WOYjVTih8W/ByZTKk2PNsQ3J6+3vQjlF0I=; b=R1UfORM8EV/CSYVHKnJ06KYsQN+GKtLm7qsFlODpAj32judrSzCykQu8SFuHSrP9Jf 2uIKs3v+6r+61Pf5zujXuOWN1dPr7YuXlt3Sn07degt4HqrJlAo8LWoefvX/oJmpsQE3 t0Q+guMvfUb0LREInjDoCQg6MUU0MedqmLFhs90qTDj+a7lNG9ROCifr5gD2STCp65so IXFOiep9LUoz7s5yVJY32qHkQBgBOMdfi04MS1w1ZqOiJZ8VrEfiKDvuKo89XcvHNUNc ObrdRRQBnZzLvw+x51dOHBYgS7qG13FyGrVMWv3P9c3KtCfybdQiesRB/uZlnnrKPAlf 5ViA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a98f00a09dsi372822285a.394.2024.09.05.22.20.02 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:20:02 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smRNH-0004Kf-6G; Fri, 06 Sep 2024 01:19:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMn-0002Nh-76; Fri, 06 Sep 2024 01:18:42 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smRMl-0008D3-EG; Fri, 06 Sep 2024 01:18:40 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BECD18C12E; Fri, 6 Sep 2024 08:15:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 6E2A7133373; Fri, 6 Sep 2024 08:16:35 +0300 (MSK) Received: (nullmailer pid 10461 invoked by uid 1000); Fri, 06 Sep 2024 05:16:33 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zheyu Ma , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.14 25/40] hw/sd/sdhci: Reset @data_count index on invalid ADMA transfers Date: Fri, 6 Sep 2024 08:16:13 +0300 Message-Id: <20240906051633.10288-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé We neglected to clear the @data_count index on ADMA error, allowing to trigger assertion in sdhci_read_dataport() or sdhci_write_dataport(). Cc: qemu-stable@nongnu.org Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Reported-by: Zheyu Ma Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2455 Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Richard Henderson Message-Id: <20240730092138.32443-4-philmd@linaro.org> (cherry picked from commit ed5a159c3de48a581f46de4c8c02b4b295e6c52d) Signed-off-by: Michael Tokarev diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index abd503d168..c4a9b5956d 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -846,6 +846,7 @@ static void sdhci_do_adma(SDHCIState *s) } } if (res != MEMTX_OK) { + s->data_count = 0; if (s->errintstsen & SDHC_EISEN_ADMAERR) { trace_sdhci_error("Set ADMA error flag"); s->errintsts |= SDHC_EIS_ADMAERR; From patchwork Fri Sep 6 05:16:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825903 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp638345wrb; Thu, 5 Sep 2024 22:21:43 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWQtPXu9pMJ6o7HstL55qZLJC80msaZ+2B1Fz0ufbucu1OZHmrumSqkUxO6Jnp+ytmn0GqJXw==@linaro.org X-Google-Smtp-Source: AGHT+IFQbz7jTaKYtGjggSHsa7Z4HqsuchCNwwd+GmW9qsxOtsLmhXHLf/sN+2FwBG3pcSh4NgSK X-Received: by 2002:a05:6214:5507:b0:6c3:56db:c292 with SMTP id 6a1803df08f44-6c356dbc354mr173806436d6.54.1725600103299; Thu, 05 Sep 2024 22:21:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600103; cv=none; d=google.com; s=arc-20240605; b=Mpe5QTmHG8VZZ5sSObMwiW0B3Cm7GS6bti9D3QPbKnIoiZxUiSZi7whMXuaHDJleb/ 54wGMuoke0Rxh+7G2TIGZsF/uu/fdivXIHw+AxFfH8H3ffbKAdx2Bbzcg7WCOrWbF5z0 hodKZ1+RVye09pkJVn0ZH8pId323mxdxn/JdJ7VTZOwnsYPS9dLmUCKmX8Es6As4ypJ2 JeC4K2whZDQ1sUxFqi5d6Yutat6qJtANoPHO25fxuK84G6Ep0qIega2Lh18FQRIgghbl fKDUwUbcknuWu3eDHaH3dJ3kSwqj0UrDxE70Hh8HQ4gYfBho3nC838K1DcgVPtwW/0Yo D+mg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=+in/DyVFu2COOQcr3zqxsRFMHNEtFrYSIMNT2sL7X0M=; fh=73++FxpCBH5KDXgG1Nqvg9f5zGI68qj4hqVYWy1KEho=; b=agiEBtZKID9uV8McUZfm0KFIb3r76GUxaaSEgeM852T2JHt9oCVBnyEG49mc+FHlJ1 YgffHjX1wnHXo/4wK2RwHCIFHlKes8QF/5Q6bA3n9ZMdqW9At0XhtKJfSTVSzGjBs2jV /LR9HgqwksJp3SoQ6SY1RihSwtFKrdkkSlV8LhxEdnIGvsfYzjW6hv+RKWh7gZsZqlX/ HCzrpyC6WQKQVKHhlkNgmPed3M8Ggpz2v71IusmgsQ45VL5vfl3YoDUlylsruEvVGd9r iV+Or8OmjFyJtSJ/rh19C8DpPKjBT7ysVaYH6E9sB7FJ6xXLU5nv/bYw3OoUEOkSRiki LYbg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6c52031fd9dsi36348646d6.235.2024.09.05.22.21.43 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:21:43 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smROo-0005p1-84; Fri, 06 Sep 2024 01:20:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smROO-0004RO-V8; Fri, 06 Sep 2024 01:20:26 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smROB-0008NS-0b; Fri, 06 Sep 2024 01:20:08 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 7F4318C13A; Fri, 6 Sep 2024 08:15:18 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 2FAE413337F; Fri, 6 Sep 2024 08:16:36 +0300 (MSK) Received: (nullmailer pid 10498 invoked by uid 1000); Fri, 06 Sep 2024 05:16:34 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Richard Henderson , Paolo Bonzini , Michael Tokarev Subject: [Stable-7.2.14 37/40] target/i386: Do not apply REX to MMX operands Date: Fri, 6 Sep 2024 08:16:25 +0300 Message-Id: <20240906051633.10288-37-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Richard Henderson Cc: qemu-stable@nongnu.org Fixes: b3e22b2318a ("target/i386: add core of new i386 decoder") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2495 Signed-off-by: Richard Henderson Link: https://lore.kernel.org/r/20240812025844.58956-2-richard.henderson@linaro.org Signed-off-by: Paolo Bonzini (cherry picked from commit 416f2b16c02c618c0f233372ebfe343f9ee667d4) Signed-off-by: Michael Tokarev diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc index 1dfc368456..88de92ed16 100644 --- a/target/i386/tcg/decode-new.c.inc +++ b/target/i386/tcg/decode-new.c.inc @@ -1176,7 +1176,10 @@ static bool decode_op(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode, op->unit = X86_OP_SSE; } get_reg: - op->n = ((get_modrm(s, env) >> 3) & 7) | REX_R(s); + op->n = ((get_modrm(s, env) >> 3) & 7); + if (op->unit != X86_OP_MMX) { + op->n |= REX_R(s); + } break; case X86_TYPE_E: /* ALU modrm operand */ From patchwork Fri Sep 6 05:16:27 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 825907 Delivered-To: patch@linaro.org Received: by 2002:adf:a345:0:b0:367:895a:4699 with SMTP id d5csp639536wrb; Thu, 5 Sep 2024 22:27:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXfp0KAqmGXTaJDLv/UqU3VUo5knFTDjJdCsXMLCKidd80h/tLCMkkKU4LTj1ob3JUTKgQdTA==@linaro.org X-Google-Smtp-Source: AGHT+IGBXPT+p4dkyFDy22okFfoWmgiZy3MVgH4q19XI6ojn4116ICcI3cYTf37GVM+AW9+Pm/ed X-Received: by 2002:ac8:5a84:0:b0:454:f3fb:2bff with SMTP id d75a77b69052e-457f8bc56f9mr141747421cf.15.1725600427221; Thu, 05 Sep 2024 22:27:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1725600427; cv=none; d=google.com; s=arc-20240605; b=de91GKyzUyX71wYDxGGqoG4pLSI7+KS5KUptFVUK9nyHZF/JbGPR/Mty3N7SvN641O ArupFWLT6Tl7zL/pkHgyXV3BruN1jeW1hsQx+NDbeU2uSrqegJj0kcgEfliFHLchU8yR neiFylVU9Fsl/ugg6ROnq50x7Q0ea0ze39Fzm/GiOki3ZNTnMqBw6DPRCZsDQELQsQLy m6P8T4CiIKZOewRPQx/MKC1oByjIx2pCxcrPEJW0sKFNc3Q7v1yj5nMKph52jJoSYJPN nuG34Oi+nXS2KUBtwg4wy3KdayXN/AUoZHBix/Xv+zq0R3nEvQCJg4487xVn1pwiG8cf 6eKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=8WAFiRoMNMFSxEhAH0VURHMNNFDw6dFyTjxgSQ6GU+o=; fh=QCiO3s1cvaqADEyfPI2NiS1m5l7Cs6ciWF636GXs0Bw=; b=UfU+sAwPv/fFJabk/Gh4jPXYu8iuFbDIXTQ488VFs9utrBcKBKcpuLYprEnXt/8QVu LP8WDuo0a/kRTiFhWCIi4lPIU6pu3uoOlCL4Eutj0vJN2WDFEoONDBxO7qHYMmxV5FJ1 V8ujqrkq0e9l00PinXrfMQl2QJgvCMM12sJCF7x6poIzJkUlYr++Q/i2maAFz6ca4i3H FWDJ/645x3Sd2GiqOaveb3x2OOlYYYScUY+FSkAXeOO1akQxCWzo49i9XVb2N91Qr6Ty NJtHZ+79qLRGwMXzWA9tg3x/LTk7nGMKldHrju9fVVXy1NDcZQHJfq1sY9PM7kTWbhzy v9KA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-45809c85134si22473691cf.284.2024.09.05.22.27.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 05 Sep 2024 22:27:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smROu-000723-R7; Fri, 06 Sep 2024 01:20:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smROW-0004zj-Kj; Fri, 06 Sep 2024 01:20:30 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smROR-0000Bh-Gj; Fri, 06 Sep 2024 01:20:25 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 9FECD8C13C; Fri, 6 Sep 2024 08:15:18 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 4E226133381; Fri, 6 Sep 2024 08:16:36 +0300 (MSK) Received: (nullmailer pid 10504 invoked by uid 1000); Fri, 06 Sep 2024 05:16:34 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Daniel_P_=2E_Berrang=C3=A9?= , =?utf-8?q?Phi?= =?utf-8?q?lippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.14 39/40] crypto/tlscredspsk: Free username on finalize Date: Fri, 6 Sep 2024 08:16:27 +0300 Message-Id: <20240906051633.10288-39-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When the creds->username property is set we allocate memory for it in qcrypto_tls_creds_psk_prop_set_username(), but we never free this when the QCryptoTLSCredsPSK is destroyed. Free the memory in finalize. This fixes a LeakSanitizer complaint in migration-test: $ (cd build/asan; ASAN_OPTIONS="fast_unwind_on_malloc=0" QTEST_QEMU_BINARY=./qemu-system-x86_64 ./tests/qtest/migration-test --tap -k -p /x86_64/migration/precopy/unix/tls/psk) ================================================================= ==3867512==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x5624e5c99dee in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x218edee) (BuildId: a9e623fa1009a9435c0142c037cd7b8c1ad04ce3) #1 0x7fb199ae9738 in g_malloc debian/build/deb/../../../glib/gmem.c:128:13 #2 0x7fb199afe583 in g_strdup debian/build/deb/../../../glib/gstrfuncs.c:361:17 #3 0x5624e82ea919 in qcrypto_tls_creds_psk_prop_set_username /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../crypto/tlscredspsk.c:255:23 #4 0x5624e812c6b5 in property_set_str /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object.c:2277:5 #5 0x5624e8125ce5 in object_property_set /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object.c:1463:5 #6 0x5624e8136e7c in object_set_properties_from_qdict /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:55:14 #7 0x5624e81372d2 in user_creatable_add_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:112:5 #8 0x5624e8137964 in user_creatable_add_qapi /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/object_interfaces.c:157:11 #9 0x5624e891ba3c in qmp_object_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qom/qom-qmp-cmds.c:227:5 #10 0x5624e8af9118 in qmp_marshal_object_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qapi/qapi-commands-qom.c:337:5 #11 0x5624e8bd1d49 in do_qmp_dispatch_bh /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../qapi/qmp-dispatch.c:128:5 #12 0x5624e8cb2531 in aio_bh_call /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:171:5 #13 0x5624e8cb340c in aio_bh_poll /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:218:13 #14 0x5624e8c0be98 in aio_dispatch /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/aio-posix.c:423:5 #15 0x5624e8cba3ce in aio_ctx_dispatch /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/async.c:360:5 #16 0x7fb199ae0d3a in g_main_dispatch debian/build/deb/../../../glib/gmain.c:3419:28 #17 0x7fb199ae0d3a in g_main_context_dispatch debian/build/deb/../../../glib/gmain.c:4137:7 #18 0x5624e8cbe1d9 in glib_pollfds_poll /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:287:9 #19 0x5624e8cbcb13 in os_host_main_loop_wait /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:310:5 #20 0x5624e8cbc6dc in main_loop_wait /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../util/main-loop.c:589:11 #21 0x5624e6f3f917 in qemu_main_loop /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/runstate.c:801:9 #22 0x5624e893379c in qemu_default_main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/main.c:37:14 #23 0x5624e89337e7 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/../../system/main.c:48:12 #24 0x7fb197972d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #25 0x7fb197972e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #26 0x5624e5c16fa4 in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-x86_64+0x210bfa4) (BuildId: a9e623fa1009a9435c0142c037cd7b8c1ad04ce3) SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Daniel P. Berrangé Message-ID: <20240819145021.38524-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 87e012f29f2e47dcd8c385ff8bb8188f9e06d4ea) Signed-off-by: Michael Tokarev diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c index 546cad1c5a..0d6b71a37c 100644 --- a/crypto/tlscredspsk.c +++ b/crypto/tlscredspsk.c @@ -243,6 +243,7 @@ qcrypto_tls_creds_psk_finalize(Object *obj) QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj); qcrypto_tls_creds_psk_unload(creds); + g_free(creds->username); } static void