From a8749d7cc9210ae76bb7032970ad8a208c67a1f2 Mon Sep 17 00:00:00 2001 From: David Hildenbrand Date: Tue, 1 Feb 2022 11:09:40 +0100 Subject: [PATCH 1/3] memory: Make memory_region_readd_subregion() properly handle mapped aliases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit memory_region_readd_subregion() wants to readd a region by first removing it and then readding it. For readding, it doesn't use one of the memory_region_add_*() variants, which is why fail to re-increment the mr->mapped_via_alias counters, resulting in the assert(alias->mapped_via_alias >= 0) in memory_region_del_subregion() triggering the next time we call memory_region_readd_subregion(). Fix it by using memory_region_add_subregion_common() for readding the region. Reported-by: Niek Linnenbank Fixes: 5ead62185d23 ("memory: Make memory_region_is_mapped() succeed when mapped via an alias") Tested-by: Niek Linnenbank Cc: Paolo Bonzini Cc: Peter Xu Cc: "Philippe Mathieu-Daudé" Signed-off-by: David Hildenbrand Message-Id: <20220201100940.47788-1-david@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- softmmu/memory.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/softmmu/memory.c b/softmmu/memory.c index 8060c6de78..bfa5d5178c 100644 --- a/softmmu/memory.c +++ b/softmmu/memory.c @@ -2626,8 +2626,7 @@ static void memory_region_readd_subregion(MemoryRegion *mr) memory_region_transaction_begin(); memory_region_ref(mr); memory_region_del_subregion(container, mr); - mr->container = container; - memory_region_update_container_subregions(mr); + memory_region_add_subregion_common(container, mr->addr, mr); memory_region_unref(mr); memory_region_transaction_commit(); } From 8cd0e66353018f63322e0dd200b2d31be265f883 Mon Sep 17 00:00:00 2001 From: WANG Xuerui Date: Mon, 28 Mar 2022 11:59:42 +0800 Subject: [PATCH 2/3] target/mips: Fix address space range declaration on n32 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This bug is probably lurking there for so long, I cannot even git-blame my way to the commit first introducing it. Anyway, because n32 is also TARGET_MIPS64, the address space range cannot be determined by looking at TARGET_MIPS64 alone. Fix this by only declaring 48-bit address spaces for n64, or the n32 user emulation will happily hand out memory ranges beyond the 31-bit limit and crash. Confirmed to make the minimal reproducing example in the linked issue behave. Closes: https://gitlab.com/qemu-project/qemu/-/issues/939 Cc: Philippe Mathieu-Daudé Cc: Aurelien Jarno Cc: Jiaxun Yang Cc: Aleksandar Rikalo Signed-off-by: WANG Xuerui Tested-by: Andreas K. Huettel Reviewed-by: Richard Henderson Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20220328035942.3299661-1-xen0n@gentoo.org> Signed-off-by: Philippe Mathieu-Daudé --- target/mips/cpu-param.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/mips/cpu-param.h b/target/mips/cpu-param.h index 9c4a6ea45e..1aebd01df9 100644 --- a/target/mips/cpu-param.h +++ b/target/mips/cpu-param.h @@ -12,7 +12,7 @@ #else # define TARGET_LONG_BITS 32 #endif -#ifdef TARGET_MIPS64 +#ifdef TARGET_ABI_MIPSN64 #define TARGET_PHYS_ADDR_SPACE_BITS 48 #define TARGET_VIRT_ADDR_SPACE_BITS 48 #else From 77d119dd335f910c7f953a265726e3753c69a0bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20K=2E=20H=C3=BCttel?= Date: Mon, 28 Mar 2022 22:49:01 +0200 Subject: [PATCH 3/3] qemu-binfmt-conf.sh: mips: allow nonzero EI_ABIVERSION, distinguish o32 and n32 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With the command line flag -mplt and a recent toolchain, ELF binaries generated by gcc can obtain EI_ABIVERSION=1, which makes, e.g., gcc three-stage bootstrap in a mips-unknown-linux-gnu qemu-user chroot fail since the binfmt-misc magic does not match anymore. Also other values are technically possible. qemu executes these binaries just fine, so relax the mask for the EI_ABIVERSION byte at offset 0x08. In addition, extend magic string to distinguish mips o32 and n32 ABI. This information is given by the EF_MIPS_ABI2 (0x20) bit in the e_flags field of the ELF header (a 4-byte value at offset 0x24 for the here applicable ELFCLASS32). See-also: ace3d65459 Signed-off-by: Andreas K. Hüttel Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: WANG Xuerui Cc: Laurent Vivier Cc: WANG Xuerui Cc: Richard Henderson Cc: Alex Bennee Cc: Philippe Mathieu-Daudé Closes: https://gitlab.com/qemu-project/qemu/-/issues/843 Message-Id: <20220328204900.3914990-1-dilfridge@gentoo.org> Signed-off-by: Philippe Mathieu-Daudé --- scripts/qemu-binfmt-conf.sh | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh index e9bfeb94d3..9cb723f443 100755 --- a/scripts/qemu-binfmt-conf.sh +++ b/scripts/qemu-binfmt-conf.sh @@ -60,28 +60,28 @@ m68k_family=m68k # FIXME: We could use the other endianness on a MIPS host. -mips_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08' -mips_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' +mips_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' +mips_mask='\xff\xff\xff\xff\xff\xff\xff\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' mips_family=mips -mipsel_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00' -mipsel_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff' +mipsel_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' +mipsel_mask='\xff\xff\xff\xff\xff\xff\xff\x00\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00' mipsel_family=mips -mipsn32_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08' -mipsn32_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' +mipsn32_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' +mipsn32_mask='\xff\xff\xff\xff\xff\xff\xff\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20' mipsn32_family=mips -mipsn32el_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00' -mipsn32el_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff' +mipsn32el_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00' +mipsn32el_mask='\xff\xff\xff\xff\xff\xff\xff\x00\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00' mipsn32el_family=mips mips64_magic='\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08' -mips64_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' +mips64_mask='\xff\xff\xff\xff\xff\xff\xff\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff' mips64_family=mips mips64el_magic='\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00' -mips64el_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff' +mips64el_mask='\xff\xff\xff\xff\xff\xff\xff\x00\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff' mips64el_family=mips sh4_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x2a\x00'