target-arm queue for rc1 -- these are all bug fixes.

The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715

for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:

target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)

* report ARMv8-A FP support for AArch32 -cpu max

* hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory

* hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]

* hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO

* hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO

* hw/arm/virt: Fix non-secure flash mode

* pl031: Correctly migrate state when using -rtc clock=host

* fix regression that meant arm926 and arm1026 lost VFP

double-precision support

* v8M: NS BusFault on vector table fetch escalates to NS HardFault

Alex Bennée (1):

target/arm: report ARMv8-A FP support for AArch32 -cpu max

David Engraf (1):

hw/arm/virt: Fix non-secure flash mode

Peter Maydell (3):

pl031: Correctly migrate state when using -rtc clock=host

target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026

target/arm: NS BusFault on vector table fetch escalates to NS HardFault

Philippe Mathieu-Daudé (5):

hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs

hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory

hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]

hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO

hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO

From: Alex Bennée <alex.bennee@linaro.org>

When we converted to using feature bits in 602f6e42cfbf we missed out

the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for

-cpu max configurations. This caused a regression in the GCC test

suite. Fix this by setting the appropriate bits in mvfr1.FPHP to

report ARMv8-A with FP support (but not ARMv8.2-FP16).

Fixes: https://bugs.launchpad.net/qemu/+bug/1836078

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20190711103737.10017-1-alex.bennee@linaro.org

target/arm/cpu.c | 4 ++++

1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)

t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);

cpu->isar.id_isar6 = t;

+ t = cpu->isar.mvfr1;

+ t = FIELD_DP32(t, MVFR1, FPHP, 2); /* v8.0 FP support */

+ cpu->isar.mvfr1 = t;

t = cpu->isar.mvfr2;

t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */

t = FIELD_DP32(t, MVFR2, FPMISC, 4); /* FP MaxNum */

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Lei Sun found while auditing the code that a CPU write would

trigger a NULL pointer dereference.

>From UG1085 datasheet [*] AXI writes in this region are ignored

and generates an AXI Slave Error (SLVERR).

Fix by implementing the write_with_attrs() handler.

Return MEMTX_ERROR when the region is accessed (this error maps

to an AXI slave error).

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf

Reported-by: Lei Sun <slei.casper@gmail.com>

Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>

Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

hw/ssi/xilinx_spips.c | 16 ++++++++++++++++

1 file changed, 16 insertions(+)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c

--- a/hw/ssi/xilinx_spips.c

+++ b/hw/ssi/xilinx_spips.c

@@ -XXX,XX +XXX,XX @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,

return lqspi_read(opaque, addr, value, size, attrs);

}

+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,

+ unsigned size, MemTxAttrs attrs)

+{

+ /*

+ * From UG1085, Chapter 24 (Quad-SPI controllers):

+ * - Writes are ignored

+ * - AXI writes generate an external AXI slave error (SLVERR)

+ */

+ qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64

+ " (value: 0x%" PRIx64 "\n",

+ __func__, size << 3, offset, value);

+ return MEMTX_ERROR;

static const MemoryRegionOps lqspi_ops = {

.read_with_attrs = lqspi_read,

+ .write_with_attrs = lqspi_write,

.endianness = DEVICE_NATIVE_ENDIAN,

.valid = {

.min_access_size = 1,

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Reading the RX_DATA register when the RX_FIFO is empty triggers

an abort. This can be easily reproduced:

$ qemu-system-arm -M emcraft-sf2 -monitor stdio -S

QEMU 4.0.50 monitor - type 'help' for more information

(qemu) x 0x40001010

Aborted (core dumped)

(gdb) bt

#1 0x00007f035874f895 in abort () at /lib64/libc.so.6

#2 0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66

#3 0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137

#4 0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168

#5 0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439

#6 0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569

#7 0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420

#8 0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447

#9 0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385

#10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423

#11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436

#12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466

#13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976

#14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730

#15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785

#16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082

From the datasheet "Actel SmartFusion Microcontroller Subsystem

User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this

register has a reset value of 0.

Check the FIFO is not empty before accessing it, else log an

error message.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20190709113715.7761-3-philmd@redhat.com

hw/ssi/mss-spi.c | 8 +++++++-

1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c

--- a/hw/ssi/mss-spi.c

+++ b/hw/ssi/mss-spi.c

@@ -XXX,XX +XXX,XX @@ spi_read(void *opaque, hwaddr addr, unsigned int size)

case R_SPI_RX:

s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;

s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;

- ret = fifo32_pop(&s->rx_fifo);

+ if (fifo32_is_empty(&s->rx_fifo)) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: Reading empty RX_FIFO\n",

+ __func__);

+ } else {

+ ret = fifo32_pop(&s->rx_fifo);