Mostly just bug fixes. The important one here is

hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register

which fixes a buffer overrun that's a security issue if you're running

KVM on Arm with kernel-irqchip=off (which hopefully nobody is doing in

a security context, because kernel-irqchip=on is the default and the

sensible choice for performance).

-- PMM

The following changes since commit cf7ca7d5b9faca13f1f8e3ea92cfb2f741eb0c0e:

Merge remote-tracking branch 'remotes/stefanha-gitlab/tags/tracing-pull-request' into staging (2021-02-01 16:28:00 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210202-1

for you to fetch changes up to 14657850c9cc10948551fbb884c30eb5a3a7370a:

hw/arm: Display CPU type in machine description (2021-02-02 17:53:44 +0000)

* hw/intc/arm_gic: Allow to use QTest without crashing

* hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled

* hw/char/exynos4210_uart: Fix missing call to report ready for input

* hw/arm/smmuv3: Fix addr_mask for range-based invalidation

* hw/ssi/imx_spi: Fix various minor bugs

* hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register

* hw/arm: Add missing Kconfig dependencies

* hw/arm: Display CPU type in machine description

Bin Meng (5):

hw/ssi: imx_spi: Use a macro for number of chip selects supported

hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset()

hw/ssi: imx_spi: Round up the burst length to be multiple of 8

hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic

hw/ssi: imx_spi: Correct tx and rx fifo endianness

Iris Johnson (2):

hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled

hw/char/exynos4210_uart: Fix missing call to report ready for input

Philippe Mathieu-Daudé (12):

hw/intc/arm_gic: Allow to use QTest without crashing

hw/ssi: imx_spi: Remove pointless variable initialization

hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value

hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled

hw/ssi: imx_spi: Rework imx_spi_write() to handle block disabled

hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register

hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ

hw/arm/exynos4210: Add missing dependency on OR_IRQ

hw/arm/xlnx-versal: Versal SoC requires ZDMA

hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals

hw/net/can: ZynqMP CAN device requires PTIMER

hw/arm: Display CPU type in machine description

Xuzhou Cheng (1):

hw/ssi: imx_spi: Disable chip selects when controller is disabled

Zenghui Yu (1):

hw/arm/smmuv3: Fix addr_mask for range-based invalidation

include/hw/ssi/imx_spi.h | 5 +-

hw/arm/digic_boards.c | 2 +-

hw/arm/microbit.c | 2 +-

hw/arm/netduino2.c | 2 +-

hw/arm/netduinoplus2.c | 2 +-

hw/arm/orangepi.c | 2 +-

hw/arm/smmuv3.c | 4 +-

hw/arm/stellaris.c | 4 +-

hw/char/exynos4210_uart.c | 7 ++-

hw/intc/arm_gic.c | 5 +-

hw/ssi/imx_spi.c | 153 +++++++++++++++++++++++++++++-----------------

hw/Kconfig | 1 +

hw/arm/Kconfig | 5 ++

hw/dma/Kconfig | 3 +

hw/dma/meson.build | 2 +-

15 files changed, 130 insertions(+), 69 deletions(-)

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Alexander reported an issue in gic_get_current_cpu() using the

fuzzer. Yet another "deref current_cpu with QTest" bug, reproducible

doing:

$ echo readb 0xf03ff000 | qemu-system-arm -M npcm750-evb,accel=qtest -qtest stdio

[I 1611849440.651452] OPENED

[R +0.242498] readb 0xf03ff000

hw/intc/arm_gic.c:63:29: runtime error: member access within null pointer of type 'CPUState' (aka 'struct CPUState')

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/intc/arm_gic.c:63:29 in

AddressSanitizer:DEADLYSIGNAL

=================================================================

==3719691==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000082a0 (pc 0x5618790ac882 bp 0x7ffca946f4f0 sp 0x7ffca946f4a0 T0)

==3719691==The signal is caused by a READ memory access.

#0 0x5618790ac882 in gic_get_current_cpu hw/intc/arm_gic.c:63:29

#1 0x5618790a8901 in gic_dist_readb hw/intc/arm_gic.c:955:11

#2 0x5618790a7489 in gic_dist_read hw/intc/arm_gic.c:1158:17

#3 0x56187adc573b in memory_region_read_with_attrs_accessor softmmu/memory.c:464:9

#4 0x56187ad7903a in access_with_adjusted_size softmmu/memory.c:552:18

#5 0x56187ad766d6 in memory_region_dispatch_read1 softmmu/memory.c:1426:16

#6 0x56187ad758a8 in memory_region_dispatch_read softmmu/memory.c:1449:9

#7 0x56187b09e84c in flatview_read_continue softmmu/physmem.c:2822:23

#8 0x56187b0a0115 in flatview_read softmmu/physmem.c:2862:12

#9 0x56187b09fc9e in address_space_read_full softmmu/physmem.c:2875:18

#10 0x56187aa88633 in address_space_read include/exec/memory.h:2489:18

#11 0x56187aa88633 in qtest_process_command softmmu/qtest.c:558:13

#12 0x56187aa81881 in qtest_process_inbuf softmmu/qtest.c:797:9

#13 0x56187aa80e02 in qtest_read softmmu/qtest.c:809:5

current_cpu is NULL because QTest accelerator does not use CPU.

Fix by skipping the check and returning the first CPU index when

QTest accelerator is used, similarly to commit c781a2cc423

("hw/i386/vmport: Allow QTest use without crashing").

Reported-by: Alexander Bulekov <alxndr@bu.edu>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

Reviewed-by: Alexander Bulekov <alxndr@bu.edu>

Message-id: 20210128161417.3726358-1-philmd@redhat.com

hw/intc/arm_gic.c | 3 ++-

1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c

--- a/hw/intc/arm_gic.c

+++ b/hw/intc/arm_gic.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/module.h"

#include "trace.h"

#include "sysemu/kvm.h"

+#include "sysemu/qtest.h"

/* #define DEBUG_GIC */

@@ -XXX,XX +XXX,XX @@ static const uint8_t gic_id_gicv2[] = {

static inline int gic_get_current_cpu(GICState *s)

{

- if (s->num_cpu > 1) {

+ if (!qtest_enabled() && s->num_cpu > 1) {

return current_cpu->cpu_index;

From: Iris Johnson <iris@modwiz.com>

Currently the Exynos 4210 UART code always reports available FIFO space

when the backend checks for buffer space. When the FIFO is disabled this

is behavior causes the backend chardev code to replace the data before the

guest can read it.

This patch changes adds the logic to report the capacity properly when the

FIFO is not being used.

Buglink: https://bugs.launchpad.net/qemu/+bug/1913344

Signed-off-by: Iris Johnson <iris@modwiz.com>

Message-id: 20210128033655.1029577-1-iris@modwiz.com

hw/char/exynos4210_uart.c | 6 +++++-

1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c

--- a/hw/char/exynos4210_uart.c

+++ b/hw/char/exynos4210_uart.c

@@ -XXX,XX +XXX,XX @@ static int exynos4210_uart_can_receive(void *opaque)

{

Exynos4210UartState *s = (Exynos4210UartState *)opaque;

- return fifo_empty_elements_number(&s->rx);

+ if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) {

+ return fifo_empty_elements_number(&s->rx);

+ } else {

+ return !(s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY);

+ }

static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size)

From: Iris Johnson <iris@modwiz.com>

When the frontend device has no space for a read the fd is removed

from polling to allow time for the guest to read and clear the buffer.

Without the call to qemu_chr_fe_accept_input(), the poll will not be

broken out of when the guest has cleared the buffer causing significant

IO delays that get worse with smaller buffers.

Buglink: https://bugs.launchpad.net/qemu/+bug/1913341

Signed-off-by: Iris Johnson <iris@modwiz.com>

Message-id: 20210130184016.1787097-1-iris@modwiz.com

hw/char/exynos4210_uart.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c

--- a/hw/char/exynos4210_uart.c

+++ b/hw/char/exynos4210_uart.c

@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset,

s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY;

res = s->reg[I_(URXH)];

}

+ qemu_chr_fe_accept_input(&s->chr);

exynos4210_uart_update_dmabusy(s);

trace_exynos_uart_read(s->channel, offset,

exynos4210_uart_regname(offset), res);

From: Zenghui Yu <yuzenghui@huawei.com>

When handling guest range-based IOTLB invalidation, we should decode the TG

field into the corresponding translation granule size so that we can pass

the correct invalidation range to backend. Set @granule to (tg * 2 + 10) to

properly emulate the architecture.

Fixes: d52915616c05 ("hw/arm/smmuv3: Get prepared for range invalidation")

Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>

Acked-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20210130043220.1345-1-yuzenghui@huawei.com

hw/arm/smmuv3.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,

{

SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);

IOMMUTLBEvent event;

- uint8_t granule = tg;

+ uint8_t granule;

if (!tg) {

SMMUEventInfo event = {.inval_ste_allowed = true};

@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,

return;

}

granule = tt->granule_sz;

+ } else {

+ granule = tg * 2 + 10;

event.type = IOMMU_NOTIFIER_UNMAP;

From: Bin Meng <bin.meng@windriver.com>

Avoid using a magic number (4) everywhere for the number of chip

selects supported.

Signed-off-by: Bin Meng <bin.meng@windriver.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Juan Quintela <quintela@redhat.com>

Message-id: 20210129132323.30946-2-bmeng.cn@gmail.com

include/hw/ssi/imx_spi.h | 5 ++++-

hw/ssi/imx_spi.c | 4 ++--

2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/hw/ssi/imx_spi.h b/include/hw/ssi/imx_spi.h

--- a/include/hw/ssi/imx_spi.h

+++ b/include/hw/ssi/imx_spi.h

@@ -XXX,XX +XXX,XX @@

#define EXTRACT(value, name) extract32(value, name##_SHIFT, name##_LENGTH)

+/* number of chip selects supported */

+#define ECSPI_NUM_CS 4

+

#define TYPE_IMX_SPI "imx.spi"

OBJECT_DECLARE_SIMPLE_TYPE(IMXSPIState, IMX_SPI)

@@ -XXX,XX +XXX,XX @@ struct IMXSPIState {

qemu_irq irq;

- qemu_irq cs_lines[4];

+ qemu_irq cs_lines[ECSPI_NUM_CS];

SSIBus *bus;

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/imx_spi.c

+++ b/hw/ssi/imx_spi.c

@@ -XXX,XX +XXX,XX @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value,

/* We are in master mode */

- for (i = 0; i < 4; i++) {

+ for (i = 0; i < ECSPI_NUM_CS; i++) {

qemu_set_irq(s->cs_lines[i],

i == imx_spi_selected_channel(s) ? 0 : 1);

}

@@ -XXX,XX +XXX,XX @@ static void imx_spi_realize(DeviceState *dev, Error **errp)

sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);

sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);

- for (i = 0; i < 4; ++i) {

+ for (i = 0; i < ECSPI_NUM_CS; ++i) {

sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->cs_lines[i]);

}

From: Bin Meng <bin.meng@windriver.com>

Usually the approach is that the device on the other end of the line

is going to reset its state anyway, so there's no need to actively

signal an irq line change during the reset hook.

Move imx_spi_update_irq() out of imx_spi_reset(), to a new function

imx_spi_soft_reset() that is called when the controller is disabled.

Signed-off-by: Bin Meng <bin.meng@windriver.com>

hw/ssi/imx_spi.c | 14 ++++++++++----

1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c

--- a/hw/ssi/imx_spi.c

+++ b/hw/ssi/imx_spi.c

@@ -XXX,XX +XXX,XX @@ static void imx_spi_reset(DeviceState *dev)

imx_spi_rxfifo_reset(s);

imx_spi_txfifo_reset(s);

- imx_spi_update_irq(s);

-

s->burst_length = 0;

+static void imx_spi_soft_reset(IMXSPIState *s)

+{

+ imx_spi_reset(DEVICE(s));

+

+ imx_spi_update_irq(s);

+}

+

static uint64_t imx_spi_read(void *opaque, hwaddr offset, unsigned size)

{

uint32_t value = 0;

@@ -XXX,XX +XXX,XX @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value,

s->regs[ECSPI_CONREG] = value;

if (!imx_spi_is_enabled(s)) {

- /* device is disabled, so this is a reset */

- imx_spi_reset(DEVICE(s));

+ /* device is disabled, so this is a soft reset */

+ imx_spi_soft_reset(s);

+

return;

}

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

'burst_length' is cleared in imx_spi_reset(), which is called

after imx_spi_realize(). Remove the initialization to simplify.

Reviewed-by: Juan Quintela <quintela@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Bin Meng <bin.meng@windriver.com>

Signed-off-by: Bin Meng <bin.meng@windriver.com>

Message-id: 20210129132323.30946-4-bmeng.cn@gmail.com

Message-Id: <20210115153049.3353008-3-f4bug@amsat.org>

Reviewed-by: Bin Meng <bin.meng@windriver.com>

Signed-off-by: Bin Meng <bin.meng@windriver.com>

hw/ssi/imx_spi.c | 2 --

1 file changed, 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c

--- a/hw/ssi/imx_spi.c

+++ b/hw/ssi/imx_spi.c

@@ -XXX,XX +XXX,XX @@ static void imx_spi_realize(DeviceState *dev, Error **errp)

sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->cs_lines[i]);

- s->burst_length = 0;

fifo32_create(&s->tx_fifo, ECSPI_FIFO_SIZE);

fifo32_create(&s->rx_fifo, ECSPI_FIFO_SIZE);

}

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

When the block is disabled, all registers are reset with the

exception of the ECSPI_CONREG. It is initialized to zero

when the instance is created.

Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM),

chapter 21.7.3: Control Register (ECSPIx_CONREG)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Bin Meng <bin.meng@windriver.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20210129132323.30946-5-bmeng.cn@gmail.com

[bmeng: add a 'common_reset' function that does most of reset operation]

Signed-off-by: Bin Meng <bin.meng@windriver.com>

hw/ssi/imx_spi.c | 32 ++++++++++++++++++++++++--------

1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c

--- a/hw/ssi/imx_spi.c

+++ b/hw/ssi/imx_spi.c

@@ -XXX,XX +XXX,XX @@ static void imx_spi_flush_txfifo(IMXSPIState *s)

fifo32_num_used(&s->tx_fifo), fifo32_num_used(&s->rx_fifo));

-static void imx_spi_reset(DeviceState *dev)

+static void imx_spi_common_reset(IMXSPIState *s)

{

- IMXSPIState *s = IMX_SPI(dev);

+ int i;

- DPRINTF("\n");

-

- memset(s->regs, 0, sizeof(s->regs));

-

- s->regs[ECSPI_STATREG] = 0x00000003;

+ for (i = 0; i < ARRAY_SIZE(s->regs); i++) {

+ switch (i) {

+ case ECSPI_CONREG:

+ /* CONREG is not updated on soft reset */

+ break;

+ case ECSPI_STATREG:

+ s->regs[i] = 0x00000003;

+ break;

+ default:

+ s->regs[i] = 0;

+ break;

+ }

+ }

imx_spi_rxfifo_reset(s);

imx_spi_txfifo_reset(s);

@@ -XXX,XX +XXX,XX @@ static void imx_spi_reset(DeviceState *dev)

static void imx_spi_soft_reset(IMXSPIState *s)

{

- imx_spi_reset(DEVICE(s));

+ imx_spi_common_reset(s);

imx_spi_update_irq(s);

}

+static void imx_spi_reset(DeviceState *dev)

+ IMXSPIState *s = IMX_SPI(dev);

+

+ imx_spi_common_reset(s);

+ s->regs[ECSPI_CONREG] = 0;