Series comparison

-[Qemu-devel] [PULL 00/10] target-arm queue
+[PULL 0/7] target-arm queue
-target-arm queue for rc1 -- these are all bug fixes.
+Small pullreq with some bug fixes to go into rc1.
-thanks
 -- PMM
-The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:
+The following changes since commit 5ca634afcf83215a9a54ca6e66032325b5ffb5f6:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)
+  Merge remote-tracking branch 'remotes/philmd/tags/sdmmc-20210322' into staging (2021-03-22 18:50:25 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210323
-for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:
+for you to fetch changes up to dad90de78e9e9d47cefcbcd30115706b98e6ec87:
-  target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)
+  target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill (2021-03-23 14:07:55 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * report ARMv8-A FP support for AArch32 -cpu max
+ * hw/arm/virt: Disable pl011 clock migration if needed
- * hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
+ * target/arm: Make M-profile VTOR loads on reset handle memory aliasing
- * hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
+ * target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill
  * hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
  * hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
  * hw/arm/virt: Fix non-secure flash mode
  * pl031: Correctly migrate state when using -rtc clock=host
  * fix regression that meant arm926 and arm1026 lost VFP
    double-precision support
  * v8M: NS BusFault on vector table fetch escalates to NS HardFault
 ----------------------------------------------------------------
-Alex Bennée (1):
+Gavin Shan (1):
-      target/arm: report ARMv8-A FP support for AArch32 -cpu max
+      hw/arm/virt: Disable pl011 clock migration if needed
-David Engraf (1):
+Peter Maydell (5):
-      hw/arm/virt: Fix non-secure flash mode
+      memory: Make flatview_cb return bool, not int
       memory: Document flatview_for_each_range()
       memory: Add offset_in_region to flatview_cb arguments
       hw/core/loader: Add new function rom_ptr_for_as()
       target/arm: Make M-profile VTOR loads on reset handle memory aliasing
-Peter Maydell (3):
+Richard Henderson (1):
-      pl031: Correctly migrate state when using -rtc clock=host
+      target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill
       target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
       target/arm: NS BusFault on vector table fetch escalates to NS HardFault
-Philippe Mathieu-Daudé (5):
+ include/exec/memory.h           | 32 +++++++++++++++---
-      hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
+ include/hw/char/pl011.h         |  1 +
-      hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
+ include/hw/loader.h             | 31 +++++++++++++++++
-      hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
+ hw/char/pl011.c                 |  9 +++++
-      hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
+ hw/core/loader.c                | 75 +++++++++++++++++++++++++++++++++++++++++
-      hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
+ hw/core/machine.c               |  1 +
  softmmu/memory.c                |  4 ++-
  target/arm/cpu.c                |  2 +-
  target/arm/tlb_helper.c         |  1 +
  tests/qtest/fuzz/generic_fuzz.c | 11 +++---
 files changed, 157 insertions(+), 10 deletions(-)
- include/hw/timer/pl031.h |  2 ++
- hw/arm/virt.c            |  2 +-
- hw/core/machine.c        |  1 +
- hw/display/xlnx_dp.c     | 15 +++++---
- hw/ssi/mss-spi.c         |  8 ++++-
- hw/ssi/xilinx_spips.c    | 43 +++++++++++++++-------
- hw/timer/pl031.c         | 92 +++++++++++++++++++++++++++++++++++++++++++++---
- target/arm/cpu.c         | 16 +++++++++
- target/arm/m_helper.c    | 21 ++++++++---
-files changed, 174 insertions(+), 26 deletions(-)

-[Qemu-devel] [PULL 08/10] pl031: Correctly migrate state when using -rtc clock=host
+[PULL 1/7] hw/arm/virt: Disable pl011 clock migration if needed
-The PL031 RTC tracks the difference between the guest RTC
+From: Gavin Shan <gshan@redhat.com>
 and the host RTC using a tick_offset field. For migration,
 however, we currently always migrate the offset between
 the guest and the vm_clock, even if the RTC clock is not
 the same as the vm_clock; this was an attempt to retain
 migration backwards compatibility.
-Unfortunately this results in the RTC behaving oddly across
+A clock is added by commit aac63e0e6ea3 ("hw/char/pl011: add a clock
-a VM state save and restore -- since the VM clock stands still
+input") since v5.2.0 which corresponds to virt-5.2 machine type. It
-across save-then-restore, regardless of how much real world
+causes backwards migration failure from upstream to downstream (v5.1.0)
-time has elapsed, the guest RTC ends up out of sync with the
+when the machine type is specified with virt-5.1.
 host RTC in the restored VM.
-Fix this by migrating the raw tick_offset. To retain migration
+This fixes the issue by following instructions from section "Connecting
-compatibility as far as possible, we have a new property
+subsections to properties" in docs/devel/migration.rst. With this applied,
-migrate-tick-offset; by default this is 'true' and we will
+the PL011 clock is migrated based on the machine type.
 migrate the true tick offset in a new subsection; if the
 incoming data has no subsection we fall back to the old
 vm_clock-based offset information, so old->new migration
 compatibility is preserved. For complete new->old migration
 compatibility, the property is set to 'false' for 4.0 and
 earlier machine types (this will only affect 'virt-4.0'
 and below, as none of the other pl031-using machines are
 versioned).
-Reported-by: Russell King <rmk@armlinux.org.uk>
+   virt-5.2 or newer:  migration
    virt-5.1 or older:  non-migration
 Cc: qemu-stable@nongnu.org # v5.2.0+
 Fixes: aac63e0e6ea3 ("hw/char/pl011: add a clock input")
 Suggested-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Gavin Shan <gshan@redhat.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20210318023801.18287-1-gshan@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Message-id: 20190709143912.28905-1-peter.maydell@linaro.org
 ---
- include/hw/timer/pl031.h |  2 +
+ include/hw/char/pl011.h | 1 +
- hw/core/machine.c        |  1 +
+ hw/char/pl011.c         | 9 +++++++++
- hw/timer/pl031.c         | 92 ++++++++++++++++++++++++++++++++++++++--
+ hw/core/machine.c       | 1 +
-files changed, 91 insertions(+), 4 deletions(-)
+files changed, 11 insertions(+)
-diff --git a/include/hw/timer/pl031.h b/include/hw/timer/pl031.h
+diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/pl031.h
+--- a/include/hw/char/pl011.h
-+++ b/include/hw/timer/pl031.h
++++ b/include/hw/char/pl011.h
-@@ -XXX,XX +XXX,XX @@ typedef struct PL031State {
+@@ -XXX,XX +XXX,XX @@ struct PL011State {
-      */
+     CharBackend chr;
-     uint32_t tick_offset_vmstate;
+     qemu_irq irq[6];
-     uint32_t tick_offset;
+     Clock *clk;
-+    bool tick_offset_migrated;
++    bool migrate_clk;
-+    bool migrate_tick_offset;
+     const unsigned char *id;
+ };
-     uint32_t mr;
-     uint32_t lr;
+diff --git a/hw/char/pl011.c b/hw/char/pl011.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/pl011.c
 +++ b/hw/char/pl011.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pl011_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 +static bool pl011_clock_needed(void *opaque)
 +{
 +    PL011State *s = PL011(opaque);
 +
 +    return s->migrate_clk;
 +}
 +
  static const VMStateDescription vmstate_pl011_clock = {
      .name = "pl011/clock",
      .version_id = 1,
      .minimum_version_id = 1,
 +    .needed = pl011_clock_needed,
      .fields = (VMStateField[]) {
          VMSTATE_CLOCK(clk, PL011State),
          VMSTATE_END_OF_LIST()
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl011 = {
  static Property pl011_properties[] = {
      DEFINE_PROP_CHR("chardev", PL011State, chr),
 +    DEFINE_PROP_BOOL("migrate-clk", PL011State, migrate_clk, true),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_4_0[] = {
+@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_5_1[] = {
-     { "virtio-gpu-pci", "edid", "false" },
+     { "virtio-scsi-device", "num_queues", "1"},
-     { "virtio-device", "use-started", "false" },
+     { "nvme", "use-intel-id", "on"},
-     { "virtio-balloon-device", "qemu-4-0-config-size", "true" },
+     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
-+    { "pl031", "migrate-tick-offset", "false" },
++    { "pl011", "migrate-clk", "off" },
  };
- const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
+ const size_t hw_compat_5_1_len = G_N_ELEMENTS(hw_compat_5_1);
 diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/pl031.c
 +++ b/hw/timer/pl031.c
@@ -XXX,XX +XXX,XX @@ static int pl031_pre_save(void *opaque)
  {
      PL031State *s = opaque;
 -    /* tick_offset is base_time - rtc_clock base time.  Instead, we want to
 -     * store the base time relative to the QEMU_CLOCK_VIRTUAL for backwards-compatibility.  */
 +    /*
 +     * The PL031 device model code uses the tick_offset field, which is
 +     * the offset between what the guest RTC should read and what the
 +     * QEMU rtc_clock reads:
 +     *  guest_rtc = rtc_clock + tick_offset
 +     * and so
 +     *  tick_offset = guest_rtc - rtc_clock
 +     *
 +     * We want to migrate this offset, which sounds straightforward.
 +     * Unfortunately older versions of QEMU migrated a conversion of this
 +     * offset into an offset from the vm_clock. (This was in turn an
 +     * attempt to be compatible with even older QEMU versions, but it
 +     * has incorrect behaviour if the rtc_clock is not the same as the
 +     * vm_clock.) So we put the actual tick_offset into a migration
 +     * subsection, and the backwards-compatible time-relative-to-vm_clock
 +     * in the main migration state.
 +     *
 +     * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
 +     */
      int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
      s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
      return 0;
  }
 +static int pl031_pre_load(void *opaque)
 +{
 +    PL031State *s = opaque;
 +
 +    s->tick_offset_migrated = false;
 +    return 0;
 +}
 +
  static int pl031_post_load(void *opaque, int version_id)
  {
      PL031State *s = opaque;
 -    int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -    s->tick_offset = s->tick_offset_vmstate - delta / NANOSECONDS_PER_SECOND;
 +    /*
 +     * If we got the tick_offset subsection, then we can just use
 +     * the value in that. Otherwise the source is an older QEMU and
 +     * has given us the offset from the vm_clock; convert it back to
 +     * an offset from the rtc_clock. This will cause time to incorrectly
 +     * go backwards compared to the host RTC, but this is unavoidable.
 +     */
 +
 +    if (!s->tick_offset_migrated) {
 +        int64_t delta = qemu_clock_get_ns(rtc_clock) -
 +            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        s->tick_offset = s->tick_offset_vmstate -
 +            delta / NANOSECONDS_PER_SECOND;
 +    }
      pl031_set_alarm(s);
      return 0;
  }
 +static int pl031_tick_offset_post_load(void *opaque, int version_id)
 +{
 +    PL031State *s = opaque;
 +
 +    s->tick_offset_migrated = true;
 +    return 0;
 +}
 +
 +static bool pl031_tick_offset_needed(void *opaque)
 +{
 +    PL031State *s = opaque;
 +
 +    return s->migrate_tick_offset;
 +}
 +
 +static const VMStateDescription vmstate_pl031_tick_offset = {
 +    .name = "pl031/tick-offset",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = pl031_tick_offset_needed,
 +    .post_load = pl031_tick_offset_post_load,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(tick_offset, PL031State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_pl031 = {
      .name = "pl031",
      .version_id = 1,
      .minimum_version_id = 1,
      .pre_save = pl031_pre_save,
 +    .pre_load = pl031_pre_load,
      .post_load = pl031_post_load,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(tick_offset_vmstate, PL031State),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl031 = {
          VMSTATE_UINT32(im, PL031State),
          VMSTATE_UINT32(is, PL031State),
          VMSTATE_END_OF_LIST()
 +    },
 +    .subsections = (const VMStateDescription*[]) {
 +        &vmstate_pl031_tick_offset,
 +        NULL
      }
  };
 +static Property pl031_properties[] = {
 +    /*
 +     * True to correctly migrate the tick offset of the RTC. False to
 +     * obtain backward migration compatibility with older QEMU versions,
 +     * at the expense of the guest RTC going backwards compared with the
 +     * host RTC when the VM is saved/restored if using -rtc host.
 +     * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
 +     * 'false' also permits newer QEMU to migrate to older QEMU.)
 +     */
 +    DEFINE_PROP_BOOL("migrate-tick-offset",
 +                     PL031State, migrate_tick_offset, true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
  static void pl031_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      dc->vmsd = &vmstate_pl031;
 +    dc->props = pl031_properties;
  }
  static const TypeInfo pl031_info = {
 --
 .20.1

-[Qemu-devel] [PULL 10/10] target/arm: NS BusFault on vector table fetch escalates to NS HardFault
+[PULL 2/7] memory: Make flatview_cb return bool, not int
-In the M-profile architecture, when we do a vector table fetch and it
+The return value of the flatview_cb callback passed to the
-fails, we need to report a HardFault.  Whether this is a Secure HF or
+flatview_for_each_range() function is zero if the iteration through
-a NonSecure HF depends on several things.  If AIRCR.BFHFNMINS is 0
+the ranges should continue, or non-zero to break out of it.  Use a
-then HF is always Secure, because there is no NonSecure HardFault.
+bool for this rather than int.
 Otherwise, the answer depends on whether the 'underlying exception'
 (MemManage, BusFault, SecureFault) targets Secure or NonSecure.  (In
 the pseudocode, this is handled in the Vector() function: the final
 exc.isSecure is calculated by looking at the exc.isSecure from the
 exception returned from the memory access, not the isSecure input
 argument.)
 We weren't doing this correctly, because we were looking at
 the target security domain of the exception we were trying to
 load the vector table entry for. This produces errors of two kinds:
  * a load from the NS vector table which hits the "NS access
    to S memory" SecureFault should end up as a Secure HardFault,
    but we were raising an NS HardFault
  * a load from the S vector table which causes a BusFault
    should raise an NS HardFault if BFHFNMINS == 1 (because
    in that case all BusFaults are NonSecure), but we were raising
    a Secure HardFault
 Correct the logic.
 We also fix a comment error where we claimed that we might
 be escalating MemManage to HardFault, and forgot about SecureFault.
 (Vector loads can never hit MPU access faults, because they're
 always aligned and always use the default address map.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20190705094823.28905-1-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210318174823.18066-2-peter.maydell@linaro.org
 ---
- target/arm/m_helper.c | 21 +++++++++++++++++----
+ include/exec/memory.h           | 6 +++---
-file changed, 17 insertions(+), 4 deletions(-)
+ tests/qtest/fuzz/generic_fuzz.c | 8 ++++----
 files changed, 7 insertions(+), 7 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/include/exec/memory.h
-+++ b/target/arm/m_helper.c
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
+@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
-         if (sattrs.ns) {
+     return qatomic_rcu_read(&as->current_map);
-             attrs.secure = false;
+ }
-         } else if (!targets_secure) {
--            /* NS access to S memory */
+-typedef int (*flatview_cb)(Int128 start,
-+            /*
+-                           Int128 len,
-+             * NS access to S memory: the underlying exception which we escalate
+-                           const MemoryRegion*, void*);
-+             * to HardFault is SecureFault, which always targets Secure.
++typedef bool (*flatview_cb)(Int128 start,
-+             */
++                            Int128 len,
-+            exc_secure = true;
++                            const MemoryRegion*, void*);
-             goto load_fail;
  void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque);
 diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/fuzz/generic_fuzz.c
 +++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -XXX,XX +XXX,XX @@ struct get_io_cb_info {
      address_range result;
  };
 -static int get_io_address_cb(Int128 start, Int128 size,
 -                          const MemoryRegion *mr, void *opaque) {
 +static bool get_io_address_cb(Int128 start, Int128 size,
 +                              const MemoryRegion *mr, void *opaque) {
      struct get_io_cb_info *info = opaque;
      if (g_hash_table_lookup(fuzzable_memoryregions, mr)) {
          if (info->index == 0) {
              info->result.addr = (ram_addr_t)start;
              info->result.size = (ram_addr_t)size;
              info->found = 1;
 -            return 1;
 +            return true;
          }
+         info->index--;
      }
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
+-    return 0;
-     vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
++    return false;
-                                      attrs, &result);
+ }
-     if (result != MEMTX_OK) {
-+        /*
+ /*
 +         * Underlying exception is BusFault: its target security state
 +         * depends on BFHFNMINS.
 +         */
 +        exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
          goto load_fail;
      }
      *pvec = vector_entry;
@@ -XXX,XX +XXX,XX @@ load_fail:
      /*
       * All vector table fetch fails are reported as HardFault, with
       * HFSR.VECTTBL and .FORCED set. (FORCED is set because
 -     * technically the underlying exception is a MemManage or BusFault
 +     * technically the underlying exception is a SecureFault or BusFault
       * that is escalated to HardFault.) This is a terminal exception,
       * so we will either take the HardFault immediately or else enter
       * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
 +     * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
 +     * secure); otherwise it targets the same security state as the
 +     * underlying exception.
       */
 -    exc_secure = targets_secure ||
 -        !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
 +    if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
 +        exc_secure = true;
 +    }
      env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
      armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
      return false;
 --
 .20.1

-[Qemu-devel] [PULL 09/10] target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
+[PULL 3/7] memory: Document flatview_for_each_range()
-The ARMv5 architecture didn't specify detailed per-feature ID
+Add a documentation comment describing flatview_for_each_range().
 registers. Now that we're using the MVFR0 register fields to
 gate the existence of VFP instructions, we need to set up
 the correct values in the cpu->isar structure so that we still
 provide an FPU to the guest.
-This fixes a regression in the arm926 and arm1026 CPUs, which
-are the only ones that both have VFP and are ARMv5 or earlier.
-This regression was introduced by the VFP refactoring, and more
-specifically by commits 1120827fa182f0e76 and 266bd25c485597c,
-which accidentally disabled VFP short-vector support and
-double-precision support on these CPUs.
-Fixes: 1120827fa182f0e
-Fixes: 266bd25c485597c
-Fixes: https://bugs.launchpad.net/qemu/+bug/1836192
-Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Christophe Lyon <christophe.lyon@linaro.org>
+Message-id: 20210318174823.18066-3-peter.maydell@linaro.org
 Message-id: 20190711131241.22231-1-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 12 ++++++++++++
+ include/exec/memory.h | 26 ++++++++++++++++++++++++--
-file changed, 12 insertions(+)
+file changed, 24 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/include/exec/memory.h
-+++ b/target/arm/cpu.c
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
-      * set the field to indicate Jazelle support within QEMU.
+     return qatomic_rcu_read(&as->current_map);
       */
      cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
 +    /*
 +     * Similarly, we need to set MVFR0 fields to enable double precision
 +     * and short vector support even though ARMv5 doesn't have this register.
 +     */
 +    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
 +    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
  }
- static void arm946_initfn(Object *obj)
++/**
-@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
++ * typedef flatview_cb: callback for flatview_for_each_range()
-      * set the field to indicate Jazelle support within QEMU.
++ *
-      */
++ * @start: start address of the range within the FlatView
-     cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
++ * @len: length of the range in bytes
-+    /*
++ * @mr: MemoryRegion covering this range
-+     * Similarly, we need to set MVFR0 fields to enable double precision
++ * @opaque: data pointer passed to flatview_for_each_range()
-+     * and short vector support even though ARMv5 doesn't have this register.
++ *
-+     */
++ * Returns: true to stop the iteration, false to keep going.
-+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
++ */
-+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
+ typedef bool (*flatview_cb)(Int128 start,
+                             Int128 len,
-     {
+-                            const MemoryRegion*, void*);
-         /* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
++                            const MemoryRegion *mr,
 +                            void *opaque);
 -void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque);
 +/**
 + * flatview_for_each_range: Iterate through a FlatView
 + * @fv: the FlatView to iterate through
 + * @cb: function to call for each range
 + * @opaque: opaque data pointer to pass to @cb
 + *
 + * A FlatView is made up of a list of non-overlapping ranges, each of
 + * which is a slice of a MemoryRegion. This function iterates through
 + * each range in @fv, calling @cb. The callback function can terminate
 + * iteration early by returning 'true'.
 + */
 +void flatview_for_each_range(FlatView *fv, flatview_cb cb, void *opaque);
  /**
   * struct MemoryRegionSection: describes a fragment of a #MemoryRegion
 --
 .20.1

-[Qemu-devel] [PULL 02/10] hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
+[PULL 4/7] memory: Add offset_in_region to flatview_cb arguments
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The function flatview_for_each_range() calls a callback for each
 range in a FlatView.  Currently the callback gets the start and
 length of the range and the MemoryRegion involved, but not the offset
 within the MemoryRegion.  Add this to the callback's arguments; we're
 going to want it for a new use in the next commit.
-In the next commit we will implement the write_with_attrs()
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-handler. To avoid using different APIs, convert the read()
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-handler first.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210318174823.18066-4-peter.maydell@linaro.org
 ---
  include/exec/memory.h           | 2 ++
  softmmu/memory.c                | 4 +++-
  tests/qtest/fuzz/generic_fuzz.c | 5 ++++-
 files changed, 9 insertions(+), 2 deletions(-)
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/ssi/xilinx_spips.c | 23 +++++++++++------------
 file changed, 11 insertions(+), 12 deletions(-)
 diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spips.c
+--- a/include/exec/memory.h
-+++ b/hw/ssi/xilinx_spips.c
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
+@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
   * @start: start address of the range within the FlatView
   * @len: length of the range in bytes
   * @mr: MemoryRegion covering this range
 + * @offset_in_region: offset of the first byte of the range within @mr
   * @opaque: data pointer passed to flatview_for_each_range()
   *
   * Returns: true to stop the iteration, false to keep going.
@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
  typedef bool (*flatview_cb)(Int128 start,
                              Int128 len,
                              const MemoryRegion *mr,
 +                            hwaddr offset_in_region,
                              void *opaque);
  /**
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@ void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque)
      assert(cb);
      FOR_EACH_FLAT_RANGE(fr, fv) {
 -        if (cb(fr->addr.start, fr->addr.size, fr->mr, opaque))
 +        if (cb(fr->addr.start, fr->addr.size, fr->mr,
 +               fr->offset_in_region, opaque)) {
              break;
 +        }
      }
  }
--static uint64_t
+diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
--lqspi_read(void *opaque, hwaddr addr, unsigned int size)
+index XXXXXXX..XXXXXXX 100644
-+static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
+--- a/tests/qtest/fuzz/generic_fuzz.c
-+                              unsigned size, MemTxAttrs attrs)
++++ b/tests/qtest/fuzz/generic_fuzz.c
- {
+@@ -XXX,XX +XXX,XX @@ struct get_io_cb_info {
--    XilinxQSPIPS *q = opaque;
+ };
--    uint32_t ret;
-+    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
+ static bool get_io_address_cb(Int128 start, Int128 size,
+-                              const MemoryRegion *mr, void *opaque) {
-     if (addr >= q->lqspi_cached_addr &&
++                              const MemoryRegion *mr,
-             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
++                              hwaddr offset_in_region,
-         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
++                              void *opaque)
--        ret = cpu_to_le32(*(uint32_t *)retp);
++{
--        DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
+     struct get_io_cb_info *info = opaque;
--                   (unsigned)ret);
+     if (g_hash_table_lookup(fuzzable_memoryregions, mr)) {
--        return ret;
+         if (info->index == 0) {
 -    } else {
 -        lqspi_load_cache(opaque, addr);
 -        return lqspi_read(opaque, addr, size);
 +        *value = cpu_to_le32(*(uint32_t *)retp);
 +        DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
 +                   addr, *value);
 +        return MEMTX_OK;
      }
 +
 +    lqspi_load_cache(opaque, addr);
 +    return lqspi_read(opaque, addr, value, size, attrs);
  }
  static const MemoryRegionOps lqspi_ops = {
 -    .read = lqspi_read,
 +    .read_with_attrs = lqspi_read,
      .endianness = DEVICE_NATIVE_ENDIAN,
      .valid = {
          .min_access_size = 1,
 --
 .20.1

-[Qemu-devel] [PULL 03/10] hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
+[PULL 5/7] hw/core/loader: Add new function rom_ptr_for_as()
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+For accesses to rom blob data before or during reset, we have a
 function rom_ptr() which looks for a rom blob that would be loaded to
 the specified address, and returns a pointer into the rom blob data
 corresponding to that address.  This allows board or CPU code to say
 "what is the data that is going to be loaded to this address?".
-Lei Sun found while auditing the code that a CPU write would
+However, this function does not take account of memory region
-trigger a NULL pointer dereference.
+aliases.  If for instance a machine model has RAM at address
 x0000_0000 which is aliased to also appear at 0x1000_0000, a
 rom_ptr() query for address 0x0000_0000 will only return a match if
 the guest image provided by the user was loaded at 0x0000_0000 and
 not if it was loaded at 0x1000_0000, even though they are the same
 RAM and a run-time guest CPU read of 0x0000_0000 will read the data
 loaded to 0x1000_0000.
->From UG1085 datasheet [*] AXI writes in this region are ignored
+Provide a new function rom_ptr_for_as() which takes an AddressSpace
-and generates an AXI Slave Error (SLVERR).
+argument, so that it can check whether the MemoryRegion corresponding
 to the address is also mapped anywhere else in the AddressSpace and
 look for rom blobs that loaded to that alias.
-Fix by implementing the write_with_attrs() handler.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Return MEMTX_ERROR when the region is accessed (this error maps
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-to an AXI slave error).
+Message-id: 20210318174823.18066-5-peter.maydell@linaro.org
 ---
  include/hw/loader.h | 31 +++++++++++++++++++
  hw/core/loader.c    | 75 +++++++++++++++++++++++++++++++++++++++++++++
 files changed, 106 insertions(+)
-[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
+diff --git a/include/hw/loader.h b/include/hw/loader.h
 Reported-by: Lei Sun <slei.casper@gmail.com>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/ssi/xilinx_spips.c | 16 ++++++++++++++++
 file changed, 16 insertions(+)
 diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spips.c
+--- a/include/hw/loader.h
-+++ b/hw/ssi/xilinx_spips.c
++++ b/include/hw/loader.h
-@@ -XXX,XX +XXX,XX @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
+@@ -XXX,XX +XXX,XX @@ void rom_transaction_end(bool commit);
-     return lqspi_read(opaque, addr, value, size, attrs);
  int rom_copy(uint8_t *dest, hwaddr addr, size_t size);
  void *rom_ptr(hwaddr addr, size_t size);
 +/**
 + * rom_ptr_for_as: Return a pointer to ROM blob data for the address
 + * @as: AddressSpace to look for the ROM blob in
 + * @addr: Address within @as
 + * @size: size of data required in bytes
 + *
 + * Returns: pointer into the data which backs the matching ROM blob,
 + * or NULL if no blob covers the address range.
 + *
 + * This function looks for a ROM blob which covers the specified range
 + * of bytes of length @size starting at @addr within the address space
 + * @as. This is useful for code which runs as part of board
 + * initialization or CPU reset which wants to read data that is part
 + * of a user-supplied guest image or other guest memory contents, but
 + * which runs before the ROM loader's reset function has copied the
 + * blobs into guest memory.
 + *
 + * rom_ptr_for_as() will look not just for blobs loaded directly to
 + * the specified address, but also for blobs which were loaded to an
 + * alias of the region at a different location in the AddressSpace.
 + * In other words, if a machine model has RAM at address 0x0000_0000
 + * which is aliased to also appear at 0x1000_0000, rom_ptr_for_as()
 + * will return the correct data whether the guest image was linked and
 + * loaded at 0x0000_0000 or 0x1000_0000.  Contrast rom_ptr(), which
 + * will only return data if the image load address is an exact match
 + * with the queried address.
 + *
 + * New code should prefer to use rom_ptr_for_as() instead of
 + * rom_ptr().
 + */
 +void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size);
  void hmp_info_roms(Monitor *mon, const QDict *qdict);
  #define rom_add_file_fixed(_f, _a, _i)          \
 diff --git a/hw/core/loader.c b/hw/core/loader.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/loader.c
 +++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@ void *rom_ptr(hwaddr addr, size_t size)
      return rom->data + (addr - rom->addr);
  }
-+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
++typedef struct FindRomCBData {
-+                               unsigned size, MemTxAttrs attrs)
++    size_t size; /* Amount of data we want from ROM, in bytes */
 +    MemoryRegion *mr; /* MR at the unaliased guest addr */
 +    hwaddr xlat; /* Offset of addr within mr */
 +    void *rom; /* Output: rom data pointer, if found */
 +} FindRomCBData;
 +
 +static bool find_rom_cb(Int128 start, Int128 len, const MemoryRegion *mr,
 +                        hwaddr offset_in_region, void *opaque)
 +{
 +    FindRomCBData *cbdata = opaque;
 +    hwaddr alias_addr;
 +
 +    if (mr != cbdata->mr) {
 +        return false;
 +    }
 +
 +    alias_addr = int128_get64(start) + cbdata->xlat - offset_in_region;
 +    cbdata->rom = rom_ptr(alias_addr, cbdata->size);
 +    if (!cbdata->rom) {
 +        return false;
 +    }
 +    /* Found a match, stop iterating */
 +    return true;
 +}
 +
 +void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size)
 +{
 +    /*
-+     * From UG1085, Chapter 24 (Quad-SPI controllers):
++     * Find any ROM data for the given guest address range.  If there
-+     * - Writes are ignored
++     * is a ROM blob then return a pointer to the host memory
-+     * - AXI writes generate an external AXI slave error (SLVERR)
++     * corresponding to 'addr'; otherwise return NULL.
 +     *
 +     * We look not only for ROM blobs that were loaded directly to
 +     * addr, but also for ROM blobs that were loaded to aliases of
 +     * that memory at other addresses within the AddressSpace.
 +     *
 +     * Note that we do not check @as against the 'as' member in the
 +     * 'struct Rom' returned by rom_ptr(). The Rom::as is the
 +     * AddressSpace which the rom blob should be written to, whereas
 +     * our @as argument is the AddressSpace which we are (effectively)
 +     * reading from, and the same underlying RAM will often be visible
 +     * in multiple AddressSpaces. (A common example is a ROM blob
 +     * written to the 'system' address space but then read back via a
 +     * CPU's cpu->as pointer.) This does mean we might potentially
 +     * return a false-positive match if a ROM blob was loaded into an
 +     * AS which is entirely separate and distinct from the one we're
 +     * querying, but this issue exists also for rom_ptr() and hasn't
 +     * caused any problems in practice.
 +     */
-+    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
++    FlatView *fv;
-+                                   " (value: 0x%" PRIx64 "\n",
++    void *rom;
-+                  __func__, size << 3, offset, value);
++    hwaddr len_unused;
 +    FindRomCBData cbdata = {};
 +
-+    return MEMTX_ERROR;
++    /* Easy case: there's data at the actual address */
 +    rom = rom_ptr(addr, size);
 +    if (rom) {
 +        return rom;
 +    }
 +
 +    RCU_READ_LOCK_GUARD();
 +
 +    fv = address_space_to_flatview(as);
 +    cbdata.mr = flatview_translate(fv, addr, &cbdata.xlat, &len_unused,
 +                                   false, MEMTXATTRS_UNSPECIFIED);
 +    if (!cbdata.mr) {
 +        /* Nothing at this address, so there can't be any aliasing */
 +        return NULL;
 +    }
 +    cbdata.size = size;
 +    flatview_for_each_range(fv, find_rom_cb, &cbdata);
 +    return cbdata.rom;
 +}
 +
- static const MemoryRegionOps lqspi_ops = {
+ void hmp_info_roms(Monitor *mon, const QDict *qdict)
-     .read_with_attrs = lqspi_read,
+ {
-+    .write_with_attrs = lqspi_write,
+     Rom *rom;
      .endianness = DEVICE_NATIVE_ENDIAN,
      .valid = {
          .min_access_size = 1,
 --
 .20.1

-[Qemu-devel] [PULL 01/10] target/arm: report ARMv8-A FP support for AArch32 -cpu max
+[PULL 6/7] target/arm: Make M-profile VTOR loads on reset handle memory aliasing
-From: Alex Bennée <alex.bennee@linaro.org>
+For Arm M-profile CPUs, on reset the CPU must load its initial PC and
 SP from a vector table in guest memory.  Because we can't guarantee
 reset ordering, we have to handle the possibility that the ROM blob
 loader's reset function has not yet run when the CPU resets, in which
 case the data in an ELF file specified by the user won't be in guest
 memory to be read yet.
-When we converted to using feature bits in 602f6e42cfbf we missed out
+We work around the reset ordering problem by checking whether the ROM
-the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for
+blob loader has any data for the address where the vector table is,
--cpu max configurations. This caused a regression in the GCC test
+using rom_ptr().  Unfortunately this does not handle the possibility
-suite. Fix this by setting the appropriate bits in mvfr1.FPHP to
+of memory aliasing.  For many M-profile boards, memory can be
-report ARMv8-A with FP support (but not ARMv8.2-FP16).
+accessed via multiple possible physical addresses; if the board has
 the vector table at address X but the user's ELF file loads data via
 a different address Y which is an alias to the same underlying guest
 RAM then rom_ptr() will not find it.
-Fixes: https://bugs.launchpad.net/qemu/+bug/1836078
+Use the new rom_ptr_for_as() function, which deals with memory
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+aliasing when locating a relevant ROM blob.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190711103737.10017-1-alex.bennee@linaro.org
+Message-id: 20210318174823.18066-6-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c | 4 ++++
+ target/arm/cpu.c | 2 +-
-file changed, 4 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
-             t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
-             cpu->isar.id_isar6 = t;
+         /* Load the initial SP and PC from offset 0 and 4 in the vector table */
+         vecbase = env->v7m.vecbase[env->v7m.secure];
-+            t = cpu->isar.mvfr1;
+-        rom = rom_ptr(vecbase, 8);
-+            t = FIELD_DP32(t, MVFR1, FPHP, 2);     /* v8.0 FP support */
++        rom = rom_ptr_for_as(s->as, vecbase, 8);
-+            cpu->isar.mvfr1 = t;
+         if (rom) {
-+
+             /* Address zero is covered by ROM which hasn't yet been
-             t = cpu->isar.mvfr2;
+              * copied into physical memory.
              t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
              t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
 --
 .20.1

-[Qemu-devel] [PULL 04/10] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Both lqspi_read() and lqspi_load_cache() expect a 32-bit
-aligned address.
->From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':
-  Transfer Size Limitations
-    Because of the 32-bit wide TX, RX, and generic FIFO, all
-    APB/AXI transfers must be an integer multiple of 4-bytes.
-    Shorter transfers are not possible.
-Set MemoryRegionOps.impl values to force 32-bit accesses,
-this way we are sure we do not access the lqspi_buf[] array
-out of bound.
-[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/ssi/xilinx_spips.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spips.c
-+++ b/hw/ssi/xilinx_spips.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps lqspi_ops = {
-     .read_with_attrs = lqspi_read,
-     .write_with_attrs = lqspi_write,
-     .endianness = DEVICE_NATIVE_ENDIAN,
-+    .impl = {
-+        .min_access_size = 4,
-+        .max_access_size = 4,
-+    },
-     .valid = {
-         .min_access_size = 1,
-         .max_access_size = 4
---
-.20.1

-[Qemu-devel] [PULL 05/10] hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reading the RX_DATA register when the RX_FIFO is empty triggers
-an abort. This can be easily reproduced:
-  $ qemu-system-arm -M emcraft-sf2 -monitor stdio -S
-  QEMU 4.0.50 monitor - type 'help' for more information
-  (qemu) x 0x40001010
-  Aborted (core dumped)
-  (gdb) bt
-  #1  0x00007f035874f895 in abort () at /lib64/libc.so.6
-  #2  0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66
-  #3  0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137
-  #4  0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168
-  #5  0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
-  #6  0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569
-  #7  0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420
-  #8  0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447
-  #9  0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385
-  #10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423
-  #11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436
-  #12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466
-  #13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976
-  #14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730
-  #15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785
-  #16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082
-From the datasheet "Actel SmartFusion Microcontroller Subsystem
-User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this
-register has a reset value of 0.
-Check the FIFO is not empty before accessing it, else log an
-error message.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20190709113715.7761-3-philmd@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/ssi/mss-spi.c | 8 +++++++-
-file changed, 7 insertions(+), 1 deletion(-)
-diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/mss-spi.c
-+++ b/hw/ssi/mss-spi.c
-@@ -XXX,XX +XXX,XX @@ spi_read(void *opaque, hwaddr addr, unsigned int size)
-     case R_SPI_RX:
-         s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;
-         s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;
--        ret = fifo32_pop(&s->rx_fifo);
-+        if (fifo32_is_empty(&s->rx_fifo)) {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "%s: Reading empty RX_FIFO\n",
-+                          __func__);
-+        } else {
-+            ret = fifo32_pop(&s->rx_fifo);
-+        }
-         if (fifo32_is_empty(&s->rx_fifo)) {
-             s->regs[R_SPI_STATUS] |= S_RXFIFOEMP;
-         }
---
-.20.1

-[Qemu-devel] [PULL 06/10] hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-In the previous commit we fixed a crash when the guest read a
-register that pop from an empty FIFO.
-By auditing the repository, we found another similar use with
-an easy way to reproduce:
-  $ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S
-  QEMU 4.0.50 monitor - type 'help' for more information
-  (qemu) xp/b 0xfd4a0134
-  Aborted (core dumped)
-  (gdb) bt
-  #0  0x00007f6936dea57f in raise () at /lib64/libc.so.6
-  #1  0x00007f6936dd4895 in abort () at /lib64/libc.so.6
-  #2  0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431
-  #3  0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667
-  #4  0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
-  #5  0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569
-  #6  0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420
-  #7  0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447
-  #8  0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385
-  #9  0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423
-  #10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436
-  #11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131
-  #12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723
-  #13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795
-  #14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082
-Fix by checking the FIFO is not empty before popping from it.
-The datasheet is not clear about the reset value of this register,
-we choose to return '0'.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20190709113715.7761-4-philmd@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/display/xlnx_dp.c | 15 +++++++++++----
-file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/xlnx_dp.c
-+++ b/hw/display/xlnx_dp.c
-@@ -XXX,XX +XXX,XX @@ static uint8_t xlnx_dp_aux_pop_rx_fifo(XlnxDPState *s)
-     uint8_t ret;
-     if (fifo8_is_empty(&s->rx_fifo)) {
--        DPRINTF("rx_fifo underflow..\n");
--        abort();
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: Reading empty RX_FIFO\n",
-+                      __func__);
-+        /*
-+         * The datasheet is not clear about the reset value, it seems
-+         * to be unspecified. We choose to return '0'.
-+         */
-+        ret = 0;
-+    } else {
-+        ret = fifo8_pop(&s->rx_fifo);
-+        DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
-     }
--    ret = fifo8_pop(&s->rx_fifo);
--    DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
-     return ret;
- }
---
-.20.1

-[Qemu-devel] [PULL 07/10] hw/arm/virt: Fix non-secure flash mode
+[PULL 7/7] target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill
-From: David Engraf <david.engraf@sysgo.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Using the whole 128 MiB flash in non-secure mode is not working because
+Pretend the fault always happens at page table level 3.
 virt_flash_fdt() expects the same address for secure_sysmem and sysmem.
 This is not correctly handled by caller because it forwards NULL for
 secure_sysmem in non-secure flash mode.
-Fixed by using sysmem when secure_sysmem is NULL.
+Failure to set this leaves level = 0, which is impossible for
 ARMFault_Permission, and produces an invalid syndrome, which
 reaches g_assert_not_reached in cpu_loop.
-Signed-off-by: David Engraf <david.engraf@sysgo.com>
+Fixes: 8db94ab4e5db ("linux-user/aarch64: Pass syndrome to EXC_*_ABORT")
-Message-id: 20190712075002.14326-1-david.engraf@sysgo.com
+Reported-by: Laurent Vivier <laurent@vivier.eu>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210320000606.1788699-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 2 +-
+ target/arm/tlb_helper.c | 1 +
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 1 insertion(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/target/arm/tlb_helper.c
-+++ b/hw/arm/virt.c
++++ b/target/arm/tlb_helper.c
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                                     &machine->device_memory->mr);
+     } else {
          fi.type = ARMFault_Translation;
      }
++    fi.level = 3;
--    virt_flash_fdt(vms, sysmem, secure_sysmem);
-+    virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
+     /* now we have a real cpu fault */
+     cpu_restore_state(cs, retaddr, true);
      create_gic(vms, pic);
 --
 .20.1

target-arm queue for rc1 -- these are all bug fixes.

thanks
-- PMM

The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715

for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:

target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)

----------------------------------------------------------------
target-arm queue:
 * report ARMv8-A FP support for AArch32 -cpu max
 * hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
 * hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
 * hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
 * hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
 * hw/arm/virt: Fix non-secure flash mode
 * pl031: Correctly migrate state when using -rtc clock=host
 * fix regression that meant arm926 and arm1026 lost VFP
   double-precision support
 * v8M: NS BusFault on vector table fetch escalates to NS HardFault

----------------------------------------------------------------
Alex Bennée (1):
      target/arm: report ARMv8-A FP support for AArch32 -cpu max

David Engraf (1):
      hw/arm/virt: Fix non-secure flash mode

Peter Maydell (3):
      pl031: Correctly migrate state when using -rtc clock=host
      target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
      target/arm: NS BusFault on vector table fetch escalates to NS HardFault

Philippe Mathieu-Daudé (5):
      hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
      hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
      hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
      hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
      hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO

From: Alex Bennée <alex.bennee@linaro.org>

When we converted to using feature bits in 602f6e42cfbf we missed out
the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for
-cpu max configurations. This caused a regression in the GCC test
suite. Fix this by setting the appropriate bits in mvfr1.FPHP to
report ARMv8-A with FP support (but not ARMv8.2-FP16).

Fixes: https://bugs.launchpad.net/qemu/+bug/1836078
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190711103737.10017-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
             t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
             cpu->isar.id_isar6 = t;
 
+            t = cpu->isar.mvfr1;
+            t = FIELD_DP32(t, MVFR1, FPHP, 2);     /* v8.0 FP support */
+            cpu->isar.mvfr1 = t;
+
             t = cpu->isar.mvfr2;
             t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
             t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

In the next commit we will implement the write_with_attrs()
handler. To avoid using different APIs, convert the read()
handler first.

Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
     }
 }
 
-static uint64_t
-lqspi_read(void *opaque, hwaddr addr, unsigned int size)
+static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
+                              unsigned size, MemTxAttrs attrs)
 {
-    XilinxQSPIPS *q = opaque;
-    uint32_t ret;
+    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
 
     if (addr >= q->lqspi_cached_addr &&
             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
-        ret = cpu_to_le32(*(uint32_t *)retp);
-        DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
-                   (unsigned)ret);
-        return ret;
-    } else {
-        lqspi_load_cache(opaque, addr);
-        return lqspi_read(opaque, addr, size);
+        *value = cpu_to_le32(*(uint32_t *)retp);
+        DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
+                   addr, *value);
+        return MEMTX_OK;
     }
+
+    lqspi_load_cache(opaque, addr);
+    return lqspi_read(opaque, addr, value, size, attrs);
 }
 
 static const MemoryRegionOps lqspi_ops = {
-    .read = lqspi_read,
+    .read_with_attrs = lqspi_read,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
         .min_access_size = 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Lei Sun found while auditing the code that a CPU write would
trigger a NULL pointer dereference.

>From UG1085 datasheet [*] AXI writes in this region are ignored
and generates an AXI Slave Error (SLVERR).

Fix by implementing the write_with_attrs() handler.
Return MEMTX_ERROR when the region is accessed (this error maps
to an AXI slave error).

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf

Reported-by: Lei Sun <slei.casper@gmail.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
     return lqspi_read(opaque, addr, value, size, attrs);
 }
 
+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
+                               unsigned size, MemTxAttrs attrs)
+{
+    /*
+     * From UG1085, Chapter 24 (Quad-SPI controllers):
+     * - Writes are ignored
+     * - AXI writes generate an external AXI slave error (SLVERR)
+     */
+    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
+                                   " (value: 0x%" PRIx64 "\n",
+                  __func__, size << 3, offset, value);
+
+    return MEMTX_ERROR;
+}
+
 static const MemoryRegionOps lqspi_ops = {
     .read_with_attrs = lqspi_read,
+    .write_with_attrs = lqspi_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
         .min_access_size = 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Both lqspi_read() and lqspi_load_cache() expect a 32-bit
aligned address.

>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':

Transfer Size Limitations

Because of the 32-bit wide TX, RX, and generic FIFO, all
    APB/AXI transfers must be an integer multiple of 4-bytes.
    Shorter transfers are not possible.

Set MemoryRegionOps.impl values to force 32-bit accesses,
this way we are sure we do not access the lqspi_buf[] array
out of bound.

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps lqspi_ops = {
     .read_with_attrs = lqspi_read,
     .write_with_attrs = lqspi_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
     .valid = {
         .min_access_size = 1,
         .max_access_size = 4
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Reading the RX_DATA register when the RX_FIFO is empty triggers
an abort. This can be easily reproduced:

$ qemu-system-arm -M emcraft-sf2 -monitor stdio -S
  QEMU 4.0.50 monitor - type 'help' for more information
  (qemu) x 0x40001010
  Aborted (core dumped)

(gdb) bt
  #1  0x00007f035874f895 in abort () at /lib64/libc.so.6
  #2  0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66
  #3  0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137
  #4  0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168
  #5  0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
  #6  0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569
  #7  0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420
  #8  0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447
  #9  0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385
  #10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423
  #11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436
  #12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466
  #13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976
  #14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730
  #15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785
  #16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082

From the datasheet "Actel SmartFusion Microcontroller Subsystem
User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this
register has a reset value of 0.

Check the FIFO is not empty before accessing it, else log an
error message.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190709113715.7761-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/mss-spi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/mss-spi.c
+++ b/hw/ssi/mss-spi.c
@@ -XXX,XX +XXX,XX @@ spi_read(void *opaque, hwaddr addr, unsigned int size)
     case R_SPI_RX:
         s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;
         s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;
-        ret = fifo32_pop(&s->rx_fifo);
+        if (fifo32_is_empty(&s->rx_fifo)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Reading empty RX_FIFO\n",
+                          __func__);
+        } else {
+            ret = fifo32_pop(&s->rx_fifo);
+        }
         if (fifo32_is_empty(&s->rx_fifo)) {
             s->regs[R_SPI_STATUS] |= S_RXFIFOEMP;
         }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

In the previous commit we fixed a crash when the guest read a
register that pop from an empty FIFO.
By auditing the repository, we found another similar use with
an easy way to reproduce:

$ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S
  QEMU 4.0.50 monitor - type 'help' for more information
  (qemu) xp/b 0xfd4a0134
  Aborted (core dumped)

(gdb) bt
  #0  0x00007f6936dea57f in raise () at /lib64/libc.so.6
  #1  0x00007f6936dd4895 in abort () at /lib64/libc.so.6
  #2  0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431
  #3  0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667
  #4  0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
  #5  0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569
  #6  0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420
  #7  0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447
  #8  0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385
  #9  0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423
  #10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436
  #11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131
  #12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723
  #13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795
  #14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082

Fix by checking the FIFO is not empty before popping from it.

The datasheet is not clear about the reset value of this register,
we choose to return '0'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190709113715.7761-4-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/xlnx_dp.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -XXX,XX +XXX,XX @@ static uint8_t xlnx_dp_aux_pop_rx_fifo(XlnxDPState *s)
     uint8_t ret;
 
     if (fifo8_is_empty(&s->rx_fifo)) {
-        DPRINTF("rx_fifo underflow..\n");
-        abort();
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Reading empty RX_FIFO\n",
+                      __func__);
+        /*
+         * The datasheet is not clear about the reset value, it seems
+         * to be unspecified. We choose to return '0'.
+         */
+        ret = 0;
+    } else {
+        ret = fifo8_pop(&s->rx_fifo);
+        DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
     }
-    ret = fifo8_pop(&s->rx_fifo);
-    DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
     return ret;
 }
 
-- 
2.20.1

From: David Engraf <david.engraf@sysgo.com>

Using the whole 128 MiB flash in non-secure mode is not working because
virt_flash_fdt() expects the same address for secure_sysmem and sysmem.
This is not correctly handled by caller because it forwards NULL for
secure_sysmem in non-secure flash mode.

Fixed by using sysmem when secure_sysmem is NULL.

Signed-off-by: David Engraf <david.engraf@sysgo.com>
Message-id: 20190712075002.14326-1-david.engraf@sysgo.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                     &machine->device_memory->mr);
     }
 
-    virt_flash_fdt(vms, sysmem, secure_sysmem);
+    virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 
     create_gic(vms, pic);
 
-- 
2.20.1

The PL031 RTC tracks the difference between the guest RTC
and the host RTC using a tick_offset field. For migration,
however, we currently always migrate the offset between
the guest and the vm_clock, even if the RTC clock is not
the same as the vm_clock; this was an attempt to retain
migration backwards compatibility.

Unfortunately this results in the RTC behaving oddly across
a VM state save and restore -- since the VM clock stands still
across save-then-restore, regardless of how much real world
time has elapsed, the guest RTC ends up out of sync with the
host RTC in the restored VM.

Fix this by migrating the raw tick_offset. To retain migration
compatibility as far as possible, we have a new property
migrate-tick-offset; by default this is 'true' and we will
migrate the true tick offset in a new subsection; if the
incoming data has no subsection we fall back to the old
vm_clock-based offset information, so old->new migration
compatibility is preserved. For complete new->old migration
compatibility, the property is set to 'false' for 4.0 and
earlier machine types (this will only affect 'virt-4.0'
and below, as none of the other pl031-using machines are
versioned).

Reported-by: Russell King <rmk@armlinux.org.uk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 20190709143912.28905-1-peter.maydell@linaro.org
---
 include/hw/timer/pl031.h |  2 +
 hw/core/machine.c        |  1 +
 hw/timer/pl031.c         | 92 ++++++++++++++++++++++++++++++++++++++--
 3 files changed, 91 insertions(+), 4 deletions(-)

diff --git a/include/hw/timer/pl031.h b/include/hw/timer/pl031.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/pl031.h
+++ b/include/hw/timer/pl031.h
@@ -XXX,XX +XXX,XX @@ typedef struct PL031State {
      */
     uint32_t tick_offset_vmstate;
     uint32_t tick_offset;
+    bool tick_offset_migrated;
+    bool migrate_tick_offset;
 
     uint32_t mr;
     uint32_t lr;
diff --git a/hw/core/machine.c b/hw/core/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_4_0[] = {
     { "virtio-gpu-pci", "edid", "false" },
     { "virtio-device", "use-started", "false" },
     { "virtio-balloon-device", "qemu-4-0-config-size", "true" },
+    { "pl031", "migrate-tick-offset", "false" },
 };
 const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
 
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -XXX,XX +XXX,XX @@ static int pl031_pre_save(void *opaque)
 {
     PL031State *s = opaque;
 
-    /* tick_offset is base_time - rtc_clock base time.  Instead, we want to
-     * store the base time relative to the QEMU_CLOCK_VIRTUAL for backwards-compatibility.  */
+    /*
+     * The PL031 device model code uses the tick_offset field, which is
+     * the offset between what the guest RTC should read and what the
+     * QEMU rtc_clock reads:
+     *  guest_rtc = rtc_clock + tick_offset
+     * and so
+     *  tick_offset = guest_rtc - rtc_clock
+     *
+     * We want to migrate this offset, which sounds straightforward.
+     * Unfortunately older versions of QEMU migrated a conversion of this
+     * offset into an offset from the vm_clock. (This was in turn an
+     * attempt to be compatible with even older QEMU versions, but it
+     * has incorrect behaviour if the rtc_clock is not the same as the
+     * vm_clock.) So we put the actual tick_offset into a migration
+     * subsection, and the backwards-compatible time-relative-to-vm_clock
+     * in the main migration state.
+     *
+     * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
+     */
     int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
 
     return 0;
 }
 
+static int pl031_pre_load(void *opaque)
+{
+    PL031State *s = opaque;
+
+    s->tick_offset_migrated = false;
+    return 0;
+}
+
 static int pl031_post_load(void *opaque, int version_id)
 {
     PL031State *s = opaque;
 
-    int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    s->tick_offset = s->tick_offset_vmstate - delta / NANOSECONDS_PER_SECOND;
+    /*
+     * If we got the tick_offset subsection, then we can just use
+     * the value in that. Otherwise the source is an older QEMU and
+     * has given us the offset from the vm_clock; convert it back to
+     * an offset from the rtc_clock. This will cause time to incorrectly
+     * go backwards compared to the host RTC, but this is unavoidable.
+     */
+
+    if (!s->tick_offset_migrated) {
+        int64_t delta = qemu_clock_get_ns(rtc_clock) -
+            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        s->tick_offset = s->tick_offset_vmstate -
+            delta / NANOSECONDS_PER_SECOND;
+    }
     pl031_set_alarm(s);
     return 0;
 }
 
+static int pl031_tick_offset_post_load(void *opaque, int version_id)
+{
+    PL031State *s = opaque;
+
+    s->tick_offset_migrated = true;
+    return 0;
+}
+
+static bool pl031_tick_offset_needed(void *opaque)
+{
+    PL031State *s = opaque;
+
+    return s->migrate_tick_offset;
+}
+
+static const VMStateDescription vmstate_pl031_tick_offset = {
+    .name = "pl031/tick-offset",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = pl031_tick_offset_needed,
+    .post_load = pl031_tick_offset_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(tick_offset, PL031State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_pl031 = {
     .name = "pl031",
     .version_id = 1,
     .minimum_version_id = 1,
     .pre_save = pl031_pre_save,
+    .pre_load = pl031_pre_load,
     .post_load = pl031_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(tick_offset_vmstate, PL031State),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl031 = {
         VMSTATE_UINT32(im, PL031State),
         VMSTATE_UINT32(is, PL031State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_pl031_tick_offset,
+        NULL
     }
 };
 
+static Property pl031_properties[] = {
+    /*
+     * True to correctly migrate the tick offset of the RTC. False to
+     * obtain backward migration compatibility with older QEMU versions,
+     * at the expense of the guest RTC going backwards compared with the
+     * host RTC when the VM is saved/restored if using -rtc host.
+     * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
+     * 'false' also permits newer QEMU to migrate to older QEMU.)
+     */
+    DEFINE_PROP_BOOL("migrate-tick-offset",
+                     PL031State, migrate_tick_offset, true),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void pl031_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->vmsd = &vmstate_pl031;
+    dc->props = pl031_properties;
 }
 
 static const TypeInfo pl031_info = {
-- 
2.20.1

The ARMv5 architecture didn't specify detailed per-feature ID
registers. Now that we're using the MVFR0 register fields to
gate the existence of VFP instructions, we need to set up
the correct values in the cpu->isar structure so that we still
provide an FPU to the guest.

This fixes a regression in the arm926 and arm1026 CPUs, which
are the only ones that both have VFP and are ARMv5 or earlier.
This regression was introduced by the VFP refactoring, and more
specifically by commits 1120827fa182f0e76 and 266bd25c485597c,
which accidentally disabled VFP short-vector support and
double-precision support on these CPUs.

Fixes: 1120827fa182f0e
Fixes: 266bd25c485597c
Fixes: https://bugs.launchpad.net/qemu/+bug/1836192
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Christophe Lyon <christophe.lyon@linaro.org>
Message-id: 20190711131241.22231-1-peter.maydell@linaro.org
---
 target/arm/cpu.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
      * set the field to indicate Jazelle support within QEMU.
      */
     cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+    /*
+     * Similarly, we need to set MVFR0 fields to enable double precision
+     * and short vector support even though ARMv5 doesn't have this register.
+     */
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
 }
 
 static void arm946_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
      * set the field to indicate Jazelle support within QEMU.
      */
     cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+    /*
+     * Similarly, we need to set MVFR0 fields to enable double precision
+     * and short vector support even though ARMv5 doesn't have this register.
+     */
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
 
     {
         /* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
-- 
2.20.1

In the M-profile architecture, when we do a vector table fetch and it
fails, we need to report a HardFault.  Whether this is a Secure HF or
a NonSecure HF depends on several things.  If AIRCR.BFHFNMINS is 0
then HF is always Secure, because there is no NonSecure HardFault.
Otherwise, the answer depends on whether the 'underlying exception'
(MemManage, BusFault, SecureFault) targets Secure or NonSecure.  (In
the pseudocode, this is handled in the Vector() function: the final
exc.isSecure is calculated by looking at the exc.isSecure from the
exception returned from the memory access, not the isSecure input
argument.)

We weren't doing this correctly, because we were looking at
the target security domain of the exception we were trying to
load the vector table entry for. This produces errors of two kinds:
 * a load from the NS vector table which hits the "NS access
   to S memory" SecureFault should end up as a Secure HardFault,
   but we were raising an NS HardFault
 * a load from the S vector table which causes a BusFault
   should raise an NS HardFault if BFHFNMINS == 1 (because
   in that case all BusFaults are NonSecure), but we were raising
   a Secure HardFault

Correct the logic.

We also fix a comment error where we claimed that we might
be escalating MemManage to HardFault, and forgot about SecureFault.
(Vector loads can never hit MPU access faults, because they're
always aligned and always use the default address map.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190705094823.28905-1-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
         if (sattrs.ns) {
             attrs.secure = false;
         } else if (!targets_secure) {
-            /* NS access to S memory */
+            /*
+             * NS access to S memory: the underlying exception which we escalate
+             * to HardFault is SecureFault, which always targets Secure.
+             */
+            exc_secure = true;
             goto load_fail;
         }
     }
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
     vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
                                      attrs, &result);
     if (result != MEMTX_OK) {
+        /*
+         * Underlying exception is BusFault: its target security state
+         * depends on BFHFNMINS.
+         */
+        exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
         goto load_fail;
     }
     *pvec = vector_entry;
@@ -XXX,XX +XXX,XX @@ load_fail:
     /*
      * All vector table fetch fails are reported as HardFault, with
      * HFSR.VECTTBL and .FORCED set. (FORCED is set because
-     * technically the underlying exception is a MemManage or BusFault
+     * technically the underlying exception is a SecureFault or BusFault
      * that is escalated to HardFault.) This is a terminal exception,
      * so we will either take the HardFault immediately or else enter
      * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
+     * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
+     * secure); otherwise it targets the same security state as the
+     * underlying exception.
      */
-    exc_secure = targets_secure ||
-        !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
+    if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+        exc_secure = true;
+    }
     env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
     armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
     return false;
-- 
2.20.1

Small pullreq with some bug fixes to go into rc1.

-- PMM

The following changes since commit 5ca634afcf83215a9a54ca6e66032325b5ffb5f6:

Merge remote-tracking branch 'remotes/philmd/tags/sdmmc-20210322' into staging (2021-03-22 18:50:25 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210323

for you to fetch changes up to dad90de78e9e9d47cefcbcd30115706b98e6ec87:

target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill (2021-03-23 14:07:55 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: Disable pl011 clock migration if needed
 * target/arm: Make M-profile VTOR loads on reset handle memory aliasing
 * target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill

----------------------------------------------------------------
Gavin Shan (1):
      hw/arm/virt: Disable pl011 clock migration if needed

Peter Maydell (5):
      memory: Make flatview_cb return bool, not int
      memory: Document flatview_for_each_range()
      memory: Add offset_in_region to flatview_cb arguments
      hw/core/loader: Add new function rom_ptr_for_as()
      target/arm: Make M-profile VTOR loads on reset handle memory aliasing

Richard Henderson (1):
      target/arm: Set ARMMMUFaultInfo.level in user-only arm_cpu_tlb_fill

From: Gavin Shan <gshan@redhat.com>

A clock is added by commit aac63e0e6ea3 ("hw/char/pl011: add a clock
input") since v5.2.0 which corresponds to virt-5.2 machine type. It
causes backwards migration failure from upstream to downstream (v5.1.0)
when the machine type is specified with virt-5.1.

This fixes the issue by following instructions from section "Connecting
subsections to properties" in docs/devel/migration.rst. With this applied,
the PL011 clock is migrated based on the machine type.

virt-5.2 or newer:  migration
   virt-5.1 or older:  non-migration

Cc: qemu-stable@nongnu.org # v5.2.0+
Fixes: aac63e0e6ea3 ("hw/char/pl011: add a clock input")
Suggested-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20210318023801.18287-1-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/pl011.h | 1 +
 hw/char/pl011.c         | 9 +++++++++
 hw/core/machine.c       | 1 +
 3 files changed, 11 insertions(+)

diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/pl011.h
+++ b/include/hw/char/pl011.h
@@ -XXX,XX +XXX,XX @@ struct PL011State {
     CharBackend chr;
     qemu_irq irq[6];
     Clock *clk;
+    bool migrate_clk;
     const unsigned char *id;
 };
 
diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pl011_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+static bool pl011_clock_needed(void *opaque)
+{
+    PL011State *s = PL011(opaque);
+
+    return s->migrate_clk;
+}
+
 static const VMStateDescription vmstate_pl011_clock = {
     .name = "pl011/clock",
     .version_id = 1,
     .minimum_version_id = 1,
+    .needed = pl011_clock_needed,
     .fields = (VMStateField[]) {
         VMSTATE_CLOCK(clk, PL011State),
         VMSTATE_END_OF_LIST()
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl011 = {
 
 static Property pl011_properties[] = {
     DEFINE_PROP_CHR("chardev", PL011State, chr),
+    DEFINE_PROP_BOOL("migrate-clk", PL011State, migrate_clk, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/core/machine.c b/hw/core/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_5_1[] = {
     { "virtio-scsi-device", "num_queues", "1"},
     { "nvme", "use-intel-id", "on"},
     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
+    { "pl011", "migrate-clk", "off" },
 };
 const size_t hw_compat_5_1_len = G_N_ELEMENTS(hw_compat_5_1);
 
-- 
2.20.1

The return value of the flatview_cb callback passed to the
flatview_for_each_range() function is zero if the iteration through
the ranges should continue, or non-zero to break out of it.  Use a
bool for this rather than int.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210318174823.18066-2-peter.maydell@linaro.org
---
 include/exec/memory.h           | 6 +++---
 tests/qtest/fuzz/generic_fuzz.c | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
     return qatomic_rcu_read(&as->current_map);
 }
 
-typedef int (*flatview_cb)(Int128 start,
-                           Int128 len,
-                           const MemoryRegion*, void*);
+typedef bool (*flatview_cb)(Int128 start,
+                            Int128 len,
+                            const MemoryRegion*, void*);
 
 void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque);
 
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -XXX,XX +XXX,XX @@ struct get_io_cb_info {
     address_range result;
 };
 
-static int get_io_address_cb(Int128 start, Int128 size,
-                          const MemoryRegion *mr, void *opaque) {
+static bool get_io_address_cb(Int128 start, Int128 size,
+                              const MemoryRegion *mr, void *opaque) {
     struct get_io_cb_info *info = opaque;
     if (g_hash_table_lookup(fuzzable_memoryregions, mr)) {
         if (info->index == 0) {
             info->result.addr = (ram_addr_t)start;
             info->result.size = (ram_addr_t)size;
             info->found = 1;
-            return 1;
+            return true;
         }
         info->index--;
     }
-    return 0;
+    return false;
 }
 
 /*
-- 
2.20.1

Add a documentation comment describing flatview_for_each_range().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210318174823.18066-3-peter.maydell@linaro.org
---
 include/exec/memory.h | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
     return qatomic_rcu_read(&as->current_map);
 }
 
+/**
+ * typedef flatview_cb: callback for flatview_for_each_range()
+ *
+ * @start: start address of the range within the FlatView
+ * @len: length of the range in bytes
+ * @mr: MemoryRegion covering this range
+ * @opaque: data pointer passed to flatview_for_each_range()
+ *
+ * Returns: true to stop the iteration, false to keep going.
+ */
 typedef bool (*flatview_cb)(Int128 start,
                             Int128 len,
-                            const MemoryRegion*, void*);
+                            const MemoryRegion *mr,
+                            void *opaque);
 
-void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque);
+/**
+ * flatview_for_each_range: Iterate through a FlatView
+ * @fv: the FlatView to iterate through
+ * @cb: function to call for each range
+ * @opaque: opaque data pointer to pass to @cb
+ *
+ * A FlatView is made up of a list of non-overlapping ranges, each of
+ * which is a slice of a MemoryRegion. This function iterates through
+ * each range in @fv, calling @cb. The callback function can terminate
+ * iteration early by returning 'true'.
+ */
+void flatview_for_each_range(FlatView *fv, flatview_cb cb, void *opaque);
 
 /**
  * struct MemoryRegionSection: describes a fragment of a #MemoryRegion
-- 
2.20.1

The function flatview_for_each_range() calls a callback for each
range in a FlatView.  Currently the callback gets the start and
length of the range and the MemoryRegion involved, but not the offset
within the MemoryRegion.  Add this to the callback's arguments; we're
going to want it for a new use in the next commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210318174823.18066-4-peter.maydell@linaro.org
---
 include/exec/memory.h           | 2 ++
 softmmu/memory.c                | 4 +++-
 tests/qtest/fuzz/generic_fuzz.c | 5 ++++-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
  * @start: start address of the range within the FlatView
  * @len: length of the range in bytes
  * @mr: MemoryRegion covering this range
+ * @offset_in_region: offset of the first byte of the range within @mr
  * @opaque: data pointer passed to flatview_for_each_range()
  *
  * Returns: true to stop the iteration, false to keep going.
@@ -XXX,XX +XXX,XX @@ static inline FlatView *address_space_to_flatview(AddressSpace *as)
 typedef bool (*flatview_cb)(Int128 start,
                             Int128 len,
                             const MemoryRegion *mr,
+                            hwaddr offset_in_region,
                             void *opaque);
 
 /**
diff --git a/softmmu/memory.c b/softmmu/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -XXX,XX +XXX,XX @@ void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque)
     assert(cb);
 
     FOR_EACH_FLAT_RANGE(fr, fv) {
-        if (cb(fr->addr.start, fr->addr.size, fr->mr, opaque))
+        if (cb(fr->addr.start, fr->addr.size, fr->mr,
+               fr->offset_in_region, opaque)) {
             break;
+        }
     }
 }
 
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -XXX,XX +XXX,XX @@ struct get_io_cb_info {
 };
 
 static bool get_io_address_cb(Int128 start, Int128 size,
-                              const MemoryRegion *mr, void *opaque) {
+                              const MemoryRegion *mr,
+                              hwaddr offset_in_region,
+                              void *opaque)
+{
     struct get_io_cb_info *info = opaque;
     if (g_hash_table_lookup(fuzzable_memoryregions, mr)) {
         if (info->index == 0) {
-- 
2.20.1

For accesses to rom blob data before or during reset, we have a
function rom_ptr() which looks for a rom blob that would be loaded to
the specified address, and returns a pointer into the rom blob data
corresponding to that address.  This allows board or CPU code to say
"what is the data that is going to be loaded to this address?".

However, this function does not take account of memory region
aliases.  If for instance a machine model has RAM at address
0x0000_0000 which is aliased to also appear at 0x1000_0000, a
rom_ptr() query for address 0x0000_0000 will only return a match if
the guest image provided by the user was loaded at 0x0000_0000 and
not if it was loaded at 0x1000_0000, even though they are the same
RAM and a run-time guest CPU read of 0x0000_0000 will read the data
loaded to 0x1000_0000.

Provide a new function rom_ptr_for_as() which takes an AddressSpace
argument, so that it can check whether the MemoryRegion corresponding
to the address is also mapped anywhere else in the AddressSpace and
look for rom blobs that loaded to that alias.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210318174823.18066-5-peter.maydell@linaro.org
---
 include/hw/loader.h | 31 +++++++++++++++++++
 hw/core/loader.c    | 75 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 106 insertions(+)

diff --git a/include/hw/loader.h b/include/hw/loader.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -XXX,XX +XXX,XX @@ void rom_transaction_end(bool commit);
 
 int rom_copy(uint8_t *dest, hwaddr addr, size_t size);
 void *rom_ptr(hwaddr addr, size_t size);
+/**
+ * rom_ptr_for_as: Return a pointer to ROM blob data for the address
+ * @as: AddressSpace to look for the ROM blob in
+ * @addr: Address within @as
+ * @size: size of data required in bytes
+ *
+ * Returns: pointer into the data which backs the matching ROM blob,
+ * or NULL if no blob covers the address range.
+ *
+ * This function looks for a ROM blob which covers the specified range
+ * of bytes of length @size starting at @addr within the address space
+ * @as. This is useful for code which runs as part of board
+ * initialization or CPU reset which wants to read data that is part
+ * of a user-supplied guest image or other guest memory contents, but
+ * which runs before the ROM loader's reset function has copied the
+ * blobs into guest memory.
+ *
+ * rom_ptr_for_as() will look not just for blobs loaded directly to
+ * the specified address, but also for blobs which were loaded to an
+ * alias of the region at a different location in the AddressSpace.
+ * In other words, if a machine model has RAM at address 0x0000_0000
+ * which is aliased to also appear at 0x1000_0000, rom_ptr_for_as()
+ * will return the correct data whether the guest image was linked and
+ * loaded at 0x0000_0000 or 0x1000_0000.  Contrast rom_ptr(), which
+ * will only return data if the image load address is an exact match
+ * with the queried address.
+ *
+ * New code should prefer to use rom_ptr_for_as() instead of
+ * rom_ptr().
+ */
+void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size);
 void hmp_info_roms(Monitor *mon, const QDict *qdict);
 
 #define rom_add_file_fixed(_f, _a, _i)          \
diff --git a/hw/core/loader.c b/hw/core/loader.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@ void *rom_ptr(hwaddr addr, size_t size)
     return rom->data + (addr - rom->addr);
 }
 
+typedef struct FindRomCBData {
+    size_t size; /* Amount of data we want from ROM, in bytes */
+    MemoryRegion *mr; /* MR at the unaliased guest addr */
+    hwaddr xlat; /* Offset of addr within mr */
+    void *rom; /* Output: rom data pointer, if found */
+} FindRomCBData;
+
+static bool find_rom_cb(Int128 start, Int128 len, const MemoryRegion *mr,
+                        hwaddr offset_in_region, void *opaque)
+{
+    FindRomCBData *cbdata = opaque;
+    hwaddr alias_addr;
+
+    if (mr != cbdata->mr) {
+        return false;
+    }
+
+    alias_addr = int128_get64(start) + cbdata->xlat - offset_in_region;
+    cbdata->rom = rom_ptr(alias_addr, cbdata->size);
+    if (!cbdata->rom) {
+        return false;
+    }
+    /* Found a match, stop iterating */
+    return true;
+}
+
+void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size)
+{
+    /*
+     * Find any ROM data for the given guest address range.  If there
+     * is a ROM blob then return a pointer to the host memory
+     * corresponding to 'addr'; otherwise return NULL.
+     *
+     * We look not only for ROM blobs that were loaded directly to
+     * addr, but also for ROM blobs that were loaded to aliases of
+     * that memory at other addresses within the AddressSpace.
+     *
+     * Note that we do not check @as against the 'as' member in the
+     * 'struct Rom' returned by rom_ptr(). The Rom::as is the
+     * AddressSpace which the rom blob should be written to, whereas
+     * our @as argument is the AddressSpace which we are (effectively)
+     * reading from, and the same underlying RAM will often be visible
+     * in multiple AddressSpaces. (A common example is a ROM blob
+     * written to the 'system' address space but then read back via a
+     * CPU's cpu->as pointer.) This does mean we might potentially
+     * return a false-positive match if a ROM blob was loaded into an
+     * AS which is entirely separate and distinct from the one we're
+     * querying, but this issue exists also for rom_ptr() and hasn't
+     * caused any problems in practice.
+     */
+    FlatView *fv;
+    void *rom;
+    hwaddr len_unused;
+    FindRomCBData cbdata = {};
+
+    /* Easy case: there's data at the actual address */
+    rom = rom_ptr(addr, size);
+    if (rom) {
+        return rom;
+    }
+
+    RCU_READ_LOCK_GUARD();
+
+    fv = address_space_to_flatview(as);
+    cbdata.mr = flatview_translate(fv, addr, &cbdata.xlat, &len_unused,
+                                   false, MEMTXATTRS_UNSPECIFIED);
+    if (!cbdata.mr) {
+        /* Nothing at this address, so there can't be any aliasing */
+        return NULL;
+    }
+    cbdata.size = size;
+    flatview_for_each_range(fv, find_rom_cb, &cbdata);
+    return cbdata.rom;
+}
+
 void hmp_info_roms(Monitor *mon, const QDict *qdict)
 {
     Rom *rom;
-- 
2.20.1

For Arm M-profile CPUs, on reset the CPU must load its initial PC and
SP from a vector table in guest memory.  Because we can't guarantee
reset ordering, we have to handle the possibility that the ROM blob
loader's reset function has not yet run when the CPU resets, in which
case the data in an ELF file specified by the user won't be in guest
memory to be read yet.

We work around the reset ordering problem by checking whether the ROM
blob loader has any data for the address where the vector table is,
using rom_ptr().  Unfortunately this does not handle the possibility
of memory aliasing.  For many M-profile boards, memory can be
accessed via multiple possible physical addresses; if the board has
the vector table at address X but the user's ELF file loads data via
a different address Y which is an alias to the same underlying guest
RAM then rom_ptr() will not find it.

Use the new rom_ptr_for_as() function, which deals with memory
aliasing when locating a relevant ROM blob.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210318174823.18066-6-peter.maydell@linaro.org
---
 target/arm/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
 
         /* Load the initial SP and PC from offset 0 and 4 in the vector table */
         vecbase = env->v7m.vecbase[env->v7m.secure];
-        rom = rom_ptr(vecbase, 8);
+        rom = rom_ptr_for_as(s->as, vecbase, 8);
         if (rom) {
             /* Address zero is covered by ROM which hasn't yet been
              * copied into physical memory.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Pretend the fault always happens at page table level 3.

Failure to set this leaves level = 0, which is impossible for
ARMFault_Permission, and produces an invalid syndrome, which
reaches g_assert_not_reached in cpu_loop.

Fixes: 8db94ab4e5db ("linux-user/aarch64: Pass syndrome to EXC_*_ABORT")
Reported-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210320000606.1788699-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tlb_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     } else {
         fi.type = ARMFault_Translation;
     }
+    fi.level = 3;
 
     /* now we have a real cpu fault */
     cpu_restore_state(cs, retaddr, true);
-- 
2.20.1