A handful of bugfixes before rc1 tomorrow...

The following changes since commit f9fe8450fa7cdc6268e05c93fa258f583f4514b7:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-03-30 11:32:01 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200330

for you to fetch changes up to 88828bf133b64b7a860c166af3423ef1a47c5d3b:

target/arm: fix incorrect current EL bug in aarch32 exception emulation (2020-03-30 13:55:32 +0100)

* hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available

* hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address

* docs/conf.py: Raise ConfigError for bad Sphinx Python version

* hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path

* hw/arm/xlnx-zynqmp.c: Add missing error-propagation code

* target/arm: fix incorrect current EL bug in aarch32 exception emulation

Changbin Du (1):

target/arm: fix incorrect current EL bug in aarch32 exception emulation

Niek Linnenbank (2):

hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available

hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address

Peter Maydell (3):

docs/conf.py: Raise ConfigError for bad Sphinx Python version

hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path

hw/arm/xlnx-zynqmp.c: Add missing error-propagation code

hw/arm/orangepi.c | 2 +-

hw/arm/xlnx-zynqmp.c | 27 ++++++++++++++++++++++++++-

hw/misc/allwinner-h3-dramc.c | 4 ++--

target/arm/helper.c | 5 ++++-

docs/conf.py | 9 +++++----

5 files changed, 38 insertions(+), 9 deletions(-)

From: Changbin Du <changbin.du@gmail.com>

The arm_current_el() should be invoked after mode switching. Otherwise, we

get a wrong current EL value, since current EL is also determined by

current mode.

Fixes: 4a2696c0d4 ("target/arm: Set PAN bit as required on exception entry")

Signed-off-by: Changbin Du <changbin.du@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200328140232.17278-1-changbin.du@gmail.com

target/arm/helper.c | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,

/* Change the CPU state so as to actually take the exception. */

switch_mode(env, new_mode);

- new_el = arm_current_el(env);

/*

* For exceptions taken to AArch32 we must clear the SS bit in both

@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,

env->condexec_bits = 0;

/* Switch to the new mode, and to the correct instruction set. */

env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;

+

+ /* This must be after mode switching. */

+ new_el = arm_current_el(env);

+

/* Set new mode endianness */

env->uncached_cpsr &= ~CPSR_E;

if (env->cp15.sctlr_el[new_el] & SCTLR_EE) {

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The allwinner_h3_dramc_map_rows function simulates row addressing behavior

when bootloader software attempts to detect the amount of available SDRAM.

Currently the line that calculates the 64-bit address of the mirrored row

uses a signed 32-bit multiply operation that in theory could result in the

upper 32-bit be all 1s. This commit ensures that the row mirror address

is calculated using only 64-bit operations.

Reported-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Message-id: 20200323192944.5967-1-nieklinnenbank@gmail.com

hw/misc/allwinner-h3-dramc.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c

--- a/hw/misc/allwinner-h3-dramc.c

+++ b/hw/misc/allwinner-h3-dramc.c

@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s, uint8_t row_bits,

} else if (row_bits_actual) {

/* Row bits not matching ram_size, install the rows mirror */

- hwaddr row_mirror = s->ram_addr + ((1 << (row_bits_actual +

- bank_bits)) * page_size);

+ hwaddr row_mirror = s->ram_addr + ((1ULL << (row_bits_actual +

+ bank_bits)) * page_size);

memory_region_set_enabled(&s->row_mirror_alias, true);

memory_region_set_address(&s->row_mirror_alias, row_mirror);

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Orange Pi PC initialization function needs to verify that the SD card

block backend is usable before calling the Boot ROM setup routine. When

calling blk_is_available() the input parameter should not be NULL.

This commit ensures that blk_is_available is only called with non-NULL input.

Reported-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Message-id: 20200322205439.15231-1-nieklinnenbank@gmail.com

hw/arm/orangepi.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c

--- a/hw/arm/orangepi.c

+++ b/hw/arm/orangepi.c

@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)

machine->ram);

/* Load target kernel or start using BootROM */

- if (!machine->kernel_filename && blk_is_available(blk)) {

+ if (!machine->kernel_filename && blk && blk_is_available(blk)) {

/* Use Boot ROM to copy data from SD card to SRAM */

allwinner_h3_bootrom_setup(h3, blk);

}

In xlnx_zynqmp_realize() if the attempt to realize the SD

controller object fails then the error-return path will leak

the 'bus_name' string. Fix this by deferring the allocation

until after the realize has succeeded.

Fixes: Coverity CID 1421911

hw/arm/xlnx-zynqmp.c | 3 ++-

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c

--- a/hw/arm/xlnx-zynqmp.c

+++ b/hw/arm/xlnx-zynqmp.c

@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)

sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]);

for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) {

- char *bus_name = g_strdup_printf("sd-bus%d", i);

+ char *bus_name;

SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]);

Object *sdhci = OBJECT(&s->sdhci[i]);

@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)

sysbus_connect_irq(sbd, 0, gic_spi[sdhci_intr[i]]);

/* Alias controller SD bus to the SoC itself */

+ bus_name = g_strdup_printf("sd-bus%d", i);

object_property_add_alias(OBJECT(s), bus_name, sdhci, "sd-bus",

&error_abort);

g_free(bus_name);

Raise ConfigError rather than VersionRequirementError when we detect

that the Python being used by Sphinx is too old.

Currently the way we flag the Python version problem up to the user

causes Sphinx to print an unnecessary Python stack trace as well as

the information about the problem; in most versions of Sphinx this is

unavoidable.

The upstream Sphinx developers kindly added a feature to allow

conf.py to report errors to the user without the backtrace:

https://github.com/sphinx-doc/sphinx/commit/be608ca2313fc08eb842f3dc19d0f5d2d8227d08

but the exception type they chose for this was ConfigError.

Switch to ConfigError, which won't make any difference with currently

deployed Sphinx versions, but will be prettier one day when the user

is using a Sphinx version with the new feature.

Reviewed-by: John Snow <jsnow@redhat.com>

Message-id: 20200313163616.30674-1-peter.maydell@linaro.org

docs/conf.py | 9 +++++----

1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py

--- a/docs/conf.py

+++ b/docs/conf.py

@@ -XXX,XX +XXX,XX @@

import os

import sys

import sphinx

-from sphinx.errors import VersionRequirementError

+from sphinx.errors import ConfigError

# Make Sphinx fail cleanly if using an old Python, rather than obscurely

# failing because some code in one of our extensions doesn't work there.

-# Unfortunately this doesn't display very neatly (there's an unavoidable

-# Python backtrace) but at least the information gets printed...

+# In newer versions of Sphinx this will display nicely; in older versions

+# Sphinx will also produce a Python backtrace but at least the information

+# gets printed...

if sys.version_info < (3,5):

- raise VersionRequirementError(

+ raise ConfigError(

"QEMU requires a Sphinx that uses Python 3.5 or better\n")

# The per-manual conf.py will set qemu_docdir for a single-manual build;

In some places in xlnx_zynqmp_realize() we were putting an

error into our local Error*, but forgetting to check for

failure and pass it back to the caller. Add the missing code.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20200324134947.15384-3-peter.maydell@linaro.org

hw/arm/xlnx-zynqmp.c | 24 ++++++++++++++++++++++++

1 file changed, 24 insertions(+)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c

--- a/hw/arm/xlnx-zynqmp.c

+++ b/hw/arm/xlnx-zynqmp.c

@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)

* - eMMC Specification Version 4.51

*/

object_property_set_uint(sdhci, 3, "sd-spec-version", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

object_property_set_uint(sdhci, SDHCI_CAPABILITIES, "capareg", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

object_property_set_bool(OBJECT(&s->qspi), true, "realized", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi), 0, QSPI_ADDR);

sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi), 1, LQSPI_ADDR);

sysbus_connect_irq(SYS_BUS_DEVICE(&s->qspi), 0, gic_spi[QSPI_IRQ]);

@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)

for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {

object_property_set_uint(OBJECT(&s->gdma[i]), 128, "bus-width", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

+ }

object_property_set_bool(OBJECT(&s->gdma[i]), true, "realized", &err);

if (err) {

error_propagate(errp, err);