docs/system/arm/cpu-features.rst | 11 ++++

include/hw/arm/fsl-imx25.h | 2 +-

include/hw/arm/virt.h | 5 ++

linux-headers/linux/kvm.h | 6 ++-

target/arm/cpu.h | 4 ++

target/arm/kvm_arm.h | 94 ++++++++++++++++++++++++++-------

hw/arm/sbsa-ref.c | 3 +-

hw/arm/virt.c | 110 ++++++++++++++++++++++++++++-----------

hw/char/bcm2835_aux.c | 4 +-

hw/ssi/npcm7xx_fiu.c | 12 ++---

target/arm/cpu.c | 8 +++

target/arm/cpu64.c | 4 ++

target/arm/kvm.c | 16 ++++++

target/arm/kvm64.c | 64 +++++++++++++++++++++--

target/arm/monitor.c | 2 +-

tests/qtest/arm-cpu-features.c | 25 +++++++--

hw/ssi/trace-events | 2 +-

tests/qtest/meson.build | 3 +-

18 files changed, 303 insertions(+), 72 deletions(-)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix integer handling issues handling issue reported by Coverity:

hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()

>>> CID 1432730: Integer handling issues (NEGATIVE_RETURNS)

>>> "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.

162 npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));

hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()

218 cs_id = npcm7xx_fiu_cs_index(fiu, f);

219 trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,

220 size, v);

>>> CID 1432729: Integer handling issues (NEGATIVE_RETURNS)

>>> "cs_id" is passed to a parameter that cannot be negative.

221 npcm7xx_fiu_select(fiu, cs_id);

Since the index of the flash can not be negative, return an

unsigned type.

Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>

Message-id: 20200919132435.310527-1-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/ssi/npcm7xx_fiu.c | 12 ++++++------

hw/ssi/trace-events | 2 +-

2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/npcm7xx_fiu.c

+++ b/hw/ssi/npcm7xx_fiu.c

@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {

* Returns the index of flash in the fiu->flash array. This corresponds to the

* chip select ID of the flash.

*/

-static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

+static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,

+ NPCM7xxFIUFlash *flash)

{

int index = flash - fiu->flash;

@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

}

/* Assert the chip select specified in the UMA Control/Status Register. */

-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)

+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)

{

trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);

if (cs_id < s->cs_count) {

qemu_irq_lower(s->cs_lines[cs_id]);

+ s->active_cs = cs_id;

} else {

qemu_log_mask(LOG_GUEST_ERROR,

"%s: UMA to CS%d; this module has only %d chip selects",

DEVICE(s)->canonical_path, cs_id, s->cs_count);

- cs_id = -1;

+ s->active_cs = -1;

}

-

- s->active_cs = cs_id;

}

/* Deassert the currently active chip select. */

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,

NPCM7xxFIUFlash *f = opaque;

NPCM7xxFIUState *fiu = f->fiu;

uint32_t dwr_cfg;

- int cs_id;

+ unsigned cs_id;

int i;

if (fiu->active_cs != -1) {

diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/trace-events

+++ b/hw/ssi/trace-events

@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"

npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201002080935.1660005-1-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx25.h | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx25.h

+++ b/include/hw/arm/fsl-imx25.h

@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {

* 0xBB00_0000 0xBB00_0FFF 4 Kbytes NAND flash main area buffer

* 0xBB00_1000 0xBB00_11FF 512 B NAND flash spare area buffer

* 0xBB00_1200 0xBB00_1DFF 3 Kbytes Reserved

- * 0xBB00_1E00 0xBB00_1FFF 512 B NAND flash control regisers

+ * 0xBB00_1E00 0xBB00_1FFF 512 B NAND flash control registers

* 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved

* 0xC000_0000 0xFFFF_FFFF 1024 Mbytes Reserved

*/

--

2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

Original commit did not allocate IRQs for the SMMUv3 in the irqmap

effectively using irq 0->3 (shared with other devices). Assuming

original intent was to allocate unique IRQs then add an allocation

to the irqmap.

Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Graeme Gregory <graeme@nuviainc.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20201007100732.4103790-3-graeme@nuviainc.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/sbsa-ref.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {

[SBSA_SECURE_UART_MM] = 9,

[SBSA_AHCI] = 10,

[SBSA_EHCI] = 11,

+ [SBSA_SMMU] = 12, /* ... to 15 */

};

static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The "BCM2835 ARM Peripherals" datasheet [*] chapter 2

("Auxiliaries: UART1 & SPI1, SPI2"), list the register

sizes as 3/8/16/32 bits. We assume this means this

peripheral allows 8-bit accesses.

This was not an issue until commit 5d971f9e67 which reverted

("memory: accept mismatching sizes in memory_region_access_valid").

The model is implemented as 32-bit accesses (see commit 97398d900c,

all registers are 32-bit) so replace MemoryRegionOps.valid as

MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid

with a 8/32-bit range.

[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201002181032.1899463-1-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/char/bcm2835_aux.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/bcm2835_aux.c

+++ b/hw/char/bcm2835_aux.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {

.read = bcm2835_aux_read,

.write = bcm2835_aux_write,

.endianness = DEVICE_NATIVE_ENDIAN,

- .valid.min_access_size = 4,

+ .impl.min_access_size = 4,

+ .impl.max_access_size = 4,

+ .valid.min_access_size = 1,

.valid.max_access_size = 4,

};

--

2.20.1

When we compile without KVM support !defined(CONFIG_KVM) we generate

stubs for functions that the linker will still encounter. Sometimes

these stubs can be executed safely and are placed in paths where they

get executed with or without KVM. Other functions should never be

called without KVM. Those functions should be guarded by kvm_enabled(),

but should also be robust to refactoring mistakes. Putting a

g_assert_not_reached() in the function should help. Additionally,

the g_assert_not_reached() calls may actually help the linker remove

some code.

We remove the stubs for kvm_arm_get/put_virtual_time(), as they aren't

necessary at all - the only caller is in kvm.c

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Message-id: 20201001061718.101915-3-drjones@redhat.com