From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix integer handling issues handling issue reported by Coverity:

hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()

>>> CID 1432730: Integer handling issues (NEGATIVE_RETURNS)

>>> "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.

162 npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));

hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()

218 cs_id = npcm7xx_fiu_cs_index(fiu, f);

219 trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,

220 size, v);

>>> CID 1432729: Integer handling issues (NEGATIVE_RETURNS)

>>> "cs_id" is passed to a parameter that cannot be negative.

221 npcm7xx_fiu_select(fiu, cs_id);

Since the index of the flash can not be negative, return an

unsigned type.

Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>

Message-id: 20200919132435.310527-1-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/ssi/npcm7xx_fiu.c | 12 ++++++------

hw/ssi/trace-events | 2 +-

2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/npcm7xx_fiu.c

+++ b/hw/ssi/npcm7xx_fiu.c

@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {

* Returns the index of flash in the fiu->flash array. This corresponds to the

* chip select ID of the flash.

*/

-static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

+static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,

+ NPCM7xxFIUFlash *flash)

{

int index = flash - fiu->flash;

@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

}

/* Assert the chip select specified in the UMA Control/Status Register. */

-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)

+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)

{

trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);

if (cs_id < s->cs_count) {

qemu_irq_lower(s->cs_lines[cs_id]);

+ s->active_cs = cs_id;

} else {

qemu_log_mask(LOG_GUEST_ERROR,

"%s: UMA to CS%d; this module has only %d chip selects",

DEVICE(s)->canonical_path, cs_id, s->cs_count);

- cs_id = -1;

+ s->active_cs = -1;

}

-

- s->active_cs = cs_id;

}

/* Deassert the currently active chip select. */

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,

NPCM7xxFIUFlash *f = opaque;

NPCM7xxFIUState *fiu = f->fiu;

uint32_t dwr_cfg;

- int cs_id;

+ unsigned cs_id;

int i;

if (fiu->active_cs != -1) {

diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/trace-events

+++ b/hw/ssi/trace-events

@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"

npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

--

2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

Original commit did not allocate IRQs for the SMMUv3 in the irqmap

effectively using irq 0->3 (shared with other devices). Assuming

original intent was to allocate unique IRQs then add an allocation

to the irqmap.

Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Graeme Gregory <graeme@nuviainc.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20201007100732.4103790-3-graeme@nuviainc.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/sbsa-ref.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {

[SBSA_SECURE_UART_MM] = 9,

[SBSA_AHCI] = 10,

[SBSA_EHCI] = 11,

+ [SBSA_SMMU] = 12, /* ... to 15 */

};

static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)

--

2.20.1

From: Andrew Jones <drjones@redhat.com>

Update against Linux 5.9-rc7.

Cc: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Message-id: 20201001061718.101915-2-drjones@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

linux-headers/linux/kvm.h | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h

index XXXXXXX..XXXXXXX 100644

--- a/linux-headers/linux/kvm.h

+++ b/linux-headers/linux/kvm.h

@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {

#define KVM_VM_PPC_HV 1

#define KVM_VM_PPC_PR 2

-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */

-#define KVM_VM_MIPS_TE        0

+/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */

+#define KVM_VM_MIPS_AUTO    0

#define KVM_VM_MIPS_VZ        1

+#define KVM_VM_MIPS_TE        2

#define KVM_S390_SIE_PAGE_OFFSET 1

@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {

#define KVM_CAP_LAST_CPU 184

#define KVM_CAP_SMALLER_MAXPHYADDR 185

#define KVM_CAP_S390_DIAG318 186

+#define KVM_CAP_STEAL_TIME 187

#ifdef KVM_CAP_IRQ_ROUTING

--

2.20.1