From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix integer handling issues handling issue reported by Coverity:

hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()

>>> CID 1432730: Integer handling issues (NEGATIVE_RETURNS)

>>> "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.

162 npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));

hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()

218 cs_id = npcm7xx_fiu_cs_index(fiu, f);

219 trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,

220 size, v);

>>> CID 1432729: Integer handling issues (NEGATIVE_RETURNS)

>>> "cs_id" is passed to a parameter that cannot be negative.

221 npcm7xx_fiu_select(fiu, cs_id);

Since the index of the flash can not be negative, return an

unsigned type.

Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>

Message-id: 20200919132435.310527-1-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/ssi/npcm7xx_fiu.c | 12 ++++++------

hw/ssi/trace-events | 2 +-

2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/npcm7xx_fiu.c

+++ b/hw/ssi/npcm7xx_fiu.c

@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {

* Returns the index of flash in the fiu->flash array. This corresponds to the

* chip select ID of the flash.

*/

-static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

+static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,

+ NPCM7xxFIUFlash *flash)

{

int index = flash - fiu->flash;

@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

}

/* Assert the chip select specified in the UMA Control/Status Register. */

-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)

+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)

{

trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);

if (cs_id < s->cs_count) {

qemu_irq_lower(s->cs_lines[cs_id]);

+ s->active_cs = cs_id;

} else {

qemu_log_mask(LOG_GUEST_ERROR,

"%s: UMA to CS%d; this module has only %d chip selects",

DEVICE(s)->canonical_path, cs_id, s->cs_count);

- cs_id = -1;

+ s->active_cs = -1;

}

-

- s->active_cs = cs_id;

}

/* Deassert the currently active chip select. */

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,

NPCM7xxFIUFlash *f = opaque;

NPCM7xxFIUState *fiu = f->fiu;

uint32_t dwr_cfg;

- int cs_id;

+ unsigned cs_id;

int i;

if (fiu->active_cs != -1) {

diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/trace-events

+++ b/hw/ssi/trace-events

@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"

npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201002080935.1660005-1-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx25.h | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx25.h

+++ b/include/hw/arm/fsl-imx25.h

@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {

* 0xBB00_0000 0xBB00_0FFF 4 Kbytes NAND flash main area buffer

* 0xBB00_1000 0xBB00_11FF 512 B NAND flash spare area buffer

* 0xBB00_1200 0xBB00_1DFF 3 Kbytes Reserved

- * 0xBB00_1E00 0xBB00_1FFF 512 B NAND flash control regisers

+ * 0xBB00_1E00 0xBB00_1FFF 512 B NAND flash control registers

* 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved

* 0xC000_0000 0xFFFF_FFFF 1024 Mbytes Reserved

*/

--

2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

SMMUv3 has an error in a previous patch where an i was transposed to a 1

meaning interrupts would not have been correctly assigned to the SMMUv3

instance.

Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state")

Signed-off-by: Graeme Gregory <graeme@nuviainc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20201007100732.4103790-2-graeme@nuviainc.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/sbsa-ref.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@ static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);

for (i = 0; i < NUM_SMMU_IRQS; i++) {

sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,

- qdev_get_gpio_in(sms->gic, irq + 1));

+ qdev_get_gpio_in(sms->gic, irq + i));

}

}

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The "BCM2835 ARM Peripherals" datasheet [*] chapter 2

("Auxiliaries: UART1 & SPI1, SPI2"), list the register

sizes as 3/8/16/32 bits. We assume this means this

peripheral allows 8-bit accesses.

This was not an issue until commit 5d971f9e67 which reverted

("memory: accept mismatching sizes in memory_region_access_valid").

The model is implemented as 32-bit accesses (see commit 97398d900c,

all registers are 32-bit) so replace MemoryRegionOps.valid as

MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid

with a 8/32-bit range.

[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201002181032.1899463-1-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/char/bcm2835_aux.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/bcm2835_aux.c

+++ b/hw/char/bcm2835_aux.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {

.read = bcm2835_aux_read,

.write = bcm2835_aux_write,

.endianness = DEVICE_NATIVE_ENDIAN,

- .valid.min_access_size = 4,

+ .impl.min_access_size = 4,

+ .impl.max_access_size = 4,

+ .valid.min_access_size = 1,

.valid.max_access_size = 4,

};

--

2.20.1

From: Andrew Jones <drjones@redhat.com>

Update against Linux 5.9-rc7.

Cc: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Message-id: 20201001061718.101915-2-drjones@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

linux-headers/linux/kvm.h | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h

index XXXXXXX..XXXXXXX 100644

--- a/linux-headers/linux/kvm.h

+++ b/linux-headers/linux/kvm.h

@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {

#define KVM_VM_PPC_HV 1

#define KVM_VM_PPC_PR 2

-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */

-#define KVM_VM_MIPS_TE        0

+/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */

+#define KVM_VM_MIPS_AUTO    0

#define KVM_VM_MIPS_VZ        1

+#define KVM_VM_MIPS_TE        2

#define KVM_S390_SIE_PAGE_OFFSET 1

@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {

#define KVM_CAP_LAST_CPU 184

#define KVM_CAP_SMALLER_MAXPHYADDR 185

#define KVM_CAP_S390_DIAG318 186

+#define KVM_CAP_STEAL_TIME 187

#ifdef KVM_CAP_IRQ_ROUTING

--

2.20.1