A grab-bag of minor stuff for the end of the year. My to-review

queue is not empty, but it it at least in single figures...

-- PMM

The following changes since commit 5bfbd8170ce7acb98a1834ff49ed7340b0837144:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging (2020-12-14 20:32:38 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201215

for you to fetch changes up to 23af268566069183285bebbdf95b1b37cb7c0942:

hw/block/m25p80: Fix Numonyx fast read dummy cycle count (2020-12-15 13:39:30 +0000)

* gdbstub: Correct misparsing of vCont C/S requests

* openrisc: Move pic_cpu code into CPU object proper

* nios2: Move IIC code into CPU object proper

* Improve reporting of ROM overlap errors

* xlnx-versal: Add USB support

* hw/misc/zynq_slcr: Avoid #DIV/0! error

* Numonyx: Fix dummy cycles and check for SPI mode on cmds

Joe Komlodi (4):

hw/block/m25p80: Make Numonyx config field names more accurate

hw/block/m25p80: Fix when VCFG XIP bit is set for Numonyx

hw/block/m25p80: Check SPI mode before running some Numonyx commands

hw/block/m25p80: Fix Numonyx fast read dummy cycle count

Peter Maydell (11):

gdbstub: Correct misparsing of vCont C/S requests

hw/openrisc/openrisc_sim: Use IRQ splitter when connecting IRQ to multiple CPUs

hw/openrisc/openrisc_sim: Abstract out "get IRQ x of CPU y"

target/openrisc: Move pic_cpu code into CPU object proper

target/nios2: Move IIC code into CPU object proper

target/nios2: Move nios2_check_interrupts() into target/nios2

target/nios2: Use deposit32() to update ipending register

hw/core/loader.c: Track last-seen ROM in rom_check_and_register_reset()

hw/core/loader.c: Improve reporting of ROM overlap errors

elf_ops.h: Don't truncate name of the ROM blobs we create

elf_ops.h: Be more verbose with ROM blob names

hw/misc/zynq_slcr: Avoid #DIV/0! error

Sai Pavan Boddu (2):

usb: Add versal-usb2-ctrl-regs module

usb: xlnx-usb-subsystem: Add xilinx usb subsystem

Vikram Garhwal (2):

usb: Add DWC3 model

arm: xlnx-versal: Connect usb to virt-versal

From: Joe Komlodi <joe.komlodi@xilinx.com>

VCFG XIP is set (disabled) when the NVCFG XIP bits are all set (disabled).

Signed-off-by: Joe Komlodi <komlodi@xilinx.com>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Message-id: 1605568264-26376-3-git-send-email-komlodi@xilinx.com

hw/block/m25p80.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c

--- a/hw/block/m25p80.c

+++ b/hw/block/m25p80.c

@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)

s->volatile_cfg |= VCFG_DUMMY;

s->volatile_cfg |= VCFG_WRAP_SEQUENTIAL;

if ((s->nonvolatile_cfg & NVCFG_XIP_MODE_MASK)

- != NVCFG_XIP_MODE_DISABLED) {

+ == NVCFG_XIP_MODE_DISABLED) {

s->volatile_cfg |= VCFG_XIP_MODE_DISABLED;

}

s->volatile_cfg |= deposit32(s->volatile_cfg,

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

This model is a top level integration wrapper for hcd-dwc3 and

versal-usb2-ctrl-regs modules, this is used by xilinx versal soc's and

future xilinx usb subsystems would also be part of it.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

include/hw/usb/xlnx-usb-subsystem.h | 45 ++++++++++++++

hw/usb/xlnx-usb-subsystem.c | 94 +++++++++++++++++++++++++++++

hw/usb/Kconfig | 5 ++

hw/usb/meson.build | 1 +

4 files changed, 145 insertions(+)

create mode 100644 include/hw/usb/xlnx-usb-subsystem.h

create mode 100644 hw/usb/xlnx-usb-subsystem.c

diff --git a/include/hw/usb/xlnx-usb-subsystem.h b/include/hw/usb/xlnx-usb-subsystem.h

+++ b/include/hw/usb/xlnx-usb-subsystem.h

+ * QEMU model of the Xilinx usb subsystem

+ * Copyright (c) 2020 Xilinx Inc. Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

+ * Permission is hereby granted, free of charge, to any person obtaining a copy

+ * of this software and associated documentation files (the "Software"), to deal

+ * in the Software without restriction, including without limitation the rights

+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

+ * copies of the Software, and to permit persons to whom the Software is

+ * furnished to do so, subject to the following conditions:

+ * The above copyright notice and this permission notice shall be included in

+ * all copies or substantial portions of the Software.

+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

+ * THE SOFTWARE.

+ * QEMU model of the Xilinx usb subsystem

+ *

+ * Copyright (c) 2020 Xilinx Inc. Sai Pavan Boddu <sai.pava.boddu@xilinx.com>

+ *

+ * Permission is hereby granted, free of charge, to any person obtaining a copy

+ * of this software and associated documentation files (the "Software"), to deal

+ * in the Software without restriction, including without limitation the rights

+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

+ * copies of the Software, and to permit persons to whom the Software is

+ * furnished to do so, subject to the following conditions:

+ *

+ * The above copyright notice and this permission notice shall be included in

+ * all copies or substantial portions of the Software.

+ *

+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

+ * THE SOFTWARE.

+#include "hw/irq.h"

+#include "hw/register.h"

+#include "qemu/bitops.h"

+#include "qemu/log.h"

+#include "qom/object.h"

+#include "qapi/error.h"

+#include "hw/qdev-properties.h"

+#include "hw/usb/xlnx-usb-subsystem.h"

+static void versal_usb2_realize(DeviceState *dev, Error **errp)

+ VersalUsb2 *s = VERSAL_USB2(dev);

+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);

+ Error *err = NULL;

+

+ sysbus_realize(SYS_BUS_DEVICE(&s->dwc3), &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

+static void versal_usb2_init(Object *obj)

+ VersalUsb2 *s = VERSAL_USB2(obj);

+

+ object_initialize_child(obj, "versal.dwc3", &s->dwc3,

+ TYPE_USB_DWC3);

+ object_initialize_child(obj, "versal.usb2-ctrl", &s->usb2Ctrl,

+ TYPE_XILINX_VERSAL_USB2_CTRL_REGS);

+ memory_region_init_alias(&s->dwc3_mr, obj, "versal.dwc3_alias",

+ &s->dwc3.iomem, 0, DWC3_SIZE);

+ memory_region_init_alias(&s->usb2Ctrl_mr, obj, "versal.usb2Ctrl_alias",

+ &s->usb2Ctrl.iomem, 0, USB2_REGS_R_MAX * 4);

+ qdev_alias_all_properties(DEVICE(&s->dwc3), obj);

+ qdev_alias_all_properties(DEVICE(&s->dwc3.sysbus_xhci), obj);

+ object_property_add_alias(obj, "dma", OBJECT(&s->dwc3.sysbus_xhci), "dma");

+static void versal_usb2_class_init(ObjectClass *klass, void *data)

+ DeviceClass *dc = DEVICE_CLASS(klass);

+ dc->realize = versal_usb2_realize;

+static const TypeInfo versal_usb2_info = {

+ .name = TYPE_XILINX_VERSAL_USB2,

+ .instance_size = sizeof(VersalUsb2),

+ .class_init = versal_usb2_class_init,

+ .instance_init = versal_usb2_init,

+static void versal_usb_types(void)

+ type_register_static(&versal_usb2_info);

+type_init(versal_usb_types)

diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig

--- a/hw/usb/Kconfig

+++ b/hw/usb/Kconfig

@@ -XXX,XX +XXX,XX @@ config USB_DWC3

select USB_XHCI_SYSBUS

select REGISTER

+config XLNX_USB_SUBSYS

+ bool

+ default y if XLNX_VERSAL

+ select USB_DWC3

diff --git a/hw/usb/meson.build b/hw/usb/meson.build

--- a/hw/usb/meson.build

+++ b/hw/usb/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_TUSB6010', if_true: files('tusb6010.c'))

softmmu_ss.add(when: 'CONFIG_IMX', if_true: files('chipidea.c'))

softmmu_ss.add(when: 'CONFIG_IMX_USBPHY', if_true: files('imx-usb-phy.c'))

specific_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-usb2-ctrl-regs.c'))

+specific_ss.add(when: 'CONFIG_XLNX_USB_SUBSYS', if_true: files('xlnx-usb-subsystem.c'))

# emulated usb devices

softmmu_ss.add(when: 'CONFIG_USB', if_true: files('dev-hub.c'))

From: Joe Komlodi <joe.komlodi@xilinx.com>

Numonyx chips determine the number of cycles to wait based on bits 7:4

in the volatile configuration register.

However, if these bits are 0x0 or 0xF, the number of dummy cycles to

wait is 10 for QIOR and QIOR4 commands or when in QIO mode, and otherwise 8 for

the currently supported fast read commands. [1]

[1]

https://www.micron.com/-/media/client/global/documents/products/data-sheet/nor-flash/serial-nor/mt25q/die-rev-b/mt25q_qlkt_u_02g_cbb_0.pdf?rev=9b167fbf2b3645efba6385949a72e453

Signed-off-by: Joe Komlodi <komlodi@xilinx.com>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Message-id: 1605568264-26376-5-git-send-email-komlodi@xilinx.com

hw/block/m25p80.c | 30 +++++++++++++++++++++++++++---

1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c

--- a/hw/block/m25p80.c

+++ b/hw/block/m25p80.c

@@ -XXX,XX +XXX,XX @@ static uint8_t numonyx_mode(Flash *s)

+static uint8_t numonyx_extract_cfg_num_dummies(Flash *s)

+ uint8_t num_dummies;

+ uint8_t mode;

+ assert(get_man(s) == MAN_NUMONYX);

+ mode = numonyx_mode(s);

+ num_dummies = extract32(s->volatile_cfg, 4, 4);

+ if (num_dummies == 0x0 || num_dummies == 0xf) {

+ switch (s->cmd_in_progress) {

+ case QIOR:

+ case QIOR4:

+ num_dummies = 10;

+ break;

+ default:

+ num_dummies = (mode == MODE_QIO) ? 10 : 8;

+ break;

+ }

+ }

+

+ return num_dummies;

static void decode_fast_read_cmd(Flash *s)

s->needed_bytes = get_addr_length(s);

@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)

s->needed_bytes += 8;

break;

case MAN_NUMONYX:

- s->needed_bytes += extract32(s->volatile_cfg, 4, 4);

+ s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

break;

case MAN_MACRONIX:

if (extract32(s->volatile_cfg, 6, 2) == 1) {

@@ -XXX,XX +XXX,XX @@ static void decode_dio_read_cmd(Flash *s)

);

break;

case MAN_NUMONYX:

- s->needed_bytes += extract32(s->volatile_cfg, 4, 4);

+ s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

break;

case MAN_MACRONIX:

switch (extract32(s->volatile_cfg, 6, 2)) {

@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)

);

break;

case MAN_NUMONYX:

- s->needed_bytes += extract32(s->volatile_cfg, 4, 4);

+ s->needed_bytes += numonyx_extract_cfg_num_dummies(s);

break;

case MAN_MACRONIX:

switch (extract32(s->volatile_cfg, 6, 2)) {

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Malicious user can set the feedback divisor for the PLLs

to zero, triggering a floating-point exception (SIGFPE).

As the datasheet [*] is not clear how hardware behaves

when these bits are zeroes, use the maximum divisor

possible (128) to avoid the software FPE.

[*] Zynq-7000 TRM, UG585 (v1.12.2)

B.28 System Level Control Registers (slcr)

-> "Register (slcr) ARM_PLL_CTRL"

25.10.4 PLLs

-> "Software-Controlled PLL Update"

Fixes: 38867cb7ec9 ("hw/misc/zynq_slcr: add clock generation for uarts")

Reported-by: Gaoning Pan <pgn@zju.edu.cn>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>

Message-id: 20201210141610.884600-1-f4bug@amsat.org

hw/misc/zynq_slcr.c | 5 +++++

1 file changed, 5 insertions(+)

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c

--- a/hw/misc/zynq_slcr.c

+++ b/hw/misc/zynq_slcr.c

@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_pll(uint64_t input, uint32_t ctrl_reg)

return 0;

+ /* Consider zero feedback as maximum divide ratio possible */

+ if (!mult) {

+ mult = 1 << R_xxx_PLL_CTRL_PLL_FPDIV_LENGTH;

/* frequency multiplier -> period division */

return input / mult;

In the vCont packet, two of the command actions (C and S) take an

argument specifying the signal to be sent to the process/thread, which is

sent as an ASCII string of two hex digits which immediately follow the

'C' or 'S' character.

Our code for parsing this packet accidentally skipped the first of the

two bytes of the signal value, because it started parsing the hex string

at 'p + 1' when the preceding code had already moved past the 'C' or

'S' with "cur_action = *p++".

This meant that we would only do the right thing for signals below

10, and would misinterpret the rest. For instance, when the debugger

wants to send the process a SIGPROF (27 on x86-64) we mangle this into

a SIGSEGV (11).

Remove the accidental double increment.

Fixes: https://bugs.launchpad.net/qemu/+bug/1773743

gdbstub.c | 2 +-

diff --git a/gdbstub.c b/gdbstub.c

--- a/gdbstub.c

+++ b/gdbstub.c

@@ -XXX,XX +XXX,XX @@ static int gdb_handle_vcont(const char *p)

cur_action = *p++;

if (cur_action == 'C' || cur_action == 'S') {

cur_action = qemu_tolower(cur_action);

- res = qemu_strtoul(p + 1, &p, 16, &tmp);

+ res = qemu_strtoul(p, &p, 16, &tmp);

if (res) {

goto out;

}