The following changes since commit efcd0ec14b0fe9ee0ee70277763b2d538d19238d:

Merge tag 'misc-fixes-20230330' of https://github.com/philmd/qemu into staging (2023-03-30 14:22:29 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230403

for you to fetch changes up to a0eaa126af3c5a43937a22c58cfb9bb36e4a5001:

hw/ssi: Fix Linux driver init issue with xilinx_spi (2023-04-03 16:12:30 +0100)

* target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()

* hw/arm: do not free machine->fdt in arm_load_dtb()

* target/arm: Fix generated code for cpreg reads when HSTR is active

* hw/ssi: Fix Linux driver init issue with xilinx_spi

Chris Rauer (1):

hw/ssi: Fix Linux driver init issue with xilinx_spi

Markus Armbruster (1):

hw/arm: do not free machine->fdt in arm_load_dtb()

Peter Maydell (1):

target/arm: Fix generated code for cpreg reads when HSTR is active

Philippe Mathieu-Daudé (1):

target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()

target/arm/internals.h | 15 ++++++++++-----

hw/arm/boot.c | 5 ++++-

hw/ssi/xilinx_spi.c | 1 +

target/arm/gdbstub64.c | 7 +++++--

target/arm/tcg/pauth_helper.c | 18 +-----------------

target/arm/tcg/translate.c | 6 ++++++

6 files changed, 27 insertions(+), 25 deletions(-)

From: Markus Armbruster <armbru@redhat.com>

At this moment, arm_load_dtb() can free machine->fdt when

binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be

retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is

the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to

machine->fdt. And, in that case, the existing g_free(fdt) at the end of

arm_load_dtb() will make machine->fdt point to an invalid memory region.

Since monitor command 'dumpdtb' was introduced a couple of releases

ago, running it with any ARM machine that uses arm_load_dtb() will

crash QEMU.

Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead

of freeing 'fdt', assign it back to ms->fdt.

Cc: Peter Maydell <peter.maydell@linaro.org>

Cc: qemu-arm@nongnu.org

Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb")

Reported-by: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>

Message-id: 20230328165935.1512846-1-armbru@redhat.com

hw/arm/boot.c | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,

qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,

rom_ptr_for_as(as, addr, size));

- g_free(fdt);

+ if (fdt != ms->fdt) {

+ g_free(ms->fdt);

+ ms->fdt = fdt;

+ }

return size;

2.34.1

In commit 049edada we added some code to handle HSTR_EL2 traps, which

we did as an inline "conditionally branch over a

gen_exception_insn()". Unfortunately this fails to take account of

the fact that gen_exception_insn() will set s->base.is_jmp to

DISAS_NORETURN. That means that at the end of the TB we won't

generate the necessary code to handle the "branched over the trap and

continued normal execution" codepath. The result is that the TCG

main loop thinks that we stopped execution of the TB due to a

situation that only happens when icount is enabled, and hits an

assertion. Explicitly set is_jmp back to DISAS_NEXT so we generate

the correct code for when execution continues past this insn.

Note that this only happens for cpreg reads; writes will call

gen_lookup_tb() which generates a valid end-of-TB.

Fixes: 049edada ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1")

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1551

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230330101900.2320380-1-peter.maydell@linaro.org

---

target/arm/tcg/translate.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c

--- a/target/arm/tcg/translate.c

+++ b/target/arm/tcg/translate.c

@@ -XXX,XX +XXX,XX @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,

tcg_gen_brcondi_i32(TCG_COND_EQ, t, 0, over.label);

gen_exception_insn(s, 0, EXCP_UDEF, syndrome);

+ /*

+ * gen_exception_insn() will set is_jmp to DISAS_NORETURN,

+ * but since we're conditionally branching over it, we want

+ * to assume continue-to-next-instruction.

+ */

+ s->base.is_jmp = DISAS_NEXT;

set_disas_label(s, over);

2.34.1

From: Chris Rauer <crauer@google.com>

The problem is that the Linux driver expects the master transaction inhibit

bit(R_SPICR_MTI) to be set during driver initialization so that it can

detect the fifo size but QEMU defaults it to zero out of reset. The

datasheet indicates this bit is active on reset.

See page 25, SPI Control Register section:

https://www.xilinx.com/content/dam/xilinx/support/documents/ip_documentation/axi_quad_spi/v3_2/pg153-axi-quad-spi.pdf

Signed-off-by: Chris Rauer <crauer@google.com>

Message-id: 20230323182811.2641044-1-crauer@google.com

Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>

hw/ssi/xilinx_spi.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c

--- a/hw/ssi/xilinx_spi.c

+++ b/hw/ssi/xilinx_spi.c

@@ -XXX,XX +XXX,XX @@ static void xlx_spi_do_reset(XilinxSPI *s)

txfifo_reset(s);

s->regs[R_SPISSR] = ~0;

+ s->regs[R_SPICR] = R_SPICR_MTI;

xlx_spi_update_irq(s);

xlx_spi_update_cs(s);

}

2.34.1