1 | This bug seemed worth fixing for 8.0 since we need an rc4 anyway: | 1 | no changes to v1, except adding the CVE identifier to one of the commit |
---|---|---|---|
2 | we were using uninitialized data for the guarded bit when | 2 | messages. |
3 | combining stage 1 and stage 2 attrs. | ||
4 | 3 | ||
5 | thanks | ||
6 | -- PMM | 4 | -- PMM |
7 | 5 | ||
8 | The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6: | 6 | The following changes since commit cf7ca7d5b9faca13f1f8e3ea92cfb2f741eb0c0e: |
9 | 7 | ||
10 | Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100) | 8 | Merge remote-tracking branch 'remotes/stefanha-gitlab/tags/tracing-pull-request' into staging (2021-02-01 16:28:00 +0000) |
11 | 9 | ||
12 | are available in the Git repository at: | 10 | are available in the Git repository at: |
13 | 11 | ||
14 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410 | 12 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210203 |
15 | 13 | ||
16 | for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308: | 14 | for you to fetch changes up to fd8f71b95da86f530aae3d02a14b0ccd9e024772: |
17 | 15 | ||
18 | target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100) | 16 | hw/arm: Display CPU type in machine description (2021-02-03 10:15:51 +0000) |
19 | 17 | ||
20 | ---------------------------------------------------------------- | 18 | ---------------------------------------------------------------- |
21 | target-arm: Fix bug where we weren't initializing | 19 | target-arm queue: |
22 | guarded bit state when combining S1/S2 attrs | 20 | * hw/intc/arm_gic: Allow to use QTest without crashing |
21 | * hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled | ||
22 | * hw/char/exynos4210_uart: Fix missing call to report ready for input | ||
23 | * hw/arm/smmuv3: Fix addr_mask for range-based invalidation | ||
24 | * hw/ssi/imx_spi: Fix various minor bugs | ||
25 | * hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register | ||
26 | * hw/arm: Add missing Kconfig dependencies | ||
27 | * hw/arm: Display CPU type in machine description | ||
23 | 28 | ||
24 | ---------------------------------------------------------------- | 29 | ---------------------------------------------------------------- |
25 | Richard Henderson (2): | 30 | Bin Meng (5): |
26 | target/arm: PTE bit GP only applies to stage1 | 31 | hw/ssi: imx_spi: Use a macro for number of chip selects supported |
27 | target/arm: Copy guarded bit in combine_cacheattrs | 32 | hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset() |
33 | hw/ssi: imx_spi: Round up the burst length to be multiple of 8 | ||
34 | hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic | ||
35 | hw/ssi: imx_spi: Correct tx and rx fifo endianness | ||
28 | 36 | ||
29 | target/arm/ptw.c | 11 ++++++----- | 37 | Iris Johnson (2): |
30 | 1 file changed, 6 insertions(+), 5 deletions(-) | 38 | hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled |
39 | hw/char/exynos4210_uart: Fix missing call to report ready for input | ||
40 | |||
41 | Philippe Mathieu-Daudé (12): | ||
42 | hw/intc/arm_gic: Allow to use QTest without crashing | ||
43 | hw/ssi: imx_spi: Remove pointless variable initialization | ||
44 | hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value | ||
45 | hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled | ||
46 | hw/ssi: imx_spi: Rework imx_spi_write() to handle block disabled | ||
47 | hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register | ||
48 | hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ | ||
49 | hw/arm/exynos4210: Add missing dependency on OR_IRQ | ||
50 | hw/arm/xlnx-versal: Versal SoC requires ZDMA | ||
51 | hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals | ||
52 | hw/net/can: ZynqMP CAN device requires PTIMER | ||
53 | hw/arm: Display CPU type in machine description | ||
54 | |||
55 | Xuzhou Cheng (1): | ||
56 | hw/ssi: imx_spi: Disable chip selects when controller is disabled | ||
57 | |||
58 | Zenghui Yu (1): | ||
59 | hw/arm/smmuv3: Fix addr_mask for range-based invalidation | ||
60 | |||
61 | include/hw/ssi/imx_spi.h | 5 +- | ||
62 | hw/arm/digic_boards.c | 2 +- | ||
63 | hw/arm/microbit.c | 2 +- | ||
64 | hw/arm/netduino2.c | 2 +- | ||
65 | hw/arm/netduinoplus2.c | 2 +- | ||
66 | hw/arm/orangepi.c | 2 +- | ||
67 | hw/arm/smmuv3.c | 4 +- | ||
68 | hw/arm/stellaris.c | 4 +- | ||
69 | hw/char/exynos4210_uart.c | 7 ++- | ||
70 | hw/intc/arm_gic.c | 5 +- | ||
71 | hw/ssi/imx_spi.c | 153 +++++++++++++++++++++++++++++----------------- | ||
72 | hw/Kconfig | 1 + | ||
73 | hw/arm/Kconfig | 5 ++ | ||
74 | hw/dma/Kconfig | 3 + | ||
75 | hw/dma/meson.build | 2 +- | ||
76 | 15 files changed, 130 insertions(+), 69 deletions(-) | ||
77 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Richard Henderson <richard.henderson@linaro.org> | ||
2 | 1 | ||
3 | Only perform the extract of GP during the stage1 walk. | ||
4 | |||
5 | Reported-by: Peter Maydell <peter.maydell@linaro.org> | ||
6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
8 | Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org | ||
9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
10 | --- | ||
11 | target/arm/ptw.c | 10 +++++----- | ||
12 | 1 file changed, 5 insertions(+), 5 deletions(-) | ||
13 | |||
14 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
15 | index XXXXXXX..XXXXXXX 100644 | ||
16 | --- a/target/arm/ptw.c | ||
17 | +++ b/target/arm/ptw.c | ||
18 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
19 | result->f.attrs.secure = false; | ||
20 | } | ||
21 | |||
22 | - /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ | ||
23 | - if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { | ||
24 | - result->f.guarded = extract64(attrs, 50, 1); /* GP */ | ||
25 | - } | ||
26 | - | ||
27 | if (regime_is_stage2(mmu_idx)) { | ||
28 | result->cacheattrs.is_s2_format = true; | ||
29 | result->cacheattrs.attrs = extract32(attrs, 2, 4); | ||
30 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
31 | assert(attrindx <= 7); | ||
32 | result->cacheattrs.is_s2_format = false; | ||
33 | result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); | ||
34 | + | ||
35 | + /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ | ||
36 | + if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { | ||
37 | + result->f.guarded = extract64(attrs, 50, 1); /* GP */ | ||
38 | + } | ||
39 | } | ||
40 | |||
41 | /* | ||
42 | -- | ||
43 | 2.34.1 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Richard Henderson <richard.henderson@linaro.org> | ||
2 | 1 | ||
3 | The guarded bit comes from the stage1 walk. | ||
4 | |||
5 | Fixes: Coverity CID 1507929 | ||
6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
8 | Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org | ||
9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
10 | --- | ||
11 | target/arm/ptw.c | 1 + | ||
12 | 1 file changed, 1 insertion(+) | ||
13 | |||
14 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
15 | index XXXXXXX..XXXXXXX 100644 | ||
16 | --- a/target/arm/ptw.c | ||
17 | +++ b/target/arm/ptw.c | ||
18 | @@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr, | ||
19 | |||
20 | assert(!s1.is_s2_format); | ||
21 | ret.is_s2_format = false; | ||
22 | + ret.guarded = s1.guarded; | ||
23 | |||
24 | if (s1.attrs == 0xf0) { | ||
25 | tagged = true; | ||
26 | -- | ||
27 | 2.34.1 | diff view generated by jsdifflib |