Commit graph

84434 commits

Author SHA1 Message Date
Vladimir Sementsov-Ogievskiy 69b55e03f7 block: refactor bdrv_check_request: add errp
It's better to pass &error_abort than just assert that result is 0: on
crash, we'll immediately see the reason in the backtrace.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201211183934.169161-2-vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: fix iotest 206 fallout]
Signed-off-by: Eric Blake <eblake@redhat.com>
2021-02-03 08:00:33 -06:00
Eric Blake c930831446 iotests: Fix expected whitespace for 185
Commit f93e19fb03 adjusted various iotest whitespace discrepancies.
But another one snuck in during 61623f8215, and we missed the
semantic merge conflict at the time because 185 is not run as part of
the default 'make check'.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20210202185914.614705-1-eblake@redhat.com>
[eblake: adjust commit message]
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2021-02-03 08:00:33 -06:00
Peter Maydell 99ae0cd90d target-arm queue:
* hw/intc/arm_gic: Allow to use QTest without crashing
  * hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled
  * hw/char/exynos4210_uart: Fix missing call to report ready for input
  * hw/arm/smmuv3: Fix addr_mask for range-based invalidation
  * hw/ssi/imx_spi: Fix various minor bugs
  * hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
  * hw/arm: Add missing Kconfig dependencies
  * hw/arm: Display CPU type in machine description
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmAaeAQZHHBldGVyLm1h
 eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3tWFD/9VTSSTmGMtSLGpuVt6t07x
 zqaFvRe+xUjrunwt25yx9tu9o4txXTk6mekgAz51QSeijESVIQQUKArZjbLWxRjl
 EXZAedOCF+f+lpzdQCO/GZtsHOfcWa158qm51NlEIM3cn1NiSASs0ky3r52MjjAR
 g0NFYTiZNplq8ah/0RljhHMhnAHzUbp/IErIxknWOVKvaH45+eji7mKxUk2vaCXB
 L5HCEzGCbPCqMMi3DFcwm9nNIYRu7X0hs9nR0AXTvdXbCoDqSyD4dEpjEcK/2IFM
 4zbS4NFRD7ndjD0C502+EUFav3tfd5/UfIjNg3oquMTDQrMCvh5Y1i3II0lVVWe5
 eSfbqV2eBzJHBanf7P64fRpk9mBNduJ8BZrozICvkCJxj5y3nTofKA9hXeGaDAdy
 7sA7Uzkpb1vnnMFzYk/0t2D6BSSFiknYuDHnfMY0nRoHsuDvY5yHw9Tt181D+qST
 UyLcmS8BB227WGgQPKSsFiUu7U423BIoiD5pp8cRyAg+FojqH6BZrcVluUWng6Ru
 ZVG0349lTmZ4mgv2hZI1qqIh80o40TI6K7OerQuMkZlq+4xseZvyb6+SQHaQ/j3I
 CKBiN15y/UzE5eivG6Siq3MR2myCBCSevTxDw4s+zR9FhoRQqFKoDhPGXTR9btWo
 1mgDNUQfyWtCcdoJKb7jEg==
 =kWoi
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210203' into staging

target-arm queue:
 * hw/intc/arm_gic: Allow to use QTest without crashing
 * hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled
 * hw/char/exynos4210_uart: Fix missing call to report ready for input
 * hw/arm/smmuv3: Fix addr_mask for range-based invalidation
 * hw/ssi/imx_spi: Fix various minor bugs
 * hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
 * hw/arm: Add missing Kconfig dependencies
 * hw/arm: Display CPU type in machine description

# gpg: Signature made Wed 03 Feb 2021 10:16:36 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20210203: (21 commits)
  hw/arm: Display CPU type in machine description
  hw/net/can: ZynqMP CAN device requires PTIMER
  hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals
  hw/arm/xlnx-versal: Versal SoC requires ZDMA
  hw/arm/exynos4210: Add missing dependency on OR_IRQ
  hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ
  hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
  hw/ssi: imx_spi: Correct tx and rx fifo endianness
  hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic
  hw/ssi: imx_spi: Round up the burst length to be multiple of 8
  hw/ssi: imx_spi: Disable chip selects when controller is disabled
  hw/ssi: imx_spi: Rework imx_spi_write() to handle block disabled
  hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled
  hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value
  hw/ssi: imx_spi: Remove pointless variable initialization
  hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset()
  hw/ssi: imx_spi: Use a macro for number of chip selects supported
  hw/arm/smmuv3: Fix addr_mask for range-based invalidation
  hw/char/exynos4210_uart: Fix missing call to report ready for input
  hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 12:55:44 +00:00
Philippe Mathieu-Daudé fd8f71b95d hw/arm: Display CPU type in machine description
Most of ARM machines display their CPU when QEMU list the available
machines (-M help). Some machines do not. Fix to unify the help
output.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210131184449.382425-7-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 10:15:51 +00:00
Philippe Mathieu-Daudé e022f2a205 hw/net/can: ZynqMP CAN device requires PTIMER
Add a dependency XLNX_ZYNQMP -> PTIMER to fix:

  /usr/bin/ld:
  libcommon.fa.p/hw_net_can_xlnx-zynqmp-can.c.o: in function `xlnx_zynqmp_can_realize':
  hw/net/can/xlnx-zynqmp-can.c:1082: undefined reference to `ptimer_init'
  hw/net/can/xlnx-zynqmp-can.c:1085: undefined reference to `ptimer_transaction_begin'
  hw/net/can/xlnx-zynqmp-can.c:1087: undefined reference to `ptimer_set_freq'
  hw/net/can/xlnx-zynqmp-can.c:1088: undefined reference to `ptimer_set_limit'
  hw/net/can/xlnx-zynqmp-can.c:1089: undefined reference to `ptimer_run'
  hw/net/can/xlnx-zynqmp-can.c:1090: undefined reference to `ptimer_transaction_commit'
  libcommon.fa.p/hw_net_can_xlnx-zynqmp-can.c.o:(.data.rel+0x2c8): undefined reference to `vmstate_ptimer'

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210131184449.382425-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 10:15:50 +00:00
Philippe Mathieu-Daudé 1de3b49017 hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals
The Versal SoC instantiates the TYPE_XLNX_ZYNQMP_RTC object in
versal_create_rtc()(). Select CONFIG_XLNX_ZYNQMP to fix:

  $ make check-qtest-aarch64
  ...
  Running test qtest-aarch64/qom-test
  qemu-system-aarch64: missing object type 'xlnx-zynmp.rtc'
  Broken pipe

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210131184449.382425-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 10:15:50 +00:00
Philippe Mathieu-Daudé 6bfaec73a1 hw/arm/xlnx-versal: Versal SoC requires ZDMA
The Versal SoC instantiates the TYPE_XLNX_ZDMA object in
versal_create_admas(). Introduce the XLNX_ZDMA configuration
and select it to fix:

  $ qemu-system-aarch64 -M xlnx-versal-virt ...
  qemu-system-aarch64: missing object type 'xlnx.zdma'

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210131184449.382425-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 10:15:50 +00:00
Philippe Mathieu-Daudé 5900c7a6d4 hw/arm/exynos4210: Add missing dependency on OR_IRQ
The Exynos4210 SoC uses an OR gate on the PL330 IRQ lines.

Fixes: dab15fbe2a ("hw/arm/exynos4210: Fix DMA initialization")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210131184449.382425-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 10:15:50 +00:00
Philippe Mathieu-Daudé 9e39983e5d hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ
The STM32F405 SoC uses an OR gate on its ADC IRQs.

Fixes: 529fc5fd3e ("hw/arm: Add the STM32F4xx SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210131184449.382425-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 10:15:50 +00:00
Peter Maydell 8360ebeb4f Machine queue, 2021-02-02
Feature:
 * nvdimm: read-only file support (Stefan Hajnoczi)
 -----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEEWjIv1avE09usz9GqKAeTb5hNxaYFAmAZp5kUHGVoYWJrb3N0
 QHJlZGhhdC5jb20ACgkQKAeTb5hNxaYSeBAAp2lr8eKwsEju6Qpmo+OGo6rG/ORM
 KWRtwwLhHfjj2iFipURAkoepOqmtD/xd7fwItdTwi6zZxzr2eNwKqdlc9T93onzX
 P1yXCNHrz0NmmDB8LbC9Bw2NwubghAYgkuWo+fWMxNU92r+ObnvEc3Otx7P7sGvb
 Lr0yFRANgbJBLw1JTB9kMcWVDhiJ8tMPO9drhUWiMjl4kOaLNyrjUpafNzaleIaO
 GRtIXWts2Waq8wIz3XgSqWDytr075v2vWfvbR4JeAQxFArFbplR3BUuDa8G4nf6O
 nB+DERSMw+fOB2f6ZSYaAqSNwCgIrtwjhkZID0EXzNr03GPuonRnKLRZXYHvlEPT
 0qLaQeeLX+RXr6vGIjPJceQ3PyPlgDMVgVAKPS6Fvx4a3vYzAKfIj6E85QDNhuUJ
 FD37bS3iHpGxMAiuw1Ju1xJdkdzpX11h3nruo8K3sFciMK0CjkfHQKwGcw4XtKE1
 U56PEp+hKmoPe3z9CT1QmlJXlAJ+3NCAAXp6yt5yFDMqU4qxD2ns9+ts/S75o3bo
 P9pTBiaSAlUyOF1a0+0tOMny/7yz+Eb+Dw4CszZ6cCErVC/wNuJXYsF3BCT2roPN
 0d5CKwA717Jh7JmxhSlGXAW4d5mSMn8RHbFnHd5ZKFiIAh4+wnKfXrD9vB+Vq4fr
 Nja+LAk7QoURKjc=
 =TJ6/
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/ehabkost-gl/tags/machine-next-pull-request' into staging

Machine queue, 2021-02-02

Feature:
* nvdimm: read-only file support (Stefan Hajnoczi)

# gpg: Signature made Tue 02 Feb 2021 19:27:21 GMT
# gpg:                using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6
# gpg:                issuer "ehabkost@redhat.com"
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full]
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* remotes/ehabkost-gl/tags/machine-next-pull-request:
  nvdimm: check -object memory-backend-file, readonly=on option
  hostmem-file: add readonly=on|off option
  memory: add readonly support to memory_region_init_ram_from_file()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-03 09:54:21 +00:00
Richard Henderson 0c823e5968 tcg: Remove TCG_TARGET_CON_SET_H
All backends have now been converted to tcg-target-con-set.h,
so we can remove the fallback code.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 63b29fda4e tcg/tci: Split out constraint sets to tcg-target-con-set.h
This requires finishing the conversion to tcg_target_op_def.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 0d11dc7c97 tcg/sparc: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson d1c36a9032 tcg/s390: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 665be288ac tcg/riscv: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 6893016b90 tcg/ppc: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 0263330bce tcg/mips: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 7166eebb9b tcg/arm: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 39e7522b4a tcg/aarch64: Split out constraint sets to tcg-target-con-set.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 4c22e84088 tcg/i386: Split out constraint sets to tcg-target-con-set.h
This exports the constraint sets from tcg_target_op_def to
a place we will be able to manipulate more in future.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 8c07f3262e tcg: Remove TCG_TARGET_CON_STR_H
All backends have now been converted to tcg-target-con-str.h,
so we can remove the fallback code.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:43 -10:00
Richard Henderson 77f268e80b tcg/sparc: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson c947deb13e tcg/s390: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson fc63a4c5c8 tcg/riscv: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson 51800e4346 tcg/mips: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson 7d1820a755 tcg/tci: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson 85d251d7ec tcg/ppc: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson abc730e18e tcg/aarch64: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson 3440d583d6 tcg/arm: Split out target constraints to tcg-target-con-str.h
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:31 -10:00
Richard Henderson 358b492392 tcg/i386: Split out target constraints to tcg-target-con-str.h
This eliminates the target-specific function target_parse_constraint
and folds it into the single caller, process_op_defs.  Since this is
done directly into the switch statement, duplicates are compilation
errors rather than silently ignored at runtime.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:29 -10:00
Richard Henderson df903b94b3 tcg/i386: Tidy register constraint definitions
Create symbolic constants for all low-byte-addressable
and second-byte-addressable registers.  Create a symbol
for the registers that need reserving for softmmu.

There is no functional change for 's', as this letter is
only used for i386.  The BYTEL name is correct for the
action we wish from the constraint.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:12:07 -10:00
Richard Henderson c7c778b5b9 tcg/i386: Move constraint type check to tcg_target_const_match
Rather than check the type when filling in the constraint,
check it when matching the constant.  This removes the only
use of the type argument to target_parse_constraint.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:11:49 -10:00
Richard Henderson 2366c858f9 tcg/tci: Remove TCG_TARGET_HAS_* ifdefs
The opcodes always exist, regardless of whether or not they
are enabled.  Remove the unnecessary ifdefs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:04:26 -10:00
Richard Henderson 0a19f167de tcg/tci: Drop L and S constraints
These are identical to the 'r' constraint.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-02-02 12:04:25 -10:00
Philippe Mathieu-Daudé edfe2eb436 hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register
Per the ARM Generic Interrupt Controller Architecture specification
(document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit,
not 10:

  - 4.3 Distributor register descriptions
  - 4.3.15 Software Generated Interrupt Register, GICD_SG

    - Table 4-21 GICD_SGIR bit assignments

    The Interrupt ID of the SGI to forward to the specified CPU
    interfaces. The value of this field is the Interrupt ID, in
    the range 0-15, for example a value of 0b0011 specifies
    Interrupt ID 3.

Correct the irq mask to fix an undefined behavior (which eventually
lead to a heap-buffer-overflow, see [Buglink]):

   $ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M virt,accel=qtest -qtest stdio
   [I 1612088147.116987] OPENED
  [R +0.278293] writel 0x8000f00 0xff4affb0
  ../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type 'uint8_t [16][8]'
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/intc/arm_gic.c:1498:13

This fixes a security issue when running with KVM on Arm with
kernel-irqchip=off. (The default is kernel-irqchip=on, which is
unaffected, and which is also the correct choice for performance.)

Cc: qemu-stable@nongnu.org
Fixes: CVE-2021-20221
Fixes: 9ee6e8bb85 ("ARMv7 support.")
Buglink: https://bugs.launchpad.net/qemu/+bug/1913916
Buglink: https://bugs.launchpad.net/qemu/+bug/1913917
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210131103401.217160-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Bin Meng 8c495d1379 hw/ssi: imx_spi: Correct tx and rx fifo endianness
The endianness of data exchange between tx and rx fifo is incorrect.
Earlier bytes are supposed to show up on MSB and later bytes on LSB,
ie: in big endian. The manual does not explicitly say this, but the
U-Boot and Linux driver codes have a swap on the data transferred
to tx fifo and from rx fifo.

With this change, U-Boot read from / write to SPI flash tests pass.

  => sf test 1ff000 1000
  SPI flash test:
  0 erase: 0 ticks, 4096000 KiB/s 32768.000 Mbps
  1 check: 3 ticks, 1333 KiB/s 10.664 Mbps
  2 write: 235 ticks, 17 KiB/s 0.136 Mbps
  3 read: 2 ticks, 2000 KiB/s 16.000 Mbps
  Test passed
  0 erase: 0 ticks, 4096000 KiB/s 32768.000 Mbps
  1 check: 3 ticks, 1333 KiB/s 10.664 Mbps
  2 write: 235 ticks, 17 KiB/s 0.136 Mbps
  3 read: 2 ticks, 2000 KiB/s 16.000 Mbps

Fixes: c906a3a015 ("i.MX: Add the Freescale SPI Controller")
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210129132323.30946-11-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Bin Meng 6ed924823c hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic
For the ECSPIx_CONREG register BURST_LENGTH field, the manual says:

0x020 A SPI burst contains the 1 LSB in first word and all 32 bits in second word.
0x021 A SPI burst contains the 2 LSB in first word and all 32 bits in second word.

Current logic uses either s->burst_length or 32, whichever smaller,
to determine how many bits it should read from the tx fifo each time.
For example, for a 48 bit burst length, current logic transfers the
first 32 bit from the first word in the tx fifo, followed by a 16
bit from the second word in the tx fifo, which is wrong. The correct
logic should be: transfer the first 16 bit from the first word in
the tx fifo, followed by a 32 bit from the second word in the tx fifo.

With this change, SPI flash can be successfully probed by U-Boot on
imx6 sabrelite board.

  => sf probe
  SF: Detected sst25vf016b with page size 256 Bytes, erase size 4 KiB, total 2 MiB

Fixes: c906a3a015 ("i.MX: Add the Freescale SPI Controller")
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210129132323.30946-10-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Bin Meng 24bf8ef3f5 hw/ssi: imx_spi: Round up the burst length to be multiple of 8
Current implementation of the imx spi controller expects the burst
length to be multiple of 8, which is the most common use case.

In case the burst length is not what we expect, log it to give user
a chance to notice it, and round it up to be multiple of 8.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Message-id: 20210129132323.30946-9-bmeng.cn@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Xuzhou Cheng 50dc25932e hw/ssi: imx_spi: Disable chip selects when controller is disabled
When a write to ECSPI_CONREG register to disable the SPI controller,
imx_spi_soft_reset() is called to reset the controller, but chip
select lines should have been disabled, otherwise the state machine
of any devices (e.g.: SPI flashes) connected to the SPI master is
stuck to its last state and responds incorrectly to any follow-up
commands.

Fixes: c906a3a015 ("i.MX: Add the Freescale SPI Controller")
Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210129132323.30946-8-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Philippe Mathieu-Daudé fb116b5456 hw/ssi: imx_spi: Rework imx_spi_write() to handle block disabled
When the block is disabled, only the ECSPI_CONREG register can
be modified. Setting the EN bit enabled the device, clearing it
"disables the block and resets the internal logic with the
exception of the ECSPI_CONREG" register.

Ignore all other registers write except ECSPI_CONREG when the
block is disabled.

Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM),
     chapter 21.7.3: Control Register (ECSPIx_CONREG)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210129132323.30946-7-bmeng.cn@gmail.com
Message-Id: <20210115153049.3353008-6-f4bug@amsat.org>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Philippe Mathieu-Daudé 7c87bb5333 hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled
When the block is disabled, it stay it is 'internal reset logic'
(internal clocks are gated off). Reading any register returns
its reset value. Only update this value if the device is enabled.

Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM),
     chapter 21.7.3: Control Register (ECSPIx_CONREG)

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Message-id: 20210129132323.30946-6-bmeng.cn@gmail.com
Message-Id: <20210115153049.3353008-5-f4bug@amsat.org>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Philippe Mathieu-Daudé 93722b6f6a hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value
When the block is disabled, all registers are reset with the
exception of the ECSPI_CONREG. It is initialized to zero
when the instance is created.

Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM),
     chapter 21.7.3: Control Register (ECSPIx_CONREG)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210129132323.30946-5-bmeng.cn@gmail.com
[bmeng: add a 'common_reset' function that does most of reset operation]
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:55 +00:00
Philippe Mathieu-Daudé 9c431a43a6 hw/ssi: imx_spi: Remove pointless variable initialization
'burst_length' is cleared in imx_spi_reset(), which is called
after imx_spi_realize(). Remove the initialization to simplify.

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Message-id: 20210129132323.30946-4-bmeng.cn@gmail.com
Message-Id: <20210115153049.3353008-3-f4bug@amsat.org>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Bin Meng 3c9829e574 hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset()
Usually the approach is that the device on the other end of the line
is going to reset its state anyway, so there's no need to actively
signal an irq line change during the reset hook.

Move imx_spi_update_irq() out of imx_spi_reset(), to a new function
imx_spi_soft_reset() that is called when the controller is disabled.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210129132323.30946-3-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Bin Meng 1da79ecc7a hw/ssi: imx_spi: Use a macro for number of chip selects supported
Avoid using a magic number (4) everywhere for the number of chip
selects supported.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 20210129132323.30946-2-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Zenghui Yu dcda883cd2 hw/arm/smmuv3: Fix addr_mask for range-based invalidation
When handling guest range-based IOTLB invalidation, we should decode the TG
field into the corresponding translation granule size so that we can pass
the correct invalidation range to backend. Set @granule to (tg * 2 + 10) to
properly emulate the architecture.

Fixes: d52915616c ("hw/arm/smmuv3: Get prepared for range invalidation")
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
Acked-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210130043220.1345-1-yuzenghui@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Iris Johnson f2c0fb93a4 hw/char/exynos4210_uart: Fix missing call to report ready for input
When the frontend device has no space for a read the fd is removed
from polling to allow time for the guest to read and clear the buffer.
Without the call to qemu_chr_fe_accept_input(), the poll will not be
broken out of when the guest has cleared the buffer causing significant
IO delays that get worse with smaller buffers.

Buglink: https://bugs.launchpad.net/qemu/+bug/1913341
Signed-off-by: Iris Johnson <iris@modwiz.com>
Message-id: 20210130184016.1787097-1-iris@modwiz.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Iris Johnson 40b4c2ae90 hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled
Currently the Exynos 4210 UART code always reports available FIFO space
when the backend checks for buffer space. When the FIFO is disabled this
is behavior causes the backend chardev code to replace the data before the
guest can read it.

This patch changes adds the logic to report the capacity properly when the
FIFO is not being used.

Buglink: https://bugs.launchpad.net/qemu/+bug/1913344
Signed-off-by: Iris Johnson <iris@modwiz.com>
Message-id: 20210128033655.1029577-1-iris@modwiz.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Philippe Mathieu-Daudé 09bbdb89bc hw/intc/arm_gic: Allow to use QTest without crashing
Alexander reported an issue in gic_get_current_cpu() using the
fuzzer. Yet another "deref current_cpu with QTest" bug, reproducible
doing:

  $ echo readb 0xf03ff000 | qemu-system-arm -M npcm750-evb,accel=qtest -qtest stdio
  [I 1611849440.651452] OPENED
  [R +0.242498] readb 0xf03ff000
  hw/intc/arm_gic.c:63:29: runtime error: member access within null pointer of type 'CPUState' (aka 'struct CPUState')
  SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/intc/arm_gic.c:63:29 in
  AddressSanitizer:DEADLYSIGNAL
  =================================================================
  ==3719691==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000082a0 (pc 0x5618790ac882 bp 0x7ffca946f4f0 sp 0x7ffca946f4a0 T0)
  ==3719691==The signal is caused by a READ memory access.
      #0 0x5618790ac882 in gic_get_current_cpu hw/intc/arm_gic.c:63:29
      #1 0x5618790a8901 in gic_dist_readb hw/intc/arm_gic.c:955:11
      #2 0x5618790a7489 in gic_dist_read hw/intc/arm_gic.c:1158:17
      #3 0x56187adc573b in memory_region_read_with_attrs_accessor softmmu/memory.c:464:9
      #4 0x56187ad7903a in access_with_adjusted_size softmmu/memory.c:552:18
      #5 0x56187ad766d6 in memory_region_dispatch_read1 softmmu/memory.c:1426:16
      #6 0x56187ad758a8 in memory_region_dispatch_read softmmu/memory.c:1449:9
      #7 0x56187b09e84c in flatview_read_continue softmmu/physmem.c:2822:23
      #8 0x56187b0a0115 in flatview_read softmmu/physmem.c:2862:12
      #9 0x56187b09fc9e in address_space_read_full softmmu/physmem.c:2875:18
      #10 0x56187aa88633 in address_space_read include/exec/memory.h:2489:18
      #11 0x56187aa88633 in qtest_process_command softmmu/qtest.c:558:13
      #12 0x56187aa81881 in qtest_process_inbuf softmmu/qtest.c:797:9
      #13 0x56187aa80e02 in qtest_read softmmu/qtest.c:809:5

current_cpu is NULL because QTest accelerator does not use CPU.

Fix by skipping the check and returning the first CPU index when
QTest accelerator is used, similarly to commit c781a2cc42
("hw/i386/vmport: Allow QTest use without crashing").

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Message-id: 20210128161417.3726358-1-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 17:00:54 +00:00
Peter Maydell 77f3804ab7 Block layer patches:
- Fix double processing of nodes in bdrv_set_aio_context()
 - Fix potential hang in block export shutdown
 - block/nvme: Minor tracing improvements
 - iotests: Some more fixups for the 'check' rewrite
 - MAINTAINERS: Add Vladimir as co-maintainer for Block Jobs
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEE3D3rFZqa+V09dFb+fwmycsiPL9YFAmAZfRoRHGt3b2xmQHJl
 ZGhhdC5jb20ACgkQfwmycsiPL9Y1ig//cClwP/uSJkIHRCmCsRL8XHtR9f3g8Jju
 CqB+b00VZGJx6b+d3CKty//LR/O8d8D8ZybnnyK0ruBKa3ayc+U5QBNByExJ6WRk
 Kf77MA5dUIx84t0O+XjO2NXjGiU3D3QGfjSF0Ex0nIEv+iUoVMYcUfep7cVz3/NN
 Vrt3xKPvRrptrrOwPDokkWpFCXhOha+I5gCX/JrKoeg/t4mBQxrYkkzgMHmqQY5o
 3s4eI/5rFUpcMRqUj7Z9RNy4daR8BzCJKMLuzaoTbLy8UtaVhhhzY6a1qoJDYBRF
 YqbXTFwp8lS1QaQZCCYcl5LFEkmhqaj1GZXMLC2REsw53phVtWyv1xek42b/lmTx
 wB9VJcZhVfe5aswlI3WzPQS+D0rhzR1jxURaZvs7is1v7JOFkgT6Q6+Pbsx2GCpx
 uL/h6qCItPcfRj68zwJIaixeGa1JsECzTomFllI4jcL99fumxjDpU+E+4TuF2cEg
 Quk4VvFg7yKHJ5ci88lHNEWjOxLcxNDARk3PL+pyeP2Xe5imMfyHfYWzjjE5dK5g
 94xqSoSrHgOc7kkshWk/ZRgpL8qa/tJuuzxX6mGxg9iUXmOr4HJNLWJp7BLKwqhm
 KUqpUUvlnjMRStGQ27GsQpeoO3t+x7/JKOZXWQ+7yB8dCrUHFVjFuljQu6PP2jCt
 qsUOIU1wGlo=
 =n0hS
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- Fix double processing of nodes in bdrv_set_aio_context()
- Fix potential hang in block export shutdown
- block/nvme: Minor tracing improvements
- iotests: Some more fixups for the 'check' rewrite
- MAINTAINERS: Add Vladimir as co-maintainer for Block Jobs

# gpg: Signature made Tue 02 Feb 2021 16:26:02 GMT
# gpg:                using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6
# gpg:                issuer "kwolf@redhat.com"
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  block: Fix VM size column width in bdrv_snapshot_dump()
  block/nvme: Trace NVMe spec version supported by the controller
  block/nvme: Properly display doorbell stride length in trace event
  iotests: Fix -makecheck output
  iotests: check: return 1 on failure
  iotests: Revert emulator selection to old behaviour
  iotests/297: pylint: ignore too many statements
  block: move blk_exp_close_all() to qemu_cleanup()
  block: Avoid processing BDS twice in bdrv_set_aio_context_ignore()
  MAINTAINERS: Add Vladimir as co-maintainer for Block Jobs

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2021-02-02 16:47:51 +00:00