[Qemu-commits] [qemu/qemu] 763e10: hw/arm/armsse: Fix memory leak in error-exit path

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 763e10f7bb6413c745edf36e9e806c3d626c8262
      
https://github.com/qemu/qemu/commit/763e10f7bb6413c745edf36e9e806c3d626c8262
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/armsse.c

  Log Message:
  -----------
  hw/arm/armsse: Fix memory leak in error-exit path

Coverity points out (CID 1398632, CID 1398650) that we
leak a couple of allocated strings in the error-exit
code path for setting up the MHUs in the ARMSSE.
Fix this bug by moving the allocate-and-free of each
string to be closer to the use, so we do the free before
doing the error-exit check.

Fixes: f8574705f62b38a ("hw/arm/armsse: Add unimplemented-device stubs for 
MHUs")
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: cff21316c666c8053b1f425577e324038d0ca30d
      
https://github.com/qemu/qemu/commit/cff21316c666c8053b1f425577e324038d0ca30d
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: v8M MPU should use background region as default, not always

The "background region" for a v8M MPU is a default which will be used
(if enabled, and if the access is privileged) if the access does
not match any specific MPU region. We were incorrectly using it
always (by putting the condition at the wrong nesting level). This
meant that we would always return the default background permissions
rather than the correct permissions for a specific region, and also
that we would not return the right information in response to a
TT instruction.

Move the check for the background region to the same place in the
logic as the equivalent v8M MPUCheck() pseudocode puts it.
This in turn means we must adjust the condition we use to detect
matches in multiple regions to avoid false-positives.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 67da43d668320e1bcb0a0195aaf2de4ff2a001a0
      
https://github.com/qemu/qemu/commit/67da43d668320e1bcb0a0195aaf2de4ff2a001a0
  Author: Aaron Lindsay OS <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Stop unintentional sign extension in pmu_init

This was introduced by
    commit bf8d09694ccc07487cd73d7562081fdaec3370c8
    target/arm: Don't clear supported PMU events when initializing PMCEID1
and identified by Coverity (CID 1398645).

Signed-off-by: Aaron Lindsay <address@hidden>
Reported-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 3c3ff68492c2d00bd8cb39ed2d02bdaf5caf5cb8
      
https://github.com/qemu/qemu/commit/3c3ff68492c2d00bd8cb39ed2d02bdaf5caf5cb8
  Author: Richard Henderson <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M target/arm/translate-a64.c

  Log Message:
  -----------
  target/arm: Restructure disas_fp_int_conv

For opcodes 0-5, move some if conditions into the structure
of a switch statement.  For opcodes 6 & 7, decode everything
at once with a second switch.

Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 37356079fcdb34e13abbed8ea0c00ca880c31247
      
https://github.com/qemu/qemu/commit/37356079fcdb34e13abbed8ea0c00ca880c31247
  Author: Richard Henderson <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M target/arm/Makefile.objs
    M target/arm/helper.c
    A target/arm/vfp_helper.c

  Log Message:
  -----------
  target/arm: Split out vfp_helper.c

Move all of the fp helpers out of helper.c into a new file.
This is code movement only.  Since helper.c has no copyright
header, take the one from cpu.h for the new file.

Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: e80941bd64cc388554770fd72334e9e7d459a1ef
      
https://github.com/qemu/qemu/commit/e80941bd64cc388554770fd72334e9e7d459a1ef
  Author: Richard Henderson <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Rearrange Floating-point data-processing (2 regs)

There are lots of special cases within these insns.  Split the
major argument decode/loading/saving into no_output (compares),
rd_is_dp, and rm_is_dp.

We still need to special case argument load for compare (rd as
input, rm as zero) and vcvt fixed (rd as input+output), but lots
of special cases do disappear.

Now that we have a full switch at the beginning, hoist the ISA
checks from the code generation.

Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 6c1f6f2733a7692793135ea5ce72b829add99a50
      
https://github.com/qemu/qemu/commit/6c1f6f2733a7692793135ea5ce72b829add99a50
  Author: Richard Henderson <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M target/arm/cpu.c
    M target/arm/cpu.h
    M target/arm/cpu64.c
    M target/arm/helper.h
    M target/arm/translate-a64.c
    M target/arm/translate.c
    M target/arm/vfp_helper.c

  Log Message:
  -----------
  target/arm: Implement ARMv8.3-JSConv

Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
[PMM: fixed a couple of comment typos]
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 37e571f1e0101f9aab29235afa651028723eb4c5
      
https://github.com/qemu/qemu/commit/37e571f1e0101f9aab29235afa651028723eb4c5
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/misc/tz-ppc.c
    M include/hw/misc/tz-ppc.h

  Log Message:
  -----------
  hw/misc/tz-ppc: Support having unused ports in the middle of the range

The Peripheral Protection Controller's handling of unused ports
is that if there is nothing connected to the port's downstream
then it does not create the sysbus MMIO region for the upstream
end of the port. This results in odd behaviour when there is
an unused port in the middle of the range: since sysbus MMIO
regions are implicitly consecutively allocated, any used ports
above the unused ones end up with sysbus MMIO region numbers
that don't match the port number.

Avoid this numbering mismatch by creating dummy MMIO regions
for the unused ports. This doesn't change anything for our
existing boards, which don't have any gaps in the middle of
the port ranges they use; but it will be needed for the Musca
board.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: b0de99f3e9bc7a0cacbff0ff8517379d915dd5f6
      
https://github.com/qemu/qemu/commit/b0de99f3e9bc7a0cacbff0ff8517379d915dd5f6
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M hw/timer/pl031.c
    A include/hw/timer/pl031.h

  Log Message:
  -----------
  hw/timer/pl031: Allow use as an embedded-struct device

Create a new include file for the pl031's device struct,
type macros, etc, so that it can be instantiated using
the "embedded struct" coding style.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: dd849ef2c9d57a329c6001c58dbdf49de712349c
      
https://github.com/qemu/qemu/commit/dd849ef2c9d57a329c6001c58dbdf49de712349c
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/timer/pl031.c
    M hw/timer/trace-events

  Log Message:
  -----------
  hw/timer/pl031: Convert to using trace events

Convert the debug printing in the PL031 device to use trace events,
and augment it to cover the interesting parts of device operation.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 694cf209990f7b7a6f6f30b21010bab92c985175
      
https://github.com/qemu/qemu/commit/694cf209990f7b7a6f6f30b21010bab92c985175
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/char/pl011.c
    M include/hw/char/pl011.h

  Log Message:
  -----------
  hw/char/pl011: Allow use as an embedded-struct device

Create a new include file for the pl011's device struct,
type macros, etc, so that it can be instantiated using
the "embedded struct" coding style.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: a3c1ca56c0a6ec368a7876f2331b037d066b0b27
      
https://github.com/qemu/qemu/commit/a3c1ca56c0a6ec368a7876f2331b037d066b0b27
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/char/pl011.c
    M include/hw/char/pl011.h

  Log Message:
  -----------
  hw/char/pl011: Support all interrupt lines

The PL011 UART has six interrupt lines:
 * RX (receive data)
 * TX (transmit data)
 * RT (receive timeout)
 * MS (modem status)
 * E (errors)
 * combined (logical OR of all the above)

So far we have only emulated the combined interrupt line;
add support for the others, so that boards that wire them
up to different interrupt controller inputs can do so.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 76b09fafaf54051ccc0620169ae5b72c87f4f547
      
https://github.com/qemu/qemu/commit/76b09fafaf54051ccc0620169ae5b72c87f4f547
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/char/pl011.c

  Log Message:
  -----------
  hw/char/pl011: Use '0x' prefix when logging hex numbers

The pl011 logs when the guest makes a bad access. It prints
the address offset in hex but confusingly omits the '0x'
prefix; add it.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 74ecf7677b72084b25ace9de3191abe3afdaeff6
      
https://github.com/qemu/qemu/commit/74ecf7677b72084b25ace9de3191abe3afdaeff6
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M include/hw/arm/armsse.h

  Log Message:
  -----------
  hw/arm/armsse: Document SRAM_ADDR_WIDTH property in header comment

In commit 4b635cf7a95e501211 we added a QOM property to the ARMSSE
object, but forgot to add it to the documentation comment in the
header. Correct the omission.

Fixes: 4b635cf7a95e501211 ("hw/arm/armsse: Make SRAM bank size configurable")
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 321874196d0fff06eff1df43b20cbadcfe699aad
      
https://github.com/qemu/qemu/commit/321874196d0fff06eff1df43b20cbadcfe699aad
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/armsse.c
    M include/hw/arm/armsse.h

  Log Message:
  -----------
  hw/arm/armsse: Allow boards to specify init-svtor

The Musca boards have DAPLink firmware that sets the initial
secure VTOR value (the location of the vector table) differently
depending on the boot mode (from flash, from RAM, etc). Export
the init-svtor as a QOM property of the ARMSSE object so that
the board can change it.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 8f69a4c15d977d7d66c46143f74fbba68efcc0f8
      
https://github.com/qemu/qemu/commit/8f69a4c15d977d7d66c46143f74fbba68efcc0f8
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M default-configs/arm-softmmu.mak
    M hw/arm/Makefile.objs
    A hw/arm/musca.c

  Log Message:
  -----------
  hw/arm/musca.c: Implement models of the Musca-A and -B1 boards

The Musca-A and Musca-B1 development boards are based on the
SSE-200 subsystem for embedded. Implement an initial skeleton
model of these boards, which are similar but not identical.

This commit creates the board model with the SSE and the IRQ
splitters to wire IRQs up to its two CPUs. As yet there
are no devices and no memory: these will be added later.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: ae3bc714014deecc9e6d21750a1ed72cf551e36f
      
https://github.com/qemu/qemu/commit/ae3bc714014deecc9e6d21750a1ed72cf551e36f
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/musca.c

  Log Message:
  -----------
  hw/arm/musca: Add PPCs

Many of the devices on the Musca board live behind TrustZone
Peripheral Protection Controllers (PPCs); add models of the
PPCs, using a similar scheme to the MPS2 board models.
This commit wires up the PPCs with "unimplemented device"
stubs behind them in the correct places in the address map.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 33293e504926b73c8deb304619ef84fbd7c980bd
      
https://github.com/qemu/qemu/commit/33293e504926b73c8deb304619ef84fbd7c980bd
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/musca.c

  Log Message:
  -----------
  hw/arm/musca: Add MPCs

The Musca board puts its SRAM and flash behind TrustZone
Memory Protection Controllers (MPCs). Each MPC sits between
the CPU and the RAM/flash, and also has a set of memory mapped
control registers. Wire up the MPCs, and the memory behind them.
For the moment we implement the flash as simple ROM, which
cannot be reprogrammed by the guest.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 4db6a761a570941570e287e21e8126995218c654
      
https://github.com/qemu/qemu/commit/4db6a761a570941570e287e21e8126995218c654
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/musca.c

  Log Message:
  -----------
  hw/arm/musca: Wire up PL031 RTC

Wire up the PL031 RTC for the Musca board.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 1486f1bac3eb81b43138aa5a7e1434798fe4bd97
      
https://github.com/qemu/qemu/commit/1486f1bac3eb81b43138aa5a7e1434798fe4bd97
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/musca.c

  Log Message:
  -----------
  hw/arm/musca: Wire up PL011 UARTs

Wire up the two PL011 UARTs in the Musca board.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>


  Commit: 3733f80308d2a7f23f5e39b039e0547aba6c07f1
      
https://github.com/qemu/qemu/commit/3733f80308d2a7f23f5e39b039e0547aba6c07f1
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M hw/arm/armsse.c
    M include/hw/arm/armsse.h

  Log Message:
  -----------
  hw/arm/armsse: Make 0x5... alias region work for per-CPU devices

The region 0x40010000 .. 0x4001ffff and its secure-only alias
at 0x50010000... are for per-CPU devices. We implement this by
giving each CPU its own container memory region, where the
per-CPU devices live. Unfortunately, the alias region which
makes devices mapped at 0x4... addresses also appear at 0x5...
is only implemented in the overall "all CPUs" container. The
effect of this bug is that the CPU_IDENTITY register block appears
only at 0x4001f000, but not at the 0x5001f000 alias where it should
also appear. Guests (like very recent Arm Trusted Firmware-M)
which try to access it at 0x5001f000 will crash.

Fix this by moving the handling for this alias from the "all CPUs"
container to the per-CPU container. (We leave the aliases for
0x1... and 0x3... in the overall container, because there are
no per-CPU devices there.)

Signed-off-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Reviewed-by: Alex Bennée <address@hidden>


  Commit: faf840a359edb53485bc710fbb3adca9498655dd
      
https://github.com/qemu/qemu/commit/faf840a359edb53485bc710fbb3adca9498655dd
  Author: Peter Maydell <address@hidden>
  Date:   2019-02-21 (Thu, 21 Feb 2019)

  Changed paths:
    M MAINTAINERS
    M default-configs/arm-softmmu.mak
    M hw/arm/Makefile.objs
    M hw/arm/armsse.c
    A hw/arm/musca.c
    M hw/char/pl011.c
    M hw/misc/tz-ppc.c
    M hw/timer/pl031.c
    M hw/timer/trace-events
    M include/hw/arm/armsse.h
    M include/hw/char/pl011.h
    M include/hw/misc/tz-ppc.h
    A include/hw/timer/pl031.h
    M target/arm/Makefile.objs
    M target/arm/cpu.c
    M target/arm/cpu.h
    M target/arm/cpu64.c
    M target/arm/helper.c
    M target/arm/helper.h
    M target/arm/translate-a64.c
    M target/arm/translate.c
    A target/arm/vfp_helper.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20190221' 
into staging

target-arm queue:
 * Model the Arm "Musca" development boards: "musca-a" and "musca-b1"
 * Implement the ARMv8.3-JSConv extension
 * v8M MPU should use background region as default, not always
 * Stop unintentional sign extension in pmu_init

# gpg: Signature made Thu 21 Feb 2019 18:56:32 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "address@hidden"
# gpg: Good signature from "Peter Maydell <address@hidden>" [ultimate]
# gpg:                 aka "Peter Maydell <address@hidden>" [ultimate]
# gpg:                 aka "Peter Maydell <address@hidden>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20190221: (21 commits)
  hw/arm/armsse: Make 0x5... alias region work for per-CPU devices
  hw/arm/musca: Wire up PL011 UARTs
  hw/arm/musca: Wire up PL031 RTC
  hw/arm/musca: Add MPCs
  hw/arm/musca: Add PPCs
  hw/arm/musca.c: Implement models of the Musca-A and -B1 boards
  hw/arm/armsse: Allow boards to specify init-svtor
  hw/arm/armsse: Document SRAM_ADDR_WIDTH property in header comment
  hw/char/pl011: Use '0x' prefix when logging hex numbers
  hw/char/pl011: Support all interrupt lines
  hw/char/pl011: Allow use as an embedded-struct device
  hw/timer/pl031: Convert to using trace events
  hw/timer/pl031: Allow use as an embedded-struct device
  hw/misc/tz-ppc: Support having unused ports in the middle of the range
  target/arm: Implement ARMv8.3-JSConv
  target/arm: Rearrange Floating-point data-processing (2 regs)
  target/arm: Split out vfp_helper.c
  target/arm: Restructure disas_fp_int_conv
  target/arm: Stop unintentional sign extension in pmu_init
  target/arm: v8M MPU should use background region as default, not always
  ...

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/fc3dbb90f2eb...faf840a359ed