1 | ARM queue, mostly bug fixes to go into rc0. | 1 | Handful of bugfixes for rc2. None of these are particularly critical |
---|---|---|---|
2 | The integratorcp and fsl_imx* changes are migration | 2 | or exciting. |
3 | compat breakers but that's ok for these boards. | ||
4 | 3 | ||
5 | thanks | ||
6 | -- PMM | 4 | -- PMM |
7 | 5 | ||
6 | The following changes since commit 45a150aa2b3492acf6691c7bdbeb25a8545d8345: | ||
8 | 7 | ||
9 | The following changes since commit ce1d20aac8533357650774c2c240e30de87dc122: | 8 | Merge remote-tracking branch 'remotes/ericb/tags/pull-bitmaps-2020-08-03' into staging (2020-08-03 15:13:49 +0100) |
10 | 9 | ||
11 | Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-07-24' into staging (2017-07-24 16:20:47 +0100) | 10 | are available in the Git repository at: |
12 | 11 | ||
13 | are available in the git repository at: | 12 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200803 |
14 | 13 | ||
15 | git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170724 | 14 | for you to fetch changes up to 13557fd392890cbd985bceba7f717e01efd674b8: |
16 | 15 | ||
17 | for you to fetch changes up to b2d1b0507d1b80f23da12dd8aab56944fe380a09: | 16 | hw/timer/imx_epit: Avoid assertion when CR.SWR is written (2020-08-03 17:56:11 +0100) |
18 | |||
19 | integratorcp: Don't migrate flash using vmstate_register_ram_global() (2017-07-24 17:59:28 +0100) | ||
20 | 17 | ||
21 | ---------------------------------------------------------------- | 18 | ---------------------------------------------------------------- |
22 | target-arm queue: | 19 | target-arm queue: |
23 | * fix a TCG temporary leak in aarch64 rev16 | 20 | * hw/timer/imx_epit: Avoid assertion when CR.SWR is written |
24 | * fsl_imx*: migrate the ROM contents | 21 | * netduino2, netduinoplus2, microbit: set system_clock_scale so that |
25 | * integratorcp: don't use vmstate_register_ram_global for flash | 22 | SysTick running on the CPU clock works |
26 | * mps2: Correctly set parent bus for SCC device | 23 | * target/arm: Avoid maybe-uninitialized warning with gcc 4.9 |
24 | * target/arm: Fix AddPAC error indication | ||
25 | * Make AIRCR.SYSRESETREQ actually reset the system for the | ||
26 | microbit, mps2-*, musca-*, netduino* boards | ||
27 | 27 | ||
28 | ---------------------------------------------------------------- | 28 | ---------------------------------------------------------------- |
29 | Emilio G. Cota (1): | 29 | Kaige Li (1): |
30 | target/arm: fix TCG temp leak in aarch64 rev16 | 30 | target/arm: Avoid maybe-uninitialized warning with gcc 4.9 |
31 | 31 | ||
32 | Peter Maydell (3): | 32 | Peter Maydell (6): |
33 | fsl_imx*: Migrate ROM contents | 33 | hw/arm/netduino2, netduinoplus2: Set system_clock_scale |
34 | mps2: Correctly set parent bus for SCC device | 34 | include/hw/irq.h: New function qemu_irq_is_connected() |
35 | integratorcp: Don't migrate flash using vmstate_register_ram_global() | 35 | hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ |
36 | msf2-soc, stellaris: Don't wire up SYSRESETREQ | ||
37 | hw/arm/nrf51_soc: Set system_clock_scale | ||
38 | hw/timer/imx_epit: Avoid assertion when CR.SWR is written | ||
36 | 39 | ||
37 | hw/arm/fsl-imx25.c | 4 ++-- | 40 | Richard Henderson (1): |
38 | hw/arm/fsl-imx31.c | 4 ++-- | 41 | target/arm: Fix AddPAC error indication |
39 | hw/arm/fsl-imx6.c | 4 ++-- | ||
40 | hw/arm/integratorcp.c | 3 +-- | ||
41 | hw/arm/mps2.c | 2 +- | ||
42 | target/arm/translate-a64.c | 1 + | ||
43 | 6 files changed, 9 insertions(+), 9 deletions(-) | ||
44 | 42 | ||
43 | include/hw/arm/armv7m.h | 4 +++- | ||
44 | include/hw/irq.h | 18 ++++++++++++++++++ | ||
45 | hw/arm/msf2-soc.c | 11 ----------- | ||
46 | hw/arm/netduino2.c | 10 ++++++++++ | ||
47 | hw/arm/netduinoplus2.c | 10 ++++++++++ | ||
48 | hw/arm/nrf51_soc.c | 5 +++++ | ||
49 | hw/arm/stellaris.c | 12 ------------ | ||
50 | hw/intc/armv7m_nvic.c | 17 ++++++++++++++++- | ||
51 | hw/timer/imx_epit.c | 13 ++++++++++--- | ||
52 | target/arm/pauth_helper.c | 6 +++++- | ||
53 | target/arm/translate-a64.c | 2 +- | ||
54 | tests/tcg/aarch64/pauth-5.c | 33 +++++++++++++++++++++++++++++++++ | ||
55 | tests/tcg/aarch64/Makefile.target | 2 +- | ||
56 | 13 files changed, 112 insertions(+), 31 deletions(-) | ||
57 | create mode 100644 tests/tcg/aarch64/pauth-5.c | ||
58 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | The netduino2 and netduinoplus2 boards forgot to set the system_clock_scale | ||
2 | global, which meant that if guest code used the systick timer in "use | ||
3 | the processor clock" mode it would hang because time never advances. | ||
1 | 4 | ||
5 | Set the global to match the documented CPU clock speed of these boards. | ||
6 | Judging by the data sheet this is slightly simplistic because the | ||
7 | SoC allows configuration of the SYSCLK source and frequency via the | ||
8 | RCC (reset and clock control) module, but we don't model that. | ||
9 | |||
10 | Fixes: https://bugs.launchpad.net/qemu/+bug/1876187 | ||
11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
12 | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> | ||
13 | Message-id: 20200727162617.26227-1-peter.maydell@linaro.org | ||
14 | --- | ||
15 | hw/arm/netduino2.c | 10 ++++++++++ | ||
16 | hw/arm/netduinoplus2.c | 10 ++++++++++ | ||
17 | 2 files changed, 20 insertions(+) | ||
18 | |||
19 | diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c | ||
20 | index XXXXXXX..XXXXXXX 100644 | ||
21 | --- a/hw/arm/netduino2.c | ||
22 | +++ b/hw/arm/netduino2.c | ||
23 | @@ -XXX,XX +XXX,XX @@ | ||
24 | #include "hw/arm/stm32f205_soc.h" | ||
25 | #include "hw/arm/boot.h" | ||
26 | |||
27 | +/* Main SYSCLK frequency in Hz (120MHz) */ | ||
28 | +#define SYSCLK_FRQ 120000000ULL | ||
29 | + | ||
30 | static void netduino2_init(MachineState *machine) | ||
31 | { | ||
32 | DeviceState *dev; | ||
33 | |||
34 | + /* | ||
35 | + * TODO: ideally we would model the SoC RCC and let it handle | ||
36 | + * system_clock_scale, including its ability to define different | ||
37 | + * possible SYSCLK sources. | ||
38 | + */ | ||
39 | + system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ; | ||
40 | + | ||
41 | dev = qdev_new(TYPE_STM32F205_SOC); | ||
42 | qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3")); | ||
43 | sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal); | ||
44 | diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c | ||
45 | index XXXXXXX..XXXXXXX 100644 | ||
46 | --- a/hw/arm/netduinoplus2.c | ||
47 | +++ b/hw/arm/netduinoplus2.c | ||
48 | @@ -XXX,XX +XXX,XX @@ | ||
49 | #include "hw/arm/stm32f405_soc.h" | ||
50 | #include "hw/arm/boot.h" | ||
51 | |||
52 | +/* Main SYSCLK frequency in Hz (168MHz) */ | ||
53 | +#define SYSCLK_FRQ 168000000ULL | ||
54 | + | ||
55 | static void netduinoplus2_init(MachineState *machine) | ||
56 | { | ||
57 | DeviceState *dev; | ||
58 | |||
59 | + /* | ||
60 | + * TODO: ideally we would model the SoC RCC and let it handle | ||
61 | + * system_clock_scale, including its ability to define different | ||
62 | + * possible SYSCLK sources. | ||
63 | + */ | ||
64 | + system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ; | ||
65 | + | ||
66 | dev = qdev_new(TYPE_STM32F405_SOC); | ||
67 | qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4")); | ||
68 | sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal); | ||
69 | -- | ||
70 | 2.20.1 | ||
71 | |||
72 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | Mostly devices don't need to care whether one of their output | ||
2 | qemu_irq lines is connected, because functions like qemu_set_irq() | ||
3 | silently do nothing if there is nothing on the other end. However | ||
4 | sometimes a device might want to implement default behaviour for the | ||
5 | case where the machine hasn't wired the line up to anywhere. | ||
1 | 6 | ||
7 | Provide a function qemu_irq_is_connected() that devices can use for | ||
8 | this purpose. (The test is trivial but encapsulating it in a | ||
9 | function makes it easier to see where we're doing it in case we need | ||
10 | to change the implementation later.) | ||
11 | |||
12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
13 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
14 | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> | ||
15 | Message-id: 20200728103744.6909-2-peter.maydell@linaro.org | ||
16 | --- | ||
17 | include/hw/irq.h | 18 ++++++++++++++++++ | ||
18 | 1 file changed, 18 insertions(+) | ||
19 | |||
20 | diff --git a/include/hw/irq.h b/include/hw/irq.h | ||
21 | index XXXXXXX..XXXXXXX 100644 | ||
22 | --- a/include/hw/irq.h | ||
23 | +++ b/include/hw/irq.h | ||
24 | @@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2); | ||
25 | on an existing vector of qemu_irq. */ | ||
26 | void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n); | ||
27 | |||
28 | +/** | ||
29 | + * qemu_irq_is_connected: Return true if IRQ line is wired up | ||
30 | + * | ||
31 | + * If a qemu_irq has a device on the other (receiving) end of it, | ||
32 | + * return true; otherwise return false. | ||
33 | + * | ||
34 | + * Usually device models don't need to care whether the machine model | ||
35 | + * has wired up their outbound qemu_irq lines, because functions like | ||
36 | + * qemu_set_irq() silently do nothing if there is nothing on the other | ||
37 | + * end of the line. However occasionally a device model will want to | ||
38 | + * provide default behaviour if its output is left floating, and | ||
39 | + * it can use this function to identify when that is the case. | ||
40 | + */ | ||
41 | +static inline bool qemu_irq_is_connected(qemu_irq irq) | ||
42 | +{ | ||
43 | + return irq != NULL; | ||
44 | +} | ||
45 | + | ||
46 | #endif | ||
47 | -- | ||
48 | 2.20.1 | ||
49 | |||
50 | diff view generated by jsdifflib |
1 | A cut-and-paste error meant that instead of setting the | 1 | The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals |
---|---|---|---|
2 | qdev parent bus for the SCC device we were setting it | 2 | when the guest sets the SYSRESETREQ bit in the AIRCR register. This |
3 | twice for the ARMv7M container device. Fix this bug. | 3 | matches the hardware design (where the CPU has a signal of this name |
4 | and it is up to the SoC to connect that up to an actual reset | ||
5 | mechanism), but in QEMU it mostly results in duplicated code in SoC | ||
6 | objects and bugs where SoC model implementors forget to wire up the | ||
7 | SYSRESETREQ line. | ||
8 | |||
9 | Provide a default behaviour for the case where SYSRESETREQ is not | ||
10 | actually connected to anything: use qemu_system_reset_request() to | ||
11 | perform a system reset. This will allow us to remove the | ||
12 | implementations of SYSRESETREQ handling from the boards where that's | ||
13 | exactly what it does, and also fixes the bugs in the board models | ||
14 | which forgot to wire up the signal: | ||
15 | |||
16 | * microbit | ||
17 | * mps2-an385 | ||
18 | * mps2-an505 | ||
19 | * mps2-an511 | ||
20 | * mps2-an521 | ||
21 | * musca-a | ||
22 | * musca-b1 | ||
23 | * netduino | ||
24 | * netduinoplus2 | ||
25 | |||
26 | We still allow the board to wire up the signal if it needs to, in case | ||
27 | we need to model more complicated reset controller logic or to model | ||
28 | buggy SoC hardware which forgot to wire up the line itself. But | ||
29 | defaulting to "reset the system" is more often going to be correct | ||
30 | than defaulting to "do nothing". | ||
4 | 31 | ||
5 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 32 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
6 | Message-id: 1500634509-28011-1-git-send-email-peter.maydell@linaro.org | 33 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
34 | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> | ||
35 | Message-id: 20200728103744.6909-3-peter.maydell@linaro.org | ||
7 | --- | 36 | --- |
8 | hw/arm/mps2.c | 2 +- | 37 | include/hw/arm/armv7m.h | 4 +++- |
9 | 1 file changed, 1 insertion(+), 1 deletion(-) | 38 | hw/intc/armv7m_nvic.c | 17 ++++++++++++++++- |
39 | 2 files changed, 19 insertions(+), 2 deletions(-) | ||
10 | 40 | ||
11 | diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c | 41 | diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h |
12 | index XXXXXXX..XXXXXXX 100644 | 42 | index XXXXXXX..XXXXXXX 100644 |
13 | --- a/hw/arm/mps2.c | 43 | --- a/include/hw/arm/armv7m.h |
14 | +++ b/hw/arm/mps2.c | 44 | +++ b/include/hw/arm/armv7m.h |
15 | @@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine) | 45 | @@ -XXX,XX +XXX,XX @@ typedef struct { |
16 | 46 | ||
17 | object_initialize(&mms->scc, sizeof(mms->scc), TYPE_MPS2_SCC); | 47 | /* ARMv7M container object. |
18 | sccdev = DEVICE(&mms->scc); | 48 | * + Unnamed GPIO input lines: external IRQ lines for the NVIC |
19 | - qdev_set_parent_bus(armv7m, sysbus_get_default()); | 49 | - * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ |
20 | + qdev_set_parent_bus(sccdev, sysbus_get_default()); | 50 | + * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ. |
21 | qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2); | 51 | + * If this GPIO is not wired up then the NVIC will default to performing |
22 | qdev_prop_set_uint32(sccdev, "scc-aid", 0x02000008); | 52 | + * a qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET). |
23 | qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id); | 53 | * + Property "cpu-type": CPU type to instantiate |
54 | * + Property "num-irq": number of external IRQ lines | ||
55 | * + Property "memory": MemoryRegion defining the physical address space | ||
56 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c | ||
57 | index XXXXXXX..XXXXXXX 100644 | ||
58 | --- a/hw/intc/armv7m_nvic.c | ||
59 | +++ b/hw/intc/armv7m_nvic.c | ||
60 | @@ -XXX,XX +XXX,XX @@ | ||
61 | #include "hw/intc/armv7m_nvic.h" | ||
62 | #include "hw/irq.h" | ||
63 | #include "hw/qdev-properties.h" | ||
64 | +#include "sysemu/runstate.h" | ||
65 | #include "target/arm/cpu.h" | ||
66 | #include "exec/exec-all.h" | ||
67 | #include "exec/memop.h" | ||
68 | @@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = { | ||
69 | 0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1 | ||
70 | }; | ||
71 | |||
72 | +static void signal_sysresetreq(NVICState *s) | ||
73 | +{ | ||
74 | + if (qemu_irq_is_connected(s->sysresetreq)) { | ||
75 | + qemu_irq_pulse(s->sysresetreq); | ||
76 | + } else { | ||
77 | + /* | ||
78 | + * Default behaviour if the SoC doesn't need to wire up | ||
79 | + * SYSRESETREQ (eg to a system reset controller of some kind): | ||
80 | + * perform a system reset via the usual QEMU API. | ||
81 | + */ | ||
82 | + qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); | ||
83 | + } | ||
84 | +} | ||
85 | + | ||
86 | static int nvic_pending_prio(NVICState *s) | ||
87 | { | ||
88 | /* return the group priority of the current pending interrupt, | ||
89 | @@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value, | ||
90 | if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) { | ||
91 | if (attrs.secure || | ||
92 | !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) { | ||
93 | - qemu_irq_pulse(s->sysresetreq); | ||
94 | + signal_sysresetreq(s); | ||
95 | } | ||
96 | } | ||
97 | if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) { | ||
24 | -- | 98 | -- |
25 | 2.7.4 | 99 | 2.20.1 |
26 | 100 | ||
27 | 101 | diff view generated by jsdifflib |
1 | Instead of migrating the flash by creating the memory region | 1 | The MSF2 SoC model and the Stellaris board code both wire |
---|---|---|---|
2 | with memory_region_init_ram_nomigrate() and then calling | 2 | SYSRESETREQ up to a function that just invokes |
3 | vmstate_register_ram_global(), just use memory_region_init_ram(), | 3 | qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); |
4 | which now handles migration registration automatically. | 4 | This is now the default action that the NVIC does if the line is |
5 | 5 | not connected, so we can delete the handling code. | |
6 | This is a migration compatibility break for the integratorcp | ||
7 | board, because the RAM region's migration name changes to | ||
8 | include the device path. This is OK because we don't guarantee | ||
9 | migration compatibility for this board. | ||
10 | 6 | ||
11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
12 | Message-id: 1500310341-28931-1-git-send-email-peter.maydell@linaro.org | 8 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
9 | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> | ||
10 | Message-id: 20200728103744.6909-4-peter.maydell@linaro.org | ||
13 | --- | 11 | --- |
14 | hw/arm/integratorcp.c | 3 +-- | 12 | hw/arm/msf2-soc.c | 11 ----------- |
15 | 1 file changed, 1 insertion(+), 2 deletions(-) | 13 | hw/arm/stellaris.c | 12 ------------ |
14 | 2 files changed, 23 deletions(-) | ||
16 | 15 | ||
17 | diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c | 16 | diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c |
18 | index XXXXXXX..XXXXXXX 100644 | 17 | index XXXXXXX..XXXXXXX 100644 |
19 | --- a/hw/arm/integratorcp.c | 18 | --- a/hw/arm/msf2-soc.c |
20 | +++ b/hw/arm/integratorcp.c | 19 | +++ b/hw/arm/msf2-soc.c |
21 | @@ -XXX,XX +XXX,XX @@ static void integratorcm_init(Object *obj) | 20 | @@ -XXX,XX +XXX,XX @@ |
22 | s->cm_init = 0x00000112; | 21 | #include "hw/irq.h" |
23 | s->cm_refcnt_offset = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 24, | 22 | #include "hw/arm/msf2-soc.h" |
24 | 1000); | 23 | #include "hw/misc/unimp.h" |
25 | - memory_region_init_ram_nomigrate(&s->flash, obj, "integrator.flash", 0x100000, | 24 | -#include "sysemu/runstate.h" |
26 | + memory_region_init_ram(&s->flash, obj, "integrator.flash", 0x100000, | 25 | #include "sysemu/sysemu.h" |
27 | &error_fatal); | 26 | |
28 | - vmstate_register_ram_global(&s->flash); | 27 | #define MSF2_TIMER_BASE 0x40004000 |
29 | 28 | @@ -XXX,XX +XXX,XX @@ static const int spi_irq[MSF2_NUM_SPIS] = { 2, 3 }; | |
30 | memory_region_init_io(&s->iomem, obj, &integratorcm_ops, s, | 29 | static const int uart_irq[MSF2_NUM_UARTS] = { 10, 11 }; |
31 | "integratorcm", 0x00800000); | 30 | static const int timer_irq[MSF2_NUM_TIMERS] = { 14, 15 }; |
31 | |||
32 | -static void do_sys_reset(void *opaque, int n, int level) | ||
33 | -{ | ||
34 | - if (level) { | ||
35 | - qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); | ||
36 | - } | ||
37 | -} | ||
38 | - | ||
39 | static void m2sxxx_soc_initfn(Object *obj) | ||
40 | { | ||
41 | MSF2State *s = MSF2_SOC(obj); | ||
42 | @@ -XXX,XX +XXX,XX @@ static void m2sxxx_soc_realize(DeviceState *dev_soc, Error **errp) | ||
43 | return; | ||
44 | } | ||
45 | |||
46 | - qdev_connect_gpio_out_named(DEVICE(&s->armv7m.nvic), "SYSRESETREQ", 0, | ||
47 | - qemu_allocate_irq(&do_sys_reset, NULL, 0)); | ||
48 | - | ||
49 | system_clock_scale = NANOSECONDS_PER_SECOND / s->m3clk; | ||
50 | |||
51 | for (i = 0; i < MSF2_NUM_UARTS; i++) { | ||
52 | diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c | ||
53 | index XXXXXXX..XXXXXXX 100644 | ||
54 | --- a/hw/arm/stellaris.c | ||
55 | +++ b/hw/arm/stellaris.c | ||
56 | @@ -XXX,XX +XXX,XX @@ | ||
57 | #include "hw/boards.h" | ||
58 | #include "qemu/log.h" | ||
59 | #include "exec/address-spaces.h" | ||
60 | -#include "sysemu/runstate.h" | ||
61 | #include "sysemu/sysemu.h" | ||
62 | #include "hw/arm/armv7m.h" | ||
63 | #include "hw/char/pl011.h" | ||
64 | @@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj) | ||
65 | qdev_init_gpio_in(dev, stellaris_adc_trigger, 1); | ||
66 | } | ||
67 | |||
68 | -static | ||
69 | -void do_sys_reset(void *opaque, int n, int level) | ||
70 | -{ | ||
71 | - if (level) { | ||
72 | - qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); | ||
73 | - } | ||
74 | -} | ||
75 | - | ||
76 | /* Board init. */ | ||
77 | static stellaris_board_info stellaris_boards[] = { | ||
78 | { "LM3S811EVB", | ||
79 | @@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board) | ||
80 | /* This will exit with an error if the user passed us a bad cpu_type */ | ||
81 | sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal); | ||
82 | |||
83 | - qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0, | ||
84 | - qemu_allocate_irq(&do_sys_reset, NULL, 0)); | ||
85 | - | ||
86 | if (board->dc1 & (1 << 16)) { | ||
87 | dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000, | ||
88 | qdev_get_gpio_in(nvic, 14), | ||
32 | -- | 89 | -- |
33 | 2.7.4 | 90 | 2.20.1 |
34 | 91 | ||
35 | 92 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | From: Richard Henderson <richard.henderson@linaro.org> | ||
1 | 2 | ||
3 | The definition of top_bit used in this function is one higher | ||
4 | than that used in the Arm ARM psuedo-code, which put the error | ||
5 | indication at top_bit - 1 at the wrong place, which meant that | ||
6 | it wasn't visible to Auth. | ||
7 | |||
8 | Fixing the definition of top_bit requires more changes, because | ||
9 | its most common use is for the count of bits in top_bit:bot_bit, | ||
10 | which would then need to be computed as top_bit - bot_bit + 1. | ||
11 | |||
12 | For now, prefer the minimal fix to the error indication alone. | ||
13 | |||
14 | Fixes: 63ff0ca94cb | ||
15 | Reported-by: Derrick McKee <derrick.mckee@gmail.com> | ||
16 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
17 | Message-id: 20200728195706.11087-1-richard.henderson@linaro.org | ||
18 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
19 | [PMM: added comment about the divergence from the pseudocode] | ||
20 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
21 | --- | ||
22 | target/arm/pauth_helper.c | 6 +++++- | ||
23 | tests/tcg/aarch64/pauth-5.c | 33 +++++++++++++++++++++++++++++++ | ||
24 | tests/tcg/aarch64/Makefile.target | 2 +- | ||
25 | 3 files changed, 39 insertions(+), 2 deletions(-) | ||
26 | create mode 100644 tests/tcg/aarch64/pauth-5.c | ||
27 | |||
28 | diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c | ||
29 | index XXXXXXX..XXXXXXX 100644 | ||
30 | --- a/target/arm/pauth_helper.c | ||
31 | +++ b/target/arm/pauth_helper.c | ||
32 | @@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier, | ||
33 | */ | ||
34 | test = sextract64(ptr, bot_bit, top_bit - bot_bit); | ||
35 | if (test != 0 && test != -1) { | ||
36 | - pac ^= MAKE_64BIT_MASK(top_bit - 1, 1); | ||
37 | + /* | ||
38 | + * Note that our top_bit is one greater than the pseudocode's | ||
39 | + * version, hence "- 2" here. | ||
40 | + */ | ||
41 | + pac ^= MAKE_64BIT_MASK(top_bit - 2, 1); | ||
42 | } | ||
43 | |||
44 | /* | ||
45 | diff --git a/tests/tcg/aarch64/pauth-5.c b/tests/tcg/aarch64/pauth-5.c | ||
46 | new file mode 100644 | ||
47 | index XXXXXXX..XXXXXXX | ||
48 | --- /dev/null | ||
49 | +++ b/tests/tcg/aarch64/pauth-5.c | ||
50 | @@ -XXX,XX +XXX,XX @@ | ||
51 | +#include <assert.h> | ||
52 | + | ||
53 | +static int x; | ||
54 | + | ||
55 | +int main() | ||
56 | +{ | ||
57 | + int *p0 = &x, *p1, *p2, *p3; | ||
58 | + unsigned long salt = 0; | ||
59 | + | ||
60 | + /* | ||
61 | + * With TBI enabled and a 48-bit VA, there are 7 bits of auth, and so | ||
62 | + * a 1/128 chance of auth = pac(ptr,key,salt) producing zero. | ||
63 | + * Find a salt that creates auth != 0. | ||
64 | + */ | ||
65 | + do { | ||
66 | + salt++; | ||
67 | + asm("pacda %0, %1" : "=r"(p1) : "r"(salt), "0"(p0)); | ||
68 | + } while (p0 == p1); | ||
69 | + | ||
70 | + /* | ||
71 | + * This pac must fail, because the input pointer bears an encryption, | ||
72 | + * and so is not properly extended within bits [55:47]. This will | ||
73 | + * toggle bit 54 in the output... | ||
74 | + */ | ||
75 | + asm("pacda %0, %1" : "=r"(p2) : "r"(salt), "0"(p1)); | ||
76 | + | ||
77 | + /* ... so that the aut must fail, setting bit 53 in the output ... */ | ||
78 | + asm("autda %0, %1" : "=r"(p3) : "r"(salt), "0"(p2)); | ||
79 | + | ||
80 | + /* ... which means this equality must not hold. */ | ||
81 | + assert(p3 != p0); | ||
82 | + return 0; | ||
83 | +} | ||
84 | diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target | ||
85 | index XXXXXXX..XXXXXXX 100644 | ||
86 | --- a/tests/tcg/aarch64/Makefile.target | ||
87 | +++ b/tests/tcg/aarch64/Makefile.target | ||
88 | @@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt | ||
89 | |||
90 | # Pauth Tests | ||
91 | ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_3),) | ||
92 | -AARCH64_TESTS += pauth-1 pauth-2 pauth-4 | ||
93 | +AARCH64_TESTS += pauth-1 pauth-2 pauth-4 pauth-5 | ||
94 | pauth-%: CFLAGS += -march=armv8.3-a | ||
95 | run-pauth-%: QEMU_OPTS += -cpu max | ||
96 | run-plugin-pauth-%: QEMU_OPTS += -cpu max | ||
97 | -- | ||
98 | 2.20.1 | ||
99 | |||
100 | diff view generated by jsdifflib |
1 | From: "Emilio G. Cota" <cota@braap.org> | 1 | From: Kaige Li <likaige@loongson.cn> |
---|---|---|---|
2 | 2 | ||
3 | Fix a TCG temporary leak in the new aarch64 rev16 handling. | 3 | GCC version 4.9.4 isn't clever enough to figure out that all |
4 | execution paths in disas_ldst() that use 'fn' will have initialized | ||
5 | it first, and so it warns: | ||
4 | 6 | ||
5 | Signed-off-by: Emilio G. Cota <cota@braap.org> | 7 | /home/LiKaige/qemu/target/arm/translate-a64.c: In function ‘disas_ldst’: |
8 | /home/LiKaige/qemu/target/arm/translate-a64.c:3392:5: error: ‘fn’ may be used uninitialized in this function [-Werror=maybe-uninitialized] | ||
9 | fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s), | ||
10 | ^ | ||
11 | /home/LiKaige/qemu/target/arm/translate-a64.c:3318:22: note: ‘fn’ was declared here | ||
12 | AtomicThreeOpFn *fn; | ||
13 | ^ | ||
14 | |||
15 | Make it happy by initializing the variable to NULL. | ||
16 | |||
17 | Signed-off-by: Kaige Li <likaige@loongson.cn> | ||
18 | Message-id: 1596110248-7366-2-git-send-email-likaige@loongson.cn | ||
6 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 19 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
20 | [PMM: Clean up commit message and note which gcc version this was] | ||
7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 21 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
8 | --- | 22 | --- |
9 | target/arm/translate-a64.c | 1 + | 23 | target/arm/translate-a64.c | 2 +- |
10 | 1 file changed, 1 insertion(+) | 24 | 1 file changed, 1 insertion(+), 1 deletion(-) |
11 | 25 | ||
12 | diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c | 26 | diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c |
13 | index XXXXXXX..XXXXXXX 100644 | 27 | index XXXXXXX..XXXXXXX 100644 |
14 | --- a/target/arm/translate-a64.c | 28 | --- a/target/arm/translate-a64.c |
15 | +++ b/target/arm/translate-a64.c | 29 | +++ b/target/arm/translate-a64.c |
16 | @@ -XXX,XX +XXX,XX @@ static void handle_rev16(DisasContext *s, unsigned int sf, | 30 | @@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn, |
17 | tcg_gen_shli_i64(tcg_rd, tcg_rd, 8); | 31 | bool r = extract32(insn, 22, 1); |
18 | tcg_gen_or_i64(tcg_rd, tcg_rd, tcg_tmp); | 32 | bool a = extract32(insn, 23, 1); |
19 | 33 | TCGv_i64 tcg_rs, clean_addr; | |
20 | + tcg_temp_free_i64(mask); | 34 | - AtomicThreeOpFn *fn; |
21 | tcg_temp_free_i64(tcg_tmp); | 35 | + AtomicThreeOpFn *fn = NULL; |
22 | } | 36 | |
23 | 37 | if (is_vector || !dc_isar_feature(aa64_atomics, s)) { | |
38 | unallocated_encoding(s); | ||
24 | -- | 39 | -- |
25 | 2.7.4 | 40 | 2.20.1 |
26 | 41 | ||
27 | 42 | diff view generated by jsdifflib |
1 | The fsl-imx* boards accidentally forgot to register the ROM memory | 1 | The nrf51 SoC model wasn't setting the system_clock_scale |
---|---|---|---|
2 | regions for migration. This used to require a manual step of calling | 2 | global.which meant that if guest code used the systick timer in "use |
3 | vmstate_register_ram(), but following commits | 3 | the processor clock" mode it would hang because time never advances. |
4 | 1cfe48c1ce21..b08199c6fbea194 we can use memory_region_init_rom() to | ||
5 | have it do the migration for us. | ||
6 | 4 | ||
7 | This is a migration break, but the migration code currently does not | 5 | Set the global to match the documented CPU clock speed for this SoC. |
8 | handle the case of having two RAM regions which were not registered | ||
9 | for migration, and so prior to this commit a migration load would | ||
10 | always fail with: | ||
11 | "qemu-system-arm: Length mismatch: 0x4000 in != 0x18000: Invalid argument" | ||
12 | 6 | ||
13 | NB: migration appears at this point to be broken for this board | 7 | This SoC in fact doesn't have a SysTick timer (which is the only thing |
14 | anyway -- it succeeds but the destination hangs; probably some | 8 | currently that cares about the system_clock_scale), because it's |
15 | device in the system does not yet support migration. | 9 | a configurable option in the Cortex-M0. However our Cortex-M0 and |
10 | thus our nrf51 and our micro:bit board do provide a SysTick, so | ||
11 | we ought to provide a functional one rather than a broken one. | ||
16 | 12 | ||
17 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
18 | Message-id: 1500309775-18361-1-git-send-email-peter.maydell@linaro.org | 14 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
15 | Message-id: 20200727193458.31250-1-peter.maydell@linaro.org | ||
19 | --- | 16 | --- |
20 | hw/arm/fsl-imx25.c | 4 ++-- | 17 | hw/arm/nrf51_soc.c | 5 +++++ |
21 | hw/arm/fsl-imx31.c | 4 ++-- | 18 | 1 file changed, 5 insertions(+) |
22 | hw/arm/fsl-imx6.c | 4 ++-- | ||
23 | 3 files changed, 6 insertions(+), 6 deletions(-) | ||
24 | 19 | ||
25 | diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c | 20 | diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c |
26 | index XXXXXXX..XXXXXXX 100644 | 21 | index XXXXXXX..XXXXXXX 100644 |
27 | --- a/hw/arm/fsl-imx25.c | 22 | --- a/hw/arm/nrf51_soc.c |
28 | +++ b/hw/arm/fsl-imx25.c | 23 | +++ b/hw/arm/nrf51_soc.c |
29 | @@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp) | 24 | @@ -XXX,XX +XXX,XX @@ |
25 | |||
26 | #define BASE_TO_IRQ(base) ((base >> 12) & 0x1F) | ||
27 | |||
28 | +/* HCLK (the main CPU clock) on this SoC is always 16MHz */ | ||
29 | +#define HCLK_FRQ 16000000 | ||
30 | + | ||
31 | static uint64_t clock_read(void *opaque, hwaddr addr, unsigned int size) | ||
32 | { | ||
33 | qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n", | ||
34 | @@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp) | ||
35 | return; | ||
30 | } | 36 | } |
31 | 37 | ||
32 | /* initialize 2 x 16 KB ROM */ | 38 | + system_clock_scale = NANOSECONDS_PER_SECOND / HCLK_FRQ; |
33 | - memory_region_init_rom_nomigrate(&s->rom[0], NULL, | 39 | + |
34 | + memory_region_init_rom(&s->rom[0], NULL, | 40 | object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container), |
35 | "imx25.rom0", FSL_IMX25_ROM0_SIZE, &err); | 41 | &error_abort); |
36 | if (err) { | 42 | if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) { |
37 | error_propagate(errp, err); | ||
38 | @@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp) | ||
39 | } | ||
40 | memory_region_add_subregion(get_system_memory(), FSL_IMX25_ROM0_ADDR, | ||
41 | &s->rom[0]); | ||
42 | - memory_region_init_rom_nomigrate(&s->rom[1], NULL, | ||
43 | + memory_region_init_rom(&s->rom[1], NULL, | ||
44 | "imx25.rom1", FSL_IMX25_ROM1_SIZE, &err); | ||
45 | if (err) { | ||
46 | error_propagate(errp, err); | ||
47 | diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c | ||
48 | index XXXXXXX..XXXXXXX 100644 | ||
49 | --- a/hw/arm/fsl-imx31.c | ||
50 | +++ b/hw/arm/fsl-imx31.c | ||
51 | @@ -XXX,XX +XXX,XX @@ static void fsl_imx31_realize(DeviceState *dev, Error **errp) | ||
52 | } | ||
53 | |||
54 | /* On a real system, the first 16k is a `secure boot rom' */ | ||
55 | - memory_region_init_rom_nomigrate(&s->secure_rom, NULL, "imx31.secure_rom", | ||
56 | + memory_region_init_rom(&s->secure_rom, NULL, "imx31.secure_rom", | ||
57 | FSL_IMX31_SECURE_ROM_SIZE, &err); | ||
58 | if (err) { | ||
59 | error_propagate(errp, err); | ||
60 | @@ -XXX,XX +XXX,XX @@ static void fsl_imx31_realize(DeviceState *dev, Error **errp) | ||
61 | &s->secure_rom); | ||
62 | |||
63 | /* There is also a 16k ROM */ | ||
64 | - memory_region_init_rom_nomigrate(&s->rom, NULL, "imx31.rom", | ||
65 | + memory_region_init_rom(&s->rom, NULL, "imx31.rom", | ||
66 | FSL_IMX31_ROM_SIZE, &err); | ||
67 | if (err) { | ||
68 | error_propagate(errp, err); | ||
69 | diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c | ||
70 | index XXXXXXX..XXXXXXX 100644 | ||
71 | --- a/hw/arm/fsl-imx6.c | ||
72 | +++ b/hw/arm/fsl-imx6.c | ||
73 | @@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp) | ||
74 | FSL_IMX6_ENET_MAC_1588_IRQ)); | ||
75 | |||
76 | /* ROM memory */ | ||
77 | - memory_region_init_rom_nomigrate(&s->rom, NULL, "imx6.rom", | ||
78 | + memory_region_init_rom(&s->rom, NULL, "imx6.rom", | ||
79 | FSL_IMX6_ROM_SIZE, &err); | ||
80 | if (err) { | ||
81 | error_propagate(errp, err); | ||
82 | @@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp) | ||
83 | &s->rom); | ||
84 | |||
85 | /* CAAM memory */ | ||
86 | - memory_region_init_rom_nomigrate(&s->caam, NULL, "imx6.caam", | ||
87 | + memory_region_init_rom(&s->caam, NULL, "imx6.caam", | ||
88 | FSL_IMX6_CAAM_MEM_SIZE, &err); | ||
89 | if (err) { | ||
90 | error_propagate(errp, err); | ||
91 | -- | 43 | -- |
92 | 2.7.4 | 44 | 2.20.1 |
93 | 45 | ||
94 | 46 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | The imx_epit device has a software-controllable reset triggered by | ||
2 | setting the SWR bit in the CR register. An error in commit cc2722ec83ad9 | ||
3 | means that we will end up assert()ing if the guest does this, because | ||
4 | the code in imx_epit_write() starts ptimer transactions, and then | ||
5 | imx_epit_reset() also starts ptimer transactions, triggering | ||
6 | "ptimer_transaction_begin: Assertion `!s->in_transaction' failed". | ||
1 | 7 | ||
8 | The cleanest way to avoid this double-transaction is to move the | ||
9 | start-transaction for the CR write handling down below the check of | ||
10 | the SWR bit. | ||
11 | |||
12 | Fixes: https://bugs.launchpad.net/qemu/+bug/1880424 | ||
13 | Fixes: cc2722ec83ad944505fe | ||
14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
15 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
16 | Message-id: 20200727154550.3409-1-peter.maydell@linaro.org | ||
17 | --- | ||
18 | hw/timer/imx_epit.c | 13 ++++++++++--- | ||
19 | 1 file changed, 10 insertions(+), 3 deletions(-) | ||
20 | |||
21 | diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c | ||
22 | index XXXXXXX..XXXXXXX 100644 | ||
23 | --- a/hw/timer/imx_epit.c | ||
24 | +++ b/hw/timer/imx_epit.c | ||
25 | @@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value, | ||
26 | |||
27 | switch (offset >> 2) { | ||
28 | case 0: /* CR */ | ||
29 | - ptimer_transaction_begin(s->timer_cmp); | ||
30 | - ptimer_transaction_begin(s->timer_reload); | ||
31 | |||
32 | oldcr = s->cr; | ||
33 | s->cr = value & 0x03ffffff; | ||
34 | if (s->cr & CR_SWR) { | ||
35 | /* handle the reset */ | ||
36 | imx_epit_reset(DEVICE(s)); | ||
37 | - } else { | ||
38 | + /* | ||
39 | + * TODO: could we 'break' here? following operations appear | ||
40 | + * to duplicate the work imx_epit_reset() already did. | ||
41 | + */ | ||
42 | + } | ||
43 | + | ||
44 | + ptimer_transaction_begin(s->timer_cmp); | ||
45 | + ptimer_transaction_begin(s->timer_reload); | ||
46 | + | ||
47 | + if (!(s->cr & CR_SWR)) { | ||
48 | imx_epit_set_freq(s); | ||
49 | } | ||
50 | |||
51 | -- | ||
52 | 2.20.1 | ||
53 | |||
54 | diff view generated by jsdifflib |