1
ARM queue: nothing particularly exciting, but 18 patches
1
Nothing too exciting, but does include the last bits of v8.1M support work.
2
is enough to send out.
3
2
4
thanks
5
-- PMM
3
-- PMM
6
4
7
The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:
5
The following changes since commit e79de63ab1bd1f6550e7b915e433bec1ad1a870a:
8
6
9
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)
7
Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210107' into staging (2021-01-07 20:34:05 +0000)
10
8
11
are available in the git repository at:
9
are available in the Git repository at:
12
10
13
git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210108
14
12
15
for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:
13
for you to fetch changes up to c9f8511ea8d2b80723af0fea1f716d752c1b5208:
16
14
17
mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)
15
docs/system: arm: Add sabrelite board description (2021-01-08 15:13:39 +0000)
18
16
19
----------------------------------------------------------------
17
----------------------------------------------------------------
20
target-arm queue:
18
target-arm queue:
21
* v7M: various code cleanups
19
* intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs
22
* v7M: set correct BFSR bits on bus fault
20
* target/arm: Fix MTE0_ACTIVE
23
* v7M: clear exclusive monitor on reset and exception entry/exit
21
* target/arm: Implement v8.1M and Cortex-M55 model
24
* v7M: don't apply priority mask to negative priorities
22
* hw/arm/highbank: Drop dead KVM support code
25
* zcu102: support 'secure' and 'virtualization' machine properties
23
* util/qemu-timer: Make timer_free() imply timer_del()
26
* aarch64: fix ERET single stepping
24
* various devices: Use ptimer_free() in finalize function
27
* gpex: implement PCI INTx routing
25
* docs/system: arm: Add sabrelite board description
28
* mps2-an511: fix UART overflow interrupt line wiring
26
* sabrelite: Minor fixes to allow booting U-Boot
29
27
30
----------------------------------------------------------------
28
----------------------------------------------------------------
31
Alistair Francis (5):
29
Andrew Jones (1):
32
xlnx-ep108: Rename to ZCU102
30
hw/arm/virt: Remove virt machine state 'smp_cpus'
33
xlnx-zcu102: Manually create the machines
34
xlnx-zcu102: Add a machine level secure property
35
xlnx-zcu102: Add a machine level virtualization property
36
xlnx-zcu102: Mark the EP108 machine as deprecated
37
31
38
Jaroslaw Pelczar (1):
32
Bin Meng (4):
39
AArch64: Fix single stepping of ERET instruction
33
hw/misc: imx6_ccm: Update PMU_MISC0 reset value
34
hw/msic: imx6_ccm: Correct register value for silicon type
35
hw/arm: sabrelite: Connect the Ethernet PHY at address 6
36
docs/system: arm: Add sabrelite board description
40
37
41
Peter Maydell (8):
38
Edgar E. Iglesias (1):
42
target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
39
intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs
43
target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
44
target/arm: Get PRECISERR and IBUSERR the right way round
45
nvic: Don't apply group priority mask to negative priorities
46
target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
47
target/arm: Add and use defines for EXCRET constants
48
target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
49
mps2-an511: Fix wiring of UART overflow interrupt lines
50
40
51
Pranavkumar Sawargaonkar (3):
41
Gan Qixin (7):
52
hw/pci-host/gpex: Set INTx index/gsi mapping
42
digic-timer: Use ptimer_free() in the finalize function to avoid memleaks
53
hw/arm/virt: Set INTx/gsi mapping
43
allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks
54
hw/pci-host/gpex: Implement PCI INTx routing
44
exynos4210_rtc: Use ptimer_free() in the finalize function to avoid memleaks
45
exynos4210_pwm: Use ptimer_free() in the finalize function to avoid memleaks
46
mss-timer: Use ptimer_free() in the finalize function to avoid memleaks
47
musicpal: Use ptimer_free() in the finalize function to avoid memleaks
48
exynos4210_mct: Use ptimer_free() in the finalize function to avoid memleaks
49
50
Peter Maydell (9):
51
hw/intc/armv7m_nvic: Correct handling of CCR.BFHFNMIGN
52
target/arm: Correct store of FPSCR value via FPCXT_S
53
target/arm: Implement FPCXT_NS fp system register
54
target/arm: Implement Cortex-M55 model
55
hw/arm/highbank: Drop dead KVM support code
56
util/qemu-timer: Make timer_free() imply timer_del()
57
scripts/coccinelle: New script to remove unnecessary timer_del() calls
58
Remove superfluous timer_del() calls
59
target/arm: Remove timer_del()/timer_deinit() before timer_free()
55
60
56
Richard Henderson (1):
61
Richard Henderson (1):
57
target/arm: Avoid an extra temporary for store_exclusive
62
target/arm: Fix MTE0_ACTIVE
58
63
59
hw/arm/Makefile.objs | 2 +-
64
docs/system/arm/sabrelite.rst | 119 ++++++++++++++++++++++++++
60
include/hw/arm/xlnx-zynqmp.h | 2 +
65
docs/system/target-arm.rst | 1 +
61
include/hw/pci-host/gpex.h | 3 +
66
scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++
62
target/arm/cpu.h | 35 +++---
67
include/hw/arm/virt.h | 3 +-
63
target/arm/internals.h | 20 ++++
68
include/qemu/timer.h | 24 +++---
64
hw/arm/mps2.c | 4 +-
69
block/iscsi.c | 2 -
65
hw/arm/virt.c | 1 +
70
block/nbd.c | 1 -
66
hw/arm/xlnx-ep108.c | 139 -----------------------
71
block/qcow2.c | 1 -
67
hw/arm/xlnx-zcu102.c | 259 +++++++++++++++++++++++++++++++++++++++++++
72
hw/arm/highbank.c | 14 +--
68
hw/arm/xlnx-zynqmp.c | 3 +-
73
hw/arm/musicpal.c | 12 +++
69
hw/intc/armv7m_nvic.c | 11 +-
74
hw/arm/sabrelite.c | 4 +
70
hw/pci-host/gpex.c | 22 ++++
75
hw/arm/virt-acpi-build.c | 9 +-
71
target/arm/cpu.c | 6 +
76
hw/arm/virt.c | 21 +++--
72
target/arm/helper.c | 43 ++++---
77
hw/block/nvme.c | 2 -
73
target/arm/op_helper.c | 2 +-
78
hw/char/serial.c | 2 -
74
target/arm/translate-a64.c | 27 ++---
79
hw/char/virtio-serial-bus.c | 2 -
75
16 files changed, 382 insertions(+), 197 deletions(-)
80
hw/ide/core.c | 1 -
76
delete mode 100644 hw/arm/xlnx-ep108.c
81
hw/input/hid.c | 1 -
77
create mode 100644 hw/arm/xlnx-zcu102.c
82
hw/intc/apic.c | 1 -
83
hw/intc/arm_gic.c | 4 +-
84
hw/intc/armv7m_nvic.c | 15 ++++
85
hw/intc/ioapic.c | 1 -
86
hw/ipmi/ipmi_bmc_extern.c | 1 -
87
hw/misc/imx6_ccm.c | 4 +-
88
hw/net/e1000.c | 3 -
89
hw/net/e1000e_core.c | 8 --
90
hw/net/pcnet-pci.c | 1 -
91
hw/net/rtl8139.c | 1 -
92
hw/net/spapr_llan.c | 1 -
93
hw/net/virtio-net.c | 2 -
94
hw/rtc/exynos4210_rtc.c | 9 ++
95
hw/s390x/s390-pci-inst.c | 1 -
96
hw/sd/sd.c | 1 -
97
hw/sd/sdhci.c | 2 -
98
hw/timer/allwinner-a10-pit.c | 11 +++
99
hw/timer/digic-timer.c | 8 ++
100
hw/timer/exynos4210_mct.c | 14 +++
101
hw/timer/exynos4210_pwm.c | 11 +++
102
hw/timer/mss-timer.c | 13 +++
103
hw/usb/dev-hub.c | 1 -
104
hw/usb/hcd-ehci.c | 1 -
105
hw/usb/hcd-ohci-pci.c | 1 -
106
hw/usb/hcd-uhci.c | 1 -
107
hw/usb/hcd-xhci.c | 1 -
108
hw/usb/redirect.c | 1 -
109
hw/vfio/display.c | 1 -
110
hw/virtio/vhost-vsock-common.c | 1 -
111
hw/virtio/virtio-balloon.c | 1 -
112
hw/virtio/virtio-rng.c | 1 -
113
hw/watchdog/wdt_diag288.c | 1 -
114
hw/watchdog/wdt_i6300esb.c | 1 -
115
migration/colo.c | 1 -
116
monitor/hmp-cmds.c | 1 -
117
net/announce.c | 1 -
118
net/colo-compare.c | 1 -
119
net/slirp.c | 1 -
120
replay/replay-debugging.c | 1 -
121
target/arm/cpu.c | 2 -
122
target/arm/cpu_tcg.c | 42 +++++++++
123
target/arm/helper.c | 2 +-
124
target/s390x/cpu.c | 2 -
125
ui/console.c | 1 -
126
ui/spice-core.c | 1 -
127
util/throttle.c | 1 -
128
target/arm/translate-vfp.c.inc | 114 ++++++++++++++++++++++--
129
65 files changed, 421 insertions(+), 111 deletions(-)
130
create mode 100644 docs/system/arm/sabrelite.rst
131
create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci
78
132
diff view generated by jsdifflib
New patch
1
From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
1
2
3
Correct the indexing into s->cpu_ctlr for vCPUs.
4
5
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
6
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
7
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
8
Message-id: 20201214222154.3480243-2-edgar.iglesias@gmail.com
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
hw/intc/arm_gic.c | 4 +++-
12
1 file changed, 3 insertions(+), 1 deletion(-)
13
14
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/intc/arm_gic.c
17
+++ b/hw/intc/arm_gic.c
18
@@ -XXX,XX +XXX,XX @@ static inline void gic_get_best_virq(GICState *s, int cpu,
19
static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,
20
int group_mask)
21
{
22
+ int cpu_iface = virt ? (cpu + GIC_NCPU) : cpu;
23
+
24
if (!virt && !(s->ctlr & group_mask)) {
25
return false;
26
}
27
@@ -XXX,XX +XXX,XX @@ static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,
28
return false;
29
}
30
31
- if (!(s->cpu_ctlr[cpu] & group_mask)) {
32
+ if (!(s->cpu_ctlr[cpu_iface] & group_mask)) {
33
return false;
34
}
35
36
--
37
2.20.1
38
39
diff view generated by jsdifflib
1
From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
1
From: Andrew Jones <drjones@redhat.com>
2
2
3
Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
3
virt machine's 'smp_cpus' and machine->smp.cpus must always have the
4
needed for INTx/gsi routing.
4
same value. And, anywhere we have virt machine state we have machine
5
state. So let's remove the redundancy. Also, to make it easier to see
6
that machine->smp is the true source for "smp_cpus" and "max_cpus",
7
avoid passing them in function parameters, preferring instead to get
8
them from the state.
5
9
6
Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
10
No functional change intended.
7
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
11
8
Signed-off-by: Eric Auger <eric.auger@redhat.com>
12
Signed-off-by: Andrew Jones <drjones@redhat.com>
9
Reviewed-by: Andrew Jones <drjones@redhat.com>
13
Reviewed-by: David Edmondson <david.edmondson@oracle.com>
10
Tested-by: Feng Kan <fkan@apm.com>
14
Reviewed-by: Ying Fang <fangying1@huawei.com>
11
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
15
Message-id: 20201215174815.51520-1-drjones@redhat.com
16
[PMM: minor formatting tweak to smp_cpus variable declaration]
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
18
---
14
hw/arm/virt.c | 1 +
19
include/hw/arm/virt.h | 3 +--
15
1 file changed, 1 insertion(+)
20
hw/arm/virt-acpi-build.c | 9 +++++----
21
hw/arm/virt.c | 21 ++++++++++-----------
22
3 files changed, 16 insertions(+), 17 deletions(-)
16
23
24
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
25
index XXXXXXX..XXXXXXX 100644
26
--- a/include/hw/arm/virt.h
27
+++ b/include/hw/arm/virt.h
28
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
29
MemMapEntry *memmap;
30
char *pciehb_nodename;
31
const int *irqmap;
32
- int smp_cpus;
33
void *fdt;
34
int fdt_size;
35
uint32_t clock_phandle;
36
@@ -XXX,XX +XXX,XX @@ static inline int virt_gicv3_redist_region_count(VirtMachineState *vms)
37
38
assert(vms->gic_version == VIRT_GIC_VERSION_3);
39
40
- return vms->smp_cpus > redist0_capacity ? 2 : 1;
41
+ return MACHINE(vms)->smp.cpus > redist0_capacity ? 2 : 1;
42
}
43
44
#endif /* QEMU_ARM_VIRT_H */
45
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
46
index XXXXXXX..XXXXXXX 100644
47
--- a/hw/arm/virt-acpi-build.c
48
+++ b/hw/arm/virt-acpi-build.c
49
@@ -XXX,XX +XXX,XX @@
50
51
#define ACPI_BUILD_TABLE_SIZE 0x20000
52
53
-static void acpi_dsdt_add_cpus(Aml *scope, int smp_cpus)
54
+static void acpi_dsdt_add_cpus(Aml *scope, VirtMachineState *vms)
55
{
56
+ MachineState *ms = MACHINE(vms);
57
uint16_t i;
58
59
- for (i = 0; i < smp_cpus; i++) {
60
+ for (i = 0; i < ms->smp.cpus; i++) {
61
Aml *dev = aml_device("C%.03X", i);
62
aml_append(dev, aml_name_decl("_HID", aml_string("ACPI0007")));
63
aml_append(dev, aml_name_decl("_UID", aml_int(i)));
64
@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
65
gicd->base_address = cpu_to_le64(memmap[VIRT_GIC_DIST].base);
66
gicd->version = vms->gic_version;
67
68
- for (i = 0; i < vms->smp_cpus; i++) {
69
+ for (i = 0; i < MACHINE(vms)->smp.cpus; i++) {
70
AcpiMadtGenericCpuInterface *gicc = acpi_data_push(table_data,
71
sizeof(*gicc));
72
ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
73
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
74
* the RTC ACPI device at all when using UEFI.
75
*/
76
scope = aml_scope("\\_SB");
77
- acpi_dsdt_add_cpus(scope, vms->smp_cpus);
78
+ acpi_dsdt_add_cpus(scope, vms);
79
acpi_dsdt_add_uart(scope, &memmap[VIRT_UART],
80
(irqmap[VIRT_UART] + ARM_SPI_BASE));
81
if (vmc->acpi_expose_flash) {
17
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
82
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
18
index XXXXXXX..XXXXXXX 100644
83
index XXXXXXX..XXXXXXX 100644
19
--- a/hw/arm/virt.c
84
--- a/hw/arm/virt.c
20
+++ b/hw/arm/virt.c
85
+++ b/hw/arm/virt.c
21
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
86
@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
22
87
if (vms->gic_version == VIRT_GIC_VERSION_2) {
23
for (i = 0; i < GPEX_NUM_IRQS; i++) {
88
irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
24
sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
89
GIC_FDT_IRQ_PPI_CPU_WIDTH,
25
+ gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
90
- (1 << vms->smp_cpus) - 1);
91
+ (1 << MACHINE(vms)->smp.cpus) - 1);
26
}
92
}
27
93
28
pci = PCI_HOST_BRIDGE(dev);
94
qemu_fdt_add_subnode(vms->fdt, "/timer");
95
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
96
int cpu;
97
int addr_cells = 1;
98
const MachineState *ms = MACHINE(vms);
99
+ int smp_cpus = ms->smp.cpus;
100
101
/*
102
* From Documentation/devicetree/bindings/arm/cpus.txt
103
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
104
* The simplest way to go is to examine affinity IDs of all our CPUs. If
105
* at least one of them has Aff3 populated, we set #address-cells to 2.
106
*/
107
- for (cpu = 0; cpu < vms->smp_cpus; cpu++) {
108
+ for (cpu = 0; cpu < smp_cpus; cpu++) {
109
ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
110
111
if (armcpu->mp_affinity & ARM_AFF3_MASK) {
112
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
113
qemu_fdt_setprop_cell(vms->fdt, "/cpus", "#address-cells", addr_cells);
114
qemu_fdt_setprop_cell(vms->fdt, "/cpus", "#size-cells", 0x0);
115
116
- for (cpu = vms->smp_cpus - 1; cpu >= 0; cpu--) {
117
+ for (cpu = smp_cpus - 1; cpu >= 0; cpu--) {
118
char *nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
119
ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
120
CPUState *cs = CPU(armcpu);
121
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
122
qemu_fdt_setprop_string(vms->fdt, nodename, "compatible",
123
armcpu->dtb_compatible);
124
125
- if (vms->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED
126
- && vms->smp_cpus > 1) {
127
+ if (vms->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED && smp_cpus > 1) {
128
qemu_fdt_setprop_string(vms->fdt, nodename,
129
"enable-method", "psci");
130
}
131
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
132
if (vms->gic_version == VIRT_GIC_VERSION_2) {
133
irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
134
GIC_FDT_IRQ_PPI_CPU_WIDTH,
135
- (1 << vms->smp_cpus) - 1);
136
+ (1 << MACHINE(vms)->smp.cpus) - 1);
137
}
138
139
qemu_fdt_add_subnode(vms->fdt, "/pmu");
140
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
141
* virt_cpu_post_init() must be called after the CPUs have
142
* been realized and the GIC has been created.
143
*/
144
-static void virt_cpu_post_init(VirtMachineState *vms, int max_cpus,
145
- MemoryRegion *sysmem)
146
+static void virt_cpu_post_init(VirtMachineState *vms, MemoryRegion *sysmem)
147
{
148
+ int max_cpus = MACHINE(vms)->smp.max_cpus;
149
bool aarch64, pmu, steal_time;
150
CPUState *cpu;
151
152
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
153
exit(1);
154
}
155
156
- vms->smp_cpus = smp_cpus;
157
-
158
if (vms->virt && kvm_enabled()) {
159
error_report("mach-virt: KVM does not support providing "
160
"Virtualization extensions to the guest CPU");
161
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
162
create_fdt(vms);
163
164
possible_cpus = mc->possible_cpu_arch_ids(machine);
165
+ assert(possible_cpus->len == max_cpus);
166
for (n = 0; n < possible_cpus->len; n++) {
167
Object *cpuobj;
168
CPUState *cs;
169
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
170
171
create_gic(vms);
172
173
- virt_cpu_post_init(vms, possible_cpus->len, sysmem);
174
+ virt_cpu_post_init(vms, sysmem);
175
176
fdt_add_pmu_nodes(vms);
177
29
--
178
--
30
2.7.4
179
2.20.1
31
180
32
181
diff view generated by jsdifflib
1
For a bus fault, the M profile BFSR bit PRECISERR means a bus
1
From: Richard Henderson <richard.henderson@linaro.org>
2
fault on a data access, and IBUSERR means a bus fault on an
3
instruction access. We had these the wrong way around; fix this.
4
2
3
In 50244cc76abc we updated mte_check_fail to match the ARM
4
pseudocode, using the correct EL to select the TCF field.
5
But we failed to update MTE0_ACTIVE the same way, which led
6
to g_assert_not_reached().
7
8
Cc: qemu-stable@nongnu.org
9
Buglink: https://bugs.launchpad.net/bugs/1907137
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11
Message-id: 20201221204426.88514-1-richard.henderson@linaro.org
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
9
---
14
---
10
target/arm/helper.c | 8 ++++----
15
target/arm/helper.c | 2 +-
11
1 file changed, 4 insertions(+), 4 deletions(-)
16
1 file changed, 1 insertion(+), 1 deletion(-)
12
17
13
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
diff --git a/target/arm/helper.c b/target/arm/helper.c
14
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
15
--- a/target/arm/helper.c
20
--- a/target/arm/helper.c
16
+++ b/target/arm/helper.c
21
+++ b/target/arm/helper.c
17
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
22
@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
18
case 0x8: /* External Abort */
23
if (FIELD_EX32(flags, TBFLAG_A64, UNPRIV)
19
switch (cs->exception_index) {
24
&& tbid
20
case EXCP_PREFETCH_ABORT:
25
&& !(env->pstate & PSTATE_TCO)
21
- env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
26
- && (sctlr & SCTLR_TCF0)
22
- qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
27
+ && (sctlr & SCTLR_TCF)
23
+ env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
28
&& allocation_tag_access_enabled(env, 0, sctlr)) {
24
+ qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
29
flags = FIELD_DP32(flags, TBFLAG_A64, MTE0_ACTIVE, 1);
25
break;
30
}
26
case EXCP_DATA_ABORT:
27
env->v7m.cfsr[M_REG_NS] |=
28
- (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
29
+ (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
30
env->v7m.bfar = env->exception.vaddress;
31
qemu_log_mask(CPU_LOG_INT,
32
- "...with CFSR.IBUSERR and BFAR 0x%x\n",
33
+ "...with CFSR.PRECISERR and BFAR 0x%x\n",
34
env->v7m.bfar);
35
break;
36
}
37
--
31
--
38
2.7.4
32
2.20.1
39
33
40
34
diff view generated by jsdifflib
1
In several places we were unconditionally applying the
1
The CCR is a register most of whose bits are banked between security
2
nvic_gprio_mask() to a priority value. This is incorrect
2
states but where BFHFNMIGN is not, and we keep it in the non-secure
3
if the priority is one of the fixed negative priority
3
entry of the v7m.ccr[] array. The logic which tries to handle this
4
values (for NMI and HardFault), so don't do it.
4
bit fails to implement the "RAZ/WI from Nonsecure if AIRCR.BFHFNMINS
5
5
is zero" requirement; correct the omission.
6
This bug would have caused both NMI and HardFault to be
7
considered as the same priority and so NMI wouldn't
8
correctly preempt HardFault.
9
6
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
9
Message-id: 20201210201433.26262-2-peter.maydell@linaro.org
13
---
10
---
14
hw/intc/armv7m_nvic.c | 11 +++++++++--
11
hw/intc/armv7m_nvic.c | 15 +++++++++++++++
15
1 file changed, 9 insertions(+), 2 deletions(-)
12
1 file changed, 15 insertions(+)
16
13
17
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
14
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
18
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
19
--- a/hw/intc/armv7m_nvic.c
16
--- a/hw/intc/armv7m_nvic.c
20
+++ b/hw/intc/armv7m_nvic.c
17
+++ b/hw/intc/armv7m_nvic.c
21
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
18
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
19
*/
20
val = cpu->env.v7m.ccr[attrs.secure];
21
val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
22
+ /* BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0 */
23
+ if (!attrs.secure) {
24
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
25
+ val &= ~R_V7M_CCR_BFHFNMIGN_MASK;
26
+ }
27
+ }
28
return val;
29
case 0xd24: /* System Handler Control and State (SHCSR) */
30
if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
31
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
32
(cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
33
| (value & R_V7M_CCR_BFHFNMIGN_MASK);
34
value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
35
+ } else {
36
+ /*
37
+ * BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0, so
38
+ * preserve the state currently in the NS element of the array
39
+ */
40
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
41
+ value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
42
+ value |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
43
+ }
22
}
44
}
23
}
45
24
46
cpu->env.v7m.ccr[attrs.secure] = value;
25
+ if (active_prio > 0) {
26
+ active_prio &= nvic_gprio_mask(s);
27
+ }
28
+
29
s->vectpending = pend_irq;
30
- s->exception_prio = active_prio & nvic_gprio_mask(s);
31
+ s->exception_prio = active_prio;
32
33
trace_nvic_recompute_state(s->vectpending, s->exception_prio);
34
}
35
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
36
assert(vec->enabled);
37
assert(vec->pending);
38
39
- pendgroupprio = vec->prio & nvic_gprio_mask(s);
40
+ pendgroupprio = vec->prio;
41
+ if (pendgroupprio > 0) {
42
+ pendgroupprio &= nvic_gprio_mask(s);
43
+ }
44
assert(pendgroupprio < running);
45
46
trace_nvic_acknowledge_irq(pending, vec->prio);
47
--
47
--
48
2.7.4
48
2.20.1
49
49
50
50
diff view generated by jsdifflib
New patch
1
In commit 64f863baeedc8659 we implemented the v8.1M FPCXT_S register,
2
but we got the write behaviour wrong. On read, this register reads
3
bits [27:0] of FPSCR plus the CONTROL.SFPA bit. On write, it doesn't
4
just write back those bits -- it writes a value to the whole FPSCR,
5
whose upper 4 bits are zeroes.
1
6
7
We also incorrectly implemented the write-to-FPSCR as a simple store
8
to vfp.xregs; this skips the "update the softfloat flags" part of
9
the vfp_set_fpscr helper so the value would read back correctly but
10
not actually take effect.
11
12
Fix both of these things by doing a complete write to the FPSCR
13
using the helper function.
14
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
17
Message-id: 20201210201433.26262-3-peter.maydell@linaro.org
18
---
19
target/arm/translate-vfp.c.inc | 12 ++++++------
20
1 file changed, 6 insertions(+), 6 deletions(-)
21
22
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
23
index XXXXXXX..XXXXXXX 100644
24
--- a/target/arm/translate-vfp.c.inc
25
+++ b/target/arm/translate-vfp.c.inc
26
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
27
}
28
case ARM_VFP_FPCXT_S:
29
{
30
- TCGv_i32 sfpa, control, fpscr;
31
- /* Set FPSCR[27:0] and CONTROL.SFPA from value */
32
+ TCGv_i32 sfpa, control;
33
+ /*
34
+ * Set FPSCR and CONTROL.SFPA from value; the new FPSCR takes
35
+ * bits [27:0] from value and zeroes bits [31:28].
36
+ */
37
tmp = loadfn(s, opaque);
38
sfpa = tcg_temp_new_i32();
39
tcg_gen_shri_i32(sfpa, tmp, 31);
40
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
41
tcg_gen_deposit_i32(control, control, sfpa,
42
R_V7M_CONTROL_SFPA_SHIFT, 1);
43
store_cpu_field(control, v7m.control[M_REG_S]);
44
- fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
45
- tcg_gen_andi_i32(fpscr, fpscr, FPCR_NZCV_MASK);
46
tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
47
- tcg_gen_or_i32(fpscr, fpscr, tmp);
48
- store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);
49
+ gen_helper_vfp_set_fpscr(cpu_env, tmp);
50
tcg_temp_free_i32(tmp);
51
tcg_temp_free_i32(sfpa);
52
break;
53
--
54
2.20.1
55
56
diff view generated by jsdifflib
1
In the v7M and v8M ARM ARM, the magic exception return values are
1
Implement the v8.1M FPCXT_NS floating-point system register. This is
2
referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
2
a little more complicated than FPCXT_S, because it has specific
3
constants to define bits within them. Rename the 'type' variable
3
handling for "current FP state is inactive", and it only wants to do
4
which holds the exception return value in do_v7m_exception_exit()
4
PreserveFPState(), not the full set of actions done by
5
to excret, making it clearer that it does hold an EXC_RETURN value.
5
ExecuteFPCheck() which vfp_access_check() implements.
6
6
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
9
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
9
Message-id: 20201210201433.26262-4-peter.maydell@linaro.org
12
---
10
---
13
target/arm/helper.c | 23 ++++++++++++-----------
11
target/arm/translate-vfp.c.inc | 102 ++++++++++++++++++++++++++++++++-
14
1 file changed, 12 insertions(+), 11 deletions(-)
12
1 file changed, 99 insertions(+), 3 deletions(-)
15
13
16
diff --git a/target/arm/helper.c b/target/arm/helper.c
14
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
17
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/helper.c
16
--- a/target/arm/translate-vfp.c.inc
19
+++ b/target/arm/helper.c
17
+++ b/target/arm/translate-vfp.c.inc
20
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
18
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
21
static void do_v7m_exception_exit(ARMCPU *cpu)
19
}
20
break;
21
case ARM_VFP_FPCXT_S:
22
+ case ARM_VFP_FPCXT_NS:
23
if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
24
return false;
25
}
26
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
27
return FPSysRegCheckFailed;
28
}
29
30
- if (!vfp_access_check(s)) {
31
+ /*
32
+ * FPCXT_NS is a special case: it has specific handling for
33
+ * "current FP state is inactive", and must do the PreserveFPState()
34
+ * but not the usual full set of actions done by ExecuteFPCheck().
35
+ * So we don't call vfp_access_check() and the callers must handle this.
36
+ */
37
+ if (regno != ARM_VFP_FPCXT_NS && !vfp_access_check(s)) {
38
return FPSysRegCheckDone;
39
}
40
-
41
return FPSysRegCheckContinue;
42
}
43
44
+static void gen_branch_fpInactive(DisasContext *s, TCGCond cond,
45
+ TCGLabel *label)
46
+{
47
+ /*
48
+ * FPCXT_NS is a special case: it has specific handling for
49
+ * "current FP state is inactive", and must do the PreserveFPState()
50
+ * but not the usual full set of actions done by ExecuteFPCheck().
51
+ * We don't have a TB flag that matches the fpInactive check, so we
52
+ * do it at runtime as we don't expect FPCXT_NS accesses to be frequent.
53
+ *
54
+ * Emit code that checks fpInactive and does a conditional
55
+ * branch to label based on it:
56
+ * if cond is TCG_COND_NE then branch if fpInactive != 0 (ie if inactive)
57
+ * if cond is TCG_COND_EQ then branch if fpInactive == 0 (ie if active)
58
+ */
59
+ assert(cond == TCG_COND_EQ || cond == TCG_COND_NE);
60
+
61
+ /* fpInactive = FPCCR_NS.ASPEN == 1 && CONTROL.FPCA == 0 */
62
+ TCGv_i32 aspen, fpca;
63
+ aspen = load_cpu_field(v7m.fpccr[M_REG_NS]);
64
+ fpca = load_cpu_field(v7m.control[M_REG_S]);
65
+ tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
66
+ tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
67
+ tcg_gen_andi_i32(fpca, fpca, R_V7M_CONTROL_FPCA_MASK);
68
+ tcg_gen_or_i32(fpca, fpca, aspen);
69
+ tcg_gen_brcondi_i32(tcg_invert_cond(cond), fpca, 0, label);
70
+ tcg_temp_free_i32(aspen);
71
+ tcg_temp_free_i32(fpca);
72
+}
73
+
74
static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
75
76
fp_sysreg_loadfn *loadfn,
77
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
22
{
78
{
23
CPUARMState *env = &cpu->env;
79
/* Do a write to an M-profile floating point system register */
24
- uint32_t type;
80
TCGv_i32 tmp;
25
+ uint32_t excret;
81
+ TCGLabel *lab_end = NULL;
26
uint32_t xpsr;
82
27
bool ufault = false;
83
switch (fp_sysreg_checks(s, regno)) {
28
bool return_to_sp_process = false;
84
case FPSysRegCheckFailed:
29
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
85
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
30
* the target value up between env->regs[15] and env->thumb in
86
tcg_temp_free_i32(tmp);
31
* gen_bx(). Reconstitute it.
87
break;
32
*/
33
- type = env->regs[15];
34
+ excret = env->regs[15];
35
if (env->thumb) {
36
- type |= 1;
37
+ excret |= 1;
38
}
88
}
39
89
+ case ARM_VFP_FPCXT_NS:
40
qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
90
+ lab_end = gen_new_label();
41
" previous exception %d\n",
91
+ /* fpInactive case: write is a NOP, so branch to end */
42
- type, env->v7m.exception);
92
+ gen_branch_fpInactive(s, TCG_COND_NE, lab_end);
43
+ excret, env->v7m.exception);
93
+ /* !fpInactive: PreserveFPState(), and reads same as FPCXT_S */
44
94
+ gen_preserve_fp_state(s);
45
- if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
95
+ /* fall through */
46
+ if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
96
case ARM_VFP_FPCXT_S:
47
qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
97
{
48
- "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
98
TCGv_i32 sfpa, control;
49
+ "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
99
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
50
+ excret);
100
default:
51
}
52
53
if (env->v7m.exception != ARMV7M_EXCP_NMI) {
54
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
55
* which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
56
*/
57
if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
58
- int es = type & R_V7M_EXCRET_ES_MASK;
59
+ int es = excret & R_V7M_EXCRET_ES_MASK;
60
if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
61
env->v7m.faultmask[es] = 0;
62
}
63
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
64
g_assert_not_reached();
101
g_assert_not_reached();
65
}
102
}
66
103
+ if (lab_end) {
67
- switch (type & 0xf) {
104
+ gen_set_label(lab_end);
68
+ switch (excret & 0xf) {
105
+ }
69
case 1: /* Return to Handler */
106
return true;
70
return_to_handler = true;
107
}
108
109
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
110
{
111
/* Do a read from an M-profile floating point system register */
112
TCGv_i32 tmp;
113
+ TCGLabel *lab_end = NULL;
114
+ bool lookup_tb = false;
115
116
switch (fp_sysreg_checks(s, regno)) {
117
case FPSysRegCheckFailed:
118
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
119
fpscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);
120
gen_helper_vfp_set_fpscr(cpu_env, fpscr);
121
tcg_temp_free_i32(fpscr);
122
- gen_lookup_tb(s);
123
+ lookup_tb = true;
124
+ break;
125
+ }
126
+ case ARM_VFP_FPCXT_NS:
127
+ {
128
+ TCGv_i32 control, sfpa, fpscr, fpdscr, zero;
129
+ TCGLabel *lab_active = gen_new_label();
130
+
131
+ lookup_tb = true;
132
+
133
+ gen_branch_fpInactive(s, TCG_COND_EQ, lab_active);
134
+ /* fpInactive case: reads as FPDSCR_NS */
135
+ TCGv_i32 tmp = load_cpu_field(v7m.fpdscr[M_REG_NS]);
136
+ storefn(s, opaque, tmp);
137
+ lab_end = gen_new_label();
138
+ tcg_gen_br(lab_end);
139
+
140
+ gen_set_label(lab_active);
141
+ /* !fpInactive: Reads the same as FPCXT_S, but side effects differ */
142
+ gen_preserve_fp_state(s);
143
+ tmp = tcg_temp_new_i32();
144
+ sfpa = tcg_temp_new_i32();
145
+ fpscr = tcg_temp_new_i32();
146
+ gen_helper_vfp_get_fpscr(fpscr, cpu_env);
147
+ tcg_gen_andi_i32(tmp, fpscr, ~FPCR_NZCV_MASK);
148
+ control = load_cpu_field(v7m.control[M_REG_S]);
149
+ tcg_gen_andi_i32(sfpa, control, R_V7M_CONTROL_SFPA_MASK);
150
+ tcg_gen_shli_i32(sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);
151
+ tcg_gen_or_i32(tmp, tmp, sfpa);
152
+ tcg_temp_free_i32(control);
153
+ /* Store result before updating FPSCR, in case it faults */
154
+ storefn(s, opaque, tmp);
155
+ /* If SFPA is zero then set FPSCR from FPDSCR_NS */
156
+ fpdscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);
157
+ zero = tcg_const_i32(0);
158
+ tcg_gen_movcond_i32(TCG_COND_EQ, fpscr, sfpa, zero, fpdscr, fpscr);
159
+ gen_helper_vfp_set_fpscr(cpu_env, fpscr);
160
+ tcg_temp_free_i32(zero);
161
+ tcg_temp_free_i32(sfpa);
162
+ tcg_temp_free_i32(fpdscr);
163
+ tcg_temp_free_i32(fpscr);
71
break;
164
break;
72
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
165
}
73
*/
166
default:
74
env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
167
g_assert_not_reached();
75
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
168
}
76
- v7m_exception_taken(cpu, type);
169
+
77
+ v7m_exception_taken(cpu, excret);
170
+ if (lab_end) {
78
qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
171
+ gen_set_label(lab_end);
79
"stackframe: failed exception return integrity check\n");
172
+ }
80
return;
173
+ if (lookup_tb) {
81
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
174
+ gen_lookup_tb(s);
82
175
+ }
83
/* The restored xPSR exception field will be zero if we're
176
return true;
84
* resuming in Thread mode. If that doesn't match what the
177
}
85
- * exception return type specified then this is a UsageFault.
178
86
+ * exception return excret specified then this is a UsageFault.
87
*/
88
if (return_to_handler != arm_v7m_is_handler_mode(env)) {
89
/* Take an INVPC UsageFault by pushing the stack again. */
90
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
91
env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
92
v7m_push_stack(cpu);
93
- v7m_exception_taken(cpu, type);
94
+ v7m_exception_taken(cpu, excret);
95
qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
96
"failed exception return integrity check\n");
97
return;
98
--
179
--
99
2.7.4
180
2.20.1
100
181
101
182
diff view generated by jsdifflib
New patch
1
Now that we have implemented all the features needed by the v8.1M
2
architecture, we can add the model of the Cortex-M55. This is the
3
configuration without MVE support; we'll add MVE later.
1
4
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20201210201433.26262-5-peter.maydell@linaro.org
8
---
9
target/arm/cpu_tcg.c | 42 ++++++++++++++++++++++++++++++++++++++++++
10
1 file changed, 42 insertions(+)
11
12
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
13
index XXXXXXX..XXXXXXX 100644
14
--- a/target/arm/cpu_tcg.c
15
+++ b/target/arm/cpu_tcg.c
16
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
17
cpu->ctr = 0x8000c000;
18
}
19
20
+static void cortex_m55_initfn(Object *obj)
21
+{
22
+ ARMCPU *cpu = ARM_CPU(obj);
23
+
24
+ set_feature(&cpu->env, ARM_FEATURE_V8);
25
+ set_feature(&cpu->env, ARM_FEATURE_V8_1M);
26
+ set_feature(&cpu->env, ARM_FEATURE_M);
27
+ set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
28
+ set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
29
+ set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
30
+ cpu->midr = 0x410fd221; /* r0p1 */
31
+ cpu->revidr = 0;
32
+ cpu->pmsav7_dregion = 16;
33
+ cpu->sau_sregion = 8;
34
+ /*
35
+ * These are the MVFR* values for the FPU, no MVE configuration;
36
+ * we will update them later when we implement MVE
37
+ */
38
+ cpu->isar.mvfr0 = 0x10110221;
39
+ cpu->isar.mvfr1 = 0x12100011;
40
+ cpu->isar.mvfr2 = 0x00000040;
41
+ cpu->isar.id_pfr0 = 0x20000030;
42
+ cpu->isar.id_pfr1 = 0x00000230;
43
+ cpu->isar.id_dfr0 = 0x10200000;
44
+ cpu->id_afr0 = 0x00000000;
45
+ cpu->isar.id_mmfr0 = 0x00111040;
46
+ cpu->isar.id_mmfr1 = 0x00000000;
47
+ cpu->isar.id_mmfr2 = 0x01000000;
48
+ cpu->isar.id_mmfr3 = 0x00000011;
49
+ cpu->isar.id_isar0 = 0x01103110;
50
+ cpu->isar.id_isar1 = 0x02212000;
51
+ cpu->isar.id_isar2 = 0x20232232;
52
+ cpu->isar.id_isar3 = 0x01111131;
53
+ cpu->isar.id_isar4 = 0x01310132;
54
+ cpu->isar.id_isar5 = 0x00000000;
55
+ cpu->isar.id_isar6 = 0x00000000;
56
+ cpu->clidr = 0x00000000; /* caches not implemented */
57
+ cpu->ctr = 0x8303c003;
58
+}
59
+
60
static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
61
/* Dummy the TCM region regs for the moment */
62
{ .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
63
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
64
.class_init = arm_v7m_class_init },
65
{ .name = "cortex-m33", .initfn = cortex_m33_initfn,
66
.class_init = arm_v7m_class_init },
67
+ { .name = "cortex-m55", .initfn = cortex_m55_initfn,
68
+ .class_init = arm_v7m_class_init },
69
{ .name = "cortex-r5", .initfn = cortex_r5_initfn },
70
{ .name = "cortex-r5f", .initfn = cortex_r5f_initfn },
71
{ .name = "ti925t", .initfn = ti925t_initfn },
72
--
73
2.20.1
74
75
diff view generated by jsdifflib
1
In do_v7m_exception_exit(), there's no need to force the high 4
1
Support for running KVM on 32-bit Arm hosts was removed in commit
2
bits of 'type' to 1 when calling v7m_exception_taken(), because
2
82bf7ae84ce739e. You can still run a 32-bit guest on a 64-bit Arm
3
we know that they're always 1 or we could not have got to this
3
host CPU, but because Arm KVM requires the host and guest CPU types
4
"handle return to magic exception return address" code. Remove
4
to match, it is not possible to run a guest that requires a Cortex-A9
5
the unnecessary ORs.
5
or Cortex-A15 CPU there. That means that the code in the
6
highbank/midway board models to support KVM is no longer used, and we
7
can delete it.
6
8
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
11
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
10
Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
12
Message-id: 20201215144215.28482-1-peter.maydell@linaro.org
11
---
13
---
12
target/arm/helper.c | 4 ++--
14
hw/arm/highbank.c | 14 ++++----------
13
1 file changed, 2 insertions(+), 2 deletions(-)
15
1 file changed, 4 insertions(+), 10 deletions(-)
14
16
15
diff --git a/target/arm/helper.c b/target/arm/helper.c
17
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
16
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/helper.c
19
--- a/hw/arm/highbank.c
18
+++ b/target/arm/helper.c
20
+++ b/hw/arm/highbank.c
19
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
21
@@ -XXX,XX +XXX,XX @@
20
*/
22
#include "hw/arm/boot.h"
21
env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
23
#include "hw/loader.h"
22
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
24
#include "net/net.h"
23
- v7m_exception_taken(cpu, type | 0xf0000000);
25
-#include "sysemu/kvm.h"
24
+ v7m_exception_taken(cpu, type);
26
#include "sysemu/runstate.h"
25
qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
27
#include "sysemu/sysemu.h"
26
"stackframe: failed exception return integrity check\n");
28
#include "hw/boards.h"
27
return;
29
@@ -XXX,XX +XXX,XX @@
28
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
30
#include "hw/cpu/a15mpcore.h"
29
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
31
#include "qemu/log.h"
30
env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
32
#include "qom/object.h"
31
v7m_push_stack(cpu);
33
+#include "cpu.h"
32
- v7m_exception_taken(cpu, type | 0xf0000000);
34
33
+ v7m_exception_taken(cpu, type);
35
#define SMP_BOOT_ADDR 0x100
34
qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
36
#define SMP_BOOT_REG 0x40
35
"failed exception return integrity check\n");
37
@@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id)
36
return;
38
highbank_binfo.loader_start = 0;
39
highbank_binfo.write_secondary_boot = hb_write_secondary;
40
highbank_binfo.secondary_cpu_reset_hook = hb_reset_secondary;
41
- if (!kvm_enabled()) {
42
- highbank_binfo.board_setup_addr = BOARD_SETUP_ADDR;
43
- highbank_binfo.write_board_setup = hb_write_board_setup;
44
- highbank_binfo.secure_board_setup = true;
45
- } else {
46
- warn_report("cannot load built-in Monitor support "
47
- "if KVM is enabled. Some guests (such as Linux) "
48
- "may not boot.");
49
- }
50
+ highbank_binfo.board_setup_addr = BOARD_SETUP_ADDR;
51
+ highbank_binfo.write_board_setup = hb_write_board_setup;
52
+ highbank_binfo.secure_board_setup = true;
53
54
arm_load_kernel(ARM_CPU(first_cpu), machine, &highbank_binfo);
55
}
37
--
56
--
38
2.7.4
57
2.20.1
39
58
40
59
diff view generated by jsdifflib
New patch
1
Currently timer_free() is a simple wrapper for g_free(). This means
2
that the timer being freed must not be currently active, as otherwise
3
QEMU might crash later when the active list is processed and still
4
has a pointer to freed memory on it. As a result almost all calls to
5
timer_free() are preceded by a timer_del() call, as can be seen in
6
the output of
7
git grep -B1 '\<timer_free\>'
1
8
9
This is unfortunate API design as it makes it easy to accidentally
10
misuse (by forgetting the timer_del()), and the correct use is
11
annoyingly verbose.
12
13
Make timer_free() imply a timer_del().
14
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
17
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
18
Message-id: 20201215154107.3255-2-peter.maydell@linaro.org
19
---
20
include/qemu/timer.h | 24 +++++++++++++-----------
21
1 file changed, 13 insertions(+), 11 deletions(-)
22
23
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
24
index XXXXXXX..XXXXXXX 100644
25
--- a/include/qemu/timer.h
26
+++ b/include/qemu/timer.h
27
@@ -XXX,XX +XXX,XX @@ static inline QEMUTimer *timer_new_ms(QEMUClockType type, QEMUTimerCB *cb,
28
*/
29
void timer_deinit(QEMUTimer *ts);
30
31
-/**
32
- * timer_free:
33
- * @ts: the timer
34
- *
35
- * Free a timer (it must not be on the active list)
36
- */
37
-static inline void timer_free(QEMUTimer *ts)
38
-{
39
- g_free(ts);
40
-}
41
-
42
/**
43
* timer_del:
44
* @ts: the timer
45
@@ -XXX,XX +XXX,XX @@ static inline void timer_free(QEMUTimer *ts)
46
*/
47
void timer_del(QEMUTimer *ts);
48
49
+/**
50
+ * timer_free:
51
+ * @ts: the timer
52
+ *
53
+ * Free a timer. This will call timer_del() for you to remove
54
+ * the timer from the active list if it was still active.
55
+ */
56
+static inline void timer_free(QEMUTimer *ts)
57
+{
58
+ timer_del(ts);
59
+ g_free(ts);
60
+}
61
+
62
/**
63
* timer_mod_ns:
64
* @ts: the timer
65
--
66
2.20.1
67
68
diff view generated by jsdifflib
New patch
1
Now that timer_free() implicitly calls timer_del(), sequences
2
timer_del(mytimer);
3
timer_free(mytimer);
1
4
5
can be simplified to just
6
timer_free(mytimer);
7
8
Add a Coccinelle script to do this transformation.
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
12
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 20201215154107.3255-3-peter.maydell@linaro.org
15
---
16
scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++++++++++++++++
17
1 file changed, 18 insertions(+)
18
create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci
19
20
diff --git a/scripts/coccinelle/timer-del-timer-free.cocci b/scripts/coccinelle/timer-del-timer-free.cocci
21
new file mode 100644
22
index XXXXXXX..XXXXXXX
23
--- /dev/null
24
+++ b/scripts/coccinelle/timer-del-timer-free.cocci
25
@@ -XXX,XX +XXX,XX @@
26
+// Remove superfluous timer_del() calls
27
+//
28
+// Copyright Linaro Limited 2020
29
+// This work is licensed under the terms of the GNU GPLv2 or later.
30
+//
31
+// spatch --macro-file scripts/cocci-macro-file.h \
32
+// --sp-file scripts/coccinelle/timer-del-timer-free.cocci \
33
+// --in-place --dir .
34
+//
35
+// The timer_free() function now implicitly calls timer_del()
36
+// for you, so calls to timer_del() immediately before the
37
+// timer_free() of the same timer can be deleted.
38
+
39
+@@
40
+expression T;
41
+@@
42
+-timer_del(T);
43
+ timer_free(T);
44
--
45
2.20.1
46
47
diff view generated by jsdifflib
1
The exception-return magic values get some new bits in v8M, which
1
This commit is the result of running the timer-del-timer-free.cocci
2
makes some bit definitions for them worthwhile.
2
script on the whole source tree.
3
4
We don't use the bit definitions for the switch on the low bits
5
which checks the return type for v7M, because this is defined
6
in the v7M ARM ARM as a set of valid values rather than via
7
per-bit checks.
8
3
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
4
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
5
Acked-by: Corey Minyard <cminyard@mvista.com>
11
Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
6
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20201215154107.3255-4-peter.maydell@linaro.org
12
---
10
---
13
target/arm/internals.h | 10 ++++++++++
11
block/iscsi.c | 2 --
14
target/arm/helper.c | 14 +++++++++-----
12
block/nbd.c | 1 -
15
2 files changed, 19 insertions(+), 5 deletions(-)
13
block/qcow2.c | 1 -
14
hw/block/nvme.c | 2 --
15
hw/char/serial.c | 2 --
16
hw/char/virtio-serial-bus.c | 2 --
17
hw/ide/core.c | 1 -
18
hw/input/hid.c | 1 -
19
hw/intc/apic.c | 1 -
20
hw/intc/ioapic.c | 1 -
21
hw/ipmi/ipmi_bmc_extern.c | 1 -
22
hw/net/e1000.c | 3 ---
23
hw/net/e1000e_core.c | 8 --------
24
hw/net/pcnet-pci.c | 1 -
25
hw/net/rtl8139.c | 1 -
26
hw/net/spapr_llan.c | 1 -
27
hw/net/virtio-net.c | 2 --
28
hw/s390x/s390-pci-inst.c | 1 -
29
hw/sd/sd.c | 1 -
30
hw/sd/sdhci.c | 2 --
31
hw/usb/dev-hub.c | 1 -
32
hw/usb/hcd-ehci.c | 1 -
33
hw/usb/hcd-ohci-pci.c | 1 -
34
hw/usb/hcd-uhci.c | 1 -
35
hw/usb/hcd-xhci.c | 1 -
36
hw/usb/redirect.c | 1 -
37
hw/vfio/display.c | 1 -
38
hw/virtio/vhost-vsock-common.c | 1 -
39
hw/virtio/virtio-balloon.c | 1 -
40
hw/virtio/virtio-rng.c | 1 -
41
hw/watchdog/wdt_diag288.c | 1 -
42
hw/watchdog/wdt_i6300esb.c | 1 -
43
migration/colo.c | 1 -
44
monitor/hmp-cmds.c | 1 -
45
net/announce.c | 1 -
46
net/colo-compare.c | 1 -
47
net/slirp.c | 1 -
48
replay/replay-debugging.c | 1 -
49
target/s390x/cpu.c | 2 --
50
ui/console.c | 1 -
51
ui/spice-core.c | 1 -
52
util/throttle.c | 1 -
53
42 files changed, 58 deletions(-)
16
54
17
diff --git a/target/arm/internals.h b/target/arm/internals.h
55
diff --git a/block/iscsi.c b/block/iscsi.c
18
index XXXXXXX..XXXXXXX 100644
56
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/internals.h
57
--- a/block/iscsi.c
20
+++ b/target/arm/internals.h
58
+++ b/block/iscsi.c
21
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
59
@@ -XXX,XX +XXX,XX @@ static void iscsi_detach_aio_context(BlockDriverState *bs)
22
FIELD(V7M_CONTROL, SPSEL, 1, 1)
60
iscsilun->events = 0;
23
FIELD(V7M_CONTROL, FPCA, 2, 1)
61
24
62
if (iscsilun->nop_timer) {
25
+/* Bit definitions for v7M exception return payload */
63
- timer_del(iscsilun->nop_timer);
26
+FIELD(V7M_EXCRET, ES, 0, 1)
64
timer_free(iscsilun->nop_timer);
27
+FIELD(V7M_EXCRET, RES0, 1, 1)
65
iscsilun->nop_timer = NULL;
28
+FIELD(V7M_EXCRET, SPSEL, 2, 1)
66
}
29
+FIELD(V7M_EXCRET, MODE, 3, 1)
67
if (iscsilun->event_timer) {
30
+FIELD(V7M_EXCRET, FTYPE, 4, 1)
68
- timer_del(iscsilun->event_timer);
31
+FIELD(V7M_EXCRET, DCRS, 5, 1)
69
timer_free(iscsilun->event_timer);
32
+FIELD(V7M_EXCRET, S, 6, 1)
70
iscsilun->event_timer = NULL;
33
+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
71
}
34
+
72
diff --git a/block/nbd.c b/block/nbd.c
35
/*
73
index XXXXXXX..XXXXXXX 100644
36
* For AArch64, map a given EL to an index in the banked_spsr array.
74
--- a/block/nbd.c
37
* Note that this mapping and the AArch32 mapping defined in bank_number()
75
+++ b/block/nbd.c
38
diff --git a/target/arm/helper.c b/target/arm/helper.c
76
@@ -XXX,XX +XXX,XX @@ static void nbd_recv_coroutines_wake_all(BDRVNBDState *s)
39
index XXXXXXX..XXXXXXX 100644
77
static void reconnect_delay_timer_del(BDRVNBDState *s)
40
--- a/target/arm/helper.c
78
{
41
+++ b/target/arm/helper.c
79
if (s->reconnect_delay_timer) {
42
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
80
- timer_del(s->reconnect_delay_timer);
43
" previous exception %d\n",
81
timer_free(s->reconnect_delay_timer);
44
type, env->v7m.exception);
82
s->reconnect_delay_timer = NULL;
45
83
}
46
- if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
84
diff --git a/block/qcow2.c b/block/qcow2.c
47
+ if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
85
index XXXXXXX..XXXXXXX 100644
48
qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
86
--- a/block/qcow2.c
49
"exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
87
+++ b/block/qcow2.c
50
}
88
@@ -XXX,XX +XXX,XX @@ static void cache_clean_timer_del(BlockDriverState *bs)
51
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
89
{
52
* which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
90
BDRVQcow2State *s = bs->opaque;
53
*/
91
if (s->cache_clean_timer) {
54
if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
92
- timer_del(s->cache_clean_timer);
55
- int es = type & 1;
93
timer_free(s->cache_clean_timer);
56
+ int es = type & R_V7M_EXCRET_ES_MASK;
94
s->cache_clean_timer = NULL;
57
if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
95
}
58
env->v7m.faultmask[es] = 0;
96
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
59
}
97
index XXXXXXX..XXXXXXX 100644
60
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
98
--- a/hw/block/nvme.c
61
return; /* Never happens. Keep compiler happy. */
99
+++ b/hw/block/nvme.c
62
}
100
@@ -XXX,XX +XXX,XX @@ static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)
63
101
static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n)
64
- lr = 0xfffffff1;
102
{
65
+ lr = R_V7M_EXCRET_RES1_MASK |
103
n->sq[sq->sqid] = NULL;
66
+ R_V7M_EXCRET_S_MASK |
104
- timer_del(sq->timer);
67
+ R_V7M_EXCRET_DCRS_MASK |
105
timer_free(sq->timer);
68
+ R_V7M_EXCRET_FTYPE_MASK |
106
g_free(sq->io_req);
69
+ R_V7M_EXCRET_ES_MASK;
107
if (sq->sqid) {
70
if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
108
@@ -XXX,XX +XXX,XX @@ static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req)
71
- lr |= 4;
109
static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n)
72
+ lr |= R_V7M_EXCRET_SPSEL_MASK;
110
{
73
}
111
n->cq[cq->cqid] = NULL;
74
if (!arm_v7m_is_handler_mode(env)) {
112
- timer_del(cq->timer);
75
- lr |= 8;
113
timer_free(cq->timer);
76
+ lr |= R_V7M_EXCRET_MODE_MASK;
114
msix_vector_unuse(&n->parent_obj, cq->vector);
77
}
115
if (cq->cqid) {
78
116
diff --git a/hw/char/serial.c b/hw/char/serial.c
79
v7m_push_stack(cpu);
117
index XXXXXXX..XXXXXXX 100644
118
--- a/hw/char/serial.c
119
+++ b/hw/char/serial.c
120
@@ -XXX,XX +XXX,XX @@ static void serial_unrealize(DeviceState *dev)
121
122
qemu_chr_fe_deinit(&s->chr, false);
123
124
- timer_del(s->modem_status_poll);
125
timer_free(s->modem_status_poll);
126
127
- timer_del(s->fifo_timeout_timer);
128
timer_free(s->fifo_timeout_timer);
129
130
fifo8_destroy(&s->recv_fifo);
131
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
132
index XXXXXXX..XXXXXXX 100644
133
--- a/hw/char/virtio-serial-bus.c
134
+++ b/hw/char/virtio-serial-bus.c
135
@@ -XXX,XX +XXX,XX @@ static void virtio_serial_post_load_timer_cb(void *opaque)
136
}
137
}
138
g_free(s->post_load->connected);
139
- timer_del(s->post_load->timer);
140
timer_free(s->post_load->timer);
141
g_free(s->post_load);
142
s->post_load = NULL;
143
@@ -XXX,XX +XXX,XX @@ static void virtio_serial_device_unrealize(DeviceState *dev)
144
g_free(vser->ports_map);
145
if (vser->post_load) {
146
g_free(vser->post_load->connected);
147
- timer_del(vser->post_load->timer);
148
timer_free(vser->post_load->timer);
149
g_free(vser->post_load);
150
}
151
diff --git a/hw/ide/core.c b/hw/ide/core.c
152
index XXXXXXX..XXXXXXX 100644
153
--- a/hw/ide/core.c
154
+++ b/hw/ide/core.c
155
@@ -XXX,XX +XXX,XX @@ void ide_init2(IDEBus *bus, qemu_irq irq)
156
157
void ide_exit(IDEState *s)
158
{
159
- timer_del(s->sector_write_timer);
160
timer_free(s->sector_write_timer);
161
qemu_vfree(s->smart_selftest_data);
162
qemu_vfree(s->io_buffer);
163
diff --git a/hw/input/hid.c b/hw/input/hid.c
164
index XXXXXXX..XXXXXXX 100644
165
--- a/hw/input/hid.c
166
+++ b/hw/input/hid.c
167
@@ -XXX,XX +XXX,XX @@ static void hid_idle_timer(void *opaque)
168
static void hid_del_idle_timer(HIDState *hs)
169
{
170
if (hs->idle_timer) {
171
- timer_del(hs->idle_timer);
172
timer_free(hs->idle_timer);
173
hs->idle_timer = NULL;
174
}
175
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
176
index XXXXXXX..XXXXXXX 100644
177
--- a/hw/intc/apic.c
178
+++ b/hw/intc/apic.c
179
@@ -XXX,XX +XXX,XX @@ static void apic_unrealize(DeviceState *dev)
180
{
181
APICCommonState *s = APIC(dev);
182
183
- timer_del(s->timer);
184
timer_free(s->timer);
185
local_apics[s->id] = NULL;
186
}
187
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
188
index XXXXXXX..XXXXXXX 100644
189
--- a/hw/intc/ioapic.c
190
+++ b/hw/intc/ioapic.c
191
@@ -XXX,XX +XXX,XX @@ static void ioapic_unrealize(DeviceState *dev)
192
{
193
IOAPICCommonState *s = IOAPIC_COMMON(dev);
194
195
- timer_del(s->delayed_ioapic_service_timer);
196
timer_free(s->delayed_ioapic_service_timer);
197
}
198
199
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
200
index XXXXXXX..XXXXXXX 100644
201
--- a/hw/ipmi/ipmi_bmc_extern.c
202
+++ b/hw/ipmi/ipmi_bmc_extern.c
203
@@ -XXX,XX +XXX,XX @@ static void ipmi_bmc_extern_finalize(Object *obj)
204
{
205
IPMIBmcExtern *ibe = IPMI_BMC_EXTERN(obj);
206
207
- timer_del(ibe->extern_timer);
208
timer_free(ibe->extern_timer);
209
}
210
211
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
212
index XXXXXXX..XXXXXXX 100644
213
--- a/hw/net/e1000.c
214
+++ b/hw/net/e1000.c
215
@@ -XXX,XX +XXX,XX @@ pci_e1000_uninit(PCIDevice *dev)
216
{
217
E1000State *d = E1000(dev);
218
219
- timer_del(d->autoneg_timer);
220
timer_free(d->autoneg_timer);
221
- timer_del(d->mit_timer);
222
timer_free(d->mit_timer);
223
- timer_del(d->flush_queue_timer);
224
timer_free(d->flush_queue_timer);
225
qemu_del_nic(d->nic);
226
}
227
diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
228
index XXXXXXX..XXXXXXX 100644
229
--- a/hw/net/e1000e_core.c
230
+++ b/hw/net/e1000e_core.c
231
@@ -XXX,XX +XXX,XX @@ e1000e_intrmgr_pci_unint(E1000ECore *core)
232
{
233
int i;
234
235
- timer_del(core->radv.timer);
236
timer_free(core->radv.timer);
237
- timer_del(core->rdtr.timer);
238
timer_free(core->rdtr.timer);
239
- timer_del(core->raid.timer);
240
timer_free(core->raid.timer);
241
242
- timer_del(core->tadv.timer);
243
timer_free(core->tadv.timer);
244
- timer_del(core->tidv.timer);
245
timer_free(core->tidv.timer);
246
247
- timer_del(core->itr.timer);
248
timer_free(core->itr.timer);
249
250
for (i = 0; i < E1000E_MSIX_VEC_NUM; i++) {
251
- timer_del(core->eitr[i].timer);
252
timer_free(core->eitr[i].timer);
253
}
254
}
255
@@ -XXX,XX +XXX,XX @@ e1000e_core_pci_uninit(E1000ECore *core)
256
{
257
int i;
258
259
- timer_del(core->autoneg_timer);
260
timer_free(core->autoneg_timer);
261
262
e1000e_intrmgr_pci_unint(core);
263
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
264
index XXXXXXX..XXXXXXX 100644
265
--- a/hw/net/pcnet-pci.c
266
+++ b/hw/net/pcnet-pci.c
267
@@ -XXX,XX +XXX,XX @@ static void pci_pcnet_uninit(PCIDevice *dev)
268
PCIPCNetState *d = PCI_PCNET(dev);
269
270
qemu_free_irq(d->state.irq);
271
- timer_del(d->state.poll_timer);
272
timer_free(d->state.poll_timer);
273
qemu_del_nic(d->state.nic);
274
}
275
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
276
index XXXXXXX..XXXXXXX 100644
277
--- a/hw/net/rtl8139.c
278
+++ b/hw/net/rtl8139.c
279
@@ -XXX,XX +XXX,XX @@ static void pci_rtl8139_uninit(PCIDevice *dev)
280
281
g_free(s->cplus_txbuffer);
282
s->cplus_txbuffer = NULL;
283
- timer_del(s->timer);
284
timer_free(s->timer);
285
qemu_del_nic(s->nic);
286
}
287
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
288
index XXXXXXX..XXXXXXX 100644
289
--- a/hw/net/spapr_llan.c
290
+++ b/hw/net/spapr_llan.c
291
@@ -XXX,XX +XXX,XX @@ static void spapr_vlan_instance_finalize(Object *obj)
292
}
293
294
if (dev->rxp_timer) {
295
- timer_del(dev->rxp_timer);
296
timer_free(dev->rxp_timer);
297
}
298
}
299
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
300
index XXXXXXX..XXXXXXX 100644
301
--- a/hw/net/virtio-net.c
302
+++ b/hw/net/virtio-net.c
303
@@ -XXX,XX +XXX,XX @@ static void virtio_net_rsc_cleanup(VirtIONet *n)
304
g_free(seg);
305
}
306
307
- timer_del(chain->drain_timer);
308
timer_free(chain->drain_timer);
309
QTAILQ_REMOVE(&n->rsc_chains, chain, next);
310
g_free(chain);
311
@@ -XXX,XX +XXX,XX @@ static void virtio_net_del_queue(VirtIONet *n, int index)
312
313
virtio_del_queue(vdev, index * 2);
314
if (q->tx_timer) {
315
- timer_del(q->tx_timer);
316
timer_free(q->tx_timer);
317
q->tx_timer = NULL;
318
} else {
319
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
320
index XXXXXXX..XXXXXXX 100644
321
--- a/hw/s390x/s390-pci-inst.c
322
+++ b/hw/s390x/s390-pci-inst.c
323
@@ -XXX,XX +XXX,XX @@ void pci_dereg_ioat(S390PCIIOMMU *iommu)
324
void fmb_timer_free(S390PCIBusDevice *pbdev)
325
{
326
if (pbdev->fmb_timer) {
327
- timer_del(pbdev->fmb_timer);
328
timer_free(pbdev->fmb_timer);
329
pbdev->fmb_timer = NULL;
330
}
331
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
332
index XXXXXXX..XXXXXXX 100644
333
--- a/hw/sd/sd.c
334
+++ b/hw/sd/sd.c
335
@@ -XXX,XX +XXX,XX @@ static void sd_instance_finalize(Object *obj)
336
{
337
SDState *sd = SD_CARD(obj);
338
339
- timer_del(sd->ocr_power_timer);
340
timer_free(sd->ocr_power_timer);
341
}
342
343
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
344
index XXXXXXX..XXXXXXX 100644
345
--- a/hw/sd/sdhci.c
346
+++ b/hw/sd/sdhci.c
347
@@ -XXX,XX +XXX,XX @@ void sdhci_initfn(SDHCIState *s)
348
349
void sdhci_uninitfn(SDHCIState *s)
350
{
351
- timer_del(s->insert_timer);
352
timer_free(s->insert_timer);
353
- timer_del(s->transfer_timer);
354
timer_free(s->transfer_timer);
355
356
g_free(s->fifo_buffer);
357
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
358
index XXXXXXX..XXXXXXX 100644
359
--- a/hw/usb/dev-hub.c
360
+++ b/hw/usb/dev-hub.c
361
@@ -XXX,XX +XXX,XX @@ static void usb_hub_unrealize(USBDevice *dev)
362
&s->ports[i].port);
363
}
364
365
- timer_del(s->port_timer);
366
timer_free(s->port_timer);
367
}
368
369
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
370
index XXXXXXX..XXXXXXX 100644
371
--- a/hw/usb/hcd-ehci.c
372
+++ b/hw/usb/hcd-ehci.c
373
@@ -XXX,XX +XXX,XX @@ void usb_ehci_unrealize(EHCIState *s, DeviceState *dev)
374
trace_usb_ehci_unrealize();
375
376
if (s->frame_timer) {
377
- timer_del(s->frame_timer);
378
timer_free(s->frame_timer);
379
s->frame_timer = NULL;
380
}
381
diff --git a/hw/usb/hcd-ohci-pci.c b/hw/usb/hcd-ohci-pci.c
382
index XXXXXXX..XXXXXXX 100644
383
--- a/hw/usb/hcd-ohci-pci.c
384
+++ b/hw/usb/hcd-ohci-pci.c
385
@@ -XXX,XX +XXX,XX @@ static void usb_ohci_exit(PCIDevice *dev)
386
usb_bus_release(&s->bus);
387
}
388
389
- timer_del(s->eof_timer);
390
timer_free(s->eof_timer);
391
}
392
393
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
394
index XXXXXXX..XXXXXXX 100644
395
--- a/hw/usb/hcd-uhci.c
396
+++ b/hw/usb/hcd-uhci.c
397
@@ -XXX,XX +XXX,XX @@ static void usb_uhci_exit(PCIDevice *dev)
398
trace_usb_uhci_exit();
399
400
if (s->frame_timer) {
401
- timer_del(s->frame_timer);
402
timer_free(s->frame_timer);
403
s->frame_timer = NULL;
404
}
405
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
406
index XXXXXXX..XXXXXXX 100644
407
--- a/hw/usb/hcd-xhci.c
408
+++ b/hw/usb/hcd-xhci.c
409
@@ -XXX,XX +XXX,XX @@ static void usb_xhci_unrealize(DeviceState *dev)
410
}
411
412
if (xhci->mfwrap_timer) {
413
- timer_del(xhci->mfwrap_timer);
414
timer_free(xhci->mfwrap_timer);
415
xhci->mfwrap_timer = NULL;
416
}
417
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
418
index XXXXXXX..XXXXXXX 100644
419
--- a/hw/usb/redirect.c
420
+++ b/hw/usb/redirect.c
421
@@ -XXX,XX +XXX,XX @@ static void usbredir_unrealize(USBDevice *udev)
422
qemu_bh_delete(dev->chardev_close_bh);
423
qemu_bh_delete(dev->device_reject_bh);
424
425
- timer_del(dev->attach_timer);
426
timer_free(dev->attach_timer);
427
428
usbredir_cleanup_device_queues(dev);
429
diff --git a/hw/vfio/display.c b/hw/vfio/display.c
430
index XXXXXXX..XXXXXXX 100644
431
--- a/hw/vfio/display.c
432
+++ b/hw/vfio/display.c
433
@@ -XXX,XX +XXX,XX @@ static void vfio_display_edid_exit(VFIODisplay *dpy)
434
435
g_free(dpy->edid_regs);
436
g_free(dpy->edid_blob);
437
- timer_del(dpy->edid_link_timer);
438
timer_free(dpy->edid_link_timer);
439
}
440
441
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
442
index XXXXXXX..XXXXXXX 100644
443
--- a/hw/virtio/vhost-vsock-common.c
444
+++ b/hw/virtio/vhost-vsock-common.c
445
@@ -XXX,XX +XXX,XX @@ static void vhost_vsock_common_post_load_timer_cleanup(VHostVSockCommon *vvc)
446
return;
447
}
448
449
- timer_del(vvc->post_load_timer);
450
timer_free(vvc->post_load_timer);
451
vvc->post_load_timer = NULL;
452
}
453
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
454
index XXXXXXX..XXXXXXX 100644
455
--- a/hw/virtio/virtio-balloon.c
456
+++ b/hw/virtio/virtio-balloon.c
457
@@ -XXX,XX +XXX,XX @@ static bool balloon_stats_enabled(const VirtIOBalloon *s)
458
static void balloon_stats_destroy_timer(VirtIOBalloon *s)
459
{
460
if (balloon_stats_enabled(s)) {
461
- timer_del(s->stats_timer);
462
timer_free(s->stats_timer);
463
s->stats_timer = NULL;
464
s->stats_poll_interval = 0;
465
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
466
index XXXXXXX..XXXXXXX 100644
467
--- a/hw/virtio/virtio-rng.c
468
+++ b/hw/virtio/virtio-rng.c
469
@@ -XXX,XX +XXX,XX @@ static void virtio_rng_device_unrealize(DeviceState *dev)
470
VirtIORNG *vrng = VIRTIO_RNG(dev);
471
472
qemu_del_vm_change_state_handler(vrng->vmstate);
473
- timer_del(vrng->rate_limit_timer);
474
timer_free(vrng->rate_limit_timer);
475
virtio_del_queue(vdev, 0);
476
virtio_cleanup(vdev);
477
diff --git a/hw/watchdog/wdt_diag288.c b/hw/watchdog/wdt_diag288.c
478
index XXXXXXX..XXXXXXX 100644
479
--- a/hw/watchdog/wdt_diag288.c
480
+++ b/hw/watchdog/wdt_diag288.c
481
@@ -XXX,XX +XXX,XX @@ static void wdt_diag288_unrealize(DeviceState *dev)
482
{
483
DIAG288State *diag288 = DIAG288(dev);
484
485
- timer_del(diag288->timer);
486
timer_free(diag288->timer);
487
}
488
489
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
490
index XXXXXXX..XXXXXXX 100644
491
--- a/hw/watchdog/wdt_i6300esb.c
492
+++ b/hw/watchdog/wdt_i6300esb.c
493
@@ -XXX,XX +XXX,XX @@ static void i6300esb_exit(PCIDevice *dev)
494
{
495
I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev);
496
497
- timer_del(d->timer);
498
timer_free(d->timer);
499
}
500
501
diff --git a/migration/colo.c b/migration/colo.c
502
index XXXXXXX..XXXXXXX 100644
503
--- a/migration/colo.c
504
+++ b/migration/colo.c
505
@@ -XXX,XX +XXX,XX @@ out:
506
* error.
507
*/
508
colo_compare_unregister_notifier(&packets_compare_notifier);
509
- timer_del(s->colo_delay_timer);
510
timer_free(s->colo_delay_timer);
511
qemu_event_destroy(&s->colo_checkpoint_event);
512
513
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
514
index XXXXXXX..XXXXXXX 100644
515
--- a/monitor/hmp-cmds.c
516
+++ b/monitor/hmp-cmds.c
517
@@ -XXX,XX +XXX,XX @@ static void hmp_migrate_status_cb(void *opaque)
518
error_report("%s", info->error_desc);
519
}
520
monitor_resume(status->mon);
521
- timer_del(status->timer);
522
timer_free(status->timer);
523
g_free(status);
524
}
525
diff --git a/net/announce.c b/net/announce.c
526
index XXXXXXX..XXXXXXX 100644
527
--- a/net/announce.c
528
+++ b/net/announce.c
529
@@ -XXX,XX +XXX,XX @@ void qemu_announce_timer_del(AnnounceTimer *timer, bool free_named)
530
{
531
bool free_timer = false;
532
if (timer->tm) {
533
- timer_del(timer->tm);
534
timer_free(timer->tm);
535
timer->tm = NULL;
536
}
537
diff --git a/net/colo-compare.c b/net/colo-compare.c
538
index XXXXXXX..XXXXXXX 100644
539
--- a/net/colo-compare.c
540
+++ b/net/colo-compare.c
541
@@ -XXX,XX +XXX,XX @@ static void colo_compare_timer_init(CompareState *s)
542
static void colo_compare_timer_del(CompareState *s)
543
{
544
if (s->packet_check_timer) {
545
- timer_del(s->packet_check_timer);
546
timer_free(s->packet_check_timer);
547
s->packet_check_timer = NULL;
548
}
549
diff --git a/net/slirp.c b/net/slirp.c
550
index XXXXXXX..XXXXXXX 100644
551
--- a/net/slirp.c
552
+++ b/net/slirp.c
553
@@ -XXX,XX +XXX,XX @@ static void *net_slirp_timer_new(SlirpTimerCb cb,
554
555
static void net_slirp_timer_free(void *timer, void *opaque)
556
{
557
- timer_del(timer);
558
timer_free(timer);
559
}
560
561
diff --git a/replay/replay-debugging.c b/replay/replay-debugging.c
562
index XXXXXXX..XXXXXXX 100644
563
--- a/replay/replay-debugging.c
564
+++ b/replay/replay-debugging.c
565
@@ -XXX,XX +XXX,XX @@ static void replay_delete_break(void)
566
assert(replay_mutex_locked());
567
568
if (replay_break_timer) {
569
- timer_del(replay_break_timer);
570
timer_free(replay_break_timer);
571
replay_break_timer = NULL;
572
}
573
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
574
index XXXXXXX..XXXXXXX 100644
575
--- a/target/s390x/cpu.c
576
+++ b/target/s390x/cpu.c
577
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_finalize(Object *obj)
578
#if !defined(CONFIG_USER_ONLY)
579
S390CPU *cpu = S390_CPU(obj);
580
581
- timer_del(cpu->env.tod_timer);
582
timer_free(cpu->env.tod_timer);
583
- timer_del(cpu->env.cpu_timer);
584
timer_free(cpu->env.cpu_timer);
585
586
qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
587
diff --git a/ui/console.c b/ui/console.c
588
index XXXXXXX..XXXXXXX 100644
589
--- a/ui/console.c
590
+++ b/ui/console.c
591
@@ -XXX,XX +XXX,XX @@ static void gui_setup_refresh(DisplayState *ds)
592
timer_mod(ds->gui_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME));
593
}
594
if (!need_timer && ds->gui_timer != NULL) {
595
- timer_del(ds->gui_timer);
596
timer_free(ds->gui_timer);
597
ds->gui_timer = NULL;
598
}
599
diff --git a/ui/spice-core.c b/ui/spice-core.c
600
index XXXXXXX..XXXXXXX 100644
601
--- a/ui/spice-core.c
602
+++ b/ui/spice-core.c
603
@@ -XXX,XX +XXX,XX @@ static void timer_cancel(SpiceTimer *timer)
604
605
static void timer_remove(SpiceTimer *timer)
606
{
607
- timer_del(timer->timer);
608
timer_free(timer->timer);
609
g_free(timer);
610
}
611
diff --git a/util/throttle.c b/util/throttle.c
612
index XXXXXXX..XXXXXXX 100644
613
--- a/util/throttle.c
614
+++ b/util/throttle.c
615
@@ -XXX,XX +XXX,XX @@ static void throttle_timer_destroy(QEMUTimer **timer)
616
{
617
assert(*timer != NULL);
618
619
- timer_del(*timer);
620
timer_free(*timer);
621
*timer = NULL;
622
}
80
--
623
--
81
2.7.4
624
2.20.1
82
625
83
626
diff view generated by jsdifflib
1
For M profile we must clear the exclusive monitor on reset, exception
1
The Arm CPU finalize function uses a sequence of timer_del(), timer_deinit(),
2
entry and exception exit. We weren't doing any of these things; fix
2
timer_free() to free the timer. The timer_deinit() step in this was always
3
this bug.
3
unnecessary, and now the timer_del() is implied by timer_free(), so we can
4
collapse this down to simply calling timer_free().
4
5
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
9
Message-id: 20201215154107.3255-5-peter.maydell@linaro.org
9
---
10
---
10
target/arm/internals.h | 10 ++++++++++
11
target/arm/cpu.c | 2 --
11
target/arm/cpu.c | 6 ++++++
12
1 file changed, 2 deletions(-)
12
target/arm/helper.c | 2 ++
13
target/arm/op_helper.c | 2 +-
14
4 files changed, 19 insertions(+), 1 deletion(-)
15
13
16
diff --git a/target/arm/internals.h b/target/arm/internals.h
17
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/internals.h
19
+++ b/target/arm/internals.h
20
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
21
#endif
22
23
/**
24
+ * arm_clear_exclusive: clear the exclusive monitor
25
+ * @env: CPU env
26
+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
27
+ */
28
+static inline void arm_clear_exclusive(CPUARMState *env)
29
+{
30
+ env->exclusive_addr = -1;
31
+}
32
+
33
+/**
34
* ARMMMUFaultInfo: Information describing an ARM MMU Fault
35
* @s2addr: Address that caused a fault at stage 2
36
* @stage2: True if we faulted at stage 2
37
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
14
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
38
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
39
--- a/target/arm/cpu.c
16
--- a/target/arm/cpu.c
40
+++ b/target/arm/cpu.c
17
+++ b/target/arm/cpu.c
41
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
18
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
42
env->regs[15] = 0xFFFF0000;
43
}
19
}
44
20
#ifndef CONFIG_USER_ONLY
45
+ /* M profile requires that reset clears the exclusive monitor;
21
if (cpu->pmu_timer) {
46
+ * A profile does not, but clearing it makes more sense than having it
22
- timer_del(cpu->pmu_timer);
47
+ * set with an exclusive access on address zero.
23
- timer_deinit(cpu->pmu_timer);
48
+ */
24
timer_free(cpu->pmu_timer);
49
+ arm_clear_exclusive(env);
25
}
50
+
51
env->vfp.xregs[ARM_VFP_FPEXC] = 0;
52
#endif
26
#endif
53
54
diff --git a/target/arm/helper.c b/target/arm/helper.c
55
index XXXXXXX..XXXXXXX 100644
56
--- a/target/arm/helper.c
57
+++ b/target/arm/helper.c
58
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
59
60
armv7m_nvic_acknowledge_irq(env->nvic);
61
switch_v7m_sp(env, 0);
62
+ arm_clear_exclusive(env);
63
/* Clear IT bits */
64
env->condexec_bits = 0;
65
env->regs[14] = lr;
66
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
67
}
68
69
/* Otherwise, we have a successful exception exit. */
70
+ arm_clear_exclusive(env);
71
qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
72
}
73
74
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
75
index XXXXXXX..XXXXXXX 100644
76
--- a/target/arm/op_helper.c
77
+++ b/target/arm/op_helper.c
78
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
79
80
aarch64_save_sp(env, cur_el);
81
82
- env->exclusive_addr = -1;
83
+ arm_clear_exclusive(env);
84
85
/* We must squash the PSTATE.SS bit to zero unless both of the
86
* following hold:
87
--
27
--
88
2.7.4
28
2.20.1
89
29
90
30
diff view generated by jsdifflib
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
Instead of copying addr to a local temp, reuse the value (which we
3
When running device-introspect-test, a memory leak occurred in the
4
have just compared as equal) already saved in cpu_exclusive_addr.
4
digic_timer_init function, so use ptimer_free() in the finalize function to
5
avoid it.
5
6
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
ASAN shows memory leak stack:
7
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
8
8
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
9
Indirect leak of 288 byte(s) in 3 object(s) allocated from:
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf5b04084 in digic_timer_init /qemu/hw/timer/digic-timer.c:142
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
16
#6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
17
#7 0xaaabf5b40e84 in digic_init /qemu/hw/arm/digic.c:46
18
#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
19
#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
20
#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
21
#11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
22
#12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
28
---
11
target/arm/translate-a64.c | 26 +++++++++-----------------
29
hw/timer/digic-timer.c | 8 ++++++++
12
1 file changed, 9 insertions(+), 17 deletions(-)
30
1 file changed, 8 insertions(+)
13
31
14
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
32
diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
15
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate-a64.c
34
--- a/hw/timer/digic-timer.c
17
+++ b/target/arm/translate-a64.c
35
+++ b/hw/timer/digic-timer.c
18
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
36
@@ -XXX,XX +XXX,XX @@ static void digic_timer_init(Object *obj)
37
sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
19
}
38
}
20
39
21
static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
40
+static void digic_timer_finalize(Object *obj)
22
- TCGv_i64 inaddr, int size, int is_pair)
41
+{
23
+ TCGv_i64 addr, int size, int is_pair)
42
+ DigicTimerState *s = DIGIC_TIMER(obj);
43
+
44
+ ptimer_free(s->ptimer);
45
+}
46
+
47
static void digic_timer_class_init(ObjectClass *klass, void *class_data)
24
{
48
{
25
/* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
49
DeviceClass *dc = DEVICE_CLASS(klass);
26
* && (!is_pair || env->exclusive_high == [addr + datasize])) {
50
@@ -XXX,XX +XXX,XX @@ static const TypeInfo digic_timer_info = {
27
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
51
.parent = TYPE_SYS_BUS_DEVICE,
28
*/
52
.instance_size = sizeof(DigicTimerState),
29
TCGLabel *fail_label = gen_new_label();
53
.instance_init = digic_timer_init,
30
TCGLabel *done_label = gen_new_label();
54
+ .instance_finalize = digic_timer_finalize,
31
- TCGv_i64 addr = tcg_temp_local_new_i64();
55
.class_init = digic_timer_class_init,
32
TCGv_i64 tmp;
56
};
33
57
34
- /* Copy input into a local temp so it is not trashed when the
35
- * basic block ends at the branch insn.
36
- */
37
- tcg_gen_mov_i64(addr, inaddr);
38
tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
39
40
tmp = tcg_temp_new_i64();
41
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
42
} else {
43
tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
44
}
45
- tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
46
+ tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
47
+ cpu_exclusive_val, tmp,
48
get_mem_index(s),
49
MO_64 | MO_ALIGN | s->be_data);
50
tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
51
} else if (s->be_data == MO_LE) {
52
- gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
53
- cpu_reg(s, rt2));
54
+ gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
55
+ cpu_reg(s, rt), cpu_reg(s, rt2));
56
} else {
57
- gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
58
- cpu_reg(s, rt2));
59
+ gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
60
+ cpu_reg(s, rt), cpu_reg(s, rt2));
61
}
62
} else {
63
- TCGv_i64 val = cpu_reg(s, rt);
64
- tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
65
- get_mem_index(s),
66
+ tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
67
+ cpu_reg(s, rt), get_mem_index(s),
68
size | MO_ALIGN | s->be_data);
69
tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
70
}
71
-
72
- tcg_temp_free_i64(addr);
73
-
74
tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
75
tcg_temp_free_i64(tmp);
76
tcg_gen_br(done_label);
77
--
58
--
78
2.7.4
59
2.20.1
79
60
80
61
diff view generated by jsdifflib
1
From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
To implement INTx to gsi routing we need to pass the gpex host
3
When running device-introspect-test, a memory leak occurred in the a10_pit_init
4
bridge the gsi associated to each INTx index. Let's introduce
4
function, so use ptimer_free() in the finalize function to avoid it.
5
irq_num array and gpex_set_irq_num setter function.
6
5
7
Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
6
ASAN shows memory leak stack:
8
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
7
9
Signed-off-by: Eric Auger <eric.auger@redhat.com>
8
Indirect leak of 288 byte(s) in 6 object(s) allocated from:
10
Tested-by: Feng Kan <fkan@apm.com>
9
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
Reviewed-by: Andrew Jones <drjones@redhat.com>
10
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
11
#2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
12
#3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
13
#4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
14
#5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
15
#6 0xaaabf57415e8 in a10_pit_init /qemu/hw/timer/allwinner-a10-pit.c:278
16
#7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
17
#8 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
18
#9 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
19
#10 0xaaabf5b94680 in aw_a10_init /qemu/hw/arm/allwinner-a10.c:49
20
#11 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
21
#12 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
22
23
Reported-by: Euler Robot <euler.robot@huawei.com>
24
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
25
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
26
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
27
---
15
include/hw/pci-host/gpex.h | 3 +++
28
hw/timer/allwinner-a10-pit.c | 11 +++++++++++
16
hw/pci-host/gpex.c | 10 ++++++++++
29
1 file changed, 11 insertions(+)
17
2 files changed, 13 insertions(+)
18
30
19
diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
31
diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
20
index XXXXXXX..XXXXXXX 100644
32
index XXXXXXX..XXXXXXX 100644
21
--- a/include/hw/pci-host/gpex.h
33
--- a/hw/timer/allwinner-a10-pit.c
22
+++ b/include/hw/pci-host/gpex.h
34
+++ b/hw/timer/allwinner-a10-pit.c
23
@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
35
@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
24
MemoryRegion io_ioport;
36
}
25
MemoryRegion io_mmio;
37
}
26
qemu_irq irq[GPEX_NUM_IRQS];
38
27
+ int irq_num[GPEX_NUM_IRQS];
39
+static void a10_pit_finalize(Object *obj)
28
} GPEXHost;
40
+{
29
41
+ AwA10PITState *s = AW_A10_PIT(obj);
30
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
42
+ int i;
31
+
43
+
32
#endif /* HW_GPEX_H */
44
+ for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
33
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
45
+ ptimer_free(s->timer[i]);
34
index XXXXXXX..XXXXXXX 100644
35
--- a/hw/pci-host/gpex.c
36
+++ b/hw/pci-host/gpex.c
37
@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
38
qemu_set_irq(s->irq[irq_num], level);
39
}
40
41
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
42
+{
43
+ if (index >= GPEX_NUM_IRQS) {
44
+ return -EINVAL;
45
+ }
46
+ }
46
+
47
+ s->irq_num[index] = gsi;
48
+ return 0;
49
+}
47
+}
50
+
48
+
51
static void gpex_host_realize(DeviceState *dev, Error **errp)
49
static void a10_pit_class_init(ObjectClass *klass, void *data)
52
{
50
{
53
PCIHostState *pci = PCI_HOST_BRIDGE(dev);
51
DeviceClass *dc = DEVICE_CLASS(klass);
52
@@ -XXX,XX +XXX,XX @@ static const TypeInfo a10_pit_info = {
53
.parent = TYPE_SYS_BUS_DEVICE,
54
.instance_size = sizeof(AwA10PITState),
55
.instance_init = a10_pit_init,
56
+ .instance_finalize = a10_pit_finalize,
57
.class_init = a10_pit_class_init,
58
};
59
54
--
60
--
55
2.7.4
61
2.20.1
56
62
57
63
diff view generated by jsdifflib
1
From: Alistair Francis <alistair.francis@xilinx.com>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
Add a machine level virtualization property. This defaults to false and can be
3
When running device-introspect-test, a memory leak occurred in the
4
set to true using this machine command line argument:
4
exynos4210_rtc_init function, so use ptimer_free() in the finalize function to
5
-machine xlnx-zcu102,virtualization=on
5
avoid it.
6
6
7
This follows what the ARM virt machine does.
7
ASAN shows memory leak stack:
8
8
9
This property only applies to the ZCU102 machine. The EP108 machine does
9
Indirect leak of 96 byte(s) in 1 object(s) allocated from:
10
not have this property.
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf57b3934 in exynos4210_rtc_init /qemu/hw/rtc/exynos4210_rtc.c:567
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
16
#6 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
17
#7 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
18
#8 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
19
#9 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
20
#10 0xaaabf6552708 in aio_bh_poll /qemu/util/async.c:164
21
#11 0xaaabf655f19c in aio_dispatch /qemu/util/aio-posix.c:381
22
#12 0xaaabf65523f4 in aio_ctx_dispatch /qemu/util/async.c:306
11
23
12
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
24
Reported-by: Euler Robot <euler.robot@huawei.com>
13
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
---
28
---
16
include/hw/arm/xlnx-zynqmp.h | 2 ++
29
hw/rtc/exynos4210_rtc.c | 9 +++++++++
17
hw/arm/xlnx-zcu102.c | 30 +++++++++++++++++++++++++++++-
30
1 file changed, 9 insertions(+)
18
hw/arm/xlnx-zynqmp.c | 3 ++-
19
3 files changed, 33 insertions(+), 2 deletions(-)
20
31
21
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
32
diff --git a/hw/rtc/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
22
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
23
--- a/include/hw/arm/xlnx-zynqmp.h
34
--- a/hw/rtc/exynos4210_rtc.c
24
+++ b/include/hw/arm/xlnx-zynqmp.h
35
+++ b/hw/rtc/exynos4210_rtc.c
25
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
36
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
26
37
sysbus_init_mmio(dev, &s->iomem);
27
/* Has the ARM Security extensions? */
28
bool secure;
29
+ /* Has the ARM Virtualization extensions? */
30
+ bool virt;
31
/* Has the RPU subsystem? */
32
bool has_rpu;
33
} XlnxZynqMPState;
34
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
35
index XXXXXXX..XXXXXXX 100644
36
--- a/hw/arm/xlnx-zcu102.c
37
+++ b/hw/arm/xlnx-zcu102.c
38
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
39
MemoryRegion ddr_ram;
40
41
bool secure;
42
+ bool virt;
43
} XlnxZCU102;
44
45
#define TYPE_ZCU102_MACHINE MACHINE_TYPE_NAME("xlnx-zcu102")
46
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
47
s->secure = value;
48
}
38
}
49
39
50
+static bool zcu102_get_virt(Object *obj, Error **errp)
40
+static void exynos4210_rtc_finalize(Object *obj)
51
+{
41
+{
52
+ XlnxZCU102 *s = ZCU102_MACHINE(obj);
42
+ Exynos4210RTCState *s = EXYNOS4210_RTC(obj);
53
+
43
+
54
+ return s->virt;
44
+ ptimer_free(s->ptimer);
45
+ ptimer_free(s->ptimer_1Hz);
55
+}
46
+}
56
+
47
+
57
+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
48
static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
58
+{
59
+ XlnxZCU102 *s = ZCU102_MACHINE(obj);
60
+
61
+ s->virt = value;
62
+}
63
+
64
static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
65
{
49
{
66
int i;
50
DeviceClass *dc = DEVICE_CLASS(klass);
67
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
51
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_rtc_info = {
68
"ddr-ram", &error_abort);
52
.parent = TYPE_SYS_BUS_DEVICE,
69
object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
53
.instance_size = sizeof(Exynos4210RTCState),
70
&error_fatal);
54
.instance_init = exynos4210_rtc_init,
71
+ object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
55
+ .instance_finalize = exynos4210_rtc_finalize,
72
+ &error_fatal);
56
.class_init = exynos4210_rtc_class_init,
73
57
};
74
object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
58
75
76
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
77
{
78
XlnxZCU102 *s = EP108_MACHINE(obj);
79
80
- /* EP108, we don't support setting secure */
81
+ /* EP108, we don't support setting secure or virt */
82
s->secure = false;
83
+ s->virt = false;
84
}
85
86
static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
87
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
88
"Set on/off to enable/disable the ARM "
89
"Security Extensions (TrustZone)",
90
NULL);
91
+
92
+ /* Default to virt (EL2) being disabled */
93
+ s->virt = false;
94
+ object_property_add_bool(obj, "virtualization", zcu102_get_virt,
95
+ zcu102_set_virt, NULL);
96
+ object_property_set_description(obj, "virtualization",
97
+ "Set on/off to enable/disable emulating a "
98
+ "guest CPU which implements the ARM "
99
+ "Virtualization Extensions",
100
+ NULL);
101
}
102
103
static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
104
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
105
index XXXXXXX..XXXXXXX 100644
106
--- a/hw/arm/xlnx-zynqmp.c
107
+++ b/hw/arm/xlnx-zynqmp.c
108
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
109
object_property_set_bool(OBJECT(&s->apu_cpu[i]),
110
s->secure, "has_el3", NULL);
111
object_property_set_bool(OBJECT(&s->apu_cpu[i]),
112
- false, "has_el2", NULL);
113
+ s->virt, "has_el2", NULL);
114
object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
115
"reset-cbar", &error_abort);
116
object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
117
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
118
static Property xlnx_zynqmp_props[] = {
119
DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
120
DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
121
+ DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
122
DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
123
DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
124
MemoryRegion *),
125
--
59
--
126
2.7.4
60
2.20.1
127
61
128
62
diff view generated by jsdifflib
1
From: Alistair Francis <alistair.francis@xilinx.com>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
Add a machine level secure property. This defaults to false and can be
3
When running device-introspect-test, a memory leak occurred in the
4
set to true using this machine command line argument:
4
exynos4210_pwm_init function, so use ptimer_free() in the finalize function to
5
-machine xlnx-zcu102,secure=on
5
avoid it.
6
6
7
This follows what the ARM virt machine does.
7
ASAN shows memory leak stack:
8
8
9
This property only applies to the ZCU102 machine. The EP108 machine does
9
Indirect leak of 240 byte(s) in 5 object(s) allocated from:
10
not have this property.
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
13
#3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
14
#4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
15
#5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
16
#6 0xaaabf56a36cc in exynos4210_pwm_init /qemu/hw/timer/exynos4210_pwm.c:401
17
#7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
18
#8 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
19
#9 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
20
#10 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
21
#11 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
22
#12 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
11
23
12
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
24
Reported-by: Euler Robot <euler.robot@huawei.com>
13
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
---
28
---
16
hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++
29
hw/timer/exynos4210_pwm.c | 11 +++++++++++
17
1 file changed, 32 insertions(+)
30
1 file changed, 11 insertions(+)
18
31
19
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
32
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
20
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
21
--- a/hw/arm/xlnx-zcu102.c
34
--- a/hw/timer/exynos4210_pwm.c
22
+++ b/hw/arm/xlnx-zcu102.c
35
+++ b/hw/timer/exynos4210_pwm.c
23
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
36
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_init(Object *obj)
24
37
sysbus_init_mmio(dev, &s->iomem);
25
XlnxZynqMPState soc;
38
}
26
MemoryRegion ddr_ram;
39
40
+static void exynos4210_pwm_finalize(Object *obj)
41
+{
42
+ Exynos4210PWMState *s = EXYNOS4210_PWM(obj);
43
+ int i;
27
+
44
+
28
+ bool secure;
45
+ for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
29
} XlnxZCU102;
46
+ ptimer_free(s->timer[i].ptimer);
30
47
+ }
31
#define TYPE_ZCU102_MACHINE MACHINE_TYPE_NAME("xlnx-zcu102")
32
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
33
34
static struct arm_boot_info xlnx_zcu102_binfo;
35
36
+static bool zcu102_get_secure(Object *obj, Error **errp)
37
+{
38
+ XlnxZCU102 *s = ZCU102_MACHINE(obj);
39
+
40
+ return s->secure;
41
+}
48
+}
42
+
49
+
43
+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
50
static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
44
+{
45
+ XlnxZCU102 *s = ZCU102_MACHINE(obj);
46
+
47
+ s->secure = value;
48
+}
49
+
50
static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
51
{
51
{
52
int i;
52
DeviceClass *dc = DEVICE_CLASS(klass);
53
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
53
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_pwm_info = {
54
54
.parent = TYPE_SYS_BUS_DEVICE,
55
object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
55
.instance_size = sizeof(Exynos4210PWMState),
56
"ddr-ram", &error_abort);
56
.instance_init = exynos4210_pwm_init,
57
+ object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
57
+ .instance_finalize = exynos4210_pwm_finalize,
58
+ &error_fatal);
58
.class_init = exynos4210_pwm_class_init,
59
59
};
60
object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
60
61
62
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
63
64
static void xlnx_ep108_machine_instance_init(Object *obj)
65
{
66
+ XlnxZCU102 *s = EP108_MACHINE(obj);
67
+
68
+ /* EP108, we don't support setting secure */
69
+ s->secure = false;
70
}
71
72
static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
73
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
74
75
static void xlnx_zcu102_machine_instance_init(Object *obj)
76
{
77
+ XlnxZCU102 *s = ZCU102_MACHINE(obj);
78
+
79
+ /* Default to secure mode being disabled */
80
+ s->secure = false;
81
+ object_property_add_bool(obj, "secure", zcu102_get_secure,
82
+ zcu102_set_secure, NULL);
83
+ object_property_set_description(obj, "secure",
84
+ "Set on/off to enable/disable the ARM "
85
+ "Security Extensions (TrustZone)",
86
+ NULL);
87
}
88
89
static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
90
--
61
--
91
2.7.4
62
2.20.1
92
63
93
64
diff view generated by jsdifflib
1
From: Alistair Francis <alistair.francis@xilinx.com>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
The EP108 is a early access development board. Now that silicon is in
3
When running device-introspect-test, a memory leak occurred in the
4
production people have access to the ZCU102. Let's rename the internal
4
mss_timer_init function, so use ptimer_free() in the finalize function to avoid
5
QEMU files and variables to use the ZCU102.
5
it.
6
6
7
There is no functional change here as the EP108 is still a valid board
7
ASAN shows memory leak stack:
8
option.
9
8
10
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
9
Indirect leak of 192 byte(s) in 2 object(s) allocated from:
11
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf58a0010 in mss_timer_init /qemu/hw/timer/mss-timer.c:235
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
16
#6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
17
#7 0xaaabf5b8316c in m2sxxx_soc_initfn /qemu/hw/arm/msf2-soc.c:70
18
#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
19
#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
20
#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
21
#11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
22
#12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
28
---
14
hw/arm/Makefile.objs | 2 +-
29
hw/timer/mss-timer.c | 13 +++++++++++++
15
hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
30
1 file changed, 13 insertions(+)
16
2 files changed, 16 insertions(+), 16 deletions(-)
17
rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)
18
31
19
diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
32
diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
20
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
21
--- a/hw/arm/Makefile.objs
34
--- a/hw/timer/mss-timer.c
22
+++ b/hw/arm/Makefile.objs
35
+++ b/hw/timer/mss-timer.c
23
@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
36
@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)
24
obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
37
sysbus_init_mmio(SYS_BUS_DEVICE(obj), &t->mmio);
25
obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
26
obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
27
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
28
+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
29
obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
30
obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
31
obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
32
diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
33
similarity index 85%
34
rename from hw/arm/xlnx-ep108.c
35
rename to hw/arm/xlnx-zcu102.c
36
index XXXXXXX..XXXXXXX 100644
37
--- a/hw/arm/xlnx-ep108.c
38
+++ b/hw/arm/xlnx-zcu102.c
39
@@ -XXX,XX +XXX,XX @@
40
/*
41
- * Xilinx ZynqMP EP108 board
42
+ * Xilinx ZynqMP ZCU102 board
43
*
44
* Copyright (C) 2015 Xilinx Inc
45
* Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
46
@@ -XXX,XX +XXX,XX @@
47
#include "exec/address-spaces.h"
48
#include "qemu/log.h"
49
50
-typedef struct XlnxEP108 {
51
+typedef struct XlnxZCU102 {
52
XlnxZynqMPState soc;
53
MemoryRegion ddr_ram;
54
-} XlnxEP108;
55
+} XlnxZCU102;
56
57
-static struct arm_boot_info xlnx_ep108_binfo;
58
+static struct arm_boot_info xlnx_zcu102_binfo;
59
60
-static void xlnx_ep108_init(MachineState *machine)
61
+static void xlnx_zcu102_init(MachineState *machine)
62
{
63
- XlnxEP108 *s = g_new0(XlnxEP108, 1);
64
+ XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
65
int i;
66
uint64_t ram_size = machine->ram_size;
67
68
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
69
}
70
71
if (ram_size < 0x08000000) {
72
- qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
73
+ qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
74
ram_size);
75
}
76
77
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
78
79
/* TODO create and connect IDE devices for ide_drive_get() */
80
81
- xlnx_ep108_binfo.ram_size = ram_size;
82
- xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
83
- xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
84
- xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
85
- xlnx_ep108_binfo.loader_start = 0;
86
- arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
87
+ xlnx_zcu102_binfo.ram_size = ram_size;
88
+ xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
89
+ xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
90
+ xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
91
+ xlnx_zcu102_binfo.loader_start = 0;
92
+ arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
93
}
38
}
94
39
95
static void xlnx_ep108_machine_init(MachineClass *mc)
40
+static void mss_timer_finalize(Object *obj)
96
{
41
+{
97
mc->desc = "Xilinx ZynqMP EP108 board";
42
+ MSSTimerState *t = MSS_TIMER(obj);
98
- mc->init = xlnx_ep108_init;
43
+ int i;
99
+ mc->init = xlnx_zcu102_init;
44
+
100
mc->block_default_type = IF_IDE;
45
+ for (i = 0; i < NUM_TIMERS; i++) {
101
mc->units_per_default_bus = 1;
46
+ struct Msf2Timer *st = &t->timers[i];
102
mc->ignore_memory_transaction_failures = true;
47
+
103
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
48
+ ptimer_free(st->ptimer);
104
static void xlnx_zcu102_machine_init(MachineClass *mc)
49
+ }
105
{
50
+}
106
mc->desc = "Xilinx ZynqMP ZCU102 board";
51
+
107
- mc->init = xlnx_ep108_init;
52
static const VMStateDescription vmstate_timers = {
108
+ mc->init = xlnx_zcu102_init;
53
.name = "mss-timer-block",
109
mc->block_default_type = IF_IDE;
54
.version_id = 1,
110
mc->units_per_default_bus = 1;
55
@@ -XXX,XX +XXX,XX @@ static const TypeInfo mss_timer_info = {
111
mc->ignore_memory_transaction_failures = true;
56
.parent = TYPE_SYS_BUS_DEVICE,
57
.instance_size = sizeof(MSSTimerState),
58
.instance_init = mss_timer_init,
59
+ .instance_finalize = mss_timer_finalize,
60
.class_init = mss_timer_class_init,
61
};
62
112
--
63
--
113
2.7.4
64
2.20.1
114
65
115
66
diff view generated by jsdifflib
1
From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
Now we are able to retrieve the gsi from the INTx pin, let's
3
When running device-introspect-test, a memory leak occurred in the
4
enable intx_to_irq routing. From that point on, irqfd becomes
4
mv88w8618_pit_init function, so use ptimer_free() in the finalize function to
5
usable along with INTx when assigning a PCIe device.
5
avoid it.
6
6
7
Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
7
ASAN shows memory leak stack:
8
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
8
9
Signed-off-by: Eric Auger <eric.auger@redhat.com>
9
Indirect leak of 192 byte(s) in 4 object(s) allocated from:
10
Reviewed-by: Andrew Jones <drjones@redhat.com>
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
Tested-by: Feng Kan <fkan@apm.com>
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
12
#2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
13
#3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
14
#4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
15
#5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
16
#6 0xaaabf5bb2290 in mv88w8618_timer_init /qemu/hw/arm/musicpal.c:862
17
#7 0xaaabf5bb2290 in mv88w8618_pit_init /qemu/hw/arm/musicpal.c:954
18
#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
19
#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
20
#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
21
#11 0xaaabf5a95540 in qdev_device_help /qemu/softmmu/qdev-monitor.c:283
22
#12 0xaaabf5a96940 in qmp_device_add /qemu/softmmu/qdev-monitor.c:801
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
28
---
15
hw/pci-host/gpex.c | 12 ++++++++++++
29
hw/arm/musicpal.c | 12 ++++++++++++
16
1 file changed, 12 insertions(+)
30
1 file changed, 12 insertions(+)
17
31
18
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
32
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
19
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
20
--- a/hw/pci-host/gpex.c
34
--- a/hw/arm/musicpal.c
21
+++ b/hw/pci-host/gpex.c
35
+++ b/hw/arm/musicpal.c
22
@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
36
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_init(Object *obj)
23
return 0;
37
sysbus_init_mmio(dev, &s->iomem);
24
}
38
}
25
39
26
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
40
+static void mv88w8618_pit_finalize(Object *obj)
27
+{
41
+{
28
+ PCIINTxRoute route;
42
+ SysBusDevice *dev = SYS_BUS_DEVICE(obj);
29
+ GPEXHost *s = opaque;
43
+ mv88w8618_pit_state *s = MV88W8618_PIT(dev);
44
+ int i;
30
+
45
+
31
+ route.mode = PCI_INTX_ENABLED;
46
+ for (i = 0; i < 4; i++) {
32
+ route.irq = s->irq_num[pin];
47
+ ptimer_free(s->timer[i].ptimer);
33
+
48
+ }
34
+ return route;
35
+}
49
+}
36
+
50
+
37
static void gpex_host_realize(DeviceState *dev, Error **errp)
51
static const VMStateDescription mv88w8618_timer_vmsd = {
38
{
52
.name = "timer",
39
PCIHostState *pci = PCI_HOST_BRIDGE(dev);
53
.version_id = 1,
40
@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
54
@@ -XXX,XX +XXX,XX @@ static const TypeInfo mv88w8618_pit_info = {
41
&s->io_ioport, 0, 4, TYPE_PCIE_BUS);
55
.parent = TYPE_SYS_BUS_DEVICE,
42
56
.instance_size = sizeof(mv88w8618_pit_state),
43
qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
57
.instance_init = mv88w8618_pit_init,
44
+ pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
58
+ .instance_finalize = mv88w8618_pit_finalize,
45
qdev_init_nofail(DEVICE(&s->gpex_root));
59
.class_init = mv88w8618_pit_class_init,
46
}
60
};
47
61
48
--
62
--
49
2.7.4
63
2.20.1
50
64
51
65
diff view generated by jsdifflib
1
From: Alistair Francis <alistair.francis@xilinx.com>
1
From: Gan Qixin <ganqixin@huawei.com>
2
2
3
In preperation for future work let's manually create the Xilnx machines.
3
When running device-introspect-test, a memory leak occurred in the
4
This will allow us to set properties for the machines in the future.
4
exynos4210_mct_init function, so use ptimer_free() in the finalize function to
5
avoid it.
5
6
6
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
7
ASAN shows memory leak stack:
7
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
8
9
Indirect leak of 96 byte(s) in 1 object(s) allocated from:
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf56b01a0 in exynos4210_mct_init /qemu/hw/timer/exynos4210_mct.c:1505
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
16
#6 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
17
#7 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
18
#8 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
19
#9 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
20
#10 0xaaabf6552708 in aio_bh_poll /qemu/util/async.c:164
21
#11 0xaaabf655f19c in aio_dispatch /qemu/util/aio-posix.c:381
22
#12 0xaaabf65523f4 in aio_ctx_dispatch /qemu/util/async.c:306
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
28
---
10
hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
29
hw/timer/exynos4210_mct.c | 14 ++++++++++++++
11
1 file changed, 67 insertions(+), 7 deletions(-)
30
1 file changed, 14 insertions(+)
12
31
13
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
32
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
14
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
15
--- a/hw/arm/xlnx-zcu102.c
34
--- a/hw/timer/exynos4210_mct.c
16
+++ b/hw/arm/xlnx-zcu102.c
35
+++ b/hw/timer/exynos4210_mct.c
17
@@ -XXX,XX +XXX,XX @@
36
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
18
#include "qemu/log.h"
37
sysbus_init_mmio(dev, &s->iomem);
19
38
}
20
typedef struct XlnxZCU102 {
39
21
+ MachineState parent_obj;
40
+static void exynos4210_mct_finalize(Object *obj)
41
+{
42
+ int i;
43
+ Exynos4210MCTState *s = EXYNOS4210_MCT(obj);
22
+
44
+
23
XlnxZynqMPState soc;
45
+ ptimer_free(s->g_timer.ptimer_frc);
24
MemoryRegion ddr_ram;
25
} XlnxZCU102;
26
27
+#define TYPE_ZCU102_MACHINE MACHINE_TYPE_NAME("xlnx-zcu102")
28
+#define ZCU102_MACHINE(obj) \
29
+ OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
30
+
46
+
31
+#define TYPE_EP108_MACHINE MACHINE_TYPE_NAME("xlnx-ep108")
47
+ for (i = 0; i < 2; i++) {
32
+#define EP108_MACHINE(obj) \
48
+ ptimer_free(s->l_timer[i].tick_timer.ptimer_tick);
33
+ OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
49
+ ptimer_free(s->l_timer[i].ptimer_frc);
34
+
50
+ }
35
static struct arm_boot_info xlnx_zcu102_binfo;
36
37
-static void xlnx_zcu102_init(MachineState *machine)
38
+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
39
{
40
- XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
41
int i;
42
uint64_t ram_size = machine->ram_size;
43
44
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
45
arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
46
}
47
48
-static void xlnx_ep108_machine_init(MachineClass *mc)
49
+static void xlnx_ep108_init(MachineState *machine)
50
+{
51
+ XlnxZCU102 *s = EP108_MACHINE(machine);
52
+
53
+ xlnx_zynqmp_init(s, machine);
54
+}
51
+}
55
+
52
+
56
+static void xlnx_ep108_machine_instance_init(Object *obj)
53
static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
57
{
54
{
58
+}
55
DeviceClass *dc = DEVICE_CLASS(klass);
59
+
56
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_mct_info = {
60
+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
57
.parent = TYPE_SYS_BUS_DEVICE,
61
+{
58
.instance_size = sizeof(Exynos4210MCTState),
62
+ MachineClass *mc = MACHINE_CLASS(oc);
59
.instance_init = exynos4210_mct_init,
63
+
60
+ .instance_finalize = exynos4210_mct_finalize,
64
mc->desc = "Xilinx ZynqMP EP108 board";
61
.class_init = exynos4210_mct_class_init,
65
- mc->init = xlnx_zcu102_init;
62
};
66
+ mc->init = xlnx_ep108_init;
63
67
mc->block_default_type = IF_IDE;
68
mc->units_per_default_bus = 1;
69
mc->ignore_memory_transaction_failures = true;
70
}
71
72
-DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
73
+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
74
+ .name = MACHINE_TYPE_NAME("xlnx-ep108"),
75
+ .parent = TYPE_MACHINE,
76
+ .class_init = xlnx_ep108_machine_class_init,
77
+ .instance_init = xlnx_ep108_machine_instance_init,
78
+ .instance_size = sizeof(XlnxZCU102),
79
+};
80
81
-static void xlnx_zcu102_machine_init(MachineClass *mc)
82
+static void xlnx_ep108_machine_init_register_types(void)
83
{
84
+ type_register_static(&xlnx_ep108_machine_init_typeinfo);
85
+}
86
+
87
+static void xlnx_zcu102_init(MachineState *machine)
88
+{
89
+ XlnxZCU102 *s = ZCU102_MACHINE(machine);
90
+
91
+ xlnx_zynqmp_init(s, machine);
92
+}
93
+
94
+static void xlnx_zcu102_machine_instance_init(Object *obj)
95
+{
96
+}
97
+
98
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
99
+{
100
+ MachineClass *mc = MACHINE_CLASS(oc);
101
+
102
mc->desc = "Xilinx ZynqMP ZCU102 board";
103
mc->init = xlnx_zcu102_init;
104
mc->block_default_type = IF_IDE;
105
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
106
mc->ignore_memory_transaction_failures = true;
107
}
108
109
-DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
110
+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
111
+ .name = MACHINE_TYPE_NAME("xlnx-zcu102"),
112
+ .parent = TYPE_MACHINE,
113
+ .class_init = xlnx_zcu102_machine_class_init,
114
+ .instance_init = xlnx_zcu102_machine_instance_init,
115
+ .instance_size = sizeof(XlnxZCU102),
116
+};
117
+
118
+static void xlnx_zcu102_machine_init_register_types(void)
119
+{
120
+ type_register_static(&xlnx_zcu102_machine_init_typeinfo);
121
+}
122
+
123
+type_init(xlnx_zcu102_machine_init_register_types)
124
+type_init(xlnx_ep108_machine_init_register_types)
125
--
64
--
126
2.7.4
65
2.20.1
127
66
128
67
diff view generated by jsdifflib
1
Fix an error that meant we were wiring every UART's overflow
1
From: Bin Meng <bin.meng@windriver.com>
2
interrupts into the same inputs 0 and 1 of the OR gate,
3
rather than giving each its own input.
4
2
5
Cc: qemu-stable@nongnu.org
3
U-Boot expects PMU_MISC0 register bit 7 is set (see init_bandgap()
4
in arch/arm/mach-imx/mx6/soc.c) during boot. This bit indicates the
5
bandgap has stabilized.
6
7
With this change, the latest upstream U-Boot (v2021.01-rc3) for imx6
8
sabrelite board (mx6qsabrelite_defconfig), with a slight change made
9
by switching CONFIG_OF_SEPARATE to CONFIG_OF_EMBED, boots to U-Boot
10
shell on QEMU with the following command:
11
12
$ qemu-system-arm -M sabrelite -smp 4 -m 1G -kernel u-boot \
13
-display none -serial null -serial stdio
14
15
Boot log below:
16
17
U-Boot 2021.01-rc3 (Dec 12 2020 - 17:40:02 +0800)
18
19
CPU: Freescale i.MX?? rev1.0 at 792 MHz
20
Reset cause: POR
21
Model: Freescale i.MX6 Quad SABRE Lite Board
22
Board: SABRE Lite
23
I2C: ready
24
DRAM: 1 GiB
25
force_idle_bus: sda=0 scl=0 sda.gp=0x5c scl.gp=0x55
26
force_idle_bus: failed to clear bus, sda=0 scl=0
27
force_idle_bus: sda=0 scl=0 sda.gp=0x6d scl.gp=0x6c
28
force_idle_bus: failed to clear bus, sda=0 scl=0
29
force_idle_bus: sda=0 scl=0 sda.gp=0xcb scl.gp=0x5
30
force_idle_bus: failed to clear bus, sda=0 scl=0
31
MMC: FSL_SDHC: 0, FSL_SDHC: 1
32
Loading Environment from MMC... *** Warning - No block device, using default environment
33
34
In: serial
35
Out: serial
36
Err: serial
37
Net: Board Net Initialization Failed
38
No ethernet found.
39
starting USB...
40
Bus usb@2184000: usb dr_mode not found
41
USB EHCI 1.00
42
Bus usb@2184200: USB EHCI 1.00
43
scanning bus usb@2184000 for devices... 1 USB Device(s) found
44
scanning bus usb@2184200 for devices... 1 USB Device(s) found
45
scanning usb for storage devices... 0 Storage Device(s) found
46
scanning usb for ethernet devices... 0 Ethernet Device(s) found
47
Hit any key to stop autoboot: 0
48
=>
49
50
Signed-off-by: Bin Meng <bin.meng@windriver.com>
51
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
52
Message-id: 20210106063504.10841-2-bmeng.cn@gmail.com
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
53
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
8
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
9
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
10
---
54
---
11
hw/arm/mps2.c | 4 ++--
55
hw/misc/imx6_ccm.c | 2 +-
12
1 file changed, 2 insertions(+), 2 deletions(-)
56
1 file changed, 1 insertion(+), 1 deletion(-)
13
57
14
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
58
diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
15
index XXXXXXX..XXXXXXX 100644
59
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/arm/mps2.c
60
--- a/hw/misc/imx6_ccm.c
17
+++ b/hw/arm/mps2.c
61
+++ b/hw/misc/imx6_ccm.c
18
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
62
@@ -XXX,XX +XXX,XX @@ static void imx6_ccm_reset(DeviceState *dev)
19
cmsdk_apb_uart_create(uartbase[i],
63
s->analog[PMU_REG_3P0] = 0x00000F74;
20
qdev_get_gpio_in(txrx_orgate_dev, 0),
64
s->analog[PMU_REG_2P5] = 0x00005071;
21
qdev_get_gpio_in(txrx_orgate_dev, 1),
65
s->analog[PMU_REG_CORE] = 0x00402010;
22
- qdev_get_gpio_in(orgate_dev, 0),
66
- s->analog[PMU_MISC0] = 0x04000000;
23
- qdev_get_gpio_in(orgate_dev, 1),
67
+ s->analog[PMU_MISC0] = 0x04000080;
24
+ qdev_get_gpio_in(orgate_dev, i * 2),
68
s->analog[PMU_MISC1] = 0x00000000;
25
+ qdev_get_gpio_in(orgate_dev, i * 2 + 1),
69
s->analog[PMU_MISC2] = 0x00272727;
26
NULL,
70
27
uartchr, SYSCLK_FRQ);
28
}
29
--
71
--
30
2.7.4
72
2.20.1
31
73
32
74
diff view generated by jsdifflib
1
From: Alistair Francis <alistair.francis@xilinx.com>
1
From: Bin Meng <bin.meng@windriver.com>
2
2
3
The EP108 is the same as the ZCU102, mark it as deprecated as we don't
3
Currently when U-Boot boots, it prints "??" for i.MX processor:
4
need two machines.
5
4
6
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
5
CPU: Freescale i.MX?? rev1.0 at 792 MHz
7
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
6
7
The register that was used to determine the silicon type is
8
undocumented in the latest IMX6DQRM (Rev. 6, 05/2020), but we
9
can refer to get_cpu_rev() in arch/arm/mach-imx/mx6/soc.c in
10
the U-Boot source codes that USB_ANALOG_DIGPROG is used.
11
12
Update its reset value to indicate i.MX6Q.
13
14
Signed-off-by: Bin Meng <bin.meng@windriver.com>
15
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
16
Message-id: 20210106063504.10841-3-bmeng.cn@gmail.com
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
18
---
10
hw/arm/xlnx-zcu102.c | 2 +-
19
hw/misc/imx6_ccm.c | 2 +-
11
1 file changed, 1 insertion(+), 1 deletion(-)
20
1 file changed, 1 insertion(+), 1 deletion(-)
12
21
13
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
22
diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
14
index XXXXXXX..XXXXXXX 100644
23
index XXXXXXX..XXXXXXX 100644
15
--- a/hw/arm/xlnx-zcu102.c
24
--- a/hw/misc/imx6_ccm.c
16
+++ b/hw/arm/xlnx-zcu102.c
25
+++ b/hw/misc/imx6_ccm.c
17
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
26
@@ -XXX,XX +XXX,XX @@ static void imx6_ccm_reset(DeviceState *dev)
18
{
27
s->analog[USB_ANALOG_USB2_VBUS_DETECT] = 0x00000004;
19
MachineClass *mc = MACHINE_CLASS(oc);
28
s->analog[USB_ANALOG_USB2_CHRG_DETECT] = 0x00000000;
20
29
s->analog[USB_ANALOG_USB2_MISC] = 0x00000002;
21
- mc->desc = "Xilinx ZynqMP EP108 board";
30
- s->analog[USB_ANALOG_DIGPROG] = 0x00000000;
22
+ mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
31
+ s->analog[USB_ANALOG_DIGPROG] = 0x00630000;
23
mc->init = xlnx_ep108_init;
32
24
mc->block_default_type = IF_IDE;
33
/* all PLLs need to be locked */
25
mc->units_per_default_bus = 1;
34
s->analog[CCM_ANALOG_PLL_ARM] |= CCM_ANALOG_PLL_LOCK;
26
--
35
--
27
2.7.4
36
2.20.1
28
37
29
38
diff view generated by jsdifflib
1
From: Jaroslaw Pelczar <j.pelczar@samsung.com>
1
From: Bin Meng <bin.meng@windriver.com>
2
2
3
Previously when single stepping through ERET instruction via GDB
3
At present, when booting U-Boot on QEMU sabrelite, we see:
4
would result in debugger entering the "next" PC after ERET instruction.
5
When debugging in kernel mode, this will also cause unintended behavior,
6
because debugger will try to access memory from EL0 point of view.
7
4
8
Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
5
Net: Board Net Initialization Failed
9
Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
6
No ethernet found.
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
7
8
U-Boot scans PHY at address 4/5/6/7 (see board_eth_init() in the
9
U-Boot source: board/boundary/nitrogen6x/nitrogen6x.c). On the real
10
board, the Ethernet PHY is at address 6. Adjust this by updating the
11
"fec-phy-num" property of the fsl_imx6 SoC object.
12
13
With this change, U-Boot sees the PHY but complains MAC address:
14
15
Net: using phy at 6
16
FEC [PRIME]
17
Error: FEC address not set.
18
19
This is due to U-Boot tries to read the MAC address from the fuse,
20
which QEMU does not have any valid content filled in. However this
21
does not prevent the Ethernet from working in QEMU. We just need to
22
set up the MAC address later in the U-Boot command shell, by:
23
24
=> setenv ethaddr 00:11:22:33:44:55
25
26
Signed-off-by: Bin Meng <bin.meng@windriver.com>
27
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
28
Message-id: 20210106063504.10841-4-bmeng.cn@gmail.com
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
29
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
30
---
13
target/arm/translate-a64.c | 1 +
31
hw/arm/sabrelite.c | 4 ++++
14
1 file changed, 1 insertion(+)
32
1 file changed, 4 insertions(+)
15
33
16
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
34
diff --git a/hw/arm/sabrelite.c b/hw/arm/sabrelite.c
17
index XXXXXXX..XXXXXXX 100644
35
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/translate-a64.c
36
--- a/hw/arm/sabrelite.c
19
+++ b/target/arm/translate-a64.c
37
+++ b/hw/arm/sabrelite.c
20
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
38
@@ -XXX,XX +XXX,XX @@ static void sabrelite_init(MachineState *machine)
21
default:
39
22
gen_a64_set_pc_im(dc->pc);
40
s = FSL_IMX6(object_new(TYPE_FSL_IMX6));
23
/* fall through */
41
object_property_add_child(OBJECT(machine), "soc", OBJECT(s));
24
+ case DISAS_EXIT:
42
+
25
case DISAS_JUMP:
43
+ /* Ethernet PHY address is 6 */
26
if (dc->base.singlestep_enabled) {
44
+ object_property_set_int(OBJECT(s), "fec-phy-num", 6, &error_fatal);
27
gen_exception_internal(EXCP_DEBUG);
45
+
46
qdev_realize(DEVICE(s), NULL, &error_fatal);
47
48
memory_region_add_subregion(get_system_memory(), FSL_IMX6_MMDC_ADDR,
28
--
49
--
29
2.7.4
50
2.20.1
30
51
31
52
diff view generated by jsdifflib
1
Use a symbolic constant M_REG_NUM_BANKS for the array size for
1
From: Bin Meng <bin.meng@windriver.com>
2
registers which are banked by M profile security state, rather
3
than hardcoding lots of 2s.
4
2
5
Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
3
This adds the target guide for SABRE Lite board, and documents how
4
to boot a Linux kernel and U-Boot bootloader.
5
6
Signed-off-by: Bin Meng <bin.meng@windriver.com>
7
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
8
Message-id: 20210106063504.10841-5-bmeng.cn@gmail.com
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
8
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
9
Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
10
---
10
---
11
target/arm/cpu.h | 35 +++++++++++++++++++----------------
11
docs/system/arm/sabrelite.rst | 119 ++++++++++++++++++++++++++++++++++
12
1 file changed, 19 insertions(+), 16 deletions(-)
12
docs/system/target-arm.rst | 1 +
13
2 files changed, 120 insertions(+)
14
create mode 100644 docs/system/arm/sabrelite.rst
13
15
14
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
16
diff --git a/docs/system/arm/sabrelite.rst b/docs/system/arm/sabrelite.rst
17
new file mode 100644
18
index XXXXXXX..XXXXXXX
19
--- /dev/null
20
+++ b/docs/system/arm/sabrelite.rst
21
@@ -XXX,XX +XXX,XX @@
22
+Boundary Devices SABRE Lite (``sabrelite``)
23
+===========================================
24
+
25
+Boundary Devices SABRE Lite i.MX6 Development Board is a low-cost development
26
+platform featuring the powerful Freescale / NXP Semiconductor's i.MX 6 Quad
27
+Applications Processor.
28
+
29
+Supported devices
30
+-----------------
31
+
32
+The SABRE Lite machine supports the following devices:
33
+
34
+ * Up to 4 Cortex A9 cores
35
+ * Generic Interrupt Controller
36
+ * 1 Clock Controller Module
37
+ * 1 System Reset Controller
38
+ * 5 UARTs
39
+ * 2 EPIC timers
40
+ * 1 GPT timer
41
+ * 2 Watchdog timers
42
+ * 1 FEC Ethernet controller
43
+ * 3 I2C controllers
44
+ * 7 GPIO controllers
45
+ * 4 SDHC storage controllers
46
+ * 4 USB 2.0 host controllers
47
+ * 5 ECSPI controllers
48
+ * 1 SST 25VF016B flash
49
+
50
+Please note above list is a complete superset the QEMU SABRE Lite machine can
51
+support. For a normal use case, a device tree blob that represents a real world
52
+SABRE Lite board, only exposes a subset of devices to the guest software.
53
+
54
+Boot options
55
+------------
56
+
57
+The SABRE Lite machine can start using the standard -kernel functionality
58
+for loading a Linux kernel, U-Boot bootloader or ELF executable.
59
+
60
+Running Linux kernel
61
+--------------------
62
+
63
+Linux mainline v5.10 release is tested at the time of writing. To build a Linux
64
+mainline kernel that can be booted by the SABRE Lite machine, simply configure
65
+the kernel using the imx_v6_v7_defconfig configuration:
66
+
67
+.. code-block:: bash
68
+
69
+ $ export ARCH=arm
70
+ $ export CROSS_COMPILE=arm-linux-gnueabihf-
71
+ $ make imx_v6_v7_defconfig
72
+ $ make
73
+
74
+To boot the newly built Linux kernel in QEMU with the SABRE Lite machine, use:
75
+
76
+.. code-block:: bash
77
+
78
+ $ qemu-system-arm -M sabrelite -smp 4 -m 1G \
79
+ -display none -serial null -serial stdio \
80
+ -kernel arch/arm/boot/zImage \
81
+ -dtb arch/arm/boot/dts/imx6q-sabrelite.dtb \
82
+ -initrd /path/to/rootfs.ext4 \
83
+ -append "root=/dev/ram"
84
+
85
+Running U-Boot
86
+--------------
87
+
88
+U-Boot mainline v2020.10 release is tested at the time of writing. To build a
89
+U-Boot mainline bootloader that can be booted by the SABRE Lite machine, use
90
+the mx6qsabrelite_defconfig with similar commands as described above for Linux:
91
+
92
+.. code-block:: bash
93
+
94
+ $ export CROSS_COMPILE=arm-linux-gnueabihf-
95
+ $ make mx6qsabrelite_defconfig
96
+
97
+Note we need to adjust settings by:
98
+
99
+.. code-block:: bash
100
+
101
+ $ make menuconfig
102
+
103
+then manually select the following configuration in U-Boot:
104
+
105
+ Device Tree Control > Provider of DTB for DT Control > Embedded DTB
106
+
107
+To start U-Boot using the SABRE Lite machine, provide the u-boot binary to
108
+the -kernel argument, along with an SD card image with rootfs:
109
+
110
+.. code-block:: bash
111
+
112
+ $ qemu-system-arm -M sabrelite -smp 4 -m 1G \
113
+ -display none -serial null -serial stdio \
114
+ -kernel u-boot
115
+
116
+The following example shows booting Linux kernel from dhcp, and uses the
117
+rootfs on an SD card. This requires some additional command line parameters
118
+for QEMU:
119
+
120
+.. code-block:: none
121
+
122
+ -nic user,tftp=/path/to/kernel/zImage \
123
+ -drive file=sdcard.img,id=rootfs -device sd-card,drive=rootfs
124
+
125
+The directory for the built-in TFTP server should also contain the device tree
126
+blob of the SABRE Lite board. The sample SD card image was populated with the
127
+root file system with one single partition. You may adjust the kernel "root="
128
+boot parameter accordingly.
129
+
130
+After U-Boot boots, type the following commands in the U-Boot command shell to
131
+boot the Linux kernel:
132
+
133
+.. code-block:: none
134
+
135
+ => setenv ethaddr 00:11:22:33:44:55
136
+ => setenv bootfile zImage
137
+ => dhcp
138
+ => tftpboot 14000000 imx6q-sabrelite.dtb
139
+ => setenv bootargs root=/dev/mmcblk3p1
140
+ => bootz 12000000 - 14000000
141
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
15
index XXXXXXX..XXXXXXX 100644
142
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/cpu.h
143
--- a/docs/system/target-arm.rst
17
+++ b/target/arm/cpu.h
144
+++ b/docs/system/target-arm.rst
18
@@ -XXX,XX +XXX,XX @@
145
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
19
* accessed via env->registerfield[env->v7m.secure] (whether the security
146
arm/versatile
20
* extension is implemented or not).
147
arm/vexpress
21
*/
148
arm/aspeed
22
-#define M_REG_NS 0
149
+ arm/sabrelite
23
-#define M_REG_S 1
150
arm/digic
24
+enum {
151
arm/musicpal
25
+ M_REG_NS = 0,
152
arm/gumstix
26
+ M_REG_S = 1,
27
+ M_REG_NUM_BANKS = 2,
28
+};
29
30
/* ARM-specific interrupt pending bits. */
31
#define CPU_INTERRUPT_FIQ CPU_INTERRUPT_TGT_EXT_1
32
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
33
uint32_t other_sp;
34
uint32_t other_ss_msp;
35
uint32_t other_ss_psp;
36
- uint32_t vecbase[2];
37
- uint32_t basepri[2];
38
- uint32_t control[2];
39
- uint32_t ccr[2]; /* Configuration and Control */
40
- uint32_t cfsr[2]; /* Configurable Fault Status */
41
+ uint32_t vecbase[M_REG_NUM_BANKS];
42
+ uint32_t basepri[M_REG_NUM_BANKS];
43
+ uint32_t control[M_REG_NUM_BANKS];
44
+ uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
45
+ uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
46
uint32_t hfsr; /* HardFault Status */
47
uint32_t dfsr; /* Debug Fault Status Register */
48
- uint32_t mmfar[2]; /* MemManage Fault Address */
49
+ uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
50
uint32_t bfar; /* BusFault Address */
51
- unsigned mpu_ctrl[2]; /* MPU_CTRL */
52
+ unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
53
int exception;
54
- uint32_t primask[2];
55
- uint32_t faultmask[2];
56
+ uint32_t primask[M_REG_NUM_BANKS];
57
+ uint32_t faultmask[M_REG_NUM_BANKS];
58
uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
59
} v7m;
60
61
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
62
uint32_t *drbar;
63
uint32_t *drsr;
64
uint32_t *dracr;
65
- uint32_t rnr[2];
66
+ uint32_t rnr[M_REG_NUM_BANKS];
67
} pmsav7;
68
69
/* PMSAv8 MPU */
70
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
71
* pmsav7.rnr (region number register)
72
* pmsav7_dregion (number of configured regions)
73
*/
74
- uint32_t *rbar[2];
75
- uint32_t *rlar[2];
76
- uint32_t mair0[2];
77
- uint32_t mair1[2];
78
+ uint32_t *rbar[M_REG_NUM_BANKS];
79
+ uint32_t *rlar[M_REG_NUM_BANKS];
80
+ uint32_t mair0[M_REG_NUM_BANKS];
81
+ uint32_t mair1[M_REG_NUM_BANKS];
82
} pmsav8;
83
84
void *nvic;
85
--
153
--
86
2.7.4
154
2.20.1
87
155
88
156
diff view generated by jsdifflib