Nothing too exciting, but does include the last bits of v8.1M support work.

The following changes since commit e79de63ab1bd1f6550e7b915e433bec1ad1a870a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210107' into staging (2021-01-07 20:34:05 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210108

for you to fetch changes up to c9f8511ea8d2b80723af0fea1f716d752c1b5208:

docs/system: arm: Add sabrelite board description (2021-01-08 15:13:39 +0000)

* intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs

* target/arm: Fix MTE0_ACTIVE

* target/arm: Implement v8.1M and Cortex-M55 model

* hw/arm/highbank: Drop dead KVM support code

* util/qemu-timer: Make timer_free() imply timer_del()

* various devices: Use ptimer_free() in finalize function

* docs/system: arm: Add sabrelite board description

* sabrelite: Minor fixes to allow booting U-Boot

Andrew Jones (1):

hw/arm/virt: Remove virt machine state 'smp_cpus'

Bin Meng (4):

hw/misc: imx6_ccm: Update PMU_MISC0 reset value

hw/msic: imx6_ccm: Correct register value for silicon type

hw/arm: sabrelite: Connect the Ethernet PHY at address 6

docs/system: arm: Add sabrelite board description

Edgar E. Iglesias (1):

intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs

Gan Qixin (7):

digic-timer: Use ptimer_free() in the finalize function to avoid memleaks

allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

exynos4210_rtc: Use ptimer_free() in the finalize function to avoid memleaks

exynos4210_pwm: Use ptimer_free() in the finalize function to avoid memleaks

mss-timer: Use ptimer_free() in the finalize function to avoid memleaks

musicpal: Use ptimer_free() in the finalize function to avoid memleaks

exynos4210_mct: Use ptimer_free() in the finalize function to avoid memleaks

Peter Maydell (9):

hw/intc/armv7m_nvic: Correct handling of CCR.BFHFNMIGN

target/arm: Correct store of FPSCR value via FPCXT_S

target/arm: Implement FPCXT_NS fp system register

target/arm: Implement Cortex-M55 model

hw/arm/highbank: Drop dead KVM support code

util/qemu-timer: Make timer_free() imply timer_del()

scripts/coccinelle: New script to remove unnecessary timer_del() calls

Remove superfluous timer_del() calls

target/arm: Remove timer_del()/timer_deinit() before timer_free()

Richard Henderson (1):

target/arm: Fix MTE0_ACTIVE

docs/system/arm/sabrelite.rst | 119 ++++++++++++++++++++++++++

docs/system/target-arm.rst | 1 +

scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++

include/hw/arm/virt.h | 3 +-

include/qemu/timer.h | 24 +++---

block/iscsi.c | 2 -

block/nbd.c | 1 -

block/qcow2.c | 1 -

hw/arm/highbank.c | 14 +--

hw/arm/musicpal.c | 12 +++

hw/arm/sabrelite.c | 4 +

hw/arm/virt-acpi-build.c | 9 +-

hw/arm/virt.c | 21 +++--

hw/block/nvme.c | 2 -

hw/char/serial.c | 2 -

hw/char/virtio-serial-bus.c | 2 -

hw/ide/core.c | 1 -

hw/input/hid.c | 1 -

hw/intc/apic.c | 1 -

hw/intc/arm_gic.c | 4 +-

hw/intc/armv7m_nvic.c | 15 ++++

hw/intc/ioapic.c | 1 -

hw/ipmi/ipmi_bmc_extern.c | 1 -

hw/misc/imx6_ccm.c | 4 +-

hw/net/e1000.c | 3 -

hw/net/e1000e_core.c | 8 --

hw/net/pcnet-pci.c | 1 -

hw/net/rtl8139.c | 1 -

hw/net/spapr_llan.c | 1 -

hw/net/virtio-net.c | 2 -

hw/rtc/exynos4210_rtc.c | 9 ++

hw/s390x/s390-pci-inst.c | 1 -

hw/sd/sd.c | 1 -

hw/sd/sdhci.c | 2 -

hw/timer/allwinner-a10-pit.c | 11 +++

hw/timer/digic-timer.c | 8 ++

hw/timer/exynos4210_mct.c | 14 +++

hw/timer/exynos4210_pwm.c | 11 +++

hw/timer/mss-timer.c | 13 +++

hw/usb/dev-hub.c | 1 -

hw/usb/hcd-ehci.c | 1 -

hw/usb/hcd-ohci-pci.c | 1 -

hw/usb/hcd-uhci.c | 1 -

hw/usb/hcd-xhci.c | 1 -

hw/usb/redirect.c | 1 -

hw/vfio/display.c | 1 -

hw/virtio/vhost-vsock-common.c | 1 -

hw/virtio/virtio-balloon.c | 1 -

hw/virtio/virtio-rng.c | 1 -

hw/watchdog/wdt_diag288.c | 1 -

hw/watchdog/wdt_i6300esb.c | 1 -

migration/colo.c | 1 -

monitor/hmp-cmds.c | 1 -

net/announce.c | 1 -

net/colo-compare.c | 1 -

net/slirp.c | 1 -

replay/replay-debugging.c | 1 -

target/arm/cpu.c | 2 -

target/arm/cpu_tcg.c | 42 +++++++++

target/arm/helper.c | 2 +-

target/s390x/cpu.c | 2 -

ui/console.c | 1 -

ui/spice-core.c | 1 -

util/throttle.c | 1 -

target/arm/translate-vfp.c.inc | 114 ++++++++++++++++++++++--

65 files changed, 421 insertions(+), 111 deletions(-)

create mode 100644 docs/system/arm/sabrelite.rst

create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Correct the indexing into s->cpu_ctlr for vCPUs.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20201214222154.3480243-2-edgar.iglesias@gmail.com

hw/intc/arm_gic.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c

--- a/hw/intc/arm_gic.c

+++ b/hw/intc/arm_gic.c

@@ -XXX,XX +XXX,XX @@ static inline void gic_get_best_virq(GICState *s, int cpu,

static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,

int group_mask)

+ int cpu_iface = virt ? (cpu + GIC_NCPU) : cpu;

+

if (!virt && !(s->ctlr & group_mask)) {

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

In 50244cc76abc we updated mte_check_fail to match the ARM

pseudocode, using the correct EL to select the TCF field.

But we failed to update MTE0_ACTIVE the same way, which led

to g_assert_not_reached().

Cc: qemu-stable@nongnu.org

Buglink: https://bugs.launchpad.net/bugs/1907137

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201221204426.88514-1-richard.henderson@linaro.org

@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,

if (FIELD_EX32(flags, TBFLAG_A64, UNPRIV)

&& tbid

&& !(env->pstate & PSTATE_TCO)

- && (sctlr & SCTLR_TCF0)

+ && (sctlr & SCTLR_TCF)

&& allocation_tag_access_enabled(env, 0, sctlr)) {

flags = FIELD_DP32(flags, TBFLAG_A64, MTE0_ACTIVE, 1);

}

2.20.1

The CCR is a register most of whose bits are banked between security

states but where BFHFNMIGN is not, and we keep it in the non-secure

entry of the v7m.ccr[] array. The logic which tries to handle this

bit fails to implement the "RAZ/WI from Nonsecure if AIRCR.BFHFNMINS

is zero" requirement; correct the omission.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201210201433.26262-2-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 15 +++++++++++++++

1 file changed, 15 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)

val = cpu->env.v7m.ccr[attrs.secure];

val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;

+ /* BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0 */

+ if (!attrs.secure) {

+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {

+ val &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ }

+ }

return val;

case 0xd24: /* System Handler Control and State (SHCSR) */

if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

(cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)

| (value & R_V7M_CCR_BFHFNMIGN_MASK);

value &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ } else {

+ /*

+ * BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0, so

+ * preserve the state currently in the NS element of the array

+ */

+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {

+ value &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ value |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;

+ }

}

cpu->env.v7m.ccr[attrs.secure] = value;

2.20.1

Implement the v8.1M FPCXT_NS floating-point system register. This is

a little more complicated than FPCXT_S, because it has specific

handling for "current FP state is inactive", and it only wants to do

PreserveFPState(), not the full set of actions done by

ExecuteFPCheck() which vfp_access_check() implements.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201210201433.26262-4-peter.maydell@linaro.org

target/arm/translate-vfp.c.inc | 102 ++++++++++++++++++++++++++++++++-

1 file changed, 99 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc

--- a/target/arm/translate-vfp.c.inc

+++ b/target/arm/translate-vfp.c.inc

@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)

}

break;

case ARM_VFP_FPCXT_S:

+ case ARM_VFP_FPCXT_NS:

if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {

return false;

}

@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)

return FPSysRegCheckFailed;

- if (!vfp_access_check(s)) {

+ /*

+ * FPCXT_NS is a special case: it has specific handling for

+ * "current FP state is inactive", and must do the PreserveFPState()

+ * but not the usual full set of actions done by ExecuteFPCheck().

+ * So we don't call vfp_access_check() and the callers must handle this.

+ */

+ if (regno != ARM_VFP_FPCXT_NS && !vfp_access_check(s)) {

return FPSysRegCheckDone;

-

return FPSysRegCheckContinue;

}

+static void gen_branch_fpInactive(DisasContext *s, TCGCond cond,

+ TCGLabel *label)

+{

+ /*

+ * FPCXT_NS is a special case: it has specific handling for

+ * "current FP state is inactive", and must do the PreserveFPState()

+ * but not the usual full set of actions done by ExecuteFPCheck().

+ * We don't have a TB flag that matches the fpInactive check, so we

+ * do it at runtime as we don't expect FPCXT_NS accesses to be frequent.

+ *

+ * Emit code that checks fpInactive and does a conditional

+ * branch to label based on it:

+ * if cond is TCG_COND_NE then branch if fpInactive != 0 (ie if inactive)

+ * if cond is TCG_COND_EQ then branch if fpInactive == 0 (ie if active)

+ */

+ assert(cond == TCG_COND_EQ || cond == TCG_COND_NE);

+

+ /* fpInactive = FPCCR_NS.ASPEN == 1 && CONTROL.FPCA == 0 */

+ TCGv_i32 aspen, fpca;

+ aspen = load_cpu_field(v7m.fpccr[M_REG_NS]);

+ fpca = load_cpu_field(v7m.control[M_REG_S]);

+ tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);

+ tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);

+ tcg_gen_andi_i32(fpca, fpca, R_V7M_CONTROL_FPCA_MASK);

+ tcg_gen_or_i32(fpca, fpca, aspen);

+ tcg_gen_brcondi_i32(tcg_invert_cond(cond), fpca, 0, label);

+ tcg_temp_free_i32(aspen);

+ tcg_temp_free_i32(fpca);

+}

+

static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

fp_sysreg_loadfn *loadfn,

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

{

/* Do a write to an M-profile floating point system register */

TCGv_i32 tmp;

+ TCGLabel *lab_end = NULL;

switch (fp_sysreg_checks(s, regno)) {

case FPSysRegCheckFailed:

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

tcg_temp_free_i32(tmp);

break;

}

+ case ARM_VFP_FPCXT_NS:

+ lab_end = gen_new_label();

+ /* fpInactive case: write is a NOP, so branch to end */

+ gen_branch_fpInactive(s, TCG_COND_NE, lab_end);

+ /* !fpInactive: PreserveFPState(), and reads same as FPCXT_S */

+ gen_preserve_fp_state(s);

+ /* fall through */

case ARM_VFP_FPCXT_S:

{

TCGv_i32 sfpa, control;

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

default:

g_assert_not_reached();

}

+ if (lab_end) {

+ gen_set_label(lab_end);

+ }

return true;

}

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,

{

/* Do a read from an M-profile floating point system register */

TCGv_i32 tmp;

+ TCGLabel *lab_end = NULL;

+ bool lookup_tb = false;

switch (fp_sysreg_checks(s, regno)) {

case FPSysRegCheckFailed:

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,

fpscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);

gen_helper_vfp_set_fpscr(cpu_env, fpscr);

tcg_temp_free_i32(fpscr);

- gen_lookup_tb(s);

+ lookup_tb = true;

+ break;

+ }

+ case ARM_VFP_FPCXT_NS:

+ {

+ TCGv_i32 control, sfpa, fpscr, fpdscr, zero;

+ TCGLabel *lab_active = gen_new_label();

+

+ lookup_tb = true;

+

+ gen_branch_fpInactive(s, TCG_COND_EQ, lab_active);

+ /* fpInactive case: reads as FPDSCR_NS */

+ TCGv_i32 tmp = load_cpu_field(v7m.fpdscr[M_REG_NS]);

+ storefn(s, opaque, tmp);

+ lab_end = gen_new_label();

+ tcg_gen_br(lab_end);

+

+ gen_set_label(lab_active);

+ /* !fpInactive: Reads the same as FPCXT_S, but side effects differ */

+ gen_preserve_fp_state(s);

+ tmp = tcg_temp_new_i32();

+ sfpa = tcg_temp_new_i32();

+ fpscr = tcg_temp_new_i32();

+ gen_helper_vfp_get_fpscr(fpscr, cpu_env);

+ tcg_gen_andi_i32(tmp, fpscr, ~FPCR_NZCV_MASK);

+ control = load_cpu_field(v7m.control[M_REG_S]);

+ tcg_gen_andi_i32(sfpa, control, R_V7M_CONTROL_SFPA_MASK);

+ tcg_gen_shli_i32(sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);

+ tcg_gen_or_i32(tmp, tmp, sfpa);

+ tcg_temp_free_i32(control);

+ /* Store result before updating FPSCR, in case it faults */

+ storefn(s, opaque, tmp);

+ /* If SFPA is zero then set FPSCR from FPDSCR_NS */

+ fpdscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);

+ zero = tcg_const_i32(0);

+ tcg_gen_movcond_i32(TCG_COND_EQ, fpscr, sfpa, zero, fpdscr, fpscr);

+ gen_helper_vfp_set_fpscr(cpu_env, fpscr);

+ tcg_temp_free_i32(zero);

+ tcg_temp_free_i32(sfpa);

+ tcg_temp_free_i32(fpdscr);

+ tcg_temp_free_i32(fpscr);

break;

}

default:

g_assert_not_reached();

}

+

+ if (lab_end) {

+ gen_set_label(lab_end);

+ }

+ if (lookup_tb) {

+ gen_lookup_tb(s);

+ }

return true;

}

2.20.1

Now that we have implemented all the features needed by the v8.1M

architecture, we can add the model of the Cortex-M55. This is the

configuration without MVE support; we'll add MVE later.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201210201433.26262-5-peter.maydell@linaro.org

target/arm/cpu_tcg.c | 42 ++++++++++++++++++++++++++++++++++++++++++

1 file changed, 42 insertions(+)

diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c

--- a/target/arm/cpu_tcg.c

+++ b/target/arm/cpu_tcg.c

@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)

cpu->ctr = 0x8000c000;

+static void cortex_m55_initfn(Object *obj)

+{

+ ARMCPU *cpu = ARM_CPU(obj);

+

+ set_feature(&cpu->env, ARM_FEATURE_V8);

+ set_feature(&cpu->env, ARM_FEATURE_V8_1M);

+ set_feature(&cpu->env, ARM_FEATURE_M);

+ set_feature(&cpu->env, ARM_FEATURE_M_MAIN);

+ set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);

+ set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);

+ cpu->midr = 0x410fd221; /* r0p1 */

+ cpu->revidr = 0;

+ cpu->pmsav7_dregion = 16;

+ cpu->sau_sregion = 8;

+ /*

+ * These are the MVFR* values for the FPU, no MVE configuration;

+ * we will update them later when we implement MVE

+ */

+ cpu->isar.mvfr0 = 0x10110221;

+ cpu->isar.mvfr1 = 0x12100011;

+ cpu->isar.mvfr2 = 0x00000040;

+ cpu->isar.id_pfr0 = 0x20000030;

+ cpu->isar.id_pfr1 = 0x00000230;

+ cpu->isar.id_dfr0 = 0x10200000;

+ cpu->id_afr0 = 0x00000000;

+ cpu->isar.id_mmfr0 = 0x00111040;

+ cpu->isar.id_mmfr1 = 0x00000000;

+ cpu->isar.id_mmfr2 = 0x01000000;

+ cpu->isar.id_mmfr3 = 0x00000011;

+ cpu->isar.id_isar0 = 0x01103110;

+ cpu->isar.id_isar1 = 0x02212000;

+ cpu->isar.id_isar2 = 0x20232232;

+ cpu->isar.id_isar3 = 0x01111131;

+ cpu->isar.id_isar4 = 0x01310132;

+ cpu->isar.id_isar5 = 0x00000000;

+ cpu->isar.id_isar6 = 0x00000000;

+ cpu->clidr = 0x00000000; /* caches not implemented */

+ cpu->ctr = 0x8303c003;

+}

+

static const ARMCPRegInfo cortexr5_cp_reginfo[] = {

/* Dummy the TCM region regs for the moment */

{ .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,

@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {

.class_init = arm_v7m_class_init },

{ .name = "cortex-m33", .initfn = cortex_m33_initfn,

.class_init = arm_v7m_class_init },

+ { .name = "cortex-m55", .initfn = cortex_m55_initfn,

+ .class_init = arm_v7m_class_init },

{ .name = "cortex-r5", .initfn = cortex_r5_initfn },

{ .name = "cortex-r5f", .initfn = cortex_r5f_initfn },

{ .name = "ti925t", .initfn = ti925t_initfn },

2.20.1

Support for running KVM on 32-bit Arm hosts was removed in commit

82bf7ae84ce739e. You can still run a 32-bit guest on a 64-bit Arm

host CPU, but because Arm KVM requires the host and guest CPU types

to match, it is not possible to run a guest that requires a Cortex-A9

or Cortex-A15 CPU there. That means that the code in the

highbank/midway board models to support KVM is no longer used, and we

can delete it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201215144215.28482-1-peter.maydell@linaro.org

hw/arm/highbank.c | 14 ++++----------

1 file changed, 4 insertions(+), 10 deletions(-)

highbank_binfo.loader_start = 0;

highbank_binfo.write_secondary_boot = hb_write_secondary;

highbank_binfo.secondary_cpu_reset_hook = hb_reset_secondary;

- if (!kvm_enabled()) {

- highbank_binfo.board_setup_addr = BOARD_SETUP_ADDR;

- highbank_binfo.write_board_setup = hb_write_board_setup;

- highbank_binfo.secure_board_setup = true;

- } else {

- warn_report("cannot load built-in Monitor support "

- "if KVM is enabled. Some guests (such as Linux) "

- "may not boot.");

- }

+ highbank_binfo.board_setup_addr = BOARD_SETUP_ADDR;

+ highbank_binfo.write_board_setup = hb_write_board_setup;

+ highbank_binfo.secure_board_setup = true;

arm_load_kernel(ARM_CPU(first_cpu), machine, &highbank_binfo);

}

2.20.1

Currently timer_free() is a simple wrapper for g_free(). This means

that the timer being freed must not be currently active, as otherwise

QEMU might crash later when the active list is processed and still

has a pointer to freed memory on it. As a result almost all calls to

timer_free() are preceded by a timer_del() call, as can be seen in

the output of

git grep -B1 '\<timer_free\>'

This is unfortunate API design as it makes it easy to accidentally

misuse (by forgetting the timer_del()), and the correct use is

annoyingly verbose.

Make timer_free() imply a timer_del().

include/qemu/timer.h | 24 +++++++++++++-----------

1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h

--- a/include/qemu/timer.h

+++ b/include/qemu/timer.h

@@ -XXX,XX +XXX,XX @@ static inline QEMUTimer *timer_new_ms(QEMUClockType type, QEMUTimerCB *cb,

*/

void timer_deinit(QEMUTimer *ts);

- * timer_free:

- * @ts: the timer

- *

- * Free a timer (it must not be on the active list)

-static inline void timer_free(QEMUTimer *ts)

- g_free(ts);

* timer_del:

* @ts: the timer

@@ -XXX,XX +XXX,XX @@ static inline void timer_free(QEMUTimer *ts)

*/

void timer_del(QEMUTimer *ts);

+/**

+ * timer_free:

+ * @ts: the timer

+ *

+ * Free a timer. This will call timer_del() for you to remove

+ * the timer from the active list if it was still active.

+ */

+static inline void timer_free(QEMUTimer *ts)

+{

+ timer_del(ts);

+ g_free(ts);

+}

+

/**

* timer_mod_ns:

* @ts: the timer

2.20.1

This commit is the result of running the timer-del-timer-free.cocci

script on the whole source tree.

Acked-by: Corey Minyard <cminyard@mvista.com>

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20201215154107.3255-4-peter.maydell@linaro.org

block/iscsi.c | 2 --

block/nbd.c | 1 -

block/qcow2.c | 1 -

hw/block/nvme.c | 2 --

hw/char/serial.c | 2 --

hw/char/virtio-serial-bus.c | 2 --

hw/ide/core.c | 1 -

hw/input/hid.c | 1 -

hw/intc/apic.c | 1 -

hw/intc/ioapic.c | 1 -

hw/ipmi/ipmi_bmc_extern.c | 1 -

hw/net/e1000.c | 3 ---

hw/net/e1000e_core.c | 8 --------

hw/net/pcnet-pci.c | 1 -

hw/net/rtl8139.c | 1 -

hw/net/spapr_llan.c | 1 -

hw/net/virtio-net.c | 2 --

hw/s390x/s390-pci-inst.c | 1 -

hw/sd/sd.c | 1 -

hw/sd/sdhci.c | 2 --

hw/usb/dev-hub.c | 1 -

hw/usb/hcd-ehci.c | 1 -

hw/usb/hcd-ohci-pci.c | 1 -

hw/usb/hcd-uhci.c | 1 -

hw/usb/hcd-xhci.c | 1 -

hw/usb/redirect.c | 1 -

hw/vfio/display.c | 1 -

hw/virtio/vhost-vsock-common.c | 1 -

hw/virtio/virtio-balloon.c | 1 -

hw/virtio/virtio-rng.c | 1 -

hw/watchdog/wdt_diag288.c | 1 -

hw/watchdog/wdt_i6300esb.c | 1 -

migration/colo.c | 1 -

monitor/hmp-cmds.c | 1 -

net/announce.c | 1 -

net/colo-compare.c | 1 -

net/slirp.c | 1 -

replay/replay-debugging.c | 1 -

target/s390x/cpu.c | 2 --

ui/console.c | 1 -

ui/spice-core.c | 1 -

util/throttle.c | 1 -

42 files changed, 58 deletions(-)

diff --git a/block/iscsi.c b/block/iscsi.c

index XXXXXXX..XXXXXXX 100644

--- a/block/iscsi.c

+++ b/block/iscsi.c

@@ -XXX,XX +XXX,XX @@ static void iscsi_detach_aio_context(BlockDriverState *bs)

iscsilun->events = 0;

if (iscsilun->nop_timer) {

- timer_del(iscsilun->nop_timer);

timer_free(iscsilun->nop_timer);

iscsilun->nop_timer = NULL;

}

if (iscsilun->event_timer) {

- timer_del(iscsilun->event_timer);

timer_free(iscsilun->event_timer);

iscsilun->event_timer = NULL;

}

diff --git a/block/nbd.c b/block/nbd.c

index XXXXXXX..XXXXXXX 100644

--- a/block/nbd.c

+++ b/block/nbd.c

@@ -XXX,XX +XXX,XX @@ static void nbd_recv_coroutines_wake_all(BDRVNBDState *s)

static void reconnect_delay_timer_del(BDRVNBDState *s)

{

if (s->reconnect_delay_timer) {

- timer_del(s->reconnect_delay_timer);

timer_free(s->reconnect_delay_timer);

s->reconnect_delay_timer = NULL;

}

diff --git a/block/qcow2.c b/block/qcow2.c

index XXXXXXX..XXXXXXX 100644

--- a/block/qcow2.c

+++ b/block/qcow2.c

@@ -XXX,XX +XXX,XX @@ static void cache_clean_timer_del(BlockDriverState *bs)

{

BDRVQcow2State *s = bs->opaque;

if (s->cache_clean_timer) {

- timer_del(s->cache_clean_timer);

timer_free(s->cache_clean_timer);

s->cache_clean_timer = NULL;

}

diff --git a/hw/block/nvme.c b/hw/block/nvme.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/nvme.c

+++ b/hw/block/nvme.c

@@ -XXX,XX +XXX,XX @@ static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)

static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n)

{

n->sq[sq->sqid] = NULL;

- timer_del(sq->timer);

timer_free(sq->timer);

g_free(sq->io_req);

if (sq->sqid) {

@@ -XXX,XX +XXX,XX @@ static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req)

static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n)

{

n->cq[cq->cqid] = NULL;

- timer_del(cq->timer);

timer_free(cq->timer);

msix_vector_unuse(&n->parent_obj, cq->vector);

if (cq->cqid) {

diff --git a/hw/char/serial.c b/hw/char/serial.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/serial.c

+++ b/hw/char/serial.c

@@ -XXX,XX +XXX,XX @@ static void serial_unrealize(DeviceState *dev)

qemu_chr_fe_deinit(&s->chr, false);

- timer_del(s->modem_status_poll);

timer_free(s->modem_status_poll);

- timer_del(s->fifo_timeout_timer);

timer_free(s->fifo_timeout_timer);

fifo8_destroy(&s->recv_fifo);

diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/virtio-serial-bus.c

+++ b/hw/char/virtio-serial-bus.c

@@ -XXX,XX +XXX,XX @@ static void virtio_serial_post_load_timer_cb(void *opaque)

}

}

g_free(s->post_load->connected);

- timer_del(s->post_load->timer);

timer_free(s->post_load->timer);

g_free(s->post_load);

s->post_load = NULL;

@@ -XXX,XX +XXX,XX @@ static void virtio_serial_device_unrealize(DeviceState *dev)

g_free(vser->ports_map);

if (vser->post_load) {

g_free(vser->post_load->connected);

- timer_del(vser->post_load->timer);

timer_free(vser->post_load->timer);

g_free(vser->post_load);

}

diff --git a/hw/ide/core.c b/hw/ide/core.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ide/core.c

+++ b/hw/ide/core.c

@@ -XXX,XX +XXX,XX @@ void ide_init2(IDEBus *bus, qemu_irq irq)

void ide_exit(IDEState *s)

{

- timer_del(s->sector_write_timer);

timer_free(s->sector_write_timer);

qemu_vfree(s->smart_selftest_data);

qemu_vfree(s->io_buffer);

diff --git a/hw/input/hid.c b/hw/input/hid.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/input/hid.c

+++ b/hw/input/hid.c

@@ -XXX,XX +XXX,XX @@ static void hid_idle_timer(void *opaque)

static void hid_del_idle_timer(HIDState *hs)

{

if (hs->idle_timer) {

- timer_del(hs->idle_timer);

timer_free(hs->idle_timer);

hs->idle_timer = NULL;

}

diff --git a/hw/intc/apic.c b/hw/intc/apic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/apic.c

+++ b/hw/intc/apic.c

@@ -XXX,XX +XXX,XX @@ static void apic_unrealize(DeviceState *dev)

{

APICCommonState *s = APIC(dev);

- timer_del(s->timer);

timer_free(s->timer);

local_apics[s->id] = NULL;

}

diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/ioapic.c

+++ b/hw/intc/ioapic.c

@@ -XXX,XX +XXX,XX @@ static void ioapic_unrealize(DeviceState *dev)

{

IOAPICCommonState *s = IOAPIC_COMMON(dev);

- timer_del(s->delayed_ioapic_service_timer);

timer_free(s->delayed_ioapic_service_timer);

}

diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ipmi/ipmi_bmc_extern.c

+++ b/hw/ipmi/ipmi_bmc_extern.c

@@ -XXX,XX +XXX,XX @@ static void ipmi_bmc_extern_finalize(Object *obj)

{

IPMIBmcExtern *ibe = IPMI_BMC_EXTERN(obj);

- timer_del(ibe->extern_timer);

timer_free(ibe->extern_timer);

}

diff --git a/hw/net/e1000.c b/hw/net/e1000.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/e1000.c

+++ b/hw/net/e1000.c

@@ -XXX,XX +XXX,XX @@ pci_e1000_uninit(PCIDevice *dev)

{

E1000State *d = E1000(dev);

- timer_del(d->autoneg_timer);

timer_free(d->autoneg_timer);

- timer_del(d->mit_timer);

timer_free(d->mit_timer);

- timer_del(d->flush_queue_timer);

timer_free(d->flush_queue_timer);

qemu_del_nic(d->nic);

}

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/e1000e_core.c

+++ b/hw/net/e1000e_core.c

@@ -XXX,XX +XXX,XX @@ e1000e_intrmgr_pci_unint(E1000ECore *core)

{

int i;

- timer_del(core->radv.timer);

timer_free(core->radv.timer);

- timer_del(core->rdtr.timer);

timer_free(core->rdtr.timer);

- timer_del(core->raid.timer);

timer_free(core->raid.timer);

- timer_del(core->tadv.timer);

timer_free(core->tadv.timer);

- timer_del(core->tidv.timer);

timer_free(core->tidv.timer);

- timer_del(core->itr.timer);

timer_free(core->itr.timer);

for (i = 0; i < E1000E_MSIX_VEC_NUM; i++) {

- timer_del(core->eitr[i].timer);

timer_free(core->eitr[i].timer);

}

}

@@ -XXX,XX +XXX,XX @@ e1000e_core_pci_uninit(E1000ECore *core)

{

int i;

- timer_del(core->autoneg_timer);

timer_free(core->autoneg_timer);

e1000e_intrmgr_pci_unint(core);

diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/pcnet-pci.c

+++ b/hw/net/pcnet-pci.c

@@ -XXX,XX +XXX,XX @@ static void pci_pcnet_uninit(PCIDevice *dev)

PCIPCNetState *d = PCI_PCNET(dev);

qemu_free_irq(d->state.irq);

- timer_del(d->state.poll_timer);

timer_free(d->state.poll_timer);