[Qemu-devel] [PULL 00/10] target-arm queue
[PULL 00/21] target-arm queue
1
target-arm queue for rc1 -- these are all bug fixes.
1
Here's another arm pullreq; nothing too exciting in here I think.
2
2
3
thanks
3
thanks
4
-- PMM
4
-- PMM
5
5
6
The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:
6
The following changes since commit 5fee33d97a7f2e95716417bd164f2f5264acd976:
7
7
8
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)
8
Merge tag 'samuel-thibault' of https://people.debian.org/~sthibault/qemu into staging (2024-04-29 14:34:25 -0700)
9
9
10
are available in the Git repository at:
10
are available in the Git repository at:
11
11
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240430
13
13
14
for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:
14
for you to fetch changes up to a0c325c4b05cf7815739d6a84e567b95c8c5be7e:
15
15
16
target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)
16
tests/qtest : Add testcase for DM163 (2024-04-30 16:05:08 +0100)
17
17
18
----------------------------------------------------------------
18
----------------------------------------------------------------
19
target-arm queue:
19
target-arm queue:
20
* report ARMv8-A FP support for AArch32 -cpu max
20
* hw/core/clock: allow clock_propagate on child clocks
21
* hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
21
* hvf: arm: Remove unused PL1_WRITE_MASK define
22
* hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
22
* target/arm: Restrict translation disabled alignment check to VMSA
23
* hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
23
* docs/system/arm/emulation.rst: Add missing implemented features
24
* hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
24
* target/arm: Enable FEAT_CSV2_3, FEAT_ETS2, FEAT_Spec_FPACC for 'max'
25
* hw/arm/virt: Fix non-secure flash mode
25
* tests/avocado: update sunxi kernel from armbian to 6.6.16
26
* pl031: Correctly migrate state when using -rtc clock=host
26
* target/arm: Make new CPUs default to 1GHz generic timer
27
* fix regression that meant arm926 and arm1026 lost VFP
27
* hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
28
double-precision support
28
* hw/char/stm32l4x5_usart: Fix memory corruption by adding correct class_size
29
* v8M: NS BusFault on vector table fetch escalates to NS HardFault
29
* hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
30
* hw/arm: Add DM163 display to B-L475E-IOT01A board
30
31
31
----------------------------------------------------------------
32
----------------------------------------------------------------
32
Alex Bennée (1):
33
Alexandra Diupina (1):
33
target/arm: report ARMv8-A FP support for AArch32 -cpu max
34
hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
34
35
35
David Engraf (1):
36
Inès Varhol (5):
36
hw/arm/virt: Fix non-secure flash mode
37
hw/display : Add device DM163
38
hw/arm : Pass STM32L4x5 SYSCFG gpios to STM32L4x5 SoC
39
hw/arm : Create Bl475eMachineState
40
hw/arm : Connect DM163 to B-L475E-IOT01A
41
tests/qtest : Add testcase for DM163
37
42
38
Peter Maydell (3):
43
Peter Maydell (10):
39
pl031: Correctly migrate state when using -rtc clock=host
44
docs/system/arm/emulation.rst: Add missing implemented features
40
target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
45
target/arm: Enable FEAT_CSV2_3 for -cpu max
41
target/arm: NS BusFault on vector table fetch escalates to NS HardFault
46
target/arm: Enable FEAT_ETS2 for -cpu max
47
target/arm: Implement ID_AA64MMFR3_EL1
48
target/arm: Enable FEAT_Spec_FPACC for -cpu max
49
tests/avocado: update sunxi kernel from armbian to 6.6.16
50
target/arm: Refactor default generic timer frequency handling
51
hw/arm/sbsa-ref: Force CPU generic timer to 62.5MHz
52
hw/watchdog/sbsa_gwdt: Make watchdog timer frequency a QOM property
53
target/arm: Default to 1GHz cntfrq for 'max' and new CPUs
42
54
43
Philippe Mathieu-Daudé (5):
55
Philippe Mathieu-Daudé (1):
44
hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
56
hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
45
hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
46
hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
47
hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
48
hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
49
57
50
include/hw/timer/pl031.h | 2 ++
58
Raphael Poggi (1):
51
hw/arm/virt.c | 2 +-
59
hw/core/clock: allow clock_propagate on child clocks
52
hw/core/machine.c | 1 +
53
hw/display/xlnx_dp.c | 15 +++++---
54
hw/ssi/mss-spi.c | 8 ++++-
55
hw/ssi/xilinx_spips.c | 43 +++++++++++++++-------
56
hw/timer/pl031.c | 92 +++++++++++++++++++++++++++++++++++++++++++++---
57
target/arm/cpu.c | 16 +++++++++
58
target/arm/m_helper.c | 21 ++++++++---
59
9 files changed, 174 insertions(+), 26 deletions(-)
60
60
61
Richard Henderson (1):
62
target/arm: Restrict translation disabled alignment check to VMSA
63
64
Thomas Huth (1):
65
hw/char/stm32l4x5_usart: Fix memory corruption by adding correct class_size
66
67
Zenghui Yu (1):
68
hvf: arm: Remove PL1_WRITE_MASK
69
70
docs/system/arm/b-l475e-iot01a.rst | 3 +-
71
docs/system/arm/emulation.rst | 42 ++++-
72
include/hw/display/dm163.h | 59 ++++++
73
include/hw/watchdog/sbsa_gwdt.h | 3 +-
74
target/arm/cpu.h | 28 +++
75
target/arm/internals.h | 15 +-
76
hw/arm/b-l475e-iot01a.c | 105 +++++++++--
77
hw/arm/npcm7xx.c | 3 +-
78
hw/arm/sbsa-ref.c | 16 ++
79
hw/arm/stm32l4x5_soc.c | 6 +-
80
hw/char/stm32l4x5_usart.c | 1 +
81
hw/core/clock.c | 1 -
82
hw/core/machine.c | 4 +-
83
hw/display/dm163.c | 349 ++++++++++++++++++++++++++++++++++++
84
hw/dma/xlnx_dpdma.c | 20 +--
85
hw/watchdog/sbsa_gwdt.c | 15 +-
86
target/arm/cpu.c | 42 +++--
87
target/arm/cpu64.c | 2 +
88
target/arm/helper.c | 22 +--
89
target/arm/hvf/hvf.c | 3 +-
90
target/arm/kvm.c | 2 +
91
target/arm/tcg/cpu32.c | 6 +-
92
target/arm/tcg/cpu64.c | 28 ++-
93
target/arm/tcg/hflags.c | 12 +-
94
tests/qtest/dm163-test.c | 194 ++++++++++++++++++++
95
tests/qtest/stm32l4x5_gpio-test.c | 13 +-
96
tests/qtest/stm32l4x5_syscfg-test.c | 17 +-
97
hw/arm/Kconfig | 1 +
98
hw/display/Kconfig | 3 +
99
hw/display/meson.build | 1 +
100
hw/display/trace-events | 14 ++
101
tests/avocado/boot_linux_console.py | 70 ++++----
102
tests/avocado/replay_kernel.py | 8 +-
103
tests/qtest/meson.build | 2 +
104
34 files changed, 987 insertions(+), 123 deletions(-)
105
create mode 100644 include/hw/display/dm163.h
106
create mode 100644 hw/display/dm163.c
107
create mode 100644 tests/qtest/dm163-test.c
108
diff view generated by jsdifflib
New patch
[PULL 01/21] hw/core/clock: allow clock_propagate on child clocks
1
From: Raphael Poggi <raphael.poggi@lynxleap.co.uk>
1
2
3
clock_propagate() has an assert that clk->source is NULL, i.e. that
4
you are calling it on a clock which has no source clock. This made
5
sense in the original design where the only way for a clock's
6
frequency to change if it had a source clock was when that source
7
clock changed. However, we subsequently added multiplier/divider
8
support, but didn't look at what that meant for propagation.
9
10
If a clock-management device changes the multiplier or divider value
11
on a clock, it needs to propagate that change down to child clocks,
12
even if the clock has a source clock set. So the assertion is now
13
incorrect.
14
15
Remove the assertion.
16
17
Signed-off-by: Raphael Poggi <raphael.poggi@lynxleap.co.uk>
18
Message-id: 20240419162951.23558-1-raphael.poggi@lynxleap.co.uk
19
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
20
[PMM: Rewrote the commit message]
21
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
22
---
23
hw/core/clock.c | 1 -
24
1 file changed, 1 deletion(-)
25
26
diff --git a/hw/core/clock.c b/hw/core/clock.c
27
index XXXXXXX..XXXXXXX 100644
28
--- a/hw/core/clock.c
29
+++ b/hw/core/clock.c
30
@@ -XXX,XX +XXX,XX @@ static void clock_propagate_period(Clock *clk, bool call_callbacks)
31
32
void clock_propagate(Clock *clk)
33
{
34
- assert(clk->source == NULL);
35
trace_clock_propagate(CLOCK_PATH(clk));
36
clock_propagate_period(clk, true);
37
}
38
--
39
2.34.1
diff view generated by jsdifflib
New patch
[PULL 02/21] hvf: arm: Remove PL1_WRITE_MASK
1
From: Zenghui Yu <zenghui.yu@linux.dev>
1
2
3
As it had never been used since the first commit a1477da3ddeb ("hvf: Add
4
Apple Silicon support").
5
6
Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
7
Message-id: 20240422092715.71973-1-zenghui.yu@linux.dev
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/hvf/hvf.c | 1 -
12
1 file changed, 1 deletion(-)
13
14
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/hvf/hvf.c
17
+++ b/target/arm/hvf/hvf.c
18
@@ -XXX,XX +XXX,XX @@ void hvf_arm_init_debug(void)
19
20
#define HVF_SYSREG(crn, crm, op0, op1, op2) \
21
ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)
22
-#define PL1_WRITE_MASK 0x4
23
24
#define SYSREG_OP0_SHIFT 20
25
#define SYSREG_OP0_MASK 0x3
26
--
27
2.34.1
diff view generated by jsdifflib
New patch
[PULL 03/21] target/arm: Restrict translation disabled alignment check to VMSA
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
For cpus using PMSA, when the MPU is disabled, the default memory
4
type is Normal, Non-cachable. This means that it should not
5
have alignment restrictions enforced.
6
7
Cc: qemu-stable@nongnu.org
8
Fixes: 59754f85ed3 ("target/arm: Do memory type alignment check when translation disabled")
9
Reported-by: Clément Chigot <chigot@adacore.com>
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
12
Tested-by: Clément Chigot <chigot@adacore.com>
13
Message-id: 20240422170722.117409-1-richard.henderson@linaro.org
14
[PMM: trivial comment, commit message tweaks]
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
---
17
target/arm/tcg/hflags.c | 12 ++++++++++--
18
1 file changed, 10 insertions(+), 2 deletions(-)
19
20
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
21
index XXXXXXX..XXXXXXX 100644
22
--- a/target/arm/tcg/hflags.c
23
+++ b/target/arm/tcg/hflags.c
24
@@ -XXX,XX +XXX,XX @@ static bool aprofile_require_alignment(CPUARMState *env, int el, uint64_t sctlr)
25
}
26
27
/*
28
- * If translation is disabled, then the default memory type is
29
- * Device(-nGnRnE) instead of Normal, which requires that alignment
30
+ * With PMSA, when the MPU is disabled, all memory types in the
31
+ * default map are Normal, so don't need aligment enforcing.
32
+ */
33
+ if (arm_feature(env, ARM_FEATURE_PMSA)) {
34
+ return false;
35
+ }
36
+
37
+ /*
38
+ * With VMSA, if translation is disabled, then the default memory type
39
+ * is Device(-nGnRnE) instead of Normal, which requires that alignment
40
* be enforced. Since this affects all ram, it is most efficient
41
* to handle this during translation.
42
*/
43
--
44
2.34.1
45
46
diff view generated by jsdifflib
New patch
[PULL 04/21] docs/system/arm/emulation.rst: Add missing implemented features
1
As of version DDI0487K.a of the Arm ARM, some architectural features
2
which previously didn't have official names have been named. Add
3
these to the list of features which QEMU's TCG emulation supports.
4
Mostly these are features which we thought of as part of baseline 8.0
5
support. For SVE and SVE2, the names have been brought into line
6
with the FEAT_* naming convention of other extensions, and some
7
sub-components split into separate FEAT_ items. In a few cases (eg
8
FEAT_CCIDX, FEAT_DPB2) the omission from our list was just an oversight.
1
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 20240418152004.2106516-2-peter.maydell@linaro.org
13
---
14
docs/system/arm/emulation.rst | 38 +++++++++++++++++++++++++++++++++--
15
1 file changed, 36 insertions(+), 2 deletions(-)
16
17
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
18
index XXXXXXX..XXXXXXX 100644
19
--- a/docs/system/arm/emulation.rst
20
+++ b/docs/system/arm/emulation.rst
21
@@ -XXX,XX +XXX,XX @@ Armv8 versions of the A-profile architecture. It also has support for
22
the following architecture extensions:
23
24
- FEAT_AA32BF16 (AArch32 BFloat16 instructions)
25
+- FEAT_AA32EL0 (Support for AArch32 at EL0)
26
+- FEAT_AA32EL1 (Support for AArch32 at EL1)
27
+- FEAT_AA32EL2 (Support for AArch32 at EL2)
28
+- FEAT_AA32EL3 (Support for AArch32 at EL3)
29
- FEAT_AA32HPD (AArch32 hierarchical permission disables)
30
- FEAT_AA32I8MM (AArch32 Int8 matrix multiplication instructions)
31
+- FEAT_AA64EL0 (Support for AArch64 at EL0)
32
+- FEAT_AA64EL1 (Support for AArch64 at EL1)
33
+- FEAT_AA64EL2 (Support for AArch64 at EL2)
34
+- FEAT_AA64EL3 (Support for AArch64 at EL3)
35
+- FEAT_AdvSIMD (Advanced SIMD Extension)
36
- FEAT_AES (AESD and AESE instructions)
37
+- FEAT_Armv9_Crypto (Armv9 Cryptographic Extension)
38
+- FEAT_ASID16 (16 bit ASID)
39
- FEAT_BBM at level 2 (Translation table break-before-make levels)
40
- FEAT_BF16 (AArch64 BFloat16 instructions)
41
- FEAT_BTI (Branch Target Identification)
42
+- FEAT_CCIDX (Extended cache index)
43
- FEAT_CRC32 (CRC32 instructions)
44
+- FEAT_Crypto (Cryptographic Extension)
45
- FEAT_CSV2 (Cache speculation variant 2)
46
- FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
47
- FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
48
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
49
- FEAT_DGH (Data gathering hint)
50
- FEAT_DIT (Data Independent Timing instructions)
51
- FEAT_DPB (DC CVAP instruction)
52
+- FEAT_DPB2 (DC CVADP instruction)
53
+- FEAT_Debugv8p1 (Debug with VHE)
54
- FEAT_Debugv8p2 (Debug changes for v8.2)
55
- FEAT_Debugv8p4 (Debug changes for v8.4)
56
- FEAT_DotProd (Advanced SIMD dot product instructions)
57
- FEAT_DoubleFault (Double Fault Extension)
58
- FEAT_E0PD (Preventing EL0 access to halves of address maps)
59
- FEAT_ECV (Enhanced Counter Virtualization)
60
+- FEAT_EL0 (Support for execution at EL0)
61
+- FEAT_EL1 (Support for execution at EL1)
62
+- FEAT_EL2 (Support for execution at EL2)
63
+- FEAT_EL3 (Support for execution at EL3)
64
- FEAT_EPAC (Enhanced pointer authentication)
65
- FEAT_ETS (Enhanced Translation Synchronization)
66
- FEAT_EVT (Enhanced Virtualization Traps)
67
+- FEAT_F32MM (Single-precision Matrix Multiplication)
68
+- FEAT_F64MM (Double-precision Matrix Multiplication)
69
- FEAT_FCMA (Floating-point complex number instructions)
70
- FEAT_FGT (Fine-Grained Traps)
71
- FEAT_FHM (Floating-point half-precision multiplication instructions)
72
+- FEAT_FP (Floating Point extensions)
73
- FEAT_FP16 (Half-precision floating-point data processing)
74
- FEAT_FPAC (Faulting on AUT* instructions)
75
- FEAT_FPACCOMBINE (Faulting on combined pointer authentication instructions)
76
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
77
- FEAT_LSE (Large System Extensions)
78
- FEAT_LSE2 (Large System Extensions v2)
79
- FEAT_LVA (Large Virtual Address space)
80
+- FEAT_MixedEnd (Mixed-endian support)
81
+- FEAT_MixdEndEL0 (Mixed-endian support at EL0)
82
- FEAT_MOPS (Standardization of memory operations)
83
- FEAT_MTE (Memory Tagging Extension)
84
- FEAT_MTE2 (Memory Tagging Extension)
85
- FEAT_MTE3 (MTE Asymmetric Fault Handling)
86
+- FEAT_MTE_ASYM_FAULT (Memory tagging asymmetric faults)
87
- FEAT_NMI (Non-maskable Interrupt)
88
- FEAT_NV (Nested Virtualization)
89
- FEAT_NV2 (Enhanced nested virtualization support)
90
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
91
- FEAT_PAuth (Pointer authentication)
92
- FEAT_PAuth2 (Enhancements to pointer authentication)
93
- FEAT_PMULL (PMULL, PMULL2 instructions)
94
+- FEAT_PMUv3 (PMU extension version 3)
95
- FEAT_PMUv3p1 (PMU Extensions v3.1)
96
- FEAT_PMUv3p4 (PMU Extensions v3.4)
97
- FEAT_PMUv3p5 (PMU Extensions v3.5)
98
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
99
- FEAT_SME_FA64 (Full A64 instruction set in Streaming SVE mode)
100
- FEAT_SME_F64F64 (Double-precision floating-point outer product instructions)
101
- FEAT_SME_I16I64 (16-bit to 64-bit integer widening outer product instructions)
102
+- FEAT_SVE (Scalable Vector Extension)
103
+- FEAT_SVE_AES (Scalable Vector AES instructions)
104
+- FEAT_SVE_BitPerm (Scalable Vector Bit Permutes instructions)
105
+- FEAT_SVE_PMULL128 (Scalable Vector PMULL instructions)
106
+- FEAT_SVE_SHA3 (Scalable Vector SHA3 instructions)
107
+- FEAT_SVE_SM4 (Scalable Vector SM4 instructions)
108
+- FEAT_SVE2 (Scalable Vector Extension version 2)
109
- FEAT_SPECRES (Speculation restriction instructions)
110
- FEAT_SSBS (Speculative Store Bypass Safe)
111
+- FEAT_TGran16K (Support for 16KB memory translation granule size at stage 1)
112
+- FEAT_TGran4K (Support for 4KB memory translation granule size at stage 1)
113
+- FEAT_TGran64K (Support for 64KB memory translation granule size at stage 1)
114
- FEAT_TIDCP1 (EL0 use of IMPLEMENTATION DEFINED functionality)
115
- FEAT_TLBIOS (TLB invalidate instructions in Outer Shareable domain)
116
- FEAT_TLBIRANGE (TLB invalidate range instructions)
117
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
118
- FEAT_VHE (Virtualization Host Extensions)
119
- FEAT_VMID16 (16-bit VMID)
120
- FEAT_XNX (Translation table stage 2 Unprivileged Execute-never)
121
-- SVE (The Scalable Vector Extension)
122
-- SVE2 (The Scalable Vector Extension v2)
123
124
For information on the specifics of these extensions, please refer
125
to the `Armv8-A Arm Architecture Reference Manual
126
--
127
2.34.1
diff view generated by jsdifflib
New patch
[PULL 05/21] target/arm: Enable FEAT_CSV2_3 for -cpu max
1
FEAT_CSV2_3 adds a mechanism to identify if hardware cannot disclose
2
information about whether branch targets and branch history trained
3
in one hardware described context can control speculative execution
4
in a different hardware context.
1
5
6
There is no branch prediction in TCG, so we don't need to do anything
7
to be compliant with this. Upadte the '-cpu max' ID registers to
8
advertise the feature.
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
13
Message-id: 20240418152004.2106516-3-peter.maydell@linaro.org
14
---
15
docs/system/arm/emulation.rst | 1 +
16
target/arm/tcg/cpu64.c | 4 ++--
17
2 files changed, 3 insertions(+), 2 deletions(-)
18
19
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
20
index XXXXXXX..XXXXXXX 100644
21
--- a/docs/system/arm/emulation.rst
22
+++ b/docs/system/arm/emulation.rst
23
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
24
- FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
25
- FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
26
- FEAT_CSV2_2 (Cache speculation variant 2, version 2)
27
+- FEAT_CSV2_3 (Cache speculation variant 2, version 3)
28
- FEAT_CSV3 (Cache speculation variant 3)
29
- FEAT_DGH (Data gathering hint)
30
- FEAT_DIT (Data Independent Timing instructions)
31
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
32
index XXXXXXX..XXXXXXX 100644
33
--- a/target/arm/tcg/cpu64.c
34
+++ b/target/arm/tcg/cpu64.c
35
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
36
t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
37
t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1); /* FEAT_SEL2 */
38
t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1); /* FEAT_DIT */
39
- t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 2); /* FEAT_CSV2_2 */
40
+ t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 3); /* FEAT_CSV2_3 */
41
t = FIELD_DP64(t, ID_AA64PFR0, CSV3, 1); /* FEAT_CSV3 */
42
cpu->isar.id_aa64pfr0 = t;
43
44
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
45
t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3); /* FEAT_MTE3 */
46
t = FIELD_DP64(t, ID_AA64PFR1, RAS_FRAC, 0); /* FEAT_RASv1p1 + FEAT_DoubleFault */
47
t = FIELD_DP64(t, ID_AA64PFR1, SME, 1); /* FEAT_SME */
48
- t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_2 */
49
+ t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_3 */
50
t = FIELD_DP64(t, ID_AA64PFR1, NMI, 1); /* FEAT_NMI */
51
cpu->isar.id_aa64pfr1 = t;
52
53
--
54
2.34.1
55
56
diff view generated by jsdifflib
New patch
[PULL 06/21] target/arm: Enable FEAT_ETS2 for -cpu max
1
FEAT_ETS2 is a tighter set of guarantees about memory ordering
2
involving translation table walks than the old FEAT_ETS; FEAT_ETS has
3
been retired from the Arm ARM and the old ID_AA64MMFR1.ETS == 1
4
now gives no greater guarantees than ETS == 0.
1
5
6
FEAT_ETS2 requires:
7
* the virtual address of a load or store that appears in program
8
order after a DSB cannot be translated until after the DSB
9
completes (section B2.10.9)
10
* TLB maintenance operations that only affect translations without
11
execute permission are guaranteed complete after a DSB
12
(R_BLDZX)
13
* if a memory access RW2 is ordered-before memory access RW2,
14
then RW1 is also ordered-before any translation table walk
15
generated by RW2 that generates a Translation, Address size
16
or Access flag fault (R_NNFPF, I_CLGHP)
17
18
As with FEAT_ETS, QEMU is already compliant, because we do not
19
reorder translation table walk memory accesses relative to other
20
memory accesses, and we always guarantee to have finished TLB
21
maintenance as soon as the TLB op is done.
22
23
Update the documentation to list FEAT_ETS2 instead of the
24
no-longer-existent FEAT_ETS, and update the 'max' CPU ID registers.
25
26
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
28
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
29
Message-id: 20240418152004.2106516-4-peter.maydell@linaro.org
30
---
31
docs/system/arm/emulation.rst | 2 +-
32
target/arm/tcg/cpu32.c | 2 +-
33
target/arm/tcg/cpu64.c | 2 +-
34
3 files changed, 3 insertions(+), 3 deletions(-)
35
36
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
37
index XXXXXXX..XXXXXXX 100644
38
--- a/docs/system/arm/emulation.rst
39
+++ b/docs/system/arm/emulation.rst
40
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
41
- FEAT_EL2 (Support for execution at EL2)
42
- FEAT_EL3 (Support for execution at EL3)
43
- FEAT_EPAC (Enhanced pointer authentication)
44
-- FEAT_ETS (Enhanced Translation Synchronization)
45
+- FEAT_ETS2 (Enhanced Translation Synchronization)
46
- FEAT_EVT (Enhanced Virtualization Traps)
47
- FEAT_F32MM (Single-precision Matrix Multiplication)
48
- FEAT_F64MM (Double-precision Matrix Multiplication)
49
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/target/arm/tcg/cpu32.c
52
+++ b/target/arm/tcg/cpu32.c
53
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
54
cpu->isar.id_mmfr4 = t;
55
56
t = cpu->isar.id_mmfr5;
57
- t = FIELD_DP32(t, ID_MMFR5, ETS, 1); /* FEAT_ETS */
58
+ t = FIELD_DP32(t, ID_MMFR5, ETS, 2); /* FEAT_ETS2 */
59
cpu->isar.id_mmfr5 = t;
60
61
t = cpu->isar.id_pfr0;
62
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
63
index XXXXXXX..XXXXXXX 100644
64
--- a/target/arm/tcg/cpu64.c
65
+++ b/target/arm/tcg/cpu64.c
66
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
67
t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1); /* FEAT_LOR */
68
t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 3); /* FEAT_PAN3 */
69
t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* FEAT_XNX */
70
- t = FIELD_DP64(t, ID_AA64MMFR1, ETS, 1); /* FEAT_ETS */
71
+ t = FIELD_DP64(t, ID_AA64MMFR1, ETS, 2); /* FEAT_ETS2 */
72
t = FIELD_DP64(t, ID_AA64MMFR1, HCX, 1); /* FEAT_HCX */
73
t = FIELD_DP64(t, ID_AA64MMFR1, TIDCP1, 1); /* FEAT_TIDCP1 */
74
cpu->isar.id_aa64mmfr1 = t;
75
--
76
2.34.1
77
78
diff view generated by jsdifflib
New patch
[PULL 07/21] target/arm: Implement ID_AA64MMFR3_EL1
1
Newer versions of the Arm ARM (e.g. rev K.a) now define fields for
2
ID_AA64MMFR3_EL1. Implement this register, so that we can set the
3
fields if we need to. There's no behaviour change here since we
4
don't currently set the register value to non-zero.
1
5
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Message-id: 20240418152004.2106516-5-peter.maydell@linaro.org
10
---
11
target/arm/cpu.h | 17 +++++++++++++++++
12
target/arm/helper.c | 6 ++++--
13
target/arm/hvf/hvf.c | 2 ++
14
target/arm/kvm.c | 2 ++
15
4 files changed, 25 insertions(+), 2 deletions(-)
16
17
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/cpu.h
20
+++ b/target/arm/cpu.h
21
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
22
uint64_t id_aa64mmfr0;
23
uint64_t id_aa64mmfr1;
24
uint64_t id_aa64mmfr2;
25
+ uint64_t id_aa64mmfr3;
26
uint64_t id_aa64dfr0;
27
uint64_t id_aa64dfr1;
28
uint64_t id_aa64zfr0;
29
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR2, BBM, 52, 4)
30
FIELD(ID_AA64MMFR2, EVT, 56, 4)
31
FIELD(ID_AA64MMFR2, E0PD, 60, 4)
32
33
+FIELD(ID_AA64MMFR3, TCRX, 0, 4)
34
+FIELD(ID_AA64MMFR3, SCTLRX, 4, 4)
35
+FIELD(ID_AA64MMFR3, S1PIE, 8, 4)
36
+FIELD(ID_AA64MMFR3, S2PIE, 12, 4)
37
+FIELD(ID_AA64MMFR3, S1POE, 16, 4)
38
+FIELD(ID_AA64MMFR3, S2POE, 20, 4)
39
+FIELD(ID_AA64MMFR3, AIE, 24, 4)
40
+FIELD(ID_AA64MMFR3, MEC, 28, 4)
41
+FIELD(ID_AA64MMFR3, D128, 32, 4)
42
+FIELD(ID_AA64MMFR3, D128_2, 36, 4)
43
+FIELD(ID_AA64MMFR3, SNERR, 40, 4)
44
+FIELD(ID_AA64MMFR3, ANERR, 44, 4)
45
+FIELD(ID_AA64MMFR3, SDERR, 52, 4)
46
+FIELD(ID_AA64MMFR3, ADERR, 56, 4)
47
+FIELD(ID_AA64MMFR3, SPEC_FPACC, 60, 4)
48
+
49
FIELD(ID_AA64DFR0, DEBUGVER, 0, 4)
50
FIELD(ID_AA64DFR0, TRACEVER, 4, 4)
51
FIELD(ID_AA64DFR0, PMUVER, 8, 4)
52
diff --git a/target/arm/helper.c b/target/arm/helper.c
53
index XXXXXXX..XXXXXXX 100644
54
--- a/target/arm/helper.c
55
+++ b/target/arm/helper.c
56
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
57
.access = PL1_R, .type = ARM_CP_CONST,
58
.accessfn = access_aa64_tid3,
59
.resetvalue = cpu->isar.id_aa64mmfr2 },
60
- { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
61
+ { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64,
62
.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
63
.access = PL1_R, .type = ARM_CP_CONST,
64
.accessfn = access_aa64_tid3,
65
- .resetvalue = 0 },
66
+ .resetvalue = cpu->isar.id_aa64mmfr3 },
67
{ .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
68
.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
69
.access = PL1_R, .type = ARM_CP_CONST,
70
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
71
.exported_bits = R_ID_AA64MMFR1_AFP_MASK },
72
{ .name = "ID_AA64MMFR2_EL1",
73
.exported_bits = R_ID_AA64MMFR2_AT_MASK },
74
+ { .name = "ID_AA64MMFR3_EL1",
75
+ .exported_bits = 0 },
76
{ .name = "ID_AA64MMFR*_EL1_RESERVED",
77
.is_glob = true },
78
{ .name = "ID_AA64DFR0_EL1",
79
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
80
index XXXXXXX..XXXXXXX 100644
81
--- a/target/arm/hvf/hvf.c
82
+++ b/target/arm/hvf/hvf.c
83
@@ -XXX,XX +XXX,XX @@ static struct hvf_sreg_match hvf_sreg_match[] = {
84
#endif
85
{ HV_SYS_REG_ID_AA64MMFR1_EL1, HVF_SYSREG(0, 7, 3, 0, 1) },
86
{ HV_SYS_REG_ID_AA64MMFR2_EL1, HVF_SYSREG(0, 7, 3, 0, 2) },
87
+ /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
88
89
{ HV_SYS_REG_MDSCR_EL1, HVF_SYSREG(0, 2, 2, 0, 2) },
90
{ HV_SYS_REG_SCTLR_EL1, HVF_SYSREG(1, 0, 3, 0, 0) },
91
@@ -XXX,XX +XXX,XX @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
92
{ HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },
93
{ HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 },
94
{ HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.id_aa64mmfr2 },
95
+ /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
96
};
97
hv_vcpu_t fd;
98
hv_return_t r = HV_SUCCESS;
99
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
100
index XXXXXXX..XXXXXXX 100644
101
--- a/target/arm/kvm.c
102
+++ b/target/arm/kvm.c
103
@@ -XXX,XX +XXX,XX @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
104
ARM64_SYS_REG(3, 0, 0, 7, 1));
105
err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
106
ARM64_SYS_REG(3, 0, 0, 7, 2));
107
+ err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr3,
108
+ ARM64_SYS_REG(3, 0, 0, 7, 3));
109
110
/*
111
* Note that if AArch32 support is not present in the host,
112
--
113
2.34.1
114
115
diff view generated by jsdifflib
New patch
[PULL 08/21] target/arm: Enable FEAT_Spec_FPACC for -cpu max
1
FEAT_Spec_FPACC is a feature describing speculative behaviour in the
2
event of a PAC authontication failure when FEAT_FPACCOMBINE is
3
implemented. FEAT_Spec_FPACC means that the speculative use of
4
pointers processed by a PAC Authentication is not materially
5
different in terms of the impact on cached microarchitectural state
6
(caches, TLBs, etc) between passing and failing of the PAC
7
Authentication.
1
8
9
QEMU doesn't do speculative execution, so we can advertise
10
this feature.
11
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
15
Message-id: 20240418152004.2106516-6-peter.maydell@linaro.org
16
---
17
docs/system/arm/emulation.rst | 1 +
18
target/arm/tcg/cpu64.c | 4 ++++
19
2 files changed, 5 insertions(+)
20
21
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
22
index XXXXXXX..XXXXXXX 100644
23
--- a/docs/system/arm/emulation.rst
24
+++ b/docs/system/arm/emulation.rst
25
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
26
- FEAT_FP16 (Half-precision floating-point data processing)
27
- FEAT_FPAC (Faulting on AUT* instructions)
28
- FEAT_FPACCOMBINE (Faulting on combined pointer authentication instructions)
29
+- FEAT_FPACC_SPEC (Speculative behavior of combined pointer authentication instructions)
30
- FEAT_FRINTTS (Floating-point to integer instructions)
31
- FEAT_FlagM (Flag manipulation instructions v2)
32
- FEAT_FlagM2 (Enhancements to flag manipulation instructions)
33
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
34
index XXXXXXX..XXXXXXX 100644
35
--- a/target/arm/tcg/cpu64.c
36
+++ b/target/arm/tcg/cpu64.c
37
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
38
t = FIELD_DP64(t, ID_AA64MMFR2, E0PD, 1); /* FEAT_E0PD */
39
cpu->isar.id_aa64mmfr2 = t;
40
41
+ t = cpu->isar.id_aa64mmfr3;
42
+ t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
43
+ cpu->isar.id_aa64mmfr3 = t;
44
+
45
t = cpu->isar.id_aa64zfr0;
46
t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);
47
t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2); /* FEAT_SVE_PMULL128 */
48
--
49
2.34.1
50
51
diff view generated by jsdifflib
New patch
[PULL 09/21] tests/avocado: update sunxi kernel from armbian to 6.6.16
1
The Linux kernel 5.10.16 binary for sunxi has been removed from
2
apt.armbian.com. This means that the avocado tests for these machines
3
will be skipped (status CANCEL) if the old binary isn't present in
4
the avocado cache.
1
5
6
Update to 6.6.16, in the same way we did in commit e384db41d8661
7
when we moved to 5.10.16 in 2021.
8
9
Cc: qemu-stable@nongnu.org
10
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2284
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
13
Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>
14
Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
15
Message-id: 20240415151845.1564201-1-peter.maydell@linaro.org
16
---
17
tests/avocado/boot_linux_console.py | 70 ++++++++++++++---------------
18
tests/avocado/replay_kernel.py | 8 ++--
19
2 files changed, 39 insertions(+), 39 deletions(-)
20
21
diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py
22
index XXXXXXX..XXXXXXX 100644
23
--- a/tests/avocado/boot_linux_console.py
24
+++ b/tests/avocado/boot_linux_console.py
25
@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
26
:avocado: tags=accel:tcg
27
"""
28
deb_url = ('https://apt.armbian.com/pool/main/l/'
29
- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
30
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
31
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
32
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
33
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
34
kernel_path = self.extract_from_deb(deb_path,
35
- '/boot/vmlinuz-5.10.16-sunxi')
36
- dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
37
+ '/boot/vmlinuz-6.6.16-current-sunxi')
38
+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun4i-a10-cubieboard.dtb'
39
dtb_path = self.extract_from_deb(deb_path, dtb_path)
40
initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
41
'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
42
@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_sata(self):
43
:avocado: tags=accel:tcg
44
"""
45
deb_url = ('https://apt.armbian.com/pool/main/l/'
46
- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
47
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
48
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
49
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
50
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
51
kernel_path = self.extract_from_deb(deb_path,
52
- '/boot/vmlinuz-5.10.16-sunxi')
53
- dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
54
+ '/boot/vmlinuz-6.6.16-current-sunxi')
55
+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun4i-a10-cubieboard.dtb'
56
dtb_path = self.extract_from_deb(deb_path, dtb_path)
57
rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
58
'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
59
@@ -XXX,XX +XXX,XX @@ def test_arm_bpim2u(self):
60
:avocado: tags=machine:bpim2u
61
:avocado: tags=accel:tcg
62
"""
63
- deb_url = ('https://apt.armbian.com/pool/main/l/linux-5.10.16-sunxi/'
64
- 'linux-image-current-sunxi_21.02.2_armhf.deb')
65
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
66
+ deb_url = ('https://apt.armbian.com/pool/main/l/'
67
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
68
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
69
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
70
kernel_path = self.extract_from_deb(deb_path,
71
- '/boot/vmlinuz-5.10.16-sunxi')
72
- dtb_path = ('/usr/lib/linux-image-current-sunxi/'
73
+ '/boot/vmlinuz-6.6.16-current-sunxi')
74
+ dtb_path = ('/usr/lib/linux-image-6.6.16-current-sunxi/'
75
'sun8i-r40-bananapi-m2-ultra.dtb')
76
dtb_path = self.extract_from_deb(deb_path, dtb_path)
77
78
@@ -XXX,XX +XXX,XX @@ def test_arm_bpim2u_initrd(self):
79
:avocado: tags=accel:tcg
80
:avocado: tags=machine:bpim2u
81
"""
82
- deb_url = ('https://apt.armbian.com/pool/main/l/linux-5.10.16-sunxi/'
83
- 'linux-image-current-sunxi_21.02.2_armhf.deb')
84
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
85
+ deb_url = ('https://apt.armbian.com/pool/main/l/'
86
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
87
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
88
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
89
kernel_path = self.extract_from_deb(deb_path,
90
- '/boot/vmlinuz-5.10.16-sunxi')
91
- dtb_path = ('/usr/lib/linux-image-current-sunxi/'
92
+ '/boot/vmlinuz-6.6.16-current-sunxi')
93
+ dtb_path = ('/usr/lib/linux-image-6.6.16-current-sunxi/'
94
'sun8i-r40-bananapi-m2-ultra.dtb')
95
dtb_path = self.extract_from_deb(deb_path, dtb_path)
96
initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
97
@@ -XXX,XX +XXX,XX @@ def test_arm_bpim2u_gmac(self):
98
"""
99
self.require_netdev('user')
100
101
- deb_url = ('https://apt.armbian.com/pool/main/l/linux-5.10.16-sunxi/'
102
- 'linux-image-current-sunxi_21.02.2_armhf.deb')
103
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
104
+ deb_url = ('https://apt.armbian.com/pool/main/l/'
105
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
106
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
107
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
108
kernel_path = self.extract_from_deb(deb_path,
109
- '/boot/vmlinuz-5.10.16-sunxi')
110
- dtb_path = ('/usr/lib/linux-image-current-sunxi/'
111
+ '/boot/vmlinuz-6.6.16-current-sunxi')
112
+ dtb_path = ('/usr/lib/linux-image-6.6.16-current-sunxi/'
113
'sun8i-r40-bananapi-m2-ultra.dtb')
114
dtb_path = self.extract_from_deb(deb_path, dtb_path)
115
rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'
116
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi(self):
117
:avocado: tags=accel:tcg
118
"""
119
deb_url = ('https://apt.armbian.com/pool/main/l/'
120
- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
121
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
122
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
123
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
124
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
125
kernel_path = self.extract_from_deb(deb_path,
126
- '/boot/vmlinuz-5.10.16-sunxi')
127
- dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
128
+ '/boot/vmlinuz-6.6.16-current-sunxi')
129
+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun8i-h3-orangepi-pc.dtb'
130
dtb_path = self.extract_from_deb(deb_path, dtb_path)
131
132
self.vm.set_console()
133
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_initrd(self):
134
:avocado: tags=machine:orangepi-pc
135
"""
136
deb_url = ('https://apt.armbian.com/pool/main/l/'
137
- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
138
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
139
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
140
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
141
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
142
kernel_path = self.extract_from_deb(deb_path,
143
- '/boot/vmlinuz-5.10.16-sunxi')
144
- dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
145
+ '/boot/vmlinuz-6.6.16-current-sunxi')
146
+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun8i-h3-orangepi-pc.dtb'
147
dtb_path = self.extract_from_deb(deb_path, dtb_path)
148
initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
149
'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
150
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_sd(self):
151
self.require_netdev('user')
152
153
deb_url = ('https://apt.armbian.com/pool/main/l/'
154
- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
155
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
156
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
157
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
158
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
159
kernel_path = self.extract_from_deb(deb_path,
160
- '/boot/vmlinuz-5.10.16-sunxi')
161
- dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'
162
+ '/boot/vmlinuz-6.6.16-current-sunxi')
163
+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun8i-h3-orangepi-pc.dtb'
164
dtb_path = self.extract_from_deb(deb_path, dtb_path)
165
rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'
166
'buildroot-baseline/20221116.0/armel/rootfs.ext2.xz')
167
diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
168
index XXXXXXX..XXXXXXX 100644
169
--- a/tests/avocado/replay_kernel.py
170
+++ b/tests/avocado/replay_kernel.py
171
@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):
172
:avocado: tags=machine:cubieboard
173
"""
174
deb_url = ('https://apt.armbian.com/pool/main/l/'
175
- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')
176
- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'
177
+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')
178
+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'
179
deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
180
kernel_path = self.extract_from_deb(deb_path,
181
- '/boot/vmlinuz-5.10.16-sunxi')
182
- dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'
183
+ '/boot/vmlinuz-6.6.16-current-sunxi')
184
+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun4i-a10-cubieboard.dtb'
185
dtb_path = self.extract_from_deb(deb_path, dtb_path)
186
initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
187
'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
188
--
189
2.34.1
diff view generated by jsdifflib
[Qemu-devel] [PULL 09/10] target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
[PULL 10/21] target/arm: Refactor default generic timer frequency handling
1
The ARMv5 architecture didn't specify detailed per-feature ID
1
The generic timer frequency is settable by board code via a QOM
2
registers. Now that we're using the MVFR0 register fields to
2
property "cntfrq", but otherwise defaults to 62.5MHz. The way this
3
gate the existence of VFP instructions, we need to set up
3
is done includes some complication resulting from how this was
4
the correct values in the cpu->isar structure so that we still
4
originally a fixed value with no QOM property. Clean it up:
5
provide an FPU to the guest.
6
5
7
This fixes a regression in the arm926 and arm1026 CPUs, which
6
* always set cpu->gt_cntfrq_hz to some sensible value, whether
8
are the only ones that both have VFP and are ARMv5 or earlier.
7
the CPU has the generic timer or not, and whether it's system
9
This regression was introduced by the VFP refactoring, and more
8
or user-only emulation
10
specifically by commits 1120827fa182f0e76 and 266bd25c485597c,
9
* this means we can always use gt_cntfrq_hz, and never need
11
which accidentally disabled VFP short-vector support and
10
the old GTIMER_SCALE define
12
double-precision support on these CPUs.
11
* set the default value in exactly one place, in the realize fn
13
12
14
Fixes: 1120827fa182f0e
13
The aim here is to pave the way for handling the ARMv8.6 requirement
15
Fixes: 266bd25c485597c
14
that the generic timer frequency is always 1GHz. We're going to do
16
Fixes: https://bugs.launchpad.net/qemu/+bug/1836192
15
that by having old CPU types keep their legacy-in-QEMU behaviour and
17
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
16
having the default for any new CPU types be a 1GHz rather han 62.5MHz
17
cntfrq, so we want the point where the default is decided to be in
18
one place, and in code, not in a DEFINE_PROP_UINT64() initializer.
19
20
This commit should have no behavioural changes.
21
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
22
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
19
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
24
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
20
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
25
Message-id: 20240426122913.3427983-2-peter.maydell@linaro.org
21
Tested-by: Christophe Lyon <christophe.lyon@linaro.org>
22
Message-id: 20190711131241.22231-1-peter.maydell@linaro.org
23
---
26
---
24
target/arm/cpu.c | 12 ++++++++++++
27
target/arm/internals.h | 7 ++++---
25
1 file changed, 12 insertions(+)
28
target/arm/cpu.c | 31 +++++++++++++++++--------------
29
target/arm/helper.c | 16 ++++++++--------
30
3 files changed, 29 insertions(+), 25 deletions(-)
26
31
32
diff --git a/target/arm/internals.h b/target/arm/internals.h
33
index XXXXXXX..XXXXXXX 100644
34
--- a/target/arm/internals.h
35
+++ b/target/arm/internals.h
36
@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)
37
|| excp == EXCP_SEMIHOST;
38
}
39
40
-/* Scale factor for generic timers, ie number of ns per tick.
41
- * This gives a 62.5MHz timer.
42
+/*
43
+ * Default frequency for the generic timer, in Hz.
44
+ * This is 62.5MHz, which gives a 16 ns tick period.
45
*/
46
-#define GTIMER_SCALE 16
47
+#define GTIMER_DEFAULT_HZ 62500000
48
49
/* Bit definitions for the v7M CONTROL register */
50
FIELD(V7M_CONTROL, NPRIV, 0, 1)
27
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
51
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
28
index XXXXXXX..XXXXXXX 100644
52
index XXXXXXX..XXXXXXX 100644
29
--- a/target/arm/cpu.c
53
--- a/target/arm/cpu.c
30
+++ b/target/arm/cpu.c
54
+++ b/target/arm/cpu.c
31
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
55
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
32
* set the field to indicate Jazelle support within QEMU.
56
}
33
*/
34
cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
35
+ /*
36
+ * Similarly, we need to set MVFR0 fields to enable double precision
37
+ * and short vector support even though ARMv5 doesn't have this register.
38
+ */
39
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
40
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
41
}
57
}
42
58
43
static void arm946_initfn(Object *obj)
59
+/*
44
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
60
+ * 0 means "unset, use the default value". That default might vary depending
45
* set the field to indicate Jazelle support within QEMU.
61
+ * on the CPU type, and is set in the realize fn.
46
*/
62
+ */
47
cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
63
static Property arm_cpu_gt_cntfrq_property =
48
+ /*
64
- DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz,
49
+ * Similarly, we need to set MVFR0 fields to enable double precision
65
- NANOSECONDS_PER_SECOND / GTIMER_SCALE);
50
+ * and short vector support even though ARMv5 doesn't have this register.
66
+ DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz, 0);
51
+ */
67
52
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
68
static Property arm_cpu_reset_cbar_property =
53
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
69
DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
70
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
71
return;
72
}
73
74
+ if (!cpu->gt_cntfrq_hz) {
75
+ /*
76
+ * 0 means "the board didn't set a value, use the default".
77
+ * The default value of the generic timer frequency (as seen in
78
+ * CNTFRQ_EL0) is 62.5MHz, which corresponds to a period of 16ns.
79
+ * This is what you get (a) for a CONFIG_USER_ONLY CPU (b) if the
80
+ * board doesn't set it.
81
+ */
82
+ cpu->gt_cntfrq_hz = GTIMER_DEFAULT_HZ;
83
+ }
84
+
85
#ifndef CONFIG_USER_ONLY
86
/* The NVIC and M-profile CPU are two halves of a single piece of
87
* hardware; trying to use one without the other is a command line
88
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
89
}
54
90
55
{
91
{
56
/* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
92
- uint64_t scale;
93
-
94
- if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
95
- if (!cpu->gt_cntfrq_hz) {
96
- error_setg(errp, "Invalid CNTFRQ: %"PRId64"Hz",
97
- cpu->gt_cntfrq_hz);
98
- return;
99
- }
100
- scale = gt_cntfrq_period_ns(cpu);
101
- } else {
102
- scale = GTIMER_SCALE;
103
- }
104
+ uint64_t scale = gt_cntfrq_period_ns(cpu);
105
106
cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
107
arm_gt_ptimer_cb, cpu);
108
diff --git a/target/arm/helper.c b/target/arm/helper.c
109
index XXXXXXX..XXXXXXX 100644
110
--- a/target/arm/helper.c
111
+++ b/target/arm/helper.c
112
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
113
.resetvalue = 0 },
114
};
115
116
+static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
117
+{
118
+ ARMCPU *cpu = env_archcpu(env);
119
+
120
+ cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
121
+}
122
+
123
#ifndef CONFIG_USER_ONLY
124
125
static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,
126
@@ -XXX,XX +XXX,XX @@ void arm_gt_hvtimer_cb(void *opaque)
127
gt_recalc_timer(cpu, GTIMER_HYPVIRT);
128
}
129
130
-static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
131
-{
132
- ARMCPU *cpu = env_archcpu(env);
133
-
134
- cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
135
-}
136
-
137
static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
138
/*
139
* Note that CNTFRQ is purely reads-as-written for the benefit
140
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
141
.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
142
.type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
143
.fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
144
- .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE,
145
+ .resetfn = arm_gt_cntfrq_reset,
146
},
147
{ .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
148
.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
57
--
149
--
58
2.20.1
150
2.34.1
59
151
60
152
diff view generated by jsdifflib
[Qemu-devel] [PULL 10/10] target/arm: NS BusFault on vector table fetch escalates to NS HardFault
[PULL 11/21] hw/arm/sbsa-ref: Force CPU generic timer to 62.5MHz
1
In the M-profile architecture, when we do a vector table fetch and it
1
Currently QEMU CPUs always run with a generic timer counter frequency
2
fails, we need to report a HardFault. Whether this is a Secure HF or
2
of 62.5MHz, but ARMv8.6 CPUs will run at 1GHz. For older versions of
3
a NonSecure HF depends on several things. If AIRCR.BFHFNMINS is 0
3
the TF-A firmware that sbsa-ref runs, the frequency of the generic
4
then HF is always Secure, because there is no NonSecure HardFault.
4
timer is hardcoded into the firmware, and so if the CPU actually has
5
Otherwise, the answer depends on whether the 'underlying exception'
5
a different frequency then timers in the guest will be set
6
(MemManage, BusFault, SecureFault) targets Secure or NonSecure. (In
6
incorrectly.
7
the pseudocode, this is handled in the Vector() function: the final
8
exc.isSecure is calculated by looking at the exc.isSecure from the
9
exception returned from the memory access, not the isSecure input
10
argument.)
11
7
12
We weren't doing this correctly, because we were looking at
8
The default frequency used by the 'max' CPU is about to change, so
13
the target security domain of the exception we were trying to
9
make the sbsa-ref board force the CPU frequency to the value which
14
load the vector table entry for. This produces errors of two kinds:
10
the firmware expects.
15
* a load from the NS vector table which hits the "NS access
16
to S memory" SecureFault should end up as a Secure HardFault,
17
but we were raising an NS HardFault
18
* a load from the S vector table which causes a BusFault
19
should raise an NS HardFault if BFHFNMINS == 1 (because
20
in that case all BusFaults are NonSecure), but we were raising
21
a Secure HardFault
22
11
23
Correct the logic.
12
Newer versions of TF-A will read the frequency from the CPU's
24
13
CNTFRQ_EL0 register:
25
We also fix a comment error where we claimed that we might
14
https://github.com/ARM-software/arm-trusted-firmware/commit/4c77fac98dac0bebc63798aae9101ac865b87148
26
be escalating MemManage to HardFault, and forgot about SecureFault.
15
so in the longer term we could make this board use the 1GHz
27
(Vector loads can never hit MPU access faults, because they're
16
frequency. We will need to make sure we update the binaries used
28
always aligned and always use the default address map.)
17
by our avocado test
18
Aarch64SbsarefMachine.test_sbsaref_alpine_linux_max_pauth_impdef
19
before we can do that.
29
20
30
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
21
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
31
Message-id: 20190705094823.28905-1-peter.maydell@linaro.org
22
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
23
Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
24
Message-id: 20240426122913.3427983-3-peter.maydell@linaro.org
32
---
25
---
33
target/arm/m_helper.c | 21 +++++++++++++++++----
26
hw/arm/sbsa-ref.c | 15 +++++++++++++++
34
1 file changed, 17 insertions(+), 4 deletions(-)
27
1 file changed, 15 insertions(+)
35
28
36
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
29
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
37
index XXXXXXX..XXXXXXX 100644
30
index XXXXXXX..XXXXXXX 100644
38
--- a/target/arm/m_helper.c
31
--- a/hw/arm/sbsa-ref.c
39
+++ b/target/arm/m_helper.c
32
+++ b/hw/arm/sbsa-ref.c
40
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
33
@@ -XXX,XX +XXX,XX @@
41
if (sattrs.ns) {
34
#define NUM_SMMU_IRQS 4
42
attrs.secure = false;
35
#define NUM_SATA_PORTS 6
43
} else if (!targets_secure) {
36
44
- /* NS access to S memory */
37
+/*
45
+ /*
38
+ * Generic timer frequency in Hz (which drives both the CPU generic timers
46
+ * NS access to S memory: the underlying exception which we escalate
39
+ * and the SBSA watchdog-timer). Older versions of the TF-A firmware
47
+ * to HardFault is SecureFault, which always targets Secure.
40
+ * typically used with sbsa-ref (including the binaries in our Avocado test
48
+ */
41
+ * Aarch64SbsarefMachine.test_sbsaref_alpine_linux_max_pauth_impdef
49
+ exc_secure = true;
42
+ * assume it is this value.
50
goto load_fail;
43
+ *
44
+ * TODO: this value is not architecturally correct for an Armv8.6 or
45
+ * better CPU, so we should move to 1GHz once the TF-A fix above has
46
+ * made it into a release and into our Avocado test.
47
+ */
48
+#define SBSA_GTIMER_HZ 62500000
49
+
50
enum {
51
SBSA_FLASH,
52
SBSA_MEM,
53
@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
54
&error_abort);
51
}
55
}
52
}
56
53
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
57
+ object_property_set_int(cpuobj, "cntfrq", SBSA_GTIMER_HZ, &error_abort);
54
vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
58
+
55
attrs, &result);
59
object_property_set_link(cpuobj, "memory", OBJECT(sysmem),
56
if (result != MEMTX_OK) {
60
&error_abort);
57
+ /*
61
58
+ * Underlying exception is BusFault: its target security state
59
+ * depends on BFHFNMINS.
60
+ */
61
+ exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
62
goto load_fail;
63
}
64
*pvec = vector_entry;
65
@@ -XXX,XX +XXX,XX @@ load_fail:
66
/*
67
* All vector table fetch fails are reported as HardFault, with
68
* HFSR.VECTTBL and .FORCED set. (FORCED is set because
69
- * technically the underlying exception is a MemManage or BusFault
70
+ * technically the underlying exception is a SecureFault or BusFault
71
* that is escalated to HardFault.) This is a terminal exception,
72
* so we will either take the HardFault immediately or else enter
73
* lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
74
+ * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
75
+ * secure); otherwise it targets the same security state as the
76
+ * underlying exception.
77
*/
78
- exc_secure = targets_secure ||
79
- !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
80
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
81
+ exc_secure = true;
82
+ }
83
env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
84
armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
85
return false;
86
--
62
--
87
2.20.1
63
2.34.1
88
64
89
65
diff view generated by jsdifflib
[Qemu-devel] [PULL 02/10] hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
[PULL 12/21] hw/watchdog/sbsa_gwdt: Make watchdog timer frequency a QOM property
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
Currently the sbsa_gdwt watchdog device hardcodes its frequency at
2
62.5MHz. In real hardware, this watchdog is supposed to be driven
3
from the system counter, which also drives the CPU generic timers.
4
Newer CPU types (in particular from Armv8.6) should have a CPU
5
generic timer frequency of 1GHz, so we can't leave the watchdog
6
on the old QEMU default of 62.5GHz.
2
7
3
In the next commit we will implement the write_with_attrs()
8
Make the frequency a QOM property so it can be set by the board,
4
handler. To avoid using different APIs, convert the read()
9
and have our only board that uses this device set that frequency
5
handler first.
10
to the same value it sets the CPU frequency.
6
11
7
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
8
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
9
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
14
Message-id: 20240426122913.3427983-4-peter.maydell@linaro.org
11
---
15
---
12
hw/ssi/xilinx_spips.c | 23 +++++++++++------------
16
include/hw/watchdog/sbsa_gwdt.h | 3 +--
13
1 file changed, 11 insertions(+), 12 deletions(-)
17
hw/arm/sbsa-ref.c | 1 +
18
hw/watchdog/sbsa_gwdt.c | 15 ++++++++++++++-
19
3 files changed, 16 insertions(+), 3 deletions(-)
14
20
15
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
21
diff --git a/include/hw/watchdog/sbsa_gwdt.h b/include/hw/watchdog/sbsa_gwdt.h
16
index XXXXXXX..XXXXXXX 100644
22
index XXXXXXX..XXXXXXX 100644
17
--- a/hw/ssi/xilinx_spips.c
23
--- a/include/hw/watchdog/sbsa_gwdt.h
18
+++ b/hw/ssi/xilinx_spips.c
24
+++ b/include/hw/watchdog/sbsa_gwdt.h
19
@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
25
@@ -XXX,XX +XXX,XX @@
20
}
26
#define SBSA_GWDT_RMMIO_SIZE 0x1000
27
#define SBSA_GWDT_CMMIO_SIZE 0x1000
28
29
-#define SBSA_TIMER_FREQ 62500000 /* Hz */
30
-
31
typedef struct SBSA_GWDTState {
32
/* <private> */
33
SysBusDevice parent_obj;
34
@@ -XXX,XX +XXX,XX @@ typedef struct SBSA_GWDTState {
35
qemu_irq irq;
36
37
QEMUTimer *timer;
38
+ uint64_t freq;
39
40
uint32_t id;
41
uint32_t wcs;
42
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
43
index XXXXXXX..XXXXXXX 100644
44
--- a/hw/arm/sbsa-ref.c
45
+++ b/hw/arm/sbsa-ref.c
46
@@ -XXX,XX +XXX,XX @@ static void create_wdt(const SBSAMachineState *sms)
47
SysBusDevice *s = SYS_BUS_DEVICE(dev);
48
int irq = sbsa_ref_irqmap[SBSA_GWDT_WS0];
49
50
+ qdev_prop_set_uint64(dev, "clock-frequency", SBSA_GTIMER_HZ);
51
sysbus_realize_and_unref(s, &error_fatal);
52
sysbus_mmio_map(s, 0, rbase);
53
sysbus_mmio_map(s, 1, cbase);
54
diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c
55
index XXXXXXX..XXXXXXX 100644
56
--- a/hw/watchdog/sbsa_gwdt.c
57
+++ b/hw/watchdog/sbsa_gwdt.c
58
@@ -XXX,XX +XXX,XX @@
59
#include "qemu/osdep.h"
60
#include "sysemu/reset.h"
61
#include "sysemu/watchdog.h"
62
+#include "hw/qdev-properties.h"
63
#include "hw/watchdog/sbsa_gwdt.h"
64
#include "qemu/timer.h"
65
#include "migration/vmstate.h"
66
@@ -XXX,XX +XXX,XX @@ static void sbsa_gwdt_update_timer(SBSA_GWDTState *s, WdtRefreshType rtype)
67
timeout = s->woru;
68
timeout <<= 32;
69
timeout |= s->worl;
70
- timeout = muldiv64(timeout, NANOSECONDS_PER_SECOND, SBSA_TIMER_FREQ);
71
+ timeout = muldiv64(timeout, NANOSECONDS_PER_SECOND, s->freq);
72
timeout += qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
73
74
if ((rtype == EXPLICIT_REFRESH) || ((rtype == TIMEOUT_REFRESH) &&
75
@@ -XXX,XX +XXX,XX @@ static void wdt_sbsa_gwdt_realize(DeviceState *dev, Error **errp)
76
dev);
21
}
77
}
22
78
23
-static uint64_t
79
+static Property wdt_sbsa_gwdt_props[] = {
24
-lqspi_read(void *opaque, hwaddr addr, unsigned int size)
80
+ /*
25
+static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
81
+ * Timer frequency in Hz. This must match the frequency used by
26
+ unsigned size, MemTxAttrs attrs)
82
+ * the CPU's generic timer. Default 62.5Hz matches QEMU's legacy
83
+ * CPU timer frequency default.
84
+ */
85
+ DEFINE_PROP_UINT64("clock-frequency", struct SBSA_GWDTState, freq,
86
+ 62500000),
87
+ DEFINE_PROP_END_OF_LIST(),
88
+};
89
+
90
static void wdt_sbsa_gwdt_class_init(ObjectClass *klass, void *data)
27
{
91
{
28
- XilinxQSPIPS *q = opaque;
92
DeviceClass *dc = DEVICE_CLASS(klass);
29
- uint32_t ret;
93
@@ -XXX,XX +XXX,XX @@ static void wdt_sbsa_gwdt_class_init(ObjectClass *klass, void *data)
30
+ XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
94
set_bit(DEVICE_CATEGORY_WATCHDOG, dc->categories);
31
95
dc->vmsd = &vmstate_sbsa_gwdt;
32
if (addr >= q->lqspi_cached_addr &&
96
dc->desc = "SBSA-compliant generic watchdog device";
33
addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
97
+ device_class_set_props(dc, wdt_sbsa_gwdt_props);
34
uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
35
- ret = cpu_to_le32(*(uint32_t *)retp);
36
- DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
37
- (unsigned)ret);
38
- return ret;
39
- } else {
40
- lqspi_load_cache(opaque, addr);
41
- return lqspi_read(opaque, addr, size);
42
+ *value = cpu_to_le32(*(uint32_t *)retp);
43
+ DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
44
+ addr, *value);
45
+ return MEMTX_OK;
46
}
47
+
48
+ lqspi_load_cache(opaque, addr);
49
+ return lqspi_read(opaque, addr, value, size, attrs);
50
}
98
}
51
99
52
static const MemoryRegionOps lqspi_ops = {
100
static const TypeInfo wdt_sbsa_gwdt_info = {
53
- .read = lqspi_read,
54
+ .read_with_attrs = lqspi_read,
55
.endianness = DEVICE_NATIVE_ENDIAN,
56
.valid = {
57
.min_access_size = 1,
58
--
101
--
59
2.20.1
102
2.34.1
60
103
61
104
diff view generated by jsdifflib
[Qemu-devel] [PULL 01/10] target/arm: report ARMv8-A FP support for AArch32 -cpu max
[PULL 13/21] target/arm: Default to 1GHz cntfrq for 'max' and new CPUs
1
From: Alex Bennée <alex.bennee@linaro.org>
1
In previous versions of the Arm architecture, the frequency of the
2
2
generic timers as reported in CNTFRQ_EL0 could be any IMPDEF value,
3
When we converted to using feature bits in 602f6e42cfbf we missed out
3
and for QEMU we picked 62.5MHz, giving a timer tick period of 16ns.
4
the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for
4
In Armv8.6, the architecture standardized this frequency to 1GHz.
5
-cpu max configurations. This caused a regression in the GCC test
5
6
suite. Fix this by setting the appropriate bits in mvfr1.FPHP to
6
Because there is no ID register feature field that indicates whether
7
report ARMv8-A with FP support (but not ARMv8.2-FP16).
7
a CPU is v8.6 or that it ought to have this counter frequency, we
8
8
implement this by changing our default CNTFRQ value for all CPUs,
9
Fixes: https://bugs.launchpad.net/qemu/+bug/1836078
9
with exceptions for backwards compatibility:
10
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
10
11
* CPU types which we already implement will retain the old
12
default value. None of these are v8.6 CPUs, so this is
13
architecturally OK.
14
* CPUs used in versioned machine types with a version of 9.0
15
or earlier will retain the old default value.
16
17
The upshot is that the only CPU type that changes is 'max'; but any
18
new type we add in future (whether v8.6 or not) will also get the new
19
1GHz default.
20
21
It remains the case that the machine model can override the default
22
value via the 'cntfrq' QOM property (regardless of the CPU type).
23
24
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
25
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 20190711103737.10017-1-alex.bennee@linaro.org
26
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Message-id: 20240426122913.3427983-5-peter.maydell@linaro.org
14
---
28
---
15
target/arm/cpu.c | 4 ++++
29
target/arm/cpu.h | 11 +++++++++++
16
1 file changed, 4 insertions(+)
30
target/arm/internals.h | 12 ++++++++++--
17
31
hw/core/machine.c | 4 +++-
32
target/arm/cpu.c | 23 +++++++++++++++++------
33
target/arm/cpu64.c | 2 ++
34
target/arm/tcg/cpu32.c | 4 ++++
35
target/arm/tcg/cpu64.c | 18 ++++++++++++++++++
36
7 files changed, 65 insertions(+), 9 deletions(-)
37
38
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
39
index XXXXXXX..XXXXXXX 100644
40
--- a/target/arm/cpu.h
41
+++ b/target/arm/cpu.h
42
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
43
*/
44
bool host_cpu_probe_failed;
45
46
+ /* QOM property to indicate we should use the back-compat CNTFRQ default */
47
+ bool backcompat_cntfrq;
48
+
49
/* Specify the number of cores in this CPU cluster. Used for the L2CTLR
50
* register.
51
*/
52
@@ -XXX,XX +XXX,XX @@ enum arm_features {
53
ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
54
ARM_FEATURE_M_MAIN, /* M profile Main Extension */
55
ARM_FEATURE_V8_1M, /* M profile extras only in v8.1M and later */
56
+ /*
57
+ * ARM_FEATURE_BACKCOMPAT_CNTFRQ makes the CPU default cntfrq be 62.5MHz
58
+ * if the board doesn't set a value, instead of 1GHz. It is for backwards
59
+ * compatibility and used only with CPU definitions that were already
60
+ * in QEMU before we changed the default. It should not be set on any
61
+ * CPU types added in future.
62
+ */
63
+ ARM_FEATURE_BACKCOMPAT_CNTFRQ, /* 62.5MHz timer default */
64
};
65
66
static inline int arm_feature(CPUARMState *env, int feature)
67
diff --git a/target/arm/internals.h b/target/arm/internals.h
68
index XXXXXXX..XXXXXXX 100644
69
--- a/target/arm/internals.h
70
+++ b/target/arm/internals.h
71
@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)
72
73
/*
74
* Default frequency for the generic timer, in Hz.
75
- * This is 62.5MHz, which gives a 16 ns tick period.
76
+ * ARMv8.6 and later CPUs architecturally must use a 1GHz timer; before
77
+ * that it was an IMPDEF choice, and QEMU initially picked 62.5MHz,
78
+ * which gives a 16ns tick period.
79
+ *
80
+ * We will use the back-compat value:
81
+ * - for QEMU CPU types added before we standardized on 1GHz
82
+ * - for versioned machine types with a version of 9.0 or earlier
83
+ * In any case, the machine model may override via the cntfrq property.
84
*/
85
-#define GTIMER_DEFAULT_HZ 62500000
86
+#define GTIMER_DEFAULT_HZ 1000000000
87
+#define GTIMER_BACKCOMPAT_HZ 62500000
88
89
/* Bit definitions for the v7M CONTROL register */
90
FIELD(V7M_CONTROL, NPRIV, 0, 1)
91
diff --git a/hw/core/machine.c b/hw/core/machine.c
92
index XXXXXXX..XXXXXXX 100644
93
--- a/hw/core/machine.c
94
+++ b/hw/core/machine.c
95
@@ -XXX,XX +XXX,XX @@
96
#include "hw/virtio/virtio-iommu.h"
97
#include "audio/audio.h"
98
99
-GlobalProperty hw_compat_9_0[] = {};
100
+GlobalProperty hw_compat_9_0[] = {
101
+ {"arm-cpu", "backcompat-cntfrq", "true" },
102
+};
103
const size_t hw_compat_9_0_len = G_N_ELEMENTS(hw_compat_9_0);
104
105
GlobalProperty hw_compat_8_2[] = {
18
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
106
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
19
index XXXXXXX..XXXXXXX 100644
107
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/cpu.c
108
--- a/target/arm/cpu.c
21
+++ b/target/arm/cpu.c
109
+++ b/target/arm/cpu.c
110
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
111
112
if (!cpu->gt_cntfrq_hz) {
113
/*
114
- * 0 means "the board didn't set a value, use the default".
115
- * The default value of the generic timer frequency (as seen in
116
- * CNTFRQ_EL0) is 62.5MHz, which corresponds to a period of 16ns.
117
- * This is what you get (a) for a CONFIG_USER_ONLY CPU (b) if the
118
- * board doesn't set it.
119
+ * 0 means "the board didn't set a value, use the default". (We also
120
+ * get here for the CONFIG_USER_ONLY case.)
121
+ * ARMv8.6 and later CPUs architecturally must use a 1GHz timer; before
122
+ * that it was an IMPDEF choice, and QEMU initially picked 62.5MHz,
123
+ * which gives a 16ns tick period.
124
+ *
125
+ * We will use the back-compat value:
126
+ * - for QEMU CPU types added before we standardized on 1GHz
127
+ * - for versioned machine types with a version of 9.0 or earlier
128
*/
129
- cpu->gt_cntfrq_hz = GTIMER_DEFAULT_HZ;
130
+ if (arm_feature(env, ARM_FEATURE_BACKCOMPAT_CNTFRQ) ||
131
+ cpu->backcompat_cntfrq) {
132
+ cpu->gt_cntfrq_hz = GTIMER_BACKCOMPAT_HZ;
133
+ } else {
134
+ cpu->gt_cntfrq_hz = GTIMER_DEFAULT_HZ;
135
+ }
136
}
137
138
#ifndef CONFIG_USER_ONLY
139
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_properties[] = {
140
mp_affinity, ARM64_AFFINITY_INVALID),
141
DEFINE_PROP_INT32("node-id", ARMCPU, node_id, CPU_UNSET_NUMA_NODE_ID),
142
DEFINE_PROP_INT32("core-count", ARMCPU, core_count, -1),
143
+ /* True to default to the backward-compat old CNTFRQ rather than 1Ghz */
144
+ DEFINE_PROP_BOOL("backcompat-cntfrq", ARMCPU, backcompat_cntfrq, false),
145
DEFINE_PROP_END_OF_LIST()
146
};
147
148
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
149
index XXXXXXX..XXXXXXX 100644
150
--- a/target/arm/cpu64.c
151
+++ b/target/arm/cpu64.c
152
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
153
set_feature(&cpu->env, ARM_FEATURE_V8);
154
set_feature(&cpu->env, ARM_FEATURE_NEON);
155
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
156
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
157
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
158
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
159
set_feature(&cpu->env, ARM_FEATURE_EL2);
160
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
161
set_feature(&cpu->env, ARM_FEATURE_V8);
162
set_feature(&cpu->env, ARM_FEATURE_NEON);
163
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
164
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
165
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
166
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
167
set_feature(&cpu->env, ARM_FEATURE_EL2);
168
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
169
index XXXXXXX..XXXXXXX 100644
170
--- a/target/arm/tcg/cpu32.c
171
+++ b/target/arm/tcg/cpu32.c
172
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
173
set_feature(&cpu->env, ARM_FEATURE_NEON);
174
set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
175
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
176
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
177
set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
178
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
179
set_feature(&cpu->env, ARM_FEATURE_EL2);
180
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
181
set_feature(&cpu->env, ARM_FEATURE_NEON);
182
set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
183
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
184
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
185
set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
186
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
187
set_feature(&cpu->env, ARM_FEATURE_EL2);
188
@@ -XXX,XX +XXX,XX @@ static void cortex_r52_initfn(Object *obj)
189
set_feature(&cpu->env, ARM_FEATURE_PMSA);
190
set_feature(&cpu->env, ARM_FEATURE_NEON);
191
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
192
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
193
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
194
set_feature(&cpu->env, ARM_FEATURE_AUXCR);
195
cpu->midr = 0x411fd133; /* r1p3 */
22
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
196
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
23
t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
197
set_feature(&cpu->env, ARM_FEATURE_V8);
24
cpu->isar.id_isar6 = t;
198
set_feature(&cpu->env, ARM_FEATURE_NEON);
25
199
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
26
+ t = cpu->isar.mvfr1;
200
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
27
+ t = FIELD_DP32(t, MVFR1, FPHP, 2); /* v8.0 FP support */
201
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
28
+ cpu->isar.mvfr1 = t;
202
set_feature(&cpu->env, ARM_FEATURE_EL2);
203
set_feature(&cpu->env, ARM_FEATURE_EL3);
204
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
205
index XXXXXXX..XXXXXXX 100644
206
--- a/target/arm/tcg/cpu64.c
207
+++ b/target/arm/tcg/cpu64.c
208
@@ -XXX,XX +XXX,XX @@ static void aarch64_a35_initfn(Object *obj)
209
set_feature(&cpu->env, ARM_FEATURE_V8);
210
set_feature(&cpu->env, ARM_FEATURE_NEON);
211
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
212
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
213
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
214
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
215
set_feature(&cpu->env, ARM_FEATURE_EL2);
216
@@ -XXX,XX +XXX,XX @@ static void aarch64_a55_initfn(Object *obj)
217
set_feature(&cpu->env, ARM_FEATURE_V8);
218
set_feature(&cpu->env, ARM_FEATURE_NEON);
219
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
220
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
221
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
222
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
223
set_feature(&cpu->env, ARM_FEATURE_EL2);
224
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
225
set_feature(&cpu->env, ARM_FEATURE_V8);
226
set_feature(&cpu->env, ARM_FEATURE_NEON);
227
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
228
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
229
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
230
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
231
set_feature(&cpu->env, ARM_FEATURE_EL2);
232
@@ -XXX,XX +XXX,XX @@ static void aarch64_a76_initfn(Object *obj)
233
set_feature(&cpu->env, ARM_FEATURE_V8);
234
set_feature(&cpu->env, ARM_FEATURE_NEON);
235
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
236
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
237
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
238
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
239
set_feature(&cpu->env, ARM_FEATURE_EL2);
240
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
241
set_feature(&cpu->env, ARM_FEATURE_V8);
242
set_feature(&cpu->env, ARM_FEATURE_NEON);
243
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
244
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
245
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
246
set_feature(&cpu->env, ARM_FEATURE_EL2);
247
set_feature(&cpu->env, ARM_FEATURE_EL3);
248
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
249
set_feature(&cpu->env, ARM_FEATURE_V8);
250
set_feature(&cpu->env, ARM_FEATURE_NEON);
251
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
252
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
253
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
254
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
255
set_feature(&cpu->env, ARM_FEATURE_EL2);
256
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_v1_initfn(Object *obj)
257
set_feature(&cpu->env, ARM_FEATURE_V8);
258
set_feature(&cpu->env, ARM_FEATURE_NEON);
259
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
260
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
261
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
262
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
263
set_feature(&cpu->env, ARM_FEATURE_EL2);
264
@@ -XXX,XX +XXX,XX @@ static void aarch64_a710_initfn(Object *obj)
265
set_feature(&cpu->env, ARM_FEATURE_V8);
266
set_feature(&cpu->env, ARM_FEATURE_NEON);
267
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
268
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
269
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
270
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
271
set_feature(&cpu->env, ARM_FEATURE_EL2);
272
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n2_initfn(Object *obj)
273
set_feature(&cpu->env, ARM_FEATURE_V8);
274
set_feature(&cpu->env, ARM_FEATURE_NEON);
275
set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
276
+ set_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
277
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
278
set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
279
set_feature(&cpu->env, ARM_FEATURE_EL2);
280
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
281
uint64_t t;
282
uint32_t u;
283
284
+ /*
285
+ * Unset ARM_FEATURE_BACKCOMPAT_CNTFRQ, which we would otherwise default
286
+ * to because we started with aarch64_a57_initfn(). A 'max' CPU might
287
+ * be a v8.6-or-later one, in which case the cntfrq must be 1GHz; and
288
+ * because it is our "may change" CPU type we are OK with it not being
289
+ * backwards-compatible with how it worked in old QEMU.
290
+ */
291
+ unset_feature(&cpu->env, ARM_FEATURE_BACKCOMPAT_CNTFRQ);
29
+
292
+
30
t = cpu->isar.mvfr2;
293
/*
31
t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
294
* Reset MIDR so the guest doesn't mistake our 'max' CPU type for a real
32
t = FIELD_DP32(t, MVFR2, FPMISC, 4); /* FP MaxNum */
295
* one and try to apply errata workarounds or use impdef features we
33
--
296
--
34
2.20.1
297
2.34.1
35
298
36
299
diff view generated by jsdifflib
New patch
[PULL 14/21] hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
1
From: Alexandra Diupina <adiupina@astralinux.ru>
1
2
3
The DMA descriptor structures for this device have
4
a set of "address extension" fields which extend the 32
5
bit source addresses with an extra 16 bits to give a
6
48 bit address:
7
https://docs.amd.com/r/en-US/ug1085-zynq-ultrascale-trm/ADDR_EXT-Field
8
9
However, we misimplemented this address extension in several ways:
10
* we only extracted 12 bits of the extension fields, not 16
11
* we didn't shift the extension field up far enough
12
* we accidentally did the shift as 32-bit arithmetic, which
13
meant that we would have an overflow instead of setting
14
bits [47:32] of the resulting 64-bit address
15
16
Add a type cast and use extract64() instead of extract32()
17
to avoid integer overflow on addition. Fix bit fields
18
extraction according to documentation.
19
20
Found by Linux Verification Center (linuxtesting.org) with SVACE.
21
22
Cc: qemu-stable@nongnu.org
23
Fixes: d3c6369a96 ("introduce xlnx-dpdma")
24
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
25
Message-id: 20240428181131.23801-1-adiupina@astralinux.ru
26
[PMM: adjusted commit message]
27
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
28
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
29
---
30
hw/dma/xlnx_dpdma.c | 20 ++++++++++----------
31
1 file changed, 10 insertions(+), 10 deletions(-)
32
33
diff --git a/hw/dma/xlnx_dpdma.c b/hw/dma/xlnx_dpdma.c
34
index XXXXXXX..XXXXXXX 100644
35
--- a/hw/dma/xlnx_dpdma.c
36
+++ b/hw/dma/xlnx_dpdma.c
37
@@ -XXX,XX +XXX,XX @@ static uint64_t xlnx_dpdma_desc_get_source_address(DPDMADescriptor *desc,
38
39
switch (frag) {
40
case 0:
41
- addr = desc->source_address
42
- + (extract32(desc->address_extension, 16, 12) << 20);
43
+ addr = (uint64_t)desc->source_address
44
+ + (extract64(desc->address_extension, 16, 16) << 32);
45
break;
46
case 1:
47
- addr = desc->source_address2
48
- + (extract32(desc->address_extension_23, 0, 12) << 8);
49
+ addr = (uint64_t)desc->source_address2
50
+ + (extract64(desc->address_extension_23, 0, 16) << 32);
51
break;
52
case 2:
53
- addr = desc->source_address3
54
- + (extract32(desc->address_extension_23, 16, 12) << 20);
55
+ addr = (uint64_t)desc->source_address3
56
+ + (extract64(desc->address_extension_23, 16, 16) << 32);
57
break;
58
case 3:
59
- addr = desc->source_address4
60
- + (extract32(desc->address_extension_45, 0, 12) << 8);
61
+ addr = (uint64_t)desc->source_address4
62
+ + (extract64(desc->address_extension_45, 0, 16) << 32);
63
break;
64
case 4:
65
- addr = desc->source_address5
66
- + (extract32(desc->address_extension_45, 16, 12) << 20);
67
+ addr = (uint64_t)desc->source_address5
68
+ + (extract64(desc->address_extension_45, 16, 16) << 32);
69
break;
70
default:
71
addr = 0;
72
--
73
2.34.1
diff view generated by jsdifflib
[Qemu-devel] [PULL 05/10] hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
[PULL 15/21] hw/char/stm32l4x5_usart: Fix memory corruption by adding correct class_size
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Thomas Huth <thuth@redhat.com>
2
2
3
Reading the RX_DATA register when the RX_FIFO is empty triggers
3
"make check-qtest-aarch64" recently started failing on FreeBSD builds,
4
an abort. This can be easily reproduced:
4
and valgrind on Linux also detected that there is something fishy with
5
the new stm32l4x5-usart: The code forgot to set the correct class_size
6
here, so the various class_init functions in this file wrote beyond
7
the allocated buffer when setting the subc->type field.
5
8
6
$ qemu-system-arm -M emcraft-sf2 -monitor stdio -S
9
Fixes: 4fb37aea7e ("hw/char: Implement STM32L4x5 USART skeleton")
7
QEMU 4.0.50 monitor - type 'help' for more information
10
Signed-off-by: Thomas Huth <thuth@redhat.com>
8
(qemu) x 0x40001010
11
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Aborted (core dumped)
12
Message-id: 20240429075908.36302-1-thuth@redhat.com
10
11
(gdb) bt
12
#1 0x00007f035874f895 in abort () at /lib64/libc.so.6
13
#2 0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66
14
#3 0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137
15
#4 0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168
16
#5 0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
17
#6 0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569
18
#7 0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420
19
#8 0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447
20
#9 0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385
21
#10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423
22
#11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436
23
#12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466
24
#13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976
25
#14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730
26
#15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785
27
#16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082
28
29
From the datasheet "Actel SmartFusion Microcontroller Subsystem
30
User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this
31
register has a reset value of 0.
32
33
Check the FIFO is not empty before accessing it, else log an
34
error message.
35
36
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
37
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
38
Message-id: 20190709113715.7761-3-philmd@redhat.com
39
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
40
---
14
---
41
hw/ssi/mss-spi.c | 8 +++++++-
15
hw/char/stm32l4x5_usart.c | 1 +
42
1 file changed, 7 insertions(+), 1 deletion(-)
16
1 file changed, 1 insertion(+)
43
17
44
diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
18
diff --git a/hw/char/stm32l4x5_usart.c b/hw/char/stm32l4x5_usart.c
45
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
46
--- a/hw/ssi/mss-spi.c
20
--- a/hw/char/stm32l4x5_usart.c
47
+++ b/hw/ssi/mss-spi.c
21
+++ b/hw/char/stm32l4x5_usart.c
48
@@ -XXX,XX +XXX,XX @@ spi_read(void *opaque, hwaddr addr, unsigned int size)
22
@@ -XXX,XX +XXX,XX @@ static const TypeInfo stm32l4x5_usart_types[] = {
49
case R_SPI_RX:
23
.parent = TYPE_SYS_BUS_DEVICE,
50
s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;
24
.instance_size = sizeof(Stm32l4x5UsartBaseState),
51
s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;
25
.instance_init = stm32l4x5_usart_base_init,
52
- ret = fifo32_pop(&s->rx_fifo);
26
+ .class_size = sizeof(Stm32l4x5UsartBaseClass),
53
+ if (fifo32_is_empty(&s->rx_fifo)) {
27
.class_init = stm32l4x5_usart_base_class_init,
54
+ qemu_log_mask(LOG_GUEST_ERROR,
28
.abstract = true,
55
+ "%s: Reading empty RX_FIFO\n",
29
}, {
56
+ __func__);
57
+ } else {
58
+ ret = fifo32_pop(&s->rx_fifo);
59
+ }
60
if (fifo32_is_empty(&s->rx_fifo)) {
61
s->regs[R_SPI_STATUS] |= S_RXFIFOEMP;
62
}
63
--
30
--
64
2.20.1
31
2.34.1
65
32
66
33
diff view generated by jsdifflib
[Qemu-devel] [PULL 04/10] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
[PULL 16/21] hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Philippe Mathieu-Daudé <philmd@linaro.org>
2
2
3
Both lqspi_read() and lqspi_load_cache() expect a 32-bit
3
Use little endian for derivative OTP fuse key.
4
aligned address.
5
4
6
>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':
5
Cc: qemu-stable@nongnu.org
7
6
Fixes: c752bb079b ("hw/nvram: NPCM7xx OTP device model")
8
Transfer Size Limitations
7
Suggested-by: Avi Fishman <Avi.Fishman@nuvoton.com>
9
8
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
10
Because of the 32-bit wide TX, RX, and generic FIFO, all
9
Message-id: 20240422125813.1403-1-philmd@linaro.org
11
APB/AXI transfers must be an integer multiple of 4-bytes.
10
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12
Shorter transfers are not possible.
13
14
Set MemoryRegionOps.impl values to force 32-bit accesses,
15
this way we are sure we do not access the lqspi_buf[] array
16
out of bound.
17
18
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
19
20
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
21
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
22
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
24
---
12
---
25
hw/ssi/xilinx_spips.c | 4 ++++
13
hw/arm/npcm7xx.c | 3 ++-
26
1 file changed, 4 insertions(+)
14
1 file changed, 2 insertions(+), 1 deletion(-)
27
15
28
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
16
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
29
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
30
--- a/hw/ssi/xilinx_spips.c
18
--- a/hw/arm/npcm7xx.c
31
+++ b/hw/ssi/xilinx_spips.c
19
+++ b/hw/arm/npcm7xx.c
32
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps lqspi_ops = {
20
@@ -XXX,XX +XXX,XX @@
33
.read_with_attrs = lqspi_read,
21
#include "hw/qdev-clock.h"
34
.write_with_attrs = lqspi_write,
22
#include "hw/qdev-properties.h"
35
.endianness = DEVICE_NATIVE_ENDIAN,
23
#include "qapi/error.h"
36
+ .impl = {
24
+#include "qemu/bswap.h"
37
+ .min_access_size = 4,
25
#include "qemu/units.h"
38
+ .max_access_size = 4,
26
#include "sysemu/sysemu.h"
39
+ },
27
#include "target/arm/cpu-qom.h"
40
.valid = {
28
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init_fuses(NPCM7xxState *s)
41
.min_access_size = 1,
29
* The initial mask of disabled modules indicates the chip derivative (e.g.
42
.max_access_size = 4
30
* NPCM750 or NPCM730).
31
*/
32
- value = tswap32(nc->disabled_modules);
33
+ value = cpu_to_le32(nc->disabled_modules);
34
npcm7xx_otp_array_write(&s->fuse_array, &value, NPCM7XX_FUSE_DERIVATIVE,
35
sizeof(value));
36
}
43
--
37
--
44
2.20.1
38
2.34.1
45
39
46
40
diff view generated by jsdifflib
[Qemu-devel] [PULL 08/10] pl031: Correctly migrate state when using -rtc clock=host
[PULL 17/21] hw/display : Add device DM163
1
The PL031 RTC tracks the difference between the guest RTC
1
From: Inès Varhol <ines.varhol@telecom-paris.fr>
2
and the host RTC using a tick_offset field. For migration,
3
however, we currently always migrate the offset between
4
the guest and the vm_clock, even if the RTC clock is not
5
the same as the vm_clock; this was an attempt to retain
6
migration backwards compatibility.
7
2
8
Unfortunately this results in the RTC behaving oddly across
3
This device implements the IM120417002 colors shield v1.1 for Arduino
9
a VM state save and restore -- since the VM clock stands still
4
(which relies on the DM163 8x3-channel led driving logic) and features
10
across save-then-restore, regardless of how much real world
5
a simple display of an 8x8 RGB matrix. The columns of the matrix are
11
time has elapsed, the guest RTC ends up out of sync with the
6
driven by the DM163 and the rows are driven externally.
12
host RTC in the restored VM.
13
7
14
Fix this by migrating the raw tick_offset. To retain migration
8
Acked-by: Alistair Francis <alistair.francis@wdc.com>
15
compatibility as far as possible, we have a new property
9
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
16
migrate-tick-offset; by default this is 'true' and we will
10
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
17
migrate the true tick offset in a new subsection; if the
11
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
18
incoming data has no subsection we fall back to the old
12
Message-id: 20240424200929.240921-2-ines.varhol@telecom-paris.fr
19
vm_clock-based offset information, so old->new migration
13
[PMM: updated to new reset hold method prototype]
20
compatibility is preserved. For complete new->old migration
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
21
compatibility, the property is set to 'false' for 4.0 and
15
---
22
earlier machine types (this will only affect 'virt-4.0'
16
docs/system/arm/b-l475e-iot01a.rst | 3 +-
23
and below, as none of the other pl031-using machines are
17
include/hw/display/dm163.h | 59 +++++
24
versioned).
18
hw/display/dm163.c | 349 +++++++++++++++++++++++++++++
19
hw/display/Kconfig | 3 +
20
hw/display/meson.build | 1 +
21
hw/display/trace-events | 14 ++
22
6 files changed, 428 insertions(+), 1 deletion(-)
23
create mode 100644 include/hw/display/dm163.h
24
create mode 100644 hw/display/dm163.c
25
25
26
Reported-by: Russell King <rmk@armlinux.org.uk>
26
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
29
Message-id: 20190709143912.28905-1-peter.maydell@linaro.org
30
---
31
include/hw/timer/pl031.h | 2 +
32
hw/core/machine.c | 1 +
33
hw/timer/pl031.c | 92 ++++++++++++++++++++++++++++++++++++++--
34
3 files changed, 91 insertions(+), 4 deletions(-)
35
36
diff --git a/include/hw/timer/pl031.h b/include/hw/timer/pl031.h
37
index XXXXXXX..XXXXXXX 100644
27
index XXXXXXX..XXXXXXX 100644
38
--- a/include/hw/timer/pl031.h
28
--- a/docs/system/arm/b-l475e-iot01a.rst
39
+++ b/include/hw/timer/pl031.h
29
+++ b/docs/system/arm/b-l475e-iot01a.rst
40
@@ -XXX,XX +XXX,XX @@ typedef struct PL031State {
30
@@ -XXX,XX +XXX,XX @@ USART, I2C, SPI, CAN and USB OTG, as well as a variety of sensors.
41
*/
31
Supported devices
42
uint32_t tick_offset_vmstate;
32
"""""""""""""""""
43
uint32_t tick_offset;
33
44
+ bool tick_offset_migrated;
34
-Currently B-L475E-IOT01A machine's only supports the following devices:
45
+ bool migrate_tick_offset;
35
+Currently B-L475E-IOT01A machines support the following devices:
46
36
47
uint32_t mr;
37
- Cortex-M4F based STM32L4x5 SoC
48
uint32_t lr;
38
- STM32L4x5 EXTI (Extended interrupts and events controller)
49
diff --git a/hw/core/machine.c b/hw/core/machine.c
39
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
50
index XXXXXXX..XXXXXXX 100644
40
- STM32L4x5 RCC (Reset and clock control)
51
--- a/hw/core/machine.c
41
- STM32L4x5 GPIOs (General-purpose I/Os)
52
+++ b/hw/core/machine.c
42
- STM32L4x5 USARTs, UARTs and LPUART (Serial ports)
53
@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_4_0[] = {
43
+- optional 8x8 led display (based on DM163 driver)
54
{ "virtio-gpu-pci", "edid", "false" },
44
55
{ "virtio-device", "use-started", "false" },
45
Missing devices
56
{ "virtio-balloon-device", "qemu-4-0-config-size", "true" },
46
"""""""""""""""
57
+ { "pl031", "migrate-tick-offset", "false" },
47
diff --git a/include/hw/display/dm163.h b/include/hw/display/dm163.h
58
};
48
new file mode 100644
59
const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
49
index XXXXXXX..XXXXXXX
60
50
--- /dev/null
61
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
51
+++ b/include/hw/display/dm163.h
62
index XXXXXXX..XXXXXXX 100644
52
@@ -XXX,XX +XXX,XX @@
63
--- a/hw/timer/pl031.c
53
+/*
64
+++ b/hw/timer/pl031.c
54
+ * QEMU DM163 8x3-channel constant current led driver
65
@@ -XXX,XX +XXX,XX @@ static int pl031_pre_save(void *opaque)
55
+ * driving columns of associated 8x8 RGB matrix.
66
{
56
+ *
67
PL031State *s = opaque;
57
+ * Copyright (C) 2024 Samuel Tardieu <sam@rfc1149.net>
68
58
+ * Copyright (C) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
69
- /* tick_offset is base_time - rtc_clock base time. Instead, we want to
59
+ * Copyright (C) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
70
- * store the base time relative to the QEMU_CLOCK_VIRTUAL for backwards-compatibility. */
60
+ *
71
+ /*
61
+ * SPDX-License-Identifier: GPL-2.0-or-later
72
+ * The PL031 device model code uses the tick_offset field, which is
62
+ */
73
+ * the offset between what the guest RTC should read and what the
63
+
74
+ * QEMU rtc_clock reads:
64
+#ifndef HW_DISPLAY_DM163_H
75
+ * guest_rtc = rtc_clock + tick_offset
65
+#define HW_DISPLAY_DM163_H
76
+ * and so
66
+
77
+ * tick_offset = guest_rtc - rtc_clock
67
+#include "qom/object.h"
78
+ *
68
+#include "hw/qdev-core.h"
79
+ * We want to migrate this offset, which sounds straightforward.
69
+
80
+ * Unfortunately older versions of QEMU migrated a conversion of this
70
+#define TYPE_DM163 "dm163"
81
+ * offset into an offset from the vm_clock. (This was in turn an
71
+OBJECT_DECLARE_SIMPLE_TYPE(DM163State, DM163);
82
+ * attempt to be compatible with even older QEMU versions, but it
72
+
83
+ * has incorrect behaviour if the rtc_clock is not the same as the
73
+#define RGB_MATRIX_NUM_ROWS 8
84
+ * vm_clock.) So we put the actual tick_offset into a migration
74
+#define RGB_MATRIX_NUM_COLS 8
85
+ * subsection, and the backwards-compatible time-relative-to-vm_clock
75
+#define DM163_NUM_LEDS (RGB_MATRIX_NUM_COLS * 3)
86
+ * in the main migration state.
76
+/* The last row is filled with 0 (turned off row) */
87
+ *
77
+#define COLOR_BUFFER_SIZE (RGB_MATRIX_NUM_ROWS + 1)
88
+ * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
78
+
89
+ */
79
+typedef struct DM163State {
90
int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
80
+ DeviceState parent_obj;
91
s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
81
+
92
82
+ /* DM163 driver */
93
return 0;
83
+ uint64_t bank0_shift_register[3];
94
}
84
+ uint64_t bank1_shift_register[3];
95
85
+ uint16_t latched_outputs[DM163_NUM_LEDS];
96
+static int pl031_pre_load(void *opaque)
86
+ uint16_t outputs[DM163_NUM_LEDS];
97
+{
87
+ qemu_irq sout;
98
+ PL031State *s = opaque;
88
+
99
+
89
+ uint8_t sin;
100
+ s->tick_offset_migrated = false;
90
+ uint8_t dck;
101
+ return 0;
91
+ uint8_t rst_b;
102
+}
92
+ uint8_t lat_b;
103
+
93
+ uint8_t selbk;
104
static int pl031_post_load(void *opaque, int version_id)
94
+ uint8_t en_b;
105
{
95
+
106
PL031State *s = opaque;
96
+ /* IM120417002 colors shield */
107
97
+ uint8_t activated_rows;
108
- int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
98
+
109
- s->tick_offset = s->tick_offset_vmstate - delta / NANOSECONDS_PER_SECOND;
99
+ /* 8x8 RGB matrix */
110
+ /*
100
+ QemuConsole *console;
111
+ * If we got the tick_offset subsection, then we can just use
101
+ uint8_t redraw;
112
+ * the value in that. Otherwise the source is an older QEMU and
102
+ /* Rows currently being displayed on the matrix. */
113
+ * has given us the offset from the vm_clock; convert it back to
103
+ /* The last row is filled with 0 (turned off row) */
114
+ * an offset from the rtc_clock. This will cause time to incorrectly
104
+ uint32_t buffer[COLOR_BUFFER_SIZE][RGB_MATRIX_NUM_COLS];
115
+ * go backwards compared to the host RTC, but this is unavoidable.
105
+ uint8_t last_buffer_idx;
116
+ */
106
+ uint8_t buffer_idx_of_row[RGB_MATRIX_NUM_ROWS];
117
+
107
+ /* Used to simulate retinal persistence of rows */
118
+ if (!s->tick_offset_migrated) {
108
+ uint8_t row_persistence_delay[RGB_MATRIX_NUM_ROWS];
119
+ int64_t delta = qemu_clock_get_ns(rtc_clock) -
109
+} DM163State;
120
+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
110
+
121
+ s->tick_offset = s->tick_offset_vmstate -
111
+#endif /* HW_DISPLAY_DM163_H */
122
+ delta / NANOSECONDS_PER_SECOND;
112
diff --git a/hw/display/dm163.c b/hw/display/dm163.c
123
+ }
113
new file mode 100644
124
pl031_set_alarm(s);
114
index XXXXXXX..XXXXXXX
125
return 0;
115
--- /dev/null
126
}
116
+++ b/hw/display/dm163.c
127
117
@@ -XXX,XX +XXX,XX @@
128
+static int pl031_tick_offset_post_load(void *opaque, int version_id)
118
+/*
129
+{
119
+ * QEMU DM163 8x3-channel constant current led driver
130
+ PL031State *s = opaque;
120
+ * driving columns of associated 8x8 RGB matrix.
131
+
121
+ *
132
+ s->tick_offset_migrated = true;
122
+ * Copyright (C) 2024 Samuel Tardieu <sam@rfc1149.net>
133
+ return 0;
123
+ * Copyright (C) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
134
+}
124
+ * Copyright (C) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
135
+
125
+ *
136
+static bool pl031_tick_offset_needed(void *opaque)
126
+ * SPDX-License-Identifier: GPL-2.0-or-later
137
+{
127
+ */
138
+ PL031State *s = opaque;
128
+
139
+
129
+/*
140
+ return s->migrate_tick_offset;
130
+ * The reference used for the DM163 is the following :
141
+}
131
+ * http://www.siti.com.tw/product/spec/LED/DM163.pdf
142
+
132
+ */
143
+static const VMStateDescription vmstate_pl031_tick_offset = {
133
+
144
+ .name = "pl031/tick-offset",
134
+#include "qemu/osdep.h"
135
+#include "qapi/error.h"
136
+#include "migration/vmstate.h"
137
+#include "hw/irq.h"
138
+#include "hw/qdev-properties.h"
139
+#include "hw/display/dm163.h"
140
+#include "ui/console.h"
141
+#include "trace.h"
142
+
143
+#define LED_SQUARE_SIZE 100
144
+/* Number of frames a row stays visible after being turned off. */
145
+#define ROW_PERSISTENCE 3
146
+#define TURNED_OFF_ROW (COLOR_BUFFER_SIZE - 1)
147
+
148
+static const VMStateDescription vmstate_dm163 = {
149
+ .name = TYPE_DM163,
145
+ .version_id = 1,
150
+ .version_id = 1,
146
+ .minimum_version_id = 1,
151
+ .minimum_version_id = 1,
147
+ .needed = pl031_tick_offset_needed,
152
+ .fields = (const VMStateField[]) {
148
+ .post_load = pl031_tick_offset_post_load,
153
+ VMSTATE_UINT64_ARRAY(bank0_shift_register, DM163State, 3),
149
+ .fields = (VMStateField[]) {
154
+ VMSTATE_UINT64_ARRAY(bank1_shift_register, DM163State, 3),
150
+ VMSTATE_UINT32(tick_offset, PL031State),
155
+ VMSTATE_UINT16_ARRAY(latched_outputs, DM163State, DM163_NUM_LEDS),
156
+ VMSTATE_UINT16_ARRAY(outputs, DM163State, DM163_NUM_LEDS),
157
+ VMSTATE_UINT8(dck, DM163State),
158
+ VMSTATE_UINT8(en_b, DM163State),
159
+ VMSTATE_UINT8(lat_b, DM163State),
160
+ VMSTATE_UINT8(rst_b, DM163State),
161
+ VMSTATE_UINT8(selbk, DM163State),
162
+ VMSTATE_UINT8(sin, DM163State),
163
+ VMSTATE_UINT8(activated_rows, DM163State),
164
+ VMSTATE_UINT32_2DARRAY(buffer, DM163State, COLOR_BUFFER_SIZE,
165
+ RGB_MATRIX_NUM_COLS),
166
+ VMSTATE_UINT8(last_buffer_idx, DM163State),
167
+ VMSTATE_UINT8_ARRAY(buffer_idx_of_row, DM163State, RGB_MATRIX_NUM_ROWS),
168
+ VMSTATE_UINT8_ARRAY(row_persistence_delay, DM163State,
169
+ RGB_MATRIX_NUM_ROWS),
151
+ VMSTATE_END_OF_LIST()
170
+ VMSTATE_END_OF_LIST()
152
+ }
171
+ }
153
+};
172
+};
154
+
173
+
155
static const VMStateDescription vmstate_pl031 = {
174
+static void dm163_reset_hold(Object *obj, ResetType type)
156
.name = "pl031",
175
+{
157
.version_id = 1,
176
+ DM163State *s = DM163(obj);
158
.minimum_version_id = 1,
177
+
159
.pre_save = pl031_pre_save,
178
+ s->sin = 0;
160
+ .pre_load = pl031_pre_load,
179
+ s->dck = 0;
161
.post_load = pl031_post_load,
180
+ s->rst_b = 0;
162
.fields = (VMStateField[]) {
181
+ /* Ensuring the first falling edge of lat_b isn't missed */
163
VMSTATE_UINT32(tick_offset_vmstate, PL031State),
182
+ s->lat_b = 1;
164
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl031 = {
183
+ s->selbk = 0;
165
VMSTATE_UINT32(im, PL031State),
184
+ s->en_b = 0;
166
VMSTATE_UINT32(is, PL031State),
185
+ /* Reset stops the PWM, not the shift and latched registers. */
167
VMSTATE_END_OF_LIST()
186
+ memset(s->outputs, 0, sizeof(s->outputs));
168
+ },
187
+
169
+ .subsections = (const VMStateDescription*[]) {
188
+ s->activated_rows = 0;
170
+ &vmstate_pl031_tick_offset,
189
+ s->redraw = 0;
171
+ NULL
190
+ trace_dm163_redraw(s->redraw);
172
}
191
+ for (unsigned i = 0; i < COLOR_BUFFER_SIZE; i++) {
173
};
192
+ memset(s->buffer[i], 0, sizeof(s->buffer[0]));
174
193
+ }
175
+static Property pl031_properties[] = {
194
+ s->last_buffer_idx = 0;
195
+ memset(s->buffer_idx_of_row, TURNED_OFF_ROW, sizeof(s->buffer_idx_of_row));
196
+ memset(s->row_persistence_delay, 0, sizeof(s->row_persistence_delay));
197
+}
198
+
199
+static void dm163_dck_gpio_handler(void *opaque, int line, int new_state)
200
+{
201
+ DM163State *s = opaque;
202
+
203
+ if (new_state && !s->dck) {
204
+ /*
205
+ * On raising dck, sample selbk to get the bank to use, and
206
+ * sample sin for the bit to enter into the bank shift buffer.
207
+ */
208
+ uint64_t *sb =
209
+ s->selbk ? s->bank1_shift_register : s->bank0_shift_register;
210
+ /* Output the outgoing bit on sout */
211
+ const bool sout = (s->selbk ? sb[2] & MAKE_64BIT_MASK(63, 1) :
212
+ sb[2] & MAKE_64BIT_MASK(15, 1)) != 0;
213
+ qemu_set_irq(s->sout, sout);
214
+ /* Enter sin into the shift buffer */
215
+ sb[2] = (sb[2] << 1) | ((sb[1] >> 63) & 1);
216
+ sb[1] = (sb[1] << 1) | ((sb[0] >> 63) & 1);
217
+ sb[0] = (sb[0] << 1) | s->sin;
218
+ }
219
+
220
+ s->dck = new_state;
221
+ trace_dm163_dck(new_state);
222
+}
223
+
224
+static void dm163_propagate_outputs(DM163State *s)
225
+{
226
+ s->last_buffer_idx = (s->last_buffer_idx + 1) % RGB_MATRIX_NUM_ROWS;
227
+ /* Values are output when reset is high and enable is low. */
228
+ if (s->rst_b && !s->en_b) {
229
+ memcpy(s->outputs, s->latched_outputs, sizeof(s->outputs));
230
+ } else {
231
+ memset(s->outputs, 0, sizeof(s->outputs));
232
+ }
233
+ for (unsigned x = 0; x < RGB_MATRIX_NUM_COLS; x++) {
234
+ /* Grouping the 3 RGB channels in a pixel value */
235
+ const uint16_t b = extract16(s->outputs[3 * x + 0], 6, 8);
236
+ const uint16_t g = extract16(s->outputs[3 * x + 1], 6, 8);
237
+ const uint16_t r = extract16(s->outputs[3 * x + 2], 6, 8);
238
+ uint32_t rgba = 0;
239
+
240
+ trace_dm163_channels(3 * x + 2, r);
241
+ trace_dm163_channels(3 * x + 1, g);
242
+ trace_dm163_channels(3 * x + 0, b);
243
+
244
+ rgba = deposit32(rgba, 0, 8, r);
245
+ rgba = deposit32(rgba, 8, 8, g);
246
+ rgba = deposit32(rgba, 16, 8, b);
247
+
248
+ /* Led values are sent from the last one to the first one */
249
+ s->buffer[s->last_buffer_idx][RGB_MATRIX_NUM_COLS - x - 1] = rgba;
250
+ }
251
+ for (unsigned row = 0; row < RGB_MATRIX_NUM_ROWS; row++) {
252
+ if (s->activated_rows & (1 << row)) {
253
+ s->buffer_idx_of_row[row] = s->last_buffer_idx;
254
+ s->redraw |= (1 << row);
255
+ trace_dm163_redraw(s->redraw);
256
+ }
257
+ }
258
+}
259
+
260
+static void dm163_en_b_gpio_handler(void *opaque, int line, int new_state)
261
+{
262
+ DM163State *s = opaque;
263
+
264
+ s->en_b = new_state;
265
+ dm163_propagate_outputs(s);
266
+ trace_dm163_en_b(new_state);
267
+}
268
+
269
+static uint8_t dm163_bank0(const DM163State *s, uint8_t led)
270
+{
176
+ /*
271
+ /*
177
+ * True to correctly migrate the tick offset of the RTC. False to
272
+ * Bank 0 uses 6 bits per led, so a value may be stored accross
178
+ * obtain backward migration compatibility with older QEMU versions,
273
+ * two uint64_t entries.
179
+ * at the expense of the guest RTC going backwards compared with the
180
+ * host RTC when the VM is saved/restored if using -rtc host.
181
+ * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
182
+ * 'false' also permits newer QEMU to migrate to older QEMU.)
183
+ */
274
+ */
184
+ DEFINE_PROP_BOOL("migrate-tick-offset",
275
+ const uint8_t low_bit = 6 * led;
185
+ PL031State, migrate_tick_offset, true),
276
+ const uint8_t low_word = low_bit / 64;
186
+ DEFINE_PROP_END_OF_LIST()
277
+ const uint8_t high_word = (low_bit + 5) / 64;
278
+ const uint8_t low_shift = low_bit % 64;
279
+
280
+ if (low_word == high_word) {
281
+ /* Simple case: the value belongs to one entry. */
282
+ return extract64(s->bank0_shift_register[low_word], low_shift, 6);
283
+ }
284
+
285
+ const uint8_t nb_bits_in_low_word = 64 - low_shift;
286
+ const uint8_t nb_bits_in_high_word = 6 - nb_bits_in_low_word;
287
+
288
+ const uint64_t bits_in_low_word = \
289
+ extract64(s->bank0_shift_register[low_word], low_shift,
290
+ nb_bits_in_low_word);
291
+ const uint64_t bits_in_high_word = \
292
+ extract64(s->bank0_shift_register[high_word], 0,
293
+ nb_bits_in_high_word);
294
+ uint8_t val = 0;
295
+
296
+ val = deposit32(val, 0, nb_bits_in_low_word, bits_in_low_word);
297
+ val = deposit32(val, nb_bits_in_low_word, nb_bits_in_high_word,
298
+ bits_in_high_word);
299
+
300
+ return val;
301
+}
302
+
303
+static uint8_t dm163_bank1(const DM163State *s, uint8_t led)
304
+{
305
+ const uint64_t entry = s->bank1_shift_register[led / RGB_MATRIX_NUM_COLS];
306
+ return extract64(entry, 8 * (led % RGB_MATRIX_NUM_COLS), 8);
307
+}
308
+
309
+static void dm163_lat_b_gpio_handler(void *opaque, int line, int new_state)
310
+{
311
+ DM163State *s = opaque;
312
+
313
+ if (s->lat_b && !new_state) {
314
+ for (int led = 0; led < DM163_NUM_LEDS; led++) {
315
+ s->latched_outputs[led] = dm163_bank0(s, led) * dm163_bank1(s, led);
316
+ }
317
+ dm163_propagate_outputs(s);
318
+ }
319
+
320
+ s->lat_b = new_state;
321
+ trace_dm163_lat_b(new_state);
322
+}
323
+
324
+static void dm163_rst_b_gpio_handler(void *opaque, int line, int new_state)
325
+{
326
+ DM163State *s = opaque;
327
+
328
+ s->rst_b = new_state;
329
+ dm163_propagate_outputs(s);
330
+ trace_dm163_rst_b(new_state);
331
+}
332
+
333
+static void dm163_selbk_gpio_handler(void *opaque, int line, int new_state)
334
+{
335
+ DM163State *s = opaque;
336
+
337
+ s->selbk = new_state;
338
+ trace_dm163_selbk(new_state);
339
+}
340
+
341
+static void dm163_sin_gpio_handler(void *opaque, int line, int new_state)
342
+{
343
+ DM163State *s = opaque;
344
+
345
+ s->sin = new_state;
346
+ trace_dm163_sin(new_state);
347
+}
348
+
349
+static void dm163_rows_gpio_handler(void *opaque, int line, int new_state)
350
+{
351
+ DM163State *s = opaque;
352
+
353
+ if (new_state) {
354
+ s->activated_rows |= (1 << line);
355
+ s->buffer_idx_of_row[line] = s->last_buffer_idx;
356
+ s->redraw |= (1 << line);
357
+ trace_dm163_redraw(s->redraw);
358
+ } else {
359
+ s->activated_rows &= ~(1 << line);
360
+ s->row_persistence_delay[line] = ROW_PERSISTENCE;
361
+ }
362
+ trace_dm163_activated_rows(s->activated_rows);
363
+}
364
+
365
+static void dm163_invalidate_display(void *opaque)
366
+{
367
+ DM163State *s = (DM163State *)opaque;
368
+ s->redraw = 0xFF;
369
+ trace_dm163_redraw(s->redraw);
370
+}
371
+
372
+static void update_row_persistence_delay(DM163State *s, unsigned row)
373
+{
374
+ if (s->row_persistence_delay[row]) {
375
+ s->row_persistence_delay[row]--;
376
+ } else {
377
+ /*
378
+ * If the ROW_PERSISTENCE delay is up,
379
+ * the row is turned off.
380
+ */
381
+ s->buffer_idx_of_row[row] = TURNED_OFF_ROW;
382
+ s->redraw |= (1 << row);
383
+ trace_dm163_redraw(s->redraw);
384
+ }
385
+}
386
+
387
+static uint32_t *update_display_of_row(DM163State *s, uint32_t *dest,
388
+ unsigned row)
389
+{
390
+ for (unsigned _ = 0; _ < LED_SQUARE_SIZE; _++) {
391
+ for (int x = 0; x < RGB_MATRIX_NUM_COLS * LED_SQUARE_SIZE; x++) {
392
+ /* UI layer guarantees that there's 32 bits per pixel (Mar 2024) */
393
+ *dest++ = s->buffer[s->buffer_idx_of_row[row]][x / LED_SQUARE_SIZE];
394
+ }
395
+ }
396
+
397
+ dpy_gfx_update(s->console, 0, LED_SQUARE_SIZE * row,
398
+ RGB_MATRIX_NUM_COLS * LED_SQUARE_SIZE, LED_SQUARE_SIZE);
399
+ s->redraw &= ~(1 << row);
400
+ trace_dm163_redraw(s->redraw);
401
+
402
+ return dest;
403
+}
404
+
405
+static void dm163_update_display(void *opaque)
406
+{
407
+ DM163State *s = (DM163State *)opaque;
408
+ DisplaySurface *surface = qemu_console_surface(s->console);
409
+ uint32_t *dest;
410
+
411
+ dest = surface_data(surface);
412
+ for (unsigned row = 0; row < RGB_MATRIX_NUM_ROWS; row++) {
413
+ update_row_persistence_delay(s, row);
414
+ if (!extract8(s->redraw, row, 1)) {
415
+ dest += LED_SQUARE_SIZE * LED_SQUARE_SIZE * RGB_MATRIX_NUM_COLS;
416
+ continue;
417
+ }
418
+ dest = update_display_of_row(s, dest, row);
419
+ }
420
+}
421
+
422
+static const GraphicHwOps dm163_ops = {
423
+ .invalidate = dm163_invalidate_display,
424
+ .gfx_update = dm163_update_display,
187
+};
425
+};
188
+
426
+
189
static void pl031_class_init(ObjectClass *klass, void *data)
427
+static void dm163_realize(DeviceState *dev, Error **errp)
190
{
428
+{
191
DeviceClass *dc = DEVICE_CLASS(klass);
429
+ DM163State *s = DM163(dev);
192
430
+
193
dc->vmsd = &vmstate_pl031;
431
+ qdev_init_gpio_in(dev, dm163_rows_gpio_handler, RGB_MATRIX_NUM_ROWS);
194
+ dc->props = pl031_properties;
432
+ qdev_init_gpio_in(dev, dm163_sin_gpio_handler, 1);
195
}
433
+ qdev_init_gpio_in(dev, dm163_dck_gpio_handler, 1);
196
434
+ qdev_init_gpio_in(dev, dm163_rst_b_gpio_handler, 1);
197
static const TypeInfo pl031_info = {
435
+ qdev_init_gpio_in(dev, dm163_lat_b_gpio_handler, 1);
436
+ qdev_init_gpio_in(dev, dm163_selbk_gpio_handler, 1);
437
+ qdev_init_gpio_in(dev, dm163_en_b_gpio_handler, 1);
438
+ qdev_init_gpio_out_named(dev, &s->sout, "sout", 1);
439
+
440
+ s->console = graphic_console_init(dev, 0, &dm163_ops, s);
441
+ qemu_console_resize(s->console, RGB_MATRIX_NUM_COLS * LED_SQUARE_SIZE,
442
+ RGB_MATRIX_NUM_ROWS * LED_SQUARE_SIZE);
443
+}
444
+
445
+static void dm163_class_init(ObjectClass *klass, void *data)
446
+{
447
+ DeviceClass *dc = DEVICE_CLASS(klass);
448
+ ResettableClass *rc = RESETTABLE_CLASS(klass);
449
+
450
+ dc->desc = "DM163";
451
+ dc->vmsd = &vmstate_dm163;
452
+ dc->realize = dm163_realize;
453
+ rc->phases.hold = dm163_reset_hold;
454
+ set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
455
+}
456
+
457
+static const TypeInfo dm163_types[] = {
458
+ {
459
+ .name = TYPE_DM163,
460
+ .parent = TYPE_DEVICE,
461
+ .instance_size = sizeof(DM163State),
462
+ .class_init = dm163_class_init
463
+ }
464
+};
465
+
466
+DEFINE_TYPES(dm163_types)
467
diff --git a/hw/display/Kconfig b/hw/display/Kconfig
468
index XXXXXXX..XXXXXXX 100644
469
--- a/hw/display/Kconfig
470
+++ b/hw/display/Kconfig
471
@@ -XXX,XX +XXX,XX @@ config XLNX_DISPLAYPORT
472
bool
473
# defaults to "N", enabled by specific boards
474
depends on PIXMAN
475
+
476
+config DM163
477
+ bool
478
diff --git a/hw/display/meson.build b/hw/display/meson.build
479
index XXXXXXX..XXXXXXX 100644
480
--- a/hw/display/meson.build
481
+++ b/hw/display/meson.build
482
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_NEXTCUBE', if_true: files('next-fb.c'))
483
484
system_ss.add(when: 'CONFIG_VGA', if_true: files('vga.c'))
485
system_ss.add(when: 'CONFIG_VIRTIO', if_true: files('virtio-dmabuf.c'))
486
+system_ss.add(when: 'CONFIG_DM163', if_true: files('dm163.c'))
487
488
if (config_all_devices.has_key('CONFIG_VGA_CIRRUS') or
489
config_all_devices.has_key('CONFIG_VGA_PCI') or
490
diff --git a/hw/display/trace-events b/hw/display/trace-events
491
index XXXXXXX..XXXXXXX 100644
492
--- a/hw/display/trace-events
493
+++ b/hw/display/trace-events
494
@@ -XXX,XX +XXX,XX @@ macfb_ctrl_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%"PRI
495
macfb_sense_read(uint32_t value) "video sense: 0x%"PRIx32
496
macfb_sense_write(uint32_t value) "video sense: 0x%"PRIx32
497
macfb_update_mode(uint32_t width, uint32_t height, uint8_t depth) "setting mode to width %"PRId32 " height %"PRId32 " size %d"
498
+
499
+# dm163.c
500
+dm163_redraw(uint8_t redraw) "0x%02x"
501
+dm163_dck(unsigned new_state) "dck : %u"
502
+dm163_en_b(unsigned new_state) "en_b : %u"
503
+dm163_rst_b(unsigned new_state) "rst_b : %u"
504
+dm163_lat_b(unsigned new_state) "lat_b : %u"
505
+dm163_sin(unsigned new_state) "sin : %u"
506
+dm163_selbk(unsigned new_state) "selbk : %u"
507
+dm163_activated_rows(int new_state) "Activated rows : 0x%" PRIx32 ""
508
+dm163_bits_ppi(unsigned dest_width) "dest_width : %u"
509
+dm163_leds(int led, uint32_t value) "led %d: 0x%x"
510
+dm163_channels(int channel, uint8_t value) "channel %d: 0x%x"
511
+dm163_refresh_rate(uint32_t rr) "refresh rate %d"
198
--
512
--
199
2.20.1
513
2.34.1
200
514
201
515
diff view generated by jsdifflib
[Qemu-devel] [PULL 07/10] hw/arm/virt: Fix non-secure flash mode
[PULL 18/21] hw/arm : Pass STM32L4x5 SYSCFG gpios to STM32L4x5 SoC
1
From: David Engraf <david.engraf@sysgo.com>
1
From: Inès Varhol <ines.varhol@telecom-paris.fr>
2
2
3
Using the whole 128 MiB flash in non-secure mode is not working because
3
Exposing SYSCFG inputs to the SoC is practical in order to wire the SoC
4
virt_flash_fdt() expects the same address for secure_sysmem and sysmem.
4
to the optional DM163 display from the board code (GPIOs outputs need
5
This is not correctly handled by caller because it forwards NULL for
5
to be connected to both SYSCFG inputs and DM163 inputs).
6
secure_sysmem in non-secure flash mode.
7
6
8
Fixed by using sysmem when secure_sysmem is NULL.
7
STM32L4x5 SYSCFG in-irq interception needed to be changed accordingly.
9
8
10
Signed-off-by: David Engraf <david.engraf@sysgo.com>
9
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
11
Message-id: 20190712075002.14326-1-david.engraf@sysgo.com
10
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
12
Message-id: 20240424200929.240921-3-ines.varhol@telecom-paris.fr
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
14
---
15
hw/arm/virt.c | 2 +-
15
hw/arm/stm32l4x5_soc.c | 6 ++++--
16
1 file changed, 1 insertion(+), 1 deletion(-)
16
tests/qtest/stm32l4x5_gpio-test.c | 13 ++++++++-----
17
tests/qtest/stm32l4x5_syscfg-test.c | 17 ++++++++++-------
18
3 files changed, 22 insertions(+), 14 deletions(-)
17
19
18
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
20
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
19
index XXXXXXX..XXXXXXX 100644
21
index XXXXXXX..XXXXXXX 100644
20
--- a/hw/arm/virt.c
22
--- a/hw/arm/stm32l4x5_soc.c
21
+++ b/hw/arm/virt.c
23
+++ b/hw/arm/stm32l4x5_soc.c
22
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
24
@@ -XXX,XX +XXX,XX @@
23
&machine->device_memory->mr);
25
/*
26
* STM32L4x5 SoC family
27
*
28
- * Copyright (c) 2023 Arnaud Minier <arnaud.minier@telecom-paris.fr>
29
- * Copyright (c) 2023 Inès Varhol <ines.varhol@telecom-paris.fr>
30
+ * Copyright (c) 2023-2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
31
+ * Copyright (c) 2023-2024 Inès Varhol <ines.varhol@telecom-paris.fr>
32
*
33
* SPDX-License-Identifier: GPL-2.0-or-later
34
*
35
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
36
}
24
}
37
}
25
38
26
- virt_flash_fdt(vms, sysmem, secure_sysmem);
39
+ qdev_pass_gpios(DEVICE(&s->syscfg), dev_soc, NULL);
27
+ virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
40
+
28
41
/* EXTI device */
29
create_gic(vms, pic);
42
busdev = SYS_BUS_DEVICE(&s->exti);
43
if (!sysbus_realize(busdev, errp)) {
44
diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
45
index XXXXXXX..XXXXXXX 100644
46
--- a/tests/qtest/stm32l4x5_gpio-test.c
47
+++ b/tests/qtest/stm32l4x5_gpio-test.c
48
@@ -XXX,XX +XXX,XX @@
49
#define OTYPER_PUSH_PULL 0
50
#define OTYPER_OPEN_DRAIN 1
51
52
+/* SoC forwards GPIOs to SysCfg */
53
+#define SYSCFG "/machine/soc"
54
+
55
const uint32_t moder_reset[NUM_GPIOS] = {
56
0xABFFFFFF,
57
0xFFFFFEBF,
58
@@ -XXX,XX +XXX,XX @@ static void test_gpio_output_mode(const void *data)
59
uint32_t gpio = test_gpio_addr(data);
60
unsigned int gpio_id = get_gpio_id(gpio);
61
62
- qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
63
+ qtest_irq_intercept_in(global_qtest, SYSCFG);
64
65
/* Set a bit in ODR and check nothing happens */
66
gpio_set_bit(gpio, ODR, pin, 1);
67
@@ -XXX,XX +XXX,XX @@ static void test_gpio_input_mode(const void *data)
68
uint32_t gpio = test_gpio_addr(data);
69
unsigned int gpio_id = get_gpio_id(gpio);
70
71
- qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
72
+ qtest_irq_intercept_in(global_qtest, SYSCFG);
73
74
/* Configure a line as input, raise it, and check that the pin is high */
75
gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
76
@@ -XXX,XX +XXX,XX @@ static void test_pull_up_pull_down(const void *data)
77
uint32_t gpio = test_gpio_addr(data);
78
unsigned int gpio_id = get_gpio_id(gpio);
79
80
- qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
81
+ qtest_irq_intercept_in(global_qtest, SYSCFG);
82
83
/* Configure a line as input with pull-up, check the line is set high */
84
gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
85
@@ -XXX,XX +XXX,XX @@ static void test_push_pull(const void *data)
86
uint32_t gpio = test_gpio_addr(data);
87
uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
88
89
- qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
90
+ qtest_irq_intercept_in(global_qtest, SYSCFG);
91
92
/* Setting a line high externally, configuring it in push-pull output */
93
/* And checking the pin was disconnected */
94
@@ -XXX,XX +XXX,XX @@ static void test_open_drain(const void *data)
95
uint32_t gpio = test_gpio_addr(data);
96
uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
97
98
- qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
99
+ qtest_irq_intercept_in(global_qtest, SYSCFG);
100
101
/* Setting a line high externally, configuring it in open-drain output */
102
/* And checking the pin was disconnected */
103
diff --git a/tests/qtest/stm32l4x5_syscfg-test.c b/tests/qtest/stm32l4x5_syscfg-test.c
104
index XXXXXXX..XXXXXXX 100644
105
--- a/tests/qtest/stm32l4x5_syscfg-test.c
106
+++ b/tests/qtest/stm32l4x5_syscfg-test.c
107
@@ -XXX,XX +XXX,XX @@
108
/*
109
* QTest testcase for STM32L4x5_SYSCFG
110
*
111
- * Copyright (c) 2023 Arnaud Minier <arnaud.minier@telecom-paris.fr>
112
- * Copyright (c) 2023 Inès Varhol <ines.varhol@telecom-paris.fr>
113
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
114
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
115
*
116
* This work is licensed under the terms of the GNU GPL, version 2 or later.
117
* See the COPYING file in the top-level directory.
118
@@ -XXX,XX +XXX,XX @@
119
#define SYSCFG_SWPR2 0x28
120
#define INVALID_ADDR 0x2C
121
122
+/* SoC forwards GPIOs to SysCfg */
123
+#define SYSCFG "/machine/soc"
124
+#define EXTI "/machine/soc/exti"
125
+
126
static void syscfg_writel(unsigned int offset, uint32_t value)
127
{
128
writel(SYSCFG_BASE_ADDR + offset, value);
129
@@ -XXX,XX +XXX,XX @@ static uint32_t syscfg_readl(unsigned int offset)
130
131
static void syscfg_set_irq(int num, int level)
132
{
133
- qtest_set_irq_in(global_qtest, "/machine/soc/syscfg",
134
- NULL, num, level);
135
+ qtest_set_irq_in(global_qtest, SYSCFG, NULL, num, level);
136
}
137
138
static void system_reset(void)
139
@@ -XXX,XX +XXX,XX @@ static void test_interrupt(void)
140
* Test that GPIO rising lines result in an irq
141
* with the right configuration
142
*/
143
- qtest_irq_intercept_in(global_qtest, "/machine/soc/exti");
144
+ qtest_irq_intercept_in(global_qtest, EXTI);
145
146
/* GPIOA is the default source for EXTI lines 0 to 15 */
147
148
@@ -XXX,XX +XXX,XX @@ static void test_irq_pin_multiplexer(void)
149
* Test that syscfg irq sets the right exti irq
150
*/
151
152
- qtest_irq_intercept_in(global_qtest, "/machine/soc/exti");
153
+ qtest_irq_intercept_in(global_qtest, EXTI);
154
155
syscfg_set_irq(0, 1);
156
157
@@ -XXX,XX +XXX,XX @@ static void test_irq_gpio_multiplexer(void)
158
* Test that an irq is generated only by the right GPIO
159
*/
160
161
- qtest_irq_intercept_in(global_qtest, "/machine/soc/exti");
162
+ qtest_irq_intercept_in(global_qtest, EXTI);
163
164
/* GPIOA is the default source for EXTI lines 0 to 15 */
30
165
31
--
166
--
32
2.20.1
167
2.34.1
33
168
34
169
diff view generated by jsdifflib
[Qemu-devel] [PULL 06/10] hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
[PULL 19/21] hw/arm : Create Bl475eMachineState
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Inès Varhol <ines.varhol@telecom-paris.fr>
2
2
3
In the previous commit we fixed a crash when the guest read a
3
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
4
register that pop from an empty FIFO.
4
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
5
By auditing the repository, we found another similar use with
5
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
6
an easy way to reproduce:
6
Message-id: 20240424200929.240921-4-ines.varhol@telecom-paris.fr
7
8
$ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S
9
QEMU 4.0.50 monitor - type 'help' for more information
10
(qemu) xp/b 0xfd4a0134
11
Aborted (core dumped)
12
13
(gdb) bt
14
#0 0x00007f6936dea57f in raise () at /lib64/libc.so.6
15
#1 0x00007f6936dd4895 in abort () at /lib64/libc.so.6
16
#2 0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431
17
#3 0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667
18
#4 0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
19
#5 0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569
20
#6 0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420
21
#7 0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447
22
#8 0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385
23
#9 0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423
24
#10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436
25
#11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131
26
#12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723
27
#13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795
28
#14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082
29
30
Fix by checking the FIFO is not empty before popping from it.
31
32
The datasheet is not clear about the reset value of this register,
33
we choose to return '0'.
34
35
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
36
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
37
Message-id: 20190709113715.7761-4-philmd@redhat.com
38
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
39
---
8
---
40
hw/display/xlnx_dp.c | 15 +++++++++++----
9
hw/arm/b-l475e-iot01a.c | 46 ++++++++++++++++++++++++++++-------------
41
1 file changed, 11 insertions(+), 4 deletions(-)
10
1 file changed, 32 insertions(+), 14 deletions(-)
42
11
43
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
12
diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
44
index XXXXXXX..XXXXXXX 100644
13
index XXXXXXX..XXXXXXX 100644
45
--- a/hw/display/xlnx_dp.c
14
--- a/hw/arm/b-l475e-iot01a.c
46
+++ b/hw/display/xlnx_dp.c
15
+++ b/hw/arm/b-l475e-iot01a.c
47
@@ -XXX,XX +XXX,XX @@ static uint8_t xlnx_dp_aux_pop_rx_fifo(XlnxDPState *s)
16
@@ -XXX,XX +XXX,XX @@
48
uint8_t ret;
17
* B-L475E-IOT01A Discovery Kit machine
49
18
* (B-L475E-IOT01A IoT Node)
50
if (fifo8_is_empty(&s->rx_fifo)) {
19
*
51
- DPRINTF("rx_fifo underflow..\n");
20
- * Copyright (c) 2023 Arnaud Minier <arnaud.minier@telecom-paris.fr>
52
- abort();
21
- * Copyright (c) 2023 Inès Varhol <ines.varhol@telecom-paris.fr>
53
+ qemu_log_mask(LOG_GUEST_ERROR,
22
+ * Copyright (c) 2023-2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
54
+ "%s: Reading empty RX_FIFO\n",
23
+ * Copyright (c) 2023-2024 Inès Varhol <ines.varhol@telecom-paris.fr>
55
+ __func__);
24
*
56
+ /*
25
* SPDX-License-Identifier: GPL-2.0-or-later
57
+ * The datasheet is not clear about the reset value, it seems
26
*
58
+ * to be unspecified. We choose to return '0'.
27
@@ -XXX,XX +XXX,XX @@
59
+ */
28
60
+ ret = 0;
29
/* B-L475E-IOT01A implementation is derived from netduinoplus2 */
61
+ } else {
30
62
+ ret = fifo8_pop(&s->rx_fifo);
31
-static void b_l475e_iot01a_init(MachineState *machine)
63
+ DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
32
+#define TYPE_B_L475E_IOT01A MACHINE_TYPE_NAME("b-l475e-iot01a")
64
}
33
+OBJECT_DECLARE_SIMPLE_TYPE(Bl475eMachineState, B_L475E_IOT01A)
65
- ret = fifo8_pop(&s->rx_fifo);
34
+
66
- DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
35
+typedef struct Bl475eMachineState {
67
return ret;
36
+ MachineState parent_obj;
37
+
38
+ Stm32l4x5SocState soc;
39
+} Bl475eMachineState;
40
+
41
+static void bl475e_init(MachineState *machine)
42
{
43
+ Bl475eMachineState *s = B_L475E_IOT01A(machine);
44
const Stm32l4x5SocClass *sc;
45
- DeviceState *dev;
46
47
- dev = qdev_new(TYPE_STM32L4X5XG_SOC);
48
- object_property_add_child(OBJECT(machine), "soc", OBJECT(dev));
49
- sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
50
+ object_initialize_child(OBJECT(machine), "soc", &s->soc,
51
+ TYPE_STM32L4X5XG_SOC);
52
+ sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
53
54
- sc = STM32L4X5_SOC_GET_CLASS(dev);
55
- armv7m_load_kernel(ARM_CPU(first_cpu),
56
- machine->kernel_filename,
57
- 0, sc->flash_size);
58
+ sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
59
+ armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
60
+ sc->flash_size);
68
}
61
}
69
62
63
-static void b_l475e_iot01a_machine_init(MachineClass *mc)
64
+static void bl475e_machine_init(ObjectClass *oc, void *data)
65
{
66
+ MachineClass *mc = MACHINE_CLASS(oc);
67
static const char *machine_valid_cpu_types[] = {
68
ARM_CPU_TYPE_NAME("cortex-m4"),
69
NULL
70
};
71
mc->desc = "B-L475E-IOT01A Discovery Kit (Cortex-M4)";
72
- mc->init = b_l475e_iot01a_init;
73
+ mc->init = bl475e_init;
74
mc->valid_cpu_types = machine_valid_cpu_types;
75
76
/* SRAM pre-allocated as part of the SoC instantiation */
77
mc->default_ram_size = 0;
78
}
79
80
-DEFINE_MACHINE("b-l475e-iot01a", b_l475e_iot01a_machine_init)
81
+static const TypeInfo bl475e_machine_type[] = {
82
+ {
83
+ .name = TYPE_B_L475E_IOT01A,
84
+ .parent = TYPE_MACHINE,
85
+ .instance_size = sizeof(Bl475eMachineState),
86
+ .class_init = bl475e_machine_init,
87
+ }
88
+};
89
+
90
+DEFINE_TYPES(bl475e_machine_type)
70
--
91
--
71
2.20.1
92
2.34.1
72
93
73
94
diff view generated by jsdifflib
[Qemu-devel] [PULL 03/10] hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
[PULL 20/21] hw/arm : Connect DM163 to B-L475E-IOT01A
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Inès Varhol <ines.varhol@telecom-paris.fr>
2
2
3
Lei Sun found while auditing the code that a CPU write would
3
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
4
trigger a NULL pointer dereference.
4
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
5
5
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
6
>From UG1085 datasheet [*] AXI writes in this region are ignored
6
Message-id: 20240424200929.240921-5-ines.varhol@telecom-paris.fr
7
and generates an AXI Slave Error (SLVERR).
8
9
Fix by implementing the write_with_attrs() handler.
10
Return MEMTX_ERROR when the region is accessed (this error maps
11
to an AXI slave error).
12
13
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
14
15
Reported-by: Lei Sun <slei.casper@gmail.com>
16
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
17
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
18
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
---
8
---
21
hw/ssi/xilinx_spips.c | 16 ++++++++++++++++
9
hw/arm/b-l475e-iot01a.c | 59 +++++++++++++++++++++++++++++++++++++++--
22
1 file changed, 16 insertions(+)
10
hw/arm/Kconfig | 1 +
11
2 files changed, 58 insertions(+), 2 deletions(-)
23
12
24
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
13
diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
25
index XXXXXXX..XXXXXXX 100644
14
index XXXXXXX..XXXXXXX 100644
26
--- a/hw/ssi/xilinx_spips.c
15
--- a/hw/arm/b-l475e-iot01a.c
27
+++ b/hw/ssi/xilinx_spips.c
16
+++ b/hw/arm/b-l475e-iot01a.c
28
@@ -XXX,XX +XXX,XX @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
17
@@ -XXX,XX +XXX,XX @@
29
return lqspi_read(opaque, addr, value, size, attrs);
18
#include "hw/boards.h"
19
#include "hw/qdev-properties.h"
20
#include "qemu/error-report.h"
21
-#include "hw/arm/stm32l4x5_soc.h"
22
#include "hw/arm/boot.h"
23
+#include "hw/core/split-irq.h"
24
+#include "hw/arm/stm32l4x5_soc.h"
25
+#include "hw/gpio/stm32l4x5_gpio.h"
26
+#include "hw/display/dm163.h"
27
28
-/* B-L475E-IOT01A implementation is derived from netduinoplus2 */
29
+/* B-L475E-IOT01A implementation is inspired from netduinoplus2 and arduino */
30
+
31
+/*
32
+ * There are actually 14 input pins in the DM163 device.
33
+ * Here the DM163 input pin EN isn't connected to the STM32L4x5
34
+ * GPIOs as the IM120417002 colors shield doesn't actually use
35
+ * this pin to drive the RGB matrix.
36
+ */
37
+#define NUM_DM163_INPUTS 13
38
+
39
+static const unsigned dm163_input[NUM_DM163_INPUTS] = {
40
+ 1 * GPIO_NUM_PINS + 2, /* ROW0 PB2 */
41
+ 0 * GPIO_NUM_PINS + 15, /* ROW1 PA15 */
42
+ 0 * GPIO_NUM_PINS + 2, /* ROW2 PA2 */
43
+ 0 * GPIO_NUM_PINS + 7, /* ROW3 PA7 */
44
+ 0 * GPIO_NUM_PINS + 6, /* ROW4 PA6 */
45
+ 0 * GPIO_NUM_PINS + 5, /* ROW5 PA5 */
46
+ 1 * GPIO_NUM_PINS + 0, /* ROW6 PB0 */
47
+ 0 * GPIO_NUM_PINS + 3, /* ROW7 PA3 */
48
+ 0 * GPIO_NUM_PINS + 4, /* SIN (SDA) PA4 */
49
+ 1 * GPIO_NUM_PINS + 1, /* DCK (SCK) PB1 */
50
+ 2 * GPIO_NUM_PINS + 3, /* RST_B (RST) PC3 */
51
+ 2 * GPIO_NUM_PINS + 4, /* LAT_B (LAT) PC4 */
52
+ 2 * GPIO_NUM_PINS + 5, /* SELBK (SB) PC5 */
53
+};
54
55
#define TYPE_B_L475E_IOT01A MACHINE_TYPE_NAME("b-l475e-iot01a")
56
OBJECT_DECLARE_SIMPLE_TYPE(Bl475eMachineState, B_L475E_IOT01A)
57
@@ -XXX,XX +XXX,XX @@ typedef struct Bl475eMachineState {
58
MachineState parent_obj;
59
60
Stm32l4x5SocState soc;
61
+ SplitIRQ gpio_splitters[NUM_DM163_INPUTS];
62
+ DM163State dm163;
63
} Bl475eMachineState;
64
65
static void bl475e_init(MachineState *machine)
66
{
67
Bl475eMachineState *s = B_L475E_IOT01A(machine);
68
const Stm32l4x5SocClass *sc;
69
+ DeviceState *dev, *gpio_out_splitter;
70
+ unsigned gpio, pin;
71
72
object_initialize_child(OBJECT(machine), "soc", &s->soc,
73
TYPE_STM32L4X5XG_SOC);
74
@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
75
sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
76
armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
77
sc->flash_size);
78
+
79
+ if (object_class_by_name(TYPE_DM163)) {
80
+ object_initialize_child(OBJECT(machine), "dm163",
81
+ &s->dm163, TYPE_DM163);
82
+ dev = DEVICE(&s->dm163);
83
+ qdev_realize(dev, NULL, &error_abort);
84
+
85
+ for (unsigned i = 0; i < NUM_DM163_INPUTS; i++) {
86
+ object_initialize_child(OBJECT(machine), "gpio-out-splitters[*]",
87
+ &s->gpio_splitters[i], TYPE_SPLIT_IRQ);
88
+ gpio_out_splitter = DEVICE(&s->gpio_splitters[i]);
89
+ qdev_prop_set_uint32(gpio_out_splitter, "num-lines", 2);
90
+ qdev_realize(gpio_out_splitter, NULL, &error_fatal);
91
+
92
+ qdev_connect_gpio_out(gpio_out_splitter, 0,
93
+ qdev_get_gpio_in(DEVICE(&s->soc), dm163_input[i]));
94
+ qdev_connect_gpio_out(gpio_out_splitter, 1,
95
+ qdev_get_gpio_in(dev, i));
96
+ gpio = dm163_input[i] / GPIO_NUM_PINS;
97
+ pin = dm163_input[i] % GPIO_NUM_PINS;
98
+ qdev_connect_gpio_out(DEVICE(&s->soc.gpio[gpio]), pin,
99
+ qdev_get_gpio_in(DEVICE(gpio_out_splitter), 0));
100
+ }
101
+ }
30
}
102
}
31
103
32
+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
104
static void bl475e_machine_init(ObjectClass *oc, void *data)
33
+ unsigned size, MemTxAttrs attrs)
105
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
34
+{
106
index XXXXXXX..XXXXXXX 100644
35
+ /*
107
--- a/hw/arm/Kconfig
36
+ * From UG1085, Chapter 24 (Quad-SPI controllers):
108
+++ b/hw/arm/Kconfig
37
+ * - Writes are ignored
109
@@ -XXX,XX +XXX,XX @@ config B_L475E_IOT01A
38
+ * - AXI writes generate an external AXI slave error (SLVERR)
110
default y
39
+ */
111
depends on TCG && ARM
40
+ qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
112
select STM32L4X5_SOC
41
+ " (value: 0x%" PRIx64 "\n",
113
+ imply DM163
42
+ __func__, size << 3, offset, value);
114
43
+
115
config STM32L4X5_SOC
44
+ return MEMTX_ERROR;
116
bool
45
+}
46
+
47
static const MemoryRegionOps lqspi_ops = {
48
.read_with_attrs = lqspi_read,
49
+ .write_with_attrs = lqspi_write,
50
.endianness = DEVICE_NATIVE_ENDIAN,
51
.valid = {
52
.min_access_size = 1,
53
--
117
--
54
2.20.1
118
2.34.1
55
119
56
120
diff view generated by jsdifflib
New patch
[PULL 21/21] tests/qtest : Add testcase for DM163
1
1
From: Inès Varhol <ines.varhol@telecom-paris.fr>
2
3
`test_dm163_bank()`
4
Checks that the pin "sout" of the DM163 led driver outputs the values
5
received on pin "sin" with the expected latency (depending on the bank).
6
7
`test_dm163_gpio_connection()`
8
Check that changes to relevant STM32L4x5 GPIO pins are propagated to the
9
DM163 device.
10
11
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
12
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
13
Acked-by: Thomas Huth <thuth@redhat.com>
14
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
15
Message-id: 20240424200929.240921-6-ines.varhol@telecom-paris.fr
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
---
18
tests/qtest/dm163-test.c | 194 +++++++++++++++++++++++++++++++++++++++
19
tests/qtest/meson.build | 2 +
20
2 files changed, 196 insertions(+)
21
create mode 100644 tests/qtest/dm163-test.c
22
23
diff --git a/tests/qtest/dm163-test.c b/tests/qtest/dm163-test.c
24
new file mode 100644
25
index XXXXXXX..XXXXXXX
26
--- /dev/null
27
+++ b/tests/qtest/dm163-test.c
28
@@ -XXX,XX +XXX,XX @@
29
+/*
30
+ * QTest testcase for DM163
31
+ *
32
+ * Copyright (C) 2024 Samuel Tardieu <sam@rfc1149.net>
33
+ * Copyright (C) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
34
+ * Copyright (C) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
35
+ *
36
+ * SPDX-License-Identifier: GPL-2.0-or-later
37
+ */
38
+
39
+#include "qemu/osdep.h"
40
+#include "libqtest.h"
41
+
42
+enum DM163_INPUTS {
43
+ SIN = 8,
44
+ DCK = 9,
45
+ RST_B = 10,
46
+ LAT_B = 11,
47
+ SELBK = 12,
48
+ EN_B = 13
49
+};
50
+
51
+#define DEVICE_NAME "/machine/dm163"
52
+#define GPIO_OUT(name, value) qtest_set_irq_in(qts, DEVICE_NAME, NULL, name, \
53
+ value)
54
+#define GPIO_PULSE(name) \
55
+ do { \
56
+ GPIO_OUT(name, 1); \
57
+ GPIO_OUT(name, 0); \
58
+ } while (0)
59
+
60
+
61
+static void rise_gpio_pin_dck(QTestState *qts)
62
+{
63
+ /* Configure output mode for pin PB1 */
64
+ qtest_writel(qts, 0x48000400, 0xFFFFFEB7);
65
+ /* Write 1 in ODR for PB1 */
66
+ qtest_writel(qts, 0x48000414, 0x00000002);
67
+}
68
+
69
+static void lower_gpio_pin_dck(QTestState *qts)
70
+{
71
+ /* Configure output mode for pin PB1 */
72
+ qtest_writel(qts, 0x48000400, 0xFFFFFEB7);
73
+ /* Write 0 in ODR for PB1 */
74
+ qtest_writel(qts, 0x48000414, 0x00000000);
75
+}
76
+
77
+static void rise_gpio_pin_selbk(QTestState *qts)
78
+{
79
+ /* Configure output mode for pin PC5 */
80
+ qtest_writel(qts, 0x48000800, 0xFFFFF7FF);
81
+ /* Write 1 in ODR for PC5 */
82
+ qtest_writel(qts, 0x48000814, 0x00000020);
83
+}
84
+
85
+static void lower_gpio_pin_selbk(QTestState *qts)
86
+{
87
+ /* Configure output mode for pin PC5 */
88
+ qtest_writel(qts, 0x48000800, 0xFFFFF7FF);
89
+ /* Write 0 in ODR for PC5 */
90
+ qtest_writel(qts, 0x48000814, 0x00000000);
91
+}
92
+
93
+static void rise_gpio_pin_lat_b(QTestState *qts)
94
+{
95
+ /* Configure output mode for pin PC4 */
96
+ qtest_writel(qts, 0x48000800, 0xFFFFFDFF);
97
+ /* Write 1 in ODR for PC4 */
98
+ qtest_writel(qts, 0x48000814, 0x00000010);
99
+}
100
+
101
+static void lower_gpio_pin_lat_b(QTestState *qts)
102
+{
103
+ /* Configure output mode for pin PC4 */
104
+ qtest_writel(qts, 0x48000800, 0xFFFFFDFF);
105
+ /* Write 0 in ODR for PC4 */
106
+ qtest_writel(qts, 0x48000814, 0x00000000);
107
+}
108
+
109
+static void rise_gpio_pin_rst_b(QTestState *qts)
110
+{
111
+ /* Configure output mode for pin PC3 */
112
+ qtest_writel(qts, 0x48000800, 0xFFFFFF7F);
113
+ /* Write 1 in ODR for PC3 */
114
+ qtest_writel(qts, 0x48000814, 0x00000008);
115
+}
116
+
117
+static void lower_gpio_pin_rst_b(QTestState *qts)
118
+{
119
+ /* Configure output mode for pin PC3 */
120
+ qtest_writel(qts, 0x48000800, 0xFFFFFF7F);
121
+ /* Write 0 in ODR for PC3 */
122
+ qtest_writel(qts, 0x48000814, 0x00000000);
123
+}
124
+
125
+static void rise_gpio_pin_sin(QTestState *qts)
126
+{
127
+ /* Configure output mode for pin PA4 */
128
+ qtest_writel(qts, 0x48000000, 0xFFFFFDFF);
129
+ /* Write 1 in ODR for PA4 */
130
+ qtest_writel(qts, 0x48000014, 0x00000010);
131
+}
132
+
133
+static void lower_gpio_pin_sin(QTestState *qts)
134
+{
135
+ /* Configure output mode for pin PA4 */
136
+ qtest_writel(qts, 0x48000000, 0xFFFFFDFF);
137
+ /* Write 0 in ODR for PA4 */
138
+ qtest_writel(qts, 0x48000014, 0x00000000);
139
+}
140
+
141
+static void test_dm163_bank(const void *opaque)
142
+{
143
+ const unsigned bank = (uintptr_t) opaque;
144
+ const int width = bank ? 192 : 144;
145
+
146
+ QTestState *qts = qtest_initf("-M b-l475e-iot01a");
147
+ qtest_irq_intercept_out_named(qts, DEVICE_NAME, "sout");
148
+ GPIO_OUT(RST_B, 1);
149
+ GPIO_OUT(EN_B, 0);
150
+ GPIO_OUT(DCK, 0);
151
+ GPIO_OUT(SELBK, bank);
152
+ GPIO_OUT(LAT_B, 1);
153
+
154
+ /* Fill bank with zeroes */
155
+ GPIO_OUT(SIN, 0);
156
+ for (int i = 0; i < width; i++) {
157
+ GPIO_PULSE(DCK);
158
+ }
159
+ /* Fill bank with ones, check that we get the previous zeroes */
160
+ GPIO_OUT(SIN, 1);
161
+ for (int i = 0; i < width; i++) {
162
+ GPIO_PULSE(DCK);
163
+ g_assert(!qtest_get_irq(qts, 0));
164
+ }
165
+
166
+ /* Pulse one more bit in the bank, check that we get a one */
167
+ GPIO_PULSE(DCK);
168
+ g_assert(qtest_get_irq(qts, 0));
169
+
170
+ qtest_quit(qts);
171
+}
172
+
173
+static void test_dm163_gpio_connection(void)
174
+{
175
+ QTestState *qts = qtest_init("-M b-l475e-iot01a");
176
+ qtest_irq_intercept_in(qts, DEVICE_NAME);
177
+
178
+ g_assert_false(qtest_get_irq(qts, SIN));
179
+ g_assert_false(qtest_get_irq(qts, DCK));
180
+ g_assert_false(qtest_get_irq(qts, RST_B));
181
+ g_assert_false(qtest_get_irq(qts, LAT_B));
182
+ g_assert_false(qtest_get_irq(qts, SELBK));
183
+
184
+ rise_gpio_pin_dck(qts);
185
+ g_assert_true(qtest_get_irq(qts, DCK));
186
+ lower_gpio_pin_dck(qts);
187
+ g_assert_false(qtest_get_irq(qts, DCK));
188
+
189
+ rise_gpio_pin_lat_b(qts);
190
+ g_assert_true(qtest_get_irq(qts, LAT_B));
191
+ lower_gpio_pin_lat_b(qts);
192
+ g_assert_false(qtest_get_irq(qts, LAT_B));
193
+
194
+ rise_gpio_pin_selbk(qts);
195
+ g_assert_true(qtest_get_irq(qts, SELBK));
196
+ lower_gpio_pin_selbk(qts);
197
+ g_assert_false(qtest_get_irq(qts, SELBK));
198
+
199
+ rise_gpio_pin_rst_b(qts);
200
+ g_assert_true(qtest_get_irq(qts, RST_B));
201
+ lower_gpio_pin_rst_b(qts);
202
+ g_assert_false(qtest_get_irq(qts, RST_B));
203
+
204
+ rise_gpio_pin_sin(qts);
205
+ g_assert_true(qtest_get_irq(qts, SIN));
206
+ lower_gpio_pin_sin(qts);
207
+ g_assert_false(qtest_get_irq(qts, SIN));
208
+
209
+ g_assert_false(qtest_get_irq(qts, DCK));
210
+ g_assert_false(qtest_get_irq(qts, LAT_B));
211
+ g_assert_false(qtest_get_irq(qts, SELBK));
212
+ g_assert_false(qtest_get_irq(qts, RST_B));
213
+}
214
+
215
+int main(int argc, char **argv)
216
+{
217
+ g_test_init(&argc, &argv, NULL);
218
+ qtest_add_data_func("/dm163/bank0", (void *)0, test_dm163_bank);
219
+ qtest_add_data_func("/dm163/bank1", (void *)1, test_dm163_bank);
220
+ qtest_add_func("/dm163/gpio_connection", test_dm163_gpio_connection);
221
+ return g_test_run();
222
+}
223
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
224
index XXXXXXX..XXXXXXX 100644
225
--- a/tests/qtest/meson.build
226
+++ b/tests/qtest/meson.build
227
@@ -XXX,XX +XXX,XX @@ qtests_arm = \
228
(config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
229
(config_all_devices.has_key('CONFIG_STM32L4X5_SOC') ? qtests_stm32l4x5 : []) + \
230
(config_all_devices.has_key('CONFIG_FSI_APB2OPB_ASPEED') ? ['aspeed_fsi-test'] : []) + \
231
+ (config_all_devices.has_key('CONFIG_STM32L4X5_SOC') and
232
+ config_all_devices.has_key('CONFIG_DM163')? ['dm163-test'] : []) + \
233
['arm-cpu-features',
234
'boot-serial-test']
235
236
--
237
2.34.1
238
239
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.