1 | Arm queue; bugfixes only. | 1 | Two bug fixes for 9.0... |
---|---|---|---|
2 | 2 | ||
3 | thanks | ||
4 | -- PMM | 3 | -- PMM |
5 | 4 | ||
6 | The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739: | 5 | The following changes since commit ce64e6224affb8b4e4b019f76d2950270b391af5: |
7 | 6 | ||
8 | Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000) | 7 | Merge tag 'qemu-sparc-20240404' of https://github.com/mcayland/qemu into staging (2024-04-04 15:28:06 +0100) |
9 | 8 | ||
10 | are available in the Git repository at: | 9 | are available in the Git repository at: |
11 | 10 | ||
12 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117 | 11 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240408 |
13 | 12 | ||
14 | for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42: | 13 | for you to fetch changes up to 19b254e86a900dc5ee332e3ac0baf9c521301abf: |
15 | 14 | ||
16 | tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000) | 15 | target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3 (2024-04-08 15:38:53 +0100) |
17 | 16 | ||
18 | ---------------------------------------------------------------- | 17 | ---------------------------------------------------------------- |
19 | target-arm queue: | 18 | target-arm: |
20 | * hw/arm/virt: ARM_VIRT must select ARM_GIC | 19 | * Use correct SecuritySpace for AArch64 AT ops at EL3 |
21 | * exynos: Fix bad printf format specifiers | 20 | * Fix CNTPOFF_EL2 trap to missing EL3 |
22 | * hw/input/ps2.c: Remove remnants of printf debug | ||
23 | * target/openrisc: Remove dead code attempting to check "is timer disabled" | ||
24 | * register: Remove unnecessary NULL check | ||
25 | * util/cutils: Fix Coverity array overrun in freq_to_str() | ||
26 | * configure: Make "does libgio work" test pull in some actual functions | ||
27 | * tmp105: reset the T_low and T_High registers | ||
28 | * tmp105: Correct handling of temperature limit checks | ||
29 | 21 | ||
30 | ---------------------------------------------------------------- | 22 | ---------------------------------------------------------------- |
31 | Alex Chen (1): | 23 | Peter Maydell (1): |
32 | exynos: Fix bad printf format specifiers | 24 | target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3 |
33 | 25 | ||
34 | Alistair Francis (1): | 26 | Pierre-Clément Tosi (1): |
35 | register: Remove unnecessary NULL check | 27 | target/arm: Fix CNTPOFF_EL2 trap to missing EL3 |
36 | 28 | ||
37 | Andrew Jones (1): | 29 | target/arm/helper.c | 10 +++++++--- |
38 | hw/arm/virt: ARM_VIRT must select ARM_GIC | 30 | 1 file changed, 7 insertions(+), 3 deletions(-) |
39 | 31 | ||
40 | Peter Maydell (5): | ||
41 | hw/input/ps2.c: Remove remnants of printf debug | ||
42 | target/openrisc: Remove dead code attempting to check "is timer disabled" | ||
43 | configure: Make "does libgio work" test pull in some actual functions | ||
44 | hw/misc/tmp105: reset the T_low and T_High registers | ||
45 | tmp105: Correct handling of temperature limit checks | ||
46 | |||
47 | Philippe Mathieu-Daudé (1): | ||
48 | util/cutils: Fix Coverity array overrun in freq_to_str() | ||
49 | |||
50 | configure | 11 +++++-- | ||
51 | hw/misc/tmp105.h | 7 +++++ | ||
52 | hw/core/register.c | 4 --- | ||
53 | hw/input/ps2.c | 9 ------ | ||
54 | hw/misc/tmp105.c | 73 ++++++++++++++++++++++++++++++++++++++------ | ||
55 | hw/timer/exynos4210_mct.c | 4 +-- | ||
56 | hw/timer/exynos4210_pwm.c | 8 ++--- | ||
57 | target/openrisc/sys_helper.c | 3 -- | ||
58 | util/cutils.c | 3 +- | ||
59 | hw/arm/Kconfig | 1 + | ||
60 | 10 files changed, 89 insertions(+), 34 deletions(-) | ||
61 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Andrew Jones <drjones@redhat.com> | ||
2 | 1 | ||
3 | The removal of the selection of A15MPCORE from ARM_VIRT also | ||
4 | removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC. | ||
5 | |||
6 | Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals") | ||
7 | Reported-by: Miroslav Rezanina <mrezanin@redhat.com> | ||
8 | Signed-off-by: Andrew Jones <drjones@redhat.com> | ||
9 | Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com> | ||
10 | Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
11 | Message-id: 20201111143440.112763-1-drjones@redhat.com | ||
12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
13 | --- | ||
14 | hw/arm/Kconfig | 1 + | ||
15 | 1 file changed, 1 insertion(+) | ||
16 | |||
17 | diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig | ||
18 | index XXXXXXX..XXXXXXX 100644 | ||
19 | --- a/hw/arm/Kconfig | ||
20 | +++ b/hw/arm/Kconfig | ||
21 | @@ -XXX,XX +XXX,XX @@ config ARM_VIRT | ||
22 | imply VFIO_PLATFORM | ||
23 | imply VFIO_XGMAC | ||
24 | imply TPM_TIS_SYSBUS | ||
25 | + select ARM_GIC | ||
26 | select ACPI | ||
27 | select ARM_SMMUV3 | ||
28 | select GPIO_KEY | ||
29 | -- | ||
30 | 2.20.1 | ||
31 | |||
32 | diff view generated by jsdifflib |
1 | From: Alex Chen <alex.chen@huawei.com> | 1 | From: Pierre-Clément Tosi <ptosi@google.com> |
---|---|---|---|
2 | 2 | ||
3 | We should use printf format specifier "%u" instead of "%d" for | 3 | EL2 accesses to CNTPOFF_EL2 should only ever trap to EL3 if EL3 is |
4 | argument of type "unsigned int". | 4 | present, as described by the reference manual (for MRS): |
5 | 5 | ||
6 | Reported-by: Euler Robot <euler.robot@huawei.com> | 6 | /* ... */ |
7 | Signed-off-by: Alex Chen <alex.chen@huawei.com> | 7 | elsif PSTATE.EL == EL2 then |
8 | Message-id: 20201111073651.72804-1-alex.chen@huawei.com | 8 | if Halted() && HaveEL(EL3) && /*...*/ then |
9 | UNDEFINED; | ||
10 | elsif HaveEL(EL3) && SCR_EL3.ECVEn == '0' then | ||
11 | /* ... */ | ||
12 | else | ||
13 | X[t, 64] = CNTPOFF_EL2; | ||
14 | |||
15 | However, the existing implementation of gt_cntpoff_access() always | ||
16 | returns CP_ACCESS_TRAP_EL3 for EL2 accesses with SCR_EL3.ECVEn unset. In | ||
17 | pseudo-code terminology, this corresponds to assuming that HaveEL(EL3) | ||
18 | is always true, which is wrong. As a result, QEMU panics in | ||
19 | access_check_cp_reg() when started without EL3 and running EL2 code | ||
20 | accessing the register (e.g. any recent KVM booting a guest). | ||
21 | |||
22 | Therefore, add the HaveEL(EL3) check to gt_cntpoff_access(). | ||
23 | |||
24 | Fixes: 2808d3b38a52 ("target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling") | ||
25 | Signed-off-by: Pierre-Clément Tosi <ptosi@google.com> | ||
26 | Message-id: m3al6amhdkmsiy2f62w72ufth6dzn45xg5cz6xljceyibphnf4@ezmmpwk4tnhl | ||
9 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 27 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 28 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
11 | --- | 29 | --- |
12 | hw/timer/exynos4210_mct.c | 4 ++-- | 30 | target/arm/helper.c | 3 ++- |
13 | hw/timer/exynos4210_pwm.c | 8 ++++---- | 31 | 1 file changed, 2 insertions(+), 1 deletion(-) |
14 | 2 files changed, 6 insertions(+), 6 deletions(-) | ||
15 | 32 | ||
16 | diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c | 33 | diff --git a/target/arm/helper.c b/target/arm/helper.c |
17 | index XXXXXXX..XXXXXXX 100644 | 34 | index XXXXXXX..XXXXXXX 100644 |
18 | --- a/hw/timer/exynos4210_mct.c | 35 | --- a/target/arm/helper.c |
19 | +++ b/hw/timer/exynos4210_mct.c | 36 | +++ b/target/arm/helper.c |
20 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id) | 37 | @@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_cntpoff_access(CPUARMState *env, |
21 | /* If CSTAT is pending and IRQ is enabled */ | 38 | const ARMCPRegInfo *ri, |
22 | if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) && | 39 | bool isread) |
23 | (s->reg.int_enb & G_INT_ENABLE(id))) { | 40 | { |
24 | - DPRINTF("gcmp timer[%d] IRQ\n", id); | 41 | - if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) { |
25 | + DPRINTF("gcmp timer[%u] IRQ\n", id); | 42 | + if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) && |
26 | qemu_irq_raise(s->irq[id]); | 43 | + !(env->cp15.scr_el3 & SCR_ECVEN)) { |
44 | return CP_ACCESS_TRAP_EL3; | ||
27 | } | 45 | } |
28 | } | 46 | return CP_ACCESS_OK; |
29 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s) | ||
30 | MCT_CFG_GET_DIVIDER(s->reg_mct_cfg)); | ||
31 | |||
32 | if (freq != s->freq) { | ||
33 | - DPRINTF("freq=%dHz\n", s->freq); | ||
34 | + DPRINTF("freq=%uHz\n", s->freq); | ||
35 | |||
36 | /* global timer */ | ||
37 | tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq); | ||
38 | diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c | ||
39 | index XXXXXXX..XXXXXXX 100644 | ||
40 | --- a/hw/timer/exynos4210_pwm.c | ||
41 | +++ b/hw/timer/exynos4210_pwm.c | ||
42 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id) | ||
43 | |||
44 | if (freq != s->timer[id].freq) { | ||
45 | ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq); | ||
46 | - DPRINTF("freq=%dHz\n", s->timer[id].freq); | ||
47 | + DPRINTF("freq=%uHz\n", s->timer[id].freq); | ||
48 | } | ||
49 | } | ||
50 | |||
51 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque) | ||
52 | uint32_t id = s->id; | ||
53 | bool cmp; | ||
54 | |||
55 | - DPRINTF("timer %d tick\n", id); | ||
56 | + DPRINTF("timer %u tick\n", id); | ||
57 | |||
58 | /* set irq status */ | ||
59 | p->reg_tint_cstat |= TINT_CSTAT_STATUS(id); | ||
60 | |||
61 | /* raise IRQ */ | ||
62 | if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) { | ||
63 | - DPRINTF("timer %d IRQ\n", id); | ||
64 | + DPRINTF("timer %u IRQ\n", id); | ||
65 | qemu_irq_raise(p->timer[id].irq); | ||
66 | } | ||
67 | |||
68 | @@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque) | ||
69 | } | ||
70 | |||
71 | if (cmp) { | ||
72 | - DPRINTF("auto reload timer %d count to %x\n", id, | ||
73 | + DPRINTF("auto reload timer %u count to %x\n", id, | ||
74 | p->timer[id].reg_tcntb); | ||
75 | ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb); | ||
76 | ptimer_run(p->timer[id].ptimer, 1); | ||
77 | -- | 47 | -- |
78 | 2.20.1 | 48 | 2.34.1 |
79 | 49 | ||
80 | 50 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | In commit 5edab03d4040 we added tracepoints to the ps2 keyboard | ||
2 | and mouse emulation. However we didn't remove all the debug-by-printf | ||
3 | support. In fact there is only one printf() remaining, and it is | ||
4 | redundant with the trace_ps2_write_mouse() event next to it. | ||
5 | Remove the printf() and the now-unused DEBUG* macros. | ||
6 | 1 | ||
7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
8 | Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
9 | Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> | ||
10 | Message-id: 20201101133258.4240-1-peter.maydell@linaro.org | ||
11 | --- | ||
12 | hw/input/ps2.c | 9 --------- | ||
13 | 1 file changed, 9 deletions(-) | ||
14 | |||
15 | diff --git a/hw/input/ps2.c b/hw/input/ps2.c | ||
16 | index XXXXXXX..XXXXXXX 100644 | ||
17 | --- a/hw/input/ps2.c | ||
18 | +++ b/hw/input/ps2.c | ||
19 | @@ -XXX,XX +XXX,XX @@ | ||
20 | |||
21 | #include "trace.h" | ||
22 | |||
23 | -/* debug PC keyboard */ | ||
24 | -//#define DEBUG_KBD | ||
25 | - | ||
26 | -/* debug PC keyboard : only mouse */ | ||
27 | -//#define DEBUG_MOUSE | ||
28 | - | ||
29 | /* Keyboard Commands */ | ||
30 | #define KBD_CMD_SET_LEDS 0xED /* Set keyboard leds */ | ||
31 | #define KBD_CMD_ECHO 0xEE | ||
32 | @@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val) | ||
33 | PS2MouseState *s = (PS2MouseState *)opaque; | ||
34 | |||
35 | trace_ps2_write_mouse(opaque, val); | ||
36 | -#ifdef DEBUG_MOUSE | ||
37 | - printf("kbd: write mouse 0x%02x\n", val); | ||
38 | -#endif | ||
39 | switch(s->common.write_cmd) { | ||
40 | default: | ||
41 | case -1: | ||
42 | -- | ||
43 | 2.20.1 | ||
44 | |||
45 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | In the mtspr helper we attempt to check for "is the timer disabled" | ||
2 | with "if (env->ttmr & TIMER_NONE)". This is wrong because TIMER_NONE | ||
3 | is zero and the condition is always false (Coverity complains about | ||
4 | the dead code.) | ||
5 | 1 | ||
6 | The correct check would be to test whether the TTMR_M field in the | ||
7 | register is equal to TIMER_NONE instead. However, the | ||
8 | cpu_openrisc_timer_update() function checks whether the timer is | ||
9 | enabled (it looks at cpu->env.is_counting, which is set to 0 via | ||
10 | cpu_openrisc_count_stop() when the TTMR_M field is set to | ||
11 | TIMER_NONE), so there's no need to check for "timer disabled" in the | ||
12 | target/openrisc code. Instead, simply remove the dead code. | ||
13 | |||
14 | Fixes: Coverity CID 1005812 | ||
15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
16 | Acked-by: Stafford Horne <shorne@gmail.com> | ||
17 | Message-id: 20201103114654.18540-1-peter.maydell@linaro.org | ||
18 | --- | ||
19 | target/openrisc/sys_helper.c | 3 --- | ||
20 | 1 file changed, 3 deletions(-) | ||
21 | |||
22 | diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c | ||
23 | index XXXXXXX..XXXXXXX 100644 | ||
24 | --- a/target/openrisc/sys_helper.c | ||
25 | +++ b/target/openrisc/sys_helper.c | ||
26 | @@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb) | ||
27 | |||
28 | case TO_SPR(10, 1): /* TTCR */ | ||
29 | cpu_openrisc_count_set(cpu, rb); | ||
30 | - if (env->ttmr & TIMER_NONE) { | ||
31 | - return; | ||
32 | - } | ||
33 | cpu_openrisc_timer_update(cpu); | ||
34 | break; | ||
35 | #endif | ||
36 | -- | ||
37 | 2.20.1 | ||
38 | |||
39 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Alistair Francis <alistair.francis@wdc.com> | ||
2 | 1 | ||
3 | This patch fixes CID 1432800 by removing an unnecessary check. | ||
4 | |||
5 | Signed-off-by: Alistair Francis <alistair.francis@wdc.com> | ||
6 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
8 | --- | ||
9 | hw/core/register.c | 4 ---- | ||
10 | 1 file changed, 4 deletions(-) | ||
11 | |||
12 | diff --git a/hw/core/register.c b/hw/core/register.c | ||
13 | index XXXXXXX..XXXXXXX 100644 | ||
14 | --- a/hw/core/register.c | ||
15 | +++ b/hw/core/register.c | ||
16 | @@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner, | ||
17 | int index = rae[i].addr / data_size; | ||
18 | RegisterInfo *r = &ri[index]; | ||
19 | |||
20 | - if (data + data_size * index == 0 || !&rae[i]) { | ||
21 | - continue; | ||
22 | - } | ||
23 | - | ||
24 | /* Init the register, this will zero it. */ | ||
25 | object_initialize((void *)r, sizeof(*r), TYPE_REGISTER); | ||
26 | |||
27 | -- | ||
28 | 2.20.1 | ||
29 | |||
30 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | From: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
2 | 1 | ||
3 | Fix Coverity CID 1435957: Memory - illegal accesses (OVERRUN): | ||
4 | |||
5 | >>> Overrunning array "suffixes" of 7 8-byte elements at element | ||
6 | index 7 (byte offset 63) using index "idx" (which evaluates to 7). | ||
7 | |||
8 | Note, the biggest input value freq_to_str() can accept is UINT64_MAX, | ||
9 | which is ~18.446 EHz, less than 1000 EHz. | ||
10 | |||
11 | Reported-by: Eduardo Habkost <ehabkost@redhat.com> | ||
12 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
13 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
14 | Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> | ||
15 | Reviewed-by: Luc Michel <luc@lmichel.fr> | ||
16 | Message-id: 20201101215755.2021421-1-f4bug@amsat.org | ||
17 | Suggested-by: Peter Maydell <peter.maydell@linaro.org> | ||
18 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
19 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
20 | --- | ||
21 | util/cutils.c | 3 ++- | ||
22 | 1 file changed, 2 insertions(+), 1 deletion(-) | ||
23 | |||
24 | diff --git a/util/cutils.c b/util/cutils.c | ||
25 | index XXXXXXX..XXXXXXX 100644 | ||
26 | --- a/util/cutils.c | ||
27 | +++ b/util/cutils.c | ||
28 | @@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz) | ||
29 | double freq = freq_hz; | ||
30 | size_t idx = 0; | ||
31 | |||
32 | - while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) { | ||
33 | + while (freq >= 1000.0) { | ||
34 | freq /= 1000.0; | ||
35 | idx++; | ||
36 | } | ||
37 | + assert(idx < ARRAY_SIZE(suffixes)); | ||
38 | |||
39 | return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]); | ||
40 | } | ||
41 | -- | ||
42 | 2.20.1 | ||
43 | |||
44 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | In commit 76346b6264a9b01979 we tried to add a configure check that | ||
2 | the libgio pkg-config data was correct, which builds an executable | ||
3 | linked against it. Unfortunately this doesn't catch the problem | ||
4 | (missing static library dependency info), because a "do nothing" test | ||
5 | source file doesn't have any symbol references that cause the linker | ||
6 | to pull in .o files from libgio.a, and so we don't see the "missing | ||
7 | symbols from libmount" error that a full QEMU link triggers. | ||
8 | 1 | ||
9 | (The ineffective test went unnoticed because of a typo that | ||
10 | effectively disabled libgio unconditionally, but after commit | ||
11 | 3569a5dfc11f2 fixed that, a static link of the system emulator on | ||
12 | Ubuntu stopped working again.) | ||
13 | |||
14 | Improve the gio test by having the test source fragment reference a | ||
15 | g_dbus function (which is what is indirectly causing us to end up | ||
16 | wanting functions from libmount). | ||
17 | |||
18 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
19 | Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> | ||
20 | Message-id: 20201116104617.18333-1-peter.maydell@linaro.org | ||
21 | --- | ||
22 | configure | 11 +++++++++-- | ||
23 | 1 file changed, 9 insertions(+), 2 deletions(-) | ||
24 | |||
25 | diff --git a/configure b/configure | ||
26 | index XXXXXXX..XXXXXXX 100755 | ||
27 | --- a/configure | ||
28 | +++ b/configure | ||
29 | @@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then | ||
30 | # Check that the libraries actually work -- Ubuntu 18.04 ships | ||
31 | # with pkg-config --static --libs data for gio-2.0 that is missing | ||
32 | # -lblkid and will give a link error. | ||
33 | - write_c_skeleton | ||
34 | - if compile_prog "" "$gio_libs" ; then | ||
35 | + cat > $TMPC <<EOF | ||
36 | +#include <gio/gio.h> | ||
37 | +int main(void) | ||
38 | +{ | ||
39 | + g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0); | ||
40 | + return 0; | ||
41 | +} | ||
42 | +EOF | ||
43 | + if compile_prog "$gio_cflags" "$gio_libs" ; then | ||
44 | gio=yes | ||
45 | else | ||
46 | gio=no | ||
47 | -- | ||
48 | 2.20.1 | ||
49 | |||
50 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the | ||
2 | power-up reset values for the T_low and T_high registers are 80 degrees C | ||
3 | and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5. These | ||
4 | values are then shifted right by four bits to give the register reset | ||
5 | values, since both registers store the 12 bits of temperature data in bits | ||
6 | [15..4] of a 16 bit register. | ||
7 | 1 | ||
8 | We were resetting these registers to zero, which is problematic for Linux | ||
9 | guests which enable the alert interrupt and then immediately take an | ||
10 | unexpected overtemperature alert because the current temperature is above | ||
11 | freezing... | ||
12 | |||
13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
14 | Reviewed-by: Cédric Le Goater <clg@kaod.org> | ||
15 | Message-id: 20201110150023.25533-2-peter.maydell@linaro.org | ||
16 | --- | ||
17 | hw/misc/tmp105.c | 3 +++ | ||
18 | 1 file changed, 3 insertions(+) | ||
19 | |||
20 | diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c | ||
21 | index XXXXXXX..XXXXXXX 100644 | ||
22 | --- a/hw/misc/tmp105.c | ||
23 | +++ b/hw/misc/tmp105.c | ||
24 | @@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c) | ||
25 | s->faults = tmp105_faultq[(s->config >> 3) & 3]; | ||
26 | s->alarm = 0; | ||
27 | |||
28 | + s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */ | ||
29 | + s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */ | ||
30 | + | ||
31 | tmp105_interrupt_update(s); | ||
32 | } | ||
33 | |||
34 | -- | ||
35 | 2.20.1 | ||
36 | |||
37 | diff view generated by jsdifflib |
1 | The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device | 1 | When we do an AT address translation operation, the page table walk |
---|---|---|---|
2 | signals an alert when the temperature equals or exceeds the T_high value and | 2 | is supposed to be performed in the context of the EL we're doing the |
3 | then remains high until a device register is read or the device responds to | 3 | walk for, so for instance an AT S1E2R walk is done for EL2. In the |
4 | the SMBUS Alert Response address, or the device is put into Shutdown Mode. | 4 | pseudocode an EL is passed to AArch64.AT(), which calls |
5 | Thereafter the Alert pin will only be re-signalled when temperature falls | 5 | SecurityStateAtEL() to find the security state that we should be |
6 | below T_low; alert can then be cleared in the same set of ways, and the | 6 | doing the walk with. |
7 | device returns to its initial "alert when temperature goes above T_high" | ||
8 | mode. (If this textual description is confusing, see figure 3 in the | ||
9 | TI datasheet at https://www.ti.com/lit/gpn/tmp105 .) | ||
10 | 7 | ||
11 | We were misimplementing this as a simple "always alert if temperature is | 8 | In ats_write64() we get this wrong, instead using the current |
12 | above T_high or below T_low" condition, which gives a spurious alert on | 9 | security space always. This is fine for AT operations performed from |
13 | startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset | 10 | EL1 and EL2, because there the current security state and the |
14 | limit values. | 11 | security state for the lower EL are the same. But for AT operations |
12 | performed from EL3, the current security state is always either | ||
13 | Secure or Root, whereas we want to use the security state defined by | ||
14 | SCR_EL3.{NS,NSE} for the walk. This affects not just guests using | ||
15 | FEAT_RME but also ones where EL3 is Secure state and the EL3 code | ||
16 | is trying to do an AT for a NonSecure EL2 or EL1. | ||
15 | 17 | ||
16 | Implement the correct (hysteresis) behaviour by tracking whether we | 18 | Use arm_security_space_below_el3() to get the SecuritySpace to |
17 | are currently looking for the temperature to rise over T_high or | 19 | pass to do_ats_write() for all AT operations except the |
18 | for it to fall below T_low. Our implementation of the comparator | 20 | AT S1E3* operations. |
19 | mode (TM==0) wasn't wrong, but rephrase it to match the way that | ||
20 | interrupt mode is now handled for clarity. | ||
21 | 21 | ||
22 | Cc: qemu-stable@nongnu.org | ||
23 | Fixes: e1ee56ec2383 ("target/arm: Pass security space rather than flag for AT instructions") | ||
24 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2250 | ||
22 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 25 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
23 | Reviewed-by: Cédric Le Goater <clg@kaod.org> | 26 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
24 | Message-id: 20201110150023.25533-3-peter.maydell@linaro.org | 27 | Message-id: 20240405180232.3570066-1-peter.maydell@linaro.org |
25 | --- | 28 | --- |
26 | hw/misc/tmp105.h | 7 +++++ | 29 | target/arm/helper.c | 7 +++++-- |
27 | hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++------- | 30 | 1 file changed, 5 insertions(+), 2 deletions(-) |
28 | 2 files changed, 68 insertions(+), 9 deletions(-) | ||
29 | 31 | ||
30 | diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h | 32 | diff --git a/target/arm/helper.c b/target/arm/helper.c |
31 | index XXXXXXX..XXXXXXX 100644 | 33 | index XXXXXXX..XXXXXXX 100644 |
32 | --- a/hw/misc/tmp105.h | 34 | --- a/target/arm/helper.c |
33 | +++ b/hw/misc/tmp105.h | 35 | +++ b/target/arm/helper.c |
34 | @@ -XXX,XX +XXX,XX @@ struct TMP105State { | 36 | @@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, |
35 | int16_t limit[2]; | 37 | ARMMMUIdx mmu_idx; |
36 | int faults; | 38 | uint64_t hcr_el2 = arm_hcr_el2_eff(env); |
37 | uint8_t alarm; | 39 | bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE); |
38 | + /* | 40 | + bool for_el3 = false; |
39 | + * The TMP105 initially looks for a temperature rising above T_high; | 41 | + ARMSecuritySpace ss; |
40 | + * once this is detected, the condition it looks for next is the | 42 | |
41 | + * temperature falling below T_low. This flag is false when initially | 43 | switch (ri->opc2 & 6) { |
42 | + * looking for T_high, true when looking for T_low. | 44 | case 0: |
43 | + */ | 45 | @@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, |
44 | + bool detect_falling; | 46 | break; |
45 | }; | 47 | case 6: /* AT S1E3R, AT S1E3W */ |
46 | 48 | mmu_idx = ARMMMUIdx_E3; | |
47 | #endif | 49 | + for_el3 = true; |
48 | diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c | 50 | break; |
49 | index XXXXXXX..XXXXXXX 100644 | 51 | default: |
50 | --- a/hw/misc/tmp105.c | 52 | g_assert_not_reached(); |
51 | +++ b/hw/misc/tmp105.c | 53 | @@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, |
52 | @@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s) | 54 | g_assert_not_reached(); |
53 | return; | ||
54 | } | 55 | } |
55 | 56 | ||
56 | - if ((s->config >> 1) & 1) { /* TM */ | 57 | - env->cp15.par_el[1] = do_ats_write(env, value, access_type, |
57 | - if (s->temperature >= s->limit[1]) | 58 | - mmu_idx, arm_security_space(env)); |
58 | - s->alarm = 1; | 59 | + ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env); |
59 | - else if (s->temperature < s->limit[0]) | 60 | + env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss); |
60 | - s->alarm = 1; | 61 | #else |
61 | + if (s->config >> 1 & 1) { | 62 | /* Handled by hardware accelerator. */ |
62 | + /* | 63 | g_assert_not_reached(); |
63 | + * TM == 1 : Interrupt mode. We signal Alert when the | ||
64 | + * temperature rises above T_high, and expect the guest to clear | ||
65 | + * it (eg by reading a device register). | ||
66 | + */ | ||
67 | + if (s->detect_falling) { | ||
68 | + if (s->temperature < s->limit[0]) { | ||
69 | + s->alarm = 1; | ||
70 | + s->detect_falling = false; | ||
71 | + } | ||
72 | + } else { | ||
73 | + if (s->temperature >= s->limit[1]) { | ||
74 | + s->alarm = 1; | ||
75 | + s->detect_falling = true; | ||
76 | + } | ||
77 | + } | ||
78 | } else { | ||
79 | - if (s->temperature >= s->limit[1]) | ||
80 | - s->alarm = 1; | ||
81 | - else if (s->temperature < s->limit[0]) | ||
82 | - s->alarm = 0; | ||
83 | + /* | ||
84 | + * TM == 0 : Comparator mode. We signal Alert when the temperature | ||
85 | + * rises above T_high, and stop signalling it when the temperature | ||
86 | + * falls below T_low. | ||
87 | + */ | ||
88 | + if (s->detect_falling) { | ||
89 | + if (s->temperature < s->limit[0]) { | ||
90 | + s->alarm = 0; | ||
91 | + s->detect_falling = false; | ||
92 | + } | ||
93 | + } else { | ||
94 | + if (s->temperature >= s->limit[1]) { | ||
95 | + s->alarm = 1; | ||
96 | + s->detect_falling = true; | ||
97 | + } | ||
98 | + } | ||
99 | } | ||
100 | |||
101 | tmp105_interrupt_update(s); | ||
102 | @@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id) | ||
103 | return 0; | ||
104 | } | ||
105 | |||
106 | +static bool detect_falling_needed(void *opaque) | ||
107 | +{ | ||
108 | + TMP105State *s = opaque; | ||
109 | + | ||
110 | + /* | ||
111 | + * We only need to migrate the detect_falling bool if it's set; | ||
112 | + * for migration from older machines we assume that it is false | ||
113 | + * (ie temperature is not out of range). | ||
114 | + */ | ||
115 | + return s->detect_falling; | ||
116 | +} | ||
117 | + | ||
118 | +static const VMStateDescription vmstate_tmp105_detect_falling = { | ||
119 | + .name = "TMP105/detect-falling", | ||
120 | + .version_id = 1, | ||
121 | + .minimum_version_id = 1, | ||
122 | + .needed = detect_falling_needed, | ||
123 | + .fields = (VMStateField[]) { | ||
124 | + VMSTATE_BOOL(detect_falling, TMP105State), | ||
125 | + VMSTATE_END_OF_LIST() | ||
126 | + } | ||
127 | +}; | ||
128 | + | ||
129 | static const VMStateDescription vmstate_tmp105 = { | ||
130 | .name = "TMP105", | ||
131 | .version_id = 0, | ||
132 | @@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = { | ||
133 | VMSTATE_UINT8(alarm, TMP105State), | ||
134 | VMSTATE_I2C_SLAVE(i2c, TMP105State), | ||
135 | VMSTATE_END_OF_LIST() | ||
136 | + }, | ||
137 | + .subsections = (const VMStateDescription*[]) { | ||
138 | + &vmstate_tmp105_detect_falling, | ||
139 | + NULL | ||
140 | } | ||
141 | }; | ||
142 | |||
143 | @@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c) | ||
144 | s->config = 0; | ||
145 | s->faults = tmp105_faultq[(s->config >> 3) & 3]; | ||
146 | s->alarm = 0; | ||
147 | + s->detect_falling = false; | ||
148 | |||
149 | s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */ | ||
150 | s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */ | ||
151 | -- | 64 | -- |
152 | 2.20.1 | 65 | 2.34.1 |
153 | |||
154 | diff view generated by jsdifflib |