1
Arm queue; bugfixes only.
1
Two bug fixes for 9.0...
2
2
3
thanks
4
-- PMM
3
-- PMM
5
4
6
The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
5
The following changes since commit ce64e6224affb8b4e4b019f76d2950270b391af5:
7
6
8
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
7
Merge tag 'qemu-sparc-20240404' of https://github.com/mcayland/qemu into staging (2024-04-04 15:28:06 +0100)
9
8
10
are available in the Git repository at:
9
are available in the Git repository at:
11
10
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240408
13
12
14
for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
13
for you to fetch changes up to 19b254e86a900dc5ee332e3ac0baf9c521301abf:
15
14
16
tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
15
target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3 (2024-04-08 15:38:53 +0100)
17
16
18
----------------------------------------------------------------
17
----------------------------------------------------------------
19
target-arm queue:
18
target-arm:
20
* hw/arm/virt: ARM_VIRT must select ARM_GIC
19
* Use correct SecuritySpace for AArch64 AT ops at EL3
21
* exynos: Fix bad printf format specifiers
20
* Fix CNTPOFF_EL2 trap to missing EL3
22
* hw/input/ps2.c: Remove remnants of printf debug
23
* target/openrisc: Remove dead code attempting to check "is timer disabled"
24
* register: Remove unnecessary NULL check
25
* util/cutils: Fix Coverity array overrun in freq_to_str()
26
* configure: Make "does libgio work" test pull in some actual functions
27
* tmp105: reset the T_low and T_High registers
28
* tmp105: Correct handling of temperature limit checks
29
21
30
----------------------------------------------------------------
22
----------------------------------------------------------------
31
Alex Chen (1):
23
Peter Maydell (1):
32
exynos: Fix bad printf format specifiers
24
target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3
33
25
34
Alistair Francis (1):
26
Pierre-Clément Tosi (1):
35
register: Remove unnecessary NULL check
27
target/arm: Fix CNTPOFF_EL2 trap to missing EL3
36
28
37
Andrew Jones (1):
29
target/arm/helper.c | 10 +++++++---
38
hw/arm/virt: ARM_VIRT must select ARM_GIC
30
1 file changed, 7 insertions(+), 3 deletions(-)
39
31
40
Peter Maydell (5):
41
hw/input/ps2.c: Remove remnants of printf debug
42
target/openrisc: Remove dead code attempting to check "is timer disabled"
43
configure: Make "does libgio work" test pull in some actual functions
44
hw/misc/tmp105: reset the T_low and T_High registers
45
tmp105: Correct handling of temperature limit checks
46
47
Philippe Mathieu-Daudé (1):
48
util/cutils: Fix Coverity array overrun in freq_to_str()
49
50
configure | 11 +++++--
51
hw/misc/tmp105.h | 7 +++++
52
hw/core/register.c | 4 ---
53
hw/input/ps2.c | 9 ------
54
hw/misc/tmp105.c | 73 ++++++++++++++++++++++++++++++++++++++------
55
hw/timer/exynos4210_mct.c | 4 +--
56
hw/timer/exynos4210_pwm.c | 8 ++---
57
target/openrisc/sys_helper.c | 3 --
58
util/cutils.c | 3 +-
59
hw/arm/Kconfig | 1 +
60
10 files changed, 89 insertions(+), 34 deletions(-)
61
diff view generated by jsdifflib
Deleted patch
1
From: Andrew Jones <drjones@redhat.com>
2
1
3
The removal of the selection of A15MPCORE from ARM_VIRT also
4
removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
5
6
Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
7
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
8
Signed-off-by: Andrew Jones <drjones@redhat.com>
9
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
10
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
11
Message-id: 20201111143440.112763-1-drjones@redhat.com
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
hw/arm/Kconfig | 1 +
15
1 file changed, 1 insertion(+)
16
17
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
18
index XXXXXXX..XXXXXXX 100644
19
--- a/hw/arm/Kconfig
20
+++ b/hw/arm/Kconfig
21
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
22
imply VFIO_PLATFORM
23
imply VFIO_XGMAC
24
imply TPM_TIS_SYSBUS
25
+ select ARM_GIC
26
select ACPI
27
select ARM_SMMUV3
28
select GPIO_KEY
29
--
30
2.20.1
31
32
diff view generated by jsdifflib
1
From: Alex Chen <alex.chen@huawei.com>
1
From: Pierre-Clément Tosi <ptosi@google.com>
2
2
3
We should use printf format specifier "%u" instead of "%d" for
3
EL2 accesses to CNTPOFF_EL2 should only ever trap to EL3 if EL3 is
4
argument of type "unsigned int".
4
present, as described by the reference manual (for MRS):
5
5
6
Reported-by: Euler Robot <euler.robot@huawei.com>
6
/* ... */
7
Signed-off-by: Alex Chen <alex.chen@huawei.com>
7
elsif PSTATE.EL == EL2 then
8
Message-id: 20201111073651.72804-1-alex.chen@huawei.com
8
if Halted() && HaveEL(EL3) && /*...*/ then
9
UNDEFINED;
10
elsif HaveEL(EL3) && SCR_EL3.ECVEn == '0' then
11
/* ... */
12
else
13
X[t, 64] = CNTPOFF_EL2;
14
15
However, the existing implementation of gt_cntpoff_access() always
16
returns CP_ACCESS_TRAP_EL3 for EL2 accesses with SCR_EL3.ECVEn unset. In
17
pseudo-code terminology, this corresponds to assuming that HaveEL(EL3)
18
is always true, which is wrong. As a result, QEMU panics in
19
access_check_cp_reg() when started without EL3 and running EL2 code
20
accessing the register (e.g. any recent KVM booting a guest).
21
22
Therefore, add the HaveEL(EL3) check to gt_cntpoff_access().
23
24
Fixes: 2808d3b38a52 ("target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling")
25
Signed-off-by: Pierre-Clément Tosi <ptosi@google.com>
26
Message-id: m3al6amhdkmsiy2f62w72ufth6dzn45xg5cz6xljceyibphnf4@ezmmpwk4tnhl
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
27
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
29
---
12
hw/timer/exynos4210_mct.c | 4 ++--
30
target/arm/helper.c | 3 ++-
13
hw/timer/exynos4210_pwm.c | 8 ++++----
31
1 file changed, 2 insertions(+), 1 deletion(-)
14
2 files changed, 6 insertions(+), 6 deletions(-)
15
32
16
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
33
diff --git a/target/arm/helper.c b/target/arm/helper.c
17
index XXXXXXX..XXXXXXX 100644
34
index XXXXXXX..XXXXXXX 100644
18
--- a/hw/timer/exynos4210_mct.c
35
--- a/target/arm/helper.c
19
+++ b/hw/timer/exynos4210_mct.c
36
+++ b/target/arm/helper.c
20
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
37
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_cntpoff_access(CPUARMState *env,
21
/* If CSTAT is pending and IRQ is enabled */
38
const ARMCPRegInfo *ri,
22
if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
39
bool isread)
23
(s->reg.int_enb & G_INT_ENABLE(id))) {
40
{
24
- DPRINTF("gcmp timer[%d] IRQ\n", id);
41
- if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
25
+ DPRINTF("gcmp timer[%u] IRQ\n", id);
42
+ if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) &&
26
qemu_irq_raise(s->irq[id]);
43
+ !(env->cp15.scr_el3 & SCR_ECVEN)) {
44
return CP_ACCESS_TRAP_EL3;
27
}
45
}
28
}
46
return CP_ACCESS_OK;
29
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
30
MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
31
32
if (freq != s->freq) {
33
- DPRINTF("freq=%dHz\n", s->freq);
34
+ DPRINTF("freq=%uHz\n", s->freq);
35
36
/* global timer */
37
tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
38
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
39
index XXXXXXX..XXXXXXX 100644
40
--- a/hw/timer/exynos4210_pwm.c
41
+++ b/hw/timer/exynos4210_pwm.c
42
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
43
44
if (freq != s->timer[id].freq) {
45
ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
46
- DPRINTF("freq=%dHz\n", s->timer[id].freq);
47
+ DPRINTF("freq=%uHz\n", s->timer[id].freq);
48
}
49
}
50
51
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
52
uint32_t id = s->id;
53
bool cmp;
54
55
- DPRINTF("timer %d tick\n", id);
56
+ DPRINTF("timer %u tick\n", id);
57
58
/* set irq status */
59
p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
60
61
/* raise IRQ */
62
if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
63
- DPRINTF("timer %d IRQ\n", id);
64
+ DPRINTF("timer %u IRQ\n", id);
65
qemu_irq_raise(p->timer[id].irq);
66
}
67
68
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
69
}
70
71
if (cmp) {
72
- DPRINTF("auto reload timer %d count to %x\n", id,
73
+ DPRINTF("auto reload timer %u count to %x\n", id,
74
p->timer[id].reg_tcntb);
75
ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
76
ptimer_run(p->timer[id].ptimer, 1);
77
--
47
--
78
2.20.1
48
2.34.1
79
49
80
50
diff view generated by jsdifflib
Deleted patch
1
In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
2
and mouse emulation. However we didn't remove all the debug-by-printf
3
support. In fact there is only one printf() remaining, and it is
4
redundant with the trace_ps2_write_mouse() event next to it.
5
Remove the printf() and the now-unused DEBUG* macros.
6
1
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
9
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
10
Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
11
---
12
hw/input/ps2.c | 9 ---------
13
1 file changed, 9 deletions(-)
14
15
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/hw/input/ps2.c
18
+++ b/hw/input/ps2.c
19
@@ -XXX,XX +XXX,XX @@
20
21
#include "trace.h"
22
23
-/* debug PC keyboard */
24
-//#define DEBUG_KBD
25
-
26
-/* debug PC keyboard : only mouse */
27
-//#define DEBUG_MOUSE
28
-
29
/* Keyboard Commands */
30
#define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
31
#define KBD_CMD_ECHO     0xEE
32
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
33
PS2MouseState *s = (PS2MouseState *)opaque;
34
35
trace_ps2_write_mouse(opaque, val);
36
-#ifdef DEBUG_MOUSE
37
- printf("kbd: write mouse 0x%02x\n", val);
38
-#endif
39
switch(s->common.write_cmd) {
40
default:
41
case -1:
42
--
43
2.20.1
44
45
diff view generated by jsdifflib
Deleted patch
1
In the mtspr helper we attempt to check for "is the timer disabled"
2
with "if (env->ttmr & TIMER_NONE)". This is wrong because TIMER_NONE
3
is zero and the condition is always false (Coverity complains about
4
the dead code.)
5
1
6
The correct check would be to test whether the TTMR_M field in the
7
register is equal to TIMER_NONE instead. However, the
8
cpu_openrisc_timer_update() function checks whether the timer is
9
enabled (it looks at cpu->env.is_counting, which is set to 0 via
10
cpu_openrisc_count_stop() when the TTMR_M field is set to
11
TIMER_NONE), so there's no need to check for "timer disabled" in the
12
target/openrisc code. Instead, simply remove the dead code.
13
14
Fixes: Coverity CID 1005812
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Acked-by: Stafford Horne <shorne@gmail.com>
17
Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
18
---
19
target/openrisc/sys_helper.c | 3 ---
20
1 file changed, 3 deletions(-)
21
22
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
23
index XXXXXXX..XXXXXXX 100644
24
--- a/target/openrisc/sys_helper.c
25
+++ b/target/openrisc/sys_helper.c
26
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
27
28
case TO_SPR(10, 1): /* TTCR */
29
cpu_openrisc_count_set(cpu, rb);
30
- if (env->ttmr & TIMER_NONE) {
31
- return;
32
- }
33
cpu_openrisc_timer_update(cpu);
34
break;
35
#endif
36
--
37
2.20.1
38
39
diff view generated by jsdifflib
Deleted patch
1
From: Alistair Francis <alistair.francis@wdc.com>
2
1
3
This patch fixes CID 1432800 by removing an unnecessary check.
4
5
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
---
9
hw/core/register.c | 4 ----
10
1 file changed, 4 deletions(-)
11
12
diff --git a/hw/core/register.c b/hw/core/register.c
13
index XXXXXXX..XXXXXXX 100644
14
--- a/hw/core/register.c
15
+++ b/hw/core/register.c
16
@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
17
int index = rae[i].addr / data_size;
18
RegisterInfo *r = &ri[index];
19
20
- if (data + data_size * index == 0 || !&rae[i]) {
21
- continue;
22
- }
23
-
24
/* Init the register, this will zero it. */
25
object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
26
27
--
28
2.20.1
29
30
diff view generated by jsdifflib
Deleted patch
1
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
2
1
3
Fix Coverity CID 1435957: Memory - illegal accesses (OVERRUN):
4
5
>>> Overrunning array "suffixes" of 7 8-byte elements at element
6
index 7 (byte offset 63) using index "idx" (which evaluates to 7).
7
8
Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
9
which is ~18.446 EHz, less than 1000 EHz.
10
11
Reported-by: Eduardo Habkost <ehabkost@redhat.com>
12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
13
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
15
Reviewed-by: Luc Michel <luc@lmichel.fr>
16
Message-id: 20201101215755.2021421-1-f4bug@amsat.org
17
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
18
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
---
21
util/cutils.c | 3 ++-
22
1 file changed, 2 insertions(+), 1 deletion(-)
23
24
diff --git a/util/cutils.c b/util/cutils.c
25
index XXXXXXX..XXXXXXX 100644
26
--- a/util/cutils.c
27
+++ b/util/cutils.c
28
@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
29
double freq = freq_hz;
30
size_t idx = 0;
31
32
- while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
33
+ while (freq >= 1000.0) {
34
freq /= 1000.0;
35
idx++;
36
}
37
+ assert(idx < ARRAY_SIZE(suffixes));
38
39
return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
40
}
41
--
42
2.20.1
43
44
diff view generated by jsdifflib
Deleted patch
1
In commit 76346b6264a9b01979 we tried to add a configure check that
2
the libgio pkg-config data was correct, which builds an executable
3
linked against it. Unfortunately this doesn't catch the problem
4
(missing static library dependency info), because a "do nothing" test
5
source file doesn't have any symbol references that cause the linker
6
to pull in .o files from libgio.a, and so we don't see the "missing
7
symbols from libmount" error that a full QEMU link triggers.
8
1
9
(The ineffective test went unnoticed because of a typo that
10
effectively disabled libgio unconditionally, but after commit
11
3569a5dfc11f2 fixed that, a static link of the system emulator on
12
Ubuntu stopped working again.)
13
14
Improve the gio test by having the test source fragment reference a
15
g_dbus function (which is what is indirectly causing us to end up
16
wanting functions from libmount).
17
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
19
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
20
Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
21
---
22
configure | 11 +++++++++--
23
1 file changed, 9 insertions(+), 2 deletions(-)
24
25
diff --git a/configure b/configure
26
index XXXXXXX..XXXXXXX 100755
27
--- a/configure
28
+++ b/configure
29
@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
30
# Check that the libraries actually work -- Ubuntu 18.04 ships
31
# with pkg-config --static --libs data for gio-2.0 that is missing
32
# -lblkid and will give a link error.
33
- write_c_skeleton
34
- if compile_prog "" "$gio_libs" ; then
35
+ cat > $TMPC <<EOF
36
+#include <gio/gio.h>
37
+int main(void)
38
+{
39
+ g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
40
+ return 0;
41
+}
42
+EOF
43
+ if compile_prog "$gio_cflags" "$gio_libs" ; then
44
gio=yes
45
else
46
gio=no
47
--
48
2.20.1
49
50
diff view generated by jsdifflib
Deleted patch
1
The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
2
power-up reset values for the T_low and T_high registers are 80 degrees C
3
and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5. These
4
values are then shifted right by four bits to give the register reset
5
values, since both registers store the 12 bits of temperature data in bits
6
[15..4] of a 16 bit register.
7
1
8
We were resetting these registers to zero, which is problematic for Linux
9
guests which enable the alert interrupt and then immediately take an
10
unexpected overtemperature alert because the current temperature is above
11
freezing...
12
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Cédric Le Goater <clg@kaod.org>
15
Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
16
---
17
hw/misc/tmp105.c | 3 +++
18
1 file changed, 3 insertions(+)
19
20
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
21
index XXXXXXX..XXXXXXX 100644
22
--- a/hw/misc/tmp105.c
23
+++ b/hw/misc/tmp105.c
24
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
25
s->faults = tmp105_faultq[(s->config >> 3) & 3];
26
s->alarm = 0;
27
28
+ s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
29
+ s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
30
+
31
tmp105_interrupt_update(s);
32
}
33
34
--
35
2.20.1
36
37
diff view generated by jsdifflib
1
The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
1
When we do an AT address translation operation, the page table walk
2
signals an alert when the temperature equals or exceeds the T_high value and
2
is supposed to be performed in the context of the EL we're doing the
3
then remains high until a device register is read or the device responds to
3
walk for, so for instance an AT S1E2R walk is done for EL2. In the
4
the SMBUS Alert Response address, or the device is put into Shutdown Mode.
4
pseudocode an EL is passed to AArch64.AT(), which calls
5
Thereafter the Alert pin will only be re-signalled when temperature falls
5
SecurityStateAtEL() to find the security state that we should be
6
below T_low; alert can then be cleared in the same set of ways, and the
6
doing the walk with.
7
device returns to its initial "alert when temperature goes above T_high"
8
mode. (If this textual description is confusing, see figure 3 in the
9
TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
10
7
11
We were misimplementing this as a simple "always alert if temperature is
8
In ats_write64() we get this wrong, instead using the current
12
above T_high or below T_low" condition, which gives a spurious alert on
9
security space always. This is fine for AT operations performed from
13
startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
10
EL1 and EL2, because there the current security state and the
14
limit values.
11
security state for the lower EL are the same. But for AT operations
12
performed from EL3, the current security state is always either
13
Secure or Root, whereas we want to use the security state defined by
14
SCR_EL3.{NS,NSE} for the walk. This affects not just guests using
15
FEAT_RME but also ones where EL3 is Secure state and the EL3 code
16
is trying to do an AT for a NonSecure EL2 or EL1.
15
17
16
Implement the correct (hysteresis) behaviour by tracking whether we
18
Use arm_security_space_below_el3() to get the SecuritySpace to
17
are currently looking for the temperature to rise over T_high or
19
pass to do_ats_write() for all AT operations except the
18
for it to fall below T_low. Our implementation of the comparator
20
AT S1E3* operations.
19
mode (TM==0) wasn't wrong, but rephrase it to match the way that
20
interrupt mode is now handled for clarity.
21
21
22
Cc: qemu-stable@nongnu.org
23
Fixes: e1ee56ec2383 ("target/arm: Pass security space rather than flag for AT instructions")
24
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2250
22
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
25
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
Reviewed-by: Cédric Le Goater <clg@kaod.org>
26
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
24
Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
27
Message-id: 20240405180232.3570066-1-peter.maydell@linaro.org
25
---
28
---
26
hw/misc/tmp105.h | 7 +++++
29
target/arm/helper.c | 7 +++++--
27
hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
30
1 file changed, 5 insertions(+), 2 deletions(-)
28
2 files changed, 68 insertions(+), 9 deletions(-)
29
31
30
diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
32
diff --git a/target/arm/helper.c b/target/arm/helper.c
31
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
32
--- a/hw/misc/tmp105.h
34
--- a/target/arm/helper.c
33
+++ b/hw/misc/tmp105.h
35
+++ b/target/arm/helper.c
34
@@ -XXX,XX +XXX,XX @@ struct TMP105State {
36
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
35
int16_t limit[2];
37
ARMMMUIdx mmu_idx;
36
int faults;
38
uint64_t hcr_el2 = arm_hcr_el2_eff(env);
37
uint8_t alarm;
39
bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
38
+ /*
40
+ bool for_el3 = false;
39
+ * The TMP105 initially looks for a temperature rising above T_high;
41
+ ARMSecuritySpace ss;
40
+ * once this is detected, the condition it looks for next is the
42
41
+ * temperature falling below T_low. This flag is false when initially
43
switch (ri->opc2 & 6) {
42
+ * looking for T_high, true when looking for T_low.
44
case 0:
43
+ */
45
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
44
+ bool detect_falling;
46
break;
45
};
47
case 6: /* AT S1E3R, AT S1E3W */
46
48
mmu_idx = ARMMMUIdx_E3;
47
#endif
49
+ for_el3 = true;
48
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
50
break;
49
index XXXXXXX..XXXXXXX 100644
51
default:
50
--- a/hw/misc/tmp105.c
52
g_assert_not_reached();
51
+++ b/hw/misc/tmp105.c
53
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
52
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
54
g_assert_not_reached();
53
return;
54
}
55
}
55
56
56
- if ((s->config >> 1) & 1) {                    /* TM */
57
- env->cp15.par_el[1] = do_ats_write(env, value, access_type,
57
- if (s->temperature >= s->limit[1])
58
- mmu_idx, arm_security_space(env));
58
- s->alarm = 1;
59
+ ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
59
- else if (s->temperature < s->limit[0])
60
+ env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
60
- s->alarm = 1;
61
#else
61
+ if (s->config >> 1 & 1) {
62
/* Handled by hardware accelerator. */
62
+ /*
63
g_assert_not_reached();
63
+ * TM == 1 : Interrupt mode. We signal Alert when the
64
+ * temperature rises above T_high, and expect the guest to clear
65
+ * it (eg by reading a device register).
66
+ */
67
+ if (s->detect_falling) {
68
+ if (s->temperature < s->limit[0]) {
69
+ s->alarm = 1;
70
+ s->detect_falling = false;
71
+ }
72
+ } else {
73
+ if (s->temperature >= s->limit[1]) {
74
+ s->alarm = 1;
75
+ s->detect_falling = true;
76
+ }
77
+ }
78
} else {
79
- if (s->temperature >= s->limit[1])
80
- s->alarm = 1;
81
- else if (s->temperature < s->limit[0])
82
- s->alarm = 0;
83
+ /*
84
+ * TM == 0 : Comparator mode. We signal Alert when the temperature
85
+ * rises above T_high, and stop signalling it when the temperature
86
+ * falls below T_low.
87
+ */
88
+ if (s->detect_falling) {
89
+ if (s->temperature < s->limit[0]) {
90
+ s->alarm = 0;
91
+ s->detect_falling = false;
92
+ }
93
+ } else {
94
+ if (s->temperature >= s->limit[1]) {
95
+ s->alarm = 1;
96
+ s->detect_falling = true;
97
+ }
98
+ }
99
}
100
101
tmp105_interrupt_update(s);
102
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
103
return 0;
104
}
105
106
+static bool detect_falling_needed(void *opaque)
107
+{
108
+ TMP105State *s = opaque;
109
+
110
+ /*
111
+ * We only need to migrate the detect_falling bool if it's set;
112
+ * for migration from older machines we assume that it is false
113
+ * (ie temperature is not out of range).
114
+ */
115
+ return s->detect_falling;
116
+}
117
+
118
+static const VMStateDescription vmstate_tmp105_detect_falling = {
119
+ .name = "TMP105/detect-falling",
120
+ .version_id = 1,
121
+ .minimum_version_id = 1,
122
+ .needed = detect_falling_needed,
123
+ .fields = (VMStateField[]) {
124
+ VMSTATE_BOOL(detect_falling, TMP105State),
125
+ VMSTATE_END_OF_LIST()
126
+ }
127
+};
128
+
129
static const VMStateDescription vmstate_tmp105 = {
130
.name = "TMP105",
131
.version_id = 0,
132
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
133
VMSTATE_UINT8(alarm, TMP105State),
134
VMSTATE_I2C_SLAVE(i2c, TMP105State),
135
VMSTATE_END_OF_LIST()
136
+ },
137
+ .subsections = (const VMStateDescription*[]) {
138
+ &vmstate_tmp105_detect_falling,
139
+ NULL
140
}
141
};
142
143
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
144
s->config = 0;
145
s->faults = tmp105_faultq[(s->config >> 3) & 3];
146
s->alarm = 0;
147
+ s->detect_falling = false;
148
149
s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
150
s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
151
--
64
--
152
2.20.1
65
2.34.1
153
154
diff view generated by jsdifflib