1
Nothing too exciting, but does include the last bits of v8.1M support work.
1
The following changes since commit f003dd8d81f7d88f4b1f8802309eaa76f6eb223a:
2
2
3
-- PMM
3
Merge tag 'pull-tcg-20230305' of https://gitlab.com/rth7680/qemu into staging (2023-03-06 10:20:04 +0000)
4
5
The following changes since commit e79de63ab1bd1f6550e7b915e433bec1ad1a870a:
6
7
Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210107' into staging (2021-01-07 20:34:05 +0000)
8
4
9
are available in the Git repository at:
5
are available in the Git repository at:
10
6
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210108
7
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230306
12
8
13
for you to fetch changes up to c9f8511ea8d2b80723af0fea1f716d752c1b5208:
9
for you to fetch changes up to 2ddc45954f97cd1d7ee5cbca0def05e980d1da9f:
14
10
15
docs/system: arm: Add sabrelite board description (2021-01-08 15:13:39 +0000)
11
hw: arm: allwinner-h3: Fix and complete H3 i2c devices (2023-03-06 15:31:24 +0000)
16
12
17
----------------------------------------------------------------
13
----------------------------------------------------------------
18
target-arm queue:
14
target-arm queue:
19
* intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs
15
* allwinner-h3: Fix I2C controller model for Sun6i SoCs
20
* target/arm: Fix MTE0_ACTIVE
16
* allwinner-h3: Add missing i2c controllers
21
* target/arm: Implement v8.1M and Cortex-M55 model
17
* Expose M-profile system registers to gdbstub
22
* hw/arm/highbank: Drop dead KVM support code
18
* Expose pauth information to gdbstub
23
* util/qemu-timer: Make timer_free() imply timer_del()
19
* Support direct boot for Linux/arm64 EFI zboot images
24
* various devices: Use ptimer_free() in finalize function
20
* Fix incorrect stage 2 MMU setup validation
25
* docs/system: arm: Add sabrelite board description
26
* sabrelite: Minor fixes to allow booting U-Boot
27
21
28
----------------------------------------------------------------
22
----------------------------------------------------------------
29
Andrew Jones (1):
23
Ard Biesheuvel (1):
30
hw/arm/virt: Remove virt machine state 'smp_cpus'
24
hw: arm: Support direct boot for Linux/arm64 EFI zboot images
31
25
32
Bin Meng (4):
26
David Reiss (2):
33
hw/misc: imx6_ccm: Update PMU_MISC0 reset value
27
target/arm: Export arm_v7m_mrs_control
34
hw/msic: imx6_ccm: Correct register value for silicon type
28
target/arm: Export arm_v7m_get_sp_ptr
35
hw/arm: sabrelite: Connect the Ethernet PHY at address 6
36
docs/system: arm: Add sabrelite board description
37
29
38
Edgar E. Iglesias (1):
30
Richard Henderson (16):
39
intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs
31
target/arm: Normalize aarch64 gdbstub get/set function names
32
target/arm: Unexport arm_gen_dynamic_sysreg_xml
33
target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
34
target/arm: Split out output_vector_union_type
35
target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
36
target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
37
target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
38
target/arm: Add name argument to output_vector_union_type
39
target/arm: Simplify iteration over bit widths
40
target/arm: Create pauth_ptr_mask
41
target/arm: Implement gdbstub pauth extension
42
target/arm: Implement gdbstub m-profile systemreg and secext
43
target/arm: Handle m-profile in arm_is_secure
44
target/arm: Stub arm_hcr_el2_eff for m-profile
45
target/arm: Diagnose incorrect usage of arm_is_secure subroutines
46
target/arm: Rewrite check_s2_mmu_setup
40
47
41
Gan Qixin (7):
48
qianfan Zhao (2):
42
digic-timer: Use ptimer_free() in the finalize function to avoid memleaks
49
hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
43
allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks
50
hw: arm: allwinner-h3: Fix and complete H3 i2c devices
44
exynos4210_rtc: Use ptimer_free() in the finalize function to avoid memleaks
45
exynos4210_pwm: Use ptimer_free() in the finalize function to avoid memleaks
46
mss-timer: Use ptimer_free() in the finalize function to avoid memleaks
47
musicpal: Use ptimer_free() in the finalize function to avoid memleaks
48
exynos4210_mct: Use ptimer_free() in the finalize function to avoid memleaks
49
51
50
Peter Maydell (9):
52
configs/targets/aarch64-linux-user.mak | 2 +-
51
hw/intc/armv7m_nvic: Correct handling of CCR.BFHFNMIGN
53
configs/targets/aarch64-softmmu.mak | 2 +-
52
target/arm: Correct store of FPSCR value via FPCXT_S
54
configs/targets/aarch64_be-linux-user.mak | 2 +-
53
target/arm: Implement FPCXT_NS fp system register
55
include/hw/arm/allwinner-h3.h | 6 +
54
target/arm: Implement Cortex-M55 model
56
include/hw/i2c/allwinner-i2c.h | 6 +
55
hw/arm/highbank: Drop dead KVM support code
57
include/hw/loader.h | 19 ++
56
util/qemu-timer: Make timer_free() imply timer_del()
58
target/arm/cpu.h | 17 +-
57
scripts/coccinelle: New script to remove unnecessary timer_del() calls
59
target/arm/internals.h | 34 +++-
58
Remove superfluous timer_del() calls
60
hw/arm/allwinner-h3.c | 29 +++-
59
target/arm: Remove timer_del()/timer_deinit() before timer_free()
61
hw/arm/boot.c | 6 +
60
62
hw/core/loader.c | 91 ++++++++++
61
Richard Henderson (1):
63
hw/i2c/allwinner-i2c.c | 26 ++-
62
target/arm: Fix MTE0_ACTIVE
64
target/arm/gdbstub.c | 278 ++++++++++++++++++------------
63
65
target/arm/gdbstub64.c | 175 ++++++++++++++++++-
64
docs/system/arm/sabrelite.rst | 119 ++++++++++++++++++++++++++
66
target/arm/helper.c | 3 +
65
docs/system/target-arm.rst | 1 +
67
target/arm/ptw.c | 173 +++++++++++--------
66
scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++
68
target/arm/tcg/m_helper.c | 90 +++++-----
67
include/hw/arm/virt.h | 3 +-
69
target/arm/tcg/pauth_helper.c | 26 ++-
68
include/qemu/timer.h | 24 +++---
70
gdb-xml/aarch64-pauth.xml | 15 ++
69
block/iscsi.c | 2 -
71
19 files changed, 742 insertions(+), 258 deletions(-)
70
block/nbd.c | 1 -
72
create mode 100644 gdb-xml/aarch64-pauth.xml
71
block/qcow2.c | 1 -
72
hw/arm/highbank.c | 14 +--
73
hw/arm/musicpal.c | 12 +++
74
hw/arm/sabrelite.c | 4 +
75
hw/arm/virt-acpi-build.c | 9 +-
76
hw/arm/virt.c | 21 +++--
77
hw/block/nvme.c | 2 -
78
hw/char/serial.c | 2 -
79
hw/char/virtio-serial-bus.c | 2 -
80
hw/ide/core.c | 1 -
81
hw/input/hid.c | 1 -
82
hw/intc/apic.c | 1 -
83
hw/intc/arm_gic.c | 4 +-
84
hw/intc/armv7m_nvic.c | 15 ++++
85
hw/intc/ioapic.c | 1 -
86
hw/ipmi/ipmi_bmc_extern.c | 1 -
87
hw/misc/imx6_ccm.c | 4 +-
88
hw/net/e1000.c | 3 -
89
hw/net/e1000e_core.c | 8 --
90
hw/net/pcnet-pci.c | 1 -
91
hw/net/rtl8139.c | 1 -
92
hw/net/spapr_llan.c | 1 -
93
hw/net/virtio-net.c | 2 -
94
hw/rtc/exynos4210_rtc.c | 9 ++
95
hw/s390x/s390-pci-inst.c | 1 -
96
hw/sd/sd.c | 1 -
97
hw/sd/sdhci.c | 2 -
98
hw/timer/allwinner-a10-pit.c | 11 +++
99
hw/timer/digic-timer.c | 8 ++
100
hw/timer/exynos4210_mct.c | 14 +++
101
hw/timer/exynos4210_pwm.c | 11 +++
102
hw/timer/mss-timer.c | 13 +++
103
hw/usb/dev-hub.c | 1 -
104
hw/usb/hcd-ehci.c | 1 -
105
hw/usb/hcd-ohci-pci.c | 1 -
106
hw/usb/hcd-uhci.c | 1 -
107
hw/usb/hcd-xhci.c | 1 -
108
hw/usb/redirect.c | 1 -
109
hw/vfio/display.c | 1 -
110
hw/virtio/vhost-vsock-common.c | 1 -
111
hw/virtio/virtio-balloon.c | 1 -
112
hw/virtio/virtio-rng.c | 1 -
113
hw/watchdog/wdt_diag288.c | 1 -
114
hw/watchdog/wdt_i6300esb.c | 1 -
115
migration/colo.c | 1 -
116
monitor/hmp-cmds.c | 1 -
117
net/announce.c | 1 -
118
net/colo-compare.c | 1 -
119
net/slirp.c | 1 -
120
replay/replay-debugging.c | 1 -
121
target/arm/cpu.c | 2 -
122
target/arm/cpu_tcg.c | 42 +++++++++
123
target/arm/helper.c | 2 +-
124
target/s390x/cpu.c | 2 -
125
ui/console.c | 1 -
126
ui/spice-core.c | 1 -
127
util/throttle.c | 1 -
128
target/arm/translate-vfp.c.inc | 114 ++++++++++++++++++++++--
129
65 files changed, 421 insertions(+), 111 deletions(-)
130
create mode 100644 docs/system/arm/sabrelite.rst
131
create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci
132
diff view generated by jsdifflib
1
This commit is the result of running the timer-del-timer-free.cocci
1
From: Richard Henderson <richard.henderson@linaro.org>
2
script on the whole source tree.
3
2
3
Make the form of the function names between fp and sve the same:
4
- arm_gdb_*_svereg -> aarch64_gdb_*_sve_reg.
5
- aarch64_fpu_gdb_*_reg -> aarch64_gdb_*_fpu_reg.
6
7
Reviewed-by: Fabiano Rosas <farosas@suse.de>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20230227213329.793795-2-richard.henderson@linaro.org
4
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5
Acked-by: Corey Minyard <cminyard@mvista.com>
6
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20201215154107.3255-4-peter.maydell@linaro.org
10
---
12
---
11
block/iscsi.c | 2 --
13
target/arm/internals.h | 8 ++++----
12
block/nbd.c | 1 -
14
target/arm/gdbstub.c | 9 +++++----
13
block/qcow2.c | 1 -
15
target/arm/gdbstub64.c | 8 ++++----
14
hw/block/nvme.c | 2 --
16
3 files changed, 13 insertions(+), 12 deletions(-)
15
hw/char/serial.c | 2 --
16
hw/char/virtio-serial-bus.c | 2 --
17
hw/ide/core.c | 1 -
18
hw/input/hid.c | 1 -
19
hw/intc/apic.c | 1 -
20
hw/intc/ioapic.c | 1 -
21
hw/ipmi/ipmi_bmc_extern.c | 1 -
22
hw/net/e1000.c | 3 ---
23
hw/net/e1000e_core.c | 8 --------
24
hw/net/pcnet-pci.c | 1 -
25
hw/net/rtl8139.c | 1 -
26
hw/net/spapr_llan.c | 1 -
27
hw/net/virtio-net.c | 2 --
28
hw/s390x/s390-pci-inst.c | 1 -
29
hw/sd/sd.c | 1 -
30
hw/sd/sdhci.c | 2 --
31
hw/usb/dev-hub.c | 1 -
32
hw/usb/hcd-ehci.c | 1 -
33
hw/usb/hcd-ohci-pci.c | 1 -
34
hw/usb/hcd-uhci.c | 1 -
35
hw/usb/hcd-xhci.c | 1 -
36
hw/usb/redirect.c | 1 -
37
hw/vfio/display.c | 1 -
38
hw/virtio/vhost-vsock-common.c | 1 -
39
hw/virtio/virtio-balloon.c | 1 -
40
hw/virtio/virtio-rng.c | 1 -
41
hw/watchdog/wdt_diag288.c | 1 -
42
hw/watchdog/wdt_i6300esb.c | 1 -
43
migration/colo.c | 1 -
44
monitor/hmp-cmds.c | 1 -
45
net/announce.c | 1 -
46
net/colo-compare.c | 1 -
47
net/slirp.c | 1 -
48
replay/replay-debugging.c | 1 -
49
target/s390x/cpu.c | 2 --
50
ui/console.c | 1 -
51
ui/spice-core.c | 1 -
52
util/throttle.c | 1 -
53
42 files changed, 58 deletions(-)
54
17
55
diff --git a/block/iscsi.c b/block/iscsi.c
18
diff --git a/target/arm/internals.h b/target/arm/internals.h
56
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
57
--- a/block/iscsi.c
20
--- a/target/arm/internals.h
58
+++ b/block/iscsi.c
21
+++ b/target/arm/internals.h
59
@@ -XXX,XX +XXX,XX @@ static void iscsi_detach_aio_context(BlockDriverState *bs)
22
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
60
iscsilun->events = 0;
23
}
61
24
62
if (iscsilun->nop_timer) {
25
#ifdef TARGET_AARCH64
63
- timer_del(iscsilun->nop_timer);
26
-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
64
timer_free(iscsilun->nop_timer);
27
-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
65
iscsilun->nop_timer = NULL;
28
-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
66
}
29
-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
67
if (iscsilun->event_timer) {
30
+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
68
- timer_del(iscsilun->event_timer);
31
+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
69
timer_free(iscsilun->event_timer);
32
+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
70
iscsilun->event_timer = NULL;
33
+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
71
}
34
void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
72
diff --git a/block/nbd.c b/block/nbd.c
35
void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
36
void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
37
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
73
index XXXXXXX..XXXXXXX 100644
38
index XXXXXXX..XXXXXXX 100644
74
--- a/block/nbd.c
39
--- a/target/arm/gdbstub.c
75
+++ b/block/nbd.c
40
+++ b/target/arm/gdbstub.c
76
@@ -XXX,XX +XXX,XX @@ static void nbd_recv_coroutines_wake_all(BDRVNBDState *s)
41
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
77
static void reconnect_delay_timer_del(BDRVNBDState *s)
42
*/
43
#ifdef TARGET_AARCH64
44
if (isar_feature_aa64_sve(&cpu->isar)) {
45
- gdb_register_coprocessor(cs, arm_gdb_get_svereg, arm_gdb_set_svereg,
46
- arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs),
47
+ int nreg = arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs);
48
+ gdb_register_coprocessor(cs, aarch64_gdb_get_sve_reg,
49
+ aarch64_gdb_set_sve_reg, nreg,
50
"sve-registers.xml", 0);
51
} else {
52
- gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
53
- aarch64_fpu_gdb_set_reg,
54
+ gdb_register_coprocessor(cs, aarch64_gdb_get_fpu_reg,
55
+ aarch64_gdb_set_fpu_reg,
56
34, "aarch64-fpu.xml", 0);
57
}
58
#endif
59
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
60
index XXXXXXX..XXXXXXX 100644
61
--- a/target/arm/gdbstub64.c
62
+++ b/target/arm/gdbstub64.c
63
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
64
return 0;
65
}
66
67
-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
68
+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg)
78
{
69
{
79
if (s->reconnect_delay_timer) {
70
switch (reg) {
80
- timer_del(s->reconnect_delay_timer);
71
case 0 ... 31:
81
timer_free(s->reconnect_delay_timer);
72
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
82
s->reconnect_delay_timer = NULL;
83
}
84
diff --git a/block/qcow2.c b/block/qcow2.c
85
index XXXXXXX..XXXXXXX 100644
86
--- a/block/qcow2.c
87
+++ b/block/qcow2.c
88
@@ -XXX,XX +XXX,XX @@ static void cache_clean_timer_del(BlockDriverState *bs)
89
{
90
BDRVQcow2State *s = bs->opaque;
91
if (s->cache_clean_timer) {
92
- timer_del(s->cache_clean_timer);
93
timer_free(s->cache_clean_timer);
94
s->cache_clean_timer = NULL;
95
}
96
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
97
index XXXXXXX..XXXXXXX 100644
98
--- a/hw/block/nvme.c
99
+++ b/hw/block/nvme.c
100
@@ -XXX,XX +XXX,XX @@ static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)
101
static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n)
102
{
103
n->sq[sq->sqid] = NULL;
104
- timer_del(sq->timer);
105
timer_free(sq->timer);
106
g_free(sq->io_req);
107
if (sq->sqid) {
108
@@ -XXX,XX +XXX,XX @@ static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req)
109
static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n)
110
{
111
n->cq[cq->cqid] = NULL;
112
- timer_del(cq->timer);
113
timer_free(cq->timer);
114
msix_vector_unuse(&n->parent_obj, cq->vector);
115
if (cq->cqid) {
116
diff --git a/hw/char/serial.c b/hw/char/serial.c
117
index XXXXXXX..XXXXXXX 100644
118
--- a/hw/char/serial.c
119
+++ b/hw/char/serial.c
120
@@ -XXX,XX +XXX,XX @@ static void serial_unrealize(DeviceState *dev)
121
122
qemu_chr_fe_deinit(&s->chr, false);
123
124
- timer_del(s->modem_status_poll);
125
timer_free(s->modem_status_poll);
126
127
- timer_del(s->fifo_timeout_timer);
128
timer_free(s->fifo_timeout_timer);
129
130
fifo8_destroy(&s->recv_fifo);
131
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
132
index XXXXXXX..XXXXXXX 100644
133
--- a/hw/char/virtio-serial-bus.c
134
+++ b/hw/char/virtio-serial-bus.c
135
@@ -XXX,XX +XXX,XX @@ static void virtio_serial_post_load_timer_cb(void *opaque)
136
}
137
}
138
g_free(s->post_load->connected);
139
- timer_del(s->post_load->timer);
140
timer_free(s->post_load->timer);
141
g_free(s->post_load);
142
s->post_load = NULL;
143
@@ -XXX,XX +XXX,XX @@ static void virtio_serial_device_unrealize(DeviceState *dev)
144
g_free(vser->ports_map);
145
if (vser->post_load) {
146
g_free(vser->post_load->connected);
147
- timer_del(vser->post_load->timer);
148
timer_free(vser->post_load->timer);
149
g_free(vser->post_load);
150
}
151
diff --git a/hw/ide/core.c b/hw/ide/core.c
152
index XXXXXXX..XXXXXXX 100644
153
--- a/hw/ide/core.c
154
+++ b/hw/ide/core.c
155
@@ -XXX,XX +XXX,XX @@ void ide_init2(IDEBus *bus, qemu_irq irq)
156
157
void ide_exit(IDEState *s)
158
{
159
- timer_del(s->sector_write_timer);
160
timer_free(s->sector_write_timer);
161
qemu_vfree(s->smart_selftest_data);
162
qemu_vfree(s->io_buffer);
163
diff --git a/hw/input/hid.c b/hw/input/hid.c
164
index XXXXXXX..XXXXXXX 100644
165
--- a/hw/input/hid.c
166
+++ b/hw/input/hid.c
167
@@ -XXX,XX +XXX,XX @@ static void hid_idle_timer(void *opaque)
168
static void hid_del_idle_timer(HIDState *hs)
169
{
170
if (hs->idle_timer) {
171
- timer_del(hs->idle_timer);
172
timer_free(hs->idle_timer);
173
hs->idle_timer = NULL;
174
}
175
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
176
index XXXXXXX..XXXXXXX 100644
177
--- a/hw/intc/apic.c
178
+++ b/hw/intc/apic.c
179
@@ -XXX,XX +XXX,XX @@ static void apic_unrealize(DeviceState *dev)
180
{
181
APICCommonState *s = APIC(dev);
182
183
- timer_del(s->timer);
184
timer_free(s->timer);
185
local_apics[s->id] = NULL;
186
}
187
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
188
index XXXXXXX..XXXXXXX 100644
189
--- a/hw/intc/ioapic.c
190
+++ b/hw/intc/ioapic.c
191
@@ -XXX,XX +XXX,XX @@ static void ioapic_unrealize(DeviceState *dev)
192
{
193
IOAPICCommonState *s = IOAPIC_COMMON(dev);
194
195
- timer_del(s->delayed_ioapic_service_timer);
196
timer_free(s->delayed_ioapic_service_timer);
197
}
198
199
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
200
index XXXXXXX..XXXXXXX 100644
201
--- a/hw/ipmi/ipmi_bmc_extern.c
202
+++ b/hw/ipmi/ipmi_bmc_extern.c
203
@@ -XXX,XX +XXX,XX @@ static void ipmi_bmc_extern_finalize(Object *obj)
204
{
205
IPMIBmcExtern *ibe = IPMI_BMC_EXTERN(obj);
206
207
- timer_del(ibe->extern_timer);
208
timer_free(ibe->extern_timer);
209
}
210
211
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
212
index XXXXXXX..XXXXXXX 100644
213
--- a/hw/net/e1000.c
214
+++ b/hw/net/e1000.c
215
@@ -XXX,XX +XXX,XX @@ pci_e1000_uninit(PCIDevice *dev)
216
{
217
E1000State *d = E1000(dev);
218
219
- timer_del(d->autoneg_timer);
220
timer_free(d->autoneg_timer);
221
- timer_del(d->mit_timer);
222
timer_free(d->mit_timer);
223
- timer_del(d->flush_queue_timer);
224
timer_free(d->flush_queue_timer);
225
qemu_del_nic(d->nic);
226
}
227
diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
228
index XXXXXXX..XXXXXXX 100644
229
--- a/hw/net/e1000e_core.c
230
+++ b/hw/net/e1000e_core.c
231
@@ -XXX,XX +XXX,XX @@ e1000e_intrmgr_pci_unint(E1000ECore *core)
232
{
233
int i;
234
235
- timer_del(core->radv.timer);
236
timer_free(core->radv.timer);
237
- timer_del(core->rdtr.timer);
238
timer_free(core->rdtr.timer);
239
- timer_del(core->raid.timer);
240
timer_free(core->raid.timer);
241
242
- timer_del(core->tadv.timer);
243
timer_free(core->tadv.timer);
244
- timer_del(core->tidv.timer);
245
timer_free(core->tidv.timer);
246
247
- timer_del(core->itr.timer);
248
timer_free(core->itr.timer);
249
250
for (i = 0; i < E1000E_MSIX_VEC_NUM; i++) {
251
- timer_del(core->eitr[i].timer);
252
timer_free(core->eitr[i].timer);
253
}
73
}
254
}
74
}
255
@@ -XXX,XX +XXX,XX @@ e1000e_core_pci_uninit(E1000ECore *core)
75
76
-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
77
+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg)
256
{
78
{
257
int i;
79
switch (reg) {
258
80
case 0 ... 31:
259
- timer_del(core->autoneg_timer);
81
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
260
timer_free(core->autoneg_timer);
261
262
e1000e_intrmgr_pci_unint(core);
263
diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
264
index XXXXXXX..XXXXXXX 100644
265
--- a/hw/net/pcnet-pci.c
266
+++ b/hw/net/pcnet-pci.c
267
@@ -XXX,XX +XXX,XX @@ static void pci_pcnet_uninit(PCIDevice *dev)
268
PCIPCNetState *d = PCI_PCNET(dev);
269
270
qemu_free_irq(d->state.irq);
271
- timer_del(d->state.poll_timer);
272
timer_free(d->state.poll_timer);
273
qemu_del_nic(d->state.nic);
274
}
275
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
276
index XXXXXXX..XXXXXXX 100644
277
--- a/hw/net/rtl8139.c
278
+++ b/hw/net/rtl8139.c
279
@@ -XXX,XX +XXX,XX @@ static void pci_rtl8139_uninit(PCIDevice *dev)
280
281
g_free(s->cplus_txbuffer);
282
s->cplus_txbuffer = NULL;
283
- timer_del(s->timer);
284
timer_free(s->timer);
285
qemu_del_nic(s->nic);
286
}
287
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
288
index XXXXXXX..XXXXXXX 100644
289
--- a/hw/net/spapr_llan.c
290
+++ b/hw/net/spapr_llan.c
291
@@ -XXX,XX +XXX,XX @@ static void spapr_vlan_instance_finalize(Object *obj)
292
}
293
294
if (dev->rxp_timer) {
295
- timer_del(dev->rxp_timer);
296
timer_free(dev->rxp_timer);
297
}
82
}
298
}
83
}
299
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
84
300
index XXXXXXX..XXXXXXX 100644
85
-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
301
--- a/hw/net/virtio-net.c
86
+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg)
302
+++ b/hw/net/virtio-net.c
303
@@ -XXX,XX +XXX,XX @@ static void virtio_net_rsc_cleanup(VirtIONet *n)
304
g_free(seg);
305
}
306
307
- timer_del(chain->drain_timer);
308
timer_free(chain->drain_timer);
309
QTAILQ_REMOVE(&n->rsc_chains, chain, next);
310
g_free(chain);
311
@@ -XXX,XX +XXX,XX @@ static void virtio_net_del_queue(VirtIONet *n, int index)
312
313
virtio_del_queue(vdev, index * 2);
314
if (q->tx_timer) {
315
- timer_del(q->tx_timer);
316
timer_free(q->tx_timer);
317
q->tx_timer = NULL;
318
} else {
319
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
320
index XXXXXXX..XXXXXXX 100644
321
--- a/hw/s390x/s390-pci-inst.c
322
+++ b/hw/s390x/s390-pci-inst.c
323
@@ -XXX,XX +XXX,XX @@ void pci_dereg_ioat(S390PCIIOMMU *iommu)
324
void fmb_timer_free(S390PCIBusDevice *pbdev)
325
{
87
{
326
if (pbdev->fmb_timer) {
88
ARMCPU *cpu = env_archcpu(env);
327
- timer_del(pbdev->fmb_timer);
89
328
timer_free(pbdev->fmb_timer);
90
@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
329
pbdev->fmb_timer = NULL;
91
return 0;
330
}
92
}
331
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
93
332
index XXXXXXX..XXXXXXX 100644
94
-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg)
333
--- a/hw/sd/sd.c
95
+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
334
+++ b/hw/sd/sd.c
335
@@ -XXX,XX +XXX,XX @@ static void sd_instance_finalize(Object *obj)
336
{
96
{
337
SDState *sd = SD_CARD(obj);
97
ARMCPU *cpu = env_archcpu(env);
338
98
339
- timer_del(sd->ocr_power_timer);
340
timer_free(sd->ocr_power_timer);
341
}
342
343
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
344
index XXXXXXX..XXXXXXX 100644
345
--- a/hw/sd/sdhci.c
346
+++ b/hw/sd/sdhci.c
347
@@ -XXX,XX +XXX,XX @@ void sdhci_initfn(SDHCIState *s)
348
349
void sdhci_uninitfn(SDHCIState *s)
350
{
351
- timer_del(s->insert_timer);
352
timer_free(s->insert_timer);
353
- timer_del(s->transfer_timer);
354
timer_free(s->transfer_timer);
355
356
g_free(s->fifo_buffer);
357
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
358
index XXXXXXX..XXXXXXX 100644
359
--- a/hw/usb/dev-hub.c
360
+++ b/hw/usb/dev-hub.c
361
@@ -XXX,XX +XXX,XX @@ static void usb_hub_unrealize(USBDevice *dev)
362
&s->ports[i].port);
363
}
364
365
- timer_del(s->port_timer);
366
timer_free(s->port_timer);
367
}
368
369
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
370
index XXXXXXX..XXXXXXX 100644
371
--- a/hw/usb/hcd-ehci.c
372
+++ b/hw/usb/hcd-ehci.c
373
@@ -XXX,XX +XXX,XX @@ void usb_ehci_unrealize(EHCIState *s, DeviceState *dev)
374
trace_usb_ehci_unrealize();
375
376
if (s->frame_timer) {
377
- timer_del(s->frame_timer);
378
timer_free(s->frame_timer);
379
s->frame_timer = NULL;
380
}
381
diff --git a/hw/usb/hcd-ohci-pci.c b/hw/usb/hcd-ohci-pci.c
382
index XXXXXXX..XXXXXXX 100644
383
--- a/hw/usb/hcd-ohci-pci.c
384
+++ b/hw/usb/hcd-ohci-pci.c
385
@@ -XXX,XX +XXX,XX @@ static void usb_ohci_exit(PCIDevice *dev)
386
usb_bus_release(&s->bus);
387
}
388
389
- timer_del(s->eof_timer);
390
timer_free(s->eof_timer);
391
}
392
393
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
394
index XXXXXXX..XXXXXXX 100644
395
--- a/hw/usb/hcd-uhci.c
396
+++ b/hw/usb/hcd-uhci.c
397
@@ -XXX,XX +XXX,XX @@ static void usb_uhci_exit(PCIDevice *dev)
398
trace_usb_uhci_exit();
399
400
if (s->frame_timer) {
401
- timer_del(s->frame_timer);
402
timer_free(s->frame_timer);
403
s->frame_timer = NULL;
404
}
405
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
406
index XXXXXXX..XXXXXXX 100644
407
--- a/hw/usb/hcd-xhci.c
408
+++ b/hw/usb/hcd-xhci.c
409
@@ -XXX,XX +XXX,XX @@ static void usb_xhci_unrealize(DeviceState *dev)
410
}
411
412
if (xhci->mfwrap_timer) {
413
- timer_del(xhci->mfwrap_timer);
414
timer_free(xhci->mfwrap_timer);
415
xhci->mfwrap_timer = NULL;
416
}
417
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
418
index XXXXXXX..XXXXXXX 100644
419
--- a/hw/usb/redirect.c
420
+++ b/hw/usb/redirect.c
421
@@ -XXX,XX +XXX,XX @@ static void usbredir_unrealize(USBDevice *udev)
422
qemu_bh_delete(dev->chardev_close_bh);
423
qemu_bh_delete(dev->device_reject_bh);
424
425
- timer_del(dev->attach_timer);
426
timer_free(dev->attach_timer);
427
428
usbredir_cleanup_device_queues(dev);
429
diff --git a/hw/vfio/display.c b/hw/vfio/display.c
430
index XXXXXXX..XXXXXXX 100644
431
--- a/hw/vfio/display.c
432
+++ b/hw/vfio/display.c
433
@@ -XXX,XX +XXX,XX @@ static void vfio_display_edid_exit(VFIODisplay *dpy)
434
435
g_free(dpy->edid_regs);
436
g_free(dpy->edid_blob);
437
- timer_del(dpy->edid_link_timer);
438
timer_free(dpy->edid_link_timer);
439
}
440
441
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
442
index XXXXXXX..XXXXXXX 100644
443
--- a/hw/virtio/vhost-vsock-common.c
444
+++ b/hw/virtio/vhost-vsock-common.c
445
@@ -XXX,XX +XXX,XX @@ static void vhost_vsock_common_post_load_timer_cleanup(VHostVSockCommon *vvc)
446
return;
447
}
448
449
- timer_del(vvc->post_load_timer);
450
timer_free(vvc->post_load_timer);
451
vvc->post_load_timer = NULL;
452
}
453
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
454
index XXXXXXX..XXXXXXX 100644
455
--- a/hw/virtio/virtio-balloon.c
456
+++ b/hw/virtio/virtio-balloon.c
457
@@ -XXX,XX +XXX,XX @@ static bool balloon_stats_enabled(const VirtIOBalloon *s)
458
static void balloon_stats_destroy_timer(VirtIOBalloon *s)
459
{
460
if (balloon_stats_enabled(s)) {
461
- timer_del(s->stats_timer);
462
timer_free(s->stats_timer);
463
s->stats_timer = NULL;
464
s->stats_poll_interval = 0;
465
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
466
index XXXXXXX..XXXXXXX 100644
467
--- a/hw/virtio/virtio-rng.c
468
+++ b/hw/virtio/virtio-rng.c
469
@@ -XXX,XX +XXX,XX @@ static void virtio_rng_device_unrealize(DeviceState *dev)
470
VirtIORNG *vrng = VIRTIO_RNG(dev);
471
472
qemu_del_vm_change_state_handler(vrng->vmstate);
473
- timer_del(vrng->rate_limit_timer);
474
timer_free(vrng->rate_limit_timer);
475
virtio_del_queue(vdev, 0);
476
virtio_cleanup(vdev);
477
diff --git a/hw/watchdog/wdt_diag288.c b/hw/watchdog/wdt_diag288.c
478
index XXXXXXX..XXXXXXX 100644
479
--- a/hw/watchdog/wdt_diag288.c
480
+++ b/hw/watchdog/wdt_diag288.c
481
@@ -XXX,XX +XXX,XX @@ static void wdt_diag288_unrealize(DeviceState *dev)
482
{
483
DIAG288State *diag288 = DIAG288(dev);
484
485
- timer_del(diag288->timer);
486
timer_free(diag288->timer);
487
}
488
489
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
490
index XXXXXXX..XXXXXXX 100644
491
--- a/hw/watchdog/wdt_i6300esb.c
492
+++ b/hw/watchdog/wdt_i6300esb.c
493
@@ -XXX,XX +XXX,XX @@ static void i6300esb_exit(PCIDevice *dev)
494
{
495
I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev);
496
497
- timer_del(d->timer);
498
timer_free(d->timer);
499
}
500
501
diff --git a/migration/colo.c b/migration/colo.c
502
index XXXXXXX..XXXXXXX 100644
503
--- a/migration/colo.c
504
+++ b/migration/colo.c
505
@@ -XXX,XX +XXX,XX @@ out:
506
* error.
507
*/
508
colo_compare_unregister_notifier(&packets_compare_notifier);
509
- timer_del(s->colo_delay_timer);
510
timer_free(s->colo_delay_timer);
511
qemu_event_destroy(&s->colo_checkpoint_event);
512
513
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
514
index XXXXXXX..XXXXXXX 100644
515
--- a/monitor/hmp-cmds.c
516
+++ b/monitor/hmp-cmds.c
517
@@ -XXX,XX +XXX,XX @@ static void hmp_migrate_status_cb(void *opaque)
518
error_report("%s", info->error_desc);
519
}
520
monitor_resume(status->mon);
521
- timer_del(status->timer);
522
timer_free(status->timer);
523
g_free(status);
524
}
525
diff --git a/net/announce.c b/net/announce.c
526
index XXXXXXX..XXXXXXX 100644
527
--- a/net/announce.c
528
+++ b/net/announce.c
529
@@ -XXX,XX +XXX,XX @@ void qemu_announce_timer_del(AnnounceTimer *timer, bool free_named)
530
{
531
bool free_timer = false;
532
if (timer->tm) {
533
- timer_del(timer->tm);
534
timer_free(timer->tm);
535
timer->tm = NULL;
536
}
537
diff --git a/net/colo-compare.c b/net/colo-compare.c
538
index XXXXXXX..XXXXXXX 100644
539
--- a/net/colo-compare.c
540
+++ b/net/colo-compare.c
541
@@ -XXX,XX +XXX,XX @@ static void colo_compare_timer_init(CompareState *s)
542
static void colo_compare_timer_del(CompareState *s)
543
{
544
if (s->packet_check_timer) {
545
- timer_del(s->packet_check_timer);
546
timer_free(s->packet_check_timer);
547
s->packet_check_timer = NULL;
548
}
549
diff --git a/net/slirp.c b/net/slirp.c
550
index XXXXXXX..XXXXXXX 100644
551
--- a/net/slirp.c
552
+++ b/net/slirp.c
553
@@ -XXX,XX +XXX,XX @@ static void *net_slirp_timer_new(SlirpTimerCb cb,
554
555
static void net_slirp_timer_free(void *timer, void *opaque)
556
{
557
- timer_del(timer);
558
timer_free(timer);
559
}
560
561
diff --git a/replay/replay-debugging.c b/replay/replay-debugging.c
562
index XXXXXXX..XXXXXXX 100644
563
--- a/replay/replay-debugging.c
564
+++ b/replay/replay-debugging.c
565
@@ -XXX,XX +XXX,XX @@ static void replay_delete_break(void)
566
assert(replay_mutex_locked());
567
568
if (replay_break_timer) {
569
- timer_del(replay_break_timer);
570
timer_free(replay_break_timer);
571
replay_break_timer = NULL;
572
}
573
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
574
index XXXXXXX..XXXXXXX 100644
575
--- a/target/s390x/cpu.c
576
+++ b/target/s390x/cpu.c
577
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_finalize(Object *obj)
578
#if !defined(CONFIG_USER_ONLY)
579
S390CPU *cpu = S390_CPU(obj);
580
581
- timer_del(cpu->env.tod_timer);
582
timer_free(cpu->env.tod_timer);
583
- timer_del(cpu->env.cpu_timer);
584
timer_free(cpu->env.cpu_timer);
585
586
qemu_unregister_reset(s390_cpu_machine_reset_cb, cpu);
587
diff --git a/ui/console.c b/ui/console.c
588
index XXXXXXX..XXXXXXX 100644
589
--- a/ui/console.c
590
+++ b/ui/console.c
591
@@ -XXX,XX +XXX,XX @@ static void gui_setup_refresh(DisplayState *ds)
592
timer_mod(ds->gui_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME));
593
}
594
if (!need_timer && ds->gui_timer != NULL) {
595
- timer_del(ds->gui_timer);
596
timer_free(ds->gui_timer);
597
ds->gui_timer = NULL;
598
}
599
diff --git a/ui/spice-core.c b/ui/spice-core.c
600
index XXXXXXX..XXXXXXX 100644
601
--- a/ui/spice-core.c
602
+++ b/ui/spice-core.c
603
@@ -XXX,XX +XXX,XX @@ static void timer_cancel(SpiceTimer *timer)
604
605
static void timer_remove(SpiceTimer *timer)
606
{
607
- timer_del(timer->timer);
608
timer_free(timer->timer);
609
g_free(timer);
610
}
611
diff --git a/util/throttle.c b/util/throttle.c
612
index XXXXXXX..XXXXXXX 100644
613
--- a/util/throttle.c
614
+++ b/util/throttle.c
615
@@ -XXX,XX +XXX,XX @@ static void throttle_timer_destroy(QEMUTimer **timer)
616
{
617
assert(*timer != NULL);
618
619
- timer_del(*timer);
620
timer_free(*timer);
621
*timer = NULL;
622
}
623
--
99
--
624
2.20.1
100
2.34.1
625
101
626
102
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
When running device-introspect-test, a memory leak occurred in the a10_pit_init
3
This function is not used outside gdbstub.c.
4
function, so use ptimer_free() in the finalize function to avoid it.
5
4
6
ASAN shows memory leak stack:
5
Reviewed-by: Fabiano Rosas <farosas@suse.de>
7
6
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
8
Indirect leak of 288 byte(s) in 6 object(s) allocated from:
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
8
Message-id: 20230227213329.793795-3-richard.henderson@linaro.org
10
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
11
#2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
12
#3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
13
#4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
14
#5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
15
#6 0xaaabf57415e8 in a10_pit_init /qemu/hw/timer/allwinner-a10-pit.c:278
16
#7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
17
#8 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
18
#9 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
19
#10 0xaaabf5b94680 in aw_a10_init /qemu/hw/arm/allwinner-a10.c:49
20
#11 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
21
#12 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
22
23
Reported-by: Euler Robot <euler.robot@huawei.com>
24
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
25
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
26
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
---
10
---
28
hw/timer/allwinner-a10-pit.c | 11 +++++++++++
11
target/arm/cpu.h | 1 -
29
1 file changed, 11 insertions(+)
12
target/arm/gdbstub.c | 2 +-
13
2 files changed, 1 insertion(+), 2 deletions(-)
30
14
31
diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
15
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
32
index XXXXXXX..XXXXXXX 100644
16
index XXXXXXX..XXXXXXX 100644
33
--- a/hw/timer/allwinner-a10-pit.c
17
--- a/target/arm/cpu.h
34
+++ b/hw/timer/allwinner-a10-pit.c
18
+++ b/target/arm/cpu.h
35
@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
19
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
20
* Helpers to dynamically generates XML descriptions of the sysregs
21
* and SVE registers. Returns the number of registers in each set.
22
*/
23
-int arm_gen_dynamic_sysreg_xml(CPUState *cpu, int base_reg);
24
int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
25
26
/* Returns the dynamically generated XML for the gdb stub.
27
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
28
index XXXXXXX..XXXXXXX 100644
29
--- a/target/arm/gdbstub.c
30
+++ b/target/arm/gdbstub.c
31
@@ -XXX,XX +XXX,XX @@ static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
36
}
32
}
37
}
33
}
38
34
39
+static void a10_pit_finalize(Object *obj)
35
-int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
40
+{
36
+static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
41
+ AwA10PITState *s = AW_A10_PIT(obj);
42
+ int i;
43
+
44
+ for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
45
+ ptimer_free(s->timer[i]);
46
+ }
47
+}
48
+
49
static void a10_pit_class_init(ObjectClass *klass, void *data)
50
{
37
{
51
DeviceClass *dc = DEVICE_CLASS(klass);
38
ARMCPU *cpu = ARM_CPU(cs);
52
@@ -XXX,XX +XXX,XX @@ static const TypeInfo a10_pit_info = {
39
GString *s = g_string_new(NULL);
53
.parent = TYPE_SYS_BUS_DEVICE,
54
.instance_size = sizeof(AwA10PITState),
55
.instance_init = a10_pit_init,
56
+ .instance_finalize = a10_pit_finalize,
57
.class_init = a10_pit_class_init,
58
};
59
60
--
40
--
61
2.20.1
41
2.34.1
62
42
63
43
diff view generated by jsdifflib
1
The CCR is a register most of whose bits are banked between security
1
From: Richard Henderson <richard.henderson@linaro.org>
2
states but where BFHFNMIGN is not, and we keep it in the non-secure
2
3
entry of the v7m.ccr[] array. The logic which tries to handle this
3
The function is only used for aarch64, so move it to the
4
bit fails to implement the "RAZ/WI from Nonsecure if AIRCR.BFHFNMINS
4
file that has the other aarch64 gdbstub stuff. Move the
5
is zero" requirement; correct the omission.
5
declaration to internals.h.
6
6
7
Reviewed-by: Fabiano Rosas <farosas@suse.de>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20230227213329.793795-4-richard.henderson@linaro.org
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20201210201433.26262-2-peter.maydell@linaro.org
10
---
12
---
11
hw/intc/armv7m_nvic.c | 15 +++++++++++++++
13
target/arm/cpu.h | 6 ---
12
1 file changed, 15 insertions(+)
14
target/arm/internals.h | 1 +
13
15
target/arm/gdbstub.c | 120 -----------------------------------------
14
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
16
target/arm/gdbstub64.c | 118 ++++++++++++++++++++++++++++++++++++++++
17
4 files changed, 119 insertions(+), 126 deletions(-)
18
19
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
15
index XXXXXXX..XXXXXXX 100644
20
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/intc/armv7m_nvic.c
21
--- a/target/arm/cpu.h
17
+++ b/hw/intc/armv7m_nvic.c
22
+++ b/target/arm/cpu.h
18
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
23
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
19
*/
24
int arm_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
20
val = cpu->env.v7m.ccr[attrs.secure];
25
int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
21
val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
26
22
+ /* BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0 */
27
-/*
23
+ if (!attrs.secure) {
28
- * Helpers to dynamically generates XML descriptions of the sysregs
24
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
29
- * and SVE registers. Returns the number of registers in each set.
25
+ val &= ~R_V7M_CCR_BFHFNMIGN_MASK;
30
- */
31
-int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
32
-
33
/* Returns the dynamically generated XML for the gdb stub.
34
* Returns a pointer to the XML contents for the specified XML file or NULL
35
* if the XML name doesn't match the predefined one.
36
diff --git a/target/arm/internals.h b/target/arm/internals.h
37
index XXXXXXX..XXXXXXX 100644
38
--- a/target/arm/internals.h
39
+++ b/target/arm/internals.h
40
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
41
}
42
43
#ifdef TARGET_AARCH64
44
+int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
45
int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
46
int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
47
int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
48
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
49
index XXXXXXX..XXXXXXX 100644
50
--- a/target/arm/gdbstub.c
51
+++ b/target/arm/gdbstub.c
52
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
53
return cpu->dyn_sysreg_xml.num;
54
}
55
56
-struct TypeSize {
57
- const char *gdb_type;
58
- int size;
59
- const char sz, suffix;
60
-};
61
-
62
-static const struct TypeSize vec_lanes[] = {
63
- /* quads */
64
- { "uint128", 128, 'q', 'u' },
65
- { "int128", 128, 'q', 's' },
66
- /* 64 bit */
67
- { "ieee_double", 64, 'd', 'f' },
68
- { "uint64", 64, 'd', 'u' },
69
- { "int64", 64, 'd', 's' },
70
- /* 32 bit */
71
- { "ieee_single", 32, 's', 'f' },
72
- { "uint32", 32, 's', 'u' },
73
- { "int32", 32, 's', 's' },
74
- /* 16 bit */
75
- { "ieee_half", 16, 'h', 'f' },
76
- { "uint16", 16, 'h', 'u' },
77
- { "int16", 16, 'h', 's' },
78
- /* bytes */
79
- { "uint8", 8, 'b', 'u' },
80
- { "int8", 8, 'b', 's' },
81
-};
82
-
83
-
84
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
85
-{
86
- ARMCPU *cpu = ARM_CPU(cs);
87
- GString *s = g_string_new(NULL);
88
- DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
89
- g_autoptr(GString) ts = g_string_new("");
90
- int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
91
- info->num = 0;
92
- g_string_printf(s, "<?xml version=\"1.0\"?>");
93
- g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
94
- g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
95
-
96
- /* First define types and totals in a whole VL */
97
- for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
98
- int count = reg_width / vec_lanes[i].size;
99
- g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
100
- g_string_append_printf(s,
101
- "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
102
- ts->str, vec_lanes[i].gdb_type, count);
103
- }
104
- /*
105
- * Now define a union for each size group containing unsigned and
106
- * signed and potentially float versions of each size from 128 to
107
- * 8 bits.
108
- */
109
- for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
110
- const char suf[] = { 'q', 'd', 's', 'h', 'b' };
111
- g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
112
- for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
113
- if (vec_lanes[j].size == bits) {
114
- g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
115
- vec_lanes[j].suffix,
116
- vec_lanes[j].sz, vec_lanes[j].suffix);
117
- }
118
- }
119
- g_string_append(s, "</union>");
120
- }
121
- /* And now the final union of unions */
122
- g_string_append(s, "<union id=\"svev\">");
123
- for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
124
- const char suf[] = { 'q', 'd', 's', 'h', 'b' };
125
- g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
126
- suf[i], suf[i]);
127
- }
128
- g_string_append(s, "</union>");
129
-
130
- /* Finally the sve prefix type */
131
- g_string_append_printf(s,
132
- "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
133
- reg_width / 8);
134
-
135
- /* Then define each register in parts for each vq */
136
- for (i = 0; i < 32; i++) {
137
- g_string_append_printf(s,
138
- "<reg name=\"z%d\" bitsize=\"%d\""
139
- " regnum=\"%d\" type=\"svev\"/>",
140
- i, reg_width, base_reg++);
141
- info->num++;
142
- }
143
- /* fpscr & status registers */
144
- g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
145
- " regnum=\"%d\" group=\"float\""
146
- " type=\"int\"/>", base_reg++);
147
- g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
148
- " regnum=\"%d\" group=\"float\""
149
- " type=\"int\"/>", base_reg++);
150
- info->num += 2;
151
-
152
- for (i = 0; i < 16; i++) {
153
- g_string_append_printf(s,
154
- "<reg name=\"p%d\" bitsize=\"%d\""
155
- " regnum=\"%d\" type=\"svep\"/>",
156
- i, cpu->sve_max_vq * 16, base_reg++);
157
- info->num++;
158
- }
159
- g_string_append_printf(s,
160
- "<reg name=\"ffr\" bitsize=\"%d\""
161
- " regnum=\"%d\" group=\"vector\""
162
- " type=\"svep\"/>",
163
- cpu->sve_max_vq * 16, base_reg++);
164
- g_string_append_printf(s,
165
- "<reg name=\"vg\" bitsize=\"64\""
166
- " regnum=\"%d\" type=\"int\"/>",
167
- base_reg++);
168
- info->num += 2;
169
- g_string_append_printf(s, "</feature>");
170
- cpu->dyn_svereg_xml.desc = g_string_free(s, false);
171
-
172
- return cpu->dyn_svereg_xml.num;
173
-}
174
-
175
-
176
const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
177
{
178
ARMCPU *cpu = ARM_CPU(cs);
179
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
180
index XXXXXXX..XXXXXXX 100644
181
--- a/target/arm/gdbstub64.c
182
+++ b/target/arm/gdbstub64.c
183
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
184
185
return 0;
186
}
187
+
188
+struct TypeSize {
189
+ const char *gdb_type;
190
+ short size;
191
+ char sz, suffix;
192
+};
193
+
194
+static const struct TypeSize vec_lanes[] = {
195
+ /* quads */
196
+ { "uint128", 128, 'q', 'u' },
197
+ { "int128", 128, 'q', 's' },
198
+ /* 64 bit */
199
+ { "ieee_double", 64, 'd', 'f' },
200
+ { "uint64", 64, 'd', 'u' },
201
+ { "int64", 64, 'd', 's' },
202
+ /* 32 bit */
203
+ { "ieee_single", 32, 's', 'f' },
204
+ { "uint32", 32, 's', 'u' },
205
+ { "int32", 32, 's', 's' },
206
+ /* 16 bit */
207
+ { "ieee_half", 16, 'h', 'f' },
208
+ { "uint16", 16, 'h', 'u' },
209
+ { "int16", 16, 'h', 's' },
210
+ /* bytes */
211
+ { "uint8", 8, 'b', 'u' },
212
+ { "int8", 8, 'b', 's' },
213
+};
214
+
215
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
216
+{
217
+ ARMCPU *cpu = ARM_CPU(cs);
218
+ GString *s = g_string_new(NULL);
219
+ DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
220
+ g_autoptr(GString) ts = g_string_new("");
221
+ int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
222
+ info->num = 0;
223
+ g_string_printf(s, "<?xml version=\"1.0\"?>");
224
+ g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
225
+ g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
226
+
227
+ /* First define types and totals in a whole VL */
228
+ for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
229
+ int count = reg_width / vec_lanes[i].size;
230
+ g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
231
+ g_string_append_printf(s,
232
+ "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
233
+ ts->str, vec_lanes[i].gdb_type, count);
234
+ }
235
+ /*
236
+ * Now define a union for each size group containing unsigned and
237
+ * signed and potentially float versions of each size from 128 to
238
+ * 8 bits.
239
+ */
240
+ for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
241
+ const char suf[] = { 'q', 'd', 's', 'h', 'b' };
242
+ g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
243
+ for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
244
+ if (vec_lanes[j].size == bits) {
245
+ g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
246
+ vec_lanes[j].suffix,
247
+ vec_lanes[j].sz, vec_lanes[j].suffix);
26
+ }
248
+ }
27
+ }
249
+ }
28
return val;
250
+ g_string_append(s, "</union>");
29
case 0xd24: /* System Handler Control and State (SHCSR) */
251
+ }
30
if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
252
+ /* And now the final union of unions */
31
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
253
+ g_string_append(s, "<union id=\"svev\">");
32
(cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)
254
+ for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
33
| (value & R_V7M_CCR_BFHFNMIGN_MASK);
255
+ const char suf[] = { 'q', 'd', 's', 'h', 'b' };
34
value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
256
+ g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
35
+ } else {
257
+ suf[i], suf[i]);
36
+ /*
258
+ }
37
+ * BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0, so
259
+ g_string_append(s, "</union>");
38
+ * preserve the state currently in the NS element of the array
260
+
39
+ */
261
+ /* Finally the sve prefix type */
40
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
262
+ g_string_append_printf(s,
41
+ value &= ~R_V7M_CCR_BFHFNMIGN_MASK;
263
+ "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
42
+ value |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
264
+ reg_width / 8);
43
+ }
265
+
44
}
266
+ /* Then define each register in parts for each vq */
45
267
+ for (i = 0; i < 32; i++) {
46
cpu->env.v7m.ccr[attrs.secure] = value;
268
+ g_string_append_printf(s,
269
+ "<reg name=\"z%d\" bitsize=\"%d\""
270
+ " regnum=\"%d\" type=\"svev\"/>",
271
+ i, reg_width, base_reg++);
272
+ info->num++;
273
+ }
274
+ /* fpscr & status registers */
275
+ g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
276
+ " regnum=\"%d\" group=\"float\""
277
+ " type=\"int\"/>", base_reg++);
278
+ g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
279
+ " regnum=\"%d\" group=\"float\""
280
+ " type=\"int\"/>", base_reg++);
281
+ info->num += 2;
282
+
283
+ for (i = 0; i < 16; i++) {
284
+ g_string_append_printf(s,
285
+ "<reg name=\"p%d\" bitsize=\"%d\""
286
+ " regnum=\"%d\" type=\"svep\"/>",
287
+ i, cpu->sve_max_vq * 16, base_reg++);
288
+ info->num++;
289
+ }
290
+ g_string_append_printf(s,
291
+ "<reg name=\"ffr\" bitsize=\"%d\""
292
+ " regnum=\"%d\" group=\"vector\""
293
+ " type=\"svep\"/>",
294
+ cpu->sve_max_vq * 16, base_reg++);
295
+ g_string_append_printf(s,
296
+ "<reg name=\"vg\" bitsize=\"64\""
297
+ " regnum=\"%d\" type=\"int\"/>",
298
+ base_reg++);
299
+ info->num += 2;
300
+ g_string_append_printf(s, "</feature>");
301
+ info->desc = g_string_free(s, false);
302
+
303
+ return info->num;
304
+}
47
--
305
--
48
2.20.1
306
2.34.1
49
307
50
308
diff view generated by jsdifflib
1
Now that we have implemented all the features needed by the v8.1M
1
From: Richard Henderson <richard.henderson@linaro.org>
2
architecture, we can add the model of the Cortex-M55. This is the
3
configuration without MVE support; we'll add MVE later.
4
2
3
Create a subroutine for creating the union of unions
4
of the various type sizes that a vector may contain.
5
6
Reviewed-by: Fabiano Rosas <farosas@suse.de>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20230227213329.793795-5-richard.henderson@linaro.org
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20201210201433.26262-5-peter.maydell@linaro.org
8
---
11
---
9
target/arm/cpu_tcg.c | 42 ++++++++++++++++++++++++++++++++++++++++++
12
target/arm/gdbstub64.c | 83 +++++++++++++++++++++++-------------------
10
1 file changed, 42 insertions(+)
13
1 file changed, 45 insertions(+), 38 deletions(-)
11
14
12
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
15
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
13
index XXXXXXX..XXXXXXX 100644
16
index XXXXXXX..XXXXXXX 100644
14
--- a/target/arm/cpu_tcg.c
17
--- a/target/arm/gdbstub64.c
15
+++ b/target/arm/cpu_tcg.c
18
+++ b/target/arm/gdbstub64.c
16
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
19
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
17
cpu->ctr = 0x8000c000;
20
return 0;
18
}
21
}
19
22
20
+static void cortex_m55_initfn(Object *obj)
23
-struct TypeSize {
21
+{
24
- const char *gdb_type;
22
+ ARMCPU *cpu = ARM_CPU(obj);
25
- short size;
26
- char sz, suffix;
27
-};
28
-
29
-static const struct TypeSize vec_lanes[] = {
30
- /* quads */
31
- { "uint128", 128, 'q', 'u' },
32
- { "int128", 128, 'q', 's' },
33
- /* 64 bit */
34
- { "ieee_double", 64, 'd', 'f' },
35
- { "uint64", 64, 'd', 'u' },
36
- { "int64", 64, 'd', 's' },
37
- /* 32 bit */
38
- { "ieee_single", 32, 's', 'f' },
39
- { "uint32", 32, 's', 'u' },
40
- { "int32", 32, 's', 's' },
41
- /* 16 bit */
42
- { "ieee_half", 16, 'h', 'f' },
43
- { "uint16", 16, 'h', 'u' },
44
- { "int16", 16, 'h', 's' },
45
- /* bytes */
46
- { "uint8", 8, 'b', 'u' },
47
- { "int8", 8, 'b', 's' },
48
-};
49
-
50
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
51
+static void output_vector_union_type(GString *s, int reg_width)
52
{
53
- ARMCPU *cpu = ARM_CPU(cs);
54
- GString *s = g_string_new(NULL);
55
- DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
56
+ struct TypeSize {
57
+ const char *gdb_type;
58
+ short size;
59
+ char sz, suffix;
60
+ };
23
+
61
+
24
+ set_feature(&cpu->env, ARM_FEATURE_V8);
62
+ static const struct TypeSize vec_lanes[] = {
25
+ set_feature(&cpu->env, ARM_FEATURE_V8_1M);
63
+ /* quads */
26
+ set_feature(&cpu->env, ARM_FEATURE_M);
64
+ { "uint128", 128, 'q', 'u' },
27
+ set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
65
+ { "int128", 128, 'q', 's' },
28
+ set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
66
+ /* 64 bit */
29
+ set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
67
+ { "ieee_double", 64, 'd', 'f' },
30
+ cpu->midr = 0x410fd221; /* r0p1 */
68
+ { "uint64", 64, 'd', 'u' },
31
+ cpu->revidr = 0;
69
+ { "int64", 64, 'd', 's' },
32
+ cpu->pmsav7_dregion = 16;
70
+ /* 32 bit */
33
+ cpu->sau_sregion = 8;
71
+ { "ieee_single", 32, 's', 'f' },
34
+ /*
72
+ { "uint32", 32, 's', 'u' },
35
+ * These are the MVFR* values for the FPU, no MVE configuration;
73
+ { "int32", 32, 's', 's' },
36
+ * we will update them later when we implement MVE
74
+ /* 16 bit */
37
+ */
75
+ { "ieee_half", 16, 'h', 'f' },
38
+ cpu->isar.mvfr0 = 0x10110221;
76
+ { "uint16", 16, 'h', 'u' },
39
+ cpu->isar.mvfr1 = 0x12100011;
77
+ { "int16", 16, 'h', 's' },
40
+ cpu->isar.mvfr2 = 0x00000040;
78
+ /* bytes */
41
+ cpu->isar.id_pfr0 = 0x20000030;
79
+ { "uint8", 8, 'b', 'u' },
42
+ cpu->isar.id_pfr1 = 0x00000230;
80
+ { "int8", 8, 'b', 's' },
43
+ cpu->isar.id_dfr0 = 0x10200000;
81
+ };
44
+ cpu->id_afr0 = 0x00000000;
82
+
45
+ cpu->isar.id_mmfr0 = 0x00111040;
83
+ static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
46
+ cpu->isar.id_mmfr1 = 0x00000000;
84
+
47
+ cpu->isar.id_mmfr2 = 0x01000000;
85
g_autoptr(GString) ts = g_string_new("");
48
+ cpu->isar.id_mmfr3 = 0x00000011;
86
- int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
49
+ cpu->isar.id_isar0 = 0x01103110;
87
- info->num = 0;
50
+ cpu->isar.id_isar1 = 0x02212000;
88
- g_string_printf(s, "<?xml version=\"1.0\"?>");
51
+ cpu->isar.id_isar2 = 0x20232232;
89
- g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
52
+ cpu->isar.id_isar3 = 0x01111131;
90
- g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
53
+ cpu->isar.id_isar4 = 0x01310132;
91
+ int i, j, bits;
54
+ cpu->isar.id_isar5 = 0x00000000;
92
55
+ cpu->isar.id_isar6 = 0x00000000;
93
/* First define types and totals in a whole VL */
56
+ cpu->clidr = 0x00000000; /* caches not implemented */
94
for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
57
+ cpu->ctr = 0x8303c003;
95
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
96
* 8 bits.
97
*/
98
for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
99
- const char suf[] = { 'q', 'd', 's', 'h', 'b' };
100
g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
101
for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
102
if (vec_lanes[j].size == bits) {
103
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
104
/* And now the final union of unions */
105
g_string_append(s, "<union id=\"svev\">");
106
for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
107
- const char suf[] = { 'q', 'd', 's', 'h', 'b' };
108
g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
109
suf[i], suf[i]);
110
}
111
g_string_append(s, "</union>");
58
+}
112
+}
59
+
113
+
60
static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
114
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
61
/* Dummy the TCM region regs for the moment */
115
+{
62
{ .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
116
+ ARMCPU *cpu = ARM_CPU(cs);
63
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
117
+ GString *s = g_string_new(NULL);
64
.class_init = arm_v7m_class_init },
118
+ DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
65
{ .name = "cortex-m33", .initfn = cortex_m33_initfn,
119
+ int i, reg_width = (cpu->sve_max_vq * 128);
66
.class_init = arm_v7m_class_init },
120
+ info->num = 0;
67
+ { .name = "cortex-m55", .initfn = cortex_m55_initfn,
121
+ g_string_printf(s, "<?xml version=\"1.0\"?>");
68
+ .class_init = arm_v7m_class_init },
122
+ g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
69
{ .name = "cortex-r5", .initfn = cortex_r5_initfn },
123
+ g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
70
{ .name = "cortex-r5f", .initfn = cortex_r5f_initfn },
124
+
71
{ .name = "ti925t", .initfn = ti925t_initfn },
125
+ output_vector_union_type(s, reg_width);
126
127
/* Finally the sve prefix type */
128
g_string_append_printf(s,
72
--
129
--
73
2.20.1
130
2.34.1
74
75
diff view generated by jsdifflib
1
Support for running KVM on 32-bit Arm hosts was removed in commit
1
From: Richard Henderson <richard.henderson@linaro.org>
2
82bf7ae84ce739e. You can still run a 32-bit guest on a 64-bit Arm
3
host CPU, but because Arm KVM requires the host and guest CPU types
4
to match, it is not possible to run a guest that requires a Cortex-A9
5
or Cortex-A15 CPU there. That means that the code in the
6
highbank/midway board models to support KVM is no longer used, and we
7
can delete it.
8
2
3
Rather than increment base_reg and num, compute num from the change
4
to base_reg at the end. Clean up some nearby comments.
5
6
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20230227213329.793795-6-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
12
Message-id: 20201215144215.28482-1-peter.maydell@linaro.org
13
---
10
---
14
hw/arm/highbank.c | 14 ++++----------
11
target/arm/gdbstub64.c | 27 ++++++++++++++++-----------
15
1 file changed, 4 insertions(+), 10 deletions(-)
12
1 file changed, 16 insertions(+), 11 deletions(-)
16
13
17
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
14
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
18
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
19
--- a/hw/arm/highbank.c
16
--- a/target/arm/gdbstub64.c
20
+++ b/hw/arm/highbank.c
17
+++ b/target/arm/gdbstub64.c
21
@@ -XXX,XX +XXX,XX @@
18
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
22
#include "hw/arm/boot.h"
19
g_string_append(s, "</union>");
23
#include "hw/loader.h"
20
}
24
#include "net/net.h"
21
25
-#include "sysemu/kvm.h"
22
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
26
#include "sysemu/runstate.h"
23
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
27
#include "sysemu/sysemu.h"
24
{
28
#include "hw/boards.h"
25
ARMCPU *cpu = ARM_CPU(cs);
29
@@ -XXX,XX +XXX,XX @@
26
GString *s = g_string_new(NULL);
30
#include "hw/cpu/a15mpcore.h"
27
DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
31
#include "qemu/log.h"
28
- int i, reg_width = (cpu->sve_max_vq * 128);
32
#include "qom/object.h"
29
- info->num = 0;
33
+#include "cpu.h"
30
+ int reg_width = cpu->sve_max_vq * 128;
34
31
+ int base_reg = orig_base_reg;
35
#define SMP_BOOT_ADDR 0x100
32
+ int i;
36
#define SMP_BOOT_REG 0x40
33
+
37
@@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id)
34
g_string_printf(s, "<?xml version=\"1.0\"?>");
38
highbank_binfo.loader_start = 0;
35
g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
39
highbank_binfo.write_secondary_boot = hb_write_secondary;
36
g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
40
highbank_binfo.secondary_cpu_reset_hook = hb_reset_secondary;
37
41
- if (!kvm_enabled()) {
38
+ /* Create the vector union type. */
42
- highbank_binfo.board_setup_addr = BOARD_SETUP_ADDR;
39
output_vector_union_type(s, reg_width);
43
- highbank_binfo.write_board_setup = hb_write_board_setup;
40
44
- highbank_binfo.secure_board_setup = true;
41
- /* Finally the sve prefix type */
45
- } else {
42
+ /* Create the predicate vector type. */
46
- warn_report("cannot load built-in Monitor support "
43
g_string_append_printf(s,
47
- "if KVM is enabled. Some guests (such as Linux) "
44
"<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
48
- "may not boot.");
45
reg_width / 8);
49
- }
46
50
+ highbank_binfo.board_setup_addr = BOARD_SETUP_ADDR;
47
- /* Then define each register in parts for each vq */
51
+ highbank_binfo.write_board_setup = hb_write_board_setup;
48
+ /* Define the vector registers. */
52
+ highbank_binfo.secure_board_setup = true;
49
for (i = 0; i < 32; i++) {
53
50
g_string_append_printf(s,
54
arm_load_kernel(ARM_CPU(first_cpu), machine, &highbank_binfo);
51
"<reg name=\"z%d\" bitsize=\"%d\""
52
" regnum=\"%d\" type=\"svev\"/>",
53
i, reg_width, base_reg++);
54
- info->num++;
55
}
56
+
57
/* fpscr & status registers */
58
g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
59
" regnum=\"%d\" group=\"float\""
60
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
61
g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
62
" regnum=\"%d\" group=\"float\""
63
" type=\"int\"/>", base_reg++);
64
- info->num += 2;
65
66
+ /* Define the predicate registers. */
67
for (i = 0; i < 16; i++) {
68
g_string_append_printf(s,
69
"<reg name=\"p%d\" bitsize=\"%d\""
70
" regnum=\"%d\" type=\"svep\"/>",
71
i, cpu->sve_max_vq * 16, base_reg++);
72
- info->num++;
73
}
74
g_string_append_printf(s,
75
"<reg name=\"ffr\" bitsize=\"%d\""
76
" regnum=\"%d\" group=\"vector\""
77
" type=\"svep\"/>",
78
cpu->sve_max_vq * 16, base_reg++);
79
+
80
+ /* Define the vector length pseudo-register. */
81
g_string_append_printf(s,
82
"<reg name=\"vg\" bitsize=\"64\""
83
" regnum=\"%d\" type=\"int\"/>",
84
base_reg++);
85
- info->num += 2;
86
- g_string_append_printf(s, "</feature>");
87
- info->desc = g_string_free(s, false);
88
89
+ g_string_append_printf(s, "</feature>");
90
+
91
+ info->desc = g_string_free(s, false);
92
+ info->num = base_reg - orig_base_reg;
93
return info->num;
55
}
94
}
56
--
95
--
57
2.20.1
96
2.34.1
58
97
59
98
diff view generated by jsdifflib
1
From: Bin Meng <bin.meng@windriver.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
This adds the target guide for SABRE Lite board, and documents how
3
Reviewed-by: Fabiano Rosas <farosas@suse.de>
4
to boot a Linux kernel and U-Boot bootloader.
4
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
5
5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
Signed-off-by: Bin Meng <bin.meng@windriver.com>
6
Message-id: 20230227213329.793795-7-richard.henderson@linaro.org
7
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
8
Message-id: 20210106063504.10841-5-bmeng.cn@gmail.com
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
8
---
11
docs/system/arm/sabrelite.rst | 119 ++++++++++++++++++++++++++++++++++
9
target/arm/gdbstub64.c | 5 +++--
12
docs/system/target-arm.rst | 1 +
10
1 file changed, 3 insertions(+), 2 deletions(-)
13
2 files changed, 120 insertions(+)
14
create mode 100644 docs/system/arm/sabrelite.rst
15
11
16
diff --git a/docs/system/arm/sabrelite.rst b/docs/system/arm/sabrelite.rst
12
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
17
new file mode 100644
18
index XXXXXXX..XXXXXXX
19
--- /dev/null
20
+++ b/docs/system/arm/sabrelite.rst
21
@@ -XXX,XX +XXX,XX @@
22
+Boundary Devices SABRE Lite (``sabrelite``)
23
+===========================================
24
+
25
+Boundary Devices SABRE Lite i.MX6 Development Board is a low-cost development
26
+platform featuring the powerful Freescale / NXP Semiconductor's i.MX 6 Quad
27
+Applications Processor.
28
+
29
+Supported devices
30
+-----------------
31
+
32
+The SABRE Lite machine supports the following devices:
33
+
34
+ * Up to 4 Cortex A9 cores
35
+ * Generic Interrupt Controller
36
+ * 1 Clock Controller Module
37
+ * 1 System Reset Controller
38
+ * 5 UARTs
39
+ * 2 EPIC timers
40
+ * 1 GPT timer
41
+ * 2 Watchdog timers
42
+ * 1 FEC Ethernet controller
43
+ * 3 I2C controllers
44
+ * 7 GPIO controllers
45
+ * 4 SDHC storage controllers
46
+ * 4 USB 2.0 host controllers
47
+ * 5 ECSPI controllers
48
+ * 1 SST 25VF016B flash
49
+
50
+Please note above list is a complete superset the QEMU SABRE Lite machine can
51
+support. For a normal use case, a device tree blob that represents a real world
52
+SABRE Lite board, only exposes a subset of devices to the guest software.
53
+
54
+Boot options
55
+------------
56
+
57
+The SABRE Lite machine can start using the standard -kernel functionality
58
+for loading a Linux kernel, U-Boot bootloader or ELF executable.
59
+
60
+Running Linux kernel
61
+--------------------
62
+
63
+Linux mainline v5.10 release is tested at the time of writing. To build a Linux
64
+mainline kernel that can be booted by the SABRE Lite machine, simply configure
65
+the kernel using the imx_v6_v7_defconfig configuration:
66
+
67
+.. code-block:: bash
68
+
69
+ $ export ARCH=arm
70
+ $ export CROSS_COMPILE=arm-linux-gnueabihf-
71
+ $ make imx_v6_v7_defconfig
72
+ $ make
73
+
74
+To boot the newly built Linux kernel in QEMU with the SABRE Lite machine, use:
75
+
76
+.. code-block:: bash
77
+
78
+ $ qemu-system-arm -M sabrelite -smp 4 -m 1G \
79
+ -display none -serial null -serial stdio \
80
+ -kernel arch/arm/boot/zImage \
81
+ -dtb arch/arm/boot/dts/imx6q-sabrelite.dtb \
82
+ -initrd /path/to/rootfs.ext4 \
83
+ -append "root=/dev/ram"
84
+
85
+Running U-Boot
86
+--------------
87
+
88
+U-Boot mainline v2020.10 release is tested at the time of writing. To build a
89
+U-Boot mainline bootloader that can be booted by the SABRE Lite machine, use
90
+the mx6qsabrelite_defconfig with similar commands as described above for Linux:
91
+
92
+.. code-block:: bash
93
+
94
+ $ export CROSS_COMPILE=arm-linux-gnueabihf-
95
+ $ make mx6qsabrelite_defconfig
96
+
97
+Note we need to adjust settings by:
98
+
99
+.. code-block:: bash
100
+
101
+ $ make menuconfig
102
+
103
+then manually select the following configuration in U-Boot:
104
+
105
+ Device Tree Control > Provider of DTB for DT Control > Embedded DTB
106
+
107
+To start U-Boot using the SABRE Lite machine, provide the u-boot binary to
108
+the -kernel argument, along with an SD card image with rootfs:
109
+
110
+.. code-block:: bash
111
+
112
+ $ qemu-system-arm -M sabrelite -smp 4 -m 1G \
113
+ -display none -serial null -serial stdio \
114
+ -kernel u-boot
115
+
116
+The following example shows booting Linux kernel from dhcp, and uses the
117
+rootfs on an SD card. This requires some additional command line parameters
118
+for QEMU:
119
+
120
+.. code-block:: none
121
+
122
+ -nic user,tftp=/path/to/kernel/zImage \
123
+ -drive file=sdcard.img,id=rootfs -device sd-card,drive=rootfs
124
+
125
+The directory for the built-in TFTP server should also contain the device tree
126
+blob of the SABRE Lite board. The sample SD card image was populated with the
127
+root file system with one single partition. You may adjust the kernel "root="
128
+boot parameter accordingly.
129
+
130
+After U-Boot boots, type the following commands in the U-Boot command shell to
131
+boot the Linux kernel:
132
+
133
+.. code-block:: none
134
+
135
+ => setenv ethaddr 00:11:22:33:44:55
136
+ => setenv bootfile zImage
137
+ => dhcp
138
+ => tftpboot 14000000 imx6q-sabrelite.dtb
139
+ => setenv bootargs root=/dev/mmcblk3p1
140
+ => bootz 12000000 - 14000000
141
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
142
index XXXXXXX..XXXXXXX 100644
13
index XXXXXXX..XXXXXXX 100644
143
--- a/docs/system/target-arm.rst
14
--- a/target/arm/gdbstub64.c
144
+++ b/docs/system/target-arm.rst
15
+++ b/target/arm/gdbstub64.c
145
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
16
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
146
arm/versatile
17
GString *s = g_string_new(NULL);
147
arm/vexpress
18
DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
148
arm/aspeed
19
int reg_width = cpu->sve_max_vq * 128;
149
+ arm/sabrelite
20
+ int pred_width = cpu->sve_max_vq * 16;
150
arm/digic
21
int base_reg = orig_base_reg;
151
arm/musicpal
22
int i;
152
arm/gumstix
23
24
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
25
g_string_append_printf(s,
26
"<reg name=\"p%d\" bitsize=\"%d\""
27
" regnum=\"%d\" type=\"svep\"/>",
28
- i, cpu->sve_max_vq * 16, base_reg++);
29
+ i, pred_width, base_reg++);
30
}
31
g_string_append_printf(s,
32
"<reg name=\"ffr\" bitsize=\"%d\""
33
" regnum=\"%d\" group=\"vector\""
34
" type=\"svep\"/>",
35
- cpu->sve_max_vq * 16, base_reg++);
36
+ pred_width, base_reg++);
37
38
/* Define the vector length pseudo-register. */
39
g_string_append_printf(s,
153
--
40
--
154
2.20.1
41
2.34.1
155
42
156
43
diff view generated by jsdifflib
1
From: Bin Meng <bin.meng@windriver.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
Currently when U-Boot boots, it prints "??" for i.MX processor:
3
Define svep based on the size of the predicates,
4
not the primary vector registers.
4
5
5
CPU: Freescale i.MX?? rev1.0 at 792 MHz
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
6
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
The register that was used to determine the silicon type is
8
Message-id: 20230227213329.793795-8-richard.henderson@linaro.org
8
undocumented in the latest IMX6DQRM (Rev. 6, 05/2020), but we
9
can refer to get_cpu_rev() in arch/arm/mach-imx/mx6/soc.c in
10
the U-Boot source codes that USB_ANALOG_DIGPROG is used.
11
12
Update its reset value to indicate i.MX6Q.
13
14
Signed-off-by: Bin Meng <bin.meng@windriver.com>
15
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
16
Message-id: 20210106063504.10841-3-bmeng.cn@gmail.com
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
---
10
---
19
hw/misc/imx6_ccm.c | 2 +-
11
target/arm/gdbstub64.c | 2 +-
20
1 file changed, 1 insertion(+), 1 deletion(-)
12
1 file changed, 1 insertion(+), 1 deletion(-)
21
13
22
diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
14
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
23
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
24
--- a/hw/misc/imx6_ccm.c
16
--- a/target/arm/gdbstub64.c
25
+++ b/hw/misc/imx6_ccm.c
17
+++ b/target/arm/gdbstub64.c
26
@@ -XXX,XX +XXX,XX @@ static void imx6_ccm_reset(DeviceState *dev)
18
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
27
s->analog[USB_ANALOG_USB2_VBUS_DETECT] = 0x00000004;
19
/* Create the predicate vector type. */
28
s->analog[USB_ANALOG_USB2_CHRG_DETECT] = 0x00000000;
20
g_string_append_printf(s,
29
s->analog[USB_ANALOG_USB2_MISC] = 0x00000002;
21
"<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
30
- s->analog[USB_ANALOG_DIGPROG] = 0x00000000;
22
- reg_width / 8);
31
+ s->analog[USB_ANALOG_DIGPROG] = 0x00630000;
23
+ pred_width / 8);
32
24
33
/* all PLLs need to be locked */
25
/* Define the vector registers. */
34
s->analog[CCM_ANALOG_PLL_ARM] |= CCM_ANALOG_PLL_LOCK;
26
for (i = 0; i < 32; i++) {
35
--
27
--
36
2.20.1
28
2.34.1
37
38
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
When running device-introspect-test, a memory leak occurred in the
3
This will make the function usable between SVE and SME.
4
exynos4210_mct_init function, so use ptimer_free() in the finalize function to
5
avoid it.
6
4
7
ASAN shows memory leak stack:
8
9
Indirect leak of 96 byte(s) in 1 object(s) allocated from:
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf56b01a0 in exynos4210_mct_init /qemu/hw/timer/exynos4210_mct.c:1505
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
16
#6 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
17
#7 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
18
#8 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
19
#9 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
20
#10 0xaaabf6552708 in aio_bh_poll /qemu/util/async.c:164
21
#11 0xaaabf655f19c in aio_dispatch /qemu/util/aio-posix.c:381
22
#12 0xaaabf65523f4 in aio_ctx_dispatch /qemu/util/async.c:306
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
5
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20230227213329.793795-9-richard.henderson@linaro.org
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
10
---
29
hw/timer/exynos4210_mct.c | 14 ++++++++++++++
11
target/arm/gdbstub64.c | 28 ++++++++++++++--------------
30
1 file changed, 14 insertions(+)
12
1 file changed, 14 insertions(+), 14 deletions(-)
31
13
32
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
14
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
33
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
34
--- a/hw/timer/exynos4210_mct.c
16
--- a/target/arm/gdbstub64.c
35
+++ b/hw/timer/exynos4210_mct.c
17
+++ b/target/arm/gdbstub64.c
36
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
18
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
37
sysbus_init_mmio(dev, &s->iomem);
19
return 0;
38
}
20
}
39
21
40
+static void exynos4210_mct_finalize(Object *obj)
22
-static void output_vector_union_type(GString *s, int reg_width)
41
+{
23
+static void output_vector_union_type(GString *s, int reg_width,
42
+ int i;
24
+ const char *name)
43
+ Exynos4210MCTState *s = EXYNOS4210_MCT(obj);
25
{
26
struct TypeSize {
27
const char *gdb_type;
28
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
29
};
30
31
static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
32
-
33
- g_autoptr(GString) ts = g_string_new("");
34
int i, j, bits;
35
36
/* First define types and totals in a whole VL */
37
for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
38
- int count = reg_width / vec_lanes[i].size;
39
- g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
40
g_string_append_printf(s,
41
- "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
42
- ts->str, vec_lanes[i].gdb_type, count);
43
+ "<vector id=\"%s%c%c\" type=\"%s\" count=\"%d\"/>",
44
+ name, vec_lanes[i].sz, vec_lanes[i].suffix,
45
+ vec_lanes[i].gdb_type, reg_width / vec_lanes[i].size);
46
}
44
+
47
+
45
+ ptimer_free(s->g_timer.ptimer_frc);
48
/*
49
* Now define a union for each size group containing unsigned and
50
* signed and potentially float versions of each size from 128 to
51
* 8 bits.
52
*/
53
for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
54
- g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
55
+ g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
56
for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
57
if (vec_lanes[j].size == bits) {
58
- g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
59
- vec_lanes[j].suffix,
60
+ g_string_append_printf(s, "<field name=\"%c\" type=\"%s%c%c\"/>",
61
+ vec_lanes[j].suffix, name,
62
vec_lanes[j].sz, vec_lanes[j].suffix);
63
}
64
}
65
g_string_append(s, "</union>");
66
}
46
+
67
+
47
+ for (i = 0; i < 2; i++) {
68
/* And now the final union of unions */
48
+ ptimer_free(s->l_timer[i].tick_timer.ptimer_tick);
69
- g_string_append(s, "<union id=\"svev\">");
49
+ ptimer_free(s->l_timer[i].ptimer_frc);
70
+ g_string_append_printf(s, "<union id=\"%s\">", name);
50
+ }
71
for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
51
+}
72
- g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
52
+
73
- suf[i], suf[i]);
53
static void exynos4210_mct_class_init(ObjectClass *klass, void *data)
74
+ g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
54
{
75
+ suf[i], name, suf[i]);
55
DeviceClass *dc = DEVICE_CLASS(klass);
76
}
56
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_mct_info = {
77
g_string_append(s, "</union>");
57
.parent = TYPE_SYS_BUS_DEVICE,
78
}
58
.instance_size = sizeof(Exynos4210MCTState),
79
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
59
.instance_init = exynos4210_mct_init,
80
g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
60
+ .instance_finalize = exynos4210_mct_finalize,
81
61
.class_init = exynos4210_mct_class_init,
82
/* Create the vector union type. */
62
};
83
- output_vector_union_type(s, reg_width);
63
84
+ output_vector_union_type(s, reg_width, "svev");
85
86
/* Create the predicate vector type. */
87
g_string_append_printf(s,
64
--
88
--
65
2.20.1
89
2.34.1
66
90
67
91
diff view generated by jsdifflib
1
From: Bin Meng <bin.meng@windriver.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
At present, when booting U-Boot on QEMU sabrelite, we see:
3
Order suf[] by the log8 of the width.
4
Use ARRAY_SIZE instead of hard-coding 128.
4
5
5
Net: Board Net Initialization Failed
6
This changes the order of the union definitions,
6
No ethernet found.
7
but retains the order of the union-of-union members.
7
8
8
U-Boot scans PHY at address 4/5/6/7 (see board_eth_init() in the
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
U-Boot source: board/boundary/nitrogen6x/nitrogen6x.c). On the real
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
board, the Ethernet PHY is at address 6. Adjust this by updating the
11
Message-id: 20230227213329.793795-10-richard.henderson@linaro.org
11
"fec-phy-num" property of the fsl_imx6 SoC object.
12
13
With this change, U-Boot sees the PHY but complains MAC address:
14
15
Net: using phy at 6
16
FEC [PRIME]
17
Error: FEC address not set.
18
19
This is due to U-Boot tries to read the MAC address from the fuse,
20
which QEMU does not have any valid content filled in. However this
21
does not prevent the Ethernet from working in QEMU. We just need to
22
set up the MAC address later in the U-Boot command shell, by:
23
24
=> setenv ethaddr 00:11:22:33:44:55
25
26
Signed-off-by: Bin Meng <bin.meng@windriver.com>
27
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
28
Message-id: 20210106063504.10841-4-bmeng.cn@gmail.com
29
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
30
---
13
---
31
hw/arm/sabrelite.c | 4 ++++
14
target/arm/gdbstub64.c | 10 ++++++----
32
1 file changed, 4 insertions(+)
15
1 file changed, 6 insertions(+), 4 deletions(-)
33
16
34
diff --git a/hw/arm/sabrelite.c b/hw/arm/sabrelite.c
17
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
35
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
36
--- a/hw/arm/sabrelite.c
19
--- a/target/arm/gdbstub64.c
37
+++ b/hw/arm/sabrelite.c
20
+++ b/target/arm/gdbstub64.c
38
@@ -XXX,XX +XXX,XX @@ static void sabrelite_init(MachineState *machine)
21
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
39
22
{ "int8", 8, 'b', 's' },
40
s = FSL_IMX6(object_new(TYPE_FSL_IMX6));
23
};
41
object_property_add_child(OBJECT(machine), "soc", OBJECT(s));
24
25
- static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
26
- int i, j, bits;
27
+ static const char suf[] = { 'b', 'h', 's', 'd', 'q' };
28
+ int i, j;
29
30
/* First define types and totals in a whole VL */
31
for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
32
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
33
* signed and potentially float versions of each size from 128 to
34
* 8 bits.
35
*/
36
- for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
37
+ for (i = 0; i < ARRAY_SIZE(suf); i++) {
38
+ int bits = 8 << i;
42
+
39
+
43
+ /* Ethernet PHY address is 6 */
40
g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
44
+ object_property_set_int(OBJECT(s), "fec-phy-num", 6, &error_fatal);
41
for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
45
+
42
if (vec_lanes[j].size == bits) {
46
qdev_realize(DEVICE(s), NULL, &error_fatal);
43
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
47
44
48
memory_region_add_subregion(get_system_memory(), FSL_IMX6_MMDC_ADDR,
45
/* And now the final union of unions */
46
g_string_append_printf(s, "<union id=\"%s\">", name);
47
- for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
48
+ for (i = ARRAY_SIZE(suf) - 1; i >= 0; i--) {
49
g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
50
suf[i], name, suf[i]);
51
}
49
--
52
--
50
2.20.1
53
2.34.1
51
52
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
When running device-introspect-test, a memory leak occurred in the
3
Keep the logic for pauth within pauth_helper.c, and expose
4
mv88w8618_pit_init function, so use ptimer_free() in the finalize function to
4
a helper function for use with the gdbstub pac extension.
5
avoid it.
6
5
7
ASAN shows memory leak stack:
8
9
Indirect leak of 192 byte(s) in 4 object(s) allocated from:
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
13
#3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
14
#4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
15
#5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
16
#6 0xaaabf5bb2290 in mv88w8618_timer_init /qemu/hw/arm/musicpal.c:862
17
#7 0xaaabf5bb2290 in mv88w8618_pit_init /qemu/hw/arm/musicpal.c:954
18
#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
19
#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
20
#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
21
#11 0xaaabf5a95540 in qdev_device_help /qemu/softmmu/qdev-monitor.c:283
22
#12 0xaaabf5a96940 in qmp_device_add /qemu/softmmu/qdev-monitor.c:801
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20230227213329.793795-11-richard.henderson@linaro.org
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
10
---
29
hw/arm/musicpal.c | 12 ++++++++++++
11
target/arm/internals.h | 10 ++++++++++
30
1 file changed, 12 insertions(+)
12
target/arm/tcg/pauth_helper.c | 26 ++++++++++++++++++++++----
13
2 files changed, 32 insertions(+), 4 deletions(-)
31
14
32
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
15
diff --git a/target/arm/internals.h b/target/arm/internals.h
33
index XXXXXXX..XXXXXXX 100644
16
index XXXXXXX..XXXXXXX 100644
34
--- a/hw/arm/musicpal.c
17
--- a/target/arm/internals.h
35
+++ b/hw/arm/musicpal.c
18
+++ b/target/arm/internals.h
36
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_init(Object *obj)
19
@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
37
sysbus_init_mmio(dev, &s->iomem);
20
bool arm_singlestep_active(CPUARMState *env);
21
bool arm_generate_debug_exceptions(CPUARMState *env);
22
23
+/**
24
+ * pauth_ptr_mask:
25
+ * @env: cpu context
26
+ * @ptr: selects between TTBR0 and TTBR1
27
+ * @data: selects between TBI and TBID
28
+ *
29
+ * Return a mask of the bits of @ptr that contain the authentication code.
30
+ */
31
+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data);
32
+
33
/* Add the cpreg definitions for debug related system registers */
34
void define_debug_regs(ARMCPU *cpu);
35
36
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
37
index XXXXXXX..XXXXXXX 100644
38
--- a/target/arm/tcg/pauth_helper.c
39
+++ b/target/arm/tcg/pauth_helper.c
40
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
41
return pac | ext | ptr;
38
}
42
}
39
43
40
+static void mv88w8618_pit_finalize(Object *obj)
44
-static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
45
+static uint64_t pauth_ptr_mask_internal(ARMVAParameters param)
46
{
47
- /* Note that bit 55 is used whether or not the regime has 2 ranges. */
48
- uint64_t extfield = sextract64(ptr, 55, 1);
49
int bot_pac_bit = 64 - param.tsz;
50
int top_pac_bit = 64 - 8 * param.tbi;
51
52
- return deposit64(ptr, bot_pac_bit, top_pac_bit - bot_pac_bit, extfield);
53
+ return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
54
+}
55
+
56
+static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
41
+{
57
+{
42
+ SysBusDevice *dev = SYS_BUS_DEVICE(obj);
58
+ uint64_t mask = pauth_ptr_mask_internal(param);
43
+ mv88w8618_pit_state *s = MV88W8618_PIT(dev);
44
+ int i;
45
+
59
+
46
+ for (i = 0; i < 4; i++) {
60
+ /* Note that bit 55 is used whether or not the regime has 2 ranges. */
47
+ ptimer_free(s->timer[i].ptimer);
61
+ if (extract64(ptr, 55, 1)) {
62
+ return ptr | mask;
63
+ } else {
64
+ return ptr & ~mask;
48
+ }
65
+ }
49
+}
66
+}
50
+
67
+
51
static const VMStateDescription mv88w8618_timer_vmsd = {
68
+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data)
52
.name = "timer",
69
+{
53
.version_id = 1,
70
+ ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
54
@@ -XXX,XX +XXX,XX @@ static const TypeInfo mv88w8618_pit_info = {
71
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
55
.parent = TYPE_SYS_BUS_DEVICE,
72
+
56
.instance_size = sizeof(mv88w8618_pit_state),
73
+ return pauth_ptr_mask_internal(param);
57
.instance_init = mv88w8618_pit_init,
74
}
58
+ .instance_finalize = mv88w8618_pit_finalize,
75
59
.class_init = mv88w8618_pit_class_init,
76
static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
60
};
61
62
--
77
--
63
2.20.1
78
2.34.1
64
65
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
When running device-introspect-test, a memory leak occurred in the
3
The extension is primarily defined by the Linux kernel NT_ARM_PAC_MASK
4
mss_timer_init function, so use ptimer_free() in the finalize function to avoid
4
ptrace register set.
5
it.
6
5
7
ASAN shows memory leak stack:
6
The original gdb feature consists of two masks, data and code, which are
7
used to mask out the authentication code within a pointer. Following
8
discussion with Luis Machado, add two more masks in order to support
9
pointers within the high half of the address space (i.e. TTBR1 vs TTBR0).
8
10
9
Indirect leak of 192 byte(s) in 2 object(s) allocated from:
11
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1105
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf58a0010 in mss_timer_init /qemu/hw/timer/mss-timer.c:235
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
16
#6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
17
#7 0xaaabf5b8316c in m2sxxx_soc_initfn /qemu/hw/arm/msf2-soc.c:70
18
#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
19
#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
20
#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
21
#11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
22
#12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 20230227213329.793795-12-richard.henderson@linaro.org
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
16
---
29
hw/timer/mss-timer.c | 13 +++++++++++++
17
configs/targets/aarch64-linux-user.mak | 2 +-
30
1 file changed, 13 insertions(+)
18
configs/targets/aarch64-softmmu.mak | 2 +-
19
configs/targets/aarch64_be-linux-user.mak | 2 +-
20
target/arm/internals.h | 2 ++
21
target/arm/gdbstub.c | 5 ++++
22
target/arm/gdbstub64.c | 34 +++++++++++++++++++++++
23
gdb-xml/aarch64-pauth.xml | 15 ++++++++++
24
7 files changed, 59 insertions(+), 3 deletions(-)
25
create mode 100644 gdb-xml/aarch64-pauth.xml
31
26
32
diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
27
diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak
33
index XXXXXXX..XXXXXXX 100644
28
index XXXXXXX..XXXXXXX 100644
34
--- a/hw/timer/mss-timer.c
29
--- a/configs/targets/aarch64-linux-user.mak
35
+++ b/hw/timer/mss-timer.c
30
+++ b/configs/targets/aarch64-linux-user.mak
36
@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)
31
@@ -XXX,XX +XXX,XX @@
37
sysbus_init_mmio(SYS_BUS_DEVICE(obj), &t->mmio);
32
TARGET_ARCH=aarch64
33
TARGET_BASE_ARCH=arm
34
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
35
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
36
TARGET_HAS_BFLT=y
37
CONFIG_SEMIHOSTING=y
38
CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
39
diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
40
index XXXXXXX..XXXXXXX 100644
41
--- a/configs/targets/aarch64-softmmu.mak
42
+++ b/configs/targets/aarch64-softmmu.mak
43
@@ -XXX,XX +XXX,XX @@
44
TARGET_ARCH=aarch64
45
TARGET_BASE_ARCH=arm
46
TARGET_SUPPORTS_MTTCG=y
47
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml
48
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
49
TARGET_NEED_FDT=y
50
diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak
51
index XXXXXXX..XXXXXXX 100644
52
--- a/configs/targets/aarch64_be-linux-user.mak
53
+++ b/configs/targets/aarch64_be-linux-user.mak
54
@@ -XXX,XX +XXX,XX @@
55
TARGET_ARCH=aarch64
56
TARGET_BASE_ARCH=arm
57
TARGET_BIG_ENDIAN=y
58
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
59
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
60
TARGET_HAS_BFLT=y
61
CONFIG_SEMIHOSTING=y
62
CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
63
diff --git a/target/arm/internals.h b/target/arm/internals.h
64
index XXXXXXX..XXXXXXX 100644
65
--- a/target/arm/internals.h
66
+++ b/target/arm/internals.h
67
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
68
int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
69
int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
70
int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
71
+int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg);
72
+int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg);
73
void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
74
void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
75
void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
76
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
77
index XXXXXXX..XXXXXXX 100644
78
--- a/target/arm/gdbstub.c
79
+++ b/target/arm/gdbstub.c
80
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
81
aarch64_gdb_set_fpu_reg,
82
34, "aarch64-fpu.xml", 0);
83
}
84
+ if (isar_feature_aa64_pauth(&cpu->isar)) {
85
+ gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
86
+ aarch64_gdb_set_pauth_reg,
87
+ 4, "aarch64-pauth.xml", 0);
88
+ }
89
#endif
90
} else {
91
if (arm_feature(env, ARM_FEATURE_NEON)) {
92
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
93
index XXXXXXX..XXXXXXX 100644
94
--- a/target/arm/gdbstub64.c
95
+++ b/target/arm/gdbstub64.c
96
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
97
return 0;
38
}
98
}
39
99
40
+static void mss_timer_finalize(Object *obj)
100
+int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
41
+{
101
+{
42
+ MSSTimerState *t = MSS_TIMER(obj);
102
+ switch (reg) {
43
+ int i;
103
+ case 0: /* pauth_dmask */
44
+
104
+ case 1: /* pauth_cmask */
45
+ for (i = 0; i < NUM_TIMERS; i++) {
105
+ case 2: /* pauth_dmask_high */
46
+ struct Msf2Timer *st = &t->timers[i];
106
+ case 3: /* pauth_cmask_high */
47
+
107
+ /*
48
+ ptimer_free(st->ptimer);
108
+ * Note that older versions of this feature only contained
109
+ * pauth_{d,c}mask, for use with Linux user processes, and
110
+ * thus exclusively in the low half of the address space.
111
+ *
112
+ * To support system mode, and to debug kernels, two new regs
113
+ * were added to cover the high half of the address space.
114
+ * For the purpose of pauth_ptr_mask, we can use any well-formed
115
+ * address within the address space half -- here, 0 and -1.
116
+ */
117
+ {
118
+ bool is_data = !(reg & 1);
119
+ bool is_high = reg & 2;
120
+ uint64_t mask = pauth_ptr_mask(env, -is_high, is_data);
121
+ return gdb_get_reg64(buf, mask);
122
+ }
123
+ default:
124
+ return 0;
49
+ }
125
+ }
50
+}
126
+}
51
+
127
+
52
static const VMStateDescription vmstate_timers = {
128
+int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg)
53
.name = "mss-timer-block",
129
+{
54
.version_id = 1,
130
+ /* All pseudo registers are read-only. */
55
@@ -XXX,XX +XXX,XX @@ static const TypeInfo mss_timer_info = {
131
+ return 0;
56
.parent = TYPE_SYS_BUS_DEVICE,
132
+}
57
.instance_size = sizeof(MSSTimerState),
133
+
58
.instance_init = mss_timer_init,
134
static void output_vector_union_type(GString *s, int reg_width,
59
+ .instance_finalize = mss_timer_finalize,
135
const char *name)
60
.class_init = mss_timer_class_init,
136
{
61
};
137
diff --git a/gdb-xml/aarch64-pauth.xml b/gdb-xml/aarch64-pauth.xml
62
138
new file mode 100644
139
index XXXXXXX..XXXXXXX
140
--- /dev/null
141
+++ b/gdb-xml/aarch64-pauth.xml
142
@@ -XXX,XX +XXX,XX @@
143
+<?xml version="1.0"?>
144
+<!-- Copyright (C) 2018-2022 Free Software Foundation, Inc.
145
+
146
+ Copying and distribution of this file, with or without modification,
147
+ are permitted in any medium without royalty provided the copyright
148
+ notice and this notice are preserved. -->
149
+
150
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
151
+<feature name="org.gnu.gdb.aarch64.pauth">
152
+ <reg name="pauth_dmask" bitsize="64"/>
153
+ <reg name="pauth_cmask" bitsize="64"/>
154
+ <reg name="pauth_dmask_high" bitsize="64"/>
155
+ <reg name="pauth_cmask_high" bitsize="64"/>
156
+</feature>
157
+
63
--
158
--
64
2.20.1
159
2.34.1
65
66
diff view generated by jsdifflib
1
The Arm CPU finalize function uses a sequence of timer_del(), timer_deinit(),
1
From: David Reiss <dreiss@meta.com>
2
timer_free() to free the timer. The timer_deinit() step in this was always
3
unnecessary, and now the timer_del() is implied by timer_free(), so we can
4
collapse this down to simply calling timer_free().
5
2
3
Allow the function to be used outside of m_helper.c.
4
Rename with an "arm_" prefix.
5
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
8
Signed-off-by: David Reiss <dreiss@meta.com>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20230227213329.793795-13-richard.henderson@linaro.org
11
[rth: Split out of a larger patch]
12
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20201215154107.3255-5-peter.maydell@linaro.org
10
---
14
---
11
target/arm/cpu.c | 2 --
15
target/arm/internals.h | 3 +++
12
1 file changed, 2 deletions(-)
16
target/arm/tcg/m_helper.c | 6 +++---
17
2 files changed, 6 insertions(+), 3 deletions(-)
13
18
14
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
19
diff --git a/target/arm/internals.h b/target/arm/internals.h
15
index XXXXXXX..XXXXXXX 100644
20
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/cpu.c
21
--- a/target/arm/internals.h
17
+++ b/target/arm/cpu.c
22
+++ b/target/arm/internals.h
18
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
23
@@ -XXX,XX +XXX,XX @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
19
}
24
void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
20
#ifndef CONFIG_USER_ONLY
21
if (cpu->pmu_timer) {
22
- timer_del(cpu->pmu_timer);
23
- timer_deinit(cpu->pmu_timer);
24
timer_free(cpu->pmu_timer);
25
}
26
#endif
25
#endif
26
27
+/* Read the CONTROL register as the MRS instruction would. */
28
+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
29
+
30
#ifdef CONFIG_USER_ONLY
31
static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
32
#else
33
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
34
index XXXXXXX..XXXXXXX 100644
35
--- a/target/arm/tcg/m_helper.c
36
+++ b/target/arm/tcg/m_helper.c
37
@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
38
return xpsr_read(env) & mask;
39
}
40
41
-static uint32_t v7m_mrs_control(CPUARMState *env, uint32_t secure)
42
+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
43
{
44
uint32_t value = env->v7m.control[secure];
45
46
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
47
case 0 ... 7: /* xPSR sub-fields */
48
return v7m_mrs_xpsr(env, reg, 0);
49
case 20: /* CONTROL */
50
- return v7m_mrs_control(env, 0);
51
+ return arm_v7m_mrs_control(env, 0);
52
default:
53
/* Unprivileged reads others as zero. */
54
return 0;
55
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
56
case 0 ... 7: /* xPSR sub-fields */
57
return v7m_mrs_xpsr(env, reg, el);
58
case 20: /* CONTROL */
59
- return v7m_mrs_control(env, env->v7m.secure);
60
+ return arm_v7m_mrs_control(env, env->v7m.secure);
61
case 0x94: /* CONTROL_NS */
62
/*
63
* We have to handle this here because unprivileged Secure code
27
--
64
--
28
2.20.1
65
2.34.1
29
66
30
67
diff view generated by jsdifflib
1
Implement the v8.1M FPCXT_NS floating-point system register. This is
1
From: David Reiss <dreiss@meta.com>
2
a little more complicated than FPCXT_S, because it has specific
3
handling for "current FP state is inactive", and it only wants to do
4
PreserveFPState(), not the full set of actions done by
5
ExecuteFPCheck() which vfp_access_check() implements.
6
2
3
Allow the function to be used outside of m_helper.c.
4
Move to be outside of ifndef CONFIG_USER_ONLY block.
5
Rename from get_v7m_sp_ptr.
6
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Signed-off-by: David Reiss <dreiss@meta.com>
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11
Message-id: 20230227213329.793795-14-richard.henderson@linaro.org
12
[rth: Split out of a larger patch]
13
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20201210201433.26262-4-peter.maydell@linaro.org
10
---
15
---
11
target/arm/translate-vfp.c.inc | 102 ++++++++++++++++++++++++++++++++-
16
target/arm/internals.h | 10 +++++
12
1 file changed, 99 insertions(+), 3 deletions(-)
17
target/arm/tcg/m_helper.c | 84 +++++++++++++++++++--------------------
18
2 files changed, 51 insertions(+), 43 deletions(-)
13
19
14
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
20
diff --git a/target/arm/internals.h b/target/arm/internals.h
15
index XXXXXXX..XXXXXXX 100644
21
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate-vfp.c.inc
22
--- a/target/arm/internals.h
17
+++ b/target/arm/translate-vfp.c.inc
23
+++ b/target/arm/internals.h
18
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
24
@@ -XXX,XX +XXX,XX @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
19
}
25
/* Read the CONTROL register as the MRS instruction would. */
20
break;
26
uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
21
case ARM_VFP_FPCXT_S:
27
22
+ case ARM_VFP_FPCXT_NS:
28
+/*
23
if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
29
+ * Return a pointer to the location where we currently store the
24
return false;
30
+ * stack pointer for the requested security state and thread mode.
25
}
31
+ * This pointer will become invalid if the CPU state is updated
26
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
32
+ * such that the stack pointers are switched around (eg changing
27
return FPSysRegCheckFailed;
33
+ * the SPSEL control bit).
28
}
34
+ */
29
35
+uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure,
30
- if (!vfp_access_check(s)) {
36
+ bool threadmode, bool spsel);
31
+ /*
37
+
32
+ * FPCXT_NS is a special case: it has specific handling for
38
#ifdef CONFIG_USER_ONLY
33
+ * "current FP state is inactive", and must do the PreserveFPState()
39
static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
34
+ * but not the usual full set of actions done by ExecuteFPCheck().
40
#else
35
+ * So we don't call vfp_access_check() and the callers must handle this.
41
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
36
+ */
42
index XXXXXXX..XXXXXXX 100644
37
+ if (regno != ARM_VFP_FPCXT_NS && !vfp_access_check(s)) {
43
--- a/target/arm/tcg/m_helper.c
38
return FPSysRegCheckDone;
44
+++ b/target/arm/tcg/m_helper.c
39
}
45
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
46
arm_rebuild_hflags(env);
47
}
48
49
-static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
50
- bool spsel)
51
-{
52
- /*
53
- * Return a pointer to the location where we currently store the
54
- * stack pointer for the requested security state and thread mode.
55
- * This pointer will become invalid if the CPU state is updated
56
- * such that the stack pointers are switched around (eg changing
57
- * the SPSEL control bit).
58
- * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
59
- * Unlike that pseudocode, we require the caller to pass us in the
60
- * SPSEL control bit value; this is because we also use this
61
- * function in handling of pushing of the callee-saves registers
62
- * part of the v8M stack frame (pseudocode PushCalleeStack()),
63
- * and in the tailchain codepath the SPSEL bit comes from the exception
64
- * return magic LR value from the previous exception. The pseudocode
65
- * opencodes the stack-selection in PushCalleeStack(), but we prefer
66
- * to make this utility function generic enough to do the job.
67
- */
68
- bool want_psp = threadmode && spsel;
40
-
69
-
41
return FPSysRegCheckContinue;
70
- if (secure == env->v7m.secure) {
71
- if (want_psp == v7m_using_psp(env)) {
72
- return &env->regs[13];
73
- } else {
74
- return &env->v7m.other_sp;
75
- }
76
- } else {
77
- if (want_psp) {
78
- return &env->v7m.other_ss_psp;
79
- } else {
80
- return &env->v7m.other_ss_msp;
81
- }
82
- }
83
-}
84
-
85
static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
86
uint32_t *pvec)
87
{
88
@@ -XXX,XX +XXX,XX @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
89
!mode;
90
91
mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
92
- frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
93
- lr & R_V7M_EXCRET_SPSEL_MASK);
94
+ frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
95
+ lr & R_V7M_EXCRET_SPSEL_MASK);
96
want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
97
if (want_psp) {
98
limit = env->v7m.psplim[M_REG_S];
99
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
100
* use 'frame_sp_p' after we do something that makes it invalid.
101
*/
102
bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
103
- uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
104
- return_to_secure,
105
- !return_to_handler,
106
- spsel);
107
+ uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
108
+ !return_to_handler, spsel);
109
uint32_t frameptr = *frame_sp_p;
110
bool pop_ok = true;
111
ARMMMUIdx mmu_idx;
112
@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
113
threadmode = !arm_v7m_is_handler_mode(env);
114
spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
115
116
- frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
117
+ frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
118
frameptr = *frame_sp_p;
119
120
/*
121
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
42
}
122
}
43
123
44
+static void gen_branch_fpInactive(DisasContext *s, TCGCond cond,
124
#endif /* !CONFIG_USER_ONLY */
45
+ TCGLabel *label)
125
+
126
+uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
127
+ bool spsel)
46
+{
128
+{
47
+ /*
129
+ /*
48
+ * FPCXT_NS is a special case: it has specific handling for
130
+ * Return a pointer to the location where we currently store the
49
+ * "current FP state is inactive", and must do the PreserveFPState()
131
+ * stack pointer for the requested security state and thread mode.
50
+ * but not the usual full set of actions done by ExecuteFPCheck().
132
+ * This pointer will become invalid if the CPU state is updated
51
+ * We don't have a TB flag that matches the fpInactive check, so we
133
+ * such that the stack pointers are switched around (eg changing
52
+ * do it at runtime as we don't expect FPCXT_NS accesses to be frequent.
134
+ * the SPSEL control bit).
53
+ *
135
+ * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
54
+ * Emit code that checks fpInactive and does a conditional
136
+ * Unlike that pseudocode, we require the caller to pass us in the
55
+ * branch to label based on it:
137
+ * SPSEL control bit value; this is because we also use this
56
+ * if cond is TCG_COND_NE then branch if fpInactive != 0 (ie if inactive)
138
+ * function in handling of pushing of the callee-saves registers
57
+ * if cond is TCG_COND_EQ then branch if fpInactive == 0 (ie if active)
139
+ * part of the v8M stack frame (pseudocode PushCalleeStack()),
140
+ * and in the tailchain codepath the SPSEL bit comes from the exception
141
+ * return magic LR value from the previous exception. The pseudocode
142
+ * opencodes the stack-selection in PushCalleeStack(), but we prefer
143
+ * to make this utility function generic enough to do the job.
58
+ */
144
+ */
59
+ assert(cond == TCG_COND_EQ || cond == TCG_COND_NE);
145
+ bool want_psp = threadmode && spsel;
60
+
146
+
61
+ /* fpInactive = FPCCR_NS.ASPEN == 1 && CONTROL.FPCA == 0 */
147
+ if (secure == env->v7m.secure) {
62
+ TCGv_i32 aspen, fpca;
148
+ if (want_psp == v7m_using_psp(env)) {
63
+ aspen = load_cpu_field(v7m.fpccr[M_REG_NS]);
149
+ return &env->regs[13];
64
+ fpca = load_cpu_field(v7m.control[M_REG_S]);
150
+ } else {
65
+ tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
151
+ return &env->v7m.other_sp;
66
+ tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
152
+ }
67
+ tcg_gen_andi_i32(fpca, fpca, R_V7M_CONTROL_FPCA_MASK);
153
+ } else {
68
+ tcg_gen_or_i32(fpca, fpca, aspen);
154
+ if (want_psp) {
69
+ tcg_gen_brcondi_i32(tcg_invert_cond(cond), fpca, 0, label);
155
+ return &env->v7m.other_ss_psp;
70
+ tcg_temp_free_i32(aspen);
156
+ } else {
71
+ tcg_temp_free_i32(fpca);
157
+ return &env->v7m.other_ss_msp;
158
+ }
159
+ }
72
+}
160
+}
73
+
74
static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
75
76
fp_sysreg_loadfn *loadfn,
77
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
78
{
79
/* Do a write to an M-profile floating point system register */
80
TCGv_i32 tmp;
81
+ TCGLabel *lab_end = NULL;
82
83
switch (fp_sysreg_checks(s, regno)) {
84
case FPSysRegCheckFailed:
85
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
86
tcg_temp_free_i32(tmp);
87
break;
88
}
89
+ case ARM_VFP_FPCXT_NS:
90
+ lab_end = gen_new_label();
91
+ /* fpInactive case: write is a NOP, so branch to end */
92
+ gen_branch_fpInactive(s, TCG_COND_NE, lab_end);
93
+ /* !fpInactive: PreserveFPState(), and reads same as FPCXT_S */
94
+ gen_preserve_fp_state(s);
95
+ /* fall through */
96
case ARM_VFP_FPCXT_S:
97
{
98
TCGv_i32 sfpa, control;
99
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
100
default:
101
g_assert_not_reached();
102
}
103
+ if (lab_end) {
104
+ gen_set_label(lab_end);
105
+ }
106
return true;
107
}
108
109
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
110
{
111
/* Do a read from an M-profile floating point system register */
112
TCGv_i32 tmp;
113
+ TCGLabel *lab_end = NULL;
114
+ bool lookup_tb = false;
115
116
switch (fp_sysreg_checks(s, regno)) {
117
case FPSysRegCheckFailed:
118
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
119
fpscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);
120
gen_helper_vfp_set_fpscr(cpu_env, fpscr);
121
tcg_temp_free_i32(fpscr);
122
- gen_lookup_tb(s);
123
+ lookup_tb = true;
124
+ break;
125
+ }
126
+ case ARM_VFP_FPCXT_NS:
127
+ {
128
+ TCGv_i32 control, sfpa, fpscr, fpdscr, zero;
129
+ TCGLabel *lab_active = gen_new_label();
130
+
131
+ lookup_tb = true;
132
+
133
+ gen_branch_fpInactive(s, TCG_COND_EQ, lab_active);
134
+ /* fpInactive case: reads as FPDSCR_NS */
135
+ TCGv_i32 tmp = load_cpu_field(v7m.fpdscr[M_REG_NS]);
136
+ storefn(s, opaque, tmp);
137
+ lab_end = gen_new_label();
138
+ tcg_gen_br(lab_end);
139
+
140
+ gen_set_label(lab_active);
141
+ /* !fpInactive: Reads the same as FPCXT_S, but side effects differ */
142
+ gen_preserve_fp_state(s);
143
+ tmp = tcg_temp_new_i32();
144
+ sfpa = tcg_temp_new_i32();
145
+ fpscr = tcg_temp_new_i32();
146
+ gen_helper_vfp_get_fpscr(fpscr, cpu_env);
147
+ tcg_gen_andi_i32(tmp, fpscr, ~FPCR_NZCV_MASK);
148
+ control = load_cpu_field(v7m.control[M_REG_S]);
149
+ tcg_gen_andi_i32(sfpa, control, R_V7M_CONTROL_SFPA_MASK);
150
+ tcg_gen_shli_i32(sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);
151
+ tcg_gen_or_i32(tmp, tmp, sfpa);
152
+ tcg_temp_free_i32(control);
153
+ /* Store result before updating FPSCR, in case it faults */
154
+ storefn(s, opaque, tmp);
155
+ /* If SFPA is zero then set FPSCR from FPDSCR_NS */
156
+ fpdscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);
157
+ zero = tcg_const_i32(0);
158
+ tcg_gen_movcond_i32(TCG_COND_EQ, fpscr, sfpa, zero, fpdscr, fpscr);
159
+ gen_helper_vfp_set_fpscr(cpu_env, fpscr);
160
+ tcg_temp_free_i32(zero);
161
+ tcg_temp_free_i32(sfpa);
162
+ tcg_temp_free_i32(fpdscr);
163
+ tcg_temp_free_i32(fpscr);
164
break;
165
}
166
default:
167
g_assert_not_reached();
168
}
169
+
170
+ if (lab_end) {
171
+ gen_set_label(lab_end);
172
+ }
173
+ if (lookup_tb) {
174
+ gen_lookup_tb(s);
175
+ }
176
return true;
177
}
178
179
--
161
--
180
2.20.1
162
2.34.1
181
163
182
164
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
When running device-introspect-test, a memory leak occurred in the
3
The upstream gdb xml only implements {MSP,PSP}{,_NS,S}, but
4
exynos4210_pwm_init function, so use ptimer_free() in the finalize function to
4
go ahead and implement the other system registers as well.
5
avoid it.
5
6
6
Since there is significant overlap between the two, implement
7
ASAN shows memory leak stack:
7
them with common code. The only exception is the systemreg
8
8
view of CONTROL, which merges the banked bits as per MRS.
9
Indirect leak of 240 byte(s) in 5 object(s) allocated from:
9
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
10
Signed-off-by: David Reiss <dreiss@meta.com>
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
11
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
12
#2 0xaaabf555db84 in timer_new_full /qemu/include/qemu/timer.h:523
12
Message-id: 20230227213329.793795-15-richard.henderson@linaro.org
13
#3 0xaaabf555db84 in timer_new /qemu/include/qemu/timer.h:544
13
[rth: Substatial rewrite using enumerator and shared code.]
14
#4 0xaaabf555db84 in timer_new_ns /qemu/include/qemu/timer.h:562
14
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
15
#5 0xaaabf555db84 in ptimer_init /qemu/hw/core/ptimer.c:433
16
#6 0xaaabf56a36cc in exynos4210_pwm_init /qemu/hw/timer/exynos4210_pwm.c:401
17
#7 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
18
#8 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
19
#9 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
20
#10 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
21
#11 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
22
#12 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
15
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
17
---
29
hw/timer/exynos4210_pwm.c | 11 +++++++++++
18
target/arm/cpu.h | 2 +
30
1 file changed, 11 insertions(+)
19
target/arm/gdbstub.c | 178 +++++++++++++++++++++++++++++++++++++++++++
31
20
2 files changed, 180 insertions(+)
32
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
21
22
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
33
index XXXXXXX..XXXXXXX 100644
23
index XXXXXXX..XXXXXXX 100644
34
--- a/hw/timer/exynos4210_pwm.c
24
--- a/target/arm/cpu.h
35
+++ b/hw/timer/exynos4210_pwm.c
25
+++ b/target/arm/cpu.h
36
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_init(Object *obj)
26
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
37
sysbus_init_mmio(dev, &s->iomem);
27
28
DynamicGDBXMLInfo dyn_sysreg_xml;
29
DynamicGDBXMLInfo dyn_svereg_xml;
30
+ DynamicGDBXMLInfo dyn_m_systemreg_xml;
31
+ DynamicGDBXMLInfo dyn_m_secextreg_xml;
32
33
/* Timers used by the generic (architected) timer */
34
QEMUTimer *gt_timer[NUM_GTIMERS];
35
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
36
index XXXXXXX..XXXXXXX 100644
37
--- a/target/arm/gdbstub.c
38
+++ b/target/arm/gdbstub.c
39
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
40
return cpu->dyn_sysreg_xml.num;
38
}
41
}
39
42
40
+static void exynos4210_pwm_finalize(Object *obj)
43
+typedef enum {
41
+{
44
+ M_SYSREG_MSP,
42
+ Exynos4210PWMState *s = EXYNOS4210_PWM(obj);
45
+ M_SYSREG_PSP,
46
+ M_SYSREG_PRIMASK,
47
+ M_SYSREG_CONTROL,
48
+ M_SYSREG_BASEPRI,
49
+ M_SYSREG_FAULTMASK,
50
+ M_SYSREG_MSPLIM,
51
+ M_SYSREG_PSPLIM,
52
+} MProfileSysreg;
53
+
54
+static const struct {
55
+ const char *name;
56
+ int feature;
57
+} m_sysreg_def[] = {
58
+ [M_SYSREG_MSP] = { "msp", ARM_FEATURE_M },
59
+ [M_SYSREG_PSP] = { "psp", ARM_FEATURE_M },
60
+ [M_SYSREG_PRIMASK] = { "primask", ARM_FEATURE_M },
61
+ [M_SYSREG_CONTROL] = { "control", ARM_FEATURE_M },
62
+ [M_SYSREG_BASEPRI] = { "basepri", ARM_FEATURE_M_MAIN },
63
+ [M_SYSREG_FAULTMASK] = { "faultmask", ARM_FEATURE_M_MAIN },
64
+ [M_SYSREG_MSPLIM] = { "msplim", ARM_FEATURE_V8 },
65
+ [M_SYSREG_PSPLIM] = { "psplim", ARM_FEATURE_V8 },
66
+};
67
+
68
+static uint32_t *m_sysreg_ptr(CPUARMState *env, MProfileSysreg reg, bool sec)
69
+{
70
+ uint32_t *ptr;
71
+
72
+ switch (reg) {
73
+ case M_SYSREG_MSP:
74
+ ptr = arm_v7m_get_sp_ptr(env, sec, false, true);
75
+ break;
76
+ case M_SYSREG_PSP:
77
+ ptr = arm_v7m_get_sp_ptr(env, sec, true, true);
78
+ break;
79
+ case M_SYSREG_MSPLIM:
80
+ ptr = &env->v7m.msplim[sec];
81
+ break;
82
+ case M_SYSREG_PSPLIM:
83
+ ptr = &env->v7m.psplim[sec];
84
+ break;
85
+ case M_SYSREG_PRIMASK:
86
+ ptr = &env->v7m.primask[sec];
87
+ break;
88
+ case M_SYSREG_BASEPRI:
89
+ ptr = &env->v7m.basepri[sec];
90
+ break;
91
+ case M_SYSREG_FAULTMASK:
92
+ ptr = &env->v7m.faultmask[sec];
93
+ break;
94
+ case M_SYSREG_CONTROL:
95
+ ptr = &env->v7m.control[sec];
96
+ break;
97
+ default:
98
+ return NULL;
99
+ }
100
+ return arm_feature(env, m_sysreg_def[reg].feature) ? ptr : NULL;
101
+}
102
+
103
+static int m_sysreg_get(CPUARMState *env, GByteArray *buf,
104
+ MProfileSysreg reg, bool secure)
105
+{
106
+ uint32_t *ptr = m_sysreg_ptr(env, reg, secure);
107
+
108
+ if (ptr == NULL) {
109
+ return 0;
110
+ }
111
+ return gdb_get_reg32(buf, *ptr);
112
+}
113
+
114
+static int arm_gdb_get_m_systemreg(CPUARMState *env, GByteArray *buf, int reg)
115
+{
116
+ /*
117
+ * Here, we emulate MRS instruction, where CONTROL has a mix of
118
+ * banked and non-banked bits.
119
+ */
120
+ if (reg == M_SYSREG_CONTROL) {
121
+ return gdb_get_reg32(buf, arm_v7m_mrs_control(env, env->v7m.secure));
122
+ }
123
+ return m_sysreg_get(env, buf, reg, env->v7m.secure);
124
+}
125
+
126
+static int arm_gdb_set_m_systemreg(CPUARMState *env, uint8_t *buf, int reg)
127
+{
128
+ return 0; /* TODO */
129
+}
130
+
131
+static int arm_gen_dynamic_m_systemreg_xml(CPUState *cs, int orig_base_reg)
132
+{
133
+ ARMCPU *cpu = ARM_CPU(cs);
134
+ CPUARMState *env = &cpu->env;
135
+ GString *s = g_string_new(NULL);
136
+ int base_reg = orig_base_reg;
43
+ int i;
137
+ int i;
44
+
138
+
45
+ for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
139
+ g_string_printf(s, "<?xml version=\"1.0\"?>");
46
+ ptimer_free(s->timer[i].ptimer);
140
+ g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
47
+ }
141
+ g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.m-system\">\n");
48
+}
142
+
49
+
143
+ for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
50
static void exynos4210_pwm_class_init(ObjectClass *klass, void *data)
144
+ if (arm_feature(env, m_sysreg_def[i].feature)) {
145
+ g_string_append_printf(s,
146
+ "<reg name=\"%s\" bitsize=\"32\" regnum=\"%d\"/>\n",
147
+ m_sysreg_def[i].name, base_reg++);
148
+ }
149
+ }
150
+
151
+ g_string_append_printf(s, "</feature>");
152
+ cpu->dyn_m_systemreg_xml.desc = g_string_free(s, false);
153
+ cpu->dyn_m_systemreg_xml.num = base_reg - orig_base_reg;
154
+
155
+ return cpu->dyn_m_systemreg_xml.num;
156
+}
157
+
158
+#ifndef CONFIG_USER_ONLY
159
+/*
160
+ * For user-only, we see the non-secure registers via m_systemreg above.
161
+ * For secext, encode the non-secure view as even and secure view as odd.
162
+ */
163
+static int arm_gdb_get_m_secextreg(CPUARMState *env, GByteArray *buf, int reg)
164
+{
165
+ return m_sysreg_get(env, buf, reg >> 1, reg & 1);
166
+}
167
+
168
+static int arm_gdb_set_m_secextreg(CPUARMState *env, uint8_t *buf, int reg)
169
+{
170
+ return 0; /* TODO */
171
+}
172
+
173
+static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
174
+{
175
+ ARMCPU *cpu = ARM_CPU(cs);
176
+ GString *s = g_string_new(NULL);
177
+ int base_reg = orig_base_reg;
178
+ int i;
179
+
180
+ g_string_printf(s, "<?xml version=\"1.0\"?>");
181
+ g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
182
+ g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.secext\">\n");
183
+
184
+ for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
185
+ g_string_append_printf(s,
186
+ "<reg name=\"%s_ns\" bitsize=\"32\" regnum=\"%d\"/>\n",
187
+ m_sysreg_def[i].name, base_reg++);
188
+ g_string_append_printf(s,
189
+ "<reg name=\"%s_s\" bitsize=\"32\" regnum=\"%d\"/>\n",
190
+ m_sysreg_def[i].name, base_reg++);
191
+ }
192
+
193
+ g_string_append_printf(s, "</feature>");
194
+ cpu->dyn_m_secextreg_xml.desc = g_string_free(s, false);
195
+ cpu->dyn_m_secextreg_xml.num = base_reg - orig_base_reg;
196
+
197
+ return cpu->dyn_m_secextreg_xml.num;
198
+}
199
+#endif
200
+
201
const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
51
{
202
{
52
DeviceClass *dc = DEVICE_CLASS(klass);
203
ARMCPU *cpu = ARM_CPU(cs);
53
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_pwm_info = {
204
@@ -XXX,XX +XXX,XX @@ const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
54
.parent = TYPE_SYS_BUS_DEVICE,
205
return cpu->dyn_sysreg_xml.desc;
55
.instance_size = sizeof(Exynos4210PWMState),
206
} else if (strcmp(xmlname, "sve-registers.xml") == 0) {
56
.instance_init = exynos4210_pwm_init,
207
return cpu->dyn_svereg_xml.desc;
57
+ .instance_finalize = exynos4210_pwm_finalize,
208
+ } else if (strcmp(xmlname, "arm-m-system.xml") == 0) {
58
.class_init = exynos4210_pwm_class_init,
209
+ return cpu->dyn_m_systemreg_xml.desc;
59
};
210
+#ifndef CONFIG_USER_ONLY
60
211
+ } else if (strcmp(xmlname, "arm-m-secext.xml") == 0) {
212
+ return cpu->dyn_m_secextreg_xml.desc;
213
+#endif
214
}
215
return NULL;
216
}
217
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
218
arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
219
"system-registers.xml", 0);
220
221
+ if (arm_feature(env, ARM_FEATURE_M)) {
222
+ gdb_register_coprocessor(cs,
223
+ arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
224
+ arm_gen_dynamic_m_systemreg_xml(cs, cs->gdb_num_regs),
225
+ "arm-m-system.xml", 0);
226
+#ifndef CONFIG_USER_ONLY
227
+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
228
+ gdb_register_coprocessor(cs,
229
+ arm_gdb_get_m_secextreg, arm_gdb_set_m_secextreg,
230
+ arm_gen_dynamic_m_secextreg_xml(cs, cs->gdb_num_regs),
231
+ "arm-m-secext.xml", 0);
232
+ }
233
+#endif
234
+ }
235
}
61
--
236
--
62
2.20.1
237
2.34.1
63
64
diff view generated by jsdifflib
1
From: Bin Meng <bin.meng@windriver.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
U-Boot expects PMU_MISC0 register bit 7 is set (see init_bandgap()
3
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1421
4
in arch/arm/mach-imx/mx6/soc.c) during boot. This bit indicates the
4
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
5
bandgap has stabilized.
5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
6
Message-id: 20230227225832.816605-2-richard.henderson@linaro.org
7
With this change, the latest upstream U-Boot (v2021.01-rc3) for imx6
8
sabrelite board (mx6qsabrelite_defconfig), with a slight change made
9
by switching CONFIG_OF_SEPARATE to CONFIG_OF_EMBED, boots to U-Boot
10
shell on QEMU with the following command:
11
12
$ qemu-system-arm -M sabrelite -smp 4 -m 1G -kernel u-boot \
13
-display none -serial null -serial stdio
14
15
Boot log below:
16
17
U-Boot 2021.01-rc3 (Dec 12 2020 - 17:40:02 +0800)
18
19
CPU: Freescale i.MX?? rev1.0 at 792 MHz
20
Reset cause: POR
21
Model: Freescale i.MX6 Quad SABRE Lite Board
22
Board: SABRE Lite
23
I2C: ready
24
DRAM: 1 GiB
25
force_idle_bus: sda=0 scl=0 sda.gp=0x5c scl.gp=0x55
26
force_idle_bus: failed to clear bus, sda=0 scl=0
27
force_idle_bus: sda=0 scl=0 sda.gp=0x6d scl.gp=0x6c
28
force_idle_bus: failed to clear bus, sda=0 scl=0
29
force_idle_bus: sda=0 scl=0 sda.gp=0xcb scl.gp=0x5
30
force_idle_bus: failed to clear bus, sda=0 scl=0
31
MMC: FSL_SDHC: 0, FSL_SDHC: 1
32
Loading Environment from MMC... *** Warning - No block device, using default environment
33
34
In: serial
35
Out: serial
36
Err: serial
37
Net: Board Net Initialization Failed
38
No ethernet found.
39
starting USB...
40
Bus usb@2184000: usb dr_mode not found
41
USB EHCI 1.00
42
Bus usb@2184200: USB EHCI 1.00
43
scanning bus usb@2184000 for devices... 1 USB Device(s) found
44
scanning bus usb@2184200 for devices... 1 USB Device(s) found
45
scanning usb for storage devices... 0 Storage Device(s) found
46
scanning usb for ethernet devices... 0 Ethernet Device(s) found
47
Hit any key to stop autoboot: 0
48
=>
49
50
Signed-off-by: Bin Meng <bin.meng@windriver.com>
51
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
52
Message-id: 20210106063504.10841-2-bmeng.cn@gmail.com
53
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
54
---
8
---
55
hw/misc/imx6_ccm.c | 2 +-
9
target/arm/cpu.h | 3 +++
56
1 file changed, 1 insertion(+), 1 deletion(-)
10
1 file changed, 3 insertions(+)
57
11
58
diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
12
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
59
index XXXXXXX..XXXXXXX 100644
13
index XXXXXXX..XXXXXXX 100644
60
--- a/hw/misc/imx6_ccm.c
14
--- a/target/arm/cpu.h
61
+++ b/hw/misc/imx6_ccm.c
15
+++ b/target/arm/cpu.h
62
@@ -XXX,XX +XXX,XX @@ static void imx6_ccm_reset(DeviceState *dev)
16
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el3_or_mon(CPUARMState *env)
63
s->analog[PMU_REG_3P0] = 0x00000F74;
17
/* Return true if the processor is in secure state */
64
s->analog[PMU_REG_2P5] = 0x00005071;
18
static inline bool arm_is_secure(CPUARMState *env)
65
s->analog[PMU_REG_CORE] = 0x00402010;
19
{
66
- s->analog[PMU_MISC0] = 0x04000000;
20
+ if (arm_feature(env, ARM_FEATURE_M)) {
67
+ s->analog[PMU_MISC0] = 0x04000080;
21
+ return env->v7m.secure;
68
s->analog[PMU_MISC1] = 0x00000000;
22
+ }
69
s->analog[PMU_MISC2] = 0x00272727;
23
if (arm_is_el3_or_mon(env)) {
70
24
return true;
25
}
71
--
26
--
72
2.20.1
27
2.34.1
73
74
diff view generated by jsdifflib
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
In 50244cc76abc we updated mte_check_fail to match the ARM
3
M-profile doesn't have HCR_EL2. While we could test features
4
pseudocode, using the correct EL to select the TCF field.
4
before each call, zero is a generally safe return value to
5
But we failed to update MTE0_ACTIVE the same way, which led
5
disable the code in the caller. This test is required to
6
to g_assert_not_reached().
6
avoid an assert in arm_is_secure_below_el3.
7
7
8
Cc: qemu-stable@nongnu.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Buglink: https://bugs.launchpad.net/bugs/1907137
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11
Message-id: 20201221204426.88514-1-richard.henderson@linaro.org
10
Message-id: 20230227225832.816605-3-richard.henderson@linaro.org
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
12
---
15
target/arm/helper.c | 2 +-
13
target/arm/helper.c | 3 +++
16
1 file changed, 1 insertion(+), 1 deletion(-)
14
1 file changed, 3 insertions(+)
17
15
18
diff --git a/target/arm/helper.c b/target/arm/helper.c
16
diff --git a/target/arm/helper.c b/target/arm/helper.c
19
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/helper.c
18
--- a/target/arm/helper.c
21
+++ b/target/arm/helper.c
19
+++ b/target/arm/helper.c
22
@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
20
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
23
if (FIELD_EX32(flags, TBFLAG_A64, UNPRIV)
21
24
&& tbid
22
uint64_t arm_hcr_el2_eff(CPUARMState *env)
25
&& !(env->pstate & PSTATE_TCO)
23
{
26
- && (sctlr & SCTLR_TCF0)
24
+ if (arm_feature(env, ARM_FEATURE_M)) {
27
+ && (sctlr & SCTLR_TCF)
25
+ return 0;
28
&& allocation_tag_access_enabled(env, 0, sctlr)) {
26
+ }
29
flags = FIELD_DP32(flags, TBFLAG_A64, MTE0_ACTIVE, 1);
27
return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
30
}
28
}
29
31
--
30
--
32
2.20.1
31
2.34.1
33
34
diff view generated by jsdifflib
1
From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
Correct the indexing into s->cpu_ctlr for vCPUs.
3
In several places we use arm_is_secure_below_el3 and
4
arm_is_el3_or_mon separately from arm_is_secure.
5
These functions make no sense for m-profile, and
6
would indicate prior incorrect feature testing.
4
7
5
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
9
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
7
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20201214222154.3480243-2-edgar.iglesias@gmail.com
11
Message-id: 20230227225832.816605-4-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
13
---
11
hw/intc/arm_gic.c | 4 +++-
14
target/arm/cpu.h | 5 ++++-
12
1 file changed, 3 insertions(+), 1 deletion(-)
15
1 file changed, 4 insertions(+), 1 deletion(-)
13
16
14
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
17
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
15
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/intc/arm_gic.c
19
--- a/target/arm/cpu.h
17
+++ b/hw/intc/arm_gic.c
20
+++ b/target/arm/cpu.h
18
@@ -XXX,XX +XXX,XX @@ static inline void gic_get_best_virq(GICState *s, int cpu,
21
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
19
static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,
22
void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
20
int group_mask)
23
24
#if !defined(CONFIG_USER_ONLY)
25
-/* Return true if exception levels below EL3 are in secure state,
26
+/*
27
+ * Return true if exception levels below EL3 are in secure state,
28
* or would be following an exception return to that level.
29
* Unlike arm_is_secure() (which is always a question about the
30
* _current_ state of the CPU) this doesn't care about the current
31
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
32
*/
33
static inline bool arm_is_secure_below_el3(CPUARMState *env)
21
{
34
{
22
+ int cpu_iface = virt ? (cpu + GIC_NCPU) : cpu;
35
+ assert(!arm_feature(env, ARM_FEATURE_M));
23
+
36
if (arm_feature(env, ARM_FEATURE_EL3)) {
24
if (!virt && !(s->ctlr & group_mask)) {
37
return !(env->cp15.scr_el3 & SCR_NS);
25
return false;
38
} else {
26
}
39
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure_below_el3(CPUARMState *env)
27
@@ -XXX,XX +XXX,XX @@ static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,
40
/* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
28
return false;
41
static inline bool arm_is_el3_or_mon(CPUARMState *env)
29
}
42
{
30
43
+ assert(!arm_feature(env, ARM_FEATURE_M));
31
- if (!(s->cpu_ctlr[cpu] & group_mask)) {
44
if (arm_feature(env, ARM_FEATURE_EL3)) {
32
+ if (!(s->cpu_ctlr[cpu_iface] & group_mask)) {
45
if (is_a64(env) && extract32(env->pstate, 2, 2) == 3) {
33
return false;
46
/* CPU currently in AArch64 state and EL3 */
34
}
35
36
--
47
--
37
2.20.1
48
2.34.1
38
49
39
50
diff view generated by jsdifflib
1
From: Andrew Jones <drjones@redhat.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
virt machine's 'smp_cpus' and machine->smp.cpus must always have the
3
Integrate neighboring code from get_phys_addr_lpae which computed
4
same value. And, anywhere we have virt machine state we have machine
4
starting level, as it is easier to validate when doing both at the
5
state. So let's remove the redundancy. Also, to make it easier to see
5
same time. Mirror the checks at the start of AArch{64,32}.S2Walk,
6
that machine->smp is the true source for "smp_cpus" and "max_cpus",
6
especially S2InvalidSL and S2InconsistentSL.
7
avoid passing them in function parameters, preferring instead to get
7
8
them from the state.
8
This reverts 49ba115bb74, which was incorrect -- there is nothing
9
9
in the ARM pseudocode that depends on TxSZ, i.e. outputsize; the
10
No functional change intended.
10
pseudocode is consistent in referencing PAMax.
11
11
12
Signed-off-by: Andrew Jones <drjones@redhat.com>
12
Fixes: 49ba115bb74 ("target/arm: Pass outputsize down to check_s2_mmu_setup")
13
Reviewed-by: David Edmondson <david.edmondson@oracle.com>
13
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Ying Fang <fangying1@huawei.com>
14
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
15
Message-id: 20201215174815.51520-1-drjones@redhat.com
15
Message-id: 20230227225832.816605-5-richard.henderson@linaro.org
16
[PMM: minor formatting tweak to smp_cpus variable declaration]
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
---
17
---
19
include/hw/arm/virt.h | 3 +--
18
target/arm/ptw.c | 173 ++++++++++++++++++++++++++---------------------
20
hw/arm/virt-acpi-build.c | 9 +++++----
19
1 file changed, 97 insertions(+), 76 deletions(-)
21
hw/arm/virt.c | 21 ++++++++++-----------
20
22
3 files changed, 16 insertions(+), 17 deletions(-)
21
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
23
24
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
25
index XXXXXXX..XXXXXXX 100644
22
index XXXXXXX..XXXXXXX 100644
26
--- a/include/hw/arm/virt.h
23
--- a/target/arm/ptw.c
27
+++ b/include/hw/arm/virt.h
24
+++ b/target/arm/ptw.c
28
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
25
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
29
MemMapEntry *memmap;
26
* check_s2_mmu_setup
30
char *pciehb_nodename;
27
* @cpu: ARMCPU
31
const int *irqmap;
28
* @is_aa64: True if the translation regime is in AArch64 state
32
- int smp_cpus;
29
- * @startlevel: Suggested starting level
33
void *fdt;
30
- * @inputsize: Bitsize of IPAs
34
int fdt_size;
31
+ * @tcr: VTCR_EL2 or VSTCR_EL2
35
uint32_t clock_phandle;
32
+ * @ds: Effective value of TCR.DS.
36
@@ -XXX,XX +XXX,XX @@ static inline int virt_gicv3_redist_region_count(VirtMachineState *vms)
33
+ * @iasize: Bitsize of IPAs
37
34
* @stride: Page-table stride (See the ARM ARM)
38
assert(vms->gic_version == VIRT_GIC_VERSION_3);
35
*
39
36
- * Returns true if the suggested S2 translation parameters are OK and
40
- return vms->smp_cpus > redist0_capacity ? 2 : 1;
37
- * false otherwise.
41
+ return MACHINE(vms)->smp.cpus > redist0_capacity ? 2 : 1;
38
+ * Decode the starting level of the S2 lookup, returning INT_MIN if
39
+ * the configuration is invalid.
40
*/
41
-static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
42
- int inputsize, int stride, int outputsize)
43
+static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
44
+ bool ds, int iasize, int stride)
45
{
46
- const int grainsize = stride + 3;
47
- int startsizecheck;
48
-
49
- /*
50
- * Negative levels are usually not allowed...
51
- * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
52
- * begins with level -1. Note that previous feature tests will have
53
- * eliminated this combination if it is not enabled.
54
- */
55
- if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
56
- return false;
57
- }
58
-
59
- startsizecheck = inputsize - ((3 - level) * stride + grainsize);
60
- if (startsizecheck < 1 || startsizecheck > stride + 4) {
61
- return false;
62
- }
63
+ int sl0, sl2, startlevel, granulebits, levels;
64
+ int s1_min_iasize, s1_max_iasize;
65
66
+ sl0 = extract32(tcr, 6, 2);
67
if (is_aa64) {
68
+ /*
69
+ * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
70
+ * get_phys_addr_lpae, that used aa64_va_parameters which apply
71
+ * to aarch64. If Stage1 is aarch32, the min_txsz is larger.
72
+ * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
73
+ * inputsize is 64 - 24 = 40.
74
+ */
75
+ if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
76
+ goto fail;
77
+ }
78
+
79
+ /*
80
+ * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
81
+ * so interleave AArch64.S2StartLevel.
82
+ */
83
switch (stride) {
84
- case 13: /* 64KB Pages. */
85
- if (level == 0 || (level == 1 && outputsize <= 42)) {
86
- return false;
87
+ case 9: /* 4KB */
88
+ /* SL2 is RES0 unless DS=1 & 4KB granule. */
89
+ sl2 = extract64(tcr, 33, 1);
90
+ if (ds && sl2) {
91
+ if (sl0 != 0) {
92
+ goto fail;
93
+ }
94
+ startlevel = -1;
95
+ } else {
96
+ startlevel = 2 - sl0;
97
+ switch (sl0) {
98
+ case 2:
99
+ if (arm_pamax(cpu) < 44) {
100
+ goto fail;
101
+ }
102
+ break;
103
+ case 3:
104
+ if (!cpu_isar_feature(aa64_st, cpu)) {
105
+ goto fail;
106
+ }
107
+ startlevel = 3;
108
+ break;
109
+ }
110
}
111
break;
112
- case 11: /* 16KB Pages. */
113
- if (level == 0 || (level == 1 && outputsize <= 40)) {
114
- return false;
115
+ case 11: /* 16KB */
116
+ switch (sl0) {
117
+ case 2:
118
+ if (arm_pamax(cpu) < 42) {
119
+ goto fail;
120
+ }
121
+ break;
122
+ case 3:
123
+ if (!ds) {
124
+ goto fail;
125
+ }
126
+ break;
127
}
128
+ startlevel = 3 - sl0;
129
break;
130
- case 9: /* 4KB Pages. */
131
- if (level == 0 && outputsize <= 42) {
132
- return false;
133
+ case 13: /* 64KB */
134
+ switch (sl0) {
135
+ case 2:
136
+ if (arm_pamax(cpu) < 44) {
137
+ goto fail;
138
+ }
139
+ break;
140
+ case 3:
141
+ goto fail;
142
}
143
+ startlevel = 3 - sl0;
144
break;
145
default:
146
g_assert_not_reached();
147
}
148
-
149
- /* Inputsize checks. */
150
- if (inputsize > outputsize &&
151
- (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
152
- /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */
153
- return false;
154
- }
155
} else {
156
- /* AArch32 only supports 4KB pages. Assert on that. */
157
+ /*
158
+ * Things are simpler for AArch32 EL2, with only 4k pages.
159
+ * There is no separate S2InvalidSL function, but AArch32.S2Walk
160
+ * begins with walkparms.sl0 in {'1x'}.
161
+ */
162
assert(stride == 9);
163
-
164
- if (level == 0) {
165
- return false;
166
+ if (sl0 >= 2) {
167
+ goto fail;
168
}
169
+ startlevel = 2 - sl0;
170
}
171
- return true;
172
+
173
+ /* AArch{64,32}.S2InconsistentSL are functionally equivalent. */
174
+ levels = 3 - startlevel;
175
+ granulebits = stride + 3;
176
+
177
+ s1_min_iasize = levels * stride + granulebits + 1;
178
+ s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
179
+
180
+ if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
181
+ return startlevel;
182
+ }
183
+
184
+ fail:
185
+ return INT_MIN;
42
}
186
}
43
187
44
#endif /* QEMU_ARM_VIRT_H */
188
/**
45
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
189
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
46
index XXXXXXX..XXXXXXX 100644
190
*/
47
--- a/hw/arm/virt-acpi-build.c
191
level = 4 - (inputsize - 4) / stride;
48
+++ b/hw/arm/virt-acpi-build.c
192
} else {
49
@@ -XXX,XX +XXX,XX @@
193
- /*
50
194
- * For stage 2 translations the starting level is specified by the
51
#define ACPI_BUILD_TABLE_SIZE 0x20000
195
- * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
52
196
- */
53
-static void acpi_dsdt_add_cpus(Aml *scope, int smp_cpus)
197
- uint32_t sl0 = extract32(tcr, 6, 2);
54
+static void acpi_dsdt_add_cpus(Aml *scope, VirtMachineState *vms)
198
- uint32_t sl2 = extract64(tcr, 33, 1);
55
{
199
- int32_t startlevel;
56
+ MachineState *ms = MACHINE(vms);
200
- bool ok;
57
uint16_t i;
201
-
58
202
- /* SL2 is RES0 unless DS=1 & 4kb granule. */
59
- for (i = 0; i < smp_cpus; i++) {
203
- if (param.ds && stride == 9 && sl2) {
60
+ for (i = 0; i < ms->smp.cpus; i++) {
204
- if (sl0 != 0) {
61
Aml *dev = aml_device("C%.03X", i);
205
- level = 0;
62
aml_append(dev, aml_name_decl("_HID", aml_string("ACPI0007")));
206
- goto do_translation_fault;
63
aml_append(dev, aml_name_decl("_UID", aml_int(i)));
207
- }
64
@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
208
- startlevel = -1;
65
gicd->base_address = cpu_to_le64(memmap[VIRT_GIC_DIST].base);
209
- } else if (!aarch64 || stride == 9) {
66
gicd->version = vms->gic_version;
210
- /* AArch32 or 4KB pages */
67
211
- startlevel = 2 - sl0;
68
- for (i = 0; i < vms->smp_cpus; i++) {
212
-
69
+ for (i = 0; i < MACHINE(vms)->smp.cpus; i++) {
213
- if (cpu_isar_feature(aa64_st, cpu)) {
70
AcpiMadtGenericCpuInterface *gicc = acpi_data_push(table_data,
214
- startlevel &= 3;
71
sizeof(*gicc));
215
- }
72
ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
216
- } else {
73
@@ -XXX,XX +XXX,XX @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
217
- /* 16KB or 64KB pages */
74
* the RTC ACPI device at all when using UEFI.
218
- startlevel = 3 - sl0;
75
*/
219
- }
76
scope = aml_scope("\\_SB");
220
-
77
- acpi_dsdt_add_cpus(scope, vms->smp_cpus);
221
- /* Check that the starting level is valid. */
78
+ acpi_dsdt_add_cpus(scope, vms);
222
- ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
79
acpi_dsdt_add_uart(scope, &memmap[VIRT_UART],
223
- inputsize, stride, outputsize);
80
(irqmap[VIRT_UART] + ARM_SPI_BASE));
224
- if (!ok) {
81
if (vmc->acpi_expose_flash) {
225
+ int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
82
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
226
+ inputsize, stride);
83
index XXXXXXX..XXXXXXX 100644
227
+ if (startlevel == INT_MIN) {
84
--- a/hw/arm/virt.c
228
+ level = 0;
85
+++ b/hw/arm/virt.c
229
goto do_translation_fault;
86
@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
87
if (vms->gic_version == VIRT_GIC_VERSION_2) {
88
irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
89
GIC_FDT_IRQ_PPI_CPU_WIDTH,
90
- (1 << vms->smp_cpus) - 1);
91
+ (1 << MACHINE(vms)->smp.cpus) - 1);
92
}
93
94
qemu_fdt_add_subnode(vms->fdt, "/timer");
95
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
96
int cpu;
97
int addr_cells = 1;
98
const MachineState *ms = MACHINE(vms);
99
+ int smp_cpus = ms->smp.cpus;
100
101
/*
102
* From Documentation/devicetree/bindings/arm/cpus.txt
103
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
104
* The simplest way to go is to examine affinity IDs of all our CPUs. If
105
* at least one of them has Aff3 populated, we set #address-cells to 2.
106
*/
107
- for (cpu = 0; cpu < vms->smp_cpus; cpu++) {
108
+ for (cpu = 0; cpu < smp_cpus; cpu++) {
109
ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
110
111
if (armcpu->mp_affinity & ARM_AFF3_MASK) {
112
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
113
qemu_fdt_setprop_cell(vms->fdt, "/cpus", "#address-cells", addr_cells);
114
qemu_fdt_setprop_cell(vms->fdt, "/cpus", "#size-cells", 0x0);
115
116
- for (cpu = vms->smp_cpus - 1; cpu >= 0; cpu--) {
117
+ for (cpu = smp_cpus - 1; cpu >= 0; cpu--) {
118
char *nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
119
ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
120
CPUState *cs = CPU(armcpu);
121
@@ -XXX,XX +XXX,XX @@ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
122
qemu_fdt_setprop_string(vms->fdt, nodename, "compatible",
123
armcpu->dtb_compatible);
124
125
- if (vms->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED
126
- && vms->smp_cpus > 1) {
127
+ if (vms->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED && smp_cpus > 1) {
128
qemu_fdt_setprop_string(vms->fdt, nodename,
129
"enable-method", "psci");
130
}
230
}
131
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
231
level = startlevel;
132
if (vms->gic_version == VIRT_GIC_VERSION_2) {
133
irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
134
GIC_FDT_IRQ_PPI_CPU_WIDTH,
135
- (1 << vms->smp_cpus) - 1);
136
+ (1 << MACHINE(vms)->smp.cpus) - 1);
137
}
138
139
qemu_fdt_add_subnode(vms->fdt, "/pmu");
140
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
141
* virt_cpu_post_init() must be called after the CPUs have
142
* been realized and the GIC has been created.
143
*/
144
-static void virt_cpu_post_init(VirtMachineState *vms, int max_cpus,
145
- MemoryRegion *sysmem)
146
+static void virt_cpu_post_init(VirtMachineState *vms, MemoryRegion *sysmem)
147
{
148
+ int max_cpus = MACHINE(vms)->smp.max_cpus;
149
bool aarch64, pmu, steal_time;
150
CPUState *cpu;
151
152
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
153
exit(1);
154
}
155
156
- vms->smp_cpus = smp_cpus;
157
-
158
if (vms->virt && kvm_enabled()) {
159
error_report("mach-virt: KVM does not support providing "
160
"Virtualization extensions to the guest CPU");
161
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
162
create_fdt(vms);
163
164
possible_cpus = mc->possible_cpu_arch_ids(machine);
165
+ assert(possible_cpus->len == max_cpus);
166
for (n = 0; n < possible_cpus->len; n++) {
167
Object *cpuobj;
168
CPUState *cs;
169
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
170
171
create_gic(vms);
172
173
- virt_cpu_post_init(vms, possible_cpus->len, sysmem);
174
+ virt_cpu_post_init(vms, sysmem);
175
176
fdt_add_pmu_nodes(vms);
177
178
--
232
--
179
2.20.1
233
2.34.1
180
181
diff view generated by jsdifflib
Deleted patch
1
In commit 64f863baeedc8659 we implemented the v8.1M FPCXT_S register,
2
but we got the write behaviour wrong. On read, this register reads
3
bits [27:0] of FPSCR plus the CONTROL.SFPA bit. On write, it doesn't
4
just write back those bits -- it writes a value to the whole FPSCR,
5
whose upper 4 bits are zeroes.
6
1
7
We also incorrectly implemented the write-to-FPSCR as a simple store
8
to vfp.xregs; this skips the "update the softfloat flags" part of
9
the vfp_set_fpscr helper so the value would read back correctly but
10
not actually take effect.
11
12
Fix both of these things by doing a complete write to the FPSCR
13
using the helper function.
14
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
17
Message-id: 20201210201433.26262-3-peter.maydell@linaro.org
18
---
19
target/arm/translate-vfp.c.inc | 12 ++++++------
20
1 file changed, 6 insertions(+), 6 deletions(-)
21
22
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
23
index XXXXXXX..XXXXXXX 100644
24
--- a/target/arm/translate-vfp.c.inc
25
+++ b/target/arm/translate-vfp.c.inc
26
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
27
}
28
case ARM_VFP_FPCXT_S:
29
{
30
- TCGv_i32 sfpa, control, fpscr;
31
- /* Set FPSCR[27:0] and CONTROL.SFPA from value */
32
+ TCGv_i32 sfpa, control;
33
+ /*
34
+ * Set FPSCR and CONTROL.SFPA from value; the new FPSCR takes
35
+ * bits [27:0] from value and zeroes bits [31:28].
36
+ */
37
tmp = loadfn(s, opaque);
38
sfpa = tcg_temp_new_i32();
39
tcg_gen_shri_i32(sfpa, tmp, 31);
40
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
41
tcg_gen_deposit_i32(control, control, sfpa,
42
R_V7M_CONTROL_SFPA_SHIFT, 1);
43
store_cpu_field(control, v7m.control[M_REG_S]);
44
- fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
45
- tcg_gen_andi_i32(fpscr, fpscr, FPCR_NZCV_MASK);
46
tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
47
- tcg_gen_or_i32(fpscr, fpscr, tmp);
48
- store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);
49
+ gen_helper_vfp_set_fpscr(cpu_env, tmp);
50
tcg_temp_free_i32(tmp);
51
tcg_temp_free_i32(sfpa);
52
break;
53
--
54
2.20.1
55
56
diff view generated by jsdifflib
1
Currently timer_free() is a simple wrapper for g_free(). This means
1
From: Ard Biesheuvel <ardb@kernel.org>
2
that the timer being freed must not be currently active, as otherwise
3
QEMU might crash later when the active list is processed and still
4
has a pointer to freed memory on it. As a result almost all calls to
5
timer_free() are preceded by a timer_del() call, as can be seen in
6
the output of
7
git grep -B1 '\<timer_free\>'
8
2
9
This is unfortunate API design as it makes it easy to accidentally
3
Fedora 39 will ship its arm64 kernels in the new generic EFI zboot
10
misuse (by forgetting the timer_del()), and the correct use is
4
format, using gzip compression for the payload.
11
annoyingly verbose.
12
5
13
Make timer_free() imply a timer_del().
6
For doing EFI boot in QEMU, this is completely transparent, as the
7
firmware or bootloader will take care of this. However, for direct
8
kernel boot without firmware, we will lose the ability to boot such
9
distro kernels unless we deal with the new format directly.
14
10
11
EFI zboot images contain metadata in the header regarding the placement
12
of the compressed payload inside the image, and the type of compression
13
used. This means we can wire up the existing gzip support without too
14
much hassle, by parsing the header and grabbing the payload from inside
15
the loaded zboot image.
16
17
Cc: Peter Maydell <peter.maydell@linaro.org>
18
Cc: Alex Bennée <alex.bennee@linaro.org>
19
Cc: Richard Henderson <richard.henderson@linaro.org>
20
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
21
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
22
Message-id: 20230303160109.3626966-1-ardb@kernel.org
23
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
24
[PMM: tweaked comment formatting, fixed checkpatch nits]
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
25
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
17
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
18
Message-id: 20201215154107.3255-2-peter.maydell@linaro.org
19
---
26
---
20
include/qemu/timer.h | 24 +++++++++++++-----------
27
include/hw/loader.h | 19 ++++++++++
21
1 file changed, 13 insertions(+), 11 deletions(-)
28
hw/arm/boot.c | 6 +++
29
hw/core/loader.c | 91 +++++++++++++++++++++++++++++++++++++++++++++
30
3 files changed, 116 insertions(+)
22
31
23
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
32
diff --git a/include/hw/loader.h b/include/hw/loader.h
24
index XXXXXXX..XXXXXXX 100644
33
index XXXXXXX..XXXXXXX 100644
25
--- a/include/qemu/timer.h
34
--- a/include/hw/loader.h
26
+++ b/include/qemu/timer.h
35
+++ b/include/hw/loader.h
27
@@ -XXX,XX +XXX,XX @@ static inline QEMUTimer *timer_new_ms(QEMUClockType type, QEMUTimerCB *cb,
36
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
28
*/
37
uint8_t **buffer);
29
void timer_deinit(QEMUTimer *ts);
38
ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz);
30
31
-/**
32
- * timer_free:
33
- * @ts: the timer
34
- *
35
- * Free a timer (it must not be on the active list)
36
- */
37
-static inline void timer_free(QEMUTimer *ts)
38
-{
39
- g_free(ts);
40
-}
41
-
42
/**
43
* timer_del:
44
* @ts: the timer
45
@@ -XXX,XX +XXX,XX @@ static inline void timer_free(QEMUTimer *ts)
46
*/
47
void timer_del(QEMUTimer *ts);
48
39
49
+/**
40
+/**
50
+ * timer_free:
41
+ * unpack_efi_zboot_image:
51
+ * @ts: the timer
42
+ * @buffer: pointer to a variable holding the address of a buffer containing the
43
+ * image
44
+ * @size: pointer to a variable holding the size of the buffer
52
+ *
45
+ *
53
+ * Free a timer. This will call timer_del() for you to remove
46
+ * Check whether the buffer contains a EFI zboot image, and if it does, extract
54
+ * the timer from the active list if it was still active.
47
+ * the compressed payload and decompress it into a new buffer. If successful,
48
+ * the old buffer is freed, and the *buffer and size variables pointed to by the
49
+ * function arguments are updated to refer to the newly populated buffer.
50
+ *
51
+ * Returns 0 if the image could not be identified as a EFI zboot image.
52
+ * Returns -1 if the buffer contents were identified as a EFI zboot image, but
53
+ * unpacking failed for any reason.
54
+ * Returns the size of the decompressed payload if decompression was performed
55
+ * successfully.
55
+ */
56
+ */
56
+static inline void timer_free(QEMUTimer *ts)
57
+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size);
58
+
59
#define ELF_LOAD_FAILED -1
60
#define ELF_LOAD_NOT_ELF -2
61
#define ELF_LOAD_WRONG_ARCH -3
62
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
63
index XXXXXXX..XXXXXXX 100644
64
--- a/hw/arm/boot.c
65
+++ b/hw/arm/boot.c
66
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
67
return -1;
68
}
69
size = len;
70
+
71
+ /* Unpack the image if it is a EFI zboot image */
72
+ if (unpack_efi_zboot_image(&buffer, &size) < 0) {
73
+ g_free(buffer);
74
+ return -1;
75
+ }
76
}
77
78
/* check the arm64 magic header value -- very old kernels may not have it */
79
diff --git a/hw/core/loader.c b/hw/core/loader.c
80
index XXXXXXX..XXXXXXX 100644
81
--- a/hw/core/loader.c
82
+++ b/hw/core/loader.c
83
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
84
return bytes;
85
}
86
87
+/* The PE/COFF MS-DOS stub magic number */
88
+#define EFI_PE_MSDOS_MAGIC "MZ"
89
+
90
+/*
91
+ * The Linux header magic number for a EFI PE/COFF
92
+ * image targetting an unspecified architecture.
93
+ */
94
+#define EFI_PE_LINUX_MAGIC "\xcd\x23\x82\x81"
95
+
96
+/*
97
+ * Bootable Linux kernel images may be packaged as EFI zboot images, which are
98
+ * self-decompressing executables when loaded via EFI. The compressed payload
99
+ * can also be extracted from the image and decompressed by a non-EFI loader.
100
+ *
101
+ * The de facto specification for this format is at the following URL:
102
+ *
103
+ * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
104
+ *
105
+ * This definition is based on Linux upstream commit 29636a5ce87beba.
106
+ */
107
+struct linux_efi_zboot_header {
108
+ uint8_t msdos_magic[2]; /* PE/COFF 'MZ' magic number */
109
+ uint8_t reserved0[2];
110
+ uint8_t zimg[4]; /* "zimg" for Linux EFI zboot images */
111
+ uint32_t payload_offset; /* LE offset to compressed payload */
112
+ uint32_t payload_size; /* LE size of the compressed payload */
113
+ uint8_t reserved1[8];
114
+ char compression_type[32]; /* Compression type, NUL terminated */
115
+ uint8_t linux_magic[4]; /* Linux header magic */
116
+ uint32_t pe_header_offset; /* LE offset to the PE header */
117
+};
118
+
119
+/*
120
+ * Check whether *buffer points to a Linux EFI zboot image in memory.
121
+ *
122
+ * If it does, attempt to decompress it to a new buffer, and free the old one.
123
+ * If any of this fails, return an error to the caller.
124
+ *
125
+ * If the image is not a Linux EFI zboot image, do nothing and return success.
126
+ */
127
+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size)
57
+{
128
+{
58
+ timer_del(ts);
129
+ const struct linux_efi_zboot_header *header;
59
+ g_free(ts);
130
+ uint8_t *data = NULL;
131
+ int ploff, plsize;
132
+ ssize_t bytes;
133
+
134
+ /* ignore if this is too small to be a EFI zboot image */
135
+ if (*size < sizeof(*header)) {
136
+ return 0;
137
+ }
138
+
139
+ header = (struct linux_efi_zboot_header *)*buffer;
140
+
141
+ /* ignore if this is not a Linux EFI zboot image */
142
+ if (memcmp(&header->msdos_magic, EFI_PE_MSDOS_MAGIC, 2) != 0 ||
143
+ memcmp(&header->zimg, "zimg", 4) != 0 ||
144
+ memcmp(&header->linux_magic, EFI_PE_LINUX_MAGIC, 4) != 0) {
145
+ return 0;
146
+ }
147
+
148
+ if (strcmp(header->compression_type, "gzip") != 0) {
149
+ fprintf(stderr,
150
+ "unable to handle EFI zboot image with \"%.*s\" compression\n",
151
+ (int)sizeof(header->compression_type) - 1,
152
+ header->compression_type);
153
+ return -1;
154
+ }
155
+
156
+ ploff = ldl_le_p(&header->payload_offset);
157
+ plsize = ldl_le_p(&header->payload_size);
158
+
159
+ if (ploff < 0 || plsize < 0 || ploff + plsize > *size) {
160
+ fprintf(stderr, "unable to handle corrupt EFI zboot image\n");
161
+ return -1;
162
+ }
163
+
164
+ data = g_malloc(LOAD_IMAGE_MAX_GUNZIP_BYTES);
165
+ bytes = gunzip(data, LOAD_IMAGE_MAX_GUNZIP_BYTES, *buffer + ploff, plsize);
166
+ if (bytes < 0) {
167
+ fprintf(stderr, "failed to decompress EFI zboot image\n");
168
+ g_free(data);
169
+ return -1;
170
+ }
171
+
172
+ g_free(*buffer);
173
+ *buffer = g_realloc(data, bytes);
174
+ *size = bytes;
175
+ return bytes;
60
+}
176
+}
61
+
177
+
62
/**
178
/*
63
* timer_mod_ns:
179
* Functions for reboot-persistent memory regions.
64
* @ts: the timer
180
* - used for vga bios and option roms.
65
--
181
--
66
2.20.1
182
2.34.1
67
183
68
184
diff view generated by jsdifflib
Deleted patch
1
Now that timer_free() implicitly calls timer_del(), sequences
2
timer_del(mytimer);
3
timer_free(mytimer);
4
1
5
can be simplified to just
6
timer_free(mytimer);
7
8
Add a Coccinelle script to do this transformation.
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
12
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 20201215154107.3255-3-peter.maydell@linaro.org
15
---
16
scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++++++++++++++++
17
1 file changed, 18 insertions(+)
18
create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci
19
20
diff --git a/scripts/coccinelle/timer-del-timer-free.cocci b/scripts/coccinelle/timer-del-timer-free.cocci
21
new file mode 100644
22
index XXXXXXX..XXXXXXX
23
--- /dev/null
24
+++ b/scripts/coccinelle/timer-del-timer-free.cocci
25
@@ -XXX,XX +XXX,XX @@
26
+// Remove superfluous timer_del() calls
27
+//
28
+// Copyright Linaro Limited 2020
29
+// This work is licensed under the terms of the GNU GPLv2 or later.
30
+//
31
+// spatch --macro-file scripts/cocci-macro-file.h \
32
+// --sp-file scripts/coccinelle/timer-del-timer-free.cocci \
33
+// --in-place --dir .
34
+//
35
+// The timer_free() function now implicitly calls timer_del()
36
+// for you, so calls to timer_del() immediately before the
37
+// timer_free() of the same timer can be deleted.
38
+
39
+@@
40
+expression T;
41
+@@
42
+-timer_del(T);
43
+ timer_free(T);
44
--
45
2.20.1
46
47
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: qianfan Zhao <qianfanguijin@163.com>
2
2
3
When running device-introspect-test, a memory leak occurred in the
3
TWI_CNTR_INT_FLAG is W1C(write 1 to clear and write 0 has non-effect)
4
exynos4210_rtc_init function, so use ptimer_free() in the finalize function to
4
register on SUN6i based SoCs, we should lower interrupt when the guest
5
avoid it.
5
set this bit.
6
6
7
ASAN shows memory leak stack:
7
The linux kernel will hang in irq handler(mv64xxx_i2c_intr) if no
8
device connected on the i2c bus, next is the trace log:
8
9
9
Indirect leak of 96 byte(s) in 1 object(s) allocated from:
10
allwinner_i2c_write write CNTR(0x0c): 0xc4 A_ACK BUS_EN INT_EN
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
allwinner_i2c_write write CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
allwinner_i2c_read read CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
allwinner_i2c_read read STAT(0x10): 0x20 STAT_M_ADDR_WR_NACK
13
#3 0xaaabf57b3934 in exynos4210_rtc_init /qemu/hw/rtc/exynos4210_rtc.c:567
14
allwinner_i2c_write write CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
allwinner_i2c_write write CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
15
#5 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
16
allwinner_i2c_read read CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
16
#6 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
17
allwinner_i2c_read read STAT(0x10): 0xf8 STAT_IDLE
17
#7 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
18
allwinner_i2c_write write CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
18
#8 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
19
allwinner_i2c_write write CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
19
#9 0xaaabf6552708 in aio_bh_call /qemu/util/async.c:136
20
allwinner_i2c_read read CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
20
#10 0xaaabf6552708 in aio_bh_poll /qemu/util/async.c:164
21
allwinner_i2c_read read STAT(0x10): 0xf8 STAT_IDLE
21
#11 0xaaabf655f19c in aio_dispatch /qemu/util/aio-posix.c:381
22
...
22
#12 0xaaabf65523f4 in aio_ctx_dispatch /qemu/util/async.c:306
23
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
24
Fix it.
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
25
26
Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
27
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
28
Tested-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
29
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
30
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
31
---
29
hw/rtc/exynos4210_rtc.c | 9 +++++++++
32
include/hw/i2c/allwinner-i2c.h | 6 ++++++
30
1 file changed, 9 insertions(+)
33
hw/i2c/allwinner-i2c.c | 26 ++++++++++++++++++++++++--
34
2 files changed, 30 insertions(+), 2 deletions(-)
31
35
32
diff --git a/hw/rtc/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
36
diff --git a/include/hw/i2c/allwinner-i2c.h b/include/hw/i2c/allwinner-i2c.h
33
index XXXXXXX..XXXXXXX 100644
37
index XXXXXXX..XXXXXXX 100644
34
--- a/hw/rtc/exynos4210_rtc.c
38
--- a/include/hw/i2c/allwinner-i2c.h
35
+++ b/hw/rtc/exynos4210_rtc.c
39
+++ b/include/hw/i2c/allwinner-i2c.h
36
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
40
@@ -XXX,XX +XXX,XX @@
37
sysbus_init_mmio(dev, &s->iomem);
41
#include "qom/object.h"
38
}
42
39
43
#define TYPE_AW_I2C "allwinner.i2c"
40
+static void exynos4210_rtc_finalize(Object *obj)
44
+
45
+/** Allwinner I2C sun6i family and newer (A31, H2+, H3, etc) */
46
+#define TYPE_AW_I2C_SUN6I TYPE_AW_I2C "-sun6i"
47
+
48
OBJECT_DECLARE_SIMPLE_TYPE(AWI2CState, AW_I2C)
49
50
#define AW_I2C_MEM_SIZE 0x24
51
@@ -XXX,XX +XXX,XX @@ struct AWI2CState {
52
uint8_t srst;
53
uint8_t efr;
54
uint8_t lcr;
55
+
56
+ bool irq_clear_inverted;
57
};
58
59
#endif /* ALLWINNER_I2C_H */
60
diff --git a/hw/i2c/allwinner-i2c.c b/hw/i2c/allwinner-i2c.c
61
index XXXXXXX..XXXXXXX 100644
62
--- a/hw/i2c/allwinner-i2c.c
63
+++ b/hw/i2c/allwinner-i2c.c
64
@@ -XXX,XX +XXX,XX @@ static void allwinner_i2c_write(void *opaque, hwaddr offset,
65
s->stat = STAT_FROM_STA(STAT_IDLE);
66
s->cntr &= ~TWI_CNTR_M_STP;
67
}
68
- if ((s->cntr & TWI_CNTR_INT_FLAG) == 0) {
69
- /* Interrupt flag cleared */
70
+
71
+ if (!s->irq_clear_inverted && !(s->cntr & TWI_CNTR_INT_FLAG)) {
72
+ /* Write 0 to clear this flag */
73
+ qemu_irq_lower(s->irq);
74
+ } else if (s->irq_clear_inverted && (s->cntr & TWI_CNTR_INT_FLAG)) {
75
+ /* Write 1 to clear this flag */
76
+ s->cntr &= ~TWI_CNTR_INT_FLAG;
77
qemu_irq_lower(s->irq);
78
}
79
+
80
if ((s->cntr & TWI_CNTR_A_ACK) == 0) {
81
if (STAT_TO_STA(s->stat) == STAT_M_DATA_RX_ACK) {
82
s->stat = STAT_FROM_STA(STAT_M_DATA_RX_NACK);
83
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_i2c_type_info = {
84
.class_init = allwinner_i2c_class_init,
85
};
86
87
+static void allwinner_i2c_sun6i_init(Object *obj)
41
+{
88
+{
42
+ Exynos4210RTCState *s = EXYNOS4210_RTC(obj);
89
+ AWI2CState *s = AW_I2C(obj);
43
+
90
+
44
+ ptimer_free(s->ptimer);
91
+ s->irq_clear_inverted = true;
45
+ ptimer_free(s->ptimer_1Hz);
46
+}
92
+}
47
+
93
+
48
static void exynos4210_rtc_class_init(ObjectClass *klass, void *data)
94
+static const TypeInfo allwinner_i2c_sun6i_type_info = {
95
+ .name = TYPE_AW_I2C_SUN6I,
96
+ .parent = TYPE_SYS_BUS_DEVICE,
97
+ .instance_size = sizeof(AWI2CState),
98
+ .instance_init = allwinner_i2c_sun6i_init,
99
+ .class_init = allwinner_i2c_class_init,
100
+};
101
+
102
static void allwinner_i2c_register_types(void)
49
{
103
{
50
DeviceClass *dc = DEVICE_CLASS(klass);
104
type_register_static(&allwinner_i2c_type_info);
51
@@ -XXX,XX +XXX,XX @@ static const TypeInfo exynos4210_rtc_info = {
105
+ type_register_static(&allwinner_i2c_sun6i_type_info);
52
.parent = TYPE_SYS_BUS_DEVICE,
106
}
53
.instance_size = sizeof(Exynos4210RTCState),
107
54
.instance_init = exynos4210_rtc_init,
108
type_init(allwinner_i2c_register_types)
55
+ .instance_finalize = exynos4210_rtc_finalize,
56
.class_init = exynos4210_rtc_class_init,
57
};
58
59
--
109
--
60
2.20.1
110
2.34.1
61
62
diff view generated by jsdifflib
1
From: Gan Qixin <ganqixin@huawei.com>
1
From: qianfan Zhao <qianfanguijin@163.com>
2
2
3
When running device-introspect-test, a memory leak occurred in the
3
Allwinner h3 has 4 twi(i2c) devices named twi0, twi1, twi2 and r_twi.
4
digic_timer_init function, so use ptimer_free() in the finalize function to
4
The registers are compatible with TYPE_AW_I2C_SUN6I, write 1 to clear
5
avoid it.
5
control register's INT_FLAG bit.
6
6
7
ASAN shows memory leak stack:
7
Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
8
8
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
9
Indirect leak of 288 byte(s) in 3 object(s) allocated from:
10
#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
11
#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
12
#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432
13
#3 0xaaabf5b04084 in digic_timer_init /qemu/hw/timer/digic-timer.c:142
14
#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
15
#5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564
16
#6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547
17
#7 0xaaabf5b40e84 in digic_init /qemu/hw/arm/digic.c:46
18
#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515
19
#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729
20
#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153
21
#11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59
22
#12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110
23
24
Reported-by: Euler Robot <euler.robot@huawei.com>
25
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
26
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
11
---
29
hw/timer/digic-timer.c | 8 ++++++++
12
include/hw/arm/allwinner-h3.h | 6 ++++++
30
1 file changed, 8 insertions(+)
13
hw/arm/allwinner-h3.c | 29 +++++++++++++++++++++++++----
14
2 files changed, 31 insertions(+), 4 deletions(-)
31
15
32
diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
16
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
33
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
34
--- a/hw/timer/digic-timer.c
18
--- a/include/hw/arm/allwinner-h3.h
35
+++ b/hw/timer/digic-timer.c
19
+++ b/include/hw/arm/allwinner-h3.h
36
@@ -XXX,XX +XXX,XX @@ static void digic_timer_init(Object *obj)
20
@@ -XXX,XX +XXX,XX @@ enum {
37
sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
21
AW_H3_DEV_UART3,
22
AW_H3_DEV_EMAC,
23
AW_H3_DEV_TWI0,
24
+ AW_H3_DEV_TWI1,
25
+ AW_H3_DEV_TWI2,
26
AW_H3_DEV_DRAMCOM,
27
AW_H3_DEV_DRAMCTL,
28
AW_H3_DEV_DRAMPHY,
29
@@ -XXX,XX +XXX,XX @@ enum {
30
AW_H3_DEV_GIC_VCPU,
31
AW_H3_DEV_RTC,
32
AW_H3_DEV_CPUCFG,
33
+ AW_H3_DEV_R_TWI,
34
AW_H3_DEV_SDRAM
35
};
36
37
@@ -XXX,XX +XXX,XX @@ struct AwH3State {
38
AwSidState sid;
39
AwSdHostState mmc0;
40
AWI2CState i2c0;
41
+ AWI2CState i2c1;
42
+ AWI2CState i2c2;
43
+ AWI2CState r_twi;
44
AwSun8iEmacState emac;
45
AwRtcState rtc;
46
GICState gic;
47
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
48
index XXXXXXX..XXXXXXX 100644
49
--- a/hw/arm/allwinner-h3.c
50
+++ b/hw/arm/allwinner-h3.c
51
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
52
[AW_H3_DEV_UART2] = 0x01c28800,
53
[AW_H3_DEV_UART3] = 0x01c28c00,
54
[AW_H3_DEV_TWI0] = 0x01c2ac00,
55
+ [AW_H3_DEV_TWI1] = 0x01c2b000,
56
+ [AW_H3_DEV_TWI2] = 0x01c2b400,
57
[AW_H3_DEV_EMAC] = 0x01c30000,
58
[AW_H3_DEV_DRAMCOM] = 0x01c62000,
59
[AW_H3_DEV_DRAMCTL] = 0x01c63000,
60
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
61
[AW_H3_DEV_GIC_VCPU] = 0x01c86000,
62
[AW_H3_DEV_RTC] = 0x01f00000,
63
[AW_H3_DEV_CPUCFG] = 0x01f01c00,
64
+ [AW_H3_DEV_R_TWI] = 0x01f02400,
65
[AW_H3_DEV_SDRAM] = 0x40000000
66
};
67
68
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
69
{ "uart1", 0x01c28400, 1 * KiB },
70
{ "uart2", 0x01c28800, 1 * KiB },
71
{ "uart3", 0x01c28c00, 1 * KiB },
72
- { "twi1", 0x01c2b000, 1 * KiB },
73
- { "twi2", 0x01c2b400, 1 * KiB },
74
{ "scr", 0x01c2c400, 1 * KiB },
75
{ "gpu", 0x01c40000, 64 * KiB },
76
{ "hstmr", 0x01c60000, 4 * KiB },
77
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
78
{ "r_prcm", 0x01f01400, 1 * KiB },
79
{ "r_twd", 0x01f01800, 1 * KiB },
80
{ "r_cir-rx", 0x01f02000, 1 * KiB },
81
- { "r_twi", 0x01f02400, 1 * KiB },
82
{ "r_uart", 0x01f02800, 1 * KiB },
83
{ "r_pio", 0x01f02c00, 1 * KiB },
84
{ "r_pwm", 0x01f03800, 1 * KiB },
85
@@ -XXX,XX +XXX,XX @@ enum {
86
AW_H3_GIC_SPI_UART2 = 2,
87
AW_H3_GIC_SPI_UART3 = 3,
88
AW_H3_GIC_SPI_TWI0 = 6,
89
+ AW_H3_GIC_SPI_TWI1 = 7,
90
+ AW_H3_GIC_SPI_TWI2 = 8,
91
AW_H3_GIC_SPI_TIMER0 = 18,
92
AW_H3_GIC_SPI_TIMER1 = 19,
93
+ AW_H3_GIC_SPI_R_TWI = 44,
94
AW_H3_GIC_SPI_MMC0 = 60,
95
AW_H3_GIC_SPI_EHCI0 = 72,
96
AW_H3_GIC_SPI_OHCI0 = 73,
97
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
98
99
object_initialize_child(obj, "rtc", &s->rtc, TYPE_AW_RTC_SUN6I);
100
101
- object_initialize_child(obj, "twi0", &s->i2c0, TYPE_AW_I2C);
102
+ object_initialize_child(obj, "twi0", &s->i2c0, TYPE_AW_I2C_SUN6I);
103
+ object_initialize_child(obj, "twi1", &s->i2c1, TYPE_AW_I2C_SUN6I);
104
+ object_initialize_child(obj, "twi2", &s->i2c2, TYPE_AW_I2C_SUN6I);
105
+ object_initialize_child(obj, "r_twi", &s->r_twi, TYPE_AW_I2C_SUN6I);
38
}
106
}
39
107
40
+static void digic_timer_finalize(Object *obj)
108
static void allwinner_h3_realize(DeviceState *dev, Error **errp)
41
+{
109
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
42
+ DigicTimerState *s = DIGIC_TIMER(obj);
110
sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c0), 0,
111
qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI0));
112
113
+ sysbus_realize(SYS_BUS_DEVICE(&s->i2c1), &error_fatal);
114
+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c1), 0, s->memmap[AW_H3_DEV_TWI1]);
115
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c1), 0,
116
+ qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI1));
43
+
117
+
44
+ ptimer_free(s->ptimer);
118
+ sysbus_realize(SYS_BUS_DEVICE(&s->i2c2), &error_fatal);
45
+}
119
+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c2), 0, s->memmap[AW_H3_DEV_TWI2]);
120
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c2), 0,
121
+ qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI2));
46
+
122
+
47
static void digic_timer_class_init(ObjectClass *klass, void *class_data)
123
+ sysbus_realize(SYS_BUS_DEVICE(&s->r_twi), &error_fatal);
48
{
124
+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->r_twi), 0, s->memmap[AW_H3_DEV_R_TWI]);
49
DeviceClass *dc = DEVICE_CLASS(klass);
125
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->r_twi), 0,
50
@@ -XXX,XX +XXX,XX @@ static const TypeInfo digic_timer_info = {
126
+ qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_R_TWI));
51
.parent = TYPE_SYS_BUS_DEVICE,
127
+
52
.instance_size = sizeof(DigicTimerState),
128
/* Unimplemented devices */
53
.instance_init = digic_timer_init,
129
for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
54
+ .instance_finalize = digic_timer_finalize,
130
create_unimplemented_device(unimplemented[i].device_name,
55
.class_init = digic_timer_class_init,
56
};
57
58
--
131
--
59
2.20.1
132
2.34.1
60
61
diff view generated by jsdifflib