From 09bbdb89bc25660044c946137ec7ccb0d1fcee32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Thu, 28 Jan 2021 17:14:17 +0100 Subject: [PATCH 01/21] hw/intc/arm_gic: Allow to use QTest without crashing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Alexander reported an issue in gic_get_current_cpu() using the fuzzer. Yet another "deref current_cpu with QTest" bug, reproducible doing: $ echo readb 0xf03ff000 | qemu-system-arm -M npcm750-evb,accel=qtest -qtest stdio [I 1611849440.651452] OPENED [R +0.242498] readb 0xf03ff000 hw/intc/arm_gic.c:63:29: runtime error: member access within null pointer of type 'CPUState' (aka 'struct CPUState') SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/intc/arm_gic.c:63:29 in AddressSanitizer:DEADLYSIGNAL ================================================================= ==3719691==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000082a0 (pc 0x5618790ac882 bp 0x7ffca946f4f0 sp 0x7ffca946f4a0 T0) ==3719691==The signal is caused by a READ memory access. #0 0x5618790ac882 in gic_get_current_cpu hw/intc/arm_gic.c:63:29 #1 0x5618790a8901 in gic_dist_readb hw/intc/arm_gic.c:955:11 #2 0x5618790a7489 in gic_dist_read hw/intc/arm_gic.c:1158:17 #3 0x56187adc573b in memory_region_read_with_attrs_accessor softmmu/memory.c:464:9 #4 0x56187ad7903a in access_with_adjusted_size softmmu/memory.c:552:18 #5 0x56187ad766d6 in memory_region_dispatch_read1 softmmu/memory.c:1426:16 #6 0x56187ad758a8 in memory_region_dispatch_read softmmu/memory.c:1449:9 #7 0x56187b09e84c in flatview_read_continue softmmu/physmem.c:2822:23 #8 0x56187b0a0115 in flatview_read softmmu/physmem.c:2862:12 #9 0x56187b09fc9e in address_space_read_full softmmu/physmem.c:2875:18 #10 0x56187aa88633 in address_space_read include/exec/memory.h:2489:18 #11 0x56187aa88633 in qtest_process_command softmmu/qtest.c:558:13 #12 0x56187aa81881 in qtest_process_inbuf softmmu/qtest.c:797:9 #13 0x56187aa80e02 in qtest_read softmmu/qtest.c:809:5 current_cpu is NULL because QTest accelerator does not use CPU. Fix by skipping the check and returning the first CPU index when QTest accelerator is used, similarly to commit c781a2cc423 ("hw/i386/vmport: Allow QTest use without crashing"). Reported-by: Alexander Bulekov Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Darren Kenny Reviewed-by: Alexander Bulekov Message-id: 20210128161417.3726358-1-philmd@redhat.com Signed-off-by: Peter Maydell --- hw/intc/arm_gic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c index af41e2fb44..c33b1c8c4b 100644 --- a/hw/intc/arm_gic.c +++ b/hw/intc/arm_gic.c @@ -28,6 +28,7 @@ #include "qemu/module.h" #include "trace.h" #include "sysemu/kvm.h" +#include "sysemu/qtest.h" /* #define DEBUG_GIC */ @@ -57,7 +58,7 @@ static const uint8_t gic_id_gicv2[] = { static inline int gic_get_current_cpu(GICState *s) { - if (s->num_cpu > 1) { + if (!qtest_enabled() && s->num_cpu > 1) { return current_cpu->cpu_index; } return 0; From 40b4c2ae90e4f864a1015ff748a4af00518ff0c0 Mon Sep 17 00:00:00 2001 From: Iris Johnson Date: Thu, 28 Jan 2021 03:36:55 +0000 Subject: [PATCH 02/21] hw/char/exynos4210_uart: Fix buffer size reporting with FIFO disabled Currently the Exynos 4210 UART code always reports available FIFO space when the backend checks for buffer space. When the FIFO is disabled this is behavior causes the backend chardev code to replace the data before the guest can read it. This patch changes adds the logic to report the capacity properly when the FIFO is not being used. Buglink: https://bugs.launchpad.net/qemu/+bug/1913344 Signed-off-by: Iris Johnson Message-id: 20210128033655.1029577-1-iris@modwiz.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/char/exynos4210_uart.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c index 6361df2ad3..9b21d201b3 100644 --- a/hw/char/exynos4210_uart.c +++ b/hw/char/exynos4210_uart.c @@ -553,7 +553,11 @@ static int exynos4210_uart_can_receive(void *opaque) { Exynos4210UartState *s = (Exynos4210UartState *)opaque; - return fifo_empty_elements_number(&s->rx); + if (s->reg[I_(UFCON)] & UFCON_FIFO_ENABLE) { + return fifo_empty_elements_number(&s->rx); + } else { + return !(s->reg[I_(UTRSTAT)] & UTRSTAT_Rx_BUFFER_DATA_READY); + } } static void exynos4210_uart_receive(void *opaque, const uint8_t *buf, int size) From f2c0fb93a44972a96f93510311c93ff4c2c6fab5 Mon Sep 17 00:00:00 2001 From: Iris Johnson Date: Sat, 30 Jan 2021 18:40:17 +0000 Subject: [PATCH 03/21] hw/char/exynos4210_uart: Fix missing call to report ready for input When the frontend device has no space for a read the fd is removed from polling to allow time for the guest to read and clear the buffer. Without the call to qemu_chr_fe_accept_input(), the poll will not be broken out of when the guest has cleared the buffer causing significant IO delays that get worse with smaller buffers. Buglink: https://bugs.launchpad.net/qemu/+bug/1913341 Signed-off-by: Iris Johnson Message-id: 20210130184016.1787097-1-iris@modwiz.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/char/exynos4210_uart.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c index 9b21d201b3..80d401a379 100644 --- a/hw/char/exynos4210_uart.c +++ b/hw/char/exynos4210_uart.c @@ -519,6 +519,7 @@ static uint64_t exynos4210_uart_read(void *opaque, hwaddr offset, s->reg[I_(UTRSTAT)] &= ~UTRSTAT_Rx_BUFFER_DATA_READY; res = s->reg[I_(URXH)]; } + qemu_chr_fe_accept_input(&s->chr); exynos4210_uart_update_dmabusy(s); trace_exynos_uart_read(s->channel, offset, exynos4210_uart_regname(offset), res); From dcda883cd21125c699419a3fc0fe182ea989d9c4 Mon Sep 17 00:00:00 2001 From: Zenghui Yu Date: Sat, 30 Jan 2021 12:32:20 +0800 Subject: [PATCH 04/21] hw/arm/smmuv3: Fix addr_mask for range-based invalidation When handling guest range-based IOTLB invalidation, we should decode the TG field into the corresponding translation granule size so that we can pass the correct invalidation range to backend. Set @granule to (tg * 2 + 10) to properly emulate the architecture. Fixes: d52915616c05 ("hw/arm/smmuv3: Get prepared for range invalidation") Signed-off-by: Zenghui Yu Acked-by: Eric Auger Message-id: 20210130043220.1345-1-yuzenghui@huawei.com Signed-off-by: Peter Maydell --- hw/arm/smmuv3.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index bbca0e9f20..98b99d4fe8 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -801,7 +801,7 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr, { SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); IOMMUTLBEvent event; - uint8_t granule = tg; + uint8_t granule; if (!tg) { SMMUEventInfo event = {.inval_ste_allowed = true}; @@ -821,6 +821,8 @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr, return; } granule = tt->granule_sz; + } else { + granule = tg * 2 + 10; } event.type = IOMMU_NOTIFIER_UNMAP; From 1da79ecc7a299a6f3633876c8e49e5418ae37fcf Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Fri, 29 Jan 2021 21:23:14 +0800 Subject: [PATCH 05/21] hw/ssi: imx_spi: Use a macro for number of chip selects supported MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Avoid using a magic number (4) everywhere for the number of chip selects supported. Signed-off-by: Bin Meng Reviewed-by: Alistair Francis Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Juan Quintela Message-id: 20210129132323.30946-2-bmeng.cn@gmail.com Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 4 ++-- include/hw/ssi/imx_spi.h | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index d8885ae454..e605049a21 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -361,7 +361,7 @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value, /* We are in master mode */ - for (i = 0; i < 4; i++) { + for (i = 0; i < ECSPI_NUM_CS; i++) { qemu_set_irq(s->cs_lines[i], i == imx_spi_selected_channel(s) ? 0 : 1); } @@ -424,7 +424,7 @@ static void imx_spi_realize(DeviceState *dev, Error **errp) sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem); sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq); - for (i = 0; i < 4; ++i) { + for (i = 0; i < ECSPI_NUM_CS; ++i) { sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->cs_lines[i]); } diff --git a/include/hw/ssi/imx_spi.h b/include/hw/ssi/imx_spi.h index b82b17f364..eeaf49bbac 100644 --- a/include/hw/ssi/imx_spi.h +++ b/include/hw/ssi/imx_spi.h @@ -77,6 +77,9 @@ #define EXTRACT(value, name) extract32(value, name##_SHIFT, name##_LENGTH) +/* number of chip selects supported */ +#define ECSPI_NUM_CS 4 + #define TYPE_IMX_SPI "imx.spi" OBJECT_DECLARE_SIMPLE_TYPE(IMXSPIState, IMX_SPI) @@ -89,7 +92,7 @@ struct IMXSPIState { qemu_irq irq; - qemu_irq cs_lines[4]; + qemu_irq cs_lines[ECSPI_NUM_CS]; SSIBus *bus; From 3c9829e57468f3a53078aa2e10d35afde3208b36 Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Fri, 29 Jan 2021 21:23:15 +0800 Subject: [PATCH 06/21] hw/ssi: imx_spi: Remove imx_spi_update_irq() in imx_spi_reset() Usually the approach is that the device on the other end of the line is going to reset its state anyway, so there's no need to actively signal an irq line change during the reset hook. Move imx_spi_update_irq() out of imx_spi_reset(), to a new function imx_spi_soft_reset() that is called when the controller is disabled. Signed-off-by: Bin Meng Reviewed-by: Peter Maydell Message-id: 20210129132323.30946-3-bmeng.cn@gmail.com Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index e605049a21..4d488b159a 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -241,11 +241,16 @@ static void imx_spi_reset(DeviceState *dev) imx_spi_rxfifo_reset(s); imx_spi_txfifo_reset(s); - imx_spi_update_irq(s); - s->burst_length = 0; } +static void imx_spi_soft_reset(IMXSPIState *s) +{ + imx_spi_reset(DEVICE(s)); + + imx_spi_update_irq(s); +} + static uint64_t imx_spi_read(void *opaque, hwaddr offset, unsigned size) { uint32_t value = 0; @@ -351,8 +356,9 @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value, s->regs[ECSPI_CONREG] = value; if (!imx_spi_is_enabled(s)) { - /* device is disabled, so this is a reset */ - imx_spi_reset(DEVICE(s)); + /* device is disabled, so this is a soft reset */ + imx_spi_soft_reset(s); + return; } From 9c431a43a62255402a6bbe9a01b0464e73b30fe4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 29 Jan 2021 21:23:16 +0800 Subject: [PATCH 07/21] hw/ssi: imx_spi: Remove pointless variable initialization MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 'burst_length' is cleared in imx_spi_reset(), which is called after imx_spi_realize(). Remove the initialization to simplify. Reviewed-by: Juan Quintela Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Bin Meng Signed-off-by: Bin Meng Message-id: 20210129132323.30946-4-bmeng.cn@gmail.com Message-Id: <20210115153049.3353008-3-f4bug@amsat.org> Reviewed-by: Bin Meng Signed-off-by: Bin Meng Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 4d488b159a..8fb3c9b6d1 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -434,8 +434,6 @@ static void imx_spi_realize(DeviceState *dev, Error **errp) sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->cs_lines[i]); } - s->burst_length = 0; - fifo32_create(&s->tx_fifo, ECSPI_FIFO_SIZE); fifo32_create(&s->rx_fifo, ECSPI_FIFO_SIZE); } From 93722b6f6a6ef0ab0544f20440a2f6b951103dcb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 29 Jan 2021 21:23:17 +0800 Subject: [PATCH 08/21] hw/ssi: imx_spi: Rework imx_spi_reset() to keep CONREG register value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the block is disabled, all registers are reset with the exception of the ECSPI_CONREG. It is initialized to zero when the instance is created. Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM), chapter 21.7.3: Control Register (ECSPIx_CONREG) Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Bin Meng Reviewed-by: Philippe Mathieu-Daudé Message-id: 20210129132323.30946-5-bmeng.cn@gmail.com [bmeng: add a 'common_reset' function that does most of reset operation] Signed-off-by: Bin Meng Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 8fb3c9b6d1..e85be6ae60 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -228,15 +228,23 @@ static void imx_spi_flush_txfifo(IMXSPIState *s) fifo32_num_used(&s->tx_fifo), fifo32_num_used(&s->rx_fifo)); } -static void imx_spi_reset(DeviceState *dev) +static void imx_spi_common_reset(IMXSPIState *s) { - IMXSPIState *s = IMX_SPI(dev); + int i; - DPRINTF("\n"); - - memset(s->regs, 0, sizeof(s->regs)); - - s->regs[ECSPI_STATREG] = 0x00000003; + for (i = 0; i < ARRAY_SIZE(s->regs); i++) { + switch (i) { + case ECSPI_CONREG: + /* CONREG is not updated on soft reset */ + break; + case ECSPI_STATREG: + s->regs[i] = 0x00000003; + break; + default: + s->regs[i] = 0; + break; + } + } imx_spi_rxfifo_reset(s); imx_spi_txfifo_reset(s); @@ -246,11 +254,19 @@ static void imx_spi_reset(DeviceState *dev) static void imx_spi_soft_reset(IMXSPIState *s) { - imx_spi_reset(DEVICE(s)); + imx_spi_common_reset(s); imx_spi_update_irq(s); } +static void imx_spi_reset(DeviceState *dev) +{ + IMXSPIState *s = IMX_SPI(dev); + + imx_spi_common_reset(s); + s->regs[ECSPI_CONREG] = 0; +} + static uint64_t imx_spi_read(void *opaque, hwaddr offset, unsigned size) { uint32_t value = 0; From 7c87bb5333f0fdb17fee7e52acff1d915a68857e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 29 Jan 2021 21:23:18 +0800 Subject: [PATCH 09/21] hw/ssi: imx_spi: Rework imx_spi_read() to handle block disabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the block is disabled, it stay it is 'internal reset logic' (internal clocks are gated off). Reading any register returns its reset value. Only update this value if the device is enabled. Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM), chapter 21.7.3: Control Register (ECSPIx_CONREG) Reviewed-by: Juan Quintela Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Bin Meng Signed-off-by: Bin Meng Message-id: 20210129132323.30946-6-bmeng.cn@gmail.com Message-Id: <20210115153049.3353008-5-f4bug@amsat.org> Reviewed-by: Bin Meng Signed-off-by: Bin Meng Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 60 +++++++++++++++++++++++------------------------- 1 file changed, 29 insertions(+), 31 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index e85be6ae60..21e2c9dea3 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -279,42 +279,40 @@ static uint64_t imx_spi_read(void *opaque, hwaddr offset, unsigned size) return 0; } - switch (index) { - case ECSPI_RXDATA: - if (!imx_spi_is_enabled(s)) { - value = 0; - } else if (fifo32_is_empty(&s->rx_fifo)) { - /* value is undefined */ - value = 0xdeadbeef; - } else { - /* read from the RX FIFO */ - value = fifo32_pop(&s->rx_fifo); + value = s->regs[index]; + + if (imx_spi_is_enabled(s)) { + switch (index) { + case ECSPI_RXDATA: + if (fifo32_is_empty(&s->rx_fifo)) { + /* value is undefined */ + value = 0xdeadbeef; + } else { + /* read from the RX FIFO */ + value = fifo32_pop(&s->rx_fifo); + } + break; + case ECSPI_TXDATA: + qemu_log_mask(LOG_GUEST_ERROR, + "[%s]%s: Trying to read from TX FIFO\n", + TYPE_IMX_SPI, __func__); + + /* Reading from TXDATA gives 0 */ + break; + case ECSPI_MSGDATA: + qemu_log_mask(LOG_GUEST_ERROR, + "[%s]%s: Trying to read from MSG FIFO\n", + TYPE_IMX_SPI, __func__); + /* Reading from MSGDATA gives 0 */ + break; + default: + break; } - break; - case ECSPI_TXDATA: - qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Trying to read from TX FIFO\n", - TYPE_IMX_SPI, __func__); - - /* Reading from TXDATA gives 0 */ - - break; - case ECSPI_MSGDATA: - qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Trying to read from MSG FIFO\n", - TYPE_IMX_SPI, __func__); - - /* Reading from MSGDATA gives 0 */ - - break; - default: - value = s->regs[index]; - break; + imx_spi_update_irq(s); } - DPRINTF("reg[%s] => 0x%" PRIx32 "\n", imx_spi_reg_name(index), value); - imx_spi_update_irq(s); - return (uint64_t)value; } From fb116b5456c818ae7c3b788adcbc05dfa416c90c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 29 Jan 2021 21:23:19 +0800 Subject: [PATCH 10/21] hw/ssi: imx_spi: Rework imx_spi_write() to handle block disabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the block is disabled, only the ECSPI_CONREG register can be modified. Setting the EN bit enabled the device, clearing it "disables the block and resets the internal logic with the exception of the ECSPI_CONREG" register. Ignore all other registers write except ECSPI_CONREG when the block is disabled. Ref: i.MX 6DQ Applications Processor Reference Manual (IMX6DQRM), chapter 21.7.3: Control Register (ECSPIx_CONREG) Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Bin Meng Reviewed-by: Peter Maydell Message-id: 20210129132323.30946-7-bmeng.cn@gmail.com Message-Id: <20210115153049.3353008-6-f4bug@amsat.org> Signed-off-by: Bin Meng Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 21e2c9dea3..4cfbb73e35 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -332,6 +332,14 @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value, DPRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_spi_reg_name(index), (uint32_t)value); + if (!imx_spi_is_enabled(s)) { + /* Block is disabled */ + if (index != ECSPI_CONREG) { + /* Ignore access */ + return; + } + } + change_mask = s->regs[index] ^ value; switch (index) { @@ -340,10 +348,7 @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value, TYPE_IMX_SPI, __func__); break; case ECSPI_TXDATA: - if (!imx_spi_is_enabled(s)) { - /* Ignore writes if device is disabled */ - break; - } else if (fifo32_is_full(&s->tx_fifo)) { + if (fifo32_is_full(&s->tx_fifo)) { /* Ignore writes if queue is full */ break; } From 50dc25932eb31fca15104968e596b7035ce9ece1 Mon Sep 17 00:00:00 2001 From: Xuzhou Cheng Date: Fri, 29 Jan 2021 21:23:20 +0800 Subject: [PATCH 11/21] hw/ssi: imx_spi: Disable chip selects when controller is disabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a write to ECSPI_CONREG register to disable the SPI controller, imx_spi_soft_reset() is called to reset the controller, but chip select lines should have been disabled, otherwise the state machine of any devices (e.g.: SPI flashes) connected to the SPI master is stuck to its last state and responds incorrectly to any follow-up commands. Fixes: c906a3a01582 ("i.MX: Add the Freescale SPI Controller") Signed-off-by: Xuzhou Cheng Signed-off-by: Bin Meng Reviewed-by: Philippe Mathieu-Daudé Message-id: 20210129132323.30946-8-bmeng.cn@gmail.com Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 4cfbb73e35..2fb65498c3 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -254,9 +254,15 @@ static void imx_spi_common_reset(IMXSPIState *s) static void imx_spi_soft_reset(IMXSPIState *s) { + int i; + imx_spi_common_reset(s); imx_spi_update_irq(s); + + for (i = 0; i < ECSPI_NUM_CS; i++) { + qemu_set_irq(s->cs_lines[i], 1); + } } static void imx_spi_reset(DeviceState *dev) From 24bf8ef3f5300943940fd054763f92808f8481a0 Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Fri, 29 Jan 2021 21:23:21 +0800 Subject: [PATCH 12/21] hw/ssi: imx_spi: Round up the burst length to be multiple of 8 Current implementation of the imx spi controller expects the burst length to be multiple of 8, which is the most common use case. In case the burst length is not what we expect, log it to give user a chance to notice it, and round it up to be multiple of 8. Signed-off-by: Bin Meng Message-id: 20210129132323.30946-9-bmeng.cn@gmail.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 2fb65498c3..41fe199c9f 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -128,7 +128,14 @@ static uint8_t imx_spi_selected_channel(IMXSPIState *s) static uint32_t imx_spi_burst_length(IMXSPIState *s) { - return EXTRACT(s->regs[ECSPI_CONREG], ECSPI_CONREG_BURST_LENGTH) + 1; + uint32_t burst; + + burst = EXTRACT(s->regs[ECSPI_CONREG], ECSPI_CONREG_BURST_LENGTH) + 1; + if (burst % 8) { + burst = ROUND_UP(burst, 8); + } + + return burst; } static bool imx_spi_is_enabled(IMXSPIState *s) @@ -328,6 +335,7 @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value, IMXSPIState *s = opaque; uint32_t index = offset >> 2; uint32_t change_mask; + uint32_t burst; if (index >= ECSPI_MAX) { qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%" @@ -380,6 +388,13 @@ static void imx_spi_write(void *opaque, hwaddr offset, uint64_t value, case ECSPI_CONREG: s->regs[ECSPI_CONREG] = value; + burst = EXTRACT(s->regs[ECSPI_CONREG], ECSPI_CONREG_BURST_LENGTH) + 1; + if (burst % 8) { + qemu_log_mask(LOG_UNIMP, + "[%s]%s: burst length %d not supported: rounding up to next multiple of 8\n", + TYPE_IMX_SPI, __func__, burst); + } + if (!imx_spi_is_enabled(s)) { /* device is disabled, so this is a soft reset */ imx_spi_soft_reset(s); From 6ed924823c87999191776a2bd9a56efd3d83a387 Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Fri, 29 Jan 2021 21:23:22 +0800 Subject: [PATCH 13/21] hw/ssi: imx_spi: Correct the burst length > 32 bit transfer logic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For the ECSPIx_CONREG register BURST_LENGTH field, the manual says: 0x020 A SPI burst contains the 1 LSB in first word and all 32 bits in second word. 0x021 A SPI burst contains the 2 LSB in first word and all 32 bits in second word. Current logic uses either s->burst_length or 32, whichever smaller, to determine how many bits it should read from the tx fifo each time. For example, for a 48 bit burst length, current logic transfers the first 32 bit from the first word in the tx fifo, followed by a 16 bit from the second word in the tx fifo, which is wrong. The correct logic should be: transfer the first 16 bit from the first word in the tx fifo, followed by a 32 bit from the second word in the tx fifo. With this change, SPI flash can be successfully probed by U-Boot on imx6 sabrelite board. => sf probe SF: Detected sst25vf016b with page size 256 Bytes, erase size 4 KiB, total 2 MiB Fixes: c906a3a01582 ("i.MX: Add the Freescale SPI Controller") Signed-off-by: Bin Meng Reviewed-by: Philippe Mathieu-Daudé Message-id: 20210129132323.30946-10-bmeng.cn@gmail.com Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index 41fe199c9f..a34194c1b0 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -185,7 +185,7 @@ static void imx_spi_flush_txfifo(IMXSPIState *s) DPRINTF("data tx:0x%08x\n", tx); - tx_burst = MIN(s->burst_length, 32); + tx_burst = (s->burst_length % 32) ? : 32; rx = 0; From 8c495d1379211554208c58be75736e3be5ad60e8 Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Fri, 29 Jan 2021 21:23:23 +0800 Subject: [PATCH 14/21] hw/ssi: imx_spi: Correct tx and rx fifo endianness The endianness of data exchange between tx and rx fifo is incorrect. Earlier bytes are supposed to show up on MSB and later bytes on LSB, ie: in big endian. The manual does not explicitly say this, but the U-Boot and Linux driver codes have a swap on the data transferred to tx fifo and from rx fifo. With this change, U-Boot read from / write to SPI flash tests pass. => sf test 1ff000 1000 SPI flash test: 0 erase: 0 ticks, 4096000 KiB/s 32768.000 Mbps 1 check: 3 ticks, 1333 KiB/s 10.664 Mbps 2 write: 235 ticks, 17 KiB/s 0.136 Mbps 3 read: 2 ticks, 2000 KiB/s 16.000 Mbps Test passed 0 erase: 0 ticks, 4096000 KiB/s 32768.000 Mbps 1 check: 3 ticks, 1333 KiB/s 10.664 Mbps 2 write: 235 ticks, 17 KiB/s 0.136 Mbps 3 read: 2 ticks, 2000 KiB/s 16.000 Mbps Fixes: c906a3a01582 ("i.MX: Add the Freescale SPI Controller") Signed-off-by: Bin Meng Reviewed-by: Peter Maydell Message-id: 20210129132323.30946-11-bmeng.cn@gmail.com Signed-off-by: Peter Maydell --- hw/ssi/imx_spi.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c index a34194c1b0..189423bb3a 100644 --- a/hw/ssi/imx_spi.c +++ b/hw/ssi/imx_spi.c @@ -169,7 +169,6 @@ static void imx_spi_flush_txfifo(IMXSPIState *s) while (!fifo32_is_empty(&s->tx_fifo)) { int tx_burst = 0; - int index = 0; if (s->burst_length <= 0) { s->burst_length = imx_spi_burst_length(s); @@ -190,7 +189,7 @@ static void imx_spi_flush_txfifo(IMXSPIState *s) rx = 0; while (tx_burst > 0) { - uint8_t byte = tx & 0xff; + uint8_t byte = tx >> (tx_burst - 8); DPRINTF("writing 0x%02x\n", (uint32_t)byte); @@ -199,13 +198,11 @@ static void imx_spi_flush_txfifo(IMXSPIState *s) DPRINTF("0x%02x read\n", (uint32_t)byte); - tx = tx >> 8; - rx |= (byte << (index * 8)); + rx = (rx << 8) | byte; /* Remove 8 bits from the actual burst */ tx_burst -= 8; s->burst_length -= 8; - index++; } DPRINTF("data rx:0x%08x\n", rx); From edfe2eb4360cde4ed5d95bda7777edcb3510f76a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 11:34:01 +0100 Subject: [PATCH 15/21] hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per the ARM Generic Interrupt Controller Architecture specification (document "ARM IHI 0048B.b (ID072613)"), the SGIINTID field is 4 bit, not 10: - 4.3 Distributor register descriptions - 4.3.15 Software Generated Interrupt Register, GICD_SG - Table 4-21 GICD_SGIR bit assignments The Interrupt ID of the SGI to forward to the specified CPU interfaces. The value of this field is the Interrupt ID, in the range 0-15, for example a value of 0b0011 specifies Interrupt ID 3. Correct the irq mask to fix an undefined behavior (which eventually lead to a heap-buffer-overflow, see [Buglink]): $ echo 'writel 0x8000f00 0xff4affb0' | qemu-system-aarch64 -M virt,accel=qtest -qtest stdio [I 1612088147.116987] OPENED [R +0.278293] writel 0x8000f00 0xff4affb0 ../hw/intc/arm_gic.c:1498:13: runtime error: index 944 out of bounds for type 'uint8_t [16][8]' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../hw/intc/arm_gic.c:1498:13 This fixes a security issue when running with KVM on Arm with kernel-irqchip=off. (The default is kernel-irqchip=on, which is unaffected, and which is also the correct choice for performance.) Cc: qemu-stable@nongnu.org Fixes: CVE-2021-20221 Fixes: 9ee6e8bb853 ("ARMv7 support.") Buglink: https://bugs.launchpad.net/qemu/+bug/1913916 Buglink: https://bugs.launchpad.net/qemu/+bug/1913917 Reported-by: Alexander Bulekov Signed-off-by: Philippe Mathieu-Daudé Message-id: 20210131103401.217160-1-f4bug@amsat.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/intc/arm_gic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c index c33b1c8c4b..a994b1f024 100644 --- a/hw/intc/arm_gic.c +++ b/hw/intc/arm_gic.c @@ -1477,7 +1477,7 @@ static void gic_dist_writel(void *opaque, hwaddr offset, int target_cpu; cpu = gic_get_current_cpu(s); - irq = value & 0x3ff; + irq = value & 0xf; switch ((value >> 24) & 3) { case 0: mask = (value >> 16) & ALL_CPU_MASK; From 9e39983e5daeedcf1d34a4d53dcf71b637886bf5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 19:44:44 +0100 Subject: [PATCH 16/21] hw/arm/stm32f405_soc: Add missing dependency on OR_IRQ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The STM32F405 SoC uses an OR gate on its ADC IRQs. Fixes: 529fc5fd3e1 ("hw/arm: Add the STM32F4xx SoC") Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 20210131184449.382425-2-f4bug@amsat.org Signed-off-by: Peter Maydell --- hw/arm/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index 13cc42dcc8..a320a12485 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -336,6 +336,7 @@ config STM32F205_SOC config STM32F405_SOC bool select ARM_V7M + select OR_IRQ select STM32F4XX_SYSCFG select STM32F4XX_EXTI From 5900c7a6d4ca1f968f51f3639ade56dba111455e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 19:44:45 +0100 Subject: [PATCH 17/21] hw/arm/exynos4210: Add missing dependency on OR_IRQ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Exynos4210 SoC uses an OR gate on the PL330 IRQ lines. Fixes: dab15fbe2ab ("hw/arm/exynos4210: Fix DMA initialization") Signed-off-by: Philippe Mathieu-Daudé Message-id: 20210131184449.382425-3-f4bug@amsat.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/arm/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index a320a12485..223016bb4e 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -52,6 +52,7 @@ config EXYNOS4 select PTIMER select SDHCI select USB_EHCI_SYSBUS + select OR_IRQ config HIGHBANK bool From 6bfaec73a116e88c28ea91b10bc2a472aefcf957 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 19:44:46 +0100 Subject: [PATCH 18/21] hw/arm/xlnx-versal: Versal SoC requires ZDMA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Versal SoC instantiates the TYPE_XLNX_ZDMA object in versal_create_admas(). Introduce the XLNX_ZDMA configuration and select it to fix: $ qemu-system-aarch64 -M xlnx-versal-virt ... qemu-system-aarch64: missing object type 'xlnx.zdma' Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 20210131184449.382425-4-f4bug@amsat.org Signed-off-by: Peter Maydell --- hw/arm/Kconfig | 2 ++ hw/dma/Kconfig | 3 +++ hw/dma/meson.build | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index 223016bb4e..09298881f2 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -354,6 +354,7 @@ config XLNX_ZYNQMP_ARM select XILINX_AXI select XILINX_SPIPS select XLNX_ZYNQMP + select XLNX_ZDMA config XLNX_VERSAL bool @@ -362,6 +363,7 @@ config XLNX_VERSAL select CADENCE select VIRTIO_MMIO select UNIMP + select XLNX_ZDMA config NPCM7XX bool diff --git a/hw/dma/Kconfig b/hw/dma/Kconfig index d67492d36c..5d6be1a7a7 100644 --- a/hw/dma/Kconfig +++ b/hw/dma/Kconfig @@ -18,6 +18,9 @@ config ZYNQ_DEVCFG bool select REGISTER +config XLNX_ZDMA + bool + config STP2000 bool diff --git a/hw/dma/meson.build b/hw/dma/meson.build index b991d7698c..47b4a7cb47 100644 --- a/hw/dma/meson.build +++ b/hw/dma/meson.build @@ -9,7 +9,7 @@ softmmu_ss.add(when: 'CONFIG_ZYNQ_DEVCFG', if_true: files('xlnx-zynq-devcfg.c')) softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_dma.c')) softmmu_ss.add(when: 'CONFIG_STP2000', if_true: files('sparc32_dma.c')) softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx_dpdma.c')) -softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zdma.c')) +softmmu_ss.add(when: 'CONFIG_XLNX_ZDMA', if_true: files('xlnx-zdma.c')) softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_dma.c', 'soc_dma.c')) softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_dma.c')) softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_dma.c')) From 1de3b490179bedb253e0cf0fac659212175e4530 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 19:44:47 +0100 Subject: [PATCH 19/21] hw/arm/xlnx-versal: Versal SoC requires ZynqMP peripherals MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Versal SoC instantiates the TYPE_XLNX_ZYNQMP_RTC object in versal_create_rtc()(). Select CONFIG_XLNX_ZYNQMP to fix: $ make check-qtest-aarch64 ... Running test qtest-aarch64/qom-test qemu-system-aarch64: missing object type 'xlnx-zynmp.rtc' Broken pipe Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 20210131184449.382425-5-f4bug@amsat.org Signed-off-by: Peter Maydell --- hw/arm/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index 09298881f2..be017b997a 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -364,6 +364,7 @@ config XLNX_VERSAL select VIRTIO_MMIO select UNIMP select XLNX_ZDMA + select XLNX_ZYNQMP config NPCM7XX bool From e022f2a205b93f5c5203352c0482634b4ec705ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 19:44:48 +0100 Subject: [PATCH 20/21] hw/net/can: ZynqMP CAN device requires PTIMER MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a dependency XLNX_ZYNQMP -> PTIMER to fix: /usr/bin/ld: libcommon.fa.p/hw_net_can_xlnx-zynqmp-can.c.o: in function `xlnx_zynqmp_can_realize': hw/net/can/xlnx-zynqmp-can.c:1082: undefined reference to `ptimer_init' hw/net/can/xlnx-zynqmp-can.c:1085: undefined reference to `ptimer_transaction_begin' hw/net/can/xlnx-zynqmp-can.c:1087: undefined reference to `ptimer_set_freq' hw/net/can/xlnx-zynqmp-can.c:1088: undefined reference to `ptimer_set_limit' hw/net/can/xlnx-zynqmp-can.c:1089: undefined reference to `ptimer_run' hw/net/can/xlnx-zynqmp-can.c:1090: undefined reference to `ptimer_transaction_commit' libcommon.fa.p/hw_net_can_xlnx-zynqmp-can.c.o:(.data.rel+0x2c8): undefined reference to `vmstate_ptimer' Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 20210131184449.382425-6-f4bug@amsat.org Signed-off-by: Peter Maydell --- hw/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/Kconfig b/hw/Kconfig index 5ad3c6b5a4..d4cec9e476 100644 --- a/hw/Kconfig +++ b/hw/Kconfig @@ -81,3 +81,4 @@ config XLNX_ZYNQMP bool select REGISTER select CAN_BUS + select PTIMER From fd8f71b95da86f530aae3d02a14b0ccd9e024772 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 31 Jan 2021 19:44:49 +0100 Subject: [PATCH 21/21] hw/arm: Display CPU type in machine description MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Most of ARM machines display their CPU when QEMU list the available machines (-M help). Some machines do not. Fix to unify the help output. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Niek Linnenbank Reviewed-by: Alistair Francis Message-id: 20210131184449.382425-7-f4bug@amsat.org Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/arm/digic_boards.c | 2 +- hw/arm/microbit.c | 2 +- hw/arm/netduino2.c | 2 +- hw/arm/netduinoplus2.c | 2 +- hw/arm/orangepi.c | 2 +- hw/arm/stellaris.c | 4 ++-- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c index be12873673..6cdc1d83fc 100644 --- a/hw/arm/digic_boards.c +++ b/hw/arm/digic_boards.c @@ -142,7 +142,7 @@ static void canon_a1100_init(MachineState *machine) static void canon_a1100_machine_init(MachineClass *mc) { - mc->desc = "Canon PowerShot A1100 IS"; + mc->desc = "Canon PowerShot A1100 IS (ARM946)"; mc->init = &canon_a1100_init; mc->ignore_memory_transaction_failures = true; mc->default_ram_size = 64 * MiB; diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c index 0947491cb9..e9494334ce 100644 --- a/hw/arm/microbit.c +++ b/hw/arm/microbit.c @@ -64,7 +64,7 @@ static void microbit_machine_class_init(ObjectClass *oc, void *data) { MachineClass *mc = MACHINE_CLASS(oc); - mc->desc = "BBC micro:bit"; + mc->desc = "BBC micro:bit (Cortex-M0)"; mc->init = microbit_init; mc->max_cpus = 1; } diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c index 8f10334144..1733b71507 100644 --- a/hw/arm/netduino2.c +++ b/hw/arm/netduino2.c @@ -54,7 +54,7 @@ static void netduino2_init(MachineState *machine) static void netduino2_machine_init(MachineClass *mc) { - mc->desc = "Netduino 2 Machine"; + mc->desc = "Netduino 2 Machine (Cortex-M3)"; mc->init = netduino2_init; mc->ignore_memory_transaction_failures = true; } diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c index 68abd3ec69..d3ad7a2b67 100644 --- a/hw/arm/netduinoplus2.c +++ b/hw/arm/netduinoplus2.c @@ -55,7 +55,7 @@ static void netduinoplus2_init(MachineState *machine) static void netduinoplus2_machine_init(MachineClass *mc) { - mc->desc = "Netduino Plus 2 Machine"; + mc->desc = "Netduino Plus 2 Machine (Cortex-M4)"; mc->init = netduinoplus2_init; } diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c index d6306dfdda..40cdb5c6d2 100644 --- a/hw/arm/orangepi.c +++ b/hw/arm/orangepi.c @@ -113,7 +113,7 @@ static void orangepi_init(MachineState *machine) static void orangepi_machine_init(MachineClass *mc) { - mc->desc = "Orange Pi PC"; + mc->desc = "Orange Pi PC (Cortex-A7)"; mc->init = orangepi_init; mc->block_default_type = IF_SD; mc->units_per_default_bus = 1; diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c index ad72c0959f..27292ec411 100644 --- a/hw/arm/stellaris.c +++ b/hw/arm/stellaris.c @@ -1538,7 +1538,7 @@ static void lm3s811evb_class_init(ObjectClass *oc, void *data) { MachineClass *mc = MACHINE_CLASS(oc); - mc->desc = "Stellaris LM3S811EVB"; + mc->desc = "Stellaris LM3S811EVB (Cortex-M3)"; mc->init = lm3s811evb_init; mc->ignore_memory_transaction_failures = true; mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m3"); @@ -1554,7 +1554,7 @@ static void lm3s6965evb_class_init(ObjectClass *oc, void *data) { MachineClass *mc = MACHINE_CLASS(oc); - mc->desc = "Stellaris LM3S6965EVB"; + mc->desc = "Stellaris LM3S6965EVB (Cortex-M3)"; mc->init = lm3s6965evb_init; mc->ignore_memory_transaction_failures = true; mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m3");