Commit 7e133099 authored by alex@thinkpad's avatar alex@thinkpad
Browse files

QEMU: found out why DIGIC 6 models were getting stuck at startup!

The firmware was reading the memory layout from CP15 registers;
most of them were emulated well in QEMU, except ATCM and BTCM, which were implemented as NOP.
They are still NOP in current QEMU git.

Patching the memory regions loop is no longer required!
(keeping empty 80D patch for future use)

--HG--
branch : qemu
parent 46f2e6e1cbb0
......@@ -412,7 +412,7 @@ index 7cb01a8..57e3420 100644
p = str;
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 30739fc..9574387 100644
index 30739fc..1a7bcef 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -501,8 +501,9 @@ static void arm_cpu_initfn(Object *obj)
......@@ -527,15 +527,16 @@ index 30739fc..9574387 100644
static void arm946_initfn(Object *obj)
{
ARMCPU *cpu = ARM_CPU(obj);
@@ -914,9 +1009,15 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
@@ -914,9 +1009,16 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
/* Dummy the TCM region regs for the moment */
- { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
+ /* fixme: resetvalue hardcoded for DIGIC 6 */
+ { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
+ .access = PL1_RW, .type = ARM_CP_CONST },
+ .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c15_atcm), .resetvalue = 0x00000015 },
+ { .name = "BTCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
+ .access = PL1_RW, .type = ARM_CP_CONST },
+ .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c15_btcm), .resetvalue = 0x8000001D },
+ { .name = "INV_DCACHE", .cp = 15, .opc1 = 0, .crn = 15, .crm = 5, .opc2 = 0,
+ .access = PL1_RW, .type = ARM_CP_CONST },
+ { .name = "BUILDOPTS", .cp = 15, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = CP_ANY,
......@@ -545,7 +546,7 @@ index 30739fc..9574387 100644
.access = PL1_RW, .type = ARM_CP_CONST },
REGINFO_SENTINEL
};
@@ -1328,6 +1429,8 @@ typedef struct ARMCPUInfo {
@@ -1328,6 +1430,8 @@ typedef struct ARMCPUInfo {
static const ARMCPUInfo arm_cpus[] = {
#if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
{ .name = "arm926", .initfn = arm926_initfn },
......@@ -554,6 +555,20 @@ index 30739fc..9574387 100644
{ .name = "arm946", .initfn = arm946_initfn },
{ .name = "arm1026", .initfn = arm1026_initfn },
/* What QEMU calls "arm1136-r2" is actually the 1136 r0p2, i.e. an
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 815fef8..3904787 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -389,6 +389,9 @@ typedef struct CPUARMState {
uint64_t pmccfiltr_el0; /* Performance Monitor Filter Register */
uint64_t vpidr_el2; /* Virtualization Processor ID Register */
uint64_t vmpidr_el2; /* Virtualization Multiprocessor ID Register */
+
+ uint32_t c15_atcm;
+ uint32_t c15_btcm;
} cp15;
struct {
diff --git a/target-arm/helper.c b/target-arm/helper.c
index afc4163..46cd503 100644
--- a/target-arm/helper.c
......
......@@ -3,9 +3,6 @@
source patch-header.gdb
# infinite loop (memory regions related?)
set *(int*)0xFE28AAF0 = 0x4770
# infinite loop (not sure why)
set *(int*)0xFE28AA6C = 0x4770
......
......@@ -3,7 +3,4 @@
source patch-header.gdb
# infinite loop (memory regions related?)
set *(int*)0xFE237EB0 = 0x4770
source patch-footer.gdb
68bd69f6537e88c4a0a351ca42511ad1 calls-main.log
f3e42d701871e13584ec0317fee7ac4b calls-main.idc
8c694014e671a1df2944e304738211ee calls-main-basic.log
b47e43913f1bda86a7b0b446a6832ec5 calls-main-basic.idc
13b0dadb85d34f9f94ead45dbbc9c8f9 calls-main.log
4c729e740c066f58a74897c791e713ae calls-main.idc
f1dd20b9db616fac71b7c1701d9fdeae calls-main-basic.log
3ea0ad36fadbaaaa802575e089588716 calls-main-basic.idc
25c4cbd6d97d5e25783ab26ec5875534 calls-main.log
29edd8adc82a417fcffcb7ec50c6f46c calls-main.log
ff6f7f42065ba8f8927b5db64b3b07ec calls-main.idc
f7665b549aabd00c2c772eb044a8d560 calls-main-basic.log
373c363188efd61db44fa96f8d5c6dce calls-main-basic.log
da4bdc6fe5c6d996d282758d961e25f4 calls-main-basic.idc
d56214296fc0420beccd82f8d1ada76a calls-main.log
0b2f53015bdebef3d891f16b125eaa86 calls-main.idc
02fdf85d085b1bd421912a48d3395412 calls-main-basic.log
d6bc642220d4025bac89289507b291d3 calls-main-basic.idc
e57669aecc4fe1343f429ca3f733ca3e calls-main.log
cef0dc83eb6e64beb529afcb65768aee calls-main.idc
fc61d77dad4387b3b956b8749fc55356 calls-main-basic.log
5681ddb9a085a93e57ada0a7d7e3959d calls-main-basic.idc
9a97d772b42d266ba72eea3bcaa51a88 calls-main.log
de9714d8276b2689cd84ac56ab2ebf6f calls-main.idc
7c04c2ab9ef686f4d5cad3dc32829a00 calls-main-basic.log
caea58e2a1b4ac58cac101f78d7f0b1e calls-main-basic.idc
1e8d1c2a7c96f380037ad7f03bce83c0 calls-main.log
813115fbfb5bdcf956916431270c2709 calls-main.idc
b8f71263d8635494e6025584515b8da5 calls-main-basic.log
37e0073382bc61be3ebd3296ed3b4b31 calls-main-basic.idc
5a59b401893b3eeaf4da6a4cba5fc307 calls-main.log
653c706e6b124a19b41d4a2b5c538fbf calls-main.idc
84c1c4faac83867e050c2f8581906556 calls-main-basic.log
68211dba75a9f7f66717aec8b0350ea0 calls-main-basic.idc
94b5f78bbd57d0d0674fce1117f071e3 calls-main.log
67200fb32638ae8e70fa1300a894c2c8 calls-main.idc
6537376ac6ce40944d317ef18a9a4646 calls-main-basic.log
54f403156c70b6944da2f6d87ebc4b21 calls-main-basic.idc
c0e8de748466dfe9741239c57080128d calls-main.log
d97724c7e86551b886b306fed8ef1d69 calls-main.idc
7b83d28fb8ddd219cfe08b13ccf60d83 calls-main-basic.log
72013bbaf69a4e9ccac033db3655c778 calls-main-basic.idc
5a820cfa81e72e2c940c4eb84d622fc1 calls-main.log
2229b64cbc4e88dc6042cd4c41e5176c calls-main.idc
0a93c6cd3543eecee78c0f23acb23ff2 calls-main-basic.log
3783e342f92b9d74d906d8310bb4cf46 calls-main-basic.idc
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment