ZEVORN.blog

September 29, 2024

QEMU 开源社区贡献日志

qemu6.2 min to read

前言

我的 QEMU 开源社区贡献之旅,从泰晓科技发起的“ RISCV-Linux 内核剖析项目” 这里启程,我申领了 2023 年 8 月份蒙斌老师发布的老师提案:QEMU 模拟器 ignore_memory_transaction_failures 废弃

下面按照日期倒序排版。


废弃 zynq 板卡的 ignore_memory_transaction_failures

PATCH v4(2024-10-07)

Peter Maydell 认为按照 memory map 范围去标定占位符,和基于 ignore_memory_transaction_failures 标志没有什么区别,所以痛定思痛,还是老老实实按照手册,把所有未实现设备都添加一个占位符。

这个过程还发现了 devcfg 的一个 bug ,unlock 寄存器写入任何非 0x757BDF0D 值,都会设置为非法访问状态:

Unlock Register: This register is used to protect the DEVCI configuration registers from ROM code corruption. The boot ROM will unlock the DEVCI by writing 0x757BDF0D to this register. Writing anything other than the unlock word to this register will cause an illegal access state and make the DEVCI inaccessible until a system reset occurs.

此寄存器用于防止 DEVCI 配置寄存器被 ROM 代码损坏。在设备启动过程中,引导 ROM 会通过向此寄存器写入特定的解锁码 0x757BDF0D 来解锁 DEVCI 。如果写入任何不同于这个解锁码的值,将会导致非法访问状态,并且直到系统复位之前都无法访问 DEVCI 。

在硬件设计和嵌入式系统中,这样的机制是为了确保只有在正确的条件下才能更改配置设置,从而防止意外或恶意的数据损坏。这对于保证系统的稳定性和安全性是非常重要的。

下面是第 4 版 patch 的邮件:

[PATCH v4 0/3] Drop ignore_memory_transaction_failures for xilink_zy

Hi, maintainer,Following the reference from the chip manualug585-Zynq-7000-TRM manualB.3 (Module Summary), placeholders have been added for all unimplementeddevices, including the AXI and AMBA bus controllers that interact withthe FPGA.We can check against the manual by printing the address space of thezynq board with the following qemu command:    ${QEMU_PATH}/qemu-system-aarch64 \    -M xilinx-zynq-a9 \    -display none \    -monitor stdio -s    (qemu) info mtree -fThe testing methodology previously discussed in earlier email exchangeswill not be repeated here.Chao Liu (3):  xilink_zynq: Add various missing unimplemented devices  xilink-zynq-devcfg: Fix up for memory address range size not set    correctly  xilink-zynq-devcfg: Avoid disabling devcfg memory region during    initialization hw/arm/xilinx_zynq.c              | 71 ++++++++++++++++++++++++++++++- hw/dma/xlnx-zynq-devcfg.c         |  9 +++- include/hw/dma/xlnx-zynq-devcfg.h |  2 +- 3 files changed, 78 insertions(+), 4 deletions(-)

PATCH v3(2024-10-06)

[PATCH v3 0/2] Drop ignore_memory_transaction_failures for xilink_zy

Hi all,Following the Zynq-7000 SoC Data Sheet's "Memory Map" section (referenced at [1]),We have identified the need to create placeholders for unimplemented devicesacross the entire range of Zynq-7000 series boards.This effort aims at ensuring maximum compatibility with different modelswithin the series.The following table summarizes the relevant memory map addressesfor the Zynq-7000:    Start Address  Size (MB)       Description    0x0000_0000    1,024           DDR DRAM and on-chip memory (OCM)    0x4000_0000    1,024           PL AXI slave port #0    0x8000_0000    1,024           PL AXI slave port #1    0xE000_0000    256             IOP devices    0xF000_0000    128             Reserved    0xF800_0000    32              Programmable registers access via AMBA APB bus    0xFA00_0000    32              Reserved    0xFC00_0000    64 MB - 256 KB  Quad-SPI linear address base address (except                                   to 256 KB which is in OCM), 64 MB reserved,                                   only 32 MB is currently supported    0xFFFC_0000    256 KB          OCM when mapped to high address spaceFor the purposes of this patch, we will not be creating placeholders forDRAM and any reserved regions of the address space.A test script has been developed that covers the most common board types ofthe Zynq-7000 series.The test script obtained all linux binary images of the zynq-7000 series boardsfrom xilinx-wiki for script testing(referenced at [2]).The steps to run the test are as follows:    a) Clone the repository.    git clone -b xilinx-zynq-test https://github.com/gevico/qemu-board.git    b) Apply the patch attached to this email and compile QEMU.    c) Set the environment variable for the path to your QEMU.    export QEMU_PATH=<your qemu path>    d) Execute the testing script.    ./qemu-zynq-test    e) Check the results.    If successful, the output should resemble the following:    Test Project: <your path>/qemu-board/hw/arm/xilinx-zynq        Start 1: xilinx-zynq.zc702    1/3 Test #1: xilinx-zynq.zc702 ......................   Passed        Start 2: xilinx-zynq.zc706    2/3 Test #2: xilinx-zynq.zc706 ......................   Passed        Start 3: xilinx-zynq.zed      3/3 Test #3: xilinx-zynq.zed   ......................   Passed    All tests passedSee:[1]: https://www.amd.com/content/dam/xilinx/support/documents/data_sheets/ds190-Zynq-7000-Overview.pdf[2]: http://www.wiki.xilinx.com/Zynq+2016.2+Release

PATCH v2(2024-09-27)

There are two things we can do:(1) We can leave the ignore_memory_transaction_failuresflag set. This is safe (no behaviour change) but not theright (matching the hardware) behaviour. The main reasonto do this is if we don't feel we have enough access toa range of guest code to test the other approach.(2) We can clear the flag. This is preferable (it matches thehardware). But the requirement to do this is that (a) we must make the best effort we can to be sure we've     put unimplemented-device placeholders for specific     devices we don't yet model (by checking e.g. the     hardware documentation for the SoC and board model,     the device tree, etc) (b) we do the most wide-ranging testing of guest code that     we can. This checks that we didn't miss anything in (a).I don't mind which of these we do. What I was asking in mycomments on version one of your patch was for how we weredoing on requirement 2b.

“增加了一个 znyq.umip 设备,用来覆盖 GPA 的 32 位地址空间” 的方法,并不是一个更通用和标准的做法。

移除 ignore_memory_transaction_failures flag 是可行的,基于(2b)所述,更优的做法是利用客户机程序进行更加广泛的测试。

下一步工作,主要集中在两方面,以 xilinx_zynq 为例:

最后再彻底移除 ignore_memory_transaction_failures 标志。

Re: [PATCH v2 0/2] Drop ignore_memory_transaction_failures for xilink_zy

PATCH v1(2024-09-25)