[Qemu-devel] [PATCH] target-xtensa: fix guest hang on masked CCOMPARE interrupt

[Qemu-devel] [PATCH] target-xtensa: fix guest hang on masked CCOMPARE interrupt

[Max Filippov]

QEMU timer is used to post CCOMPARE interrupt when the core is halted.
If that CCOMPARE interrupt is masked off then the timer must be rearmed
in the callback, otherwise it will be rearmed next time the core goes to
halt by the waiti instruction.

Add test case into timer testsuite.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
---
 hw/xtensa_pic.c           |   27 ++++++++++++++++++-
 target-xtensa/cpu.h       |    1 +
 target-xtensa/op_helper.c |   18 ++----------
 tests/xtensa/test_timer.S |   63 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 93 insertions(+), 16 deletions(-)

diff --git a/hw/xtensa_pic.c b/hw/xtensa_pic.c
index 3033ae2..e5085ea 100644
--- a/hw/xtensa_pic.c
+++ b/hw/xtensa_pic.c
@@ -116,10 +116,35 @@ void xtensa_timer_irq(CPUState *env, uint32_t id, uint32_t active)
     qemu_set_irq(env->irq_inputs[env->config->timerint[id]], active);
 }
 
+void xtensa_rearm_ccompare_timer(CPUState *env)
+{
+    int i;
+    uint32_t wake_ccount = env->sregs[CCOUNT] - 1;
+
+    for (i = 0; i < env->config->nccompare; ++i) {
+        if (env->sregs[CCOMPARE + i] - env->sregs[CCOUNT] <
+                wake_ccount - env->sregs[CCOUNT]) {
+            wake_ccount = env->sregs[CCOMPARE + i];
+        }
+    }
+    env->wake_ccount = wake_ccount;
+    qemu_mod_timer(env->ccompare_timer, env->halt_clock +
+            muldiv64(wake_ccount - env->sregs[CCOUNT],
+                1000000, env->config->clock_freq_khz));
+}
+
 static void xtensa_ccompare_cb(void *opaque)
 {
     CPUState *env = opaque;
-    xtensa_advance_ccount(env, env->wake_ccount - env->sregs[CCOUNT]);
+
+    if (env->halted) {
+        env->halt_clock = qemu_get_clock_ns(vm_clock);
+        xtensa_advance_ccount(env, env->wake_ccount - env->sregs[CCOUNT]);
+        if (!cpu_has_work(env)) {
+            env->sregs[CCOUNT] = env->wake_ccount + 1;
+            xtensa_rearm_ccompare_timer(env);
+        }
+    }
 }
 
 void xtensa_irq_init(CPUState *env)
diff --git a/target-xtensa/cpu.h b/target-xtensa/cpu.h
index 339075d..966f515 100644
--- a/target-xtensa/cpu.h
+++ b/target-xtensa/cpu.h
@@ -313,6 +313,7 @@ void check_interrupts(CPUXtensaState *s);
 void xtensa_irq_init(CPUState *env);
 void xtensa_advance_ccount(CPUState *env, uint32_t d);
 void xtensa_timer_irq(CPUState *env, uint32_t id, uint32_t active);
+void xtensa_rearm_ccompare_timer(CPUState *env);
 int cpu_xtensa_signal_handler(int host_signum, void *pinfo, void *puc);
 void xtensa_cpu_list(FILE *f, fprintf_function cpu_fprintf);
 void xtensa_sync_window_from_phys(CPUState *env);
diff --git a/target-xtensa/op_helper.c b/target-xtensa/op_helper.c
index 64847fc..0605611 100644
--- a/target-xtensa/op_helper.c
+++ b/target-xtensa/op_helper.c
@@ -370,23 +370,11 @@ void HELPER(waiti)(uint32_t pc, uint32_t intlevel)
         return;
     }
 
-    if (xtensa_option_enabled(env->config, XTENSA_OPTION_TIMER_INTERRUPT)) {
-        int i;
-        uint32_t wake_ccount = env->sregs[CCOUNT] - 1;
-
-        for (i = 0; i < env->config->nccompare; ++i) {
-            if (env->sregs[CCOMPARE + i] - env->sregs[CCOUNT] <
-                    wake_ccount - env->sregs[CCOUNT]) {
-                wake_ccount = env->sregs[CCOMPARE + i];
-            }
-        }
-        env->wake_ccount = wake_ccount;
-        qemu_mod_timer(env->ccompare_timer, qemu_get_clock_ns(vm_clock) +
-                muldiv64(wake_ccount - env->sregs[CCOUNT],
-                    1000000, env->config->clock_freq_khz));
-    }
     env->halt_clock = qemu_get_clock_ns(vm_clock);
     env->halted = 1;
+    if (xtensa_option_enabled(env->config, XTENSA_OPTION_TIMER_INTERRUPT)) {
+        xtensa_rearm_ccompare_timer(env);
+    }
     HELPER(exception)(EXCP_HLT);
 }
 
diff --git a/tests/xtensa/test_timer.S b/tests/xtensa/test_timer.S
index ede6395..1041cc6 100644
--- a/tests/xtensa/test_timer.S
+++ b/tests/xtensa/test_timer.S
@@ -14,6 +14,7 @@ test ccompare
     wsr     a2, intenable
     rsr     a2, interrupt
     wsr     a2, intclear
+    movi    a2, 0
     wsr     a2, ccompare1
     wsr     a2, ccompare2
 
@@ -37,6 +38,7 @@ test ccompare0_interrupt
     wsr     a2, intenable
     rsr     a2, interrupt
     wsr     a2, intclear
+    movi    a2, 0
     wsr     a2, ccompare1
     wsr     a2, ccompare2
 
@@ -66,6 +68,7 @@ test ccompare1_interrupt
     wsr     a2, intenable
     rsr     a2, interrupt
     wsr     a2, intclear
+    movi    a2, 0
     wsr     a2, ccompare0
     wsr     a2, ccompare2
 
@@ -92,6 +95,7 @@ test ccompare2_interrupt
     wsr     a2, intenable
     rsr     a2, interrupt
     wsr     a2, intclear
+    movi    a2, 0
     wsr     a2, ccompare0
     wsr     a2, ccompare1
 
@@ -112,4 +116,63 @@ test ccompare2_interrupt
 2:
 test_end
 
+test ccompare_interrupt_masked
+    set_vector kernel, 2f
+    movi    a2, 0
+    wsr     a2, intenable
+    rsr     a2, interrupt
+    wsr     a2, intclear
+    movi    a2, 0
+    wsr     a2, ccompare2
+
+    movi    a3, 40
+    rsr     a2, ccount
+    addi    a2, a2, 20
+    wsr     a2, ccompare1
+    addi    a2, a2, 20
+    wsr     a2, ccompare0
+    rsync
+    rsr     a2, interrupt
+    assert  eqi, a2, 0
+
+    movi    a2, 0x40
+    wsr     a2, intenable
+    rsil    a2, 0
+    loop    a3, 1f
+    nop
+1:
+    test_fail
+2:
+    rsr     a2, exccause
+    assert  eqi, a2, 4 /* LEVEL1_INTERRUPT_CAUSE */
+test_end
+
+test ccompare_interrupt_masked_waiti
+    set_vector kernel, 2f
+    movi    a2, 0
+    wsr     a2, intenable
+    rsr     a2, interrupt
+    wsr     a2, intclear
+    movi    a2, 0
+    wsr     a2, ccompare2
+
+    movi    a3, 40
+    rsr     a2, ccount
+    addi    a2, a2, 20
+    wsr     a2, ccompare1
+    addi    a2, a2, 20
+    wsr     a2, ccompare0
+    rsync
+    rsr     a2, interrupt
+    assert  eqi, a2, 0
+
+    movi    a2, 0x40
+    wsr     a2, intenable
+    waiti   0
+    test_fail
+2:
+    rsr     a2, exccause
+    assert  eqi, a2, 4 /* LEVEL1_INTERRUPT_CAUSE */
+test_end
+
 test_suite_end
-- 
1.7.6.4

[Qemu-devel] [PATCH] target-xtensa: update qemu-doc.texi

[Max Filippov]

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
---
 qemu-doc.texi  |   55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 qemu-tech.texi |   40 +++++++++++++++++++++++++++++++++-------
 2 files changed, 88 insertions(+), 7 deletions(-)

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 31199f6..ad19b73 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -110,6 +110,7 @@ For system emulation, the following hardware targets are supported:
 @item Syborg SVP base model (ARM Cortex-A8).
 @item AXIS-Devboard88 (CRISv32 ETRAX-FS).
 @item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
+@item Avnet LX60/LX110/LX200 boards (Xtensa)
 @end itemize
 
 @cindex supported user mode targets
@@ -1446,6 +1447,7 @@ differences are mentioned in the following sections.
 * Cris System emulator::
 * Microblaze System emulator::
 * SH4 System emulator::
+* Xtensa System emulator::
 @end menu
 
 @node PowerPC System emulator
@@ -2124,6 +2126,59 @@ TODO
 
 TODO
 
+@node Xtensa System emulator
+@section Xtensa System emulator
+@cindex system emulation (Xtensa)
+
+Two executables cover simulation of both Xtensa endian options,
+@file{qemu-system-xtensa} and @file{qemu-system-xtensaeb}.
+Two different machine types are emulated:
+
+@itemize @minus
+@item
+Xtensa emulator pseudo board "sim"
+@item
+Avnet LX60/LX110/LX200 board
+@end itemize
+
+The sim pseudo board emulation provides an environment similiar
+to one provided by the proprietary Tensilica ISS.
+It supports:
+
+@itemize @minus
+@item
+A range of Xtensa CPUs, default is the DC232B
+@item
+Console and filesystem access via semihosting calls
+@end itemize
+
+The Avnet LX60/LX110/LX200 emulation supports:
+
+@itemize @minus
+@item
+A range of Xtensa CPUs, default is the DC232B
+@item
+16550 UART
+@item
+OpenCores 10/100 Mbps Ethernet MAC
+@end itemize
+
+@c man begin OPTIONS
+
+The following options are specific to the Xtensa emulation:
+
+@table @option
+
+@item -semihosting
+Enable semihosting syscall emulation.
+
+Xtensa semihosting provides basic file IO calls, such as open/read/write/seek/select.
+Tensilica baremetal libc for ISS and linux platform "sim" use this interface.
+
+Note that this allows guest direct access to the host filesystem,
+so should only be used with trusted guest OS.
+
+@end table
 @node QEMU User space emulator
 @chapter QEMU User space emulator
 
diff --git a/qemu-tech.texi b/qemu-tech.texi
index 138e3ce..c6bdc28 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -42,13 +42,14 @@
 @chapter Introduction
 
 @menu
-* intro_features::        Features
-* intro_x86_emulation::   x86 and x86-64 emulation
-* intro_arm_emulation::   ARM emulation
-* intro_mips_emulation::  MIPS emulation
-* intro_ppc_emulation::   PowerPC emulation
-* intro_sparc_emulation:: Sparc32 and Sparc64 emulation
-* intro_other_emulation:: Other CPU emulation
+* intro_features::         Features
+* intro_x86_emulation::    x86 and x86-64 emulation
+* intro_arm_emulation::    ARM emulation
+* intro_mips_emulation::   MIPS emulation
+* intro_ppc_emulation::    PowerPC emulation
+* intro_sparc_emulation::  Sparc32 and Sparc64 emulation
+* intro_xtensa_emulation:: MIPS emulation
+* intro_other_emulation::  Other CPU emulation
 @end menu
 
 @node intro_features
@@ -259,6 +260,31 @@ Current QEMU limitations:
 
 @end itemize
 
+@node intro_xtensa_emulation
+@section Xtensa emulation
+
+@itemize
+
+@item Core Xtensa ISA emulation, including most options: code density,
+loop, extended L32R, 16- and 32-bit multiplication, 32-bit division,
+MAC16, miscellaneous operations, boolean, multiprocessor synchronization,
+conditional store, exceptions, relocatable vectors, unaligned exception,
+interrupts (including high priority and timer), hardware alignment,
+region protection, region translation, MMU, windowed registers, thread
+pointer, processor ID.
+
+@item Not implemented options: FP coprocessor, coprocessor context,
+data/instruction cache (including cache prefetch and locking), XLMI,
+processor interface, debug. Also options not covered by the core ISA
+(e.g. FLIX, wide branches) are not implemented.
+
+@item Can run most Xtensa Linux binaries.
+
+@item New core configuration that requires no additional instructions
+may be created from overlay with minimal amount of hand-written code.
+
+@end itemize
+
 @node intro_other_emulation
 @section Other CPU emulation
 
-- 
1.7.6.4

[Qemu-devel] [PATCH v2] target-xtensa: update qemu-doc.texi

[Max Filippov]

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
---
v1 -> v2 change: fix menu item text in qemu-tech.texi
---
 qemu-doc.texi  |   55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 qemu-tech.texi |   40 +++++++++++++++++++++++++++++++++-------
 2 files changed, 88 insertions(+), 7 deletions(-)

diff --git a/qemu-doc.texi b/qemu-doc.texi
index 31199f6..ad19b73 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -110,6 +110,7 @@ For system emulation, the following hardware targets are supported:
 @item Syborg SVP base model (ARM Cortex-A8).
 @item AXIS-Devboard88 (CRISv32 ETRAX-FS).
 @item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
+@item Avnet LX60/LX110/LX200 boards (Xtensa)
 @end itemize
 
 @cindex supported user mode targets
@@ -1446,6 +1447,7 @@ differences are mentioned in the following sections.
 * Cris System emulator::
 * Microblaze System emulator::
 * SH4 System emulator::
+* Xtensa System emulator::
 @end menu
 
 @node PowerPC System emulator
@@ -2124,6 +2126,59 @@ TODO
 
 TODO
 
+@node Xtensa System emulator
+@section Xtensa System emulator
+@cindex system emulation (Xtensa)
+
+Two executables cover simulation of both Xtensa endian options,
+@file{qemu-system-xtensa} and @file{qemu-system-xtensaeb}.
+Two different machine types are emulated:
+
+@itemize @minus
+@item
+Xtensa emulator pseudo board "sim"
+@item
+Avnet LX60/LX110/LX200 board
+@end itemize
+
+The sim pseudo board emulation provides an environment similiar
+to one provided by the proprietary Tensilica ISS.
+It supports:
+
+@itemize @minus
+@item
+A range of Xtensa CPUs, default is the DC232B
+@item
+Console and filesystem access via semihosting calls
+@end itemize
+
+The Avnet LX60/LX110/LX200 emulation supports:
+
+@itemize @minus
+@item
+A range of Xtensa CPUs, default is the DC232B
+@item
+16550 UART
+@item
+OpenCores 10/100 Mbps Ethernet MAC
+@end itemize
+
+@c man begin OPTIONS
+
+The following options are specific to the Xtensa emulation:
+
+@table @option
+
+@item -semihosting
+Enable semihosting syscall emulation.
+
+Xtensa semihosting provides basic file IO calls, such as open/read/write/seek/select.
+Tensilica baremetal libc for ISS and linux platform "sim" use this interface.
+
+Note that this allows guest direct access to the host filesystem,
+so should only be used with trusted guest OS.
+
+@end table
 @node QEMU User space emulator
 @chapter QEMU User space emulator
 
diff --git a/qemu-tech.texi b/qemu-tech.texi
index 138e3ce..397b070 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -42,13 +42,14 @@
 @chapter Introduction
 
 @menu
-* intro_features::        Features
-* intro_x86_emulation::   x86 and x86-64 emulation
-* intro_arm_emulation::   ARM emulation
-* intro_mips_emulation::  MIPS emulation
-* intro_ppc_emulation::   PowerPC emulation
-* intro_sparc_emulation:: Sparc32 and Sparc64 emulation
-* intro_other_emulation:: Other CPU emulation
+* intro_features::         Features
+* intro_x86_emulation::    x86 and x86-64 emulation
+* intro_arm_emulation::    ARM emulation
+* intro_mips_emulation::   MIPS emulation
+* intro_ppc_emulation::    PowerPC emulation
+* intro_sparc_emulation::  Sparc32 and Sparc64 emulation
+* intro_xtensa_emulation:: Xtensa emulation
+* intro_other_emulation::  Other CPU emulation
 @end menu
 
 @node intro_features
@@ -259,6 +260,31 @@ Current QEMU limitations:
 
 @end itemize
 
+@node intro_xtensa_emulation
+@section Xtensa emulation
+
+@itemize
+
+@item Core Xtensa ISA emulation, including most options: code density,
+loop, extended L32R, 16- and 32-bit multiplication, 32-bit division,
+MAC16, miscellaneous operations, boolean, multiprocessor synchronization,
+conditional store, exceptions, relocatable vectors, unaligned exception,
+interrupts (including high priority and timer), hardware alignment,
+region protection, region translation, MMU, windowed registers, thread
+pointer, processor ID.
+
+@item Not implemented options: FP coprocessor, coprocessor context,
+data/instruction cache (including cache prefetch and locking), XLMI,
+processor interface, debug. Also options not covered by the core ISA
+(e.g. FLIX, wide branches) are not implemented.
+
+@item Can run most Xtensa Linux binaries.
+
+@item New core configuration that requires no additional instructions
+may be created from overlay with minimal amount of hand-written code.
+
+@end itemize
+
 @node intro_other_emulation
 @section Other CPU emulation
 
-- 
1.7.2.5

Re: [Qemu-devel] [PATCH] target-xtensa: update qemu-doc.texi

[Blue Swirl]

Thanks, applied.

On Mon, Oct 10, 2011 at 2:25 AM, Max Filippov <jcmvbkbc@gmail.com> wrote:
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
>  qemu-doc.texi  |   55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  qemu-tech.texi |   40 +++++++++++++++++++++++++++++++++-------
>  2 files changed, 88 insertions(+), 7 deletions(-)
>
> diff --git a/qemu-doc.texi b/qemu-doc.texi
> index 31199f6..ad19b73 100644
> --- a/qemu-doc.texi
> +++ b/qemu-doc.texi
> @@ -110,6 +110,7 @@ For system emulation, the following hardware targets are supported:
>  @item Syborg SVP base model (ARM Cortex-A8).
>  @item AXIS-Devboard88 (CRISv32 ETRAX-FS).
>  @item Petalogix Spartan 3aDSP1800 MMU ref design (MicroBlaze).
> +@item Avnet LX60/LX110/LX200 boards (Xtensa)
>  @end itemize
>
>  @cindex supported user mode targets
> @@ -1446,6 +1447,7 @@ differences are mentioned in the following sections.
>  * Cris System emulator::
>  * Microblaze System emulator::
>  * SH4 System emulator::
> +* Xtensa System emulator::
>  @end menu
>
>  @node PowerPC System emulator
> @@ -2124,6 +2126,59 @@ TODO
>
>  TODO
>
> +@node Xtensa System emulator
> +@section Xtensa System emulator
> +@cindex system emulation (Xtensa)
> +
> +Two executables cover simulation of both Xtensa endian options,
> +@file{qemu-system-xtensa} and @file{qemu-system-xtensaeb}.
> +Two different machine types are emulated:
> +
> +@itemize @minus
> +@item
> +Xtensa emulator pseudo board "sim"
> +@item
> +Avnet LX60/LX110/LX200 board
> +@end itemize
> +
> +The sim pseudo board emulation provides an environment similiar
> +to one provided by the proprietary Tensilica ISS.
> +It supports:
> +
> +@itemize @minus
> +@item
> +A range of Xtensa CPUs, default is the DC232B
> +@item
> +Console and filesystem access via semihosting calls
> +@end itemize
> +
> +The Avnet LX60/LX110/LX200 emulation supports:
> +
> +@itemize @minus
> +@item
> +A range of Xtensa CPUs, default is the DC232B
> +@item
> +16550 UART
> +@item
> +OpenCores 10/100 Mbps Ethernet MAC
> +@end itemize
> +
> +@c man begin OPTIONS
> +
> +The following options are specific to the Xtensa emulation:
> +
> +@table @option
> +
> +@item -semihosting
> +Enable semihosting syscall emulation.
> +
> +Xtensa semihosting provides basic file IO calls, such as open/read/write/seek/select.
> +Tensilica baremetal libc for ISS and linux platform "sim" use this interface.
> +
> +Note that this allows guest direct access to the host filesystem,
> +so should only be used with trusted guest OS.
> +
> +@end table
>  @node QEMU User space emulator
>  @chapter QEMU User space emulator
>
> diff --git a/qemu-tech.texi b/qemu-tech.texi
> index 138e3ce..c6bdc28 100644
> --- a/qemu-tech.texi
> +++ b/qemu-tech.texi
> @@ -42,13 +42,14 @@
>  @chapter Introduction
>
>  @menu
> -* intro_features::        Features
> -* intro_x86_emulation::   x86 and x86-64 emulation
> -* intro_arm_emulation::   ARM emulation
> -* intro_mips_emulation::  MIPS emulation
> -* intro_ppc_emulation::   PowerPC emulation
> -* intro_sparc_emulation:: Sparc32 and Sparc64 emulation
> -* intro_other_emulation:: Other CPU emulation
> +* intro_features::         Features
> +* intro_x86_emulation::    x86 and x86-64 emulation
> +* intro_arm_emulation::    ARM emulation
> +* intro_mips_emulation::   MIPS emulation
> +* intro_ppc_emulation::    PowerPC emulation
> +* intro_sparc_emulation::  Sparc32 and Sparc64 emulation
> +* intro_xtensa_emulation:: MIPS emulation
> +* intro_other_emulation::  Other CPU emulation
>  @end menu
>
>  @node intro_features
> @@ -259,6 +260,31 @@ Current QEMU limitations:
>
>  @end itemize
>
> +@node intro_xtensa_emulation
> +@section Xtensa emulation
> +
> +@itemize
> +
> +@item Core Xtensa ISA emulation, including most options: code density,
> +loop, extended L32R, 16- and 32-bit multiplication, 32-bit division,
> +MAC16, miscellaneous operations, boolean, multiprocessor synchronization,
> +conditional store, exceptions, relocatable vectors, unaligned exception,
> +interrupts (including high priority and timer), hardware alignment,
> +region protection, region translation, MMU, windowed registers, thread
> +pointer, processor ID.
> +
> +@item Not implemented options: FP coprocessor, coprocessor context,
> +data/instruction cache (including cache prefetch and locking), XLMI,
> +processor interface, debug. Also options not covered by the core ISA
> +(e.g. FLIX, wide branches) are not implemented.
> +
> +@item Can run most Xtensa Linux binaries.
> +
> +@item New core configuration that requires no additional instructions
> +may be created from overlay with minimal amount of hand-written code.
> +
> +@end itemize
> +
>  @node intro_other_emulation
>  @section Other CPU emulation
>
> --
> 1.7.6.4
>
>
>

Re: [Qemu-devel] [PATCH] target-xtensa: fix guest hang on masked CCOMPARE interrupt

[Blue Swirl]

Thanks, applied.

On Mon, Oct 10, 2011 at 2:25 AM, Max Filippov <jcmvbkbc@gmail.com> wrote:
> QEMU timer is used to post CCOMPARE interrupt when the core is halted.
> If that CCOMPARE interrupt is masked off then the timer must be rearmed
> in the callback, otherwise it will be rearmed next time the core goes to
> halt by the waiti instruction.
>
> Add test case into timer testsuite.
>
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
>  hw/xtensa_pic.c           |   27 ++++++++++++++++++-
>  target-xtensa/cpu.h       |    1 +
>  target-xtensa/op_helper.c |   18 ++----------
>  tests/xtensa/test_timer.S |   63 +++++++++++++++++++++++++++++++++++++++++++++
>  4 files changed, 93 insertions(+), 16 deletions(-)
>
> diff --git a/hw/xtensa_pic.c b/hw/xtensa_pic.c
> index 3033ae2..e5085ea 100644
> --- a/hw/xtensa_pic.c
> +++ b/hw/xtensa_pic.c
> @@ -116,10 +116,35 @@ void xtensa_timer_irq(CPUState *env, uint32_t id, uint32_t active)
>     qemu_set_irq(env->irq_inputs[env->config->timerint[id]], active);
>  }
>
> +void xtensa_rearm_ccompare_timer(CPUState *env)
> +{
> +    int i;
> +    uint32_t wake_ccount = env->sregs[CCOUNT] - 1;
> +
> +    for (i = 0; i < env->config->nccompare; ++i) {
> +        if (env->sregs[CCOMPARE + i] - env->sregs[CCOUNT] <
> +                wake_ccount - env->sregs[CCOUNT]) {
> +            wake_ccount = env->sregs[CCOMPARE + i];
> +        }
> +    }
> +    env->wake_ccount = wake_ccount;
> +    qemu_mod_timer(env->ccompare_timer, env->halt_clock +
> +            muldiv64(wake_ccount - env->sregs[CCOUNT],
> +                1000000, env->config->clock_freq_khz));
> +}
> +
>  static void xtensa_ccompare_cb(void *opaque)
>  {
>     CPUState *env = opaque;
> -    xtensa_advance_ccount(env, env->wake_ccount - env->sregs[CCOUNT]);
> +
> +    if (env->halted) {
> +        env->halt_clock = qemu_get_clock_ns(vm_clock);
> +        xtensa_advance_ccount(env, env->wake_ccount - env->sregs[CCOUNT]);
> +        if (!cpu_has_work(env)) {
> +            env->sregs[CCOUNT] = env->wake_ccount + 1;
> +            xtensa_rearm_ccompare_timer(env);
> +        }
> +    }
>  }
>
>  void xtensa_irq_init(CPUState *env)
> diff --git a/target-xtensa/cpu.h b/target-xtensa/cpu.h
> index 339075d..966f515 100644
> --- a/target-xtensa/cpu.h
> +++ b/target-xtensa/cpu.h
> @@ -313,6 +313,7 @@ void check_interrupts(CPUXtensaState *s);
>  void xtensa_irq_init(CPUState *env);
>  void xtensa_advance_ccount(CPUState *env, uint32_t d);
>  void xtensa_timer_irq(CPUState *env, uint32_t id, uint32_t active);
> +void xtensa_rearm_ccompare_timer(CPUState *env);
>  int cpu_xtensa_signal_handler(int host_signum, void *pinfo, void *puc);
>  void xtensa_cpu_list(FILE *f, fprintf_function cpu_fprintf);
>  void xtensa_sync_window_from_phys(CPUState *env);
> diff --git a/target-xtensa/op_helper.c b/target-xtensa/op_helper.c
> index 64847fc..0605611 100644
> --- a/target-xtensa/op_helper.c
> +++ b/target-xtensa/op_helper.c
> @@ -370,23 +370,11 @@ void HELPER(waiti)(uint32_t pc, uint32_t intlevel)
>         return;
>     }
>
> -    if (xtensa_option_enabled(env->config, XTENSA_OPTION_TIMER_INTERRUPT)) {
> -        int i;
> -        uint32_t wake_ccount = env->sregs[CCOUNT] - 1;
> -
> -        for (i = 0; i < env->config->nccompare; ++i) {
> -            if (env->sregs[CCOMPARE + i] - env->sregs[CCOUNT] <
> -                    wake_ccount - env->sregs[CCOUNT]) {
> -                wake_ccount = env->sregs[CCOMPARE + i];
> -            }
> -        }
> -        env->wake_ccount = wake_ccount;
> -        qemu_mod_timer(env->ccompare_timer, qemu_get_clock_ns(vm_clock) +
> -                muldiv64(wake_ccount - env->sregs[CCOUNT],
> -                    1000000, env->config->clock_freq_khz));
> -    }
>     env->halt_clock = qemu_get_clock_ns(vm_clock);
>     env->halted = 1;
> +    if (xtensa_option_enabled(env->config, XTENSA_OPTION_TIMER_INTERRUPT)) {
> +        xtensa_rearm_ccompare_timer(env);
> +    }
>     HELPER(exception)(EXCP_HLT);
>  }
>
> diff --git a/tests/xtensa/test_timer.S b/tests/xtensa/test_timer.S
> index ede6395..1041cc6 100644
> --- a/tests/xtensa/test_timer.S
> +++ b/tests/xtensa/test_timer.S
> @@ -14,6 +14,7 @@ test ccompare
>     wsr     a2, intenable
>     rsr     a2, interrupt
>     wsr     a2, intclear
> +    movi    a2, 0
>     wsr     a2, ccompare1
>     wsr     a2, ccompare2
>
> @@ -37,6 +38,7 @@ test ccompare0_interrupt
>     wsr     a2, intenable
>     rsr     a2, interrupt
>     wsr     a2, intclear
> +    movi    a2, 0
>     wsr     a2, ccompare1
>     wsr     a2, ccompare2
>
> @@ -66,6 +68,7 @@ test ccompare1_interrupt
>     wsr     a2, intenable
>     rsr     a2, interrupt
>     wsr     a2, intclear
> +    movi    a2, 0
>     wsr     a2, ccompare0
>     wsr     a2, ccompare2
>
> @@ -92,6 +95,7 @@ test ccompare2_interrupt
>     wsr     a2, intenable
>     rsr     a2, interrupt
>     wsr     a2, intclear
> +    movi    a2, 0
>     wsr     a2, ccompare0
>     wsr     a2, ccompare1
>
> @@ -112,4 +116,63 @@ test ccompare2_interrupt
>  2:
>  test_end
>
> +test ccompare_interrupt_masked
> +    set_vector kernel, 2f
> +    movi    a2, 0
> +    wsr     a2, intenable
> +    rsr     a2, interrupt
> +    wsr     a2, intclear
> +    movi    a2, 0
> +    wsr     a2, ccompare2
> +
> +    movi    a3, 40
> +    rsr     a2, ccount
> +    addi    a2, a2, 20
> +    wsr     a2, ccompare1
> +    addi    a2, a2, 20
> +    wsr     a2, ccompare0
> +    rsync
> +    rsr     a2, interrupt
> +    assert  eqi, a2, 0
> +
> +    movi    a2, 0x40
> +    wsr     a2, intenable
> +    rsil    a2, 0
> +    loop    a3, 1f
> +    nop
> +1:
> +    test_fail
> +2:
> +    rsr     a2, exccause
> +    assert  eqi, a2, 4 /* LEVEL1_INTERRUPT_CAUSE */
> +test_end
> +
> +test ccompare_interrupt_masked_waiti
> +    set_vector kernel, 2f
> +    movi    a2, 0
> +    wsr     a2, intenable
> +    rsr     a2, interrupt
> +    wsr     a2, intclear
> +    movi    a2, 0
> +    wsr     a2, ccompare2
> +
> +    movi    a3, 40
> +    rsr     a2, ccount
> +    addi    a2, a2, 20
> +    wsr     a2, ccompare1
> +    addi    a2, a2, 20
> +    wsr     a2, ccompare0
> +    rsync
> +    rsr     a2, interrupt
> +    assert  eqi, a2, 0
> +
> +    movi    a2, 0x40
> +    wsr     a2, intenable
> +    waiti   0
> +    test_fail
> +2:
> +    rsr     a2, exccause
> +    assert  eqi, a2, 4 /* LEVEL1_INTERRUPT_CAUSE */
> +test_end
> +
>  test_suite_end
> --
> 1.7.6.4
>
>
>